VirusShare_997e7aaaf3dc9dbeca0e95f50d3ecb45

resource
VirusShare_997e7aaaf3dc9dbeca0e95f50d3ecb45
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/MediaWatchV1home872.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 e225b3017e0e35a66498fa9dc7adbae71f2c32ca84104f2a93b8890c8c2d8a66
MD5 997e7aaaf3dc9dbeca0e95f50d3ecb45
SHA1 7ec5b24a09567a550ce8cc039ae71606f2f31b29
SHA512 1a9f15ae6befa67ee8f2d8812919fd89161ed2a0095a87321c74212e951c75008913650f3ad13c3116d5c290d0fca6a25d74beb0a63df2f9183471ac998f2895
SSDEEP 12288:f6FuZcG4GjeZHkwuPikQ7lKH5p5H9x1VeZHkwu/iJQ5lKL5p6CsQzuPYt:f6dG4GjeZEXi37l6Br1VeZE3ie5lYyCL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

ch/MediaWatchV1home872.crx

SHA256 e12709b5f1e5a003cb442f0e2ea8678dacff49d0074863bb2526cdb24d737ce5
MD5 27cf3d225b0ad146bd3519f745cc778b
SHA1 f18d21227acb8a556dcd476508a1093076dd80b5
SHA512 d499f7f9ec504b1c6c3bca0ab98e831f94dc1d691ac8f6ea4d448aa844ad08252f97380cded6c60fd32c9ee3ca983084eb34ea974b29920a3984b6d8e330c361
SSDEEP 768:mZxdrxtK4JZ+yeilNrxtK4JZ+yeilirxtK4JZ+yeilMrxtK4JZ+yeilU:mzdr28F9Nr28F9ir28F9Mr28F9U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffMediaWatchV1home872chaction.js

SHA256 bc242ed84fc287b8524b301e5d2afcdb4ab60ad6119ab6b38ad6ed95d39709b8
MD5 ed26e48df5878fb722c618c98c71c52b
SHA1 bc0efc7d7d5cce14712a073c14be17fc00945036
SHA512 7f4fb7db1a53f75a35adc48c537548fbd210c511f7cee65ade20257aae3075d3cdd0f79ae5a3a22da1794937da117e36482825a10892e6d9d018cb60f0a02a1c
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home872_128.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home872_16.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home872_48.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home872_64.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 fd6b32573c278f3c7465550ccb2b4d93f38cf9157bf03252b8472f8049a9408f
MD5 ec60579d3d5556f5558fe5dc53ed8db4
SHA1 4af7933fdca1c8f1f812219658fc884f4be0323e
SHA512 312e5be2c2d4f99e747ef1f834a838d5871958f123ac7d58453f01ec348e5652ae1fbab76edd394ba8f8bab602a0201c3a984406ed44adb06035a21e1fd223ef
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 6a309f6be986fe5db51575486379ad29453146bfaa89181da8f36bbe6add70eb
MD5 d8b8748d377578fa59079433f1683702
SHA1 e11e4a5d921784e25c57c9ef19c5dca123cea615
SHA512 ca37fcc7d9cdb40a83b8a5ffb0eb810772bf579c1a441910af4bff8b4b452842ec721a437bef5dc010ab43bda48966b16ff7b6a08a48a26995082428d87f0930
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home872.js

SHA256 31766102d09320dc74d1841c2a00330957affa59089f55116abed4863e7dbb2e
MD5 6e5c701e0d2f8ab921ea55cf66facdd4
SHA1 994b0d449e0ed23b9c0ff219d573e642544ac007
SHA512 bb38bc10514df59273b124a5a33c1071564fc42338580eea4aa87d476a29e0df47ef0ad87abbfae6333b3386042993fd27a236500ab24fa8f1d3a8acf8743c3d
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home872ffaction.js

SHA256 febe5a898bdf8d2a0ead3c93aad617839d673c94bbc522396db2582261ac90a0
MD5 d4a7b7720b28320fdbdd203a1c9f5d41
SHA1 3c383a6f305f355f670d7e6b1dac2a06c41b1f7f
SHA512 bdf2015a3aac65b5d282f3f7e79375eddd9fd1c52bf98b802d479fa5a335231df6e728d07109b349c4d2a32e12d3efd433b35cbf6fd28b12883364a8152379c1
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/MediaWatchV1home872_32.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 07ac1015877bfd64dd5312d980b3da33d859e9c9d4f3bb242f1868ad8c07868b
MD5 fe31cb50bb531799b35a4f52686dcb2c
SHA1 bc654c12647d929bafaeb113bf0b60dba5b304e1
SHA512 2ecf446c6c7b14230272d40c368b8433951f1d068f1c5a94187cdec73ce6384fdd5705b9e6770a212ce453c1d3c5e60974a3724cbaadef30fc257a1b937cd9ff
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 865e42bfe72e5733a3672c78dcee190e31e392df43c027bb8ac838495642f7be
MD5 e870500069e23def5a05ab8fa12c58c8
SHA1 a9640c460b3fec263ba128ead1160c8f168c9c1a
SHA512 0efd188a5eb0e60f80f07075545edddbaf84d8fbe4c6f2782950a58eb37871f1659ed6a48ba840c141869c2e3f1b1c7f12d04f74ae8e3cb34a51ddc5773775b0
MD5 SHA1 SHA512

NSIS installer

installer

ie/MediaWatchV1home872.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 da087b7fa4e14784223b11732ad51e4a5f9b6a29ea9d1ae68d3b638e05be257f
MD5 87416d2bff45bfe8aa63281895277d70
SHA1 cbf3f3b2fb6ff7c93cd14add625d8e16962f6b69
SHA512 a341b8a58df30e6cbd59c84df3fdfda36cd243e69eafe186ad76e9005a2b4c4d1fd5fa924fd6de59567ad88a7ae3cc8198a14f77e5ce7bb6f11db0b4107d16a2
SSDEEP 1536:f3flScQkGMA5tasrOb8Dk9tgHgNglQYkD1:nlikGMAbasrORgA+aYkR
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 192b7b13e8591df8a138a34a56c1c8df6f71d84378c67cf885669aed9fe19119
MD5 1f53944af9a0a56ed34b24856e322a35
SHA1 2d7955eff203ce80b7b2b3407b7575a721a6559c
SHA512 fdf4e41670c22f05853c1b4e19f32ae6f96fc9e34c2a88faf8d7b067c21ad139285f830da3b94ac039c5b838055a065c11e0b1bfb638ed9f02021e32504f5197
SSDEEP 6144:Ee34grpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1B:FFeZHkwuPikQ7lKH5p5H9x1B
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer