64799a0a4118c6ccb56c8c8bd9dae0c0

resource	yara_rule
sample	nsis_installer_1

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 a148412a5c1cc9aba0ecdbb3e44010aeac75b40f23492bd04c0127e558aa44ac
MD5 64799a0a4118c6ccb56c8c8bd9dae0c0
SHA1 bcd05bf2b8a1e6920f3fb936f51676b90d00fe27
SHA512 ae9c6e7ed1ffbd5ba864655de638c917dda149be41559d21eabc9236ab887158a89770f28e6fdb5f95b659c3415cd4722c71c23d1fa1d56d8e6d6acfd2e4a49e
SSDEEP 49152:NFHplMNmSOZZSctRqhzS+sGjP5rUBBO4xOAL:Nlp6mSOZsctizzHjxUBH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e0:d3:4a:db:7b:b4:b0:24:bd:4b:fe:89:2d:c6:4e:67:38:3b:da:32

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

4

Entry point

12525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NsisPluginOB.dll

IMPHASH dd44db9f39da101989c2d495579e5dfe
SHA256 123a2a7b785e24f415a6ebf5e56c807a028d2c45ba7d82f19c4e837b28a6f9db
MD5 3ee7387bfe2dfabc3bd86f39795bb0da
SHA1 66071d64229506aad7c802658001725eeab70c02
SHA512 725c8d940be97b3eb080061c6f413f1676764be1d3cf1e0389550a24e73e694eb51ea2c19f51f1abd654a47cb45b6c3b48cf46f6b8b9d77c7874fd87db0e6c1c
SSDEEP 6144:Q7YRZ0tknVvtI5j5FBQNC0FyR8I6JjtbD:yZ5j5Ft0FyUV9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3c:af:bb:fc:d4:bd:3d:1b:55:21:8c:cf:95:56:38:47:f3:88:f6:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

85801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCPInfo GetOEMCP RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize GetCommandLineA VirtualAlloc HeapReAlloc Sleep ExitProcess HeapCreate HeapDestroy VirtualFree GetStdHandle GetACP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetLocaleInfoA InterlockedExchange GetProcessHeap GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile GlobalFlags GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcmpW lstrcmpA GlobalGetAtomNameA GetModuleHandleW CompareStringA GetCurrentProcessId SetErrorMode GetCurrentThreadId TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc GetModuleFileNameW GetModuleHandleA GlobalLock GlobalUnlock FormatMessageA LocalFree TerminateProcess HeapAlloc HeapFree SetLastError GetEnvironmentVariableW GetFileAttributesW WaitForSingleObject OutputDebugStringA GetModuleFileNameA GetLastError CreateFileA CreateFileMappingA MapViewOfFile GetFileSize UnmapViewOfFile InterlockedDecrement WideCharToMultiByte LoadLibraryA GetProcAddress CreateToolhelp32Snapshot Process32First CloseHandle lstrcmpiA ProcessIdToSessionId Process32Next OpenProcess CreateProcessW FreeLibrary MultiByteToWideChar GetVersionExA InterlockedIncrement FindResourceA LoadResource LockResource SizeofResource GlobalAlloc lstrcpynA GlobalFree lstrcpyW lstrcatW ExpandEnvironmentStringsW lstrcpyA lstrlenA lstrcatA lstrlenW

user32

PostQuitMessage DestroyMenu GrayStringA DrawTextExA DrawTextA TabbedTextOutA ClientToScreen SetWindowTextA RegisterWindowMessageA LoadIconA WinHelpA GetCapture GetClassNameA SetPropA GetPropA RemovePropA IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExA GetClassInfoExA GetClassInfoA RegisterClassA AdjustWindowRectEx PostMessageA GetWindowThreadProcessId CopyRect GetDlgCtrlID DefWindowProcA CallWindowProcA PtInRect GetMenu SetWindowLongA SetWindowPos SystemParametersInfoA IsIconic GetClassLongA GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState UnhookWindowsHookEx ValidateRect PeekMessageA GetKeyState SendMessageA DispatchMessageA CallNextHookEx SetWindowsHookExA UnregisterClassA MessageBoxA EnableWindow IsWindowEnabled GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapA GetFocus ModifyMenuA EnableMenuItem CheckMenuItem GetWindowTextA LoadCursorA GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush GetParent GetWindowLongA GetLastActivePopup

gdi32

GetStockObject SetViewportExtEx DeleteDC ScaleWindowExtEx SetWindowExtEx GetDeviceCaps OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutA TextOutA RectVisible PtVisible SetMapMode RestoreDC SaveDC DeleteObject SetBkColor SetTextColor GetClipBox CreateBitmap ScaleViewportExtEx

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

advapi32

RegCreateKeyExA RegSetValueExA OpenProcessToken DuplicateTokenEx RegOpenKeyExW RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryValueExW

shell32

SHGetSpecialFolderPathW ShellExecuteW

shlwapi

PathFindExtensionA PathFindFileNameA

ole32

CoInitialize CoUninitialize CoCreateInstance OleRun CoCreateGuid StringFromGUID2 CLSIDFromProgID StringFromCLSID CoTaskMemFree

oleaut32

SysStringLen SysFreeString VariantClear VariantChangeType SysStringByteLen VariantInit SysAllocStringByteLen SysAllocString GetErrorInfo

netapi32

NetUserEnum NetApiBufferFree

OfferBox.exe

IMPHASH 71e37b63a24e5bb0a50a7218a4d3f935
SHA256 9b1a56f7c746fd7a1c4113040e5c1b7abf90d77db448508989ed85d5bf589881
MD5 2e33eb8d43cf15ec73e45baa0df06191
SHA1 34b8c49e032c4dd5f4245d6f2b2386628bd9c927
SHA512 3c20b01abc639d8f1496ac728af4e58b774e026ce4f146235c5d48d05ed580326bbe040a09639a40bad216e702034e10861d657d3b406a90f10d02a85b16b038
SSDEEP 49152:Ix6lzqFI7E2Z52MiLC288T8tRcsucD7uaHYDtR+/c0cayU:oZI7EVMb288T8tuxcGaQtROJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ba:d0:ed:49:74:ea:b6:31:80:49:bf:d9:e4:b1:4b:5f:3f:38:d9:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

1126284

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

offerboxengine

ord1005 ord1003 ord1004 ord1002 ?resume@Engine@@SA_NXZ ?pause@Engine@@SA_NXZ ?initialize@Engine@@SA_NHHHPB_W00000000000PAUHWND__@@IIHH0@Z ?uninitialize@Engine@@SA_NXZ

kernel32

InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA LCMapStringW GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA RaiseException InitializeCriticalSection IsProcessorFeaturePresent InterlockedCompareExchange IsValidCodePage GetOEMCP CreateFileA GetACP DeleteCriticalSection GetCPInfo SizeofResource LockResource LoadResource FindResourceW GetLastError lstrlenW GetProcAddress LoadLibraryW CloseHandle FreeLibrary lstrcmpiW lstrcpyW GetModuleHandleW GetModuleFileNameW Sleep CreateThread EnterCriticalSection LeaveCriticalSection MultiByteToWideChar InterlockedIncrement InterlockedDecrement LoadLibraryExW GlobalFree MoveFileExW GetExitCodeThread WaitForSingleObject FlushInstructionCache GetCurrentProcess GetCurrentThreadId SetLastError GetVersionExW GetLocaleInfoW LocalFree ResetEvent SetEvent ResumeThread GlobalAlloc QueryPerformanceCounter VirtualFree HeapCreate GetStartupInfoA SetHandleCount GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStdHandle GetFileType SetStdHandle VirtualQuery GetSystemInfo VirtualAlloc HeapSize ExitProcess HeapReAlloc ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapAlloc RtlUnwind HeapFree GetSystemTimeAsFileTime GetStartupInfoW FindResourceExW VirtualProtect GetProfileIntW CreateEventW MulDiv GlobalUnlock SearchPathW GetTempPathW GetTempFileNameW SetErrorMode GlobalFindAtomW LoadLibraryA GetVersionExA GlobalFlags GetCurrentDirectoryW WritePrivateProfileStringW GetPrivateProfileIntW GlobalGetAtomNameW TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc CompareStringW GetFileTime GetFileSizeEx GetFileAttributesW GetFileAttributesExW FileTimeToLocalFileTime FileTimeToSystemTime FindNextFileW lstrlenA GetModuleHandleA CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale GetCurrentProcessId GlobalAddAtomW SetThreadPriority GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA CompareStringA InterlockedExchange lstrcmpW CopyFileW GlobalSize WideCharToMultiByte FormatMessageW GetTickCount WaitForMultipleObjects CreateDirectoryW FreeResource GlobalLock

user32

IsClipboardFormatAvailable MapVirtualKeyExW IsCharLowerW GetMenuDefaultItem UpdateLayeredWindow EnableScrollBar UnionRect SetCursorPos DrawFocusRect DrawFrameControl DrawEdge UnpackDDElParam ReuseDDElParam InsertMenuItemW TranslateAcceleratorW GetNextDlgTabItem GetNextDlgGroupItem InvalidateRgn EmptyClipboard CloseClipboard SetClipboardData DestroyIcon CopyImage OpenClipboard DrawStateW EnumChildWindows LockWindowUpdate BringWindowToTop IsRectEmpty ReleaseCapture IsMenu SetCapture GetSystemMenu SetClassLongW WindowFromPoint SetParent CreatePopupMenu NotifyWinEvent SetWindowRgn CreateAcceleratorTableW LoadAcceleratorsW DestroyAcceleratorTable GetAsyncKeyState GetKeyboardState GetKeyboardLayout MapVirtualKeyW ToUnicodeEx CopyAcceleratorTableW WaitMessage PostThreadMessageW RegisterWindowMessageW SendDlgItemMessageA IsChild GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetTopWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos ShowScrollBar UpdateWindow GetClassInfoW AdjustWindowRectEx EqualRect DefFrameProcW GetScrollInfo SetScrollInfo SetWindowPlacement GetMenu SystemParametersInfoA IsIconic GetWindowPlacement SetFocus MoveWindow IsDialogMessageW SendDlgItemMessageW CheckDlgButton UnregisterClassW IsWindow SetRectEmpty GetDesktopWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect DeleteMenu GetWindowTextLengthW GetWindowTextW GetSysColorBrush IntersectRect GetWindowDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW CharUpperW RegisterClipboardFormatW GetWindow CharNextW UnregisterClassA PostMessageW GetClientRect SetWindowContextHelpId MapDialogRect GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW ShowOwnedPopups SetCursor SetWindowsHookExW CallNextHookEx GetActiveWindow GetKeyState ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions GetFocus GetParent CheckMenuItem WinHelpW OffsetRect MessageBeep RedrawWindow DefMDIChildProcW DrawMenuBar TranslateMDISysAccel FrameRect EndDialog CreateDialogIndirectParamW CharUpperBuffW CopyIcon SubtractRect GetIconInfo GetDoubleClickTime CreateMenu GetWindowRgn DestroyCursor DrawIcon IsZoomed UnhookWindowsHookEx SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect PostQuitMessage GetMenuState GetMenuStringW AppendMenuW GetMenuItemID DeferWindowPos ShowWindow LoadIconW SetWindowLongW GetClassInfoExW LoadCursorW LoadBitmapW RegisterClassExW CreateWindowExW DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsWindowVisible SetWindowPos SendMessageW SetWindowTextW GetDlgItem CreateDialogParamW FillRect CopyRect BeginPaint EndPaint GetUpdateRect InvalidateRect GetSysColor ReleaseDC GetDC DefWindowProcW SetRect GetWindowLongW CallWindowProcW LoadImageW SetTimer FindWindowW KillTimer PeekMessageW SetMenuDefaultItem GetSubMenu ModifyMenuW LoadMenuW TrackPopupMenu SetForegroundWindow GetCursorPos EnableMenuItem DrawIconEx RegisterClassW GetSystemMetrics RemoveMenu GetMenuItemCount InsertMenuW GetKeyNameTextW

gdi32

SelectClipRgn CreateRectRgn GetViewportExtEx GetWindowExtEx GetPixel PtVisible RectVisible TextOutW Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx OffsetWindowOrgEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn CreatePatternBrush SelectPalette GetObjectType CreatePen CreateHatchBrush CreateRectRgnIndirect SetRectRgn CombineRgn GetMapMode PatBlt DPtoLP GetDCOrgEx OffsetRgn GetRgnBox GetTextMetricsW EnumFontFamiliesW GetTextCharsetInfo CreateRoundRectRgn GetTextColor SetDIBColorTable GetDIBits RealizePalette StretchBlt SetPixel CreateDIBSection GetBkColor CreateEllipticRgn CreatePolygonRgn Polyline Ellipse Polygon Rectangle RoundRect CreatePalette GetPaletteEntries GetWindowOrgEx PtInRegion FillRgn FrameRgn GetBoundsRect GetViewportOrgEx LPtoDP ExtFloodFill SetPaletteEntries GetNearestPaletteIndex GetSystemPaletteEntries EnumFontFamiliesExW GetTextFaceW SetPixelV SetTextAlign MoveToEx LineTo IntersectClipRect ExcludeClipRect GetClipBox SetMapMode GetDeviceCaps SetTextColor SetROP2 SetPolyFillMode SetBkColor RestoreDC SaveDC CreateBitmap GetTextExtentPoint32W ExtTextOutW GetObjectW CopyMetaFileW CreateCompatibleBitmap CreateSolidBrush DeleteObject SetBkMode GetStockObject CreateCompatibleDC SelectObject BitBlt CreateDIBitmap DeleteDC CreateFontIndirectW

msimg32

TransparentBlt AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegQueryValueExW RegOpenKeyExW OpenProcessToken RegDeleteKeyW RegQueryInfoKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegEnumKeyW RegCloseKey RegOpenKeyW GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid RegEnumKeyExW

shell32

SHBrowseForFolderW SHGetFolderPathW Shell_NotifyIconW SHGetSpecialFolderPathW SHGetFileInfoW SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHGetPathFromIDListW

comctl32

InitCommonControlsEx ImageList_GetIconSize

shlwapi

PathFindExtensionW PathFindFileNameW PathStripToRootW PathRemoveFileSpecW PathIsUNCW

oledlg

OleUIBusyW

ole32

OleUninitialize CLSIDFromString OleDuplicateData ReleaseStgMedium CreateStreamOnHGlobal OleRun CoTaskMemFree CLSIDFromProgID CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoFreeUnusedLibraries CoRegisterClassObject CoRevokeClassObject OleInitialize CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter OleLockRunning DoDragDrop OleGetClipboard CoInitializeEx OleCreateMenuDescriptor OleDestroyMenuDescriptor RevokeDragDrop CoLockObjectExternal RegisterDragDrop OleTranslateAccelerator StringFromGUID2 CoUninitialize CoInitialize IsAccelerator

oleaut32

SysStringLen SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr LoadRegTypeLi SysAllocStringByteLen SysStringByteLen VariantInit VariantCopy VariantChangeType VariantClear OleLoadPicture SysAllocStringLen SafeArrayDestroy VariantTimeToSystemTime SystemTimeToVariantTime GetErrorInfo OleCreateFontIndirect

gdiplus

GdipCloneImage GdipDrawImageI GdipGetImageGraphicsContext GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStreamICM GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipDeleteGraphics GdipFree GdipAlloc

wininet

InternetSetOptionW HttpQueryInfoW InternetReadFile InternetCloseHandle InternetQueryOptionW HttpSendRequestW InternetCrackUrlW InternetOpenW InternetConnectW HttpOpenRequestW HttpAddRequestHeadersW InternetGetLastResponseInfoW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

ws2_32

getaddrinfo freeaddrinfo WSACleanup WSAStartup

imm32

ImmReleaseContext ImmGetContext ImmGetOpenStatus

winmm

PlaySoundW

OfferBoxBHO.dll

IMPHASH 9d8e72a1f25b8ad699cbf4cddde2a0a6
SHA256 aef0ff4a4c0f589ea4839df6108b92adc024155281860703b28c70581aac6ee6
MD5 b4b61f417df1f173a78a55e9029be6fb
SHA1 19facf2bc92cf281b21c704faeda72fdd2909fcf
SHA512 ee9ad0a9acb8d1ba605aebdc061cbabfd5ad539169dbcef5c569be5e3b014ee7f33ad6313576a1aba4848886ee74f01d565192e06a124814ae1cae9c61b96ef6
SSDEEP 1536:brWkiTK8yE6Q7ZtbfpCRJt02GPLyRW75JrktWjC4rzHphl+lz54+U65nz677JOEN:/iTKFEdlwmPsgLT1+l++35n2f4Ftb2
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0b:da:01:12:22:8a:58:96:5c:25:ec:86:cb:44:81:f0:52:ee:19:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

35353

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

SHSetValueW SHDeleteKeyW

kernel32

GetModuleHandleW GetStringTypeA InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement GetModuleFileNameW FreeLibrary WaitForSingleObject SetEvent GetTickCount LoadLibraryW GetProcAddress CreateEventW CloseHandle GetLocaleInfoA FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA GetConsoleMode GetConsoleCP SetFilePointer SetStdHandle GetLastError MultiByteToWideChar lstrlenA WideCharToMultiByte HeapFree GetProcessHeap HeapDestroy HeapAlloc HeapReAlloc HeapSize ExitThread ResumeThread CreateThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA RtlUnwind RaiseException WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc GetStringTypeW

user32

SendMessageW FindWindowW

ole32

CoTaskMemFree CLSIDFromProgID CoInitialize StringFromCLSID CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysAllocStringByteLen VariantClear SysStringLen SysAllocString

ws2_32

WSACleanup gethostbyname WSAStartup

wininet

InternetCrackUrlW

OfferBoxChromeExtension.crx

SHA256 222b93ccced3313b5bbaaaf80bf82b2d7030005b4654943fa0e4abba3a2e4117
MD5 341abc6cd6be5b6fe64e19d79912716d
SHA1 8cf85f78037d0aba6fca4142e77e053232ed433f
SHA512 eca3ed0fc16c5d3d64e7162d19f0a9503d1c412466e11345ed9af1782da04671086330eb6fa34649bb827292d0bff917412d4f7a85052dc9377424fbaf23394b
SSDEEP 768:16bMVhCt3BHNkjtKY5DawRrNueLUCRtO1dkGIBeLEL4K:1mQCWRKRwRZRtaOyEL4K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

OfferboxChromePlugin.dll

IMPHASH 6fbcde5ce7cabd9bfda8cb7ae9b1acc6
SHA256 9e0dba0d22cd19d9a54e7154cf1a93d961fac4adfcc09f67a28f384988bf4e11
MD5 ae42cc8f93664bf54c6baa3da2a0e114
SHA1 e218a977513b8799ef5891f57baf90fda1a76ec6
SHA512 eabe87eacf539f4f5795eae2cf8000b52bb12647a1b91fdc08c4a1d7aad13ca521214d9aa7cf0d3dcb1a64b382e8d01e5163a8beb263bb90c9d6a2599c0642f3
SSDEEP 1536:MEKLP8wS42H+Ge7R6fbHOk5q2qFatyCNA:MnLP8wr4HOk5qJQtbA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

27:a5:10:85:c6:fa:ca:6a:67:2c:f7:74:28:7d:0d:dd:8b:46:b5:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

12696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject CreateEventW SetEvent CloseHandle lstrcmpA MultiByteToWideChar GetTickCount LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA ExitThread GetLastError ResumeThread CreateThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapFree HeapAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess RaiseException SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc RtlUnwind WriteFile GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount HeapSize GetLocaleInfoA

user32

FindWindowW SendMessageW

ole32

CoUninitialize CLSIDFromProgID CoCreateInstance CoInitialize

_locales/de/messages.json

SHA256 46a965298ef92d7490f9bbfa3d87ef7686967a66e8b0e29591e850b7d1b85e31
MD5 f64925e17afec7cd18c2e19808412a2a
SHA1 efc2be431a017be70601f8d1cbfab1b97be48b4a
SHA512 6721c28bec8c0dbce1c9e32988ba6439586d81019421afb524533cf6c22f01556d91d0dff0786ba03f0d1bce513e3f5d2d6f9233af566898eae057fce0e651ec
MD5 SHA1 SHA512

NSIS installer

installer

_locales/en/messages.json

SHA256 2fede41596f7d1563552be0f60ad1b85379d22d7b1a19850aa2a1d51cda894af
MD5 7c0b379dab83480778c42de038ace497
SHA1 7ae1dc2557055a01f9d2483faf5665c407ceba0b
SHA512 56ee149ed98d36df42014f2194f3107f822d9f4281904c557b38c594bca5d46d859da08deb2461c3418b198e7424849366bdf22d8df216e6fea3e7660b3e7dec
MD5 SHA1 SHA512

NSIS installer

installer

_locales/es/messages.json

SHA256 fb351f414afe12e8aa519826edf2675a472417a489b41da79fc7b4e2e07d9e8d
MD5 91ba85ea3b5332da4c51d6bb0a27a636
SHA1 c34153d262eae63cb1d85b1aeb2739614e6f5c64
SHA512 44984ceb3db56b36a32bc2c0f5630b637b07def574fc1ea588a045e06c84ea2425ff440e65e811869ed91cc47e3f458e11fdcab1ecb7d4b0ffc31d23537b29c3
MD5 SHA1 SHA512

NSIS installer

installer

_locales/fr/messages.json

SHA256 f45a7ae96134f314585468e089d67f470fe2db6baf57def9a4f481f76c24843a
MD5 d2d310a0c14cf7494ca8dede43e8935f
SHA1 2b0f0e97e91a8eeddcf1d71039625f26b210644f
SHA512 32236774228934e04bf19a58c15d036d8c9c5f787dde4c050b94e689ffb4691d4cf9a67b764bbec0fb1793dfc20c7af446abe37fb0b91607b5e53a8a285d8549
MD5 SHA1 SHA512

NSIS installer

installer

_locales/it/messages.json

SHA256 fc76d69153faef7669674fe3e85c1a04227d5d596f6bdd5a4328f89c4fc16e3d
MD5 dc5afbbb4d60a9fc171ff86c08a9e8a6
SHA1 520ace1995851536884e70c876e3d82df73799c1
SHA512 7ad65332db5c88f0374930d932b9a93ae66e54d793a91538d94f1fee5a7f8e84c72a30888c2dadf16ad5e0bd4333d04f8eade35a6957aeb4ecab944bd24b8b5d
MD5 SHA1 SHA512

NSIS installer

installer

background.html

SHA256 eab1640b3cf8e8d38fbf4f3d9d91997b07282b57d4c142b198c57a80aac0ed4b
MD5 20b338f9fad24d65734018bce8a8d5fa
SHA1 3d3a25bb4981d684ba49879c75e00ece76954b63
SHA512 20b17f57815deafe5497ebff46440e1fbdcd5babfe78f8b7e644dacabc9cb2965f0516cece121f5cb808d9080d1bdd3d400e3a4d273b9b13ce29dff72506c78d
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

contentscript.js

SHA256 3e2eba860b886a98d6ddb90a370c07ee6f92e63a697c637128ff308f8eccd905
MD5 ed97e5b3375230686bf640e931b769d1
SHA1 905f09afeb3171b661a19d8dec4dcc1ae18a6651
SHA512 9ec174964fb9f47c232eec4efe81fa9fe887671e5acb892e14ca43713aa830237686d27c35856d5569798ab1164cc3f7c5ec83ed2b1b0aa106bc1d96ccc7fc90
MD5 SHA1 SHA512

NSIS installer

installer

manifest.json

SHA256 49a4f79770255e2e86f58673ae58244563c05c2f1d9a071e6b722a126fdbb06c
MD5 48fdca48368fd2ae4562437357f54130
SHA1 e55c4ab2576e4239ec031c2e87b9a11e9f1aed37
SHA512 83d2fdc49379a5485ee9c74a55ba9caf59440583e0e9cd7992441dd859f1e26bfbb0e4eaede40596754deed294fc686e1185f191e0d7d0c06edc3df5478013d0
MD5 SHA1 SHA512

NSIS installer

installer

OfferBoxEngine.dll

IMPHASH 1920950f4333a150ccfe8d8d0cb3a233
SHA256 ba170abbf00b8a46a64626d30c2f39f2d69f4c7aaa7a0bddb4e2a79160cb2678
MD5 648bcb283d84f257184bb390d0d3a375
SHA1 35aeac1459e955f92eeb38074b6f8384843af6a0
SHA512 f932f7ef1c72a1d2f327a497ad7ffd974fa85e21f67aed3a537c99d674665385751217b2b9fa7ef5c13bfa89a0c9d1c92065d365931335b536974a333896316b
SSDEEP 12288:tYGPUEJXolX0VuJhq1otALXnoYsXBSYmRVCXeTld2hlovcDhXxT:tmEVshE0XBSYY/TlOlokDJxT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ef:01:f2:90:72:b2:62:d6:58:14:3e:a0:dc:07:69:3e:5f:61:0b:b6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

373810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TlsSetValue LocalReAlloc TlsFree SetErrorMode GetFileAttributesW GetFileSizeEx GetFileTime WritePrivateProfileStringW RtlUnwind HeapAlloc HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSize HeapReAlloc GetCommandLineA WriteConsoleW GetFileType GetStdHandle ExitProcess SetStdHandle VirtualFree VirtualAlloc HeapCreate HeapDestroy TlsAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetTimeZoneInformation InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CreateFileA GetCurrentDirectoryA GetDriveTypeA WriteConsoleA GetConsoleOutputCP GetProcessHeap SetEnvironmentVariableA GlobalHandle GlobalReAlloc IsProcessorFeaturePresent InterlockedCompareExchange TlsGetValue GlobalFlags GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW GetLocaleInfoW CompareStringA InterlockedExchange LocalAlloc FindNextFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer ReadFile lstrlenA lstrcmpA GetCurrentProcessId GetModuleHandleA GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW LoadLibraryA GetVersionExA FreeResource WideCharToMultiByte GetLocalTime MulDiv lstrcmpW CreateDirectoryW LocalFree TerminateThread GetExitCodeThread CreateMutexW LoadLibraryExW FreeLibrary lstrcmpiW OpenProcess ResumeThread SystemTimeToTzSpecificLocalTime GlobalFree MultiByteToWideChar GlobalAlloc GlobalLock GlobalUnlock CreateFileW WriteFile GetTempPathW lstrcatW CreateEventW CreateThread DeleteCriticalSection SetEvent ResetEvent WaitForSingleObject CloseHandle FindResourceExW FileTimeToLocalFileTime FileTimeToSystemTime GetLastError GetProcAddress LoadLibraryW GetModuleHandleW GetTickCount SetLastError GetModuleFileNameW GetCurrentThreadId GetCurrentProcess FlushInstructionCache InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException lstrlenW InterlockedDecrement Sleep InterlockedIncrement FindResourceW LoadResource LockResource GetModuleFileNameA SizeofResource

user32

SetRect IsZoomed SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetMenuState SendDlgItemMessageA WinHelpW SetWindowsHookExW CallNextHookEx GetClassLongW SetPropW GetPropW RemovePropW GetLastActivePopup UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW GetClassInfoW AdjustWindowRectEx EqualRect DeferWindowPos GetMenu SystemParametersInfoA GetWindowPlacement GetDlgCtrlID IsDialogMessageW SendDlgItemMessageW GetActiveWindow SetActiveWindow CreateDialogIndirectParamW IsWindowEnabled GetNextDlgTabItem EndDialog wsprintfW PeekMessageW MsgWaitForMultipleObjects RegisterClassW FindWindowW SetFocus DestroyAcceleratorTable GetDesktopWindow BeginPaint EndPaint FillRect GetDlgItem IsChild InvalidateRgn InvalidateRect ReleaseDC GetDC ClientToScreen GetSysColor GetWindowTextLengthW SendMessageW EnableWindow UnregisterClassA PtInRect RegisterWindowMessageW GetMessageW GetCursorPos TranslateAcceleratorW TranslateMessage DispatchMessageW SetForegroundWindow PostQuitMessage SetMenu SetWindowTextW CharNextW CheckMenuItem EnableMenuItem AppendMenuW CreatePopupMenu SetCursor ValidateRect CharUpperW WindowFromPoint SetRectEmpty GetSysColorBrush DestroyMenu OffsetRect IsIconic CopyRect GetClientRect RedrawWindow GetCapture SetCapture GetFocus GetParent ReleaseCapture DestroyIcon ScreenToClient SetWindowLongW ShowWindow DestroyWindow CallWindowProcW GetWindowLongW MoveWindow GetClassInfoExW LoadCursorW DefWindowProcW RegisterClassExW CreateWindowExW LoadIconW GetWindowRect GetAsyncKeyState IsWindowVisible GetKeyState LoadImageW CreateMenu CreateAcceleratorTableW GetForegroundWindow GetSystemMetrics SetWindowPos UpdateWindow GetClassNameW GetWindowTextW GetWindowThreadProcessId UnregisterClassW KillTimer SetTimer GetWindow IsWindow PostMessageW OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetTopWindow

gdi32

GetTextMetricsW GetTextExtentPoint32W GetBkColor ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW TextOutW RectVisible PtVisible CreateFontIndirectW IntersectClipRect ExcludeClipRect SetBkMode RestoreDC SaveDC SetTextColor GetClipBox CreateSolidBrush GetDeviceCaps GetStockObject CreateCompatibleDC SelectObject DeleteObject GetObjectW DPtoLP CreateBitmap CreateCompatibleBitmap GetMapMode SetMapMode BitBlt GetPixel SetPixel SetBkColor DeleteDC

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

advapi32

RegQueryValueW RegEnumKeyW RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW RegOpenKeyExW RegOpenKeyW RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

shlwapi

PathFindExtensionW UrlUnescapeW PathIsUNCW PathStripToRootW PathRemoveFileSpecW PathFindFileNameW

ole32

CoTaskMemRealloc OleUninitialize OleInitialize StringFromGUID2 OleLockRunning CoGetClassObject CLSIDFromString CoInitializeEx CoTaskMemAlloc CoInitialize CoCreateInstance CLSIDFromProgID OleRun CoUninitialize CreateStreamOnHGlobal CoTaskMemFree

oleaut32

SysAllocString SysAllocStringByteLen SysStringByteLen SysStringLen VariantClear VariantInit DispCallFunc LoadRegTypeLi LoadTypeLi VariantTimeToSystemTime SystemTimeToVariantTime SysAllocStringLen VariantChangeType VarUI4FromStr OleCreateFontIndirect GetErrorInfo SysFreeString

urlmon

CreateURLMonikerEx CoInternetParseUrl

wininet

InternetCloseHandle HttpQueryInfoW InternetReadFile HttpSendRequestW InternetQueryOptionW InternetSetOptionW HttpOpenRequestW InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetGetLastResponseInfoW HttpAddRequestHeadersW InternetCrackUrlW InternetCanonicalizeUrlW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

OfferBoxLauncher.exe

IMPHASH 648a2e9fad575279a13f37cadb2b1e14
SHA256 2b42fc2b6c09148273326ebee5bdb127bcca81b274028b69b8ca62b4cd8f4eac
MD5 7d440d531f816402dc37ce1b96b1b6b1
SHA1 546cec38de6f5fa617d82fd2425ef1ea5bf48897
SHA512 d2a8801f8a77dadc6e90ff99b60b9a22551c088ec29069e730bf4a940fa6be4f6ec6da0c7fc93a69ad6e3bf7ec24b2e502aacd50ec8033a35581e373546dd484
SSDEEP 1536:LD4/U+jLGRbb+txkKu5v1xBQZ4O6JV7atyCN2N:4c+uy3u5vXJJV+tby
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:76:ae:23:53:84:15:80:cf:33:8b:01:68:03:d6:60:66:2f:59:7a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

5374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

[email protected]/chrome.manifest

SHA256 771de26977a780d1c6d21fedbda7d8d99d7c2220b2d21a5b36050aafc350e1cc
MD5 1ee942b51b90a297bdbb990c04fd47d8
SHA1 b8464ff91a706063af8f768c272da0b9b0dc931a
SHA512 fb02b23584cb25275078708c9cfb575e06a8ddc9923f2618056b7feaa8e3cca408a9b978257992ad9b7819adaaa089f64ed112138b6e3d738af3aaa60697beb7
MD5 SHA1 SHA512

NSIS installer

installer

[email protected]/chrome/content/events.js

SHA256 8aa88167feec8b355c6df962fe56e4d077d9e35fdd3751b81c49e1598f6a2532
MD5 c440601660d29e0035adeff67d48bbef
SHA1 bc7e425503580bc691ffe7b43fbae99c73cdd544
SHA512 f38550dd62be35616ddc362f85935d8a094575f247a4be51ceccaec03c008797fb7125376113086859f0fd416a0471c4995d09753a8290904d3bfb2251cef02e
SSDEEP 96:f6yE/mt8kVZmNPuZwPGH2wMzwF4XiuZw4WuxwM1w5Cw22bKOh2AJvT4mz:SttGZGGH2Pa4XNZfWuxRJB2bKOhBth
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

[email protected]/chrome/content/overlay.xul

SHA256 bb61aa8fe084e534b4cda95b9e1bc05fc5ac7520f016c8d5ab26078c935ef0cb
MD5 3ab2d2cce0e65e1b98574e98d3b5616b
SHA1 cafdae6eeb1bf0d3d062b7907dd8a772015b6fe0
SHA512 ae59781c7af5c5f6b2e8255fe0549bf0707de961b689ed40501f1ed89e31896dd8cde52837114b8fdc4c4cf1de573e75423a1f80533ac57bbc40cab0f3fee3cb
MD5 SHA1 SHA512

NSIS installer

installer

[email protected]/components/OfferBoxXpCom.dll

IMPHASH 365a276538c58d5a481f6ea2163a5c80
SHA256 fa5fa9ee65b61c98d74810d5825ca37ff9e37d8ae50fcbccf0bab42eac0cde12
MD5 2e619bbb0c7d078b79be4ea94b8f9c31
SHA1 a72aab4defe54d679c5815e99ca5138f1487671f
SHA512 234c7ee91f69db64e6b32913232b9ad4b75f1da64377391444ce5b12fa93b3eec7b977397f6c61acd36cb67e09876ff40105c1ed2bce610308a83dce49448cc3
SSDEEP 1536:9iC0px/QM6k3lFX5zf2R4gV2flkhSJyJmq2fBRI5mb6lpatyCNs:On4pkjQR4fI4qGBi5mOl0tbs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0c:ea:3d:42:ce:02:0b:5c:cc:d0:5c:f0:86:78:e1:f1:c8:ae:a2:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Chains

Oct 22, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Secure Digital Services Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Secure Digital Services Limited,L=Dublin,ST=Dublin,C=IE

Serial Number

3b:62:dc:36:72:d1:d2:04:7d:89:74:36:1b:53:ec:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2009 - Nov 16, 2011

Minor OS version

0

Major OS version

5

Entry point

23511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_Alloc NS_StringGetData

nspr4

PR_AtomicDecrement PR_AtomicIncrement

kernel32

ResumeThread GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW MultiByteToWideChar lstrlenA InterlockedDecrement CloseHandle WaitForSingleObject SetEvent CreateEventW GetTickCount GetLocaleInfoA GetStringTypeW GetStringTypeA FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetACP LoadLibraryA InitializeCriticalSectionAndSpinCount GetModuleHandleA GetLastError WideCharToMultiByte HeapFree GetProcessHeap HeapAlloc RaiseException RtlUnwind VirtualProtect VirtualAlloc GetProcAddress GetModuleHandleW GetSystemInfo VirtualQuery TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread GetCPInfo CreateThread GetCurrentThreadId GetCommandLineA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualFree HeapReAlloc HeapCreate HeapDestroy Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError HeapSize

user32

SendMessageW FindWindowW

ole32

CoUninitialize CoInitialize CLSIDFromProgID CoCreateInstance

oleaut32

SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy VariantClear SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString

wininet

InternetCrackUrlW

[email protected]/components/OfferBoxXpCom.xpt

SHA256 5c86969f2262684eeadbcb60a85de39b2918e14dad73fb4307b22034d4809800
MD5 2f5f9011741b1e65e6e0d2480b2259e9
SHA1 ee2a111a26cc2681b18faecb8eff05d06a5d5e85
SHA512 91a1a3fc1b47454f30a2c8fa1f05dd00ef8df096a77fbba6aad327bef0182b0aca35068b64a363ad4a101053cc8e1f476ec6187dd4435c828b7ee7a74cfc7808
MD5 SHA1 SHA512

NSIS installer

installer

[email protected]/install.rdf

SHA256 70a4531307113b89f2965dca9ee0be45f877df5c9366fdc53fabba7dc3d03a73
MD5 f333315b051877641af8b3322f3b027d
SHA1 3618ee68eb656f460d05e041e5ac6e034c89efc3
SHA512 df916a2a00df467bd3d05b59963e0ed9ada395a9a64de16049411cb625cb077e106fb406c999bb8215944f4da457f7f8c3a6934288992107172db6e5c9df3ac8
MD5 SHA1 SHA512

NSIS installer

installer

res/language.xml

SHA256 b6c17ae875cea2902b9881d1707e2445a39ac01bffd9fad02e44d9cfb28bcb11
MD5 af45b42228991b62bcb0af31f67634e9
SHA1 f110866aa25b6c76147823dfdc498e3186a25967
SHA512 b4a70cb899a4edc9d77e9198145d0a26acb68ae322a2324c637fbf72e92f0529773912bab4a1ab79b91a61e0e7a4d0923faaeff57326e20b191197f0941a20a2
SSDEEP 192:dLfnlH7IdVeoCqOUfxP9Q5a8FfqlHo7QUzNQuFeDi+xJ+Acste7piTopfRL87BLk:JnFUDC3AlMVB7Q/JVSlLio9Pas3ZWU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

res/loader.gif

SHA256 271978b06de1a969aabd38bdeb72771935f8cedee9b284af9d54328710983627
MD5 b256d80f54c1415d7a6a6fdec39769f4
SHA1 376983d8f05d0737dd7064431d9f5d5234b56cd1
SHA512 9ab5c6bfaa64254abfa393367fa7a667efa2bc15ab332d37a5426c5e7987d1aca9775db00533e85192050865fd9e4163be079ab4f000e71eb7bb28d624937120
MD5 SHA1 SHA512

NSIS installer

installer

uninst.exe.nsis

SHA256 d561c887ca4632123733bc4ecded2f401b61acf5cf16e9ec93297303053d164a
MD5 ab57a3626f92a8727c93ef07ca4c89c0
SHA1 fc2aee38ff114e09dba9776e0875f03beb543f04
SHA512 9057131a1174b0245f53d4981eeb930f91d742315baaee74e217f0bca9476b5c036aa2aca0bdaa4b741820990499280b6abdd7fde4b259db65b23e250249e7d9
SSDEEP 3072:RkQEBw4mPAHdy8YipjERhd5HIVXQzewUiCw+i9:/EBPmOdYipjEjdGgzel8+i9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer