VirusShare_4a9548854beab57f1606eb25d3f2244b

resource
VirusShare_4a9548854beab57f1606eb25d3f2244b
unpack001/$PLUGINSDIR/aminsis.dll
unpack001/ie/MediaWatchV1home2456.dll
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/aminsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 47a75b61d11baf1a55a3e5891a473af8bdb28c31d0517bb344428066d7793949
MD5 4a9548854beab57f1606eb25d3f2244b
SHA1 870d6f391bd60f7b1e6a02e74da3ff9cb8b37230
SHA512 664f0bfc53a2f95e39af8a2916b9111da3b3b9ba8f7aa1ee57b53283e39d24ef657cd08da85f6986ca53949d61213fce22ea4dcd6e0924b75222454111cdbf41
SSDEEP 12288:cr//vs/MG4GjeZHkwuPikQ7lKH5p5H9x18eZHkwuXi5QvlK75pnxWlfW:czvs/MG4GjeZEXi37l6Br18eZEviuvla
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

ch/MediaWatchV1home2456.crx

SHA256 5755121e08c84e1424296c73f056dc3213c3a57ff37a90a19165d61541395e9a
MD5 880c854e5c01cc7e3d3ffd8762ef776a
SHA1 0c7e0bb8703622ff0923189fb5c8f33a8f93c955
SHA512 d6206f5d0f71724716a1bff23ec24e551694e13d72fc1329a61fbcba3062aa2e9aafb9d20fd05dcf8ca7adc77d4d3a967ce3024d44e636b8db8a7cfea6d0a446
SSDEEP 768:aZo9rxtK4JZ+yeil+rxtK4JZ+yeilVrxtK4JZ+yeilTrxtK4JZ+yeilX:a8r28F9+r28F9Vr28F9Tr28F9X
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ffMediaWatchV1home2456chaction.js

SHA256 a2d8bcc31031423a5fc96c528bd6a4c008835e98957f7cba63cd66bda8457d54
MD5 76613e238e0faea88059734f3db096d4
SHA1 5be3d165505848e56af1f704b8ee58129cf4d5ff
SHA512 c8c415d72d4c8d37d3543612d7b577e4006bc8ce74f2f2b5dd3743ddf120213a3fd553a7379edd70b997ee12866f39daa100ceda1fc461a4c8f7c745dea48aee
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 2fe1191d00c167287e1f7cec5d7fda061f5b80ef36cb65b32ad5897fc8a70f80
MD5 2e0d7aa498d6f97b7d7200acfb63343e
SHA1 8e34e1a566294e4b59731d256802d0241ed5af52
SHA512 9ebb6f256d757e75d0b31e0422c027fb773f5a4d4622a6a9c0edcab67c8fd6a8dfe737165d1194316bff2ac4332a9d7096d787f556a7089d6e51a057e09399a3
SSDEEP 48:iNeg36/fhW3djOQA86QzQ7amfVRugeit5rqqY7hSZwO+pHaiqyr/yGtXn:iQwuWROQM7oghESZwOZiB2CXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2456_128.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2456_16.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2456_48.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/MediaWatchV1home2456_64.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 d205ef4a9df6f2866fbef43111ace8d639749c74e05dd4fb392de6038353a6b1
MD5 d5005dcda120938ecd4955240f1f5baf
SHA1 a8ed98c2ef55542114dd9cf57a1ad09690119964
SHA512 bf22d7058d2e0ad7cd52dcaac7b6ae027062f27c029a3bb4e05e08726767e05d2e467030d8e89de5964262102d3341fbb0821c9b0f8e95c9f726a59af4e646d6
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome.manifest

SHA256 1e627325d5610f8fd0b46514dc88679a368ba73ec05288796c48ca744f091008
MD5 616683206b99fb92457e00f0ea9a6fe4
SHA1 c1e389ab4bd496cba18bd3a9f29731dab6eb99bc
SHA512 5bd5e8d58e7c7e4480eb51cb478502f1f24bef56fb4e192693cba4a13e1cd393d8ee498829f84bdad6720cf33f69f9a3a92161c313f1a39acd5f597716ac9e38
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home2456.js

SHA256 9eecc19833a1b333f72bc0393db717465f4aeb83e73fe2a93272f67bdb2e4383
MD5 ecf28aa796d03221d2847c0bb38b91f9
SHA1 f36dcd3a96a1da765dcf0470501ca3caaefc29be
SHA512 ef3218e00eecee79489b080ab0feb83b21f96e2c29b3bed9d69f69990dd57c34d3c7152465dc13e17f56ea14bfc3b9836304e742771b993ef6cbb7e8d7cd0a70
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/ffMediaWatchV1home2456ffaction.js

SHA256 0decc8facba845c0f1c55afcec443061e5c3a62bc7712a7b4f3603756413ae0d
MD5 3e97860649f7e2cbfefcbd83e49d7514
SHA1 0fa6c03c67a1e4b34bea98ce8a6176f2e6e15b43
SHA512 9494ff8db930d1c5f3efc8ffdb3d52b35315c006a239f7933ed7e87a1a57dcdb2be761933d4b76ac801bf3fd94c57f15bf68236cd8870cb1a65272bc78d5abff
MD5 SHA1 SHA512

NSIS installer

installer

ff/chrome/content/icons/Thumbs.db

SHA256 6678b6ae375d6db902a28bae897ab7d414ff4d6c7f4cad0c2facb3a481906cd5
MD5 c0c9dfdb30633083855e656945723c31
SHA1 4262e1fbe1fd019b1e4751cd66fc9aafd8aee7c6
SHA512 083d0fcaf038c4ecdd5eca46ff826bf1b3d170fd193cf04738a717f737b7b32db907e564eba5ec6306f22ba15e39303aee07b94e8eaeafd4ae02a8dc89f7cbce
SSDEEP 768:AlhlqldCcqR73ZQ7PCLa8eDfucT0C3i7uag6+DwDGTV+17rMh25xiYfuRvq:AlhlqldCVpQZ8ez3/aqUoVoQyitvq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/icons/default/MediaWatchV1home2456_32.png

SHA256 4f3b7a94a8d381797e0b7c69a9cffbd25dab7e28701e5127aeb387064db693cb
MD5 2ee5ba0ce9fafad832af679a1c4ff14c
SHA1 bd46d6445d80c5d5da82e674b092f29d94944be5
SHA512 d069e27a2a9f03309a0954dbd9f633fdda0060aaa4384f952a66ccc504a0ecd4451f713caaab55dcbc73e18c0fe88e261c8fbb85ef0acf76184faf15e63a1995
SSDEEP 192:pGmYipbnvU6GxjxdrAHjzi93sBAy/J3J++Yr8IxiXV3:pGmYixvU6GVky98lJZ++Yr8IxiXV3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ff/chrome/content/overlay.xul

SHA256 2d9881a570cf670503705e9de6a349bc0b2735f78d20985357765f2dca8f82b8
MD5 c8b18a42b49336b7bbff7e87894b4846
SHA1 a7bddac16aaea0a8c414d4733e54cab9a53b6f7f
SHA512 b4c55eeee81183e649211b0aa33608991d7832613b19ba6a3e5f4eed3e4c29a435a60e57e52ae5d900ef2395348174101c22441e870c1d66d8626fec546c4b38
MD5 SHA1 SHA512

NSIS installer

installer

ff/install.rdf

SHA256 acbe21e9a9fc34ed7feadb2ac0d78eeb3b5cc7a373c9d4b1c8aee6f0d4e39131
MD5 c72f097ccbc45e3a0d6cc7a803b2b6e3
SHA1 fb224a513eba40e74c241c85b67e2d9abf3a768b
SHA512 09d23fdfa7d20fa1feb12da883e6d6ab07123ecc4810275a8754cde2325c786443b84a1b4c22f6607600d0b37ed55be295dd89e5f3a0cf60774c5298f96d9776
MD5 SHA1 SHA512

NSIS installer

installer

ie/MediaWatchV1home2456.dll

IMPHASH 677bdd33d37480d06c21761ab2b6e1b1
SHA256 58c627b2b717c57599b2d222d5dd83485bff5f9593063623f6e12bbc10e51957
MD5 51e35bccbf8769800aa1c4f73fe6dd06
SHA1 498e4637a5009af71ccce5d0aac7dcb9c6cadd1c
SHA512 773ea82ba1b1d873cf6ecb6a3130f8e05293358704505fdf4b922c919eb26a02ce53138a93515f3e9ab8af0549c2dacea0bda93ff02b1d39e928822faa67e29f
SSDEEP 1536:c8/1CsEmka04RhRtahrOb8DkhyWHA9glQANh5:H12mka0ElahrO2WguaANh
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW GetThreadLocale InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException SetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount Sleep HeapAlloc HeapFree RtlUnwind DecodePointer EncodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

LoadRegTypeLi DispCallFunc VariantClear VariantInit SysAllocStringLen VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 3f370c8baa04fbe140ed5d2ce3ae7435afcce5b32467e826c05c1b809d292e62
MD5 8e7dd503868dc80b8c749182faa71554
SHA1 a2b21f488cfddc870e8d9a4f8fb48e61d7d883e4
SHA512 21708cd9f9f4d2e94363fadc18aff0086ce5c4ba59d52a290711d4b76d9d755de822d3fc85f554a3d71639a09bc67bdf124d3e6a92eb226f1154b99bf52c3b42
SSDEEP 6144:Ee347speZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1e:aweZHkwuPikQ7lKH5p5H9x1e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/aminsis.dll

IMPHASH 04d94109ba83f5729fa1164fb7aa7d74
SHA256 b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
MD5 51ba1095f0ae45a2d444bea506cb9ad4
SHA1 038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA512 f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
SSDEEP 12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

216690

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

TerminateProcess GlobalFree Process32FirstW Process32NextW CreateToolhelp32Snapshot CloseHandle CreateProcessW SetEnvironmentVariableW CreateDirectoryW WaitForSingleObject CopyFileW Sleep GetModuleFileNameW lstrlenW FindNextFileW DeleteFileW LocalFree lstrcpyW SetStdHandle CreateFileW HeapReAlloc IsValidLocale EnumSystemLocalesA ExpandEnvironmentStringsW FindClose GetPrivateProfileIntW WritePrivateProfileStringW MultiByteToWideChar GetPrivateProfileStringW lstrlenA FindFirstFileW GetProcAddress LoadLibraryW GetModuleHandleW GetCurrentProcess FreeLibrary ReadFile OutputDebugStringA DeleteCriticalSection GetVersionExW InitializeCriticalSection GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter LoadLibraryA GetStringTypeExW GetProcessHeap SetEndOfFile GetEnvironmentStringsW WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection GetLastError HeapFree HeapAlloc GetCPInfo GetCurrentThreadId GetCommandLineA RaiseException RtlUnwind LCMapStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapSize ExitProcess InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW HeapCreate HeapDestroy WriteFile SetFilePointer GetConsoleCP GetConsoleMode FlushFileBuffers TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetLocaleInfoW GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW WriteConsoleW

user32

MessageBoxW CreateDesktopW wsprintfA CloseDesktop wsprintfW LoadStringW

advapi32

RegDeleteValueW RegSetValueExW ConvertSidToStringSidW SetSecurityInfo GetSecurityInfo GetAce RegCreateKeyExW GetAclInformation GetTokenInformation DeleteAce OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey RegEnumValueW

shell32

SHFileOperationW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer