VirusShare_1a10cf0b9987f4342f7ff20b1495ffe4

resource
VirusShare_1a10cf0b9987f4342f7ff20b1495ffe4
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/RichMediaViewV1release373.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fbdac75d7e1eeff6598b4498f8395f3adac68c343f1417073527edb6c575e900
MD5 1a10cf0b9987f4342f7ff20b1495ffe4
SHA1 72d1f737b16080150c7221047323592e0158f67c
SHA512 3163f51be6d26adf543c4cfc98dc831167f59a1d5c5be0e155adeb53de0de8c74a4f9cda05a05d5aa2538b28472d5b60e2b8312253cc29a404b0e597eb7afdea
SSDEEP 12288:a0Tb0wG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Boq4WarQTwJ8ePB/p5uO71U26eB+:aqYwG4GQm4OaHYJ8eP4D5uOHBBd4WaSR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/RichMediaViewV1release373.crx

SHA256 65d1c203bc9e441edd01e06fd3ac158f6f968918ef88a6b73648dc89da87c65a
MD5 7280db617220cfa213a28a0147945576
SHA1 c3ddf22a475b97333395198dbe5b705a553858d7
SHA512 cd2a748c367520a6112ec28812e1af3e4190cf5bd6fd4731b47c73044b1604c00b5b06a473a4ff85069b873771d0c69ce644393c0dec2cf330ccb36b3da43b2e
SSDEEP 1536:bBydWeJydDYNjdhsydWeJydDYNjdh5ydWeJydDYNjdhLydWeJydDYNjdhM:bE8JYN38JYNQ8JYNq8JYNw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffRichMediaViewV1release373chaction.js

SHA256 2fc9177a2db2f31c5b6aa516b59a975e736424affc8009819d03c9e40f0b2aef
MD5 2beca6c23789ef853ff95d4e27fb2a5a
SHA1 8dcfca391fda9f647f4f902bfacddc8b9ea50dc9
SHA512 e0e5bba3df0d8022812070b7b4e28106a49627b6d60233a68ef399754939c5b1415a5537647ad68ee847cb45a1023068ecfea4b03a870fbac13c51a718f866fa
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release373_128.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release373_16.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release373_48.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release373_64.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 68199dc7fe427b9433093a381113c3a7259b8a62120cb285a8bbd76b5120a995
MD5 7576a81ae7ee1445c62a2f2a129ab591
SHA1 424e8a0c72b689fe4090627eed84d2369cccdb3e
SHA512 e02dab7579dad265707a79dd4f17b2333429c9a73eaa276493f2c8d9ec9d37ac0d94655d0de20eac2b8935de79fe99ecd33c8435fe049d4c671e451500424e9f
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 f3187bd3b4374865465e091e08e9bcb59c53e31e35f9db0b138b23718845efa9
MD5 f8dbeca1407d85ef5051f670da935833
SHA1 0f75c94497de473bd1f0b08f2cb85eaeb1bf15f6
SHA512 29eefcaddb1670d4dcf3f719f391b558961b7c9c885fb8eb7c48cf393eee31747e93aa2d81d9db2c6c862499a47fafbeac26b80bac76d97e6c9e598b6b8d3905
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release373.js

SHA256 569a72a4bf419c6a43e6b34d81045a18b67c6cd604e931992bd7ee03d00525d9
MD5 5bc4d7069945a80ba063bf5dd826ff89
SHA1 7e6da30a9e4e6d32d016b55eaabc4a3049fabe06
SHA512 af324838c820b3d837a40abfc64cc46958aa6e7afd55a387835e3b50ef39e7726acc6d05cb3062158dde040e855d2cde8d629b6977ff4e0e9841d1a61bf5205b
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release373ffaction.js

SHA256 28aa27c68f758d21d78373efbcdc8276c1f599e2ae9ffa70f83e50946a0b59d3
MD5 cc26623352bfd9478034dd896a11e531
SHA1 ab12f0205ccbacff7bd1e424e105ff44e281fa35
SHA512 4e1ff32dda9f87540984b9189453605e195a534d2ffa006664c37568271035cc3ff7ea78267729a29c8fb7784147f37ef9476019e2227bc38381b8225bd558ef
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/RichMediaViewV1release373_32.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 0d6193302535d2cb7cf2da41a5e998a5eb6ba5d436ab0bb33c60448e77c18763
MD5 aafc19319d2f77df26b3b0d6612c8216
SHA1 49cba8fdcad785b7996764fff8eba0cc9fe989ae
SHA512 05ad7a9a78c275b7cad1dd59337a7f8f8c7ccb8808745c4e3be09fbac2856bcbd72dffd6ddd61b8b7c50e3b715423c31b0dd9dd6e802595382484865afb38519
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 e29898f3d97c48ee689abdcb2f54dbfed43c47168ed04687c871ec81fd578a1d
MD5 83d7fd23cf408b26cf9df8546465a605
SHA1 765747a3ff1393f7f320f820e38acd034477a905
SHA512 d76465b840dc912652f75bb7a7586ec794a9cd9ed64ae9e0b069b2cb337eee2a03aed6da55fb838b18195ac481083d692487a213572f1e50fdc49ff2efec6af0
MD5 SHA1 SHA512

NSIS installer

installer

ie/RichMediaViewV1release373.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 2b0d829364f051a60d45ced2d6a78b7805469e4dea657c9364fde8164d91b499
MD5 8a8ad890a135a3418283374dfbeabcf8
SHA1 7ad3d85e822a56fff035181d7781345df8b314cd
SHA512 daa5713ff486c16b17ee7e714f9955bc0b6bc43bed56f71b869fc3ed4d194e9409ea7e8e6f9e698c0a8b31c0900e6f8778ceeecf20d05674057c4ab1b0d34374
SSDEEP 1536:Xkf9Csc+EE7Msd5N60GlVk8jkrwvNnqLhPLlQgVDdBZ:49++EEwsJ6FlVvNnmagVDt
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 9372aeff962ad6c69df8f6775b46b85302de99b91896a2544795038d605e4b02
MD5 566f254a5b3a10f66f20cc4049cb67a7
SHA1 5bb8fea73edbce4d1feaced7dee122fbed000313
SHA512 f5ba513532946751a247870965fa2252cc6bae357c4781b0cec670bcedd5751fb867d6e29763c008e6e482b12d914556c08e7a769a6f92a0738d8eabbaca410a
SSDEEP 6144:Ue34Z3Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmJ:03q4OaQQTYJ8eP4/L5uO7D3f5BQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer