f4ed82101d7f7ba519079ea91d3a4c18d974d72ccc0dd63747c33b0aeedb82b9

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	UPX

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	upx

resource
f4ed82101d7f7ba519079ea91d3a4c18d974d72ccc0dd63747c33b0aeedb82b9
unpack001/$PLUGINSDIR/AccessControl.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/CallAnsiPlugin.dll
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/Uninstall.exe
unpack003/$PLUGINSDIR/UAC.dll
unpack001/lzma.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 f4ed82101d7f7ba519079ea91d3a4c18d974d72ccc0dd63747c33b0aeedb82b9
MD5 61929454e676a70007a6c5c3ac3cd6eb
SHA1 4ab14feaa6a48c51ddacc26fa4b413882c908f20
SHA512 1d1ce809fde313f38e100e312e65eb7c70924e36e09c1829a95efab7eecf14cedf38d0834252b81d123fab2ac30824aeeafb2067ca94962a5b8175796f709f55
SSDEEP 24576:Tf+k29Hj7FoYIba9AMLJwMLIZCvFppMCJxMfjCGchGWcsYV3zihNOXLJcQHbijIe:Tx2zoUhesA0FXM6Mfj3iXMFcQHKemP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/AccessControl.dll

SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
MD5 9f1a88b953fd2a2c23b09703b253186c
SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX dump on OEP (original entry point)
ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

33616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 39b62bf74ace31d2d8041bf1748e3d83ad0b0b674dc7600b651164f748a38667
MD5 5173088bda257c4f549247031a21caab
SHA1 e6f3c1c3b1d5d53f6adb23cf9a264b8f5d0dc479
SHA512 01f14c768ba2f9f11c5e344ba44b75dafe486e7742ca8896e0a985d80b71192336e2472f7a2be17801fe0c753bd1eddc8494af53dc436ab727ed3d0fa3c7ae9f
SSDEEP 192:ThzPKgdc4SN+XIjjAZaK26N6dlJmclFcyw:ThzPM0/aAUF9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CallAnsiPlugin.dll

IMPHASH a2c206d70a9ff3e532fbe87e0d892f57
SHA256 2703314a0d03377c6774dad865c292d4808bc4f748871f16f142c09527c5e617
MD5 c8ff7c87b591958cb1970a7d89b9839f
SHA1 9d34a40b574eabd6bd321c976a13ab0f4d0ef236
SHA512 30a0cbefced3d1d044067e188fedb1137b1734c237ed9ffe52c009c46600ec081610e2e861074eacd5bb6252e20136bd13a800ce5704b39d2978571766dec13f
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4944

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DcryptDll.dll

IMPHASH 5e1d3f49e5b7590e18325930cd3084f1
SHA256 f730d9385bf72eac5d579bcf1f7e4330f1d239ca1054d4ead48e9e363d9f4222
MD5 904beebec2790ee2ca0c90fc448ac7e0
SHA1 40fabf1eb0a3b7168351c4514c5288216cb1566d
SHA512 8bdbbaaf73e396cf9fd9866b3e824b7e70c59a2bdefdb3236387e60d0e645d011265fe79fb193f6c0d6abe2e9c01260720c71cd8f068fcc4624760511c54efaa
SSDEEP 192:apY9VuCnNCbs8dNyHdrvr5T1KEtx/9ehuhiDTUkSv/DxRyeHk51I7n13Xm:aptMNUjyVvGWxauhiDDS3DnyK7nF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10183

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH e2ee55bddad4241d619d6a8a38e2d869
SHA256 067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a
MD5 0d45588070cf728359055f776af16ec4
SHA1 c4375ceb2883dee74632e81addbfa4e8b0c6d84a
SHA512 751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415
SSDEEP 192:ob8cSzvTyl4tgi8pPjQM0PuAg0YNyhIFtSP:mBSzm+t18pZ0WAg0RhIFg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 0b75f1007d3cc8e457970ae3e3fd53c3
SHA256 7b51372117960e84d6f5eb3a26810cc044ff02283b3d656a0a456b0ab5cb8ea7
MD5 c5b9fe538654a5a259cf64c2455c5426
SHA1 db45505fa041af025de53a0580758f3694b9444a
SHA512 f0f8a5570c01b16e54f47502e867ffbaf162b44a847c0ffc8062d20e9492114229de5d9d2a836da256fd3f9fb493536bdbf148d5308695b16c0e98d20d8926aa
SSDEEP 96:xr7fhfKaGgchPzxK6bq+pKX6D8ZLidGgmkNL38:xxbGgGPzxeX6D8ZyGgmkN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

1.dat

SHA256 4690ec382839714f27eee1007e6ab004ed8fe4b948d3307d930d097af87ecb06
MD5 26eef65dccf278716bdc52a8a2fe2257
SHA1 002099ef6f1c11956b9593f7e56d176f220b8cfe
SHA512 281f076713754386ae55795fd19cb57de27add0be5baa299ec201925af994c1859b8cb7977046651167368702239c2135d904587fab769d80fc1e722c99db8ac
SSDEEP 24576:Q29Hj7FoYIba9AMLJwMLIZCvFppMCJxMfjCGchGWcsYV3zihNi:Q2zoUhesA0FXM6Mfj3iXi
MD5 SHA1 SHA512 SSDEEP

2.dat

SHA256 39874eaaed900fabc1c6808fa97c8c8765475ab66f0fc797584bb8fcd3bfecb6
MD5 41185be8006559ba7e498f51c36b2bb1
SHA1 473a77c76b6849781ae17bbd76b782403f889650
SHA512 b2db9c0ac1b39a9d97a4148f81afe69be4fc6cfa081cab99da60566502df35b9968ed1bbc72e16970a632e33d6995ddad01bc8d7dbbb7622010489917f46e9b2
SSDEEP 768:2N2ciaBs1hpTsKte5e1nW+PhBfjF54xiBRzHUN9iuv9RC+:s2B8sRQIB1nW4fmiB5HlId
MD5 SHA1 SHA512 SSDEEP

3.dat

SHA256 e0a6ac69ded7b38d24f1546860595ea0b23a9268d779ee94f9d7fbd7c196d612
MD5 7c6f1636a470b3d17fd33d511f205083
SHA1 11dcd1df0a4009faa517adf6d3daaa2df58932af
SHA512 b48329525430ab3040365792940649df147aa520a3973460f7e226825d862a117a839cb3b652ce816dadaeef52e718657debad9392cee1dc6b322a59b59cbbd4
SSDEEP 384:erXFqdCFiWR0FyVsjEaCzAvk2b6dG1y9SXZ75CadlAH6ehBm:eT06ic+yV+H5J/2i7cQlAz/m
MD5 SHA1 SHA512 SSDEEP

4.dat

SHA256 89aee113fe6af50433e7e1260cde2182323e6a4ced2f240ed62eba8e67509237
MD5 af18e37061b0a6c9886bd25810ba53c1
SHA1 2026be98ec81b37e8cca84ebbf352265c4016ebf
SHA512 30cd1247fb610266ab9e27fc35065cc28814159cf8ead14d0f4a1072ca582c7b77b1007ba5ed524802bc0b83c5912cffa5cb162caf092a9fc3f03d658cc408a4
SSDEEP 12288:QXemxtJT4Qw0hpigCIaR1TIz/ZvKBFfWcef:QXLJcQHbijIaDItvef1W
MD5 SHA1 SHA512 SSDEEP

Uninstall.exe

IMPHASH e2a592076b17ef8bfb48b7e03965a3fc
SHA256 a205001713f20e7f40c3ca99ef8420e7f25aa3f30dc12da9da4bb59481d1fabc
MD5 bb4c8549a67b898f86b7d0238b6a5bbf
SHA1 c772d8d8df704a29b914d62b3cae619b2613cee0
SHA512 6b7f76d0b82ca6b2edad1e53b52966c594fa45969a0941a145bb7df326a1bf74fcd8e8a5d59587b6da9b0512251908400eb4c496a961987349fec53b81a172f5
SSDEEP 768:/nYYHhho+VUkSko1SJvs8evqUlwPSGiVKu0plz1iqc5rQ9NCC1VhsL0adHZ2ysN7:QYHhhDWkSkWIGq4wjiKu0P16Gl1Vh71
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryW GetFileAttributesW GetFullPathNameW Sleep GetTickCount GetFileSize GetModuleFileNameW MoveFileW SetFileAttributesW GetCurrentProcess ExitProcess SetEnvironmentVariableW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW WaitForSingleObject CopyFileW CompareFileTime GlobalLock CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA lstrcpyW MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GlobalFree GlobalAlloc GetShortPathNameW SearchPathW lstrcmpiW SetFileTime CloseHandle ExpandEnvironmentStringsW lstrcmpW GlobalUnlock lstrcpynW GetDiskFreeSpaceW GetExitCodeProcess FindFirstFileW FindNextFileW DeleteFileW SetFilePointer ReadFile FindClose MulDiv MultiByteToWideChar lstrlenA WideCharToMultiByte GetPrivateProfileStringW WritePrivateProfileStringW FreeLibrary LoadLibraryExW GetModuleHandleW

user32

GetSystemMenu SetClassLongW IsWindowEnabled EnableMenuItem SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos LoadBitmapW CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard wsprintfW ScreenToClient GetWindowRect GetSystemMetrics SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow LoadImageW SetTimer SetWindowTextW PostQuitMessage ShowWindow GetDlgItem IsWindow SetWindowLongW FindWindowExW TrackPopupMenu AppendMenuW CreatePopupMenu DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetBkMode CreateFontIndirectW SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW ShellExecuteW SHFileOperationW

advapi32

RegDeleteKeyW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegOpenKeyExW RegEnumValueW RegDeleteValueW RegCloseKey RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_AddMasked ord17 ImageList_Destroy ImageList_Create

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
MD5 173391c2c5228607d99ca65f29c8fb3e
SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
MD5 SHA1 SHA512 SSDEEP

data

SHA256 ac0600c3696d47e12fbde63f3757214a81fbaa343aeebda9bef5f5573af49f13
MD5 5d5d4de10732fa4f85413bdb9d651643
SHA1 fbd00772ec4a5714fad24c3e9a603843dbdaafd2
SHA512 f7be552693d7aca3f7f4cac83315d691126b88f65e0af76085867a80a4c92bb3f39a41906395ae8dbfe110ca474b01c643c4eae3348ef3b5b9199a2b147451cd
MD5 SHA1 SHA512

lzma.exe

IMPHASH 725d7c328da8b5c7989b84fbe16f738f
SHA256 f776415281ed68268577142b60839d0937c112be1ba0fb8470f5a387afc3ba62
MD5 1c4d758c0954e843d2fa22703f653421
SHA1 d577e6f63cb53f5f68f094b9fbaefe5b0087e933
SHA512 5b8c02473b8f57d243cac5ae1f5381a9a1dbd55bc976a172f36060b2d0c2ad80d4f956cd38d4ba7434b9b27583e0e753bcdb8b4772c1c54e926b365c90357c3e
SSDEEP 1536:ax7F8DW6pErklzKbDir++/McTJctWOrLRCIbDO+9a:akDWTrMKb2MFQCRCIe+4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

59404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer