unclassified-nsis-dropper: cbdff40b — inquiry_4387.exe, Deflate-compressed NSIS v3.06.1 with six encrypted payloads

Executive Summary

Eleventh confirmed sibling in the unclassified-nsis-dropper cluster. A Nullsoft Scriptable Install System (NSIS) v3.06.1 Unicode self-extractor compiled Aug 2020, masquerading as a business inquiry (inquiry_4387.exe). Unsigned (no certificate directory). Uses Deflate compression — a new variant in this cluster (prior siblings used LZMA or BZip2). Embeds six payloads in a Derms/ subdirectory inside the archive: four null-padded encrypted PEs, one high-entropy encrypted blob (thwack.Ins), one mid-entropy file (Abnormal78.Nep) that may be a PowerShell cradle, and one Danish word-salad text decoy (Rehang.txt). Static-only — CAPE skipped (no Windows guest).

What It Is

• SHA-256: cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889
• Filename: inquiry_4387.exe
• Size: 447,5 KiB (457 974 bytes)
• File type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections ^[file.txt]
• Compiler: MSVC 6.0 linker (MajorLinkerVersion 0x6, MinorLinkerVersion 0x0) ^[pefile.txt:44-47]
• Timestamp: 2020-08-01 02:45:20 UTC ^[pefile.txt:34]
• NSIS version: v3.06.1 Unicode exehead (manifest string Nullsoft Install System v3.06.1) ^[strings.txt:250]
• Certificate: Unsigned — IMAGE_DIRECTORY_ENTRY_SECURITY VirtualAddress = 0x0, Size = 0x0 ^[pefile.txt:193-195]
• Compression: Deflate (not LZMA, not BZip2) ^[binwalk.txt] — first Deflate variant observed in this cluster

Build / RE

Outer Loader

Standard NSIS v3.06.1 Unicode exehead stub. The .rsrc section holds 8 icon resources (RT_ICON, sizes 10828, 9624, 4296, 2152, 1384, 11544, 3752, 1128 bytes) — typical installer icon suite. No version-resource anomalies beyond the word-salad strings. The manifest declares requestedExecutionLevel level="asInvoker" — no elevation required. ^[strings.txt:250]

Version-Info Masquerade

Danish/Nordic-flavoured nonsense strings, consistent with the cluster template:

• FileDescription: dechifrerbare merceress
• InternalName: pompejansk husdyrsygdom.exe
• LegalCopyright: bellied peafowls saddelplads
• LegalTrademarks: stavede rilled kjoleskds
• ProductName: underkbers ^[exiftool.json:36-42]

Certificate

Unlike siblings 4978e16a through 5212423b (fabricated self-signed) and like siblings 3c63a3c0 and 11a56375, this sample is completely unsigned. The Security data directory is zeroed. This represents a third unsigned morph in the cluster.

Embedded Archive

Extracted via 7-Zip (NSIS-3 Unicode, Deflate method, solid = -, headers size = 8642, stub size = 131072):

The Droem.mul file carries a file utility signature of "Adobe Photoshop Color swatch" — a decoy/masquerade artefact likely inserted to confuse triage. ^[binwalk.txt]

The Abnormal78.Nep file has a non-zero density of 0.450 and entropy of 4.574, placing it between the high-entropy thwack.Ins and the null-padded PEs. Its byte distribution (many 0x00 but also runs of repeated printable-like values) suggests an encrypted or obfuscated script — possibly the Danish character-skip PowerShell cradle observed in siblings f7f089f7, b3fb616d, 78c5e8ca, 3a13583c, and 3c63a3c0. No plaintext PowerShell markers were recovered via single-byte XOR (keys 0x00–0xFF) or common multi-byte keys.

Anti-Analysis

• Gibberish filenames: thwack.Ins, Dramaers.arv, Droem.mul, Abnormal78.Nep, landbrugslov.con, Rehang.txt — computer-generated nonsense words consistent with the cluster's anti-triage naming convention.
• Null-padding: Four of six payloads are heavily zero-padded (density ~0.098), increasing raw file size and lowering entropy to evade heuristic triggers.
• Deflate compression: First observed in this cluster; prior siblings used LZMA:23 solid or BZip2. Minor toolchain variance.
• Unsigned: Absence of a certificate removes one heuristic signal (malware with stolen/fabricated certs often triggers faster than unsigned), but also reduces the sample's surface area for certificate-based clustering.

Deploy / ATT&CK

Static-only inference. CAPE skipped (no Windows guest). No dynamic-analysis.md present.

TTPs (inferred from static and cluster behaviour)

• T1204.002 — Malicious Link / User Execution: relies on social-engineering filename (inquiry_4387.exe — business-inquiry lure) ^[metadata.json:5]
• T1036.004 — Masquerade Task or Service: inquiry-document lure
• T1036.005 — Match Legitimate Name or Location: uses real NSIS installer framework
• T1574.002 — Hijack Execution Flow: NSIS stub hijacks legitimate installer trust model
• T1620 — Reflective Code Loading: inferred — inner payloads are encrypted and likely decrypted in memory by the NSIS script before execution

Persistence / C2

Not observable statically. Based on cluster siblings, the decrypted PowerShell cradle (if present in Abnormal78.Nep) would stage a secondary payload and establish persistence via registry Run keys or scheduled tasks. No hardcoded C2 URLs, IPs, or domains recovered from any extracted file.

Payload Staging Chain (hypothesized)

1. User executes inquiry_4387.exe (NSIS SFX)
2. NSIS stub extracts archive to temp directory
3. NSIS script decrypts one or more Derms/* payloads in memory
4. Decrypted payload(s) are executed via Exec or ShellExec NSIS instructions
5. If a PowerShell cradle is present (likely in Abnormal78.Nep), it performs reflective IEX loading of a secondary stage

Decompiled Behavior

Ghidra and capa were not run due to the NSIS installer limitation (capa explicitly warns it cannot handle installers well). ^[capa.txt] The exehead stub is the standard NSIS v3.06.1 open-source loader; malicious logic lives in the NSIS script and encrypted payloads, neither of which is a conventional PE code section.

C2 Infrastructure

No C2 indicators recovered statically. The cluster historically uses runtime-resolved HTTPS C2 via the decoded PowerShell cradle. No hardcoded infrastructure in this sample.

Interesting Tidbits

• Deflate first in cluster: All ten prior siblings used LZMA:23 solid (eight samples) or BZip2 (two samples: 3a13583c, 11a56375). This is the first Deflate-compressed sibling. The NSIS compiler allows method selection at build time (SetCompressor /SOLID lzma vs SetCompressor bzip2 vs default Deflate). This suggests the builder is not a single rigid pipeline but a configurable template.
• Third unsigned sibling: 3c63a3c0 (ninth) and 11a56375 (tenth) were unsigned. This sample makes three unsigned siblings out of eleven — ~27% unsigned rate. The builder appears to have a certificate toggle.
• Sixth payload count: Four null-padded PEs + one high-entropy blob + one mid-entropy script = six payloads, matching the payload count of siblings b3fb616d, 9c43b920, and 78c5e8ca.
• Danish decoy text: Rehang.txt contains museumshyldens nonambulaties filmologisk smedelrers exosporal naveness — same word-salad pattern as all prior siblings.
• No System.dll obfuscation: The $PLUGINSDIR/System.dll is the standard 6972-byte NSIS plugin; no custom plugin injection observed.

Deployable Signatures

YARA Rule

rule NSIS_Unclassified_Dropper_Cluster
{
    meta:
        description = "NSIS v3 Unicode self-extractor with Danish word-salad VS_VERSIONINFO and encrypted embedded payloads"
        author = "PacketPursuit"
        date = "2026-07-19"
        reference = "/intel/analyses/cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889.html"
        hash = "cbdff40bf525a8fdbb771e23e9da6463a380c7e6264236226a9909c8bc141889"
    strings:
        $nsis_manifest = "Nullsoft Install System v3" ascii wide
        $danish_1 = "dechifrerbare" ascii wide
        $danish_2 = "pompejansk" ascii wide
        $danish_3 = "husdyrsygdom" ascii wide
        $danish_4 = "saddelplads" ascii wide
        $danish_5 = "stavede rilled" ascii wide
        $danish_6 = "underkbers" ascii wide
        $exehead = "Nullsoft.NSIS.exehead" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        pe.number_of_sections == 5 and
        $nsis_manifest and
        ($exehead or 2 of ($danish_*)) and
        pe.exports("_main") == 0
}

Behavioral Fingerprint

This binary is a PE32 NSIS v3 Unicode self-extractor with five sections, MSVC 6.0 linker timestamp, and no code-signing certificate. The .rsrc section contains a standard NSIS manifest (Nullsoft Install System v3.xx) and 6–8 icon resources. The archive payload directory uses computer-generated gibberish filenames (e.g., Derms/thwack.Ins, Dramaers.arv) and contains 4–6 files: 2–4 null-padded encrypted PEs (entropy 1.2–1.3, non-zero density ~0.10), 1 high-entropy encrypted blob (entropy >7.0), and 1 Danish word-salad text decoy. Compression method varies across siblings (LZMA, BZip2, or Deflate). The VS_VERSIONINFO block uses Danish/Nordic nonsense strings for FileDescription, InternalName, LegalCopyright, and ProductName.

IOC List

Detection Signatures

No capa capabilities detected (installer limitation warning). ^[capa.txt] No yara matches beyond PE_File_Generic. ^[yara.txt]

References

• Entity page: unclassified-nsis-dropper
• Technique pages: nsis-lzma-embedded-payload, version-info-masquerade, character-skip-cipher-powershell-obfuscation
• Sibling analyses: raw/analyses/4978e16a.../report.md, raw/analyses/f7f089f7.../report.md, raw/analyses/11a56375.../report.md

Provenance

• file.txt — file utility output
• pefile.txt — pefile Python library PE header dump
• exiftool.json — ExifTool version-info extraction
• strings.txt — strings -a -n 6 output
• binwalk.txt — binwalk -B signature scan
• capa.txt — Mandiant flare-capa v7.0.1 capability detection (installer limitation warning)
• yara.txt — YARA generic PE rule match
• 7-Zip 23.01 — NSIS archive extraction and content listing
• python3 + math — entropy and non-zero density calculations on extracted payloads
• rabin2-info.txt — radare2 binary header summary
• metadata.json — OpenCTI artifact metadata