8b01cbd5cadf019f301814cd0a259488

resource	yara_rule
static1/unpack002/$PLUGINSDIR/nsRandom.dll	acprotect
static1/unpack002/$PLUGINSDIR/version.dll	acprotect

resource	yara_rule
static1/unpack002/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack002/$PLUGINSDIR/version.dll	upx

resource
unpack001/$PLUGINSDIR/CustomLicense.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/nsRandom.dll
unpack003/out.upx
unpack002/$PLUGINSDIR/nsisdt.dll
unpack002/$PLUGINSDIR/registry.dll
unpack002/$PLUGINSDIR/version.dll
unpack004/out.upx
unpack006/$PLUGINSDIR/KillProcDLL.dll
unpack006/$PLUGINSDIR/Math.dll
unpack006/$PLUGINSDIR/NSISdl.dll
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/inetc.dll
unpack006/$PLUGINSDIR/jsonparser.dll
unpack006/$PLUGINSDIR/md5dll.dll
unpack006/$PLUGINSDIR/nsisunz.dll
unpack006/$PLUGINSDIR/sqlwrap.dll
unpack006/$PLUGINSDIR/timepro.dll
unpack007/$PLUGINSDIR/InstallOptions.dll
unpack007/$PLUGINSDIR/KillProcDLL.dll
unpack007/$PLUGINSDIR/System.dll
unpack007/$PLUGINSDIR/UserInfo.dll
unpack007/$PLUGINSDIR/md5dll.dll
unpack008/$PLUGINSDIR/ExtractDLLEx.dll
unpack008/$PLUGINSDIR/InetLoad.dll
unpack008/$PLUGINSDIR/NSISdl.dll
unpack008/$PLUGINSDIR/Processes.dll
unpack008/$PLUGINSDIR/System.dll
unpack008/$PLUGINSDIR/UserInfo.dll
unpack008/$PLUGINSDIR/chrmPref.dll
unpack008/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/linker.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/dealply.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/dealply.exe	nsis_installer_2
static1/unpack002/vn-zugo.exe	nsis_installer_1
static1/unpack002/vn-zugo.exe	nsis_installer_2
static1/unpack006/$R0/AskSearchAsst.exe	nsis_installer_1
static1/unpack006/$R0/AskSearchAsst.exe	nsis_installer_2
static1/unpack001/$PLUGINSDIR/facemoods_w7th2.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/facemoods_w7th2.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6a0972e45710f3f23f3a05ea5ac582c20f511b3b4479d11204bcae5e56b15e85
MD5 8b01cbd5cadf019f301814cd0a259488
SHA1 754be5bfcb6d2a9e8bd479043526a601ed2394e6
SHA512 1ad0419a2edb8bb822fc26da6d20e84adc43bf02dcb8dc59ffd48786d2e733df3d7d46bfa4703399a62603d7ce8fe1d04aa00a4838a916e03ee29963cc5c8339
SSDEEP 49152:4Hmf776RPw9inVldaqtndm0/YTSH6Ozynkoo5WevfLiy:y0GdWutdm0w2R2kf5WCf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

24:88:99:a8:c8:7e:83:9e:c3:c1:57:e0:a5:c3:ee:a3:fc:4d:ee:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WebDevAZ Inc,O=WebDevAZ Inc,L=Arizona,ST=AZ,C=US,1.2.840.113549.1.9.1=#0c14737570706f727440776562646576617a2e636f6d

Chains

Feb 1, 2024

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$DESKTOP/themexp.org/Folder.ico

SHA256 700db4935ad00edba7dccaa035c53e0f9754200ef548b44c188f98cfd7a8cbb7
MD5 5d83d43a929368a98e5caed3bf6029b5
SHA1 cead44cb3cb03acfa5e73f895969f1277fbb7727
SHA512 38e2e659109082004a3bbf53fec6e6c3e241273f5a8b2a348c3de79f72b57370821ece15f39c0c89b4e33f5d736500c3f5c1ad857a4684f3d145e8a8c7845dd7
SSDEEP 192:E5snTUQlohvelYIifGeUnaZT6O6Rl4aTaTI8:E+nTpulelYPU+6O6Rl4aTaTI8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/CustomLicense.dll

IMPHASH 17ea51acf0005f354251d1882460a13c
SHA256 bdf2d5ac95808ffe5b29aac71fcc2eb64bdca5b272a9c4082a74e20d0b1f20da
MD5 ae97fd89eec5000b400e6bc7e8db0e56
SHA1 7ec1073f712ff5bd68deec894c36c0385bacdd68
SHA512 2e0d0182d7fda547bfd3f25c56d0c20ba75809ac8d4c96c2b40aad3db9a61c730a650c7e02c6050ab37abdf8ce66ea1e4479921d72e21f55b6fd42a3dc033ec3
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Firstlook_EULA.rtf

SHA256 97dd5233cd1a60d2f5f07dddac6f9fd9edef811ce2300f67500112162284f3df
MD5 7bdb34466392f623ae36f0eadf63e515
SHA1 4056d693b04f99bbf654cf7b5d3a90c3cdb7024e
SHA512 57b276387654c171744e9048e4b614160b684d4ffbd948d285f5691dd59ade305ed406cb64227190ab24c8b2daa843059708e3124b310d26e948686d233fcda6
SSDEEP 768:3lA64dNaXAoDeu8bgSDYAa92TwS1MPSXolD+cQMlyfDa3X7LjShAZqCm:3lSabS1a92TqSXo0co0XVjm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/Firstlook_banner.bmp

SHA256 aea2b89606f754935175c4d9276b72eb0c29857fbda267ab61777c3ca40e4d9d
MD5 3d6ed34138cf0c4818b4b0757e8c67d0
SHA1 fa5dc7ddfb52b78a75043a7a1d75e4a02978f9ac
SHA512 12c62c1adadac895d554ef7d0f5b13b02201556ac2e7be6ce3b7d6f074a05a3c2f2f59846c6c0b198571c24083d932f4989b938de43e7e4afebd345d2e3c80fc
SSDEEP 192:CmGuhvTWPbiWFrmchwuZ0oCKpxmefB2RA:CmGuhrWPbBgchwuZ0oCaxmefB2RA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TXP_EULA.rtf

SHA256 105cae7b46e4852e848aba1af13fee2f941578ea504508f5a1597ee7cf9347ff
MD5 78a6e403f8ae9faed0bb57e2299751c7
SHA1 57b6555887a5c94b9efd50767e979ca58e721488
SHA512 590d1dc00fda25d74d68bd2bcc383a5c4a7f705a123ac8a1077fcc28d9fd6c0b64104fafd93a9d5bde3655398ee2c0df9680253b2dcf8064d78c7a7ff77b3ad0
SSDEEP 384:Antwgqb7PzybdKkuh5EBmF4bnVVN4DJCfE3eroHvnr6c/ZoD80YrYjIi6rGsNAYs:Anqh5EBDnVVNBoT6ZD80hghAZqCn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/TXP_left.bmp

SHA256 9d0eda403116f5da7e7353bf9e0a6e0dbceddcc4a7736ee77ca8021bafabf1b4
MD5 0c190ec394ab5dc0f147bc0fbd217ebe
SHA1 c937c4b9b75c1de5008857126726543b070f3ef7
SHA512 c1b0556fd9b6756b1f86eb63c37cd7eb44a86f1c02f8ffe52b7ba42b814a4218cb6610fc80b1b4641421b5e8d3377ddb9da08b559130597d1c29f90601c090ae
SSDEEP 768:p/GDQtMllhHFCxZNKcIuMrEwYTtIksMmLnUf:Fn8HFC5KcIuMaJIdbUf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/TXP_up.bmp

SHA256 53b322af7b57b53373af81a1720be6d21b9178ea2919ab7b218a4492821513a1
MD5 2652b12ae66b26264b3999d7a2f75521
SHA1 973a093ad4872ac258594543e40e8014b386e747
SHA512 611c3d810194fe327d1a8ea1c9801493edd74f8a94e4b64873095d0fb4b3e45ef05595862e8c838991f1755d3f9df21377ebb21636b7bfbbf0f373aa5204a016
SSDEEP 1536:Ewegee/LlFKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKB:ke/LlW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/dealply.bmp

SHA256 fb800caffbd0fc3857a69af5486a08203e30b9abd0e06b79f8380454d26eae6f
MD5 86d8d49b65e8994182c703afdd15e9a3
SHA1 26d1dac8102d678cfa544d887fa69aa0e10f24a6
SHA512 6c4d6c5d859261c146c4fed774cb9d20830671a4132ab382b16e25d3c62cc26d70e37fdee6c391fc6e8f5c232d091277dbf312c7c786ff83b5820d9dcd94acb5
SSDEEP 768:fwOAnIGqCgk/robqqUENbTBgLBwFW1jOZJUDEqHKCZ6MX:fwOAnXqCF/AUkA9jfDEJCZ6MX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/dealply.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 9b6eb72e82c2baae30b48d405c3172469343b76e95539fd8e19ef2eb31d45de8
MD5 b68fad30ba12c18528ec302f8735f1b1
SHA1 5057293950ea2d2798deff0e6e6da7f71e0f5a06
SHA512 abf73190d37da6e296da4fc8d054d4606d4d74c1c2071ebc8f26d266d5dd94018e9e61dd43eb8bfddf1a7dba49e505e9929479f848301d8a9159c574438f7d12
SSDEEP 24576:HKWn4ndjrpbPhyiE4gIMcXFKW3O+Gxo8wIl:qdndjrpbcizcc15LGxo1E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b1:50:f9:ab:f3:78:f8:73:6c:1c:03:63:a2:bc:a7:8b:11:e5:f2:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Chains

Oct 27, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Serial Number

62:38:e7:e7:5d:4e:91:3e:ac:a7:a1:a3:f8:1b:cc:27

Issuer

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2011 - Jul 6, 2012

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsisdt.dll

IMPHASH aa911a57ef69e33e93666ad699a8d7be
SHA256 2261027077f23c8dba6b72af28862832aaa059740d0f5634b46cabb14326dd10
MD5 df4795dfabe3bc9278a73d496cc4b40d
SHA1 2648ded47e29ecf3e1a1cc20c631e83caf566897
SHA512 013d9712c3d699a7f41ab3e55931c9abb421fb2eda3542da5a4831ad2f073a1b0643120cc78147db0bfcd01df98ade3045ecb2f1e252fff1dc40be845e5ae303
SSDEEP 24:etGSyYi61xyMmuEwv61OVXOwr+t5blXgO8ELnD3TPrHjf7Xz5CY1aeBEW58q6TvK:6y2xyNuEwWwU5blmPeB958xTvT7L/
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

52B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

576B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

144B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

76B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/version.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome.manifest

SHA256 d1d2db094e371eb1a203435b32baae4dcf7c95145f41bc65f1104da5ca9e90e3
MD5 0f9020f034afe587a42a2ddf8c094b15
SHA1 5c5d2780ceef746aaf641097bae792aa44e433f9
SHA512 385fd7fec234dcf32cd6fc0c4be4d801c4c2100d849bb9b0e3c72e6733d0fa383aff063e7689a29967e6d5d88b8f8a2abe578f92e0530ea523aed7558a1face9
MD5 SHA1 SHA512

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/dealply.xul

SHA256 2bc803a5a32f11c013db0bd1c2496e33654337d02e07e9be6852549ddd1e2b86
MD5 de8164cf47bc29313ced645b3b48d34a
SHA1 9d92140eddac2ece093a4191f70f42c0e5ee133d
SHA512 8cb071ffcc846551d54c9a7ebe8e7f303a01064cf3bd658bdcd804f1799f55e4e5b326e326289a4b6150959668a8994d92321d82f54cd48b0e886f74e35b9a8f
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/images/dealplyIcon32.png

SHA256 c53217537e9e14f8ecf9f3a61d59ab8d128f174d95baa495558315e62e881455
MD5 3304097d8169f75d04f8005cdb063f2b
SHA1 4dcc87b3164689c4996754c124ad6ec735c0eb5b
SHA512 7343047a4dc43afe65b0852d1e3a2a502c653bb105ac2a759f013c38979b837487a135dbc2bb0dd08a4b985d8398d40001f4cb3352f2064d156b138a307f63a2
MD5 SHA1 SHA512

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js

SHA256 994f6d16c168dbb78a68b15883dcceb4581e45c32bfd4ea477bbad7f46dfaf84
MD5 6089beb98867572841a008183b4b9a0e
SHA1 8bb3b7edc6d0693cb623763712fbc78c4cfb93a5
SHA512 479a222870d06410ca329779690230526b1e309835cf259a3e8976a76e139c280aab32980514cec79c563ff0e3f30a5baea439f5c135760c0deec03efc7f33c7
MD5 SHA1 SHA512

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/install.rdf

SHA256 ac5239adb54737ac818d99f8d288cfb8bd2363d257536900d54bd2baf9051cf8
MD5 8041603a9efc126ec49ccea94351b524
SHA1 169a36baeb32017a49fe84561429781507c4c434
SHA512 071822031edde566323688f5272fde73a7caffe5622bbe66f109997f3e07d094dd6a9f310d58fdb7f23c5722e4622673b85c823fd177d78a1c4a6a03efea9b35
MD5 SHA1 SHA512

NSIS installer

installer

DealPly.crx

SHA256 ff1adc2c1390b5b070ac5a03bd433e93dc93e5c3f463703eb72f9942ae42fcd2
MD5 47314a806761a7fe27c8a08d59eb78ef
SHA1 97b32f730ca9e7d86da5d464d591f443498ec19b
SHA512 501e5b920afbaf506f1a009fbd91afc664d165eaaa2a85197a6569669247c82511608918e32965f765aae4e4990a2f1cd3311125b92b52292574172fe50f78d0
SSDEEP 384:QNromIiaK6E6PN73lC5ujCOFltGjP43M9BGGfKP8H:QNpI1K61tEYCOlGD4CBGey8H
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

background.html

SHA256 cde9fa114a23effda3202d21d7afe6c2a13506b71a588ad2afc0b9579472b109
MD5 bcb61d7c44a330b592b303755a5fa2b8
SHA1 b7180bfa7063c03de956d1f55f2e88cc6d58c386
SHA512 92d433cabf480285c9473867256b34199bf999ba627df94189d19d08a12ae83ad91a561daa10e6a14963f18adf9a56985ffa4cb3c104effdb2888a3aa5c7e1d3
MD5 SHA1 SHA512

NSIS installer

installer

images/dealplyIcon128.png

SHA256 4071fb493e583287253c24266737b0c9cfb05e902330c9f57e98285c052cc8fd
MD5 f7350f4155953a7ede975bf821aaba58
SHA1 c849540d01f85896723f3bce088a5c947835ef92
SHA512 d5d09621f71fec395c789dd1f0f61d0dcf72e42d99fd81e80af6cb6fc8924d6f36797087d01827cbc4c9a0987541ba098d1d9cc21fa2d61d091ca5bbf39433fc
SSDEEP 192:enmIR0L0doD6Uh2HS6pPN0C+U3lC5ujBJCOFltUDet4tJv4IcbioM9B5:emIiaK6E6PN73lC5ujCOFltGjP43M9B5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/dealplyIcon16.png

SHA256 44ea4d30db57a2936662ecb00d65caa10f7fd120d996efb1962ba58d0e4e0fa2
MD5 9b1ca93a2afa70e7b8ea9c6535972d85
SHA1 12448019c4569e9919e5ddd67f6d7427e4957fe5
SHA512 f1752e557df1d3621ad2321829e07d1a629ccaa6ba546718d7debe8386611bcc45966e9670cb835b4a7113461c126459bf8ac4f6bd195da709efa77f0f86b92d
MD5 SHA1 SHA512

NSIS installer

installer

images/dealplyIcon48.png

SHA256 2aa2b44abab7be57ba055e92520cda66ff5e09f1d835cb0a9c0caacd3809b56c
MD5 ca3b59c0dcb621f53d8f8394b57554c1
SHA1 e98dd9c034e4dcd01c6f60d3bfff863ebdea78da
SHA512 dd5e0f764ace8ded76725de3994d41786ce2f46ff40fbc8f53256f46d9d44585a8f32621da2e2502569953bae2406c577fd629bc35d0d400fd5d245c40b719fd
MD5 SHA1 SHA512

NSIS installer

installer

manifest.json

SHA256 70b60225d998fc640562c0938f36809896c931d017f36dcba0e25f0650b7c12e
MD5 5792f0de07821bb62c2f791c61f21904
SHA1 0b68d0bbca2363ae19d2d453bfe2823091f626a5
SHA512 11f128e18ccabf2a9b122b20738096baba6d2cfffdf7869de88252ea78be2b15de3e75aee3b06733703a0657c644a7c7b05b0ecbe949f957cd09abee998fa16f
MD5 SHA1 SHA512

NSIS installer

installer

DealPlyIE.dll

IMPHASH d126535b29e8ab83a18011d1747e9751
SHA256 c28c50700c5560d834b058e0ca816e1ccd003e77fb58777f55cd4b9d015f9013
MD5 53905cd4461961f341c0b41d4d0ec02b
SHA1 aa9d6284707f25a4ad35336ed6c131ac56f175aa
SHA512 84da2711dbeed65043150ed5afc23a6482ebb13e080a2e311f687ede136751c5f6e5fbeb947c0380e8b29ac64cb5741226a8ec23d69cd340ed8070fd48177248
SSDEEP 1536:FXEdWDidDMsRs/sbOyDsxbU3Q+HUWY9f5YJ+/W5P:F0iX/AyS3HHi9f5YJ+yP
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bc:68:ed:11:18:c5:a6:b9:c6:5d:da:bb:2d:a9:f9:60:7b:ea:24:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Chains

Aug 9, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Serial Number

62:38:e7:e7:5d:4e:91:3e:ac:a7:a1:a3:f8:1b:cc:27

Issuer

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 7, 2011 - Jul 6, 2012

Minor OS version

0

Major OS version

5

Entry point

9461

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\WebVolcano\dealply\dealdo.ie\output\DealPlyIE.pdb

kernel32

DisableThreadLibraryCalls GetModuleFileNameW GetSystemTime IsBadWritePtr InterlockedDecrement InterlockedIncrement FlushFileBuffers CloseHandle GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetLastError HeapFree HeapAlloc RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA LeaveCriticalSection EnterCriticalSection GetLocaleInfoA VirtualAlloc HeapReAlloc RtlUnwind HeapSize SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

advapi32

RegQueryValueExW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW

oleaut32

VariantClear SysAllocString VariantInit

icon.ico

SHA256 e174c37a6546f3561fea64030a69d3be67fbddaf55a1a5f84be2d1a8e1106d2d
MD5 d6aa5d65f6d4cf289e76c8f36fd2e974
SHA1 2cf343e4f01da2c3ca5a82ef8c0540847a3b7564
SHA512 5d854473a551590e3e3631d89e0d5ede8cf8fd82127f1894125dc72b0a3b48bd31124ead9899118df05e01abc5f35c9982aacdacdd68917b98e668b542155740
SSDEEP 96:OeczySceNgWKoxsfhtHx0Xw92mWE0FqCDnYPStxnDGvgXfUD9eNvJnH4Bc0C3vU2:OHF9nxSeY2jEMqInY9kyeNBYBk3+x0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninst.exe.nsis

SHA256 bde4bbf368bf777501d0aaff20de95aeddb4b558b961f112834162fbb3c35dd3
MD5 42a6596a5dd3597fe8b38ab7220f9769
SHA1 ca5ea77e6bad3e37a17d4c4ba0ac9c34549be4a3
SHA512 7d5b55d189dcadd26767fd6a4f0381c678fa04e4ce52c990cc8976f46ca1b7c533e7f7bef017535d49dda70791264bcfa31a02f49c504c88628b93aafe1267d3
SSDEEP 768:klaHJnHLnzFpdcwGu27hdpE2jNFw8NzFzRj9rVXEq9N0HqgzHSNOYH:klkHNcbu27LK2pFw8NRDVXES8qcy4s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

vn-zugo.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
MD5 6ee75d20b907780781e90fa97897b8ed
SHA1 03c0ce29326ceef11b237c91ca0922f3dc6ac0b4
SHA512 36eb2dc03ec76756a92aca72b3827105344b4ee2b179b4abf9432828505ee6d151df6959b2280d4086952ebefa4b273f83ab25ae1e2299bb4c3ef859483f1e08
SSDEEP 12288:CU1qWMBibgTEX4MXAoQu7uIpKfHB/mY+oCIPR08gu+8uRj2d4Gp57m63OM0u:CIqWeibgoIaUCoh+/ZyudGp5/3JB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

01:39:64:b1:ba:69:31:dc:37:56:b3:94:68:48:ee:d7:5a:03:59:42

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Chains

Oct 25, 2011

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 3113e12e0486a5a5251713b60422a7d6
SHA256 8f62633831a326174f05e89503e42a493aa834fa6d7ba7138d9d57ac5873512d
MD5 de2b06d8abcd4a1d3330e415ce638a6a
SHA1 2f1bf738915b288530dedb861f4ea4f60069a91f
SHA512 8dbc0edb71d6acc327418270b33d5627d7940ce406e54152af9f6c8f6d90c7239aa647a0e1f4769d0aa8bd3e38d60643e6356ff7a5ccf7dc44c5617f72277b70
SSDEEP 96:J1szPlsFYmIGExrjwIqiwZePAYyU76b+4d:Juztr+8wzg7xN4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
MD5 b140459077c7c39be4bef249c2f84535
SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
MD5 2f94245152dbd233e248909f9c01c578
SHA1 ab4e5879c001b36a2f9ff214946599fd015edda9
SHA512 f92830de27d6663be5e0df9e32cd88732bc7ee93b14c1ded65258c325d22436400801aff1124f40400c6c3b3c16e71deb08436714716f3888d13a8a6b6a32231
SSDEEP 384:vBCwUYeQ8geEQyhUtXlcgCHe8DSMk8/UhU7ya4L+0Ac9khYLMkIX0+GvRgbJ1:owUEpet1cgCHe8DNN/UhUua4L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/jsonparser.dll

IMPHASH 9477ce594d6aa3189ce13a8753710458
SHA256 7affb86cc94deba6b61a7e85337264ef8e19ef6b8a83904e22bafecbc4e1bed2
MD5 2067be2244a8a8d6d6229537076a4830
SHA1 15a27838b7d791d19d4e1e2566b3eb94938c08e9
SHA512 42a2afd0dc4f0128231fbbf3b428a29bc20ca55f0f36ed02056666b8b6bb5116b409142fd5609528fc323b9987681494803dff492824bc322b94d08d370603a2
SSDEEP 384:/iPnzsAzMhAEDKha6zmoh7ja939CH9aR5M+SKseGIJGVHHCldw9t+:/iPYAzMhAEsVj0NNHseGIgHiUt+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/md5dll.dll

IMPHASH e57536e0d3500471d52df7cea0d65a39
SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
MD5 a7d710e78711d5ab90e4792763241754
SHA1 f31cecd926c5d497aba163a17b75975ec34beb13
SHA512 f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
SSDEEP 96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nshist.dll

IMPHASH 5f100c36811a4c587bc08276d7725e60
SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
MD5 56bf72527ae93d35cd8f8778ad29902b
SHA1 3248a7ca75a3c2e715a13b455ccc5d45e04cf9b9
SHA512 c8ea0445bb83bb67dffa85b167fcc9b6ea874493442db5707e939ee0f2864a0d464ee605de486febffc27b60cd3c35a91302f226f6c4f13186119687a7e6000e
SSDEEP 384:Rb8/5X+ZjXpv4jNfoOZdd5P79dHwvwXTnxsEVRhCSkX4vJtgJ4LxvI5PMC3vlhw:ecOBxTTBdHwvwXtsQRhCX4vG4RIKKw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fc:90:9d:2e:fd:0c:8e:c0:8e:57:6c:72:c4:76:c7:2f:00:37:e6:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Chains

Sep 20, 2011

Minor OS version

0

Major OS version

4

Entry point

19891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sqlwrap.dll

IMPHASH fdc6ee00ab15ae25a28615ceaa6f4284
SHA256 35fd84a44cbbeda4ee7a7e40554c656a21506346862aa7af99ce74930522b20c
MD5 56bb18722f8e42a53d7d4ea6a09e520a
SHA1 7ccc0fa410cafec0a790e0c611087e1f61e8d7eb
SHA512 cee572a6ce1d1551da3e4efe7c5fa7a76ad4eeaccc583d856a350f24d2a3f9e8dc39fe885ce9aa9a696a24dda960ed920fdfbd97d7a3e7d327c1b0fb34ce691c
SSDEEP 96:2zCgCtUTDB8h8+rTjT90eB/DlAvSioMRwLCVD4B9:QCgft07ivOLCVDW9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/timepro.dll

IMPHASH 2187c9e78816febf7a90a23c7c7d6940
SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
MD5 009dbbdd1ef470dd752c2b73835da3e7
SHA1 f97da6556b24302df8201a092eaa32a80d49064b
SHA512 dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5
SSDEEP 48:iPDeRFIHpvCelHXKvDRnEungRnEYngia6JsRhdt3Ft5GoO1JqN1:kfhlRKdnEungRnEYngia5X3Ft5GF1J
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R0/AskSearchAsst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6e314a62cb2e33d5d5df9720ad8c0b5b466c2cc4a6fd12eeb5b633b8c72df3ba
MD5 28387db3bfa8ed7f1ba742b02b0c09d8
SHA1 517e2757282999db9cf823c2d7dedfa07342d5ad
SHA512 b6ea8554e6c8c614fe065e9915cfe0a8832b2f55bc30906f2ad8151911c70fbc37f8e6f456897c0409e28f10338bbc545f529feb91b54821dd867f5c749b7767
SSDEEP 1536:upgpHzb9dZVX9fHMvG0D3XJjAyASrBYt/nPl1wuK+J/K4Xhf6tW1svQf93wpoebw:0gXdZt9P6D3XJT/tOt27dW1sIxm9bw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0e:16:5a:d7:ea:fe:05:11:f9:20:a5:3c:93:ef:0d:b6:3a:30:f3:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Chains

Jan 19, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Serial Number

28:6f:8a:30:e2:ea:c6:96:5b:93:6f:82:6a:05:30:5d

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 17, 2008 - Jun 17, 2011

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
MD5 1e8e11f465afdabe97f529705786b368
SHA1 ea42bed65df6618c5f5648567d81f3935e70a2a0
SHA512 16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/md5dll.dll

IMPHASH e57536e0d3500471d52df7cea0d65a39
SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
MD5 a7d710e78711d5ab90e4792763241754
SHA1 f31cecd926c5d497aba163a17b75975ec34beb13
SHA512 f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
SSDEEP 96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_30_/searchplugins/ask.uk.xml

SHA256 ec49ea4d9aed428087d2e981715569649f49c0f7c191afbe3b611e0604f01889
MD5 e413d406eed738d72031878548022205
SHA1 7e530237857bfa78f3119e115ca3ff77fa79518a
SHA512 0409c058c7155e3241e37e26ab495420780c9051073110015fa712b2c253104ded0263c5a6fa57b84f9c659e4aabc1f022abe94cd92a1e833a1d1544ecd320ed
MD5 SHA1 SHA512

NSIS installer

installer

$R0/AskSearchAsst.ini

SHA256 e28cfebe18147a1ed846bfec1092f62ee191f2c6ce9f3795715ddc6f1fd2c30a
MD5 049aab81565f4118ff1843eb17989243
SHA1 2ba361f66370aa143596bf7a865bdfaac8ff8a36
SHA512 24892a98e6e114d9daa4e20b2ee2b36790888acabc4a4fb6e23d1554563c9d3e843f88462be029f0db568cb2f8397534d8df795b21873f0c1dc1c390f4586a40
MD5 SHA1 SHA512

NSIS installer

installer

$R0/ask.ico

SHA256 be31079e9eada076773dae275fb84ff7c113fac6bf11b6fc59b8a4fafa6e9f12
MD5 896b97c92f6c3215195eaf19eb71ce7e
SHA1 ef41f894b3ecd1e7225371cc5c4e532f43660f26
SHA512 1115c6bf1fca5a6a44b00afd21651710df9665e6811d9ccd55e546dbc18d4b333f76e076a417f0e123c7a46e09412e7b570a65ba85302e8618f6ee127f00db23
SSDEEP 192:8OE/xSAoOXN0VE/hOaAY8viZo/Ao+i2EzpPdxucJTNkA4MGtx4ip+w83:Z4XNTr0iaIo+ap9v7GTz+wo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$R0/bing-zugo.xml

SHA256 40af6e45352dbc8f0dc87d52870988f0fb4d240587160887823381d002a5b74b
MD5 c93afb79e9f45aad1cd4a6ebdea3e15b
SHA1 eb7f611b61a5f87a8a518156e61c8cbf6c789e06
SHA512 24863251cc1742c7b49d472528493cb84d1435043d28afceead6b38592c5a53f61880c181a7cb4e143905375f45876ebf2381dc6c42c18e0f886df498ba4821f
MD5 SHA1 SHA512

NSIS installer

installer

$R0/yahoo-zugo.xml

SHA256 4f06e80535e5d4be2a48989f053e8b22eeaa96d5cd53d2b361d29e1fe42de168
MD5 c77a4c9fb3064e0a4d2e3635f109e1f2
SHA1 8e80512c31989873dbce93df50c19bd9987891b0
SHA512 3b9a3ae430f012fd293a1864f262abda1b44fdb72a750d4a00dad50dae6b2d91c6622aaa0237143ee7b645479b7ea4c3adca261444dd9f391424ab848691b857
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/facemoods_terms.rtf

SHA256 7faf940cf5a2abc900639ade3262db9a9b0f623047a67e6b165c73aa33b90d35
MD5 021f978d062bdf04b58327f3b67c8aeb
SHA1 704ddc83f32a5ce6c95a1ce9af74f8f7b60c2a95
SHA512 f69264f3aff95d0fde5a582fa75a8d8bd74eeac255e6e7beb7723ae5260a5e1fc05e25e446a786b0003b40f3e75610ccf82013e6a86c73dd3c9a32ce20d7b97b
SSDEEP 768:l813p3VdAkF8bmrF5oa5Fscm0GEsGugGcQ/yK74fsWc24hAZqC3:l8TN8bqbGZytsWcwj3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/facemoods_up.bmp

SHA256 df1b85edea21a1cb4e155290a09b2048b9c80f0699707829bdcc51758702ed0e
MD5 211882b2ae5f5fd627c639af1b2ca2d3
SHA1 970cb56dc424de5d670a1d03ebe1e05f5c4f0d9a
SHA512 f26a80eb50bf536bf834953bac9847727cba3d60996b2e6729a2202d8cab3e75bef755bee17bdad32efe850088e36c40bb109cfd68de2886e8400ee394efb33d
SSDEEP 768:9/MY/w+AB2yinyoDSYSbR7rhpRB9lTWlnL15T64FLF/+Wp:9//s2yin3fSbRhVa15vFpR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/facemoods_w7th2.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 202916875d5cb278dabe5e5aa280fd7c296819534cf94c42ba01e6009c6aee99
MD5 4b844e8cd78a5dae585f21c9930b5c03
SHA1 169abfce05c62fc67856ae5fbd70c3546ae68be8
SHA512 983da1b31907c1acfa63b2cb82ce9106a833994edb95ddc3237018aa93823d86c44f12759c785d780a85f8171735720447a1e75945054eeb39018c4970a13c6c
SSDEEP 24576:33Wdk4yO1bzppgJLo01dvXjyoLTkyXN3VOBj7mEsLy:2tNCLbdzLTpXDOR7ELy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

5c:5e:54:9e:13:15:5d:72:7d:b0:ed:00:c6:d8:90:ec:cb:fb:30:81

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Sep 5, 2011

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/Local Storage/chrome-extension_ihflimipbcaljfnojhhknppphnnciiif_0.localstorage

SHA256 2af3e0f282942a6a94d441acd9fe930fe2401fbdfbc67a1e44f490fe914afe7d
MD5 97471c285c1afe9b7a2604b573ea4dcc
SHA1 722841633891847a5636d0ef48799e3b0e431c91
SHA512 eb33ef015ac8ff79fc13dcc0bb62629d0c32fef36b7997f01117616c403864bf3419d0d8d5aa0b16939b26e86f831bcacf60da42a239b6d199880ce958da4374
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ExtractDLLEx.dll

IMPHASH bab48790663c56c456d63bc3e045f161
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Processes.dll

IMPHASH eaa5f91829171a65db414b9e64ec9548
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/chrmPref.dll

IMPHASH 93bde92aa23094d5545e87c4d138f2ba
SHA256 a87ec5894c667c5eb22201172792027a525a375a9e6468aa4612ccf6875b1112
MD5 e02590b95a6be07cea5c5f3daf66e775
SHA1 28b6350c43d3804f69faa5f48cab70e229dd182a
SHA512 30e3abdeb2fa3c2e1bdc94e1e2b9f7fa9c85ff3d10198166e99e66a92a0ae4d62871a621eab069b1dfe2a99a7a4d457a494d91c811f1bd93c51f120f5ff692b5
SSDEEP 3072:0DNlF2bX2rBTxNwIjCRMOwt+kG2Dkq150yurKNN535xzFHcu:0DNlF24BmXH2f50L4ji
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

58477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcpyA SetEnvironmentVariableA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA WideCharToMultiByte MultiByteToWideChar GetLastError GetProcAddress GetCurrentThreadId WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA FreeLibrary LoadLibraryA CreateFileA InterlockedIncrement InterlockedDecrement GetProcessHeap GetLocaleInfoW IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID ReadFile ExitProcess RtlUnwind HeapFree HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetModuleHandleA LeaveCriticalSection EnterCriticalSection SetUnhandledExceptionFilter GetOEMCP GetCPInfo HeapDestroy HeapCreate VirtualFree HeapReAlloc IsBadWritePtr WriteFile FlushFileBuffers SetFilePointer TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA TranslateMessage

$PLUGINSDIR/modern-header.bmp

SHA256 9ca35a9dbdd4d596bcb7a3344fb0d7e7a8adbcb8fd11122484abbd5b53d8eb20
MD5 6ca928e60a9a3bf068f2380bdc9b44d8
SHA1 a03b5daf578a5ed7248c99e8e6a8814f4756782b
SHA512 fbc5e1397df6e24027fe6cea61c35c8e2874421ddf7ba1868972eb0a2a6d935087c78b2a424c2a1584e4444964f11ba2ee11ef67beff6c52e64fd1ba71b226c0
SSDEEP 768:O0m/4YIIIyI2IRQICIyIdIKIgIwI+AG9kAUIJ6XI3IJIFIHIrIYIDIpIAIAIAIc:O0zYIIIyI2ImICIyIdIKIgIwI1G9V6Xa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/Mozilla Firefox/searchplugins/fcmdSrchw7th2.xml

SHA256 ecf12f08b7aba181eba8de39fc16ea02ae9d8fbe1a082672681287fa8919012d
MD5 7ae4c660f70d7ae92e9899c676d66c6d
SHA1 cb4b1f481a92324f410f1675c4f5452dc5a66b3b
SHA512 b02f3835db16f32005892632529487a1b04bc5d778b046da59b88355634b23f7086953b2dd3ffaa79df19eed3d83b5473b61b0e3cd895685c17ae8ceafe01221
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/chrome.manifest

SHA256 43ab7764aaa9c7edc9eaec626832bbfda1dad0a234a49227c6611c34880aef57
MD5 edfe1d268ee42f8e4cb0ea2d57a88c2d
SHA1 8e3c934c51c319697030132eefdd1f55b6457fad
SHA512 0d4706f2662bbe2d882adabe99a5baa53f0b0b10cff1331bb06e88715e43d385232726b1ba4f8fcdb2e36276bad20aa7d625378b09c801084f1f8be0e662ab8d
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/components/FFHst.dll

IMPHASH 42265262b1570e7f94a9fb42ce88043e
SHA256 73f1c3bed7c14088ad837cf6468aecbdf37f8e9ca86faeb4fc7e5d79af071e09
MD5 4d858f32da07588f97a992cd083334ca
SHA1 75572a0793acb41e977c8ae0adc290f5b23da946
SHA512 37bb7b0ce98c2e345ce5508af2d7dbb30a85a2ce90d55887318105d71a88965445c2d1e7d7c129c400fd38435ea01bc72fac93e75770f01a8a114ad35e279fb4
SSDEEP 6144:XyWoZ5OaHK/HHWAV4/yZj8sNkWS4P7voGfk:if5zHK/NVpwsNkWSAoGs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

75:57:ed:00:83:5c:35:87:44:61:68:0e:da:cb:dd:0b:e6:25:24:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

62073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetMemoryManager NS_CStringContainerInit2 NS_StringContainerInit2 NS_CStringGetMutableData NS_CStringGetData NS_StringCopy NS_CStringContainerInit NS_CStringCopy NS_CStringContainerFinish NS_CStringCloneData NS_CStringToUTF16 NS_StringSetDataRange NS_CStringSetDataRange NS_Alloc NS_GetServiceManager NS_GetComponentManager NS_UTF16ToCString NS_StringGetMutableData NS_StringContainerFinish NS_StringContainerInit NS_StringGetData NS_StringSetData

kernel32

InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA MultiByteToWideChar WideCharToMultiByte GetLastError lstrlenW lstrlenA GetVersion lstrcmpiA lstrcmpiW CompareStringA CompareStringW GetEnvironmentVariableA GetEnvironmentVariableW GetStringTypeExA GetStringTypeExW CreateFileA InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA DeleteFileA CloseHandle GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA GetFileSize CreateThread SetThreadPriority ResumeThread Sleep TerminateThread FindClose FindNextFileA FindFirstFileA RaiseException GetCommandLineA ReadFile SetEnvironmentVariableA WaitForMultipleObjects CreateEventA CreateMutexA CreateSemaphoreA PulseEvent ResetEvent GetLocaleInfoW GetTimeZoneInformation SetConsoleCtrlHandler IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW SetEvent ReleaseMutex ReleaseSemaphore WaitForSingleObject FileTimeToSystemTime InterlockedDecrement SetEndOfFile GetStringTypeA LCMapStringW LCMapStringA FlushFileBuffers SetFilePointer IsBadCodePtr IsBadReadPtr CreateDirectoryA GetCPInfo GetOEMCP SetStdHandle WriteFile GetTempFileNameA MoveFileExA GetTempPathA EnterCriticalSection LeaveCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind ExitProcess GetCurrentThreadId UnhandledExceptionFilter DuplicateHandle FatalAppExitA HeapCreate VirtualFree IsBadWritePtr GetModuleHandleA TerminateProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA SetUnhandledExceptionFilter TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

CharLowerA PostThreadMessageA GetMessageA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA CharLowerW CharUpperA CharUpperW UnregisterClassA

advapi32

RegOpenKeyExA RegCloseKey OpenProcessToken RegQueryValueExA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA

ole32

CoTaskMemFree StringFromGUID2 GetRunningObjectTable CreateItemMoniker OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString

oleaut32

VariantClear VariantCopy GetErrorInfo VariantChangeType SetErrorInfo BstrFromVector VarBstrCat SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen DispCallFunc VarBstrCmp CreateErrorInfo VariantInit SysStringByteLen

nspr4

PR_sscanf PR_AtomicIncrement PR_AtomicDecrement

shlwapi

PathRemoveFileSpecA PathRenameExtensionA PathFindExtensionA PathCanonicalizeA PathAddBackslashA PathFindFileNameA StrStrW StrToIntExA

Name

.text

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_34_/extensions/[email protected]/components/FFHst.xpt

SHA256 5ca47fcca69bbe5538dbe464b57793aa0cd43410bedbc5a5ec34f52a3d6b683f
MD5 7b5b54d8cdf80a11234a81fed704647b
SHA1 6174bd947e18056633b74551c4b330b824022058
SHA512 64102bf7911dd3e5a38ff9bf86231faf9c4f957d7a77fc706fd1f709738ac30b6a715aa1ddb0f4dd3691a70be85e103912cb00a8d0e3ee4d8a87a3f1ac11df6d
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/facemoods.jar

SHA256 0b206703b286d945e5903caa43ed7b4be2c85d92b48919e376ea4bf1856b674a
MD5 35da6847680198d8cd54ed025657c1a4
SHA1 3b1ad576de71152f3096d709ea828855e08280c7
SHA512 ba9629577bc191b726e56e423acb48446e8ef2513cfbab247d5ed7501ad73f5093952e0bdb98202264cfb02aa7d65ce808896038a9a924b0fec47020edf30c9f
SSDEEP 768:bx635O0ft5QuOUg+gojzo0s7xcey9T9os4aObu:P2t5QGbjzIO/oMF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/facemoods.css

SHA256 ff33aa2b11164eed3dd5faf5bb07135cf30b87716c7edb6e6dd57e999bfe8376
MD5 1f378d2823131ebc4ca52591a3550306
SHA1 fdbf6f788c5c13511a9128b7f76a560aec165bbe
SHA512 38e832be660ea6a7bf62f38a1b69ee3c2d9bc71a13c5a1f9227e191e1b47b59098e1953126b56f95e74c1ce0ef2f2b59853693ce19bf6b72a86a179feb195840
MD5 SHA1 SHA512

NSIS installer

installer

content/facemoods.xul

SHA256 87308004d025e2a5c31a8b88c2430dcfb846b4ab08a71eaec98b97170ea41d1c
MD5 5f6549a7206671e4b1ec31b7d19f1c73
SHA1 9d5583ded41b79ba4b42f9c1d84aa23136de9e2f
SHA512 a53b2ec39ff6487786b7995b2ce494d775ce8f47f56ab2800caf8537eafa63c1d6fb3c7407a7a1662889ce85c11b9ce8473354f063e39b093c4e761c799728e8
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/arwDwn.gif

SHA256 09d5f001629c8f26137e88cf7a0f7636e6c17d0d75abff9fd3ac106a85571617
MD5 2aa11fa4dcf0f03a0c8fb08170272566
SHA1 9e304d6bd0b0183a54baa2821772aa9f72ef149f
SHA512 8ee3d2e19a20ae5a2d84eed2c722d4bafe9ccc67eb7a061723f660178564945d5938584614f2bbdf5c90b2c78eddd3368196828a2992935f3a688db46f624080
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/pref.jpg

SHA256 ab3399db35e9b42ab47b09f0a51c67b53d43f97d30f248b3042149a07ed5d504
MD5 8e13e2ebfe19e34aa34740aca5d4cb28
SHA1 23be684b0e1d653b056b4f8ef16418f58f39833e
SHA512 baf8fff280b1c88d19ac1fb5b83f9ba9ed025ccbaf3732b73604b9f1c33cd50b45cc5fc87ee5e7dec809b6e577be5140e8723996b44106e6d0c09abac1f12118
SSDEEP 384:s1ndjYSIVuiwK1ndjYSIVCnXP/EZyn/Qb0qM2sAF63WbUhSWxH6gwbhD57z016y0:s1lmApK1lmQmDsAloYtZbhxFlXWnkb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/imgs/search.png

SHA256 d7233956f9c2915306281a7e5f03b81af05add35737ee58d7a1088ed06e50af2
MD5 db16cf66110b470e05c94713568f68f0
SHA1 05c592716c053946681c725f4255322310cb851a
SHA512 bcd57eed0db752dc5868988b3f03b7bdc8e4a213b8df9787fda5387fbb8d2074fe0f48432ccf8ed24af86ad3879a1b2b0c8a75dd1e7fe814b96b5c48c07eb0b0
MD5 SHA1 SHA512

NSIS installer

installer

content/mtstart.js

SHA256 9ce029c379fa6709794e48fed80a981fbaf5baf69ca842fca1bf9e796f40cd5b
MD5 9978cfa2a984e8c46eb7701ef27735ce
SHA1 ac622df5ba595f6d1ae7e88541c62462b5176fb0
SHA512 8d18218313b7bc21517556049452da3e887e531b357804a26d6ab31d6ea2467ae858889ecec7ba42607e197c0c54b4d13143c0fa42264299e050fd8f394d524a
SSDEEP 192:YoBWK2dgQbyHafCl3HdHmJTC6axF8CPyjdSgpVbJzTgSCevXmIXHdbKi7p:YoHQGaKl3HcJTbR5RgS9mIXHtF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/prefLoader.js

SHA256 542b9822100d6d18f43312dc798b0dccc1a5326750c5687de2c775c2d3129213
MD5 bf06e3e9873338fafb57fca1d1f2c92b
SHA1 7fa1107fb960809be8f38a6aacb0031a47cd7a09
SHA512 f50d1b8b22dcb102d5ca318b791c2f29cf4d4b24716f84cb4efe1688ae214d65ade2dc32567fc68fd3f8de2e3abb61ebcda703e615f2be3efbc53d305809b003
MD5 SHA1 SHA512

NSIS installer

installer

content/preferences.xul

SHA256 8c8ea8500f2db6ceb7d1380ddfcff2ab880a03005b6c828cc5f32eba6fbb22f3
MD5 030273c1c6a64d21030cef66cce08235
SHA1 0560817783bdfb1d039ff05968aa372e5681397c
SHA512 6be19dbc6fa143aa2a9e0ff8c6180ee38ccef279c7c43667bf9438cecf0ace02fe14abce09e6a01e812d8d4cc85ffc58ef32a602b89640656c3cef61d9cb8b19
SSDEEP 96:PSK+p08ouSUdUFvc2+Db5MoknwUpHtf60a1YZCBddL7m:op0RGalV6kFiHYZCBd9m
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

content/tmplt.js

SHA256 cca94fab70df6e53ac189d41e112425482712e87b67e09abffcc7494caa0bbd5
MD5 63e3e1967199054335ed1a8ecdd24901
SHA1 386daff20cab67c044d2e5b9f63c97be05d2d98f
SHA512 029a8d6f231f3d082ade80aa85de9d57aaa1e4f1a812bc0b541dd03667bf2a8325251b8c34b8580cbcb571ec2cf7884d47e667b27bfc52d4448ea3b8653077b0
SSDEEP 192:dxT17sFA/oRQwGPV4UlbLQzJSc7LK8Jt8ZaG5:vpUAgG59xlbQccv8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_34_/extensions/[email protected]/install.rdf

SHA256 c2543ebbd797df0c4ef70cf0ab74150fa97e9cbd6d180c3ff34747ab4e35efb1
MD5 d6977d18d103e1fd91c3f964970bac2e
SHA1 b3e9689f55793cb3bd08fcc43de1c15c49d93e4d
SHA512 c2fb5da3d19c0da254cabc9d470a09631be5f88a841db5366e1ab9eadca77def60c38d56ab08308a537d7cf6b8035f90076c611b0cdb294bff3fdba09f87852d
MD5 SHA1 SHA512

NSIS installer

installer

bh/facemoods.dll

IMPHASH 44f4d3d27a95aa836b9d7cbf6a70fcc2
SHA256 b52d250a3cc40ffd3da353fc02a2b8f5c93ce7341b071228c8401a780c56313b
MD5 d0813204b590d8e8b98627fd75610e9d
SHA1 8d465e41bd3a156d6c3b12a562473193b9878a7d
SHA512 698698aacdf240812c5ab76cff7d5b4313c552b7df276cb3a63f56e13ac8400477bb01c6b93bfd7ef191bdf834db62afc34d42db239c4108b2eb9f36a18297a6
SSDEEP 3072:XPDSnuDyl0Gk5SMir25KeUpSDeVWwUz+JS4v5r95paU5paJu8cr2:fDzg0GRkKkwE4Vw7JuD2
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7e:3c:b1:8d:65:9a:9e:15:44:d2:f4:f3:b6:95:85:de:2f:68:c6:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

110596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escort.pdb

sensapi

IsNetworkAlive

kernel32

WideCharToMultiByte MultiByteToWideChar lstrlenW EnterCriticalSection LeaveCriticalSection GetLastError lstrlenA lstrcmpiA lstrcpynA lstrcpyA GetModuleFileNameA lstrcatA IsDBCSLeadByte InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryExA GetModuleHandleA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc lstrcpyW GetCurrentThreadId GetTickCount FindResourceExA GetProcAddress LoadLibraryA WaitForSingleObject ReleaseMutex CloseHandle CreateMutexA LoadResource GetCurrentProcessId QueryPerformanceCounter IsBadReadPtr GetCommandLineA FindResourceA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LockResource FlushFileBuffers SetStdHandle SetFilePointer IsBadCodePtr GetStringTypeW GetStringTypeA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange SetUnhandledExceptionFilter LocalFree HeapSize HeapReAlloc SetHandleCount LCMapStringW LCMapStringA GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError HeapDestroy VirtualFree IsBadWritePtr TlsAlloc HeapCreate

user32

EnumWindows DefWindowProcA RegisterClassExA UnregisterClassA CharNextA GetParent GetFocus GetWindowRect SetWindowLongA GetClientRect ShowWindow GetClassInfoExA wsprintfA LoadCursorA CharLowerBuffA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA SetWindowsHookExA CallNextHookEx UnhookWindowsHookEx FindWindowExA EnumChildWindows GetClassNameA GetWindowTextA CreateWindowExA GetWindowTextW GetWindowThreadProcessId SendMessageA SetWindowPos IsWindow CallWindowProcA GetWindowLongA MoveWindow

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoA

ole32

CreateItemMoniker CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance StringFromCLSID OleRun CLSIDFromString GetRunningObjectTable CLSIDFromProgID

oleaut32

VarUI4FromStr SysStringLen VariantClear LoadRegTypeLi VariantInit SysAllocStringByteLen SysStringByteLen DispCallFunc VarBstrCmp SysAllocStringLen SysFreeString RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

StrStrIW SHDeleteKeyA SHDeleteValueA PathFindExtensionA

facemoods.crx

SHA256 cc45a7785adf370466c050f324dc9cbb675ba6db452137acf91df3c8938bf977
MD5 c950d4862ff0dcff908a8934b28702e8
SHA1 910e844373c425ae105362e12007ed48ff6c18bd
SHA512 f159b788b79918240b7e9639affa24b0cccb340a9c53be7c59ed885617966ea8034c4e909cc19813ce240d1871b1bdd0c7dd9299791a7e554953e0fc2ac18730
SSDEEP 768:fqAW3YRsRdUby35PlH6ROtBxowFxA2JAQlwNnVwFDFYa9E5Tt:fqjoY2ePa2J3anVA+v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
MD5 SHA1 SHA512

NSIS installer

installer

facemoodsApp.dll

IMPHASH 54c66c30640ceaf09d0e7010ae8bba2a
SHA256 baf97779f0d58566e68e114a1fff1d926d25067c555d6c5ecc6708a452df7648
MD5 582b370e077dd9412daa10e8b7ac9015
SHA1 538a2aa698b3f41a1f0d0bcd195021946b4786a5
SHA512 f7d5b884300ca9f6de5df799e823a6bf630c83f75e4ed031dd3082b712c9f771e9378702ddc4a7ef9621141f1787c5db53768f2ba04b1f340fc59d6dfbdf0e30
SSDEEP 6144:jZTa9MWQh27pYg7Gg1uLJk352ADl81q3uF7EVfc:NTaqvh27pugwLJ2llU6u
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

36:1d:6f:d6:eb:70:ac:b0:5d:6e:0e:88:e6:e3:dc:82:8b:2d:f3:53

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

164632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortApp.pdb

iphlpapi

GetAdaptersInfo

kernel32

DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA lstrlenA lstrcmpiA lstrlenW lstrcpyA GetModuleHandleA GetModuleFileNameA LeaveCriticalSection InterlockedIncrement EnterCriticalSection InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA CompareStringA CompareStringW GetEnvironmentVariableA GetCurrentThreadId LoadLibraryA FreeLibrary GetProcAddress FileTimeToSystemTime SetEnvironmentVariableA DeleteFileA GetVolumeInformationA WaitForSingleObject GetTickCount ReleaseMutex SetEvent ResetEvent CloseHandle RaiseException CreateEventA InitializeCriticalSection CreateThread CreateFileA ReadFile WriteFile SetFilePointer GetFileSize VirtualProtect VirtualQuery IsBadReadPtr GetCurrentProcess SetFileTime SystemTimeToFileTime GetSystemTime MoveFileExA FileTimeToLocalFileTime GetFileTime GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTempFileNameA GetTempPathA CreateDirectoryA FindFirstFileA FindNextFileA FindClose FlushFileBuffers SetStdHandle WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange Sleep GetLastError SetUnhandledExceptionFilter CreateMutexA GetCPInfo GetOEMCP GetCommandLineA GetSystemTimeAsFileTime IsBadCodePtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemInfo VirtualAlloc RtlUnwind ExitProcess LocalFree GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings TerminateProcess

user32

CharNextA KillTimer SetTimer DispatchMessageA TranslateMessage PeekMessageA GetParent MsgWaitForMultipleObjects

advapi32

RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA ord165 SHGetSpecialFolderPathA

ole32

CoTaskMemFree OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize StringFromCLSID

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayCreate SafeArrayDestroy GetErrorInfo SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit VariantClear VariantCopy VarBstrCmp DispCallFunc RegisterTypeLi UnRegisterTypeLi LoadRegTypeLi LoadTypeLi VariantChangeType VarUI4FromStr VarBstrCat

shlwapi

StrToIntExA StrStrW PathRenameExtensionA PathFindNextComponentA PathIsURLW PathAppendA PathFileExistsW StrCmpIW PathFindExtensionA SHSetValueA SHGetValueA PathFindFileNameA

facemoodsEng.dll

IMPHASH 8b24b5fee3a50d84bb40a6cbf9737945
SHA256 7de1b95a08372d216e24078ad54f27783a6d04b88cac51f35deb8373cfe19c1b
MD5 45300e499ccca60e2a6869170eca9966
SHA1 fd9e5c83ff7337560e3f7f4ad9573934023b351b
SHA512 5733c6648f7ec897c8ca6f311b03d6b244ecd5865bdc4d1b79ba7edadefb38d88bc51297ee05973586dbec64b9c8a6f4817e17d84f2108443a991b6dc87bbc73
SSDEEP 6144:7LAZ7H7AcAV7PdAZckYFZboqfYCKNpPrnvxJYr7KU10:gZ7H7AcAVwcproqwCKNpjnXUK
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

79:80:a0:09:0b:3c:6b:a1:0b:3b:eb:5a:14:31:66:ee:d6:d5:58:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

227318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortEng.pdb

kernel32

CompareStringA CompareStringW GetEnvironmentVariableA SizeofResource LockResource LoadResource FindResourceA FindResourceExA CloseHandle WaitForSingleObject FlushInstructionCache GetCurrentProcess HeapAlloc GetProcessHeap GetCurrentThreadId CreateFileA CreateThread HeapFree GetTickCount MulDiv GlobalUnlock GlobalLock GlobalAlloc lstrcmpA GetProcAddress LoadLibraryA GetDateFormatA FileTimeToSystemTime SetEnvironmentVariableA FileTimeToLocalFileTime WriteFile GetFileTime Sleep ReleaseMutex SetEvent ResetEvent CreateMutexA CreateEventA MapViewOfFile CreateFileMappingA OpenFileMappingA GetFileSize UnmapViewOfFile ReadFile SetFilePointer FreeLibrary WideCharToMultiByte HeapDestroy HeapReAlloc HeapSize MultiByteToWideChar lstrcpynA InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange CreateDirectoryA FlushFileBuffers SetStdHandle GetLocaleInfoW IsBadCodePtr IsBadReadPtr IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetOEMCP SetUnhandledExceptionFilter TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCPInfo LCMapStringW LCMapStringA GetTimeFormatA GetCommandLineA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LocalFree GetModuleHandleA lstrcmpiA InterlockedDecrement InterlockedIncrement lstrcatA GetModuleFileNameA lstrlenA lstrcpyA IsDBCSLeadByte GetLastError LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW

user32

CreateAcceleratorTableA ScreenToClient UnregisterClassA CharNextA CharNextW SetWindowLongA PostMessageA GetClassInfoExA wsprintfA LoadCursorA CreateWindowExA RegisterClassExA DestroyWindow IsWindow IsWindowVisible SetTimer IsChild GetWindow GetParent DefWindowProcA GetWindowLongA CallWindowProcA SetWindowTextA GetWindowRect MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA FindWindowExA EnumChildWindows GetWindowThreadProcessId EnumWindows SystemParametersInfoA InflateRect SetForegroundWindow GetWindowTextLengthA GetWindowTextA AnimateWindow GetCursorPos OffsetRect ShowWindow MoveWindow RegisterWindowMessageA SendMessageTimeoutA GetCaretBlinkTime GetFocus GetClassNameA SetWindowPos RedrawWindow GetDlgItem SendMessageA SetFocus BeginPaint EndPaint DestroyAcceleratorTable GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor UpdateLayeredWindow CharLowerBuffA GetClientRect

gdi32

GetDeviceCaps OffsetViewportOrgEx CreateSolidBrush GetStockObject BitBlt CreateCompatibleBitmap CreateDIBSection DeleteObject SelectObject DeleteDC CreateCompatibleDC GetObjectA

advapi32

RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegCreateKeyExA RegSetValueExA RegEnumKeyExA RegQueryValueExA RegEnumValueW RegDeleteKeyA

shell32

SHGetFileInfoA SHGetSpecialFolderPathW

ole32

CoTaskMemFree StringFromCLSID StringFromGUID2 CoCreateInstance OleRun CreateItemMoniker CoInitialize CoUninitialize CLSIDFromProgID CLSIDFromString CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal CoGetClassObject OleInitialize OleUninitialize GetRunningObjectTable

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayGetDim GetErrorInfo SafeArrayGetUBound SafeArrayGetLBound VarBstrCat OleCreateFontIndirect VariantCopy DispCallFunc LoadRegTypeLi VarUI4FromStr VariantInit SysAllocStringLen VarBstrCmp RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString VariantClear SysStringByteLen SysAllocStringByteLen SysStringLen SafeArrayDestroy SafeArrayCopy SysFreeString

shlwapi

SHDeleteValueA SHGetValueA StrToIntExA SHSetValueA StrCmpIW PathFindExtensionA

gdiplus

GdiplusShutdown

ws2_32

WSAStartup WSACleanup getaddrinfo freeaddrinfo

facemoodsTlbr.dll

IMPHASH c5bd7ceec8c30d0cd7560ee6100655d6
SHA256 9e935e603e75690b3d56c748b2a435fa41fc3bb52508692c847b07acaeef45b1
MD5 0fb336ccb1fe21397098026df36fd914
SHA1 3fa3c67b6f4721a7d77cd478bd9b10a0377520fc
SHA512 28ccfcb2326812ff06ac097fe94fb117c3487c4aff8e5fd8b9e1eb8e51a57097eaab353239d6279b052abe7751e96e3aeccfb15ba1bca4305cd91ee7c6bd9b22
SSDEEP 3072:QJSxWnSCeKgNAO3HFubEz9Ev6U04Ws55h5paU5paEMlJ:QSxgaUbb674WE07N
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:ea:86:7b:90:3e:02:11:14:5d:8c:48:88:7a:af:5d:71:e7:86:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

76049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escorTlbr.pdb

kernel32

GetModuleFileNameA GetCurrentThreadId InterlockedIncrement InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA HeapFree GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpA WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA GetModuleHandleA lstrcpyA lstrlenW lstrcmpiA lstrlenA SetStdHandle SetFilePointer IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetCPInfo GetOEMCP TerminateProcess GetProcAddress IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCommandLineA VirtualQuery GetProcessHeap HeapAlloc GetCurrentProcess FlushInstructionCache FindResourceExA FindResourceA LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetLastError WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InterlockedExchange InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetSystemInfo VirtualAlloc VirtualProtect GetSystemTimeAsFileTime RtlUnwind ExitProcess LocalFree HeapSize HeapReAlloc HeapDestroy GetACP FlushFileBuffers

user32

CreateAcceleratorTableA GetClassNameA SetWindowPos RedrawWindow GetDlgItem SetFocus GetFocus IsChild PeekMessageA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor MsgWaitForMultipleObjects GetWindowTextLengthA GetWindowTextA SetWindowTextA DispatchMessageA ScreenToClient GetCursorPos SendMessageA GetParent GetWindow GetWindowRect CallWindowProcA GetWindowLongA DefWindowProcA IsWindow RegisterClassExA CharNextA CreateWindowExA GetClientRect LoadCursorA wsprintfA GetClassInfoExA ShowWindow SetWindowLongA IsWindowVisible TranslateMessage DestroyWindow UnregisterClassA DestroyAcceleratorTable RegisterWindowMessageA

gdi32

GetStockObject GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject DeleteObject SetViewportOrgEx CreateSolidBrush GetObjectA

advapi32

RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA

ole32

CreateItemMoniker GetRunningObjectTable CoTaskMemFree StringFromCLSID OleRun CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemAlloc OleLockRunning CLSIDFromProgID CLSIDFromString CoGetClassObject

oleaut32

SysFreeString SysAllocString VariantClear VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit UnRegisterTypeLi RegisterTypeLi SysAllocStringLen DispCallFunc OleCreateFontIndirect

shlwapi

PathFindExtensionA

facemoodssrv.exe

IMPHASH 5bb76c9b862d3d66ddbf9ae1fa74b496
SHA256 856b3b38f679af08a54656a9e820702602e832ffae2e66c8c903891140a7ba23
MD5 e83686c5f2273f8a7561897dd5f4e570
SHA1 b46c493e729674c1f02ae94d32c476e5b5077625
SHA512 f6147079dd8ef60b5c9a470df2cdd435c0813b9eb28999a660c54a74fa63ef05f4c665016363cc3489240235c36a8af9c0472306b0fd18cfcb49c3059513909e
SSDEEP 6144:OuugnYauQVYW6jPF0bVNjkKKAoY9Si5MGUIKT:OuFYauQVxVNjlJf5Ux
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f6:32:d9:41:0f:c5:f1:76:65:7a:6e:cd:f8:d5:61:6d:77:53:2d:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Sep 5, 2011

Minor OS version

0

Major OS version

4

Entry point

145035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dvlp\bin\facemoods\esrv.pdb

sensapi

IsNetworkAlive

kernel32

FileTimeToSystemTime FileTimeToLocalFileTime InterlockedDecrement GetFileTime WaitForSingleObject lstrlenA InterlockedIncrement lstrcmpiA lstrcpyA GetModuleHandleA GetModuleFileNameA lstrcpynA IsDBCSLeadByte LeaveCriticalSection EnterCriticalSection GetCurrentThreadId Sleep CreateThread CreateEventA lstrcatA SetEvent ExitProcess GetTickCount FreeLibrary LoadLibraryExA GetCommandLineA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc CompareStringA CompareStringW GetEnvironmentVariableA GetProcAddress LoadLibraryA SetFilePointer CreateDirectoryA GetTempPathA MoveFileExA GetTempFileNameA SetEnvironmentVariableA GlobalUnlock GlobalLock GlobalAlloc CreateFileA lstrcmpA ReleaseMutex ResetEvent CreateMutexA MultiByteToWideChar lstrlenW WideCharToMultiByte CloseHandle FlushFileBuffers SetStdHandle IsBadCodePtr IsBadReadPtr LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTimeZoneInformation SetUnhandledExceptionFilter GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate GetSystemTimeAsFileTime GetStartupInfoA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetDateFormatA GetTimeFormatA RtlUnwind LocalFree HeapSize HeapReAlloc HeapDestroy FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange WriteFile MulDiv

user32

SetWindowPos MsgWaitForMultipleObjects PeekMessageA GetWindowTextLengthA GetWindowTextA ShowWindow CharUpperA LoadIconA CharNextA SendMessageA UnregisterClassA DestroyWindow PostThreadMessageA DefWindowProcA LoadCursorA SetWindowTextA GetWindow SetWindowLongA IsWindow GetClassInfoExA CreateAcceleratorTableA GetParent GetClassNameA RedrawWindow DestroyAcceleratorTable GetDlgItem SetFocus GetFocus IsChild GetWindowLongA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetClientRect FillRect SetCapture ReleaseCapture GetSysColor GetMessageA DispatchMessageA TranslateMessage KillTimer RegisterWindowMessageA PostQuitMessage CreateWindowExA RegisterClassExA CallWindowProcA wsprintfA

gdi32

SelectObject DeleteObject CreateCompatibleDC BitBlt GetDeviceCaps GetObjectA GetStockObject CreateSolidBrush CreateCompatibleBitmap DeleteDC

advapi32

RegDeleteKeyA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegCloseKey

shell32

ord165 SHGetSpecialFolderPathA Shell_NotifyIconA SHGetFileInfoA ShellExecuteExA SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString CoTaskMemFree StringFromCLSID CoRevokeClassObject CoRegisterClassObject CoTaskMemAlloc CoCreateGuid CoTaskMemRealloc CoInitialize CoUninitialize StringFromGUID2 CoInitializeEx OleUninitialize OleInitialize CoGetClassObject

oleaut32

SysStringByteLen RegisterTypeLi DispCallFunc VarBstrCat OleCreateFontIndirect GetErrorInfo SysFreeString UnRegisterTypeLi VariantChangeType LoadTypeLi LoadRegTypeLi VarUI4FromStr SysAllocString SysAllocStringByteLen SafeArrayCopy SafeArrayDestroy SysAllocStringLen VariantCopy VariantClear SafeArrayUnlock SafeArrayLock VariantInit SafeArrayGetDim SafeArrayGetUBound SafeArrayGetLBound VarBstrCmp SysStringLen

shlwapi

PathFindFileNameA StrStrW PathFindExtensionA PathIsURLW StrToIntW SHGetValueA PathRenameExtensionA PathAppendA

uninstall.exe.nsis

SHA256 1726c56d80afe7d18c4a46e10a3b52de14ce9353659e5805034ad855a40299c2
MD5 bf1634fbcdbd45094bc2c137e43c029b
SHA1 d85ca3d3c113d96a73829f0d832f1498b431017e
SHA512 368ba7543286e4e492d69914ac5e64ae6bf68d9292411cb2bcafb85b38cc821996e14336d9166a9b97c9caedfc8a0b6db9acd6cfda23909bdf259f0e1702e1ff
SSDEEP 1536:Vw4I3JGjef21W4CBrtlp6bUi4VhYJfQfa:esiO1Yrtfm4VOP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 cb63b733a13c8765dc27269201021a4d6eb8b69996968707877dc7714de4695f
MD5 28b63cef8cadb57989672f95d2308462
SHA1 1fc67afbbb05d4bc9ad8eb548d93f9f6c51d1051
SHA512 8bb8e22636f7669005f955dea5bcbf2fbff57aa1664628a9dd43ba9217bb338c39510e99e73f09087a0a5059d60a9442e28df3ef84829f4f0cd67cfaea77a5a3
SSDEEP 384:iuKjwGitNo3psYgmyZBOpTMx2gUwJEMiMUTMF630Ac9khYLMkIX0+GTQ/h:izwDtNoSYgmyZ0KriMSMM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

15535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/linker.dll

IMPHASH ecfc30d297c65075fc7d3aa46feca14c
SHA256 75db16ea26ec8c6e728f4a99b737c8b3a6548b4c6b47fbe20286683df4745574
MD5 8b1a528ab4dbb024442b42d7a0fedead
SHA1 95d45da81fe6d595147c18dfbd8e63915825c16a
SHA512 9ed39f5a657dfcd04f3d9ec5592a826e9120128056ca17495b267355452cffd247d35a051edb810fd7647bbbcbea30844a426ea18c5bfdabedc792a172aa4d97
SSDEEP 96:lFi2eJMNhAXZqUCN9jna18wz7u2OwJbD+Sgd+SyVOVZ:l7eCAejna1bHewJn+Sm+SA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Uninstall.exe.nsis

SHA256 91ed7be92f60ec0fd370fdc4e12bd58842654eac59cadf6a8f04fc30672d09b1
MD5 988c80c7523aa52f8fa07d000cce33b7
SHA1 a267a3ffbbdcb832dda98724a26f705533a5e687
SHA512 ff22dfecb9f5e44680bc3878ee950ecfdcc67780d6cfe66243859322790ca4592bd1098a0f4ce2d429bafaabc21798734ed87eaa5ddeaea02695f70411a2f9ff
SSDEEP 96:wyNPTRarfdHsEec7ZsAQmBoFx2HLMK0MJsXNv6pXqXj8X/iX62n73iM1Jfy52Piw:93ar1iuhHBoFx+0MJs9vgXN/iX9d6Yr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer