> Technique · NSIS LZMA Embedded Payload Hiding_

~/packetpursuit $ cat /intel/techniques/nsis-lzma-embedded-payload.md

typetechniquecreated2026-06-10updated2026-07-06packerevasionpe

NSIS LZMA Embedded Payload Hiding

What it does

Malware authors compile a Nullsoft Scriptable Install System (NSIS) self-extracting installer and embed the malicious payload as one or more files inside the LZMA-compressed archive appended after the PE header. The outer PE is a legitimate NSIS exehead stub with a standard import table (registry, file I/O, process creation). Static analysis of the stub reveals nothing malicious; the threat logic is hidden inside the compressed archive and often additionally encrypted after decompression.

Detection / Fingerprint

  • file(1) identifies the binary as "PE32 executable ... Nullsoft Installer self-extracting archive" ^[raw/analyses/4978e16a.../file.txt]
  • Binwalk reports LZMA compressed data blocks at offsets after the PE resource directory ^[raw/analyses/4978e16a.../binwalk.txt]
  • 7-Zip can list and extract the embedded archive contents
  • Strings in the PE header contain Nullsoft.NSIS.exehead and Nullsoft Install System vX.XX ^[raw/analyses/4978e16a.../strings.txt:228]
  • The .rsrc section contains RT_MANIFEST resource with the NSIS assembly identity

Implementation patterns observed

  1. Encrypted payload blobs: The extracted files are high-entropy data (often uniform distribution across all 256 byte values) with no recognizable headers, suggesting AES or custom stream-cipher encryption applied before compression or after extraction.
  2. Nonsense filenames: Computer-generated gibberish words (e.g., Tyrolerne, Afruster, glasrrets.imp, discontiguous.alk, genfortl.kom, leucocythaemia.lob, Monoerne.Ple) to evade filename-based signatures and complicate OSINT pivoting.
  3. Padding/decoy files: Some variants include null-byte padding files (e.g., figurfrakke.cyt, 96% nulls) to inflate archive size and confuse entropy-based triage. Decoy text files (infraction.txt, teknonom.txt) contain Danish-structured gibberish.
  4. Fabricated certificate: A self-signed X.509 certificate embedded in the PE security directory with random word-salad subject fields, giving the superficial appearance of a signed binary.
  5. Multi-payload staging: Some variants extract four separate encrypted PE files instead of one, suggesting modular toolkits or redundancy.
  6. Obfuscated execution scripts: PowerShell scripts embedded in the archive with character-skip ciphers (stride 4/6/8) and dead-code variable padding.
  7. Polymorphic stride progression: The same operator has been observed using stride 4 (offset 3), stride 6 (offset 5), and stride 8 (offset 7) across siblings, a trivial polymorphism mechanism.

Reproduce on your own VMs

  1. Download NSIS 3.x from https://nsis.sourceforge.io/ and install on Windows.
  2. Write a .nsi script:
    OutFile "payload_dropper.exe"
Section
  SetOutPath "$TEMP"
  File "encrypted_payload.bin"
  Exec "$TEMP\encrypted_payload.bin"
SectionEnd
  3. Compile: makensis.exe script.nsi
  4. Optionally sign with a self-signed cert (see version-info-masquerade).
  5. Verify extraction: 7z l payload_dropper.exe

Defensive countermeasures

  • Block execution of NSIS installers from untrusted sources via AppLocker/WDAC.
  • Hunt for processes spawned by NSIS exehead that write high-entropy files to %TEMP% and immediately execute them.
  • YARA on Nullsoft.NSIS.exehead + security directory present + high-entropy embedded archive.

Pages where observed

  • unclassified-nsis-dropper
  • /intel/analyses/4978e16a7f6b716c324810ec44d5a82eeecd80382e4d5ccb4dc031cdc2559d9f.html
  • /intel/analyses/78c5e8ca9474815c1cd85825b00d9be487a0e049fb827b12ef74bc57580cd3f5.html — Sixth confirmed sibling; US payment-reference lure, six embedded payloads with identical archive layout, stride-6 Danish character-skip PowerShell, fabricated self-signed cert (Udskoling Begravedes Subscheme / Comoquer), reuses VS_VERSIONINFO template. Static-only.
  • /intel/analyses/5212423bac835b8c3268e4cf2b195043bdcd403e7d98f9182830098585ef2d1a.html — Seventh confirmed sibling; proforma-invoice lure, MSVC 14.29 linker (Oct 2022), BZip2 compression, four embedded payloads, US-themed fabricated cert, fresh VS_VERSIONINFO word-salad. Static-only.
  • /intel/analyses/3a13583c51add43997b963edaabc063c1abf9600d404e1d0e49bf4d09665d104.html — Eighth confirmed sibling; Product_samples_pdf.exe PDF masquerade, BZip2 compression, five embedded payloads (1× encrypted PE + 2× null-padded blobs + 1× stride-6 Danish PS cradle + 1× word-salad text), fabricated self-signed cert (broomweed Dockyards Whelphood / Mazed), VS_VERSIONINFO word-salad (tyender marmoromkransedes, smrkages, wellhead). Static-only.