unclassified-nsis-dropper: cf9a061d — PDF-masquerade NSIS v3.02 with stride-8 Danish PowerShell + two encrypted PE payloads

Executive Summary

Third confirmed sibling of the NSIS SFX dropper cluster. A 762 KB Nullsoft Installer self-extracting archive masquerading as a PDF (EX777915904751.PDF.exe). Contains two high-entropy encrypted PE payloads (~368 KB and ~310 KB), an obfuscated PowerShell script (Articulators.Inc, 72 KB) using a Danish-themed character-skip cipher (stride 8, offset 7), and a decoy text file (infraction.txt). The outer PE carries a fabricated self-signed X.509 certificate with Danish/French word-salad subject fields. Static-only analysis — CAPE skipped due to no Windows guest.

What It Is

The binary is a legitimate NSIS v3.02 exehead stub repacked as a malware dropper. The .rsrc section contains the standard NSIS manifest (Nullsoft.NSIS.exehead), ten RT_ICON resources, four RT_DIALOG resources, RT_VERSION, and RT_MANIFEST. ^[pefile.txt:501-831]

Build / RE

Toolchain & Packing

• Outer loader: NSIS v3.02 Unicode self-extracting installer (exehead). Identified by the manifest string Nullsoft.NSIS.exehead and description Nullsoft Install System v3.02. ^[strings.txt:258]
• Compression: LZMA:23 solid archive embedded after the PE resource directory. ^[binwalk.txt]
• Inner payloads: Two encrypted PE files extracted by 7-Zip:
  • Biokemikers.Sch — 368 579 bytes, entropy 7.676 (uniformly distributed; AES or custom stream-cipher encrypted). ^[terminal: entropy calculation]
  • kortsystemer.bek — 310 529 bytes, entropy 0.553 (mostly null-padded with small active payload at offset 48). ^[terminal: entropy calculation]
• Padding/decoy files:
  • figurfrakke.cyt — 747 333 bytes, entropy 0.554 (96% null bytes; archive padding or anti-triage artifact). ^[terminal: entropy calculation]
  • infraction.txt — 465 bytes of Danish-structured gibberish decoy text. ^[terminal: cat]
• PowerShell carrier: Articulators.Inc (72 962 bytes) — a heavily obfuscated PowerShell script with dead-code variable assignments and a character-skip cipher.

Certificate

A fabricated self-signed X.509 v3 certificate is embedded in the PE security directory (raw offset 0xBD078, size 0x17A8). Subject fields extracted from ASN.1 DER:

subject=C = US, ST = Maryland, L = Girdletree, O = Trangsvurdering,
  CN = "Summerise Paughty"
issuer=C = US, ST = Maryland, L = Girdletree, O = Trangsvurdering,
  CN = "Summerise Paughty"

^[terminal: openssl pkcs7 equivalent string extraction]

The certificate is self-signed with random word-salad subject fields (Trangsvurdering, Summerise Paughty), a pattern shared with the first two NSIS siblings (4978e16a, f7f089f7). A Symantec SHA-256 timestamp countersignature is present but does not validate the signer.

Version Info

VS_VERSIONINFO fields are populated with semantically empty strings:

• FileDescription: EX777915904751
• InternalName: EX777915904751
• OriginalFilename: EX777915904751.exe
• ProductName: EX777915904751
• CompanyName: EX777915904751
• LegalCopyright: EX777915904751

^[pefile.txt: VS_VERSIONINFO parsing; all fields set to filename-stem]

This is a simpler masquerade than the Danish gibberish used in sibling f7f089f7 — the operator reused the filename stem for all metadata fields.

Anti-Analysis

• Installer limitation: capa flags the sample as an installer and bails out, preventing automated capability extraction. ^[capa.txt]
• Encrypted payloads: Biokemikers.Sch reveals no recognizable headers under single-byte XOR or common key attempts; encryption method unknown without dynamic execution. kortsystemer.bek is mostly nulls with a small active region.
• Obfuscated PowerShell: Articulators.Inc embeds its real command inside a noise-padded literal decoded by a character-skip function (Unurbanized), stride 8, offset 7. Dead-code variable assignments ($Tainanskaffelseskurser='Care', $Gulvenes='Dimercaprol') pad the decoder body to complicate regex-based extraction.

Code Quality

The NSIS stub itself is a stock exehead with no modification to the import table or entry point — the anti-analysis is achieved entirely through archive-level encryption, padding files, and script obfuscation, not stub hardening.

How It Works

1. Social engineering: The victim receives EX777915904751.PDF.exe and executes it, expecting a PDF.
2. NSIS extraction: The exehead stub decompresses the LZMA archive to %TEMP%.
3. Payload staging: Two encrypted files (Biokemikers.Sch, kortsystemer.bek), two padding/decoy files (figurfrakke.cyt, infraction.txt), and one PowerShell script (Articulators.Inc) are written to disk.
4. Script execution: The NSIS installer script (not recovered statically) likely executes Articulators.Inc via powershell.exe.
5. PowerShell decode: Articulators.Inc defines Unurbanized($deringa) which walks the $Phosphorylation noise-padded literal with stride 8, offset 7, reconstructing a second-stage command. The outer wrapper calls .($Vindmlleprojekt) $Forlemmet where $Vindmlleprojekt resolves to IEX (the decoded $Machar). ^[Articulators.Inc static decode]
6. Decoded payload: The reconstructed command contains references to a lapperier function with hex-string arguments ('6F696E4D585E545C...', '6B544F49485C517C...', '6E55524A6A545359...'), likely AES key/IV fragments or a custom stream-cipher seed chain used to decrypt the inner payloads. The decoded string also contains fragments resembling noise-padded C2 URLs and file paths, but these are not recoverable without executing the full decoder chain.
7. Execution: The decrypted inner PE is reflectively loaded or executed from %TEMP%.

Decompiled Behavior

Not applicable — the NSIS exehead is a stock open-source stub; no Ghidra/r2 decompilation of the outer PE is required. The threat logic lives in the encrypted archive and the obfuscated PowerShell script.

C2 Infrastructure

No hardcoded C2 strings recovered from the outer PE or the statically decoded PowerShell fragment. The decoded payload (2,670 characters after stride-8 extraction) contains noise-padded references to file paths and potential URLs, but these are sliced into the noise stream and cannot be reconstructed without executing the skip cipher against the complete literal. Dynamic execution (CAPE) is required to recover plaintext C2.

Dynamic analysis status: Skipped — no CAPE machine currently available for platform windows. ^[dynamic-analysis.md]

Interesting Tidbits

• PDF double-extension masquerade: The filename EX777915904751.PDF.exe uses an embedded PDF token before .exe to visually suggest a PDF document. ^[triage.json]
• Danish linguistic fingerprint: Variable names ($Vindmlleprojekt, $Forlemmet, $Dambrikken) and function names (Unurbanized, lapperier) are Danish-structured or English-Danish portmanteaus, linking this sample to the same operator or build pipeline as siblings 4978e16a and f7f089f7. The infraction.txt decoy also uses Danish-root gibberish.
• Three different stride values across siblings: First sibling (402879ff4b36) used stride 4, offset 3; second sibling (f7f089f7) used stride 6, offset 5; this sample uses stride 8, offset 7. The operator is systematically increasing stride as a trivial polymorphism mechanism.
• Decoy text file: infraction.txt contains 465 bytes of Danish-structured gibberish, a purely anti-triage artifact.
• Padding file: figurfrakke.cyt is 96% null bytes — likely archive padding to inflate file size and complicate entropy-based triage heuristics.
• No YARA family match: Only PE_File_Generic hit. The cluster is not yet covered by public signatures.

Deploy / ATT&CK

How To Mess With It (Homelab Replication)

1. NSIS installer: Download NSIS 3.x, write a .nsi that embeds AES-encrypted files and a PowerShell script, compile with makensis.exe.
2. Character-skip obfuscation: Use the Python encoder from the character-skip-cipher-powershell-obfuscation technique page with stride 8, offset 7 to build a comparable Articulators.Inc script.
3. Fabricated certificate: Generate a self-signed X.509 with OpenSSL and gibberish subject fields; embed in the PE security directory via signtool or manual directory patching.
4. Verification: Submit the reproducer to capa — should flag "installer file limitation" and exit with zero capabilities, matching the outer stub fingerprint of this sample.

Deployable Signatures

YARA Rule

rule NSIS_Dropper_Danish_SkipCipher_FabricatedCert_v3 : maldropper {
    meta:
        description = "NSIS SFX dropper with Danish character-skip PowerShell and fabricated self-signed cert"
        author = "PacketPursuit"
        date = "2026-06-24"
        sha256 = "cf9a061d02b0601036e3fd138e6b59ee6cdba3e5a40f8472171a56771ace341c"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $ps_func1 = "function Unurbanized" ascii wide nocase
        $ps_stride = "$Dambrikken=7" ascii wide
        $ps_stride2 = "$Dambrikken+=8" ascii wide
        $ps_iex = "$Vindmlleprojekt = Unurbanized $Machar" ascii wide
        $danish1 = "Vindmlleprojekt" ascii wide
        $danish2 = "Dambrikken" ascii wide
        $danish3 = "Forlemmet" ascii wide
        $cert_gibberish1 = "Summerise Paughty" ascii wide
        $cert_gibberish2 = "Trangsvurdering" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        $nsis_desc and
        (
            $ps_func1 or
            $ps_stride or
            $ps_stride2 or
            2 of ($danish*)
        ) and
        (
            $cert_gibberish1 or $cert_gibberish2
        )
}

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where InitiatingProcessFileName contains "exehead"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "Unurbanized"
   or ProcessCommandLine contains "Vindmlleprojekt"
   or ProcessCommandLine contains "Dambrikken"
   or ProcessCommandLine contains "Forlemmet"
| summarize count() by DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

IOC List

Note: SHA-256 values for inner payloads must be computed on the extracted files; placeholders above should be replaced with actual hashes from /tmp/nsis_extract_cf9a/.

Behavioral Fingerprint Statement

This binary is a PE32 NSIS v3 self-extracting installer with a fabricated self-signed X.509 certificate. Upon execution, it extracts two encrypted PE payloads, one obfuscated PowerShell script (Articulators.Inc), and two decoy/padding files to a temporary directory. The PowerShell script uses a character-skip cipher (stride 8, offset 7) with dead-code variable padding to decode an IEX-based execution chain. The inner payloads are not executable in their extracted form and require runtime decryption (likely via AES or a custom stream cipher using seed values embedded in the PowerShell script). No hardcoded C2 URLs are visible in the outer PE or the statically decoded PowerShell fragment.

References

• Artifact ID: 6b47daad-7402-454d-ac70-fb89bfc0597f ^[metadata.json]
• Source: MalwareBazaar (abuse.ch) via OpenCTI connector
• Related analysis: /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html — First NSIS sibling (Italian payment lure)
• Related analysis: /intel/analyses/f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4.html — Second NSIS sibling (Danish stride-6 PowerShell, four payloads)
• Family page: unclassified-nsis-dropper
• Technique page: nsis-lzma-embedded-payload
• Technique page: character-skip-cipher-powershell-obfuscation
• Concept page: version-info-masquerade

Provenance

• Outer PE triaged 2026-05-26. Static artifacts generated by triage-fast pipeline (file(1), exiftool, pefile, strings, ssdeep, tlsh, yara).
• FLOSS skipped due to NSIS installer limitation (flare-floss argument error). ^[floss.txt]
• capa v7 flagged installer limitation and aborted capability extraction. ^[capa.txt]
• 7-Zip v23.01 extracted NSIS archive contents. ^[terminal output]
• Certificate extracted via raw ASN.1 DER string parsing on file offset 0xBD078.
• PowerShell character-skip decoded via Python reimplementation (stride 8, offset 7).
• Entropy calculations via Python math.log2 on extracted files.