97a77c8e8daa0ad6717a99f95acfb160[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
97a77c8e8daa0ad6717a99f95acfb160.bin
Size 449KB
Sample240214-clyhcsfe95
SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
MD5 97a77c8e8daa0ad6717a99f95acfb160
SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/newadvsplash.dll
unpack001/$PLUGINSDIR/nsProcess.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

97a77c8e8daa0ad6717a99f95acfb160.bin

.exe 449KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/newadvsplash.dll

.dll 8KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
$PLUGINSDIR/splash.jpg

.jpg 631B
$TEMP/~nsis/c3a007/mineeonad.dll

.dll 577KB
$WINDIR/System32/midiasvc.exe

.exe 85KB
mine_uins.dat.nsis

13KB
mineeo.dl_

.dll 121KB
mineeo.dll

.dll 121KB
mineeonad.dl_

.dll 577KB
mineeonad.dll

.dll 577KB
mineeosvc.ex_

.exe 105KB
mineeosvc.exe

.exe 105KB
minerun.ex_

.exe 129KB
minerun.exe

.exe 129KB
uninst.exe.nsis

13KB

97a77c8e8daa0ad6717a99f95acfb160.bin

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 736427aef8c7e3d5be491726979c14871de1039dc7b161299e5917c6aac51cfa
MD5 97a77c8e8daa0ad6717a99f95acfb160
SHA1 ca5f8b285cfd56d4b43e06f187a75b867f1caa33
SHA512 efcd57f74697b46c8c55686ef09e866e97eab748b47b6454d305fb547f27fa315f0d535e8f326df33f4eb15a9bdd35893ee4c6701cec1507fdb903e295070383
SSDEEP 12288:qC1x/d6lwKsVqBwDFS7HKAXKZwACaewbt:XFd6Kn5Jt0eJrdt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/newadvsplash.dll

IMPHASH 2e363db44011ed76701ec6ce62db36f5
SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
MD5 7ee14dff57fb6e6c644b318d16768f4c
SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
MD5 8f4ac52cb2f7143f29f114add12452ad
SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/~nsis/c3a007/mineeonad.dll

IMPHASH ed63a0ce384686ef380ce0e22737e951
SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
MD5 ec10d3888f7907ee3dffc5f883d84196
SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

309729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord4998 ord2514 ord6052 ord1775 ord5280 ord4425 ord3597 ord785 ord641 ord518 ord324 ord4234 ord6199 ord6215 ord6197 ord4284 ord4710 ord5594 ord2614 ord4224 ord913 ord5710 ord2763 ord6283 ord3646 ord397 ord699 ord3438 ord4188 ord912 ord5593 ord6663 ord4278 ord6282 ord3706 ord3626 ord2414 ord1641 ord2859 ord4376 ord4853 ord3361 ord326 ord2167 ord5232 ord2393 ord3797 ord2147 ord1180 ord268 ord1568 ord5268 ord1229 ord1175 ord1567 ord2917 ord1979 ord2803 ord958 ord6312 ord4177 ord6385 ord5442 ord3318 ord6010 ord5773 ord2601 ord3180 ord3183 ord3176 ord3507 ord3614 ord665 ord354 ord5208 ord5186 ord6264 ord5651 ord543 ord3616 ord350 ord3126 ord3613 ord3610 ord656 ord2784 ord5265 ord3402 ord4396 ord3574 ord609 ord6880 ord2575 ord5631 ord1776 ord1572 ord1622 ord551 ord6778 ord536 ord3790 ord3337 ord690 ord1988 ord5207 ord389 ord5356 ord6059 ord6869 ord861 ord3178 ord4204 ord1158 ord3310 ord3304 ord3010 ord6140 ord640 ord323 ord2405 ord6021 ord3571 ord1640 ord5785 ord795 ord765 ord2302 ord1768 ord6380 ord2688 ord6605 ord2754 ord6379 ord5875 ord4476 ord3721 ord3698 ord2135 ord1949 ord4034 ord3584 ord2107 ord6383 ord5440 ord2841 ord6394 ord5450 ord3663 ord398 ord6143 ord5632 ord3439 ord700 ord6883 ord2764 ord341 ord654 ord922 ord5645 ord535 ord413 ord4168 ord858 ord537 ord6302 ord711 ord924 ord2818 ord356 ord2770 ord2781 ord4058 ord3181 ord857 ord6876 ord940 ord939 ord6779 ord4189 ord941 ord6467 ord1200 ord2725 ord1232 ord1247 ord1199 ord1134 ord815 ord561 ord3738 ord4622 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord5861 ord5858 ord860 ord5683 ord4129 ord4277 ord2379 ord6453 ord4275 ord818 ord567 ord3742 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5290 ord4353 ord6374 ord5163 ord2385 ord5241 ord465 ord4407 ord1116 ord1176 ord1575 ord1168 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord4078 ord6055 ord6662 ord803 ord4202 ord6877 ord1980 ord668 ord541 ord801 ord823 ord1105 ord3811 ord539 ord2864 ord2086 ord540 ord2915 ord5572 ord800 ord3127 ord825

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ sqrt sprintf strncmp malloc free atof isalnum tolower strtol qsort strtoul _purecall _except_handler3 memmove _ftol atol abs memcpy strstr strncpy strcat memset _mbsicmp _mbscmp atoi __CxxFrameHandler _CxxThrowException _strnicmp

kernel32

LocalFree SizeofResource GlobalAlloc GlobalLock GlobalUnlock MulDiv GetVersion GetFileAttributesA SetFileAttributesA CreateProcessA GetExitCodeProcess RemoveDirectoryA GetVersionExA QueryPerformanceFrequency QueryPerformanceCounter GetPrivateProfileSectionA GetPrivateProfileSectionNamesA GetFileAttributesExA GetShortPathNameA MoveFileA WideCharToMultiByte GetCurrentDirectoryA SetCurrentDirectoryA LoadLibraryA FreeLibrary OpenProcess VirtualAllocEx WriteProcessMemory CreateRemoteThread ReadProcessMemory VirtualFreeEx GetExitCodeThread GetLastError LockResource FindResourceA LoadResource FreeResource CreateDirectoryA GetTempPathA GetPrivateProfileIntA TerminateProcess SetFilePointer WriteFile ReadFile HeapFree GetProcessHeap HeapAlloc CreateFileA DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime InterlockedDecrement InterlockedIncrement GetCurrentThreadId OutputDebugStringA GetCurrentProcess DuplicateHandle TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar GetPrivateProfileStringA lstrcpyA lstrcatA GetCurrentProcessId GetTickCount WritePrivateProfileStringA lstrcmpiA Sleep DeleteFileA SetEvent ResetEvent ResumeThread ExpandEnvironmentStringsA WaitForSingleObject lstrlenA CloseHandle GetModuleHandleA GetModuleFileNameA CreateEventA GetProcAddress LocalAlloc

user32

GetClientRect LoadMenuA GetSubMenu TrackPopupMenu LoadCursorA SetCursor ClientToScreen GetParent ScreenToClient GetWindowRect GetSystemMetrics SetWindowPos GetDC ReleaseDC InvalidateRect LoadIconA ValidateRect PostMessageA GetFocus GetWindowThreadProcessId SetActiveWindow GetActiveWindow IsWindowEnabled GetClassNameA PtInRect keybd_event SetFocus GetWindowTextA SetWindowTextA SetClassLongA GetClassLongA wsprintfA RegisterWindowMessageA GetWindowLongA GetMonitorInfoA MonitorFromPoint wvsprintfA MessageBoxA EnableWindow GetClassInfoA GetDesktopWindow IsWindowVisible GetCursorPos PeekMessageA UpdateWindow SetTimer IsWindow SendMessageA EnumChildWindows SetWindowRgn KillTimer SetParent DispatchMessageA TranslateMessage LoadBitmapA CopyRect GetMessageA SetWindowLongA CallWindowProcA FindWindowExA

gdi32

GetStockObject GetObjectA GetMapMode CreateRectRgn CreateRoundRectRgn CombineRgn EnumFontFamiliesA StretchBlt BitBlt GetDeviceCaps CreateBitmap CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetOpenFileNameA

advapi32

SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl AllocateAndInitializeSid RegQueryInfoKeyA RegSetKeySecurity CloseServiceHandle QueryServiceStatus OpenServiceA OpenSCManagerA QueryServiceConfigA RegQueryValueExA RegOpenKeyA RegQueryValueA RegEnumKeyA FreeSid RegGetKeySecurity GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken GetTokenInformation GetLengthSid CopySid RegDeleteKeyA RegDeleteValueA RegSetValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegCloseKey

shell32

ord680 SHGetDesktopFolder SHGetSpecialFolderPathA SHGetFileInfoA

ole32

OleInitialize CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SysFreeString SysAllocStringLen VariantClear SysAllocString SafeArrayDestroy SafeArrayGetElement

urlmon

URLDownloadToCacheFileA

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

wininet

InternetSetCookieA InternetCrackUrlA InternetGetCookieA InternetReadFile FindFirstUrlCacheEntryA DeleteUrlCacheEntry FindNextUrlCacheEntryA FindCloseUrlCache InternetOpenA InternetSetOptionA HttpSendRequestA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA InternetCloseHandle

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22 ord23 ord20

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmNotifyIME

shlwapi

SHDeleteKeyA

psapi

GetModuleFileNameExA

Name

.text

Size

328KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED_M

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$WINDIR/System32/midiasvc.exe

IMPHASH 865a4699dc989a6c4020da5d4bc37278
SHA256 7e864083928b1574a3cdad0827653fb91eaf96acb0b32445ed4725c8ee3d7059
MD5 e47777c0038db4950a72da594518b328
SHA1 7f858c3161d020d0c500fbb29a0f2d38cb93d44c
SHA512 4d6d02415afff4a2ceb229e3181dcd3fc7df89a99a3b6c7c0addb9f5265c03c1b3f0231f3b6d1c29c7e529ddfee83ab8e6f6a3e3e7eef838de5c42fbed60988a
SSDEEP 1536:TkriKIIIgLMYHoAtSXG4FkgrExEJHmLtzZnLr4:TkWKBIAHoOaFkjEJGLthLc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

25988

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcessId GetCurrentThreadId GetShortPathNameA CreateProcessA GetVersionExA GetProcAddress GetModuleHandleA ExpandEnvironmentStringsA GetFileAttributesExA OutputDebugStringA FileTimeToLocalFileTime SetFilePointer CreateDirectoryA GetLocalTime FreeLibrary LoadLibraryA SetEnvironmentVariableA CompareStringW CompareStringA lstrcatA DeleteFileA CreateFileA WriteFile MoveFileA GetPrivateProfileStringA ResetEvent CloseHandle GetTickCount Sleep GetLastError SetEvent lstrcpyA GetModuleFileNameA CreateEventA CreateThread WaitForSingleObject TerminateThread lstrcmpiA FileTimeToSystemTime lstrlenA FlushFileBuffers SetStdHandle SetConsoleCtrlHandler GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW ExitProcess TerminateProcess GetCurrentProcess RtlUnwind GetTimeZoneInformation GetSystemTime HeapFree HeapAlloc GetStartupInfoA GetCommandLineA GetVersion HeapReAlloc HeapSize GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr WideCharToMultiByte MultiByteToWideChar LCMapStringA LCMapStringW UnhandledExceptionFilter FreeEnvironmentStringsA

user32

wvsprintfA wsprintfA

advapi32

RegEnumKeyA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegSetValueExA RegCloseKey SetServiceStatus RegisterServiceCtrlHandlerA EnumServicesStatusA StartServiceA OpenServiceA QueryServiceStatus ControlService DeleteService OpenSCManagerA CreateServiceA ChangeServiceConfig2A CloseServiceHandle StartServiceCtrlDispatcherA RegOpenKeyExA

shell32

SHGetFileInfoA ShellExecuteA

wininet

HttpQueryInfoA InternetSetOptionA InternetOpenA InternetReadFile InternetCloseHandle InternetOpenUrlA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

shlwapi

SHDeleteKeyA SHDeleteValueA

mineeo.dl_

IMPHASH 3349570131fbaa69ef5ccbf0c5cb1ade
SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

40841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetShortPathNameA GetModuleHandleA MultiByteToWideChar lstrlenW SizeofResource LoadResource FindResourceA LoadLibraryExA lstrcpynA WideCharToMultiByte HeapDestroy CloseHandle ReleaseMutex WaitForSingleObject CreateMutexA CompareStringW CompareStringA GetLocaleInfoW GetTimeZoneInformation SetConsoleCtrlHandler GetOEMCP GetACP GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA GetProcAddress GetCurrentThreadId GetCurrentProcessId lstrcatA OutputDebugStringA lstrlenA lstrcmpiA lstrcpyA GetCurrentDirectoryA GetModuleFileNameA SetCurrentDirectoryA LoadLibraryA GetLastError IsDBCSLeadByte FreeLibrary IsValidCodePage IsValidLocale GetCPInfo SetEnvironmentVariableA GetStringTypeW GetStringTypeA UnhandledExceptionFilter IsBadCodePtr IsBadReadPtr WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA RtlUnwind RaiseException HeapFree HeapReAlloc HeapAlloc GetCommandLineA GetVersion ExitProcess FatalAppExitA TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread SetUnhandledExceptionFilter Sleep LCMapStringA LCMapStringW GetEnvironmentVariableA GetVersionExA HeapCreate VirtualFree VirtualAlloc IsBadWritePtr TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle GetFileType

user32

wsprintfA DefWindowProcA wvsprintfA SetWindowLongA PostMessageA MessageBoxA CharNextA CallWindowProcA GetWindowLongA

advapi32

RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegDeleteValueA RegDeleteKeyA RegQueryValueA RegOpenKeyA RegQueryValueExA RegSetValueA RegCreateKeyA RegSetValueExA RegCloseKey RegEnumValueA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance

oleaut32

VariantCopy SysStringLen LoadRegTypeLi RegisterTypeLi SysAllocString LoadTypeLi VarUI4FromStr VariantClear SysFreeString

mineeo.dll

IMPHASH 3349570131fbaa69ef5ccbf0c5cb1ade
SHA256 b9eacbc9112e1b97017b7e1b5213f1bc20b56bfbfdcd6898315b76bd56d72834
MD5 c7cff0342d39a8b13fa47c7c8d5f5cbf
SHA1 6b86fb16a10be1c8b5ae6111407cd3085a0c5660
SHA512 9a80098bda278ccae5ca9958e6a8c2bfd5f27995f66b7b8b2a06212c9942cebb5363f97f4ac8cbc90ba246586d39e8679c918ddc953e990e0a7dc284f81d5e34
SSDEEP 3072:c20bUZLSzWRtfU3tOA3wO4aeqtBG+EctaS:c9AAz45UsAbeN+NaS
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

40841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

user32

wsprintfA DefWindowProcA wvsprintfA SetWindowLongA PostMessageA MessageBoxA CharNextA CallWindowProcA GetWindowLongA

advapi32

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance

oleaut32

VariantCopy SysStringLen LoadRegTypeLi RegisterTypeLi SysAllocString LoadTypeLi VarUI4FromStr VariantClear SysFreeString

mineeonad.dl_

IMPHASH ed63a0ce384686ef380ce0e22737e951
SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
MD5 ec10d3888f7907ee3dffc5f883d84196
SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

309729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

msvcrt

kernel32

user32

gdi32

GetStockObject GetObjectA GetMapMode CreateRectRgn CreateRoundRectRgn CombineRgn EnumFontFamiliesA StretchBlt BitBlt GetDeviceCaps CreateBitmap CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetOpenFileNameA

advapi32

shell32

ord680 SHGetDesktopFolder SHGetSpecialFolderPathA SHGetFileInfoA

ole32

OleInitialize CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SysFreeString SysAllocStringLen VariantClear SysAllocString SafeArrayDestroy SafeArrayGetElement

urlmon

URLDownloadToCacheFileA

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

wininet

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22 ord23 ord20

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmNotifyIME

shlwapi

SHDeleteKeyA

psapi

GetModuleFileNameExA

Name

.text

Size

328KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED_M

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mineeonad.dll

IMPHASH ed63a0ce384686ef380ce0e22737e951
SHA256 90ff193e18999ce0dc26f60f5f9eb98cccf108df0368e52c98a4e785eb36d04b
MD5 ec10d3888f7907ee3dffc5f883d84196
SHA1 ead1d6ce6a6f11941b76f8bb757582794792d7eb
SHA512 6d71d59db07c7beffd6944f5724c1391294cfe2ffc7b7308039e2c454bd3ce6151b3845be0261ad3da15db508021d962ea481c67b09abd5f4028535c8cf170f1
SSDEEP 12288:YVwyLUcuggMcrNqa1wkFaOqpav/cEVFpmYtYhoWXntL:sPurbwkFa5kD/pmYtYhoWXntL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

309729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

msvcrt

kernel32

user32

gdi32

GetStockObject GetObjectA GetMapMode CreateRectRgn CreateRoundRectRgn CombineRgn EnumFontFamiliesA StretchBlt BitBlt GetDeviceCaps CreateBitmap CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetOpenFileNameA

advapi32

shell32

ord680 SHGetDesktopFolder SHGetSpecialFolderPathA SHGetFileInfoA

ole32

OleInitialize CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SafeArrayGetUBound SafeArrayGetLBound SysFreeString SysAllocStringLen VariantClear SysAllocString SafeArrayDestroy SafeArrayGetElement

urlmon

URLDownloadToCacheFileA

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

wininet

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22 ord23 ord20

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmNotifyIME

shlwapi

SHDeleteKeyA

psapi

GetModuleFileNameExA

Name

.text

Size

328KB

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

44KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED_M

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

124KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mineeosvc.ex_

IMPHASH 632a36082eb3bccfc57ff488fbb1589c
SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
MD5 2b69deccb1730858b225c58f6437d64a
SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

37801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OutputDebugStringA GetCurrentProcessId GetCurrentThreadId MoveFileA WriteFile CreateFileA GetShortPathNameA CreateProcessA GetVersionExA GetProcAddress GetModuleHandleA ResetEvent GetFileAttributesExA FileTimeToSystemTime FileTimeToLocalFileTime SetFilePointer CreateDirectoryA GetLocalTime LoadLibraryA SetEnvironmentVariableA CompareStringW CompareStringA ExpandEnvironmentStringsA LoadLibraryExA GetPrivateProfileIntA CopyFileA DeleteFileA FreeLibrary CloseHandle GetPrivateProfileStringA Sleep lstrcatA GetTickCount GetLastError SetEvent lstrcpyA GetModuleFileNameA lstrcmpiA CreateEventA CreateThread WaitForSingleObject lstrlenA TerminateThread GetTempPathA SetStdHandle SetConsoleCtrlHandler GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA ExitProcess TerminateProcess GetCurrentProcess RtlUnwind GetTimeZoneInformation GetSystemTime HeapFree HeapAlloc GetStartupInfoA GetCommandLineA GetVersion HeapReAlloc HeapSize WideCharToMultiByte GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr MultiByteToWideChar LCMapStringA LCMapStringW UnhandledExceptionFilter FlushFileBuffers

user32

wvsprintfA wsprintfA

advapi32

RegSetValueExA RegCreateKeyA SetServiceStatus RegisterServiceCtrlHandlerA RegOpenKeyExA RegEnumKeyA RegQueryValueA RegOpenKeyA RegQueryValueExA RegCloseKey StartServiceA QueryServiceStatus CreateServiceA ChangeServiceConfig2A StartServiceCtrlDispatcherA OpenSCManagerA EnumServicesStatusA OpenServiceA ControlService DeleteService CloseServiceHandle

shell32

SHGetFileInfoA ShellExecuteA

wininet

InternetReadFile HttpQueryInfoA InternetSetOptionA InternetOpenA InternetCloseHandle InternetOpenUrlA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

shlwapi

SHDeleteKeyA SHDeleteValueA

mineeosvc.exe

IMPHASH 632a36082eb3bccfc57ff488fbb1589c
SHA256 a7be80960f400b55533195f07c40e413e51542b4c0dade35d5a72988a36ab1d8
MD5 2b69deccb1730858b225c58f6437d64a
SHA1 ae92bd082409911dc21de122ec7bcefe22d4aaa9
SHA512 e61875b104982b8780c1e556f792328fae48aacdbf12e6fcb352c371efa2695106084f7ac30c339fcf53dedec513f59f0d96fc2be4c2b19aa0cbba9c700703a0
SSDEEP 1536:3iZb/FwJ3etrGhmxkMS29jENmMISOLKV35PawzZXhGJHM1tkloqkcn:ubDtrGhm2MxjUhtOoJP7zZXhGJs1tDcn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

37801

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

wvsprintfA wsprintfA

advapi32

shell32

SHGetFileInfoA ShellExecuteA

wininet

InternetReadFile HttpQueryInfoA InternetSetOptionA InternetOpenA InternetCloseHandle InternetOpenUrlA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

shlwapi

SHDeleteKeyA SHDeleteValueA

minerun.ex_

IMPHASH 4fd43891ef6b31f90b7c50305f05e318
SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
MD5 596199aebea31fbddb0044fdfb2e75ec
SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

13802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord815 ord2514 ord800 ord711 ord4168 ord413 ord2764 ord537 ord2621 ord1134 ord641 ord818 ord825 ord5265 ord4376 ord4853 ord4998 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord4465 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord6055 ord1776 ord5290 ord3402 ord567 ord2135 ord2302 ord4234 ord2645 ord860 ord4710 ord535 ord941 ord540 ord5572 ord2915 ord755 ord470 ord1168 ord2379 ord1146 ord1949 ord4034 ord823 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord3798 ord4673 ord1576

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit atoi _setmbcp __CxxFrameHandler _controlfp strcat _purecall memset _CxxThrowException

kernel32

GetLastError SetCurrentDirectoryA GetCurrentDirectoryA lstrcpyA lstrcmpiA OutputDebugStringA ExpandEnvironmentStringsA GetCurrentProcessId GetCurrentThreadId CreateProcessA GetModuleHandleA GetStartupInfoA GetModuleFileNameA lstrlenA LoadLibraryA lstrcatA FreeLibrary GetProcAddress

user32

GetClientRect EnableWindow LoadIconA wvsprintfA wsprintfA SendMessageA DrawIcon GetSystemMetrics IsWindow ShowWindow SetForegroundWindow IsIconic

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

urlmon

URLDownloadToCacheFileA

minerun.exe

IMPHASH 4fd43891ef6b31f90b7c50305f05e318
SHA256 bfac7a61df4335acfe677ca09fb1996bef63530a3867a81bfb2fceed5a123dc5
MD5 596199aebea31fbddb0044fdfb2e75ec
SHA1 00f1136ecfe4b5c7d8045f65e4ff4fd11959fd54
SHA512 52efc0b8a6890d93db74b1d3e77b0d21c1fe9c7e1300c440f49a3971b6914cd02722c9150559f882054f8c8e56e34627cef88852d626e9810bda22a96a8a3e7a
SSDEEP 1536:RYW/2vJd49J2uSF0/cyqcMYdLY3wy2vgcUZ:eW7B/cyqcMYorco
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

13802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

msvcrt

kernel32

user32

GetClientRect EnableWindow LoadIconA wvsprintfA wsprintfA SendMessageA DrawIcon GetSystemMetrics IsWindow ShowWindow SetForegroundWindow IsIconic

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

urlmon

URLDownloadToCacheFileA

Sharing

General

Malware Config

Signatures

File Explorer

97a77c8e8daa0ad6717a99f95acfb160.bin

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/newadvsplash.dll

kernel32

user32

gdi32

winmm

oleaut32

msvcrt

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$PLUGINSDIR/splash.jpg

$TEMP/~nsis/c3a007/mineeonad.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

olepro32

oleaut32

urlmon

rpcrt4

wininet

iphlpapi

version

dbghelp

cabinet

oleacc

imm32

shlwapi

psapi

generic

$WINDIR/System32/midiasvc.exe

PE Signature issue

kernel32

user32

advapi32

shell32

wininet

version

shlwapi

generic

mine_uins.dat.nsis

mineeo.dl_

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

generic

mineeo.dll

PE Signature issue

kernel32