VirusShare_2979570d9b6f2a7f85bef096e7fbd855

resource
VirusShare_2979570d9b6f2a7f85bef096e7fbd855
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/TrustMediaViewerV1alpha6001.dll
unpack001/ie/TrustMediaViewerV1alpha6001x64.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b0df4fe2b1194649fddd69937576acd03d26d8490d0aa2683fda1abfff63f4c9
MD5 2979570d9b6f2a7f85bef096e7fbd855
SHA1 dcbc8b3248fcedeb7acedd54eab131cbfb00c7b9
SHA512 0df7f8a2e3205730980cfb988e06b2bfca21b5904f349e54aa83061b779a84952bc8dc0ba1efc366457efa1e10c99ba8a73d91cad53533feee8fecdcf2e9b8cb
SSDEEP 12288:MEiISTgJG4G4Y7jeKuVnvon+N83LwwiAn6KkM33nxDdjeKuVOvjr+N8GLwwi5n6Z:MTEJG4G37tUnvone83Z76bMHxxtUOvjG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

ch/TrustMediaViewerV1alpha6001.crx

SHA256 e38dda6dfc38bedfe9b3904657e02219e2f5af70584b9e408dcaadfa3ae33a5d
MD5 7a72f73235bf85f2a01afb48f01e4937
SHA1 e7211e7e1001094208629ab64278cb37f977942c
SHA512 851666cd5b13e701ac107b83ca9262bdbec58b584f77906d18feee54044ee38981679cb23f73f3b93da6c06b3602166b6ffd9632ce84ba6e43dc1f4dee3bd4eb
SSDEEP 768:PN0/ZfA0Q74XY7z6bRc74XY7z6bRd74XY7z6bRP74XY7z6bRf/Ar:k5A/sX+ObRcsX+ObRdsX+ObRPsX+ObR2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffTrustMediaViewerV1alpha6001chaction.js

SHA256 a40276863e1c61da271ea051b53448cea1860c4ce581e39223cb8844c68f5220
MD5 4d041936247e70ecd90a69abb6161b28
SHA1 3d45d18540eb066c48cea816c9f5ee73a6f0f7ae
SHA512 a1344e009a503dde0eab30839c6fc1dc6913146bf029d7bd5aaafd1444435e54376df3b791016b187853f2c96cad944f00b993430544b08f2b4876f1f164a25b
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha6001_128.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha6001_16.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha6001_48.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/TrustMediaViewerV1alpha6001_64.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 07c9c7ec14c67e9b21ad5da53d301d65b8f68f34f3b3f8d28eb49e4bdd1757a6
MD5 16402268cf0e26c867d5e19ccb78a08c
SHA1 6540bc668334961310b68bc7be11518f25134f70
SHA512 1905a4bdcd97a3428ebdd19f804c9d6b2073e7e1f3b7e8649fe22796a0bc9c1872feb084e1f9f2c8ffa8749472934d172cdc0ea404183277af2b6c55bfa4d693
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 25da270667f8b74e8814740f6afe8eba00806b73b01d6591954f70bb564dbef9
MD5 987d2c317a48f46a7df2c49b21df83bd
SHA1 5c36c253a0eed4987c0c54360d46df44e3ad034f
SHA512 ec1868d77d35e290cfa0db881adbf85d84218b46a62c5c365e3f654f166e16160886e7919c7c739c04a909b377c5380118c3fbbdafd57ede7e6c6c62e13f05c8
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha6001.js

SHA256 b01f14317b8c38a90ce2e8f15ebed7d37e657df6f07f7d2d404ac2d7545c8f74
MD5 bd44ec15a1f317ee42900dab980104b0
SHA1 6548b6bf2adfed3eeb95c6260e43f8887b2230b2
SHA512 88b8a4c3d73880a447f72e3f72e118203a50437a49e4a6694d32ab4f624984298d654e1d5cbe6112de529db52c5bea58a50dd337a45c796c78ddee22db615fb0
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffTrustMediaViewerV1alpha6001ffaction.js

SHA256 cd66df51e7b7fce4d8d3cb0bb4b453f5400fd53612c00d2ecb91d9998df3fb37
MD5 58f7a712882945ad81fdf33cd56341b8
SHA1 cb2067c71359841c46a4bf4b10f22825d3aa6eaf
SHA512 b0c640f6af07e5adb7bfd4e2ac2ce7c7e3fb5d4963c4db3685652de02ade0a5533e8b94310c12e3daad588f155e92f89662b989d06f23c42f01ac652e6a341af
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/TrustMediaViewerV1alpha6001_32.png

SHA256 62d1ad0898ce4d1b68965336d6e829057a6198fc7a2a5ceb5352eb356566e85a
MD5 07847bc3817007b4edad6477821f106b
SHA1 16ecdc06872c7f3d73146704e9a5e5791e7ff2b9
SHA512 e6c0799e0a58cef186e79a24598663d5df23c66e281eab0d0707cc2816d04fc4cdfcceba06b430871c49d6326e3761daf32cc8743b30d14beeb7329537e40daa
SSDEEP 96:9jEmcG57kZ72mh3xw/SOEDgtYUhyAX52Ecz6odKJ7AAwoaQrADUm0Z:BE+F42m9xPwNX527z6odKhuKTZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 bedf83716b3a558723faf7e56a9cc7892913e0677d8e89e67d9c5e071b37224c
MD5 f118aa0b7058a2e66e67caacf4e5e064
SHA1 2b7c1c7a6ac171786c186c7b2db12f1327b2ddaf
SHA512 02a8fce7dd163d550a8cb9acbceb75483c1378c9ded1b2e625f08b20e6e4ace9474c1c274296ee51c205dae300039ad60fe37cace12389f70f4cff9ebfa6cc63
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 f34e7b996856770ed698b61d8dd3d1b35745244582ecb518be14542fa0a69098
MD5 c5cddcb9052a27b017f2bb7f0b457430
SHA1 aa08d77c9391f9a7a94c8f44615b2956503bdc1f
SHA512 336071b4abb2f1cb8ee6aaf062f5824ff201d22a45ce4390ec318d70d654a1ca9a728706af426b9b8417f47e433ca658553adc87b14434d5e6358c785965e152
MD5 SHA1 SHA512

NSIS installer

installer

ie/TrustMediaViewerV1alpha6001.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 f32b01931bf04c168bbebd1621856c5dc8632c8edf6d70d6d4b2302f1f3dad55
MD5 3c00fa085e25db9be961ec812a61cf13
SHA1 5229e89f266dff9f042c4ae8519f64aa69b7a522
SHA512 44fb77026cfec61fd7ee068caee250fa44d14f69f094a84f2a58ff61c0c1bce85352413a016ec054c9bcec016ecca58a36574df5dea71ea01e602764d8f0d58c
SSDEEP 1536:BpMGCsQis4EnvtKx+kNp8Dkbw518DOslQPNEjW1x:AGais4EnlKx+kNbw5uDraPNEjW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

ie/TrustMediaViewerV1alpha6001x64.dll

IMPHASH 866723e8636cd523142957a02161663c
SHA256 0b2627b2514690256610cf2776baf6d64dd4c1714c5024d4c6655056faec5c05
MD5 db6233fdf6836c55cc73861084cf055e
SHA1 916bc414e3d8df951133da589c0d63e18cfff7d9
SHA512 8aebd7f514de579aa41e8597a13a9e1ebb143a46fa12f404fc8ce6fef34709c91e55f27cd75de58236366bb00b5e240bfaea8f0c79ed6ef886413872bc3d4243
SSDEEP 3072:ZBjCnTZPjGSRzBHsQnTfGNAjJUSWfzQBTWNF9jZW:ZNCnTZPjGAlHdTONAjf+vd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

34128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW GetModuleFileNameW SetThreadLocale GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException LoadLibraryExW lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep IsValidCodePage HeapAlloc HeapFree RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx DecodePointer EncodePointer GetCurrentThreadId FlsSetValue GetCommandLineA ExitProcess WriteFile GetStdHandle HeapSetInformation GetVersion HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext TerminateProcess GetCurrentProcess FlsGetValue FlsFree SetLastError FlsAlloc HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2409f694d34aa4f8617ea40e784ebd27b76f02d2ebda5a6f4f38ba2c44785988
MD5 6df760c9b29507b4ac9edff39ad8ef30
SHA1 020b3a0d47a1437da6f67f04e6faab3a3f4b8687
SHA512 5a00acf2bc68a5055e34bfbfc3cfe052e47b7be6bde8f0f418db8a74e46929a7772313738cb44284996e5affcbd713ad45a6051454c949190ffd696521ebd6ba
SSDEEP 6144:Ee34b/jKTK0HVkUEYA2q5NbrWN83gQwwDuzMn6yDkvE39kojTxDtEC:q/jeKuVnvon+N83LwwiAn6KkM33nxDP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/aminsis.dll

IMPHASH d56fdae6a8191a51b9007120f163a6db
SHA256 e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
MD5 f346047b13f37f79c462e59a6319faa1
SHA1 ce9e7cb9719000a69b463fe024c81229e322279f
SHA512 429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
SSDEEP 12288:w/x6GnSkidh7NfMc4G1ppgH81vrKiuu+PUHOGcl5Sbl9B9G/uf:vGnSkWh4G1ppgH81vrBu3MHOGUKfG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

219771

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW GlobalAlloc LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection WriteConsoleW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount GetOEMCP GetACP GetLocaleInfoW SetLastError TlsFree QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue IsValidCodePage

user32

wsprintfA CloseDesktop wsprintfW MessageBoxW CreateDesktopW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

ShellExecuteExW SHFileOperationW

ole32

CoInitialize CoUninitialize CoCreateInstance CoSetProxyBlanket CLSIDFromString

oleaut32

SysAllocStringLen VariantInit VariantClear SysAllocString SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer