e9f7c9f10731414fcaefdd2437c1caa3_JaffaCakes118

resource
unpack001/$PLUGINSDIR/DLLWaitForKillProgram.dll
unpack001/$PLUGINSDIR/DLLWebCount.dll
unpack001/$PLUGINSDIR/IEFunctions.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/SelfDelete.dll
unpack001/$PLUGINSDIR/SetHoldData.dll
unpack001/$PLUGINSDIR/stack.dll
unpack001/GConverter.exe
unpack001/GToolbar.dll
unpack001/GUpdate.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 e89bf59c56587b51976943006e1d6bb3be86da8eb6375c88c05ab41813705828
MD5 e9f7c9f10731414fcaefdd2437c1caa3
SHA1 77953cae142a1558fb15d9104227e3a768721148
SHA512 99778f16ed5cb5f1971c080c8135c9c30c604c9980cb8836650931ec14ac935bbff2c9431006f36b4e5b3f7dae6dd38ce31645fcf586dc38ada425f4f06d5272
SSDEEP 12288:UsGS63bvdwaAw4VtbgVAEUJs/J35/TjVAswf4:UxlDdnEMVATw3pjV3wf4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/DLLWaitForKillProgram.dll

IMPHASH 2e92645153848ef99816d61ac6e2a921
SHA256 ed52bdad7b383a179b9b0e21fefdda2d72695c5263a815d5e1e0bfac6c718548
MD5 9c4b8ec42d89f7557bfd90798ce52787
SHA1 2376dde426ea65aa27c30e304086310605382475
SHA512 17c12a27a08746755868558c037376dd7e20f03f0f71888c1329903b70975a54f57786c3c32bf88aaf30119f11ed978a6830ba91949e11cfc94fbb5ad95305b7
SSDEEP 96:EP5ZuFye0MyQW4uPwhs+R/+gFrE1m/U/uG98bp2y+HS21kEZ1b+4Tu9C1uGg8wBu:akFyFRQ5wIzlH/UGq36EZY4T+Gul8U
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6176

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/DLLWebCount.dll

IMPHASH d01bef609870d68108539ca1b2908320
SHA256 0a0019b2603dbc4505453c2501255ab0cc0b3c317ece4a6ce0cfb6a02a30907b
MD5 0bdd7c6f1046ea4b42839f991ae53fb2
SHA1 cb9baefb10159b4a684fa1ee4372e7715865052d
SHA512 96f41497f25d7bc81f51ab167f74243b4b767089c89c26f9752ef518fa60dedd2722c66ae87dad2334bcce1622bc12f7b9b892ae654ca58cecd9f35c9f1dc163
SSDEEP 192:OQoR7CK9FX/dVPWtJ/tXP88bSNwWW8+YdbDT:OQcWeJ/XPWtJxPFYi8nb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6032

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1008B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

590B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/IEFunctions.dll

IMPHASH d3ade25d7710cc7b0801440c6df6098c
SHA256 3122b0413f74e88518cfd1b9c6e18435dd326ca177a2374b6405df78f43e776a
MD5 9701818d39318145dd164794ef3a3846
SHA1 7db701f8dc19163d46ba88e8b68d8dbf428a8152
SHA512 d92786630250e9eb6c47537b09684fa107f959b50d255c7f3952741eb438c3be47e171827d3a4407b049c33c12dad73f8ec381a7265b28a6d8ca101ff702e8a4
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 1f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
MD5 eef9e469e8a30717974499f277d97e2a
SHA1 2d33c25984ebd9116beeb55cdde4c5c86c023e5d
SHA512 d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48
SSDEEP 192:8np6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+MTjK72dwF7dBEnbok:8p6UdHXcIiY535zBtMTj+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 602d7a78172a6f5b4541df0fb5a6b875
SHA256 f38c669c87f2a73768a27a01622690997e9d93d5ca3830b349bd24c3ff9f8d2e
MD5 6958016193a066833556992077bad4fe
SHA1 5f564945936f99381d7e2408f034f97d069005a4
SHA512 fd6ab5c341b331b80c940ba97a2cd14547c796933a2df26d3dd87ede1602b86d9f8c37baebd7dd4c68d811199fc96a27ad4cb995bb8889d51af91db9f43ba0a7
SSDEEP 384:IL6T2Izs/XGCanZSwEfj5lwTSYlml89oayKA15JiQNRw/9uosAUdJofiiqd:88Y9gZSwq1lwTS2XA15DRm9cddJo6l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SelfDelete.dll

IMPHASH 3d91458bc90a151726bcfdaeff902d08
SHA256 c0ad2c13d48c9fe62f898da822a5f08be3bf6c4e2c1c7ffdf7634f2ca4a8859e
MD5 7bf1bd7661385621c7908e36958f582e
SHA1 43242d7731c097e95fb96753c8262609ff929410
SHA512 8317af5cc3ac802eb095f3fa8cc71daa1265ca58fead031c07872f3d4bb07663a7002ae734fad392a7617f0923fe0caf1f54ed55afdf8516a6a08e202d86fa7f
SSDEEP 96:1dIrJYYrzPpqAAZ9sNIaI2y9WulXEGNRrG:nuYATpq/viyYuEYRr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SetHoldData.dll

IMPHASH fac65ab409ffe9f980eec807ae412dc2
SHA256 4c8869ff8cbdd2f9a6a2d2876194869664d0e3f554886451224ff4e732136365
MD5 e86d36c5332858061cc519e7bb558f39
SHA1 8114e43152797296ec1919b1c713ebada661ca51
SHA512 46bf19a71fe2ae4d61084bcf406604e2f375c92f5de1a5e9a6eb857424eb4dc82e70ae7099aa3676c518960f78a17dafa05c23e5283954e43f44190391662ed1
SSDEEP 1536:WLWIcTAacVyVg+h1hT9Uh+uQNIIhVQoJadWytgYT+j:4TlCg+h1xr9IIh+oJadrb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7115

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCommandLineA RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime GetACP RaiseException HeapAlloc HeapFree HeapSize HeapReAlloc TerminateProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetUnhandledExceptionFilter VirtualAlloc IsBadWritePtr IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA FlushFileBuffers SetFilePointer WriteFile GetCurrentProcess GetOEMCP GetCPInfo GlobalFlags GetProcessVersion GetLastError SetLastError LoadLibraryA FreeLibrary GlobalGetAtomNameA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetModuleHandleA GetProcAddress lstrcmpA GetVersion GetModuleFileNameA lstrcatA SetErrorMode TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection GlobalReAlloc GlobalLock LeaveCriticalSection TlsFree GlobalHandle GlobalUnlock DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc GetCurrentThreadId CloseHandle MultiByteToWideChar WideCharToMultiByte lstrlenA InterlockedDecrement InterlockedIncrement GlobalAlloc lstrcpynA lstrcpyA ExitProcess GlobalFree

user32

CopyRect GetClientRect AdjustWindowRectEx SetFocus GetSysColor MapWindowPoints PostMessageA LoadIconA SetWindowTextA IsWindowEnabled LoadCursorA GetSysColorBrush ReleaseDC GetDC GetClassNameA PtInRect ClientToScreen PostQuitMessage DestroyMenu TabbedTextOutA DrawTextA GrayStringA EnableWindow GetTopWindow GetCapture WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetDlgItem GetWindowTextA GetDlgCtrlID DefWindowProcA DestroyWindow CreateWindowExA GetClassLongA SetPropA GetPropA CallWindowProcA RemovePropA GetMessageTime GetMessagePos GetLastActivePopup GetForegroundWindow SetForegroundWindow GetWindow GetWindowLongA SetWindowLongA SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetParent GetNextDlgTabItem LoadStringA UnregisterClassA UnhookWindowsHookEx DispatchMessageA SendMessageA GetKeyState MessageBoxA wsprintfA SetWindowsHookExA CallNextHookEx PeekMessageA RegisterWindowMessageA

comctl32

ord17

gdi32

SaveDC RestoreDC SelectObject GetStockObject SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx SetWindowExtEx ScaleWindowExtEx ScaleViewportExtEx SetTextColor PtVisible RectVisible TextOutA ExtTextOutA Escape GetClipBox DeleteDC DeleteObject GetDeviceCaps GetObjectA CreateBitmap SetBkColor

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/stack.dll

IMPHASH 55ae76a2cfe164921f566c03cfbba5ec
SHA256 46b4a72ae8590b0afb3304cc5c13db0502bc4c4cb02f64f37c79008c17db814f
MD5 0f61a81a543822de5fcb9a8a43f230dd
SHA1 d01d4a0f542f3c654637fdfe5a574fe1f150ece1
SHA512 596b7a897ba64c32e26ba6168aa3628aad37b187a9814a286298307d8c42eabf8e8a679dbda558f8b2cdc8676c94ec819256432aa5ad7c05a5387759262a4402
SSDEEP 192:VBEc/BwQV5gTRk6uIu8uQubQuNu3fufuXuPDyuSuFujournu6udkuUuw0y9UrVo:VBEwBZmx97TSefeC/zIqoInvEkJ8y9x
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6347

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

GConverter.exe

IMPHASH 1f0adef656741e727bf6fc99b40390e2
SHA256 de44b30d0f6a9c99b3fafc4cfcce5a82e3b9d8ac4b32bf87ecc7233ddad6275d
MD5 2ef6758c7dd4e90b30e3d4832bd45e0e
SHA1 814b66b9c98151f9b0867c097c65e56a831f29f5
SHA512 79460b111150c357dc3c0fc0457b027af30b946aab0d671f35f10d0ee888e51ead9f415170c76fcc1c81336aac481365e1b8055362f51b783fa3444f16d150df
SSDEEP 3072:o6D3sRGj7s20bK3GNhhCz6JpJqe0CQkzJou7Q/ub7:oi3Rs20ughhs6JLqNCQgJp8/Y7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord825 ord815 ord3626 ord3663 ord641 ord795 ord609 ord800 ord2414 ord2514 ord2621 ord1134 ord2575 ord4396 ord3574 ord6055 ord1776 ord5290 ord3402 ord3721 ord3571 ord5265 ord4853 ord4998 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3081 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord1146 ord1168 ord860 ord540 ord567 ord324 ord2370 ord2302 ord4234 ord6215 ord1768 ord6197 ord6380 ord4287 ord4299 ord1641 ord4710 ord2379 ord755 ord470 ord3573 ord640 ord5875 ord5785 ord1640 ord323 ord5953 ord4376 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord3798 ord4673 ord1576

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _setmbcp __CxxFrameHandler sprintf strrchr __dllonexit _onexit _exit _XcptFilter exit _controlfp _acmdln _initterm __getmainargs

kernel32

GetModuleFileNameA CreateFileA lstrcpyA GetStartupInfoA lstrlenA WriteFile GetLastError CreateMutexA ResumeThread GetCurrentProcess SetPriorityClass GetCurrentThread SetThreadPriority GetModuleHandleA CloseHandle CreateProcessA

user32

GetClientRect IsIconic SendMessageA LoadBitmapA GetWindowRect wsprintfA DrawIcon GetSystemMetrics LoadIconA EnableWindow

gdi32

CreateCompatibleBitmap CreateSolidBrush SelectObject PatBlt BitBlt CreateCompatibleDC

advapi32

RegSetValueExA RegCloseKey RegCreateKeyExA

shell32

ShellExecuteA SHChangeNotify

GToolbar.dll

IMPHASH ed389ae238ac2ef6fd573d1fac21e111
SHA256 3b01d8afab97431a10403b2e28476096d4ac93398687d6208c5809953da66b23
MD5 5d3a93b519baf58263671fcb25f23087
SHA1 2d2b585ee1b26665dc20525a16c0dd2bb625344c
SHA512 2cbe4772d9ceb06f9d7a079424b4cf7f7634d1ff5773c748bd861be086b45510fe76c02b6904c250fb54aa70a71d55313c0151853708a671b9bf3f1459f4ebed
SSDEEP 1536:8r3LX2nByyAoDl81RN6T6j3fs0cYX/oAGC1Y9eERR1L:8HmByyVOnfjjX/oANy1RR1
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

27849

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

RtlUnwind ExitProcess GetStringTypeW GetStringTypeA IsBadCodePtr LoadLibraryA GetOEMCP GetACP GetCPInfo SetUnhandledExceptionFilter WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetLastError TlsGetValue SetLastError MultiByteToWideChar DeleteFileW lstrlenA GetCurrentProcess FlushInstructionCache GetCurrentThreadId InterlockedIncrement lstrcatW lstrcpyW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapDestroy InitializeCriticalSection DisableThreadLibraryCalls TlsFree TlsAlloc TlsSetValue TerminateProcess LCMapStringW HeapReAlloc VirtualAlloc VirtualFree HeapCreate GetVersionExA GetEnvironmentVariableA GetModuleFileNameA GetModuleHandleA RaiseException GetVersion GetModuleFileNameW GetModuleHandleW GetShortPathNameW lstrlenW InterlockedDecrement LoadLibraryW GetCommandLineA HeapFree GetProcAddress FreeLibrary WideCharToMultiByte FreeEnvironmentStringsA LocalFree HeapAlloc LCMapStringA

user32

IsWindow DestroyWindow DefWindowProcW GetDlgItem GetClassNameW FindWindowW GetClassInfoExW RegisterClassExW CreateWindowExW UnhookWindowsHookEx CallNextHookEx SetWindowsHookExW MoveWindow PostMessageW LoadCursorW SetCursor LoadImageW PostQuitMessage CharNextW GetFocus ShowWindow GetClientRect GetWindowLongW SetWindowLongW wsprintfW CallWindowProcW LoadBitmapW SendMessageW DrawTextW GetKeyState GetWindowTextLengthW GetWindowTextW SetWindowTextW SetFocus TranslateMessage DispatchMessageW

gdi32

SelectObject DeleteObject CreateCompatibleDC SetTextColor SetBkColor

advapi32

RegQueryValueExW RegEnumValueW RegOpenKeyExW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegOpenKeyW RegCloseKey

shell32

ShellExecuteW

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysStringLen LoadRegTypeLi LoadTypeLi RegisterTypeLi SysStringByteLen SysAllocString VariantInit VariantClear SysFreeString SysAllocStringByteLen

comctl32

ImageList_AddMasked ImageList_Create ImageList_LoadImageW ImageList_Destroy InitCommonControlsEx

msimg32

TransparentBlt

imm32

ImmGetContext ImmGetConversionStatus ImmSetConversionStatus

GUpdate.exe

IMPHASH 1fafdba00882780f046ad1061fddc54f
SHA256 de4ba9c67d8859a208c6b98fede21cd6be61073dd2f9d9239761595d7258af9f
MD5 66a5bd1c4fddfbd195582598080940f3
SHA1 a52c9ea23d2b76b4475d4bd401a4058781f9f859
SHA512 b8a856e1ba324e668983bd9b1b4cd9c3f2ea4195c5b00c1c718619021e53cba03bbaeaff086869ad168feb3b624a9f12ac1e91fd61acd5230820a6c10bd61f09
SSDEEP 768:nfX5c4/QhSMnUNmcL+Q2QzDr9cHSiU3p4rwVdUEc2ZI8DmG94kDvB2pi:nv5f/Q0GmL+4KHSDy6sO94kNIi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

36959

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord4622 ord4424 ord3738 ord561 ord825 ord815 ord3663 ord3626 ord641 ord795 ord2414 ord686 ord765 ord609 ord2514 ord2621 ord1134 ord5265 ord4376 ord4853 ord4998 ord4710 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord4234 ord2575 ord4396 ord3574 ord3721 ord3571 ord3619 ord6055 ord1776 ord5290 ord3402 ord3698 ord1146 ord1168 ord384 ord567 ord2302 ord1768 ord5943 ord6199 ord858 ord6215 ord4299 ord4160 ord2863 ord2379 ord755 ord470 ord535 ord4278 ord2764 ord860 ord2820 ord6805 ord941 ord690 ord1988 ord2393 ord5207 ord389 ord2642 ord2862 ord2096 ord2123 ord6442 ord2116 ord1641 ord668 ord4080 ord3181 ord4058 ord2781 ord2770 ord926 ord537 ord356 ord939 ord922 ord924 ord4129 ord920 ord5933 ord1105 ord3089 ord4476 ord2818 ord3610 ord656 ord4275 ord3398 ord3733 ord810 ord4271 ord2864 ord3303 ord3914 ord6008 ord4000 ord3297 ord3290 ord823 ord1929 ord3573 ord3797 ord1200 ord923 ord6597 ord6650 ord6591 ord6807 ord6857 ord6823 ord6855 ord6832 ord6859 ord6867 ord6847 ord6814 ord6839 ord6846 ord6858 ord6816 ord6815 ord6812 ord6845 ord6856 ord6808 ord6835 ord4589 ord4588 ord4899 ord4370 ord4892 ord6817 ord5076 ord4340 ord4347 ord4720 ord4889 ord4531 ord4545 ord4543 ord4526 ord4529 ord4524 ord4963 ord4960 ord4108 ord6054 ord5240 ord5281 ord3748 ord1725 ord5260 ord6614 ord6691 ord4432 ord6478 ord6514 ord6800 ord4284 ord2233 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord4673 ord800 ord540 ord3811 ord861 ord1980 ord2614 ord1576

msvcrt

__set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _setmbcp _ftol __CxxFrameHandler sprintf atoi fclose fopen _mbscmp __dllonexit _onexit _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ _exit _controlfp

kernel32

GetCurrentProcessId DeleteFileA OpenMutexA RemoveDirectoryA WaitForSingleObject ReleaseMutex GetTempPathA ResumeThread GetModuleHandleA GetStartupInfoA GetLastError CreateMutexA CreateDirectoryA GetCommandLineA Sleep GetModuleFileNameA lstrlenA GetPrivateProfileStringA ExpandEnvironmentStringsA GetVersionExA Process32Next CreateProcessA CreateToolhelp32Snapshot Process32First

user32

SetWindowLongA MessageBeep IsWindowVisible SetCursor LoadCursorA EnableWindow SetTimer LoadBitmapA KillTimer GetSystemMetrics GetClientRect DrawIcon GetSystemMenu AppendMenuA SendMessageA FindWindowA GetMessagePos ScreenToClient InvalidateRect LoadIconA wsprintfA GetParent IsIconic SetFocus GetSysColor

gdi32

CreateSolidBrush CreateFontA

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegEnumKeyExA

shell32

ShellExecuteA

comctl32

ImageList_AddMasked

urlmon

URLDownloadToFileA

wininet

InternetGetConnectedState

shlwapi

StrFormatByteSizeA PathRemoveFileSpecA

uninstall.exe.nsis

SHA256 a9b8fa9716ee41ff2dbd9605f076fb8c2cf0afb2a7570e0ffaa947c2ab088f7a
MD5 7e7ebad96fb13fdf00b68fa851f54db4
SHA1 f04e7676d8ba19c0f69856a0d536c8c04baa9011
SHA512 1171eec08da1b0a2543298778ee63f4f0d59f7f1d2eb45bed3e66ebec85f78f8562a521414a13f55fb83604a53ddb37689a1bf9a6e8f3be3a1c0495d6074fc92
SSDEEP 3072:VSpIcE6rF6vnV2HsvAoAewxPg1JrMwuyeTUXZgrgTsqYLiqcYqt:VSpS6rFcnVAsvp1EUXZgrOsqYLv5+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer