VirusShare_788f62024cd511de75199bf472fa21d2

resource
VirusShare_788f62024cd511de75199bf472fa21d2
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/TrustMediaViewerV1alpha3375.dll
unpack001/ie/TrustMediaViewerV1alpha3375x64.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 d185781c5d9742b63918e7d44324026ec0424f3d0f299ee124e43241da6e6481
MD5 788f62024cd511de75199bf472fa21d2
SHA1 d8973491c38c5b7b24c5305b1085cd5c9cb10c23
SHA512 898f4b161b2dde52b14317e29beea255a72e26d419ed253beec88aa9ada949f7c45495d33ebda9b11f8ef67a867f5c1422804e7f24137a9b332fc63dceb51f60
SSDEEP 12288:nac9YixLqmDG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDvEjeKuVcvrD+N8yLwwl:naNio8G4G37tUnvone83Z76bMHxotUc0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/TrustMediaViewerV1alpha3375.crx

SHA256 8351837f3992ae06047db426703da870e27b95e9faca458f2b5d00a0636dd457
MD5 32670f93ed2825f4cb4166ce38252062
SHA1 2064d43e3afd861f22d912689d26e2bfbaeeebdf
SHA512 187fc2e58f9c49d1a0f8d972e948f4c5ad6f0d6debb7a886f1c20fb8fffa0e41accc246f26d30a5b390f7f615544a3cdc6ee1ab7777cb8d1749468aa6e234cf3
SSDEEP 768:jhs+iZk74XY7z6bRL74XY7z6bRC74XY7z6bR074XY7z6bR07:jhsLWsX+ObRLsX+ObRCsX+ObR0sX+ObU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffTrustMediaViewerV1alpha3375chaction.js

SHA256 79887b8ce3f1717c3c884f98df1e5636190d4ef011efd7f91cb190d12f5f7c23
MD5 cd53fdd427e3925ded15e7f525c07711
SHA1 6be5c3a078d2b81d0f0987f5b36c303426a043d7
SHA512 f561267b7ef8b82aedd3a1ecb254ee7c6d2f378a9e504e51dbd3b6d49c205dc99d0557ed006aad91ead31f359971a00e8992a3df4dba120e4c84b71c206e79bb
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha3375_128.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha3375_16.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha3375_48.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha3375_64.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 4f29b1ece361ed98811745e2dd264776609a8200d00cc7332962098d94a56db1
MD5 0a6e40a0fc9e2e52edbb2c20b67a1cca
SHA1 6cb356fcc8a8305eefb0ceb3c8d2ee78cb0caf35
SHA512 d52398c263d4f21e2f7ba5398519dc84d40a08c2cf8fcefaf0dc2c7cbcac367700553c43c66b811764498c06f146dff77945b07f3276960f15f9a68260838bd8
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 b38b2c8c702fa64b7d03ec2df2ddc01c4dcd61aa0904388d6bd08f5976c040a4
MD5 9a126dc707a163df04d405657969e394
SHA1 54984a72a0fd90556d536195aced4ee432ad3889
SHA512 40b163be0664de40cf7b673d1beee5486028ebaef3b52b6e06e7d30e4c58a2293be3f9d387b851c5187d2d1baeecb0cfe1b1181ea771451e13ce471c70a27d0f
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha3375.js

SHA256 8a945cbcd1548567362a40da5d010a396b489c6f9706223d723c38de79a2c857
MD5 98985baff14a6df07a4a0947561c5a28
SHA1 cbb4c97e1bb388f8928d0a84f501517623525657
SHA512 380a78a59c2beea6b7f5332014cb97665fab040567ff0b462be795a76ad60bc5918d7231fe4da89bffe806250823f148fb7a79c295407b7a76b98c6266ccfe7c
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha3375ffaction.js

SHA256 c19f7dc64f58ba79129d15b94b22a70db7cb10932e4b74edf869298bc8cb6537
MD5 e74d1485bdf6d9981767c1c04da14918
SHA1 a442af9dc290b9713a14d10371c226af81f19c28
SHA512 dc5b200a2cd0975ff12d8de200f6db0ca9a8fbff6ef2b9559fb27d8e8f4f4b1ccc2ad2348c64b07241d302a8cea792ed608af3e2cb80d83a2f5a3321a8bdab16
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/TrustMediaViewerV1alpha3375_32.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 4e536b153284d92057b47cba4227ebe5bcb9ee79094aa5b76d3bd586bad348f2
MD5 e46c65c3486bba84553d56875fb66ad0
SHA1 2d08e7021da6fd1e16c5682674f49c86339239b1
SHA512 3e5d4aa9ee0600f349b6d044a81d977e44e407eea0e4d8d4ca1ac4aa2755eaf18197cf9e62c956d7944f4d4a7d47baf5981b9dc5a31875df4869ee6f0c08ecae
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 d21d3c83e345310bb3108716989ec5041bbb88a7b8d1bb38a9c599c893e01650
MD5 b0b7005b956a889b52b1515c7184c581
SHA1 24c505469a4dc9689bdf09f28943388d72ead4de
SHA512 0125ca4f9caf211261d4cb8fe23c4056c8d4fe9da5d3e5546fbeb472bc0fe89b29571454bdc557ef9889108cdb9986f36b66663f10b8f97696b1b91e23bfe83e
MD5 SHA1 SHA512

NSIS installer

installer

ie/TrustMediaViewerV1alpha3375.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 bd018deda7a1295203c9e9c9396df981f79aa6816b589debfb0916708b6d95c8
MD5 cb7c2150ee3eca319b59deb7ccac9cd0
SHA1 e73714ea78f5e45735c47d19fc156ce78ec6a716
SHA512 efae90a5163311c83256fcf1e2fd8ddc62d6c62fd41b2e8e3303619f76662c677721f2b0293dd0da955cc3752e4daf185061ddacb644ff1efc318334119d5e67
SSDEEP 1536:c5s2Sc4McEnVtKo+kNp8Dk5i518zOslQPGBJdf:p26McEnnKo+kN5i5uzraPGBJd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

ie/TrustMediaViewerV1alpha3375x64.dll

IMPHASH 866723e8636cd523142957a02161663c
SHA256 055ceb9f5a6170f2e50b90caef3354bd1238cf40f87f034dfe09ab72fc0348a1
MD5 8a6d961fb7f770679e486aa2df72136e
SHA1 aabee5f45811bcfb4b6df7162b9b727cfb1d773f
SHA512 4ef4dfe949f4c7c214973924b516c2601536cd684e5e131324e3306530364a92a49621223c0422f772a7203cb7a4ef22d8300709f1da83bb41a09c99d72eb2b6
SSDEEP 3072:1BjCnTZPjGSRzBHsQnTfGNAj7KSWfzQBTnzF9AOd:1NCnTZPjGAlHdTONAjDtvn
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

34128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW GetModuleFileNameW SetThreadLocale GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException LoadLibraryExW lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep IsValidCodePage HeapAlloc HeapFree RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx DecodePointer EncodePointer GetCurrentThreadId FlsSetValue GetCommandLineA ExitProcess WriteFile GetStdHandle HeapSetInformation GetVersion HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess FlsGetValue FlsFree SetLastError FlsAlloc HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 8232c00a13b7645a7dbf4b428060f91c14d74da6268d04cb6b030f07226fb533
MD5 3c3df2bd899f5ccf88ccc7e6efc4112c
SHA1 e37384f5c99cc883d336ff1f75808df6cddcb7d5
SHA512 e26f1be1e82a569e536a14e539a2618200edf2bcf3f796e345e1a647ceaa0836585bf143e9dfe692f1eab5f2babe849e3f24f7f8356c76c04a50da51656f563d
SSDEEP 6144:Ee34oOEjKTK0HVkUEYA2q5NbrWN83gQwwDuzMn6yDkvE39kojTxDtEm:9OEjeKuVnvon+N83LwwiAn6KkM33nxDf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer