VirusShare_2e4f053b2d61556bae2812d03519fc91

resource
VirusShare_2e4f053b2d61556bae2812d03519fc91
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/RichMediaViewV1release94.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 06e824e1a838ba18e32b330e71cf2cfd3b772011674ade89d0df2ef176a4859b
MD5 2e4f053b2d61556bae2812d03519fc91
SHA1 5be50f03eb9e8c87ab0fd872025a52fcacea7f25
SHA512 07be7aaff843be4a148793b39245c650c736a8596b11611fb38d3f217ad16b2afe0fd6341b6acabe69ca5b5519e5eecc90a3fea86520a1b4721ba0d412420c8b
SSDEEP 12288:fl+bWO6gMG4GQTq4OaQQTYJ8eP4/L5uO7D3f5BVJq4GanQTcJ8ePx/Z5uO7dApqG:fMhMG4GQm4OaHYJ8eP4D5uOHBBVM4GaE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/RichMediaViewV1release94.crx

SHA256 5d0dbff9fbcf643bed75ee5ee987e920f1bd7bf7a543de4630e3d346b1ac1766
MD5 d0f38b61f5ac74d51454c17de03e32f9
SHA1 44559fd735a0af2f2f5bc494fda830eea6947195
SHA512 1b9a30584c2b7d52ad3a3167f9ecf300293c560a4f9287a14e7a4f4c7d0b1d4fde5179c8a253fdf1fa30ef977ac3b5e0e68a8ef3eb99610a97635c3a5f7e12ef
SSDEEP 1536:k+XtoydWeJydDYNjdhfydWeJydDYNjdhaydWeJydDYNjdhUydWeJydDYNjdhlR:kwtH8JYNW8JYN98JYNf8JYNP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffRichMediaViewV1release94chaction.js

SHA256 9e7c1f7b76bf471be8fb39a29cb494f28742ba858f3fdd72a662d0ae625adc45
MD5 b1e542d1dba8a78fcdb6278e6d897ec9
SHA1 ef580503748f28cb58b4f5b74c0522b014246192
SHA512 c5a5c6ce7624124588b6704967e61729723de3d40bc1735f1cf519f25fc12bc3ea9f9078d6ee111f8cf634f9a414f59ca376c9a4c78935386a9f33ab0effa8e8
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release94_128.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release94_16.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release94_48.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release94_64.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 a94d82f4cb5e483568ca37f0222c1eda9e1372237d9a3a0888ed8e126e03a246
MD5 61b5d9760608d58aa1c771969bf698f5
SHA1 528b632eb84390cf127f9d837280d998026156d3
SHA512 42b0c45ca31edc1d4aa3ccbf63603365a81ee1cb696ede97e2c0d98c591ec3381d4ef11280046c02844ee106dd09b1f925d18adc8df2508b5bb0abdebb019455
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 4aa165d5cae4722b7fffc619fca736531c9e5714c96687dcd6a2ab184522cd4a
MD5 48de4c17904e6908488fcda7bac86a4a
SHA1 143e852ecf04d29b31ab3421d8f3080007573791
SHA512 bc619a8b279d24481b4d20961cbacb003c8e024dabe5d2579518057fede4e6a84bf9e2b97d74421f06763ba61089b8365e83dd4ee59c36b0d5744d9cfa972d6e
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release94.js

SHA256 bc03382008aac81b25dc5ac07e457f088e4c75a94b5b36fd6633a216efd717a5
MD5 efd810dbe2f68b5763832502dfdca557
SHA1 47fd97e3aa70053878a77604e21ca1a67205779c
SHA512 19662b82597edca918a4e8d8f83d1e8362a3a037cf9caded9bf2f1165e3ed7b2d80cdcab38f707b10ae11ebfd7a9d0be6f0548816c1a53de53824d6b260f2ef8
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release94ffaction.js

SHA256 e774af1fab40904d95b7871d879222fb5024adff5ab343318847c1e667690e3b
MD5 e3e5a3fa8aba7d7a2f8a9da5bc53ea78
SHA1 8c0c752edd34d1188e113f0c35785d9e47857591
SHA512 7657524726bd53a46e787d114400d13c27e233ee2a1cd1c7d99ccbc1ed424ea25c55c89f62c2fb35d226c361742157175273b0f075fefefd0edbcf74c2ac8a86
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/RichMediaViewV1release94_32.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 13326a2d5397b4dc01c1459a92378de643ce9a05b7fa699dfb2b6f7545834f8b
MD5 de8490a8f0c8e69700db716a56674583
SHA1 086d91fbe86192248906282eacd8f1071a2d47b0
SHA512 f00afa5b6eef444cc9e9dee2207087f21867534cced8599abdea6e8f4ac0222521d1f6ebf7d9723d527711f3ad25082e2572dffc602e4edc73043d1a5032151a
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 3b4493549d5fef722e89d6fb32b3b219f69c2daee59379fdc208e064eec581a7
MD5 9e146ccd193108e003816d759568b8ee
SHA1 ff3ca763219e8d424abd2cfb1a3f2d33e4f9dccd
SHA512 3b94f4b66a2591423e27391c5b5c80634765faa173d32da7d21ba3f1abb51b7eded2acd00fa75423ba31d2f771d45281226241f83295b9800f86a8c1a51371a4
MD5 SHA1 SHA512

NSIS installer

installer

ie/RichMediaViewV1release94.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 cd3ad4365e4bcc9591b8268af6ccca1764ee57951ba2a8378a081c987ffb34a5
MD5 123ec917e881479f47630f64640dfc43
SHA1 f9073f05c5cd46da4e36cc2f5d99e63aaaa78472
SHA512 9d6d4c53fd63f24ed04e4407cfea3aff62fcddd70fc5dafa57a94c6b77779d3b22750e2770ef3089a0d2a503369b752394c4d74231f244535409a04df12c6545
SSDEEP 1536:Bc/9Cs8ekkcEDtqJ6Zk8DktexnLlQE14EpY:a9eekkcEJqJ6Z4exLaE14X
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 3ebc6d6a3a3efdea1d9a3da0394c5dfea354c2be6b3ef7940c840b9d1a4b0966
MD5 da4c414cb44a4ebf21b9168d64a3e806
SHA1 365eae43c9b14d9f72bc996f06f1810b830cb0df
SHA512 ed8a069809ea6c3712360b5e49380cef693c328b9ffa63bbbc3b4f5150f478e6c77b7e48845fc46d855bd52b41d9ba012c26260a4ac303b3622aa05a57f71f79
SSDEEP 6144:Ue34QdJRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm3:ddJq4OaQQTYJ8eP4/L5uO7D3f5BW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer