8ef8be947abf2097d72b29c77d2bcf6f

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InvokeShellVerb.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/MoreInfo.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsisXML.dll
unpack001/$PLUGINSDIR/registry.dll
unpack003/$PLUGINSDIR/KillProcDLL.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/registry.dll

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 11c50f2f12ce77d8f1d6098733ba9e3e4e08e81e54ac613df2b006d53f08efc2
MD5 8ef8be947abf2097d72b29c77d2bcf6f
SHA1 eb6d1ccef39e46b34b20e45f58b7235630958fcd
SHA512 e3dfd2e09d04a9ce87717d4d7078094589d9cf4c5b73a88b4120e1bd181ab0c542827c02f8d2f9449d8824ed3deced916f6535f6a6a70ad6fd178f19dfa636be
SSDEEP 49152:B4iUJg/bzdpAI7QeZ6688/ykGl4y8u7CUxE:BpUJWbp+IdQ3VPmyrBq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Bandoo Media\, Inc.,O=Bandoo Media\, Inc.,L=Panama City,ST=Panama,C=PA

Serial Number

3d:ec:b3:f6:06:98:17:01:01:07:78:2e:ab:f5:18:fb

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 27, 2014 - Feb 23, 2016

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Ask_Logo.bmp

SHA256 41f1c48db65dac2e6c232de1976dd7cb02ca5b19e4c1b63ecd9150b1510ba2ea
MD5 0b566f28fde1bf7cf05492b75bc901d1
SHA1 947865d0589286380996b2a9001314ba64933e0d
SHA512 d26982bd9b1cb7197e823ce32b5a39fae5de8fced22da8b82b6742b3579920b8fb596198d92f345ed91df5eb6368f2be646719ece30d36714daf697ad3690bae
MD5 SHA1 SHA512

$PLUGINSDIR/FindProcDLL.dll

IMPHASH e26d7460d0c04056b9226a899477ba4d
SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
MD5 6f73b00aef6c49eac62128ef3eca677e
SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InvokeShellVerb.dll

IMPHASH 1dd17c8be9b0761e58bbdf6fc06463e3
SHA256 2fddc8b8ab4bf4838ea374d25e4cb9e83362c3f1cb24f380137d14c814d56169
MD5 1a6e1ea7e90e50d9a18e034e7cde41a6
SHA1 93148d67fc2cee4537f749a8c98a0735065241a8
SHA512 53d35e9e4a0d45a5b37da7952f7bf8c26666fa57748c3d292fd154e40a602f08ad55735cefe9bdf043e03e3eff3e58d603bd9980ef291b3c5f409228dd5ba872
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH d806a080e21508dd768fa70be247d2ae
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MoreInfo.dll

IMPHASH 149adf074d317fbf0d2f17314bd18969
SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
MD5 bd393029cc49b415b6c9aeb8a4936516
SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ask_eula.rtf

SHA256 4346de72fee6dbe8b74218d8d9550395bf7f26634eb026ff6359fa0f855e9a4d
MD5 7bd45e3280288dda6fd602031e2066e8
SHA1 db4d49155de06f6a10ae50c01c612e4d998547bf
SHA512 a3a40b878d46531127a55550c807e6a17374d5d52bd645ba6b61fc0ae551d348247c4d4969c32e60b7bdad7ce1b3167f3d87b4eab2746ae305f182d4084c09d3
SSDEEP 1536:ZZAZp31HamwWkLTX6sbKIJ8rqj5mXoArAp0blt5S2y4e4N:ZIp3haYl2to
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner.bmp

SHA256 e3ee55ae84b373211afc1d5fe7f529ef08aafe34a9c7caf52d51fa0c20bee16d
MD5 1021fb81021bc073c0e9c31d27f1ece9
SHA1 b616ead1428d50b8c9a2e8a489dfa0f0011e73d4
SHA512 3addb0e8f78fdec381bb886297b0cbb5ab2e7b5e8ce17bd9e53b157acc2c8269b502b21fd1a71fda2c61e3c2e50145e8172dd09d4c220b727423c096eca75d5e
SSDEEP 768:lndwrbWfG/Ildwbxj1GUfYRfFwpEXLUUiWpIMr44Y3WlCxsm:loWf0IQdjKfrTeMaVsm
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_chrome.bmp

SHA256 511f82edb24c5b232c64f2d6defd2f38d857fa5af26c82d62415401eeed96d12
MD5 3e99264330fc034dd89b4d83ae34c9e8
SHA1 c9a011d729ea9252007cee56d3670fa47f2ce35b
SHA512 a0c4074da42bf379d46cd305c11405eecd5bb008cd4d13751e26949b9e1aa1a08e923350ea3756694f668446f59ce0b2986f10c978697764722f05a7aca78d75
SSDEEP 1536:eECS8itELJAuZVNdYhgLZWOiPBd0Zzor2aLCf:eEAitOYLGf
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_chrome_36.bmp

SHA256 44b246bc4552e0b092d37d8af4216fbee7d63203c7d426d180cbd48211465640
MD5 708ce1cc7d980dd3672728ecbe4e55b1
SHA1 dbc6d7f091c152ca09ffa7726629b6b08cdea899
SHA512 a355df480349d7f900fe5d91a1a10b993038bae6ab709bff3554dd26964c2003f1bb52efa986fadbb473e3196df552cbfb9ad1cdf3c11f521ea4d785ea329069
SSDEEP 768:RP0ocPK29AvQLPJroJkXX2E0XNM97D58GYHEWfqD2IRq2qD2Fp7VhPzuJ:J0ocK2toQdWHNfqD2IRq2qD2Fp5hPzq
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_ff.bmp

SHA256 6cf7004c2a5263b73bcefd62d14204ae71a914681a4f93301865726f283778d5
MD5 937d41898bfd2235cea8df655e4ccb0f
SHA1 891eb1d3e844dca54fedcad4899e267303f8a139
SHA512 519c6d678d37ba12bb1d5c757c45ec20b669e3c10840a44db9f66e98b9928ac6e24cf4cc7631d9ee06d114ab3c659176a66d32bdcf0291db9db348501e2cfaab
SSDEEP 1536:yh+jq7u1AjkNNNNNhNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNb:YuquQkNNNNNhNNNNNNNNNNNNNNNNNNNB
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_ie.bmp

SHA256 f1deb335a8b9e3ea369314427b613c74208b6ed193fd4c6cf6d67851667dadc8
MD5 8813ccf246fd02a6799aab19f693ef1f
SHA1 8ca8662ea177eb893d6b31e2a40b1d6d3491721f
SHA512 6481644bbbfb757d135e8cb8c01aca5e834194544d5a13ebb080fd924c1ec24fcdf1eb653c0a65c0106e8c7b9ad64c16daa107f2db2f0ca49712d1de9c7d9f4b
SSDEEP 384:RzP4oAWavwEs1QnNK2cAQJPUCl3vWqetPSi:BrAW+wEs1+K7PUCpWqetPSi
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-header.bmp

SHA256 812226b9201415e011752af2289c55e58d8492a7c00449f2601fc8932cc603e3
MD5 1f3bedf74421b6b084022346eea76469
SHA1 1a0ac056a3f3fa221ea15820f040becf4fcf07af
SHA512 e904cb20bf1a2ae1bffb9b223a449eaabfbe52ae0592a9266040712a8e16599be1aa4a2bbcc0eb709e3d5e540db666e148bb94f601e084c3cc881e9815ecc6c1
SSDEEP 768:Bny/ibxjNvXUPjslBBzPqyXJ8CR44MfIelCEl0:BnIidjBtSGlwfdl0
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsArray.dll

SHA256 8f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd
MD5 7fc4723bb0a4118e5f91047021d1aacd
SHA1 092a321a21d802045105ecc8cd3c9d7d2c6da923
SHA512 1fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02
SSDEEP 192:EaNHOZqWdn+/a4YZkv1uULW1C4w2X2bM:EQudRQaYAU6hX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 771c56e921b4afb27be8fc6b93a6efee818924e8ecf65edb8b0922c83ee35fd8
MD5 71369d6fabdb848702b1f425a5253dfc
SHA1 f506fa22ac1fe9c7a89c3e0e6d19263c653f4597
SHA512 5e1d8363acfe5c030c3d0baefa31003677b83165661c825b142a6d681520a0d73ee8064403f4f9eac120e71db98c5610db41a59e4f1e0acc4f06404420c892c8
SSDEEP 96:duNDLJvhx8NeQojexz2U96EFU83ACTbKsJ26ZHUDeA3leWHbGCE6oS+hSVfA7SfG:KNENebat3yCT5J1Z0HYW7GJ++hSe2X2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH 1156b4dd8fa8f1d42696b7a2d5b3e139
SHA256 e8b26d9497bf1f3be386158f7f338fa03c0cad9c893a7e96a0200a438c1733c7
MD5 a2725e4d4d57d9d497e0a384d2884417
SHA1 ee31ce04298964e5239368ca8fd7b3f1cda5d878
SHA512 8d69e6bdd73a9845ba02917bd7f8e17e9a7a818348899d5ebb6e9055094c9b746550d6807c0412c2537a59b916b377aced3cf3932eb361d923816fd05866de99
SSDEEP 96:z50nDR93puFU7aMlUzVaXYDNwIJ1uUgkWJozlfGa3CeOY3/wDQhmrjpcAWvPaSZm:l0n3h+4uaMzOi/EQO11WHaSWjp9ffbE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R1/$_1_/Uninstall.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 0b833e16c7156ae7d13ed37b0d92cd83067f698ede7f350f457ea8ae2ec817f6
MD5 928add37b4bf01fab733ca156e10762c
SHA1 f10598e2bc14c7043caa99fd81b8f4c91e5a55da
SHA512 f1b56e56359cd474473236db768c6d16071babc762de889df14092e5eea5530bbd38a14c293dee36d8db51c814307314859379e166911f77c52df1a23531d5d9
SSDEEP 6144:r50gUCBmyti5ELY4jurdS5SbOV1p7VulOCkqW:d0gtmwO4SrdS2OV1p7klO8W
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

cc:23:0f:f6:8d:6a:67:5c:35:84:d4:71:44:2c:51:0d:bc:7e:d9:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Jun 11, 2015

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

367KB

Virtual Size

367KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/KillProcDLL.dll

IMPHASH d806a080e21508dd768fa70be247d2ae
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 eb9cbbefbc75fc6c97a2e12f88244d10e842100c1aa429f82d58c3ed140adfc2
MD5 4317d55593d08a4e5bea4357dc6a1f2b
SHA1 78df0ace8d4efcc5d4c733193fe245063ef788e5
SHA512 5b1e94ca4ddf872bd72ec366c0ee5a590d3bb6ab5a7fef27b1ceec15f5f3839aae8b23dfc0505cfd6ce13bc2415f5dcf5021653780c0d7596d2d8670463e87c8
SSDEEP 192:6iNdCaXFi+J0WK2nK5kOPdeVjy2qHSsgZkaOYYTPQyQdep:6bix0WKujwLN0ep
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R1/$_1_/apphelp.dll

IMPHASH ce8eddc68f0d837dc87c8d153c0249c0
SHA256 a098a5db545f2429a2c8caaed482afe553720cafe785da57fdd6d46479047ea7
MD5 3951fb5de2e2d4329100a9687091f5b7
SHA1 4f7ceda872f7be5926509df521afee159c9135b4
SHA512 7d3ea57c8c1986036a5ace35eb5076f7c96c796f447e39a7ae3040e71eb0596df56dcf0376bd4fd51360b750f0c38c962970584979bd01794b642e483d5020b7
SSDEEP 24576:Mw9k7ZN6ID5xnw/WWVkQrMBhaShBaA6W+jDklwFksK56XxuHDKFQTniUg:MdTJXexHrhDG356XcDKSTiUg
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

78:ff:75:cd:55:bb:96:35:66:5b:bb:95:91:ea:bf:5d:34:68:b7:a9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Jun 11, 2015

Minor OS version

1

Major OS version

5

Entry point

913693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\InstallCores\G13\rbin\apphelp.pdb

wininet

InternetGetConnectedState InternetOpenW InternetReadFile HttpQueryInfoW HttpSendRequestW InternetSetOptionW HttpOpenRequestW InternetConnectW InternetCloseHandle

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

kernel32

InterlockedDecrement CreateProcessW GetTickCount Sleep CreateFileW DeleteFileW FindResourceExW GetModuleFileNameW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection GetVersionExW MultiByteToWideChar WideCharToMultiByte AreFileApisANSI ReadFile SetEndOfFile FlushFileBuffers GetFileSize UnlockFile LockFile GetFileAttributesA DeleteFileA GetFileAttributesW LoadLibraryA LoadLibraryW FreeLibrary QueryPerformanceCounter GetCurrentProcessId GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW LocalFree FormatMessageA FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileA InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList GetLastError GetFileInformationByHandle GetCurrentDirectoryW DeviceIoControl SetFilePointer SetWaitableTimer SystemTimeToFileTime ResumeThread TlsSetValue ResetEvent OpenEventA TlsGetValue TlsFree TlsAlloc DecodePointer EncodePointer GetStringTypeW InterlockedIncrement ExpandEnvironmentStringsA TerminateThread GetExitCodeThread CreateMutexA WaitForMultipleObjects ReleaseMutex SleepEx GetModuleHandleA GetLocaleInfoW GetSystemInfo RemoveDirectoryW WaitForSingleObject TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot HeapFree HeapAlloc GetProcessHeap OutputDebugStringW UnlockFileEx WriteFile LockFileEx GetLocalTime GetModuleHandleW GetProcAddress lstrlenW InterlockedExchange SetEvent CreateEventA FileTimeToSystemTime WTSGetActiveConsoleSessionId CloseHandle FlushInstructionCache GetCurrentProcess SetLastError RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection LockResource LoadResource SizeofResource FindResourceW GlobalFree GlobalUnlock GetDriveTypeW FindClose GetCurrentThread SetThreadPriority ReleaseSemaphore DuplicateHandle CreateSemaphoreA FileTimeToLocalFileTime GetDriveTypeA FindFirstFileExA LCMapStringW GetTimeFormatA GetDateFormatA CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter GlobalLock GlobalAlloc InitializeCriticalSectionAndSpinCount HeapDestroy HeapReAlloc HeapSize GetCPInfo VirtualProtect VirtualQuery ExitThread CreateThread GetCommandLineA RtlUnwind CreateWaitableTimerA IsDebuggerPresent GetStdHandle SetEnvironmentVariableA SetStdHandle WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID PeekNamedPipe ExitProcess SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate GetACP GetTimeZoneInformation GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA IsValidCodePage GetOEMCP

user32

GetSysColor DefWindowProcW UnregisterClassA PostThreadMessageW DispatchMessageW TranslateMessage PostQuitMessage GetMessageW DestroyWindow CreateDialogParamW IsWindowVisible GetSystemMenu EnableMenuItem BringWindowToTop ShowWindow EndDialog LoadBitmapW DrawTextW GetWindow MonitorFromWindow GetMonitorInfoW IsWindow GetParent MapWindowPoints MoveWindow GetDlgItem SetWindowTextW SetWindowPos DialogBoxParamW GetActiveWindow SendMessageW ScreenToClient FindWindowExW PostMessageW GetWindowThreadProcessId EnumWindows CopyRect UpdateWindow CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW InvalidateRect KillTimer SetTimer GetClientRect EndPaint BeginPaint GetWindowRect

gdi32

SetBkMode BitBlt DeleteObject CreateRectRgn SelectClipRgn CreateDIBSection GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteDC CreateFontW

advapi32

RevertToSelf ConvertSidToStringSidW LookupAccountNameW RegQueryValueExW SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel RegOpenKeyExW ImpersonateLoggedOnUser SetTokenInformation IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired CreateProcessAsUserW DuplicateTokenEx AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString VariantInit VariantCopy VariantClear

gdiplus

GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipDrawImageI GdipCreateFromHDC GdipDrawImagePointRectI GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipCreateBitmapFromStream

msimg32

AlphaBlend

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock ExpandEnvironmentStringsForUserW

oleacc

AccessibleObjectFromWindow AccessibleChildren

ws2_32

connect WSAStartup closesocket ioctlsocket select __WSAFDIsSet getaddrinfo freeaddrinfo WSASetLastError gethostbyname socket WSAIoctl WSACleanup setsockopt getsockopt htons bind ntohs getsockname send recv WSAGetLastError

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

204KB

Virtual Size

204KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

319KB

Virtual Size

319KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$R1/$_1_/soffer.dll

IMPHASH b2b1b383b1ebe9b74c890536bab03c9a
SHA256 149279f79ad29d68c444111b7a1120e5053ad41444c5ebb6281f46257c050efd
MD5 cff6a9dc992dcc7c9c3a3cf6e64d4df0
SHA1 e7f7847c2d2ff0781d27e029f209c4c2bd8e355f
SHA512 176e6ca3d2f907026da35c35d11f586225a0c388acbca474c9dbcf43913bd068e691302084b1c695e7e9678d57033162f51aa67fa2220941f1b0c288019888da
SSDEEP 3072:RODbjm2m5qIlKSdFN1r+ixG8JGusuZravUoqdYymSTqN:RODbjzux8ixG8JGusuFdNm80
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

50:83:2a:45:fc:e0:c4:c6:77:f8:c0:42:8c:61:00:9b:7b:c8:76:0a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Jun 11, 2015

Minor OS version

1

Major OS version

5

Entry point

81810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\InstallCores\G13\rbin\soffer.pdb

kernel32

SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetModuleFileNameW GetLongPathNameW GetProcAddress GetModuleHandleW lstrlenW ExpandEnvironmentStringsW SetEvent DuplicateHandle CreateEventW GetExitCodeThread InterlockedExchange WaitForSingleObject TerminateThread GetTickCount WideCharToMultiByte MultiByteToWideChar OutputDebugStringW GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW FlushFileBuffers GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP FindResourceExW RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount HeapCreate TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA CreateThread ExitThread DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange InitializeCriticalSection Sleep LocalFree FindResourceW LoadResource LockResource SizeofResource FlushInstructionCache GetCurrentProcess WriteFile InterlockedIncrement CreateFileW CloseHandle GetTempFileNameW GetTempPathW DeleteCriticalSection GetLastError RaiseException InitializeCriticalSectionAndSpinCount InterlockedDecrement SetFilePointer

user32

MapWindowPoints SetTimer SendMessageW CallWindowProcW GetWindowLongW SetWindowLongW GetClassNameW DefWindowProcW EnumChildWindows GetWindow UnregisterClassA EndPaint BeginPaint RegisterWindowMessageW SetWindowPos IsChild GetFocus SetFocus CharNextW RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient SetCapture ReleaseCapture FillRect InvalidateRgn InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable GetKeyState GetSysColor GetSystemMetrics PostThreadMessageW MsgWaitForMultipleObjects PeekMessageW MessageBoxW IsWindow PostQuitMessage DispatchMessageW TranslateMessage GetMessageW IsWindowVisible SetPropW GetSystemMenu EnableMenuItem CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PostMessageW DestroyWindow CreateDialogParamW ShowWindow KillTimer GetWindowTextLengthW GetWindowTextW GetDlgItem SetWindowTextW MoveWindow MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect

gdi32

SelectObject BitBlt CreateCompatibleBitmap GetStockObject DeleteObject CreateFontIndirectW GetObjectW CreateCompatibleDC CreateSolidBrush DeleteDC GetDeviceCaps

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW

shell32

ShellExecuteW

ole32

OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize ProgIDFromCLSID CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysFreeString DispCallFunc VariantClear VariantCopy SysAllocStringLen OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysStringLen VariantChangeType SysAllocString VariantInit

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer