VirusShare_5d9a495901c4c900025931446b58f87b

resource
VirusShare_5d9a495901c4c900025931446b58f87b
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/RichMediaViewV1release1019.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 a0cd2e6b45e3aa285dbdffd68929ae7333dcde44745c2c31eba38ebb4f58f320
MD5 5d9a495901c4c900025931446b58f87b
SHA1 a38420bd377ef7d5aba9d89b7fb5c7b7c53f9bd2
SHA512 d83e9cc26c0e09b0b5f9c93322d08705ad5059a6144021ee28004e29b6e0886d581bf222df2565230bb7113c7801684de5fa2de52e05f03c2461b487da034877
SSDEEP 12288:t1a39cOG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BZq4yaPQTMJ8ePB/x5uO7jU26nm:t1cGOG4GQm4OaHYJ8eP4D5uOHBBc4yap
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/RichMediaViewV1release1019.crx

SHA256 f097cf9dfe51024baca529e7d911ea6706629cfbc42bc563a9e94bb50c9680b8
MD5 efff56cad4fc9e98c5ddd33641dcade3
SHA1 3cf72d404ebb1163e607f3bacddcf5bedccb6f14
SHA512 daf2334d06e4234191a2f85270288b0f03d5610699eea317c14547fd502bb08607fbbce69908008e3ea0d6e73937cce768f73b4dfd079aeb0bcfef81cbf76977
SSDEEP 1536:SARSydWeJydDYNjdhrydWeJydDYNjdh2ydWeJydDYNjdhIydWeJydDYNjdh3:SA58JYNa8JYNR8JYNr8JYNL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffRichMediaViewV1release1019chaction.js

SHA256 bcaa725fd64adb1678271a9b0b3973e0c40b187cfadd124fc723219c4784e6f4
MD5 deb129749ef4008fe313b7aa7a5bbf40
SHA1 1a56e792a9ed5fb7437a42d7d751e5061484c083
SHA512 b15323e6d658be426eea0c7856a8707def244bdc2b19fb6987d39931bb6fdac161b720b72d77fbf76a7e5ea7e04c25bd82516c77776c9135a726135d636fea6e
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release1019_128.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release1019_16.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release1019_48.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release1019_64.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 43fb7c5b4fc88acae7670b6fa038bf8035e8b678abdd0469a8ba2d10cdf9ac4e
MD5 9ee3c2d50c6b61f4d84bb9cd34d2ec91
SHA1 eafebb9c14daeeaad8c8449f175481b966b91c7f
SHA512 62826a1868eedafd8f8169d8859d0867651a1141455aee500add75cc922b711f077cf923fa3d04a1f04616d901933226e5eb3deb26330b18ebcacf80b7a5dfa5
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 4e92affc34af466ae28c042b694731d7c661712b9dc45623f1a15fbcf791fb80
MD5 8956208dfcafe4074f64994feee1129b
SHA1 b1f74d868471755299949b0d278e602c8278d318
SHA512 70052044dd1d79de0808b4e00406d78aaddb2703395b485ae29d9d35e4bb26fe5877f0c33d4bce58c0edb2e4c0ac81d2305822cac5811d7e4203a9b234f5909f
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release1019.js

SHA256 335ac7e95dab32c8e6fa6abd2b08f40d5efd629e30094fe6af5aea894c6e6225
MD5 ee1885aabb4d31a3e482a1576f1d8244
SHA1 7ec166d421b984682ba0449875176e1a5bd64b63
SHA512 e1e941f1daff7f69286cea742d3699604fd091840ce781490dea51eb352c010f88dd60f29f23785635ff0ed37d3d806fa677666f0e85b0f9442a3567a8752487
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release1019ffaction.js

SHA256 336a8ad3476c408afdf97c20ab38854ae30b9819ac063d91e309ebd401ed122f
MD5 1ecf0b0ec1a51a9eb6d34ab7765af440
SHA1 9e1415b0c98ebbd7cba8bb32829eae3078f8505c
SHA512 726c1f99d762b8a7e1f2d47e5b24267b3a346273b4ecde67ff8d0770416d45c9970ffd7551f3eac5d806e79914b2b89ba12cbe4b92ea35042ceb61290fcbee6c
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/RichMediaViewV1release1019_32.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 8282c0e5f8ef98ccc9ccb5459bab80af14c2f28ccf84d8589ce9cb24767460e7
MD5 d8ce096b4dadd55aa9d5d2790caf418d
SHA1 a47df4a91ffaf73b46deb2efc6872be76d11af24
SHA512 f838c1983b3317ae677dd053c22e466fa2790dd6c12fde324584b5f923dd5b7a6957f518f2f887b814f64401e2b054d869c6115d0d8347378da1b7a735c87af6
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 0eeb4085a9059c2e5038c0ecb559988ea4aaa97bd09ab544bff6a02093f6350a
MD5 fee7933ecb54af70a51159f866565b69
SHA1 383732686766695b4df674c7411a2fad274ac9c4
SHA512 d8949e9e3a700a9d18140f7fd0b7ec6e9b2190be4265e90bafe24ad3dbfbcb9ee7e494fb1475fdee0d5898f653d1d2a12bde7aa5319c45c02da82e2145c17ff9
MD5 SHA1 SHA512

NSIS installer

installer

ie/RichMediaViewV1release1019.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 8864a45c59dda713ee4544ee7f6da7a943111dfabf9ac5b519e74865b1b57d50
MD5 5fdf75577c47ff3c12b3039241e6cf47
SHA1 28cd7c96112fcff793b320039a212f74e18a83aa
SHA512 84c90f22bb9f97b586f37ef7f97f495cdcb493234428c869752e4c04ba892ca6235bdd9e16b3a4873b810023f9474eb5d6835766de50daf3d417a151e63a49a3
SSDEEP 1536:mRsmScYsswPVt6Ap1ZcTkLCzcCjfLlQdo13:jm6sswPn6Ap1Qcwado13
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 24e5d5ab13231f60be2e78406394296a50bd6bb9c90cb31078466f75efa62bcb
MD5 48585aec63a8da5cd4ab915fe9f04a2d
SHA1 bc288b5fd94d957f08b591c9a53059ba2e3a759a
SHA512 f2d2bcb766dc346e78d9f2350c57845d8932d632206e7edd91bdcdd21e229e56c693ac3d8bb5740ed1957a3cc02582395cb20b2ef0f065c250830abb6fc11eed
SSDEEP 6144:Ue34+YRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmy:nYq4OaQQTYJ8eP4/L5uO7D3f5BP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer