2b439a03a70011aaae44b6b2b56953188c6607d547b7aa3f5d6924bce9ef5d18

resource
2b439a03a70011aaae44b6b2b56953188c6607d547b7aa3f5d6924bce9ef5d18
unpack001/$PLUGINSDIR/Delay.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/Castle Clout 2.exe
unpack001/Uninst.exe
unpack002/$PLUGINSDIR/Delay.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/inetc.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninst.exe	nsis_installer_1
static1/unpack001/Uninst.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2b439a03a70011aaae44b6b2b56953188c6607d547b7aa3f5d6924bce9ef5d18
MD5 2f35d56ad83cf6f1d2c0ca2c6c78ab67
SHA1 79dfb7c1a5381b7f6db325ccb0fc107dccf2419b
SHA512 a405da9eb3d2925105a30fad3431f965a409a0b5dcdd81250dd672775a3ba0609d6fdb70344977e89be94f5df2c594ca77bec16e3ad5e66852514a59b1c1613e
SSDEEP 24576:JMZIwzMpYwyaIr8ur+FNtk9n7QFua7Pi7znxfZbzkScSZgXRaWZIfuB9H5O18L:uJoYwnLFNtWOni7zxRbApSZgXRaWAuBF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Delay.dll

IMPHASH bb13ae3bcb238d1bf689a931b2a56cd6
SHA256 b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
MD5 4602d9a9ed82d646522ead08a58536a9
SHA1 b070bad90e13e85c97bd4e530ca7958c22e36a5a
SHA512 5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
SSDEEP 96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/dl.ini

SHA256 7ad8e4897dc114a2f482ea5d3b04690ed8633609f04cec700154bd1929d30fc0
MD5 6a965fbc16b90bafb33d63a2e9527834
SHA1 e3ca742068f23fc89da08ce27c8600548f2ff207
SHA512 15a46287fff7e5330ae7d0367bbc8c850ce7bbc5c331a142eb4d24d4ae166f9b59d7e0f844711dded39a07d1abe473e71d6f7bf4acbfd5d47ca8f9e372abb905
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 9d8b89a5f0020174aa95e75f754c06b7212ecc28034ee0f7df7d48eae06cc218
MD5 cad67d5781430559f63e1ca987294581
SHA1 534d75aa5ccb95ca1330299a460497c0e7ceed0f
SHA512 3a4739c3723a22ece07e389d87a49ae704b917886abe2ed4c334b72da06f6c345f21924e8d5e9fdc0b4f6e456cd642f209e8ed5485675287f99190be3e918cbd
SSDEEP 3072:v+X7JPuhwmKObm87DxGSl9uByBRQDVl44ZHDJVJpntsrJwOFWzUpzcypomb:v+X9Puhw/Obm8XxDl9uByBRQDV+4ZHDo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Castle Clout 2.exe

IMPHASH 32ffdd2596c008e3b5b2071e2df6d7f2
SHA256 05359de3e14bdf07ba899a204d894be2b88e9109d00962671ac5118a43dac722
MD5 8a84afcc7fa2f4d4a1e778be28ee94e4
SHA1 8238e77fab788b1317df44083cec1e9c6fbc85b1
SHA512 b3c2db777590ba7a73cc4e29de40d6e45fbfcd3c246d1ae88e572318178e6344d3ea940e290dba6a153f1b983dd18209b4f61a3b9e386febc0557ff1625b1c0c
SSDEEP 24576:nhBGEgxCQTOqIkRUOtpzo5TfQ3qXUeZ1p18IXf4RPjUDsiIusqbIM:7UwGTR57zUY3qxZ1gqf4RPIfvN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CompareStringA CreateEventA CreateFileA CreateThread DebugBreak DeleteCriticalSection DeleteFileA EnterCriticalSection EnumCalendarInfoA ExitProcess FindClose FindFirstFileA FindResourceA FormatMessageA FreeLibrary FreeResource GetACP GetCPInfo GetCommandLineA GetCurrentProcessId GetCurrentThreadId GetDateFormatA GetDiskFreeSpaceA GetEnvironmentStrings GetFileAttributesA GetFileSize GetFileType GetLastError GetLocalTime GetLocaleInfoA GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeExA GetStringTypeW GetSystemInfo GetTempPathA GetThreadLocale GetTickCount GetUserDefaultLCID GetVersion GetVersionExA GlobalAddAtomA GlobalAlloc GlobalDeleteAtom GlobalFindAtomA GlobalFree GlobalHandle GlobalLock GlobalReAlloc GlobalSize GlobalUnlock HeapAlloc HeapFree InitializeCriticalSection InterlockedDecrement InterlockedIncrement LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadResource LocalAlloc LocalFree LockResource MulDiv MultiByteToWideChar RaiseException ReadFile ResetEvent RtlUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetHandleCount SetLastError SetThreadLocale SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcpyA lstrcpynA lstrlenA

comctl32

ImageList_Add ImageList_BeginDrag ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIconSize ImageList_GetImageCount ImageList_Read ImageList_Remove ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetDragCursorImage ImageList_SetIconSize ImageList_Write

gdi32

BitBlt CloseEnhMetaFile CopyEnhMetaFileA CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateDIBitmap CreateEnhMetaFileA CreateFontIndirectA CreateHalftonePalette CreatePalette CreatePenIndirect CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject ExcludeClipRect GetBitmapBits GetBrushOrgEx GetClipBox GetCurrentPositionEx GetDCOrgEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileDescriptionA GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetObjectA GetPaletteEntries GetPixel GetStockObject GetSystemPaletteEntries GetTextExtentPoint32A GetTextMetricsA GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LPtoDP LineTo MaskBlt MoveToEx PatBlt PlayEnhMetaFile RealizePalette RectVisible RestoreDC SaveDC SelectObject SelectPalette SetBkColor SetBkMode SetBrushOrgEx SetDIBColorTable SetEnhMetaFileBits SetMapMode SetPixel SetROP2 SetStretchBltMode SetTextColor SetViewportOrgEx SetWinMetaFileBits SetWindowOrgEx StretchBlt UnrealizeObject

shell32

ShellExecuteA

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginPaint CallNextHookEx CallWindowProcA CharLowerA CharLowerBuffA CharNextA CheckMenuItem ClientToScreen CreateIcon CreateMenu CreatePopupMenu CreateWindowExA DefFrameProcA DefMDIChildProcA DefWindowProcA DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DrawEdge DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextA EnableMenuItem EnableScrollBar EnableWindow EndPaint EnumThreadWindows EnumWindows EqualRect FillRect FindWindowA FrameRect GetActiveWindow GetCapture GetClassInfoA GetClassNameA GetClientRect GetClipboardData GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextA GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardState GetKeyboardType GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuState GetMenuStringA GetMessageTime GetParent GetPropA GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSystemMenu GetSystemMetrics GetTopWindow GetWindow GetWindowDC GetWindowLongA GetWindowPlacement GetWindowRect GetWindowTextA GetWindowThreadProcessId InflateRect InsertMenuA InsertMenuItemA IntersectRect InvalidateRect IsChild IsDialogMessageA IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadBitmapA LoadCursorA LoadIconA LoadKeyboardLayoutA LoadStringA MapVirtualKeyA MapWindowPoints MessageBoxA OemToCharA OffsetRect PeekMessageA PostMessageA PostQuitMessage PtInRect RedrawWindow RegisterClassA RegisterClipboardFormatA RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu RemovePropA ScreenToClient ScrollWindow SendMessageA SetActiveWindow SetCapture SetClassLongA SetCursor SetFocus SetForegroundWindow SetMenu SetMenuItemInfoA SetPropA SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWindowLongA SetWindowPlacement SetWindowPos SetWindowsHookExA ShowCursor ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoA TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UnregisterClassA UpdateWindow WaitMessage WinHelpA WindowFromPoint wsprintfA GetSysColor

ole32

CoCreateInstance CoGetClassObject CoInitialize CoUninitialize CreateStreamOnHGlobal IsAccelerator IsEqualGUID OleDraw OleSetMenuDescriptor

oleaut32

GetErrorInfo SafeArrayCreate SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayRedim SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantCopyInd VariantInit

@$xp$41Shockwaveflashobjects_tlb@TShockwaveFlash @$xp$41Shockwaveflashobjects_tlb@TShockwaveFlash @@Shockwaveflashobjects_ocx@Finalize @@Shockwaveflashobjects_ocx@Initialize @@Unit1@Finalize @@Unit1@Initialize @Shockwaveflashobjects_ocx@Register$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@ @Shockwaveflashobjects_tlb@TShockwaveFlash@ @Shockwaveflashobjects_tlb@TShockwaveFlash@$bctr$qqrp18Classes@TComponent @Shockwaveflashobjects_tlb@TShockwaveFlash@$bctr$qqrp18Classes@TComponent @Shockwaveflashobjects_tlb@TShockwaveFlash@$bctr$qqrpv @Shockwaveflashobjects_tlb@TShockwaveFlash@$bctr$qqrpv @Shockwaveflashobjects_tlb@TShockwaveFlash@Back$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@CControlData @Shockwaveflashobjects_tlb@TShockwaveFlash@CallFunction$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@CreateControl$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@CurrentFrame$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@DEF_CTL_INTF @Shockwaveflashobjects_tlb@TShockwaveFlash@DisableLocalSecurity$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@EnforceLocalSecurity$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@EventDispIDs @Shockwaveflashobjects_tlb@TShockwaveFlash@FlashVersion$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@Forward$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@FrameLoaded$qqrl @Shockwaveflashobjects_tlb@TShockwaveFlash@GetDefaultInterface$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@GetVariable$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@GetWordBoolProp$qqri @Shockwaveflashobjects_tlb@TShockwaveFlash@GetWordBoolProp$qqri @Shockwaveflashobjects_tlb@TShockwaveFlash@GotoFrame$qqrl @Shockwaveflashobjects_tlb@TShockwaveFlash@InitControlData$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@IsPlaying$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@LoadMovie$qqripb @Shockwaveflashobjects_tlb@TShockwaveFlash@OptParam @Shockwaveflashobjects_tlb@TShockwaveFlash@Pan$qqrlli @Shockwaveflashobjects_tlb@TShockwaveFlash@PercentLoaded$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@Play$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@Rewind$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@SetReturnValue$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@SetVariable$qqrpbt1 @Shockwaveflashobjects_tlb@TShockwaveFlash@SetWordBoolProp$qqrio @Shockwaveflashobjects_tlb@TShockwaveFlash@SetWordBoolProp$qqrio @Shockwaveflashobjects_tlb@TShockwaveFlash@SetZoomRect$qqrllll @Shockwaveflashobjects_tlb@TShockwaveFlash@Stop$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@StopPlay$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@TCallFrame$qqrpbi @Shockwaveflashobjects_tlb@TShockwaveFlash@TCallLabel$qqrpbt1 @Shockwaveflashobjects_tlb@TShockwaveFlash@TCurrentFrame$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@TCurrentLabel$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@TGetProperty$qqrpbi @Shockwaveflashobjects_tlb@TShockwaveFlash@TGetPropertyAsNumber$qqrpbi @Shockwaveflashobjects_tlb@TShockwaveFlash@TGetPropertyNum$qqrpbi @Shockwaveflashobjects_tlb@TShockwaveFlash@TGotoFrame$qqrpbl @Shockwaveflashobjects_tlb@TShockwaveFlash@TGotoLabel$qqrpbt1 @Shockwaveflashobjects_tlb@TShockwaveFlash@TPlay$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@TSetProperty$qqrpbit1 @Shockwaveflashobjects_tlb@TShockwaveFlash@TSetPropertyNum$qqrpbid @Shockwaveflashobjects_tlb@TShockwaveFlash@TStopPlay$qqrpb @Shockwaveflashobjects_tlb@TShockwaveFlash@Zoom$qqri @Shockwaveflashobjects_tlb@TShockwaveFlash@get_InlineData$qqrv @Shockwaveflashobjects_tlb@TShockwaveFlash@set_InlineData$qqrp8IUnknown _Form1 __GetExceptDLLinfo ___CPPdebugHook

Name

.text

Size

437KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

24KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.edata

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

820KB

Virtual Size

820KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1f9f2a47e8c6ba0adac309cd8bc3fa7858963bfed9ad42c669e194ae0eb13743
MD5 4f328289767df4f975169f92c2bb4127
SHA1 1a9a93f3209e2713a6c0cab9a54eb78733e24297
SHA512 8cd458bd64ccb4636eee355d84519dd9928c51687b59fd9d3e2b38a17f6b68ebd691780537067275c81d0ed05a01e7e59e084616175f6e1192ac01745749342d
SSDEEP 1536:UyZMSZFvknTePMZd4k4kJJe+zR5NSO3gaevfPzG+cZWoAN8GYiutIhy67j21v/hr:jZMJnTeM4cJJe+zlwa8fPz49biueh77m
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Delay.dll

IMPHASH bb13ae3bcb238d1bf689a931b2a56cd6
SHA256 b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
MD5 4602d9a9ed82d646522ead08a58536a9
SHA1 b070bad90e13e85c97bd4e530ca7958c22e36a5a
SHA512 5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
SSDEEP 96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 9d8b89a5f0020174aa95e75f754c06b7212ecc28034ee0f7df7d48eae06cc218
MD5 cad67d5781430559f63e1ca987294581
SHA1 534d75aa5ccb95ca1330299a460497c0e7ceed0f
SHA512 3a4739c3723a22ece07e389d87a49ae704b917886abe2ed4c334b72da06f6c345f21924e8d5e9fdc0b4f6e456cd642f209e8ed5485675287f99190be3e918cbd
SSDEEP 3072:v+X7JPuhwmKObm87DxGSl9uByBRQDVl44ZHDJVJpntsrJwOFWzUpzcypomb:v+X9Puhw/Obm8XxDl9uByBRQDV+4ZHDo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer