VirusShare_4d6090def7468fc02c70c203a9894256

resource
VirusShare_4d6090def7468fc02c70c203a9894256
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/TrustMediaViewerV1alpha1078.dll
unpack001/ie/TrustMediaViewerV1alpha1078x64.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 3e1215be235134c2dd181f595cda96436fb66773415856845f21497d1eae0183
MD5 4d6090def7468fc02c70c203a9894256
SHA1 d4a0e1e3bb2f750b94a5eae796f94a4044d078bf
SHA512 4dfe6e0562a528cab890626952828ce7f0d0f4ce1632c3d2ded350cb152c97c87f69adfb6b17b31d521456629e7dea1b48f274dbf89c053e686027fde1909b92
SSDEEP 12288:zm0PviCsSTfdVG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDkjeKuV8vzp+N82LwV:zJ5H1VG4G37tUnvone83Z76bMHxotU8X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/TrustMediaViewerV1alpha1078.crx

SHA256 4162c70e2335ccab851a612e9553bfe7ab0908da751880d70eab4dbfd5af7c6c
MD5 4b7d835bde9434029661b5a81c606e2c
SHA1 e8b2caf8407f609cdbf2ca0ab96fcacf46642a8e
SHA512 f1a8380762b745f6960743e578e96e42624a38b94cf21c6ac5d22e440ab4ec44a6c658352cf6db59f3e5efbcafd589451d32445d2bfe2720eb9cd0abf3406eb3
SSDEEP 768:TZEu74XY7z6bRn74XY7z6bRO74XY7z6bRY74XY7z6bRAIp:TeusX+ObRnsX+ObROsX+ObRYsX+ObRA8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffTrustMediaViewerV1alpha1078chaction.js

SHA256 613e5c486004086c216613c1c6f92cbb5be5bcd273f0ecaa7734ce5fa97d128d
MD5 7fc4112bb53c2ec3d3b48aa560c1da8d
SHA1 f1017810ce26399597dcd5a6f6aeb8ce777d1e91
SHA512 4c34e0fff6bddfa7123b2d2385fb1a99daa3e448ece572913ecf2996f78a718c91c097070782c566c979ca8d7285903caa109fe87077ca6ed89be71a1f5093f1
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha1078_128.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha1078_16.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha1078_48.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha1078_64.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 9c4fa9ecd815f8272350bf960bbc16926c70059f2ece39ff2138d36ea64540bb
MD5 152d7ba365718d95cc687421169ac9dc
SHA1 562737545fa331c483c0636c0fa8d85625c20cd8
SHA512 827a5c0a72e12d043251447eaa4396e4569c4d28d6c65f5a442d1c15993226f0a4a97faa9d0d07a6f8ec5c78c5f87b93aa59f844bf5cd7d8b909385e7ff7ab4d
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 2edc659c1164a6d53d96c961a06f4fedee5c0ca8726ba1e9d002a89738e750be
MD5 22a09862392dafee637dabdaec54bb89
SHA1 0cae4aec04ff6dea637fe68ffc59c5791c241d7c
SHA512 e784b3a579d88110896c116a212a737001644868bee1d673af65d8a8ff42450c52a975d333213592cf2ee93eb7ee02abfe9d90c8094998fee80701dfb6f0d926
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha1078.js

SHA256 708f4c9d89fd694294d40e1acf3254c7a3a59e158fd4746bb988b8c89563e7d2
MD5 fd012b731bf3582803303fe1fe09c9d4
SHA1 7e5c4a07c1e1849a1b1947f4a4eb44ac0d2e59a8
SHA512 6bede505598041754b53860ccdfc47c9f5731da9e4d6f28d5342387887b40b97b86aff53ad964aac3ab66ab417b370c143ca130a0dc4c25573187c0655698e7c
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha1078ffaction.js

SHA256 4ad5877f831e1ba10306572a4ead6141b303b68063460635c515cf0a1c88b467
MD5 206764a5f6c8baf9109e5268bc3f2b38
SHA1 ab00c7c729c07666f9b1e424568a3e086ee08d6f
SHA512 8ee1f3360a6f6a799b94ba006d87b05ec423ebe0946005b7755e29e4c312e956ef6d7a76544715e352332f1d4bce4d30e57902619c6b7de263fdc423700f33bd
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/TrustMediaViewerV1alpha1078_32.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 ef4a7cecef45a2894bbe1ba25271a602a3ba2ef17049bc220ae001851e795413
MD5 29456ea13104a4a7daf01228916b75ad
SHA1 03087b98d52496e0cf6da4af823d39619f57369b
SHA512 59e7dab93392acfae874804cb72b3c434c5e726d6d5de2b92dba882706b33f31bacbb0e1dfce817c51ff359992db9e978a925dd7be789835fab60e3bee5f2eca
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 6fe8a65c13604fe7328c5a32df390f779c0068a2f42d4c59f19b93226e382728
MD5 f1317ccb8b025c3943de7fd70cfd81f8
SHA1 e10275b06d874a14c1be575ae6c4702fae627aee
SHA512 f31abf2ed82640b8e9939b99d542c3dfb0d402465e3ae8bab5e5d8c293d027ff999af955149a9f2a2159ba5b17f10e638f3bd68a08cf695b11c36ea0d00ce08b
MD5 SHA1 SHA512

NSIS installer

installer

ie/TrustMediaViewerV1alpha1078.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 cb761a7ab59975bd000a3acf8ff9a7e03b6ef9e5f2e5595861546f9b4b124e9c
MD5 86ab6b0bdb83322fe8c7f939b3759020
SHA1 0abc91598901c066dd9c4b9600835b5dd0cab7a3
SHA512 af2b7f4c0d60ffb297369df246b4ee4abdb7e18ba62830dbe6d1147f4ea44e9026c9a1b82295c31e6a08f9f8a4c15d3a8661d860b9bd5b215b6b5f7dd598eb47
SSDEEP 1536:spMGCsQis4EnvtKx+kNp8Dkzb518DOslQLnjZlx:pGais4EnlKx+kNzb5uDraLnjZ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

ie/TrustMediaViewerV1alpha1078x64.dll

IMPHASH 866723e8636cd523142957a02161663c
SHA256 2071ca0bef94f66ed5851180fbdb18bd484aac2fccc3a10b56171e6911ddc388
MD5 8e9ecdcbffbf3e097717aff7ba2de75b
SHA1 be9840892c0ab203c813ffa3fb3170c674c7598f
SHA512 3c72dc561279a0f6fd1e9e31c1cc2cc956b5fa011d7ea5dc343da2bd31b1e4892c217fc65062d31eb31d65094f387f55446579fe6079524f6705b5d01b619720
SSDEEP 3072:mBjCnTZPzGSRzBHsQnTfGNAjNDSWfzQBTmvF9hZ:mNCnTZPzGAlHdTONAjUsvh
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

34128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW GetModuleFileNameW SetThreadLocale GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException LoadLibraryExW lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep IsValidCodePage HeapAlloc HeapFree RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx DecodePointer EncodePointer GetCurrentThreadId FlsSetValue GetCommandLineA ExitProcess WriteFile GetStdHandle HeapSetInformation GetVersion HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess FlsGetValue FlsFree SetLastError FlsAlloc HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 852f08797d1ae83cb293b1ebb3e1a924348cefca7b8086210d302b4898e1ce3b
MD5 b741724d8cf813fe300f1f5b6db28312
SHA1 fbcb0e644465090430f3945e27ff87812b754f19
SHA512 95aac3b01ac9de79653439e27e6eb1fe3776df7c535104bd9d68f90ca9b610fcb4927a6bfa02767d9ffcd0dae70a0702fc99f6236bd91ad7443f29c840243abc
SSDEEP 6144:Ee34k+jKTK0HVkUEYA2q5NbrWN83gQwwDuzMn6yDkvE39kojTxDtE1:B+jeKuVnvon+N83LwwiAn6KkM33nxDA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer