internet-accelerator-2-0-3-90[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
internet-accelerator-2-0-3-90.exe
Size 1.6MB
Sample240224-sgathafb58
SHA256 65c8ea040d6ddcf7bf9520f5ec0c06cd655c2fee3ae6110f5df5a491604f9dc9
MD5 fcc67416a9fa9e4fe37f45809f261a65
SHA1 8551b2c62fdfeb13d599d4895c67ae5e7ddaccad
SHA512 f2be6621fcc829c39aa46d57fbae71e7cc6b96010a306d5d6328c5edb86b561eaa84bf7f1aebf6d58ee5f39d66750f71b5564ffad126378605193550970b5918
SSDEEP 49152:mfW9JsvAekMt4/tLOkzA1Q4gnXYcV4o2qP7MV:mu9JvK4/tX1XALqgV
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

File Explorer

internet-accelerator-2-0-3-90.exe

.exe 1.6MB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$PLUGINSDIR/NewsletterSubscription.ini

1KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
InternetAccelerator.chm

.chm 228KB
InternetAccelerator.exe

.exe 3.4MB
history.txt

2KB
license.txt

5KB
readme.txt

644B
uninstall.exe

.exe 50KB

internet-accelerator-2-0-3-90.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 65c8ea040d6ddcf7bf9520f5ec0c06cd655c2fee3ae6110f5df5a491604f9dc9
MD5 fcc67416a9fa9e4fe37f45809f261a65
SHA1 8551b2c62fdfeb13d599d4895c67ae5e7ddaccad
SHA512 f2be6621fcc829c39aa46d57fbae71e7cc6b96010a306d5d6328c5edb86b561eaa84bf7f1aebf6d58ee5f39d66750f71b5564ffad126378605193550970b5918
SSDEEP 49152:mfW9JsvAekMt4/tLOkzA1Q4gnXYcV4o2qP7MV:mu9JvK4/tX1XALqgV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ca:ec:a4:65:59:da:9a:73:75:7c:74:08:7c:eb:0f:59:e8:78:10:30

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pointstone Software\, LLC,O=Pointstone Software\, LLC,POSTALCODE=19713,STREET=2915 Ogletown Road\, #342,L=Newark,ST=DE,C=US

Chains

May 20, 2014

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

InternetAccelerator.exe

IMPHASH e868e2c330c388b5bd2d1fffccd4996e
SHA256 f85e986a06408c426e35d3c409c8237d7af7b2fe33a19530ce10d425e5ffa220
MD5 c2b03e5361d445a94fd211f61402a2e3
SHA1 6530392d53d9ecf4ee349269316c335a22821530
SHA512 c4ea707a3cd1901279950e7af7342d36e08d0c62e547cc038fd146185853b22b8c34387b1060c098d7fed979226fcb958d4154fccabd8358266a17d732fb3a88
SSDEEP 49152:DMfU+3wt2Wp4J+SYeWGq9UJRKBO4O7bevclTAnxt4vEio98ZDn:Gwt2Wmw9UJRExOWkzb
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

81:d2:ab:67:13:74:3f:c6:92:22:6f:ce:d2:3d:46:03:31:d8:48:de

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pointstone Software\, LLC,O=Pointstone Software\, LLC,POSTALCODE=19713,STREET=2915 Ogletown Road\, #342,L=Newark,ST=DE,C=US

Chains

May 20, 2014

Minor OS version

Major OS version

Entry point

2756432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayGetElement SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopyInd VariantCopy VariantClear VariantInit GetErrorInfo GetActiveObject SysFreeString

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey SetSecurityDescriptorSacl SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl RegSetValueExA RegSetValueExW RegQueryValueExA RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExA RegOpenKeyExW RegFlushKey RegEnumKeyExW RegDeleteValueA RegDeleteValueW RegCreateKeyExA RegCreateKeyExW RegCloseKey OpenThreadToken OpenProcessToken LookupPrivilegeValueW LookupAccountSidW IsValidSid IsValidSecurityDescriptor IsValidAcl InitializeSecurityDescriptor InitializeAcl GetUserNameA GetUserNameW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority GetSidIdentifierAuthority GetLengthSid FreeSid AllocateAndInitializeSid AddAccessAllowedAce StartServiceW QueryServiceStatus OpenServiceW OpenSCManagerW CloseServiceHandle

user32

MessageBoxA CharNextW LoadStringW SetClassLongW GetClassLongW SetWindowLongW GetWindowLongW CreateWindowExA CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups ShowCaret SetWindowRgn SetWindowsHookExW SetWindowTextA SetWindowTextW SetWindowPos SetWindowPlacement SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetCapture SetActiveWindow SendNotifyMessageW SendMessageTimeoutA SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassA RegisterClassW RedrawWindow PtInRect PostThreadMessageA PostThreadMessageW PostQuitMessage PostMessageA PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxA MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LockWindowUpdate LoadStringW LoadKeyboardLayoutW LoadImageA LoadImageW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsClipboardFormatAvailable IsChild IsCharAlphaNumericW InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect HideCaret GetWindowThreadProcessId GetWindowTextA GetWindowTextW GetWindowRect GetWindowPlacement GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetScrollBarInfo GetPropW GetParent GetWindow GetMessageTime GetMessagePos GetMessageExtraInfo GetMessageA GetMessageW GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDoubleClickTime GetDlgCtrlID GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassNameA GetClassNameW GetClassInfoExW GetClassInfoW GetCapture GetAsyncKeyState GetActiveWindow FrameRect FindWindowExW FindWindowA FindWindowW FillRect ExitWindowsEx EqualRect EnumWindows EnumThreadWindows EnumClipboardFormats EnumChildWindows EndPaint EndMenu EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextA DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcA DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CountClipboardFormats CopyImage CloseClipboard ClientToScreen ChildWindowFromPoint CheckMenuItem CharUpperBuffW CharUpperW CharNextW CharLowerBuffW CharLowerW CallWindowProcA CallWindowProcW CallNextHookEx BringWindowToTop BeginPaint AttachThreadInput CharLowerBuffA CharUpperBuffA AdjustWindowRectEx ActivateKeyboardLayout EnumDisplayMonitors GetMonitorInfoW MonitorFromPoint MonitorFromWindow

kernel32

Sleep VirtualFree VirtualAlloc lstrlenW lstrcpynW VirtualQuery QueryPerformanceCounter GetTickCount GetSystemInfo GetVersion CompareStringW IsDBCSLeadByteEx IsValidLocale SetThreadLocale GetSystemDefaultUILanguage GetUserDefaultUILanguage GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar GetConsoleOutputCP GetConsoleCP GetACP LoadLibraryExW GetStartupInfoW GetProcAddress GetModuleHandleW GetModuleFileNameW GetCommandLineW FreeLibrary GetLastError UnhandledExceptionFilter RtlUnwind RaiseException ExitProcess ExitThread SwitchToThread GetCurrentThreadId CreateThread DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection FindFirstFileW FindClose WriteFile SetFilePointer SetEndOfFile ReadFile GetFileType GetFileSize CreateFileW GetStdHandle CloseHandle GetProcAddress RaiseException LoadLibraryA GetLastError TlsSetValue TlsGetValue LocalFree LocalAlloc GetModuleHandleW FreeLibrary lstrlenW lstrcmpiW lstrcmpA lstrcmpW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualProtect VirtualFree VirtualAlloc UnmapViewOfFile TerminateThread TerminateProcess SystemTimeToFileTime SwitchToThread SuspendThread Sleep SizeofResource SetUnhandledExceptionFilter SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetFileAttributesA SetFileAttributesW SetEvent SetErrorMode SetEndOfFile SearchPathW ResumeThread ResetEvent RemoveDirectoryA RemoveDirectoryW ReleaseMutex ReadProcessMemory ReadFile RaiseException QueryPerformanceFrequency QueryPerformanceCounter OpenProcess OpenFileMappingA OpenFileMappingW MulDiv MapViewOfFile LockResource LocalSize LocalFree LocalAlloc LoadResource LoadLibraryExA LoadLibraryA LoadLibraryW LeaveCriticalSection IsValidLocale InitializeCriticalSection HeapFree HeapDestroy HeapCreate HeapAlloc GlobalUnlock GlobalSize GlobalMemoryStatus GlobalHandle GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetWindowsDirectoryA GetVersionExA GetVersionExW GetVersion GetUserDefaultLCID GetTickCount GetThreadPriority GetThreadLocale GetThreadContext GetTempPathA GetTempPathW GetSystemTime GetSystemInfo GetStringTypeExA GetStringTypeExW GetStdHandle GetProcAddress GetModuleHandleA GetModuleHandleW GetModuleFileNameA GetModuleFileNameW GetLocaleInfoA GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileTime GetFileSize GetFileAttributesA GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceA GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCurrentDirectoryA GetCurrentDirectoryW GetComputerNameA GetComputerNameW GetCommandLineA GetCommandLineW GetCPInfoExW GetCPInfo GetACP FreeResource InterlockedIncrement InterlockedExchange InterlockedDecrement InterlockedCompareExchange FreeLibrary FormatMessageA FormatMessageW FlushInstructionCache FindResourceA FindResourceW FindNextFileA FindNextFileW FindFirstFileA FindFirstFileW FindClose FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime ExpandEnvironmentStringsA ExpandEnvironmentStringsW ExitThread ExitProcess EnumSystemLocalesW EnumCalendarInfoW EnterCriticalSection DuplicateHandle DeleteFileA DeleteFileW DeleteCriticalSection CreateThread CreateProcessA CreateProcessW CreatePipe CreateMutexA CreateMutexW CreateFileMappingA CreateFileMappingW CreateFileA CreateFileW CreateEventA CreateEventW CreateDirectoryA CreateDirectoryW CopyFileA CopyFileW CompareStringA CompareStringW CloseHandle Beep Sleep GetVersionExW RtlUnwind

gdi32

UnrealizeObject TextOutA TextOutW StretchDIBits StretchBlt StartPage StartDocA StartDocW SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetMapMode SetEnhMetaFileBits SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SelectClipRgn SaveDC RoundRect RestoreDC ResizePalette Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt MoveToEx MaskBlt LineTo LPtoDP IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextFaceA GetTextExtentPointW GetTextExtentPoint32A GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetNearestPaletteIndex GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits GdiFlush FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontFamiliesExW EndPage EndDoc Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgnIndirect CreateRectRgn CreatePenIndirect CreatePen CreatePalette CreateHalftonePalette CreateFontIndirectW CreateFontA CreateFontW CreateEnhMetaFileW CreateDIBitmap CreateDIBSection CreateDCW CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW CombineRgn CloseEnhMetaFile Chord BitBlt ArcTo Arc AngleArc

version

VerQueryValueA VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoA GetFileVersionInfoW

ole32

CreateStreamOnHGlobal IsAccelerator OleDraw OleSetMenuDescriptor OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc ProgIDFromCLSID StringFromCLSID CoCreateInstance CoGetClassObject CoUninitialize CoInitialize IsEqualGUID

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_GetIcon ImageList_Remove ImageList_DrawEx ImageList_Replace ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create InitCommonControls

msvcrt

memset memcpy

shell32

ShellExecuteExA ShellExecuteA ShellExecuteW Shell_NotifyIconW SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetMalloc

comdlg32

PrintDlgW GetSaveFileNameA GetSaveFileNameW

wsock32

WSACleanup WSAStartup WSAGetLastError gethostbyname socket setsockopt sendto send select recvfrom recv ioctlsocket inet_addr htons connect closesocket bind

winmm

timeGetTime timeEndPeriod timeBeginPeriod

hhctrl.ocx

HtmlHelpA

Name

.text

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

672KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

90B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

704KB

Virtual Size

704KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b135c4466d6f78ee317a6bbdb67d6d232a8dc573755df474f52647a94b082f35
MD5 8e5d387232f6b06ed27f49132cb9ea95
SHA1 3aad6bbf5a5ce5df6522a4a85a25374d908f59ee
SHA512 09fc5223e5e27a6558e1198c2b710c1836ce7b1e31e218af75098e2056a6d1240248244eb3856b7fc899415a2a2c3feb6c8ae70e45d6366f52df123459dc5fd7
SSDEEP 768:C4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJsMzNZyIX+W76:tLXB65939tY6HBg4sXJsMNZyRY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

76:4f:91:42:5d:bb:f6:67:41:9d:8c:ba:43:f7:bd:bc:95:48:85:b6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pointstone Software\, LLC,O=Pointstone Software\, LLC,POSTALCODE=19713,STREET=2915 Ogletown Road\, #342,L=Newark,ST=DE,C=US

Chains

May 20, 2014

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

internet-accelerator-2-0-3-90.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/NewsletterSubscription.ini

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

InternetAccelerator.chm

InternetAccelerator.exe

PE Signature issue

oleaut32

advapi32

user32

kernel32

gdi32

version

ole32

comctl32

msvcrt

shell32

comdlg32

wsock32

winmm

hhctrl.ocx

generic

history.txt

license.txt

readme.txt

uninstall.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic