e60c7397f68fbaf54e71ea6bf645d959_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx
static1/unpack001/$PLUGINSDIR/version.dll	upx

resource
unpack001/$PLUGINSDIR/AnimGif.dll
unpack001/$PLUGINSDIR/Anuncios.dll
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/ThreadTimer.dll
unpack001/$PLUGINSDIR/ToolkitOffers.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/sarainetc2.dll
unpack001/$PLUGINSDIR/version.dll
unpack003/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/instloffer.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 23641b1b717d089e09858d42a5b0627e239bb54980b81574fc5767793c6f8341
MD5 e60c7397f68fbaf54e71ea6bf645d959
SHA1 ebc0c70ee7189b041ab242eecab089b38aa357d9
SHA512 a3102d37d93af407e3f4bed6743ab5d98a3a6eedee310238005af0ef61791e8f59474ffcab35846319f750239cbdd744032c03139bfb8ec4813c225eafb30b7a
SSDEEP 12288:xSWBINtJ8rSLE+rX9XZWJ8bSLEqzcs2o4Rjbtz/tJAE1UL:xWNz82LEgXZK8mLE4P4V5zAL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

00:d3:43:83:3c:a8:2f:c5:12:14:d3:65:ff:93:bb:11:b1:66:54:23

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vittalia Internet S.L.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Vittalia Internet S.L.,L=Mostoles,ST=Madrid,C=ES

Chains

Apr 4, 2024

Subject

CN=Vittalia Internet S.L.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Vittalia Internet S.L.,L=Mostoles,ST=Madrid,C=ES

Serial Number

79:52:cf:d9:ef:04:0b:59:f3:c1:40:ba:1d:a9:7a:60

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 5, 2012 - May 8, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 2, 2028

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AnimGif.dll

IMPHASH f600fe515bbb976d5966dd4286e0ebd4
SHA256 8fb060b77728fbe347e294d1174a732db7cf9c99b187f8f332662c87683fd0a3
MD5 200b6570553d00a76de8a5a6c9587f07
SHA1 08ca76a84cba8483ab34285d07909e08bdbf4a67
SHA512 01ab8aa80d7d5d3083f2e3016aab5dad29c0bbba18b225a5dde51b3bc6fa4c8c1278aec17d76bc5ee2b9ccb8532c22d79845162f752bba6ee12341b4d64304e8
SSDEEP 192:gOHvLYKKad68vn0YQRbqLGWSMRH00yQTbxDdHw:bvLXKa0OqRqS1MRH00HJdH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Anuncios.dll

IMPHASH 1b1789d43c308d5689a704f0ee9cb5b6
SHA256 4798cc15822262fd061c3a178874afa1e5535b911eb3094fc5bbf2e365866e8b
MD5 642543739542a79b1cd8576c70add738
SHA1 998a7cea2239f9925cd3796c5006edf532fab1c3
SHA512 08d7a118468056b76923694787ee2f88ab4d0e91a25b6195eaa1ccabb26c3834747a00591aa10e88d8f265eddfcb1365d20fb0a55eabb28e86ea76621516cd39
SSDEEP 768:iTrcSh2AD8wOZWzF9YhvhgtWmnTED8X/vxiTQxq:AoO4bwnYhZCxNx2A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MultiByteToWideChar GlobalFree lstrcpyA GlobalAlloc HeapFree HeapAlloc GetProcessHeap FreeLibrary GetProcAddress LoadLibraryA HeapSize GetStringTypeW LCMapStringW RtlUnwind GetModuleFileNameW WriteFile LoadLibraryW HeapReAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter HeapDestroy HeapCreate GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameA DeleteCriticalSection GetStartupInfoW GetFileType InitializeCriticalSectionAndSpinCount GetStdHandle SetHandleCount ExitProcess Sleep InterlockedDecrement GetLastError GetCurrentThreadId DecodePointer GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError IsProcessorFeaturePresent

user32

SetWindowLongA GetWindowLongA GetClientRect PostMessageA CallWindowProcA DestroyWindow DispatchMessageA TranslateMessage FindWindowExA MessageBoxA GetDlgItem CreateDialogParamA SendMessageA GetWindowRect MapWindowPoints MoveWindow ShowWindow UpdateWindow GetMessageA IsDialogMessageA

ole32

OleInitialize OleUninitialize OleCreate OleSetContainedObject

oleaut32

SysFreeString SafeArrayDestroy SafeArrayAccessData VariantInit SysAllocString VariantClear SafeArrayCreate SysAllocStringLen

urlmon

CreateURLMoniker

wininet

InternetAttemptConnect

$PLUGINSDIR/BgWorker.dll

IMPHASH db2755f409b81c4dbfc04f648cfb80b9
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
MD5 55788069d3fa4e1daf80f3339fa86fe2
SHA1 d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA512 d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
SSDEEP 96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecDos.dll

IMPHASH b997a221e444f5e6463b28778735cf2b
SHA256 d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
MD5 ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1 17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA512 5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP 48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ThreadTimer.dll

IMPHASH cd7699c6e9370d6d4c4bcc96b7286a04
SHA256 4e2a7c511e0f2ef46ac9002e0666f058ea5a4657371f086e2e4797393ee2fbf2
MD5 c43953f463c22e048e45b402d190e77d
SHA1 b4a5e6567bed3c783af030df9418f91a7bac3040
SHA512 18facd89f3dc55826b7aa0c02b8fdf3a1e6741850e4d9c264fb095e9da7956f6a4d331655ef00862948397d1a3f99d15243d03ef09c145a39c3b9a0c2ef4c974
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ToolkitOffers.dll

IMPHASH 87e54a02ab872a19fb8cd39cbfb88168
SHA256 89ebab8d0675d7b79a3d0a455ec55d0b87aa0804cfd092e30f3d1142f0ce1109
MD5 3c6a9490f32cf8aca12252188874dade
SHA1 4df69fe59c10f2cd6de472e5fc05eed5a489998b
SHA512 e8ce3378bb4cfb95cbe5ea0ad83fbf8e129cdfa0e724346b789c3f43c76b8a81d85b1c1b1c1c3fe7de0bf2b00e3c8fe485b2d784d8bbaf2221faa2ce20aa6be5
SSDEEP 3072:hb0VmAw9fh4OZGsz7dFG3plCyUSSOpITbI/o29OzU+VYeEuaQWkMx0mBo:hb0ont+PXCypeQgyDZQWbnBo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

81369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Proyectos\desktop_apps\NSIS\NSIS DLLs\Release\ToolkitOffers.pdb

wininet

InternetQueryOptionA InternetCloseHandle InternetOpenA InternetSetFilePointer InternetSetOptionA InternetReadFile InternetOpenUrlA HttpQueryInfoA

kernel32

InitializeCriticalSectionAndSpinCount ReadConsoleW ReadFile SetEndOfFile CreateFileW WriteConsoleW SetStdHandle LoadLibraryW OutputDebugStringW lstrcpynA Process32First GlobalAlloc CopyFileA GlobalFree Process32Next CreateToolhelp32Snapshot lstrcpyA GetLastError Sleep LoadLibraryExW SetFilePointerEx FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA GetFileType CloseHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetOEMCP GetACP IsValidCodePage GetProcessHeap InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WideCharToMultiByte MultiByteToWideChar GetStringTypeW IsDebuggerPresent IsProcessorFeaturePresent HeapFree HeapReAlloc GetCommandLineA GetCurrentThreadId RaiseException RtlUnwind HeapAlloc GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize GetStdHandle WriteFile GetModuleFileNameW

shell32

SHGetFolderPathA

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

SHA256 48941e9f5c92a33f1e60a7a844d562dd77ce736fd31b5503c980b49679dfe85e
MD5 f8462e9d1d7fd39789afca89ab6d6046
SHA1 7e9a518e15b7490245d2bef11a73f209c8d8d59b
SHA512 57dee2253abd7d17d53811d5e95237f9434288518fb043645524a517786db2d8a91df86a6da732c620f12ad0e7ea30a923b8d5f3de386c65bd3ff240bc0dff69
SSDEEP 96:TjGBPJ762z6gjutipI+h7jz5ozZt/aYfA7EfXxLfAZi:/ix7ibUpIS+Xa1wX2Zi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

35776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 f7c16606a1bb3c3a4f8e19683dc68f2ea5e921fa2600b232f37b4d136643b49f
MD5 827c22af1bb471c44565674640927857
SHA1 ee55a665cc493eba5be48d99363fc0a95ed8df34
SHA512 ceb8f97d1892205f12f9c8493f774c01fe9b5828d3fcf63519be0789e80255fbd9bd9410e50812cb02a011118c74848368c8d2b94668f1de9506a53544be2800
SSDEEP 96:kEHvhxm50Qol5g2W7i45Y3ZeQ9DQiey5Ry3524jQwOODkjDf3GE6fA7EfXxLfA:lu50t5NL3XrgM4jDD/EPwX2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sarainetc2.dll

IMPHASH e963599f352f9ccccdef45b7dd338c91
SHA256 8cfa8ac6ce078a961e33771d69dd4ce10fbc2e8e84cc4fec7afbe20a40d9a6aa
MD5 4ef7a82508258875ca4e684fb216a3cb
SHA1 aadf65260945eb2bf7ec07d622aa609757b44cfc
SHA512 9cc57392faba3b8da7c6aa4c71b39d0fcd8d0b5871ce839647acf917d396de5ea6d1c9be6ab4457460751f8d40748e84e323c651371e89a9beb2f0a50cf6cc06
SSDEEP 3072:MW2YXDpNYCy32SHyE1k7skVOiIJz6Kp+rBF:MW2YTIJzk7skVjIY
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

35101

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers HeapSize OutputDebugStringW HeapReAlloc WriteConsoleW SetConsoleCtrlHandler InterlockedExchange GetModuleFileNameW FreeLibrary VirtualQuery HeapAlloc LCMapStringW CompareStringW GetTimeFormatW RtlUnwind CreateFileW GetProcAddress GlobalAlloc GlobalFree CreateThread TerminateThread GetLastError WaitForSingleObject GetFileSize WriteFile ReadFile SetFilePointer CloseHandle MulDiv GetTickCount lstrcmpA lstrcmpiA lstrcpynA lstrcpyA lstrcatA lstrlenA SleepEx LoadLibraryA GetModuleHandleA CreateFileA DeleteFileA EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW GetStringTypeW FatalAppExitA LeaveCriticalSection EnterCriticalSection Sleep FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter HeapFree GetModuleFileNameA DeleteCriticalSection GetFileType GetStdHandle GetProcessHeap GetDateFormatW AreFileApisANSI GetModuleHandleExW ExitProcess WideCharToMultiByte LoadLibraryW LoadLibraryExW RaiseException MultiByteToWideChar GetCurrentThread GetCPInfo GetOEMCP GetACP IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW CreateSemaphoreW EncodePointer DecodePointer InterlockedIncrement InterlockedDecrement IsValidCodePage

user32

SystemParametersInfoA IsDialogMessageA LoadIconA FindWindowExA GetParent SetWindowLongA GetWindowLongA MessageBoxA GetWindowRect GetClientRect GetWindowTextA RedrawWindow UpdateWindow EnableWindow KillTimer SetTimer SendDlgItemMessageA SetDlgItemTextA GetDlgItem CreateDialogParamA IsWindowVisible SetWindowPos ShowWindow DestroyWindow IsWindow PostMessageA SendMessageA DispatchMessageA TranslateMessage GetMessageA wsprintfA SetWindowTextA

Name

.text

Size

115KB

Virtual Size

115KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/version.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PROGRAMFILES/Vittalia/uninstall.exe.nsis

SHA256 217be6e54171dfd49e131436373ac26a0f3fdfc9e65ecd365bb960e8b2f93bf0
MD5 26f6d9fa01fe058b3be365cb8f2b59b1
SHA1 a0843cbaee904621c50a3def3e546dd288bba3f6
SHA512 2e9634c294fae6d3d22851e47a5576d22f1c6cc91f573f42a5c9d519b633e61f5a8f0304397103c641b2186fe0d308663da2ad00e62f50f78fff53b1d48d39e2
SSDEEP 3072:POoeqruVpIDLqJO4cJSNhh67Ywksl/LSLEDTOB8:PmVrtJO9ZBSLE+S
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/ajax_loader.gif

SHA256 3d0580226138c9673aadaaf64d97c2a7c720d538f146c51c2c722d34e7ffa500
MD5 60d1f98dbb5a6ea9ac747c3e46c0c628
SHA1 25e7652b0ec4960afbb84adf52fd97d8a4e0048b
SHA512 e77a7fc0189ae278799f6bbfa23685081fcbc004dfd159c45a85122d8bd7f0273399a7c2c24ff1d69cc8ffd18784ca090a6f393220c09cfae66d104911c4ba3f
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/axtan.ico

SHA256 81a4ac6a6e8fd9bc743aab550591ea33e3768041032c4cf5ab31e2f8993b03c9
MD5 03303abc2150c06b20d239ce38bce713
SHA1 460ff6f6b81fdbe03468c7b3b5aa34ed8191860e
SHA512 108b6e19c67e9a9f02fe33afc41cbc88b5379cd19dc02f2fec351ff4c3fa68b75867601ef5f8e8d3de9f44bd4488ebcefa1b7cfb102f8ba42cb305010c5aec58
SSDEEP 192:l/8k+Jc8h5prQCEdA8evev0GlXgKltQs7NQacvvPPPn//Q:58k++8hrdES8EeclKltQs5QacvvY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/instloffer.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 7133696bfa5556914a68547d0f719c9bcb521c7ad72bf7d579faa9c5e8a76650
MD5 a0f05f4703af66e89f3cbde7aed8a719
SHA1 549e703a1c4e7ce7b05f49fbd7d1d38c5d959e05
SHA512 b781b2d04ce514395f4df376e2013f750695653ceda70100202b1819e8de0134a57a502f0c2037aab65e176b3024533c26a08ec4d5b9e6466f0d5c1286578311
SSDEEP 3072:+gXdZt9P6D3XJ8kpwHIDLqJO4cJSNhh67Ywksl/LSLEDTOBuDOOG:+e34ukiHtJO9ZBSLE+jN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

33:09:48:fd:30:c8:4f:c8:52:27:35:6b:16:bc:82:a6:08:fb:d6:3f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Vittalia Internet S.L,O=Vittalia Internet S.L,L=Mostoles,ST=Madrid,C=ES

Chains

Apr 4, 2024

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$TEMP/license.rtf

SHA256 34f4ff37f1f1a5157b420eada86cc5b0af5c95118eb38c0b71c9273b22ff2294
MD5 99917b934514b67ddd06924a946af785
SHA1 033d04e7bb31cb5af832009f95666954dfe7b1ce
SHA512 402b913d3594461f67a27fdfc4f4632f5db7db8bda0591b01e4e2b4dbc701f2f4ecf10eee8559820f14478def4f5f33b0eb083fa8273a43c243d2aba191b0c2d
SSDEEP 192:doyiN15CHjJn5PWkt1I71jz/G1n3mSxvOrTa//OTdcofTNvdVn+Xx9uN:OyUw+oIFze1n3phma/23dUB+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/square_babylonv3.bmp

SHA256 947289a34258f6601fdb17549e373c7e7d5225b205602ae1cfd4b5c3eb18c8ea
MD5 811296be3855dbe1b72546ec798f0d00
SHA1 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
SHA512 87d07838c49cd960e5f3b77085326b856d432b2f9eefc364be4d5bb7bc8f41ac5d099ee3a3ff4551199171b19c922fb87c2f2a530061f40d2f5e48b9ab11e1bc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/toolbar_bbv3.bmp

SHA256 337fbdd5f2720646eab2bcee1c7bf7dfa03a2768e6e43f154f521d2cbf387240
MD5 1687c82f77a6e033890d7fba31f85697
SHA1 a023733430f8e74f40dd6f70e30e05e244bfb559
SHA512 d7cee6563a7d77aeb755e151ff5891fa9fc8047cb3f57f39600f26d4d14b8843ef23601b18fc5522ad2a463c90856d5c6605d0d244da0126e2db6a307af186f8
SSDEEP 384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer