VirusShare_f36ac7fe92af1b022706d3f38a491f80

resource
VirusShare_f36ac7fe92af1b022706d3f38a491f80
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/RichMediaViewV1release4992.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2a194c3d5a62b2ef02d04ddfe3b986bff84cd721645804b9e6a9fa16fd44ff1e
MD5 f36ac7fe92af1b022706d3f38a491f80
SHA1 1f5a6ebace953091df4d1ffaa92b33fa73019eec
SHA512 11bec16b7d6e1454d36fb3244f799464f359f6c60adca97fcb63894b21b8b81b50be0de213e2be624483ae1c2681f882fa8455cf29166cd9d431b26fcd3919b0
SSDEEP 12288:4iXGHLKG4GQTq4OaQQTYJ8eP4/L5uO7D3f5Bsq4IalQTSJ8ePt/t5uO7EU26qBa:4iXGHLKG4GQm4OaHYJ8eP4D5uOHBBB4v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/RichMediaViewV1release4992.crx

SHA256 166edd571fb25dcfde3f9d24ef515547e280137df46a2a254457a54772ad74b6
MD5 338edc04a1ea67042bb2d9a09d40ff73
SHA1 06d4f9e41eb11448b2b799dc36f6376473716ef8
SHA512 8af3731d6952bfd0b588fa86100965980eca1839a678ebae4600d3602b81315393058a42a802f8479c160005a067f39a26aff3819708474bb81f52c9847c93f2
SSDEEP 1536:ZWydWeJydDYNjdhoydWeJydDYNjdhFydWeJydDYNjdhPydWeJydDYNjdh6:Z18JYNr8JYNk8JYNW8JYNW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffRichMediaViewV1release4992chaction.js

SHA256 623bf21e9ca9e6a603814e73376aef1ca6098b2406a9121919b0b353b33aa583
MD5 466fedb0ab0946e7f8e28118da8ecbd4
SHA1 dcba12abdb2757bb6951349d531484bc4f4e39c1
SHA512 efe200c4306578cf1742ea38098370b8156ba5321b4605ba6578f87513c7521a527aab9732be3b089ad479261e9ef6b32eae465c7fefd97e32485a65ea2b7d5e
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release4992_128.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release4992_16.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release4992_48.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/RichMediaViewV1release4992_64.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 efee1d503013b9c9069125c55cb3832c00409e3727fb14a1c1568eab4e13341a
MD5 b3462de98f026d32924ff8c847a5ed63
SHA1 ba967a72650dff0beb435269489634cca9d1ee9a
SHA512 4a5e224f244ea035beed0408c37891fae16edd2b6a70a7647920fb31f18c68a5521068afb117de546e24d2268a23462490de197b9ce16eab5c10e6f5b8c7053f
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 8aef08c3c838ab415c42a205ad7ea2dc74d9cc8a5b4efdf22bb2842fae89e8ad
MD5 d08c60f6d9fd7044fccc4cc0427b31a0
SHA1 4378a6f2338fc59c79ec2e44ac84fb8e1abf6ef3
SHA512 bd606c8a29299b0d5329c7616ac88cabcbb2c826956c5d1dc41c361f225e0ecab60d48415a9d9ba46c52ab64623d286563b8f01c14324a26806697e2099d1371
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release4992.js

SHA256 867675913ab53b24aeb057b2fc2bf94aec2d90abfbf2d79c62b8aed8f214a207
MD5 3e8d808d3512a901fd790d5a7f431ace
SHA1 5e91ccac191253a5da0dc8654885afde0471305c
SHA512 bf75fbecf69c7a34530df474e21900d4c652b962595fd5a91c273d320ce8a5b1aa104a8d6a39a425ad15ea713794820ad5b2089306170f93a1a1a852fdc809cd
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffRichMediaViewV1release4992ffaction.js

SHA256 a86f876ed2b5707a52af0404b08313c630bfd0f7f7eeea17188d1115bf0c91be
MD5 048c29de96d4ef21da22da5f02e83ada
SHA1 9bd8e44e1689378bec9a84ce8bdd3af05e511328
SHA512 8436f95ee46b4b556b32721dbfdcb74d7506cf8cabc280b75e4e3bd2d1a5ea27d8a36755455ef02b692cdafef37f2a98edaf5503f8706fd8b8571d39ebac93e2
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/RichMediaViewV1release4992_32.png

SHA256 1aab95b0e492964e021b22892c3a42786e0228928ff189c78f73f9eeec8c0902
MD5 181654070ab7235541940d797f183c19
SHA1 451515cc0c74ff6106c29d2aefb1c7e694e8a980
SHA512 20663c1d312a380752278258aa7bbe1dff72c576d966752088c7f2a5bf90729c37b63b1746bb947e5ea46ce95e2547607c31275a18dfc85149448ed883aa56c9
SSDEEP 384:U9O+kwkp6X4TdUdNHLezFRNPydCzu7P1YFQf5jpCXjfIdv7lV:U4E084TdEHLeJydDYqf/MMdhV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 dd796f11d3ba5b6d2b504693bdd7bfadbd1b5d9f675ff06f8a7517dbb2034020
MD5 ad0fdda685e82b9b3b848d07c6b87a6d
SHA1 bb7b3870195fa3b3c2c26b8fc527473c09a25cc5
SHA512 25b90e6004db18cd91699cdd8ed960ff79a86b70a5fa07a31a3d78a3b44356ba2849dc71cbdade7df3566154707441f077a2f408c47ac84220b3b267a3f2f68a
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 70f89de5e49dfc396684b6da320509547975fc622fb041672987f96891779f60
MD5 87bfcf8771d0109eca364cb443811116
SHA1 11924361513356856f6d91cf7260ab820ad6a5b2
SHA512 a911ad481e1cb6354226c9acd7e7fd1744b7db14b2c9fe298d1b252fce2a39e4db004567bbcc59737043bc40dfdd9c2148995b55a08c1271d991199dfb467830
MD5 SHA1 SHA512

NSIS installer

installer

ie/RichMediaViewV1release4992.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 303b8bb5c34ae7bc977177b734f6f845650d4cada97caaa9a02c2694e4e76d89
MD5 f88e12d8d5aff750bcd6e73d880bd098
SHA1 ea9fbe1abd46747b18a0b279c90a09131a5c7a43
SHA512 8bf3f2f6c5765a14d81d756d7317ba3311dcab3ac56af9d08027bf90fd783ed4cb77f229e7fd768f0528f49b80503dd72b3491e9c17686b45c8b617aa0243e84
SSDEEP 1536:ZhMWCsgyMIwP/t6hp1ZcTkrCBQCTfLlQkfsqS:wWKyMIwP16hp1aQgakfsX
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 cf91ed95e53662f7208db45053ffbf9ac2e38e709518fb526f205a45ff47ab63
MD5 6c635d94af00c62be7c2337859f2b84b
SHA1 3525ad160fc22e59384f05ad6fc94db445713d53
SHA512 e252f886fc73a9950a4072b27d1646a4e0f4a3fbb4ca9d9a93506ce67e38447afb1a2936b33cc5192859f32ac2633ee0f275a899100a66a291c39244179b19db
SSDEEP 6144:Ue34XHRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7Bm7:OHq4OaQQTYJ8eP4/L5uO7D3f5By
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 1c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
MD5 450753ad96785a240a39deccab3af0d0
SHA1 21c544064d2ffa6444508268ce258a330d459fc5
SHA512 c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
SSDEEP 12288:i/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9GUdL:9GnSkWh4G1ppgH81vrBu3MHOGUKfGU
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer