unclassified-nsis-dropper: f7f089f7 — Danish-character-skip PowerShell + four encrypted PE payload NSIS SFX

Executive Summary

Second confirmed sibling of the NSIS SFX dropper cluster. A 1.27 MB Nullsoft Installer self-extracting archive masquerading as a PDF (Quots-875-765-pdf.exe). Contains four high-entropy encrypted PE payloads (combined ~2.5 MB), a heavily obfuscated PowerShell dropper using a Danish-variable character-skip cipher (stride 6, offset 5), and a decoy text file. The outer PE carries a fabricated self-signed X.509 certificate with Danish/French word-salad subject fields and VS_VERSIONINFO populated with nonsense strings. Static-only analysis — CAPE skipped due to no Windows guest.

What It Is

The binary is a legitimate NSIS v3.12 exehead stub repacked as a malware dropper. The .rsrc section contains a standard NSIS manifest (Nullsoft.NSIS.exehead), eight RT_ICON resources, three RT_DIALOG resources, RT_VERSION, and RT_MANIFEST. ^[pefile.txt:521-869]

Build / RE

Toolchain & Packing

• Outer loader: NSIS v3.12 Unicode self-extracting installer (exehead). Identified by the manifest string Nullsoft Install System v3.0b2. ^[strings.txt:207]
• Compression: LZMA:23 solid archive embedded after the PE resource directory at offset 0x71898. ^[binwalk.txt]
• Inner payloads: Four encrypted PE files (.alk, .kom, .lob, .Ple) extracted by 7-Zip; each is high-entropy data with no recognizable headers, suggesting AES or custom stream-cipher encryption before or after LZMA extraction. Combined size ~2.5 MB.
• PowerShell carrier: Labourhoods.Mas (52 KB) — a heavily obfuscated PowerShell script using dead-code variable assignments and a Danish-themed character-skip cipher.

Certificate

A fabricated self-signed X.509 v3 certificate is embedded in the PE security directory (raw offset 0x13BA70, size 0x9E8). Extracted via openssl pkcs7:

subject=C = FR, ST = Centre-Val de Loire, L = Luplant\C3\A9, O = Oversigtsartiklens,
  CN = "Slettetilladelser Fishtailed Unindividualized"
issuer=C = FR, ST = Centre-Val de Loire, L = Luplant\C3\A9, O = Oversigtsartiklens,
  CN = "Slettetilladelser Fishtailed Unindividualized"

^[certificate extraction from bin]

The certificate is self-signed with random word-salad subject fields (Danish/French gibberish), a pattern identical to the first NSIS sibling (4978e16a).

Version Info Masquerade

VS_VERSIONINFO fields are populated with semantically empty strings: ^[exiftool.json]

• Comments: ufordjede spiritedness tidsfulgte
• FileDescription: autolakererierne
• InternalName: immunreaktion returkampe.exe
• LegalCopyright: ulgelige begynderkursussets
• LegalTrademarks: paunchily dogs programnr
• ProductName: udbrnd

These are computer-generated gibberish strings designed to evade filename- and metadata-based triage.

Anti-Analysis

• Installer limitation: capa flags the sample as an installer and bails out, preventing automated capability extraction. ^[capa.txt]
• Encrypted payloads: The four inner PE files reveal no headers under single-byte XOR or common key attempts; encryption method unknown without dynamic execution.
• Obfuscated PowerShell: The Labourhoods.Mas script embeds its real command inside a noise-padded literal decoded by a character-skip function (planskreres), stride 6, offset 5. Dead-code variable assignments ($Plettet='Briketter', repeated 7×) pad the decoder body to complicate regex-based extraction.

Code Quality

The NSIS stub itself is a stock exehead with no modification to the import table or entry point — the anti-analysis is achieved entirely through archive-level encryption and script obfuscation, not stub hardening.

How It Works

1. Social engineering: The victim receives Quots-875-765-pdf.exe and executes it, expecting a PDF.
2. NSIS extraction: The exehead stub decompresses the LZMA archive to %TEMP% (or a configurable output path).
3. Payload staging: Four encrypted files (discontiguous.alk, genfortl.kom, leucocythaemia.lob, Monoerne.Ple) and one PowerShell script (Labourhoods.Mas) are written to disk.
4. Script execution: The NSIS installer script (not recovered statically) likely executes Labourhoods.Mas via powershell.exe.
5. PowerShell decode: Labourhoods.Mas defines planskreres($Refractionalnurn) which walks the $hisses noise-padded literal with stride 6, offset 5, reconstructing a second-stage command. The outer wrapper calls .($Overflatten) $Vridslse54 where $Overflatten resolves to IEX (the decoded $Mmeres119). ^[Labourhoods.Mas static decode]
6. Inner payload decryption: The PowerShell script contains four hardcoded hex blobs passed to a snydendes function (not defined in the recovered fragment, likely truncated or residing in another file):
   • '94B3A8' (3 bytes)
   • '81A3B28BA9A2B3AAA38EA7A8A2AAA3' (16 bytes)
   • '85AAA7B5B5EAE696B3A4AAAFA5EAE695A3A7AAA3A2EAE687A8B5AF85AAA7B5B5EAE687B3B2A985AAA7B5B5' (~66 bytes)
   • '9A' (1 byte) These are likely AES key/IV fragments or a custom stream-cipher seed chain used to decrypt the four .alk/.kom/.lob/.Ple files.
7. Execution: The decrypted inner PE is reflectively loaded or executed from %TEMP%.

Decompiled Behavior

Not applicable — the NSIS exehead is a stock open-source stub; no Ghidra/r2 decompilation of the outer PE is required. The threat logic lives in the encrypted archive and the obfuscated PowerShell script.

C2 Infrastructure

No hardcoded C2 strings recovered from the outer PE or the statically decoded PowerShell fragment. The full decoded $hisses payload (2,158 characters after stride-6 extraction) contains noise-padded references to .bgntouertpbtnaaOlnvp.oiSSCgOG and Tlpftaopputei,ToArseuayTFS, but these are likely C2 URLs sliced into the noise stream and cannot be reconstructed without executing the skip cipher against the complete literal. Dynamic execution (CAPE) is required to recover the plaintext C2.

Dynamic analysis status: Skipped — no CAPE machine currently available for platform windows. ^[dynamic-analysis.md]

Interesting Tidbits

• PDF double-extension masquerade: The filename Quots-875-765-pdf.exe uses a trailing -pdf token to visually suggest a PDF document while the real extension is .exe. ^[triage.json]
• Danish linguistic fingerprint: Variable names ($Mmeres119, $Vridslse54, $Opdateringsdisketten, $Folkemindesamlers) and decoy text (damebladets skips modeskaber) are Danish, linking this sample to the same operator or build pipeline as the 402879ff4b36 Danish batch→PowerShell dropper.
• Decoy text file: teknonom.txt contains 258 bytes of Danish-structured gibberish, a purely anti-triage artifact.
• Four encrypted payloads: Most NSIS droppers observed in the wild stage a single inner PE; staging four separate encrypted payloads suggests either a multi-module toolkit or redundancy to ensure at least one survives endpoint decryption.
• No YARA family match: Only PE_File_Generic hit. The cluster is not yet covered by public signatures.

Deploy / ATT&CK

How To Mess With It (Homelab Replication)

1. NSIS installer: Download NSIS 3.x, write a .nsi that embeds four AES-encrypted files and a PowerShell script, compile with makensis.exe.
2. Character-skip obfuscation: Use the Python encoder from the character-skip-cipher-powershell-obfuscation technique page with stride 6, offset 5 to build a comparable Labourhoods.Mas script.
3. Fabricated certificate: Generate a self-signed X.509 with OpenSSL and gibberish subject fields; embed in the PE security directory via signtool or manual directory patching.
4. Verification: Submit the reproducer to capa — should flag "installer file limitation" and exit with zero capabilities, matching the outer stub fingerprint of this sample.

Deployable Signatures

YARA Rule

rule NSIS_Dropper_Danish_SkipCipher_FabricatedCert : maldropper {
    meta:
        description = "NSIS SFX dropper with Danish character-skip PowerShell and fabricated self-signed cert"
        author = "PacketPursuit"
        date = "2026-06-21"
        sha256 = "f7f089f7f7753da939649fe98a4d274e44b837a61b72d022897858e1998cc7c4"
    strings:
        $nsis_manifest = "Nullsoft.NSIS.exehead" ascii wide
        $nsis_desc = "Nullsoft Install System" ascii wide
        $ps_func1 = "function planskreres" ascii wide nocase
        $ps_func2 = "function Kratogen" ascii wide nocase
        $ps_iex = "$Mmeres119=" ascii wide
        $ps_stride = "$Refractional=5" ascii wide
        $ps_stride2 = "$Refractional=6" ascii wide
        $danish1 = "Opdateringsdisketten" ascii wide
        $danish2 = "Folkemindesamlers" ascii wide
        $danish3 = "Teknonom" ascii wide
        $cert_gibberish1 = "Slettetilladelser" ascii wide
        $cert_gibberish2 = "Oversigtsartiklens" ascii wide
        $ver_comment = "ufordjede spiritedness tidsfulgte" ascii wide
        $ver_desc = "autolakererierne" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        $nsis_manifest and
        $nsis_desc and
        (
            2 of ($ps_func*) or
            2 of ($danish*) or
            2 of ($cert_gibberish*)
        ) and
        (
            $ver_comment or $ver_desc
        )
}

Behavioral Hunt Query (KQL / Microsoft Defender)

DeviceProcessEvents
| where InitiatingProcessFileName contains "exehead"
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine contains "planskreres"
   or ProcessCommandLine contains "Kratogen"
   or ProcessCommandLine contains "Opdateringsdisketten"
| summarize count() by DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

IOC List

Behavioral Fingerprint Statement

This binary is a PE32 NSIS v3 self-extracting installer with a fabricated self-signed X.509 certificate and VS_VERSIONINFO populated with nonsense strings. Upon execution, it extracts four encrypted PE payloads and one obfuscated PowerShell script (Labourhoods.Mas) to a temporary directory. The PowerShell script uses a character-skip cipher (stride 6, offset 5) with dead-code variable padding to decode an IEX-based execution chain. The inner payloads are not executable in their extracted form and require runtime decryption (likely via AES or a custom stream cipher using seed values embedded in the PowerShell script). No hardcoded C2 URLs are visible in the outer PE or the statically decoded PowerShell fragment.

References

• Artifact ID: acbfdfa1-201f-4f54-8b0f-d47c22d09db2 ^[metadata.json]
• Source: MalwareBazaar (abuse.ch) via OpenCTI connector
• Related analysis: /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html — First NSIS sibling (Italian payment lure)
• Family page: unclassified-nsis-dropper
• Technique page: nsis-lzma-embedded-payload
• Technique page: character-skip-cipher-powershell-obfuscation
• Concept page: version-info-masquerade

Provenance

• Outer PE triaged 2026-05-26. Static artifacts generated by triage-fast pipeline (file(1), exiftool, pefile, strings, ssdeep, tlsh, yara).
• FLOSS skipped due to NSIS installer limitation (flare-floss argument error).
• capa v7 flagged installer limitation and aborted capability extraction. ^[capa.txt]
• 7-Zip v23.01 extracted NSIS archive contents. ^[terminal output]
• Certificate extracted via openssl pkcs7 on raw file offset 0x13BA70.
• PowerShell character-skip decoded via Python reimplementation (stride 6, offset 5).
• All inner payload hashes computed via sha256sum.