90b0b68127f75c6a3440d7e01775559e

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	upx

resource
90b0b68127f75c6a3440d7e01775559e
unpack001/$PLUGINSDIR/AccessControl.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/Uninstall.exe
unpack003/$PLUGINSDIR/UAC.dll
unpack001/lzma.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 3c803e52fe005b478351638f6015604bb6a5cba23539860fed9455c093e92be9
MD5 90b0b68127f75c6a3440d7e01775559e
SHA1 ed6f93ddcc2e36fcf50f5e5cb8dddc6878c83e1d
SHA512 81aaedb5ecd46b75a5686bb201b725bce398531a19918887a7369b593f4212b8bdeed418247bc4be1f5bcab656d15974d8e1d1e3c9ea714d451faed3fe098aa9
SSDEEP 49152:zKwnQ8lF+i3nE2PKIgrMWbid/swD0CU/2wZOIn:zKOb2izPMrMWs3DU2wZR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AccessControl.dll

SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
MD5 9f1a88b953fd2a2c23b09703b253186c
SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

33616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 39b62bf74ace31d2d8041bf1748e3d83ad0b0b674dc7600b651164f748a38667
MD5 5173088bda257c4f549247031a21caab
SHA1 e6f3c1c3b1d5d53f6adb23cf9a264b8f5d0dc479
SHA512 01f14c768ba2f9f11c5e344ba44b75dafe486e7742ca8896e0a985d80b71192336e2472f7a2be17801fe0c753bd1eddc8494af53dc436ab727ed3d0fa3c7ae9f
SSDEEP 192:ThzPKgdc4SN+XIjjAZaK26N6dlJmclFcyw:ThzPM0/aAUF9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DcryptDll.dll

IMPHASH 322977d1ab076375f887588994151f0a
SHA256 db8917ced7cdce480313476ddcf5ebf700fed92d0a347f1db96f47cb5378422d
MD5 e8192915d70fcb1107486e48b3b16a7a
SHA1 ec9d2eba81dbc631c907c6b0a3cbe55897f1325f
SHA512 86ad3eff31a22b31f1619d24469c41db0075bc5aa2590603a70b377766197589135bea53be1687b9f136eff4608529202da7b40de94e2342cda7ac6dd74a5a33
SSDEEP 384:AZyQSewDbPmRqcXx2kMPrd9cbkUmR08EMT6:AbtwnmR/xQdckUSEMT6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

10783

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/UACPage

SHA256 3c57e2caf4d4dea3d14fb7c544ed30ff177a55ea192337c49aa869288317c385
MD5 9f5a160f9d71cd1744c2a7c9524211a5
SHA1 74acd0b83bc9a442d877faed785c423b858fd836
SHA512 a4e63084bf5b1ccffd7dfbc1e5c28289929e0aa3308ce6ca33bb05ac0ee5ae2a512bb4b423c8b70d666aa5dde4f6eb031ad53d773288d73245537226c9d97b4d
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

1.dat

SHA256 2cb265544f04610f0e3d32bd6c66f57ffe422b328806706796c27c046aa2fd95
MD5 86e64a9df1333aa6d1c8c9c9d7f998e1
SHA1 dbd1e19275438bb5fb46e8cdad91487eeebe1ca5
SHA512 6acc33b95f0b71666f4178c5e30b8a6420748b74365b62063228be31c3143f7fd9f4fd913c9912cd7b6d743f7cdd51b088a2ef3b11812b7c22c8a41b8789a103
SSDEEP 12288:rBCgS7OdNJVFp+DZKCvDwMG92DUK39CERvbfL/J6M+iC54RnfqBiNb:rwn7O3fmfVzlFP/+ie4Rnui5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

2.dat

SHA256 598a74dd6880e1bfa7eb72805a67fa9805155d1c562cd6f3b1f46584902a6371
MD5 dad3d4d78130b65c1c114806d6b44f8f
SHA1 3a8cf5225502dca43fa9caaf89879f4e04e5039d
SHA512 21fc95a6253ff18131937676b48cd94c6b06bbe818f5f8435f81b3921c7577eead98516afd326717bbb4b757e31b03aac65bc8650a48c0ad978d4e2ad413d664
SSDEEP 768:635GFwqCHbDtNxuEFmaLwrv2Omw19XubpPQbg18CIl8Q5UcQ/H2ZJ/:akaqCHbop++RUpS64J1Q/k/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

3.dat

SHA256 f4efd2a1325ea0be13294392e759077bdcef31ea2e88486f7496c15833366b6f
MD5 c17c02c5e259fd0b0533791acc50b914
SHA1 3885d75cf6384b5407aba76c99b948da97cacacd
SHA512 2ed194a3caa777ca696fe3396959c454d71ef304383f71d6ebca9b8777f5ef18ba6d6650c9d5b5367cdbc908fe5dbc463fb1421169c111babf6d59bc5dd68264
SSDEEP 384:YLP89qEYQMeekeod3bJ/CPE3FaxHyc0nbpKebQ5OY0xqeY380LZ54dNLE:2U9qhcYPaFPcwgebvbuB/4vE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

5.dat

SHA256 0877cb33be8b67b7004c479d911159ceec405b346dd38894b8de6e2ec5412605
MD5 03de5fdf2b8a62124563166c743ba748
SHA1 537af3b05b040c0cf44d86f5926a225412715ef3
SHA512 d0c121a0023b985c5efc0a7d6ac1c94f4f86594c7d328eab6027f244fea7e6bf33e7cde79a481cad5bd8d0b75dcff8c11797937cf6d0d0f85ca3112879e3b24b
SSDEEP 3072:s5S72lj8IU7p386E2+6XC7q0TAD5OqRODyRKIdKnaRRA+Z98CgYwy8ATdvJmyWpg:YTCf+67sAQDDcFs3YDpvJmyWg75DEG5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

6.dat

SHA256 1062b621c9e6fb20b8293c4bc367ddde8cfba6082b847186fa346845329aef77
MD5 c16b129f5c6935db23de671421c1d980
SHA1 8633fcc613f719307776a7df7182cc8ac39defe1
SHA512 ca99f3aebbb47b2d9fb0c9d6d4da6036870c84da9a8904d9bd3791d89a9a026a37b1ceb409700e99e48efe44fa7af917a58ada8e26bf6654eed8d53ed623840c
MD5 SHA1 SHA512

NSIS installer

installer

7.dat

SHA256 a669212993f867c3705c15a77fa50de784c3e278ccab0e92160fd169fa7ce5dd
MD5 a1ecb8b50e7b9e7f587897fb66b95f3a
SHA1 8e353570699fc0b6b74fb38525d0f7474dcf445b
SHA512 19599ab59cacee7a184c9400bbbd9b885044c2988b90b5e79a4c996988a9c3fe9b4afbe50f3be7b5e32d7feb0cde33698837f8768b8f0f05d93af003caad0459
SSDEEP 192:Y5jTVF9YQ3EjelLuwmujjIiH9JrZmj/N5OI4Bb6ylFAFtvWvHO:Y5Ke5jjj9JVCN5ODbVjAFtvWvu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

8.dat

SHA256 ff5e6fe24a8e99de0b20be0f4f37bafc9936eaab36b665af7cb446d2ef07d002
MD5 a252c8be7bbc8beccde35503f8fd83ba
SHA1 c96e415b1294e08477a850b64241b93fd551561e
SHA512 9cb3f11539b0c3ed9e363f3b2cf44b70ced1e19568092f4ba3468b2143d38e6d869a3238b06bb674483c71cb075256827bbe97cb2736c3da75e041e6a2fa0db6
SSDEEP 384:YqJ1DjsZbD+huRFFP9l/BRmaujhp+hDb3y6Tkqznhrw2N2Mdaa+23hR0DEe7GARr:LjsAhwh5wb8R3BznZw2ok3jkES
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

9.dat

SHA256 db9c0510d205da00b594edd796d72daca42c69b097d3ddc5e4746daf7265372a
MD5 66f86c1dc16126a42e782df5f875a363
SHA1 5aa9a2ebf6c76481ea973fec4c660d5f324c88f5
SHA512 1ea821d7ddd04f95f580723144f3adc6dba2f36b118747fba0df40a5f36cb8916c5d23a7b20a134e1fab608b0032780151617993bb99f64aca7da57940d3d096
SSDEEP 24576:iILyprpPCWb8nd/i3zpx1+D0CU/2pVkDEiZCxgcF+TI:iIgrMWbid/swD0CU/2wZOIM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 625d52d73b2a00841751eb9bb106d91c74703b7f12e7a56c6950070190dc6e58
MD5 bd7e4a59e9c46c47a5442d271fd582ee
SHA1 7119ce221917e6f0791746a9ba5ee6df1ac87e01
SHA512 a9cf689dded2866e9bfdab34c5199c41db9498f46299919d9d68b4d5676317477c898308e674e06a5bbde5c3275a739b3a6a316ac93ca86bfabdea7636a2ae6f
SSDEEP 1536:wLXB65939tY6HBg4sXJJl73Gl1VhzDRE9U+idVe:wLk395hYXJ77YTve9WDe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

data

SHA256 ff1c96b7ce2606d750c05862c16a12629e1cddea42cc69fcae6e9f72b2353583
MD5 05c3adbe1891bcd4777248bcecf70a13
SHA1 311079c9e5297d51715d17ccf1a673dbb8a3b71f
SHA512 ab35e05d5156275b2a4edad8f756c0c98a4b65e9a550abbcd44b94d2e4a3d2075f8bbc450db5b4dd948176f7e74e48a452354afe9c699be8a261485661660c10
MD5 SHA1 SHA512

NSIS installer

installer

lzma.exe

IMPHASH 725d7c328da8b5c7989b84fbe16f738f
SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
MD5 1c4d758c0954e843d2fa22703f653421
SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

59404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer