VirusShare_7b8c8ad756e2e5e0a4ebc1a2b7833e68

resource
VirusShare_7b8c8ad756e2e5e0a4ebc1a2b7833e68
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/MediaWatchV1home2427.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1e48ba42fad238c5eb31848e810360aef3d51bd217797833b9fe6d4e34958431
MD5 7b8c8ad756e2e5e0a4ebc1a2b7833e68
SHA1 c963091441fdbac6c66b92114b716cd75fba590c
SHA512 04ef1e105b0d57e04ead621d5501dba22624eb035eaa7b2e3eae45616aa8e9adc3d016b281b47d870d5ecc6b9a098792531a295e3087ca445ff2258ca5b98ebb
SSDEEP 12288:aOcT22WHJG4GjeZHkwuPikQ7lKH5p5H9x1DeZHkwuriZQblKh5pDxXTd8zbk:aOcTuHJG4GjeZEXi37l6Br1DeZEDiObo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

ch/MediaWatchV1home2427.crx

SHA256 8ec5a213c1e9711653a3ec8450f6b9af39adde8c72d5f74b3e127dc0064a89a0
MD5 26805fa28554b7c1481da810e0225a6e
SHA1 771ce0fedbb9b34bced95737328dcc905bbedfda
SHA512 81e0de3139c35d39bba544dc36498ba7ef3519bd3ca1d9fd09f31afdc82de6dc8c4295572714473089fac8c337faad972dc0376ff689297119ebc73de5b4e393
SSDEEP 768:/BXSZTIrxtK4JZ+yeilerxtK4JZ+yeil1rxtK4JZ+yeilzrxtK4JZ+yeilv:ZC2r28F9er28F91r28F9zr28F9v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffMediaWatchV1home2427chaction.js

SHA256 cef99844422757a7c2c2038f2a264275e61dc95937511a505aafe4386017668b
MD5 e54b0f643adc357cd9b21872c9625ca8
SHA1 1d8d07d5c67950909b3a9343ac9f38ae08273501
SHA512 8ad7eecf42ca9daf9df4f8b9b57ef5feca2054ba9c5e493e573e0e7e7dc20f599afc89ebbc47cfc9e1dd1a8738819ff72113c46de8ed76e1b727f007b7d29953
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2427_128.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2427_16.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2427_48.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2427_64.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 1cc64e434db096285351c3dc46be99063f4fc49ccec436b68ce5241c65d729f0
MD5 580df0911c1a98e82295b7250e2b3561
SHA1 5b90c2b2dbe0274f6e1768a38604601e2f9e6c15
SHA512 caf65b3b3f65ad7f6491a3a657c683e15081921311aec8896045f485121f352623de1d89c4e8c2a435d13580064dd747da6f3fc3d3550b71b9f053d0953866e1
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 f2a3245ee8b017ea14b76794aa062f895a2d99fd3be77bc277052d0e6d4816e1
MD5 346f9aba49c4f5cd372f049e4f38426b
SHA1 b72692446b43c5c12bc998545bbc6ffff5824e82
SHA512 622ecfa7098a1b5dade16fcb94c8d50b2a92022cd9fc0ef561c36adca8e7c6a2e774a0d9bd97caa7fba9a0f8cf73bbe0440bdec2cdd7a313905f94228adeaddf
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home2427.js

SHA256 57bbf7271c25111c919855bf629f866142db7ede1850d9e4d6d04506f7c5d7d1
MD5 bae091b715a3e5ee709b37e5db40f6c8
SHA1 5ac2fead35156fb513c47832a1fa98005630cf65
SHA512 15d31080aa185b5de52ca36e387b64607b88332726573803c6a927b5aacafce0b5b35194c64e1ea9c29a989b1d9583e5966e3515606fdd50dc3ac01560388642
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home2427ffaction.js

SHA256 b13c8231ebad9b187f6d0b5b3ad7de4806298c8d6a8d3c1fd499c56eb6914964
MD5 a04e63d696c3ec2dfc3acbf1a638cbb1
SHA1 857a48cc1c329aa51f344f80b96319978bd8e721
SHA512 6b1676c34038de97bf444e7db6e9ecb5e3f07f7f2584eceb5bf8577f3e2c5167a4ef8f54d6b2e46237edcec23d51ec26fc17b131f53dfd257425f9b3d40ee1eb
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/MediaWatchV1home2427_32.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 40acb29c6415d20f422ca68b0593b38f08e8b97b2dcdd626768a3ef8ab678c70
MD5 a2887ae16ce9ba6349c3ef9de7f9c6f2
SHA1 b3be447a049603444d8b662cc12f236f198bf6a5
SHA512 77e4545dd4af006e72615b3cd8da4d694592b2ec8654e83b6067c9318b794e4623c0ec013ba482dc14a252787687dcf8cc38aab84044278a0b18dae9d3629a9c
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 159d250900c922328a3459d825bb991feb0229cffd013893fde63d2a58cd5cc4
MD5 98205bbfd7b1d8e136aed18532a4f03f
SHA1 eb905a56149ee362f0590dd6ab868eef7a248525
SHA512 133a908f3f4b98afc0d224511e0cc65710ed12ab7e8c54531c1874e37f56d624b16d8094c5c139d341580833355e15c574ef38696df3b6e430d902b2b58aa58b
MD5 SHA1 SHA512

NSIS installer

installer

ie/MediaWatchV1home2427.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 b290ee17d015b8eb149dcb5265011538f7873d3b73985d4aa53f68ef1ae7e8fd
MD5 28c07962e61d1c1e2a3b169be219c961
SHA1 7dd1f02d6e181164a14aaadf605a1699897962db
SHA512 fdedb93a0372a8d7628f54bfeaf50a9527ad077f8c8dd35a24b7f7ba8162c4d60a9d747a743ccfb55c1bd3ced5123064a4756a2b73152de5e11b6886c808cd27
SSDEEP 1536:O8/1CsEmka04RhRtahrOb8Dkh9RHA9glQppip:Z12mka0ElahrOpRguappi
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 c9c2f4c68854e7662e9b0e40fbd48a617008dba06df8ef65edc4311845582a41
MD5 8e1e52df79a4d3bd48aa9a6f00a2a323
SHA1 2ebd1bd4c013580304d0647f2c94270e1a9d93bd
SHA512 649be0ae3bc503916354c55b177fe71a1f6bb2f4a5ab34cfe664f86fe89bd980a2d664301a5c6fff83cbebdc2801756e977d1897c2656bbb69fa71f8bce40845
SSDEEP 6144:Ee34pYpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1e:skeZHkwuPikQ7lKH5p5H9x1e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer