VirusShare_e8f35f3511618cf0d57d81d44e3d203c

resource
VirusShare_e8f35f3511618cf0d57d81d44e3d203c
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/MediaWatchV1home4176.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b45be767bfcf5d2f034029069499318ac9bb1e5481b711676029a48d55289f0c
MD5 e8f35f3511618cf0d57d81d44e3d203c
SHA1 03ef45d894934cb0dec4cd28de5dda2401d07472
SHA512 a0092a1db39ce3189f33df5a6a8b644519969c103ba9444bb4401dafc261b39b5d7e4db4d82455a497f11e889b7490655988de68f58d305c3a00aed944f47a4d
SSDEEP 12288:bkwIG4GjeZHkwuPikQ7lKH5p5H9x1KeZHkwu9itQplKd5pyxllfJ:bkwIG4GjeZEXi37l6Br1KeZE1iCplOqX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

ch/MediaWatchV1home4176.crx

SHA256 2ba047672d20ac232752e422d3f9b1ed160e65e686feb359e4e6ec5b0914f44a
MD5 68b8610b1df4357dc3cb846b39b9ec62
SHA1 29ddce7d38eaa8357e16d975ca172022e2a9fd80
SHA512 e73e41b29994f6dc7801414d434916b07935fc34802195097148245620e30249da1f623d3aa2976c1514d7bcb7b5a78d17e157fb6ed24f1016e6cd99988b141b
SSDEEP 768:w1UH7kZsrxtK4JZ+yeilvrxtK4JZ+yeilArxtK4JZ+yeilmrxtK4JZ+yeilI:w1UHYOr28F9vr28F9Ar28F9mr28F9I
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffMediaWatchV1home4176chaction.js

SHA256 3de7b3e4a1aa3a530a21e85670be5d6d77b4e902e8323b65923c756209de8a17
MD5 a0fd126e8857d633e866e6bac102aceb
SHA1 94b9b4c5e8a64049b09112ad6958d315e7e8d14e
SHA512 d77375d6b83b6edc71204b29157d2f918d4b842150a3068a208324778e096622c2c1aa68369414f4c3fe997f33efe2f07b7aeb0cbe4c23fd92eb5e876bc99613
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4176_128.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4176_16.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4176_48.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home4176_64.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 467ce9eef0c7ad789813a8ae26c53449d266d3764377ab264e1b002b6ab099f6
MD5 e6cd92f57fd8585ca0d441bd603b8bf3
SHA1 1a4cff432103d0561d0dc532ce9b1363186610da
SHA512 411a37fa782c85fa43fe6c99f0ed4b0f03ff232d023e30fed08dbaba93e4a5dcc6bb0ce6083a7d16090d2369159618943a120f0dd483d6b9de2a86895790af6d
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 63b986927948ec16867e47c15a87045a00923986e79f4e3d5db5a551b539dded
MD5 390579a9dc5c2673988599cbead57cd0
SHA1 13daff638bdd5c13585d1673aee2a45f9e2f212e
SHA512 cd53264796067a29638a57588283116846cfea9a62b2a7a64575e1ca3e9e5eb2513761873e0aef8722aa4fc5e8ed876e081f23fcb7b77bb4c0f947d2c1251b3d
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home4176.js

SHA256 cbc11c7599bed98b70782c645a02e6cf06585518b9579a43c405fab1fd95d89b
MD5 42729f2e7c03b2973adbed68f6bd50f2
SHA1 71697ba52fd0eed380a5ee3a1cdb1611a4a25a75
SHA512 ab40f9f20eea21553f6c684390f234b07169c5815ff891e2949dffe86be593f098d4d20efab1e1dd7aeeac51b2fa8f0354c25dd876a1873eadfc621ab2ab41f6
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home4176ffaction.js

SHA256 830358e2a3dddc1b4f3b8395b2d7d0684c6470340b1f1cdf4cba91ea87f16688
MD5 c04384985a2d80fe2220e1adfb1822dc
SHA1 830cb937ceacd16a06068f11e9e091fe6c7a0547
SHA512 0265d16e0ed9c0bd8b0fa8a06861a872496955f4f7bece2b0ad799d8940a6a6c2ea648883795c38030bf06b9343ef341b20b5e8daa90ffaa20a31f175366c277
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/MediaWatchV1home4176_32.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 5888a31a60f7b0f8f3609511e947c09161527d3849a722e00366ce696a67ed8b
MD5 f281699fe6a3fdf068b489bb748c463e
SHA1 55361b2349897432b2de971ff7a1ec44a1529398
SHA512 86d91741994eada05fb4d5ddf1b3c8ed6eca479b191b24b9c2a22f3cc66f9b1fb337eade2538e6fdc2e9c203f19cf0026a9ff90acd118ab1f9b553e57de52ce2
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 e21af9364da0a6729dab489fff993147fa88d9267e9ac1bc0fcc1b9f05545129
MD5 eb433fe2ae83f282a797f135a97e822b
SHA1 961e05ec152b91367932c95ba248465a6127898c
SHA512 97436ea7cc9552409e041c0a163a37a6df27d3869e0c8f71c6e48da935a362928870b1278746a2e45a9255e4d5dcf3dc9c3e3c779c5971fb2346ea5ff3dcebe2
MD5 SHA1 SHA512

NSIS installer

installer

ie/MediaWatchV1home4176.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 6e0c5a1a43686acbd5622bb18877fad75cbc63866b0070582e771f1aca9b439f
MD5 ea98c9ab7326e558f2ae92bf642d0796
SHA1 0e8afc35c37ef5e0de609398ffcf476935468be2
SHA512 b412754b5d77f7620df0bdc66cfeeb114399505b4011e2c4eb7c4b195d1676ca7769768f745f8ce8354e2ccac41268ee1a5673c7129802eab38e2d3c14d615b7
SSDEEP 1536:mMflScQkG04RfxtakrOb8DkxKRHgNglQOuW:RlikG0ELakrOaRA+aOuW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 99b82c8a72bd81863ca7e31d462d8d7678ad7b03d9699e229af82ef374881b23
MD5 106086ee11833f12c9acee08c2f4a5f1
SHA1 33aa239e7fc2617677de60525e5f3eb9c51c733a
SHA512 56463c30185f9482ecf2d60ce83279890585cb878c4ccd5f13b9cd5e8b56643b3574b270ce1395b887a2496ddc6fbc7f5dc77ef4d6d95903e6fa5727ac116c2e
SSDEEP 6144:Ee348CpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1o:5ieZHkwuPikQ7lKH5p5H9x1o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer