af70fcf0d4032564a34f82a4cda2ae87

resource
af70fcf0d4032564a34f82a4cda2ae87
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1

IMPHASH dd1742eadfc6df18ded3c26ae64ad610
SHA256 108e554f9a900d232f2156033cd9339f1316843befbeaf809f3bdb9186b6970e
MD5 af70fcf0d4032564a34f82a4cda2ae87
SHA1 ee316a23ecbb38933e0900da3f6db73470f664f5
SHA512 7715435ec4872a1fb2beec46eedf10cf37ffef6a0cb9a5c07956e6636b5f19e34b3597befe8f5cf98c2ae1e0ca5488fca88f3fe2349fa8a9e5214ed26d3c5366
SSDEEP 3072:JP24nrk3mmJ+4o4W4IeooDto6djDcOIjNE+y78Z+C6Pr+HFkYI:JbUo4W4Iey2oNi78ZR6PyHFLI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12641

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA CloseHandle GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA ExitProcess

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Name

.text

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1024B

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.trdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$0

SHA256 f558ff347fa55ffe8b2785069b42a15baa74c01a44e86f40842cd44ca5373a48
MD5 2d5f513b66bc27780f83471879b993ba
SHA1 1fdbc7e6f85b3c871d07d43041ba37275143b430
SHA512 9298de03d075e79fe159dc537254b3426c2133c732f58f2f5a5e5bf5d2ada3097eff4043075815e19b9cf9c40f1248dbae7e4528b452b165279820dfc1af714d
MD5 SHA1 SHA512

NSIS installer

installer

$1

SHA256 4e3a2c085465e511adb987e74e8e7d3bbb2b882225040ca8aae06cea6315c34b
MD5 1cd72143e7bcb3e019dd69ab4c867f6b
SHA1 3326e949b6f7a4b7663d52732c71e8be0de78384
SHA512 5f98e3233af19440a2fee38d1ee64b9ded1ac7b0ba5f6fbb9922a80f173761459f9899a70d316321ddb80b00b524759d0b9833978c45af7728a18813e50ae869
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Dialer.dll

IMPHASH b34e411b555c469d4deeeb6647de46ee
SHA256 4742cddec8e5e059ca106fb85f6a2dc690c18461b4cde07b36aa2b25c6e3f2c9
MD5 7666a3ea04037ba2f04512879cf7ae9e
SHA1 5622855c42657d8a4ffc2ad87bbf06d0218ccfe6
SHA512 16e7d4f5cae64da54eda4f9a89e2214f9ad0c7fb8d2173fb1a807fe52180284ad8e834f447720a2d4c4e0ff996cac6ce6c7a6275b4eb66eebb81905b3f6052da
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 17f0946e0847bbaa6a06eb58aead13fce22a8606e9b3744cd2241debdf8d8bae
MD5 7e49eb67f1f3c62bb8c4b0a868b30645
SHA1 2be42e3c6059485bc3b624a537ab1fb36a10a263
SHA512 469c28b6da5b9499fd417f8cd74414d6c6edcbe6567eecc9421a69797a77ec323936deb96cd151611da57e311074ec0c56d82a9800d7aebac9538a947284ff9e
SSDEEP 192:/6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTSK72dwF7dBdcQOz:/6JaVh4I5rpPbTS+BdhO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10795

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/InstallerHelperPlugin.dll

IMPHASH 892254afb2dd6c597cfb0da13047ee12
SHA256 ea67e8f37654c7278903c73d62fbc8ec183881ab32feee5e2109c84715e63ecc
MD5 52a442935d96e94c780ca616feed71f3
SHA1 45e3d0af4e7582a0241433de6a73571100334b83
SHA512 289accf4ae88bd34f02577d7f1339a551c5e2230c354663c616a887f1c54630e044e7be2ae68035ff660d75eaa1e313c3aad35f1548a0b16842da7d7375f199e
SSDEEP 768:TWcIgKCbS2OAjFeiIWPwEPBRXkDYGzLk14IAm5oYKLPK:Kc3KqS2OXWXoDUZ587K
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

25:94:2c:9b:b0:87:3d:e2:bd:14:82:5d:ce:57:60:55:51:12:90:e6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Pinball Corporation.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Pinball Corporation.,L=Bellevue,ST=Washington,C=US

Chains

Apr 1, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Pinball Corporation.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Pinball Corporation.,L=Bellevue,ST=Washington,C=US

Serial Number

22:e4:9c:51:dc:d7:1b:05:71:3a:af:78:65:82:d1:35

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 1, 2011 - May 19, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

8243

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcpyA lstrcpynA GlobalAlloc lstrcmpA FindClose FindNextFileA MoveFileExA DeleteFileA SetFileAttributesA FindFirstFileA lstrcatA lstrlenA GetVersionExA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection HeapAlloc VirtualAlloc HeapReAlloc WriteFile LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

PostMessageA GetClassNameA EnumWindows

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 7f3057abae7e8b5b91a35fbb23897657accb8c724e923d5d4a0e9208ca09c445
MD5 de86f5220bcbbac420fc4f6166bb2d91
SHA1 d0d52fdacbcffe0058cedfc20cf5108475033f5d
SHA512 d22f7807037c410427518891dee5dd535361df514ce0980a654d99d32f369b5e9c2059bc5930d807e93ebb3b7741d09466dd87bb796256daf9d8a630280fbe99
SSDEEP 192:mO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:DKAFERdlxhGRYUzqZaf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 a7e51e8e0a92598837efe47530c7e1ef0be3cd8e622ffe5671fa434a18881c55
MD5 526bde33b2b6a0c24984de0de762105b
SHA1 2ea798362bfe9b7280d42ef020f2245fa682c981
SHA512 b66459b4aee7a4280d3f6cf5ad819f9a115844f75fba3f20207e023a7a7f60f9f61aba63c579235e3f68c63d4a161b23ca35a145f4a84fcd0864bd30d32b5945
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 3e109a0e95cce1ea46a06fcabf3e573b281ce8c5e61647303ccdcc06cb38f015
MD5 7df34c04a67796f38b0f599cdbb20657
SHA1 f44b94eea86d480d683f9c6d3c82c99e3bcd04df
SHA512 44ea3078031a163a47584e9b971c4448f3cdda61933f869b3972fd5551238977716b023bfeb87053d57f216c4a51d0cd720ac050587ed847be63c361da642064
SSDEEP 24:3+kx4rT5555555555555555555555555555555555555555555555555555555o:3+Vr2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e33f63abc11fa9eb2fa83ff5c1369204e637b2e9180d47a07987f13f9bbce9ea
MD5 4ecb801055e841b576345abd0edf4dc5
SHA1 c5111738e27dafbdaf4ec421e92f1c9e8fca7c3c
SHA512 b339c4d25fb6630a01fe156194a46f96a3defaa57fcfeb8190cbb1634b5c1ad161bae23b7d4e0d29963f5cccf38215353fc0d182b7a8f76348107cb05c2c8908
SSDEEP 384:tCsaKyo32GeXAnkf4JVzhtKwl96ayFopbeyIpJLtLd5uuc+neu8LtcWAW0M4r9Ht:Y5GewnJfl96FZfLdVgrAW0rr9+Qs2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer