VirusShare_f744078dcb8127c67b384204063c3e9a

resource
VirusShare_f744078dcb8127c67b384204063c3e9a
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/RichMediaViewV1release6203.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1a57e79dd08fe6a8e049efaa195efbb410b8103439c1b8a37355f3bf1380915f
MD5 f744078dcb8127c67b384204063c3e9a
SHA1 3f71aeb7a92aa69883eddc36249f248584ca7531
SHA512 e079c2524af2428ceb56c2f2070bc2f31dcf9d28e02acc94d354bfb4adc615203311100571271ab780107f271d696b945647f26c3a1d4c39d256984f70102478
SSDEEP 12288:n4YUWL31aG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bzq4yaPQTMJ8ePB/x5uO7jU26AZ:n4YUCEG4GQm4OaHYJ8eP4D5uOHBBG4yw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/RichMediaViewV1release6203.crx

SHA256 f1a676000165b86920fba9cd47859fda77566921baddb564f1f3231a28b72068
MD5 7654e60bbdebcadc8be68c1a64dd128d
SHA1 61a4b48bfd7f9b18356a24ca8738cbb0e2352500
SHA512 35c99f1b27eccb3472bc9a985cce836776564af9108301ccaa3853a39d46d40e64518fe0724bbffd0a9be3180f7ad505961c04ab924bf54e35c7614aa0708267
SSDEEP 1536:4+TydWeJydDYNjdhJydWeJydDYNjdhQydWeJydDYNjdhmydWeJydDYNjdhq:hG8JYNA8JYNj8JYNx8JYNO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffRichMediaViewV1release6203chaction.js

SHA256 be76dcdbb505be3c0bf61c53ecd7d6f44fbccb6b40d33e072ccd954b13d9731f
MD5 b2a40b6d8178610af1000575b0113726
SHA1 e8cbbdccf4c7713b140840b080c9bb2f5dd98b2a
SHA512 4c9b117204bc81ff12ee674e942cd0e7a3782d9cc03b345b39801ae8aa7ac87e45572de245a2571490ac2a0f190f2db9883aec58974dba59a575b44284676dfb
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release6203_128.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release6203_16.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release6203_48.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release6203_64.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 bce07f9e0da9b63aedc675f3be4c6c9a47fabe11b3ab4fb65b73a3d678a1638c
MD5 b1fe7a73d20d8718f4068fc2b804e713
SHA1 c598769ca0353c31ab921e5c34372000e2041604
SHA512 cc7035cc62d4fe9d5a26180ec0b4c8a3e6ead8f13a7b05b99431563d15d2cf1f05458c8574e59f6c2ea7097266950fe8c38c705fdb87dd64edd9fa97bb9f98b6
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 76064f8555d0afb6290b0203442697e7356a003187ed17c7c0cedd9f2c88d668
MD5 3f31c1249de911f67920cff59f3bb2e3
SHA1 c8bead6d314888f38e6dd0dc114527e4d96cfcb5
SHA512 0f5f7e833dcc7633025674209e97cd64d39fa8ddf906b8ab1aefbe586e3608ac4305e1d2e7b1885dd222ef4a677b0409daa6804f0ba2015ca6125f8e9a6396ba
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release6203.js

SHA256 ff1c888b96beb4666d99a4d052f637a69f9b6ece09f3059823543f13fb26b22b
MD5 4a7b48513b04ca6a694e541be3ce2fed
SHA1 c633f8ff775e3c4e0a117d117f75f0f1f084cf6e
SHA512 76c2fbd2ff1a2677c41bfdf8c7b8fbaf2b4e5acc1b73969ed33269623e2b1d382e987ee6f1b3add1bd79dd9e6ca81549aef2e3605178783ef4cbe9abb48aeb97
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release6203ffaction.js

SHA256 ae0b49e91cb8bcd9011d82297e0ccc9a1009a424c2340ef83ce511aeb9c390ca
MD5 c251ed3891463d8be45fdd537e7e0051
SHA1 51885e2a50af8276539233ab6d7912e535c975b0
SHA512 0a2e21a4e6d757eeefb712b7d4af3762a7c1e6e86548981527c487994aa515ccf57c664f3aa325d55e9fd5c6cf35a9c92c571d993b3458efbbee21ff3a6f6807
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/RichMediaViewV1release6203_32.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 0ee02d34188e6919a64e4c4fe74b60d2280672cf44189d6656ea3b03237c3d63
MD5 6f8889b203c7467e14fd7060a329120a
SHA1 7a6b19e79fdab8f10de0e97131f93c826063c384
SHA512 7502bf255ca23127b984434b5a583910edb3f0d06f655f0c70ffbbc85c1d2f4b2a12e2ed707987ea81a8460922f4d3e898e0f4b1959475408af6a4b14c233c33
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 94e2c3ed283c2e84c4b3215acbcb4e8c9d4cc976ea0938c0f2f7e6f47957bd19
MD5 4eee681feab7b2d9a2afc3e61aea5087
SHA1 b3d48b6026c33c7702ac3bc82ed572600cb4c289
SHA512 7c5bea1f857e0fd1851db7c47d39f0b3d8b76d21ed651432995b7d59817210cc2d47b692502fc8824ef1b3df1ad3da2c70c17cb269f93ef0a4c5e9388d6b1954
MD5 SHA1 SHA512

NSIS installer

installer

ie/RichMediaViewV1release6203.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 9f0e44f81f5123a68245eb67c608b1a91cfbc35db1cda612799331b031118de0
MD5 1a2ce39bd39f1174f8712e03dfef5bcc
SHA1 83ab539117a0836cf18f908ca986de0e433232d1
SHA512 11a1246c3ffeb3c88ddefc5bd2464ab8d9db11314ebc754989b22d617db52a22f95c6a6cb4c310f178ad9233886ddd9b3fef72a23f8ccec3307c51345497a803
SSDEEP 1536:ehMWCsgyMIwP/t6hp1ZcTkrCH5CTfLlQy5uKS:bWKyMIwP16hp105gay5u3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 8e1dba4a0fdbe953f3a1123f9a76886ab6ed86caa929e9725580c1021c61d5a6
MD5 d3abe358fdafd2dce0d9b395f97152d9
SHA1 77734c93ddcfb3f09d3573bd3a0da277fcd18d36
SHA512 79157511a8da87e7ed3293603c2e38a2ecf76de665949447658864e981b948ed9188195aa9eb0ae98820e17f0520c477328cbcbf3fa5715308d68c7bf3a610bb
SSDEEP 6144:Ue34Y5Rg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bmy:t5q4OaQQTYJ8eP4/L5uO7D3f5Bj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer