VirusShare_29e02b625136c8351cb216c63cdc33af

resource
VirusShare_29e02b625136c8351cb216c63cdc33af
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/MediaWatchV1home4093.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 cf02f781b9bade5036f6e9fa3165bd87ba42f42eaeffb3ef671e543ce107ab6b
MD5 29e02b625136c8351cb216c63cdc33af
SHA1 0a373b624fc872f75948ee6ad5cecc9413c84845
SHA512 1a0a46992a92d2aff34e79d2b8b0bc4f807a01bef82fd5bdacf0022b49c8fc7d983052a611ef65fae4482a03e3fac8918f4c46e776db7e8055cc78d3da0e1779
SSDEEP 12288:NBndEiEpG4GjeZHkwuPikQ7lKH5p5H9x15eZHkwuliXQTlKB5pixyiRy:NJIG4GjeZEXi37l6Br15eZEdigTl26wz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

ch/MediaWatchV1home4093.crx

SHA256 aa3f8441515c4bc581cdf29385d262035c569442f72e764f7ce59657b30963c2
MD5 fb287eab42d35af9b66ba5be32985299
SHA1 374f163ee479ee794cc14d4d9b23325d90114ab6
SHA512 b13c818f2ce94a846f43d1c7e96e6ce564a1a7678c16f4f24c8f9b85d302f31b04eeb215b772886d9e1e9325f72e45707a6cdcd783859013cbed54ae3e994df2
SSDEEP 768:cM/ZX1rxtK4JZ+yeillrxtK4JZ+yeilqrxtK4JZ+yeilErxtK4JZ+yeill:BV1r28F9lr28F9qr28F9Er28F9l
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffMediaWatchV1home4093chaction.js

SHA256 e9927a7f55bdd3c1dd4dab5291b64bb77a63b11bb335db7c8f6dabf4221859b6
MD5 139fa62b0a2437b1f337f565f9b5eaf0
SHA1 96ede599779e946ef8d780340f5bdc16e27caa5c
SHA512 3586561944cd9743a7eae0cf80f35d880a131ad434d1279b1396f1cc65e37a93eb17eb0b2b0ae4103ba6a4f0cbb73f2e08eb33bbf98c18deaeda6ee84ef2d546
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4093_128.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4093_16.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4093_48.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4093_64.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 a0801d0a8000024c4bffdb7fccfe9a9bf8d6484174d133365c1877c9d264ae14
MD5 010192be7571f5133b9af72dc8cd2af4
SHA1 24190be130e3c0e40bc8fdc7f9fe727ce28844be
SHA512 117839e0b04ee330a083b19714eafb9544a71fa4b8de1a1c982edb34c6474b1f0136f84e85f02e9241f59cc9bfbc12ce7413704a209dc91cf9d42e60583ed5ec
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 0a95be088c39ee12d0eb4b16d04af8124c43b78b4dfdd30ee0696ffae1d1b4b4
MD5 a4ebea038b3ac242e639ec1ab845abd3
SHA1 d9f8b06f35358d1c75d5af71a9ab55a97509c186
SHA512 fa1da0f56e8032a6b12ff2868fb262b7f4dc36ceb9069a77aae1a5d1dad4a247562b8cc5dc2358b63cb1ee76a835cd449e7a694a6c2bf694a84eaf6b1220e7dd
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home4093.js

SHA256 117373add731a4d86bb0d7ecc760812356b504e483ecb5d6709ae63ab5d96967
MD5 5ffaf75d29af0248fefc0be9b926931c
SHA1 4afd3270f53d127a5bff6600461dc6d03e6aed86
SHA512 067d95677024b6d22913b7102f99a36b6f82652e3620286217a35b35ec3daa7444ce695aab3534aa324048140aaaf749f4909e45f50d125c2319f9c3232c53f8
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home4093ffaction.js

SHA256 9a3c3c947bd9867aa92775de6105c77eae30f9aebdcbd720b1b5be94610bd31d
MD5 f08c96d8842fbbe2cf35ceda0c8186a2
SHA1 8692accf90973babd1b969bc01c28a04ae7bd54e
SHA512 b1c426adbc6bd498ea620946166a4a79edc8e55c4691f944ff099518181d05fb94b0afa806167cb506d76ecd0aeeee6ff3b1204c6b8c17732d674f926f4985a2
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/MediaWatchV1home4093_32.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 202e749424f95490e17492e8782b984395397297abc880c39f382d25e74f42a8
MD5 d4a322a3d5709f09c245640d24c3d167
SHA1 45acd6646398adece7a8c3062295b7138f2f5c49
SHA512 b9c41635dc7d04bda643c1333f348338a543f7ced0d424fe21322148dd948d06de0de95128dd3b43f3ab2fed73f3f31be19aa554bee343593ce9a8ee186c6b91
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 b02dc0b4c1eef72d5a9e8baba4a82b62e7abbfd5af05e19cbd0d94e80fca8629
MD5 026c564f4ce216fa39f6f683ad185a7d
SHA1 db42ff3048ed2af95ec4fd42cd5ad34c371a25bd
SHA512 fe4a12ca8cd6a09c16eae8ad206292ccf30237243219062de015f1f396b8538e6deedfc19854020fd6891af94654630624073cffcf75b33843b7a7105937a8f9
MD5 SHA1 SHA512

NSIS installer

installer

ie/MediaWatchV1home4093.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 e09a5842e3a10437e84274da949ceb9167f7f7857bcbcddac94723b19cc0b045
MD5 3cde5e7edcf6ccb04f1e327f143ab858
SHA1 cfb089cc4ec256f1dcc07f6fc54d4dab38500c6b
SHA512 c2c566ebdbf25a34cb2cbb60632abaf8ab87114b8209f5bb3e180695feae75e3c7a8b383bab4f5461745760f5ef4fdc8047ac88931849e1ce148f6e74984b627
SSDEEP 1536:38/1CsEmka04RhRtahrOb8DkhqWHA9glQyDgB:w12mka0ElahrOuWguayDg
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1c5ca52649b1822b417a5177a40860b161b939520986449d0d031ed89735dde7
MD5 2570fcef264dab5f901741f3a62ba3b1
SHA1 070e598daf740a074e745be18de0becf05a00d10
SHA512 f6e544b68032c265ff94d700307d21ff2b07b4cda88f026348cac215e34469914c40d5e761bf27bfe5c5506d23a6987ecb369b0358fa8358d80275e795c5a9a6
SSDEEP 6144:Ee34eHpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1g:3JeZHkwuPikQ7lKH5p5H9x1g
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer