e692a9014378ac46f150b9122698776c_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/english.loc	acprotect
static1/unpack001/filter.dll	acprotect
static1/unpack001/russian.loc	acprotect
static1/unpack003/$PLUGINSDIR/md5dll.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack003/$PLUGINSDIR/md5dll.dll	upx

resource
e692a9014378ac46f150b9122698776c_JaffaCakes118
unpack001/$PLUGINSDIR/InetLoad.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$TEMP/marker.exe
unpack001/SkyMonk.exe
unpack001/english.loc
unpack001/filter.dll
unpack001/russian.loc
unpack001/uninstall.exe
unpack003/$PLUGINSDIR/InetLoad.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UserInfo.dll
unpack003/$PLUGINSDIR/md5dll.dll
unpack004/out.upx
unpack001/update.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 27f31860fd9f2a5b127f0d13972cd0a9d3f589a9add6fa0d7feac606f2a7cb5b
MD5 e692a9014378ac46f150b9122698776c
SHA1 7a7bdb86c86e1e1adff07c43b1134479395f0eb3
SHA512 84687887ac68843c8cd465fd0fc3674e18954c14bd21ed665390080ed9c93462958cdf770309e4c3ffb93ba18db965d8d35c18e57023351ea50994b31a2c0b91
SSDEEP 98304:u84pGEbRzNwJt+YuNHIbGhyk/5rX1UUk38NAg2uvN2n8ibIxH3:uH0EVNw6hH0GT/h1UU4+AgvvN2n8JX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/endownload.ini

SHA256 557b6cdcd498abbf841200d71c980fe231f3640b06e93cfca9754098a200b8d7
MD5 b0c1da8433530397c1f04de9a0f79a6b
SHA1 c22b97e95a97e769b9ba640d6b217efa6cb678f4
SHA512 22ce5e1db1e2e6b67609a52a6acd0bb3498510a9a539bce6c74aa202301eefa8e1f96f2267c5244de7171f74930c5c528ab645ff88f0600acae49f9c4f33f1cb
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ensetup.ini

SHA256 2ad5b06f3b51d664414dd85c5fe6e0eaf4e9b14474e582758ffed06976e39742
MD5 1595d2dbc6f6f0faffbda5f5193cc39f
SHA1 36e7ab3b2c1352b89a10560fdab89d4ddda1371f
SHA512 eaa9cc9d163acb79aa8e763925e1d9c2f766d6d7238129897c22cce1828b8a20d93ee6613543e7bf26fa1f73fca73d439b99b171218d2606b694176a7e66b016
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 2b51ea30f8dc76837a0223abfb86feb002dd4f40e7b6a7a867d5e79295dab701
MD5 0dfb0608fc443b8bd02084c3414f2e0d
SHA1 38a31e6a43d8f217b594621582aaa3ba2a84b68d
SHA512 07f4711405f4a1509cde8f5ae670f55fb0c55e9f430c011a35484c0c21d5cbc98cd2e1ed4337386f368879f42bb69756cdd0b0dabee16f95ae9c8cb46a740317
SSDEEP 768:YJcRGZmLDi29Rzj/YMOUvTxamvAc6WLX5VF9ReSA4eI/3ABL+O7SA057Jh:CcwZmniqRzjQMOUvVDvAc6AVF+4b/3Au
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/rudownload.ini

SHA256 b146ba43b4ff1067b4f55f7cb04cbdc0bfc16698f8e45f755c5149cf94fe7ab7
MD5 4626bb40ed3f9d297a4877264162bf17
SHA1 2a68419ea755931985124f8a920ddb9f76cdd274
SHA512 d22d0c4d4b858ff315efae948b3cc042cde5f61ce746b0d870194f019e859daf52fd5668f2759e6b692842acd998b85d14f64265fe64f5b2f3567a0d52797abc
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/rusetup.ini

SHA256 0980f9fa129046934d975dd95baf17b9ce5833ce70cb3c4b5a9dd9a2dc93dc02
MD5 006724ae20e743022f0526b72016945b
SHA1 5001d2170e383056322745e2f8bc973528a95437
SHA512 2aa83cd6f511a5d6e5c1ad518eb33ae54eedd14da3dd8e3cfa24a9b4ec4d3fc01040df7fa77470bcbfc37546893e81a460ff70ef43de46ef24113280921de0cf
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/MailRuSputnik_rfrletitbit2_s_mpcln9514_lite.exe

IMPHASH 5aef33c703b3dcd6939c748ba6396618
SHA256 da0e716af146e66e9e5aeeafc46ab2c2b81bc29fb800a2ac2816af537b03b240
MD5 d04de47cbf06e4e9322ea1268bc77c43
SHA1 0b396c9e758f7105ac583f76098127cc0e01257f
SHA512 97bfb09df4d929d2877dfd6636fc224437d0ae9843a58f5958792bcab63d5f22585fb5f341a8899c9736b340c4e92afc8ccf43f18b80dc204228fc0d2349b7ea
SSDEEP 98304:zn9tKv0LOG2APYwMrexUIk8wNDFmpvntLfs1I0:bazTw5xUIPSDFivntLfE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

1c:12:3f:80:44:83:0b:19:53:ac:d7:22:dd:bc:59:ec:8e:71:48:59

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=LLC Mail.Ru,OU=Secure Application Development,O=LLC Mail.Ru,L=Moscow,ST=Moscow region,C=RU

Chains

Nov 17, 2011

Minor OS version

0

Major OS version

5

Entry point

1057830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareStringW OpenProcess TerminateProcess Sleep LocalFree SetEvent GetProcAddress LoadLibraryW RemoveDirectoryW FormatMessageW GetTempPathW FreeResource CreateDirectoryW GetFileAttributesW lstrlenA GetVersionExW GetExitCodeProcess WaitForSingleObject InterlockedExchange InitializeCriticalSectionAndSpinCount SleepEx CreateIoCompletionPort InterlockedCompareExchange InterlockedExchangeAdd TlsGetValue TlsSetValue TlsFree QueueUserAPC TerminateThread WaitForMultipleObjects SetWaitableTimer PostQueuedCompletionStatus TlsAlloc CreateEventW GetQueuedCompletionStatus IsValidCodePage GetOEMCP GetModuleHandleA SetFilePointer ReadFile FlushFileBuffers GetStartupInfoA GetFileType SetHandleCount FindResourceExW HeapCreate GetModuleFileNameA GetStdHandle GetStringTypeW GetCPInfo CreateThread ExitThread GetConsoleMode GetConsoleCP WriteFile GetStartupInfoW SizeofResource IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetTickCount ResumeThread ResetEvent OpenEventA GetCurrentProcessId GetSystemInfo GetSystemTimeAsFileTime FormatMessageA FindNextFileW FindFirstFileW CopyFileW MoveFileW DeleteFileA GetFullPathNameA DeleteFileW GetFullPathNameW LockResource lstrcpyW HeapAlloc CreateEventA GetModuleFileNameW LoadLibraryExW FindResourceW LoadResource FreeLibrary GetCurrentThreadId lstrcmpiW InterlockedDecrement InterlockedIncrement lstrlenW GetProcessHeap HeapFree CloseHandle GetCurrentProcess FlushInstructionCache DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar EnterCriticalSection RaiseException GetLastError MoveFileExW GetModuleHandleW SetLastError WideCharToMultiByte FindClose CreateFileA CreateFileW GetFileAttributesExW AreFileApisANSI GetSystemTime GetTempPathA GetDiskFreeSpaceA CreateFileMappingW GetDiskFreeSpaceW GetFileAttributesA LCMapStringW LCMapStringA GetStringTypeExW GetStringTypeExA GetUserDefaultLCID HeapSize HeapReAlloc HeapDestroy VirtualAlloc WritePrivateProfileStringW GetACP RtlUnwind VirtualFree IsProcessorFeaturePresent LoadLibraryA LockFileEx UnlockFileEx LockFile UnlockFile UnmapViewOfFile MapViewOfFile GetFileSize SetEnvironmentVariableA CompareStringA GetTimeZoneInformation SetEndOfFile GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetStringTypeA GetLocaleInfoA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle QueryPerformanceCounter GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW ExitProcess

user32

LoadStringW LoadStringA wsprintfW UnregisterClassA ReleaseCapture EndPaint BeginPaint GetSysColor GetFocus GetCursorPos PtInRect SetCursor DrawFocusRect FillRect CallWindowProcW SetFocus SetCapture GetCapture UpdateWindow ScreenToClient DestroyWindow SetRectEmpty OffsetRect ReleaseDC GetDC DrawTextW GetDlgCtrlID InvalidateRect GetDesktopWindow GetClassNameW LoadCursorW IsWindow GetDlgItem MoveWindow GetWindowTextLengthW GetWindowTextW CreateWindowExW DefWindowProcW GetActiveWindow DialogBoxParamW CharNextW SetWindowLongW SetWindowTextW GetSystemMetrics LoadImageW GetParent GetWindow GetWindowRect MonitorFromWindow GetMonitorInfoW GetClientRect MapWindowPoints SetWindowPos SendMessageW GetWindowLongW EndDialog MessageBoxW IsWindowEnabled

gdi32

SetBkMode DeleteDC SelectObject CreateFontIndirectW GetStockObject GetObjectW DeleteObject SetTextColor

advapi32

OpenSCManagerW RegCreateKeyExW RegSetValueExW OpenProcessToken GetTokenInformation AllocateAndInitializeSid EqualSid FreeSid CloseServiceHandle OpenServiceW ControlService QueryServiceStatus DeleteService RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegEnumValueW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteExW SHBrowseForFolderW ShellExecuteW FindExecutableW SHGetPathFromIDListW SHGetSpecialFolderPathW CommandLineToArgvW SHGetMalloc

ole32

CoCreateGuid StringFromCLSID CoInitialize CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoUninitialize

oleaut32

VariantClear SysFreeString SysAllocString VarUI4FromStr SysStringByteLen SysAllocStringByteLen VariantInit

shlwapi

PathIsNetworkPathW

comctl32

_TrackMouseEvent InitCommonControlsEx

psapi

EnumProcesses GetModuleBaseNameW

ws2_32

inet_addr closesocket getaddrinfo select WSASocketW WSASend WSARecv listen ioctlsocket getsockname getsockopt setsockopt connect bind WSAGetLastError accept __WSAFDIsSet freeaddrinfo WSASetLastError WSACleanup WSAStartup

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/marker.exe

SHA256 ad18f4d54a6e66803a803bb4abf0e42a151f241187292896721db92f89b8c699
MD5 3574d43b65ee01ed65b55864f2cad92e
SHA1 caeaddac7f3d011ad0307a5ba60080ef8537273b
SHA512 78864a17aef8033f4dfe446d3d38dd9f68fcd9ca99f0dacb0e16ddc4ff4ce7e12a637b847154f8793dd3cc22139c6ee5a5e0b47058c898cd9979d339e6c66e44
SSDEEP 384:MghHO6uSpYUDNmjoqwe5naRjpv/GvAIr0XYgPGspZJJP:3u69YmSopon41/GvcvLp3J
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

77376

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

SkyMonk.exe

SHA256 8db3335687786fe49d57afbb85dcbfd0ed67b04a590878650ed1bc6b3842dc31
MD5 28ea6cf6cb79d3125d29e2182b9c6645
SHA1 22e506e9a0f10edf4e07e7b8f4cd3f3c6f8af2dc
SHA512 d8bbfc048990379ec1728798f81a9f15437b8f409bacf78d9fb562e69a8d29193cb6a9d06f6687b58fdd8bcca5884f71d99f3eda93f60684f0bf5f585a5821ac
SSDEEP 6144:WvtRXA3uutOEBwnJu31gLZngBjHcT3hgrFR3HIgGu6YIixPmaRER4L:Wvt1A0+CL6j8T30Fr6+tNg4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

1068416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

english.loc

SHA256 a74fff8cf7715d451b6a20f5eaf9a10c9cd56485a7aea68b2726820942365678
MD5 c70a623400a7091a295b9295dec302b4
SHA1 7110b7c1057575129ebabb018eed40f8a1829b6c
SHA512 526414b202e60c40189dec18da87f13ee4a1e898267f6d5dcd69cb20e2bc5fdf0aff9ed42d2a7dc3842b7c9424159c2bdc5531da93e855cf0ca5797a99630d3b
SSDEEP 1536:zCOcV/47UNMvmN0Lsp4dhGYCf1W9o85sx9pAjTIqcGalVVH4EatQsk5A:m/47J67pYmfAV5sxutNalTH4Dk5A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

367808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

filter.dll

SHA256 e8787daa3236127fbbe2cbbca59a868a4495564a9ebb7d7befe73af9e38e4791
MD5 c9b4e862c632c0c211b256160e69b5e1
SHA1 b90b5e24ac1dbe7993e469e73dd0ce9c961489eb
SHA512 7d79ab82bec938b770f315a67dcb34623bb0771c98eebbc41c362e6d28452372aa7d7bc17b6b983e0b2056d9d6bda770b6c0e50f47501d6a65e22fe42d1a1450
SSDEEP 384:xALph75y5qkKm/+0eES5f0RybqKkfrbmak6bRUfRsVZtXos:xkh0h+03S5f0AQrrkROPtd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

59200

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

russian.loc

SHA256 9900a23bf7d7f4b5e9343b6f37a8406ddeb302ebe1d9fcf382b1c408b7dc36e7
MD5 f8d4f0bc57b49287b04ed40a4c68d2ea
SHA1 9d38d930eeaa710ef1ad6da16456563d3b008b4f
SHA512 1c02fde05d653e187371b1757616173b6278f7447ec18f1103be76daa5868f70dc67b5e1a35faaddae6f6c0ecdafcf6ab9c23ecb849757764cb8fec96b3f60ea
SSDEEP 1536:IH1COcV/476GMfQmthLlHu52bAig/y37B2wpAjTiqcGalVVe4EafQsk5A:KA/47iLl9Uici7GLNalTe4lk5A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

368160

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

skymonk.dat

SHA256 42421193cf964ded29fce87e5e637a0c0ab9896671aba72f20f005b24fb461d8
MD5 df2ce53a070debe24568e8724b55f942
SHA1 b48d7294d795b686b3c5250bec6ccd07b2e6c17f
SHA512 8d76fdd4007bce71871e85f2ac93f8a0f78c24a337fcf7661e0c1e9d0f903e47caeac695a5ba7d42fd0c8f571a68a6571bf11ff8b9078a1916292b59175e686d
MD5 SHA1 SHA512

NSIS installer

installer

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 afb14aee4127f0e4f662d0ade3efede48ea54045e422ca26e08024a60dc972b4
MD5 16c86ad4d25b228930ff1019e4e3292f
SHA1 3ce7ad87f8210564399dd28f5413b8c450dd7b14
SHA512 0bacd4ea9fb0c741dd5ae4f8560a16efbf7d1dc2fe6fbeedc11a0a0112d2137bdce491b41a0d64a39f8ab5261829dae5cc3cb0f274780deeb061db365f93db7d
SSDEEP 1536:1pgpHzb9dZVX9fHMvG0D3XJPMzKO5b4ae3z7FDYV5R9AcVVMncJGjef2od:ngXdZt9P6D3XJPqKO5e/FDeFjVOntiO0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 2e2fcf00a10003e2b3acfa59d9383572014cb70de7cd338adbbbced6e081a9d2
MD5 d86112de3188b70623cae7b3f65a86b5
SHA1 b25a5a6aec875a6cd13352e56f91704422db0daf
SHA512 5049d646579428142c928496c5ab7abb073c52310674948ae9498cb13a6e96d4d84ca2b13e3fd55f31b4e2380aad6ac66e9b5395948eec30a4c2ffa32e6647c9
SSDEEP 768:DJoRGZmPD6jpMeY0OlzCv3sUozoX5VF/RbSA4Oi/aQBh+O7SALW7Jh:towZm+jOx0Ol63sUo4V/b4N/aQX+O7bI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

update.exe

SHA256 376c9833d91e40738289af5c8bac6fcb7988d5f757ea7d54003c7942826df4aa
MD5 fea6bf51dcc6e305cb61002ae68c6247
SHA1 4bcfce25bde89666cf371e01762e80273d801701
SHA512 d2367c302e8daf5a6047a4910a38068271adca6f9661fcd73b33abfeabda4c90788bdf79ce5fbb96a9ceebc82e57c2dd66f9cc3a84238d017c1a04545b26497a
SSDEEP 3072:5ZrJp6FgsGiSwc7abNy1HFtHGAFyyg+W4kd7YxNalTs4lk5A:Ct3SwxbAHGAFYeG7o4k
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

442928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer