f986988349d4ad5da351a9a1e424a1e4_JaffaCakes118

resource
f986988349d4ad5da351a9a1e424a1e4_JaffaCakes118
unpack001/$PLUGINSDIR/EBanner.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc3.dll
unpack001/$PLUGINSDIR/linker.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 4b2e88d8e30e7c377fca3fedfe5c26d9fd8c4688d58af999984b6450b504a1d7
MD5 f986988349d4ad5da351a9a1e424a1e4
SHA1 328830def981708ee93e12ed9f15e8ee6d4e994d
SHA512 2ed5aee3b9c5ba219afcde1b611fb8e33928e63cf1d93650d488292d49b26a3112099a4813b4128ff05a479fc4d425e28a753b801693887936378e1af57595d2
SSDEEP 6144:eQqA1eyy4RjtX6t1pUUg1ZoNYP/fdiP/G:l1eoRpK1UUgzBP3diP+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/1clogo.bmp

SHA256 8757ff66d03c7e8cdf429ab77e1b648064a34bad4c28f08f08f5770f05fe02db
MD5 fa3a4bcf15747bd465fb9b4afb273df8
SHA1 14b284b6e1552a9509089e8f4319e455a6e2896e
SHA512 04cd28b65f2f1eac3fb7d098e4e365ac23393e6fcb8393728b0baf24af3bea98570aa4c72033b8c7f23011886d9689b798f1ecb76f2d7460e64f4707e165a7a7
SSDEEP 384:HYmpb5ksAkrrXKUaAhSEWy05fDh4OW57RvhgUvNvFb2wjlqRw+V:LVrXZ3WGOY7Rvhdvk42
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogoEZL.bmp

SHA256 ff0e4e60d925761c8756c4bb93186855061b1b0008a2fdf735cd1a759709a937
MD5 0efd00dd1adab09815b57590db57a6a5
SHA1 401d0e7747f0c5f3815816f62bfbe9b25611c07e
SHA512 429f3d039b0a99b0971f857c4cc8391fe22149647ed0c20d57224535cb50436a35ba2fbf10ad1cd1125b8a1e30a69e76307835144b3487bbfc1c8d2af4291045
SSDEEP 192:8h04oH9wsHjzqqaF8tREFKcQtqRpaI55ZnQI5Zd34nCbiaoG9ffffffffffffffn:8hyFRHcPRRZnQI5Zl4CWaH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogoFTT.bmp

SHA256 4b1ffc812e389761479019b929d34a4d11323caff958fb8a74487342dfc5dd23
MD5 841fd20364e4c2442cbd5b99e2a4e4d3
SHA1 e5d4b7957ce0706a4c1c756309554c31d6be5e07
SHA512 2bc69c4126120a5ead1d939bff448b959d74bb40fd45cc0471f3603035ef1b944faeaa41136c52bd7a3a757ed9d9ee77cb6808623a88e0814dc1fc7c12b44768
SSDEEP 192:7CPt+RNU/YcsEpDBkM+wPqZn333mQIZfytmphbSe4eCbuwJG9ffffffffffffffC:7qBkMjCZnWQYj4fiwL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogobvd.bmp

SHA256 7abbcf9dcef25e533289c967ec3330cb06ed2927c4fb36f6f19532cc0f4461a2
MD5 506e489f27f3d29defcbfdf759b3a30b
SHA1 0e740fce17bc4c906dd6b04e9ff2c58fbb2fe247
SHA512 14f6914bdd6e5a47ff5229681fc8fa99173436961f76b6108611c260b0a2b235cf3663dd8e1f0705432d721cc94600518fafedc2afd968bb796179436d0fd859
SSDEEP 384:ckMvPdF0NVWm/5XBtnZKGBPLTdCZlYwCIKU3Qn2KHW:IPT4W7+4QnDHW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogoddd.bmp

SHA256 717014c684877eff0bfa3fafe171384c72a9ab894fbba4597952e838db0c56e5
MD5 fe15006fb2637409ca01ba8d76e7622b
SHA1 2f027af5d1423602030619e677bb23e46210baf1
SHA512 1645166d43d8b1b2540049e599af875743184687a322046fa5c0d365696bde9654802b9d996b69dbdf01d3ffef11d710b0070c922ab8fbd81576ea3598349291
SSDEEP 384:Q2VWdSweTWz/8YKfpurJWle5zEtJcE8xmIyK:BVWS/TWz/8YypOJWpcE8UK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/EBanner.dll

IMPHASH c759d72719f57a6b126c48a6fe97f6e7
SHA256 dd519ae6d7fd6df0c32db834df215df2fe7c1d044b800922a58da7f4f00b95ab
MD5 cce7bc13dbc3faea7769fcf7727eb19f
SHA1 59633ed1adc02235ca058883534ff36be4fb3f37
SHA512 21e4a8ecd383d59ef24f590367328248d21c7fe452fc5c3a42ec597f920e79caf6a8047babb9fb44d2cca8329dd7d14b39cf13a0934aee409fa5bdd7c2e4f121
SSDEEP 96:9agsHJMYSzHl+I3tFGLafz6Dy/qCWDIH7:9DspmHlv3Lnf0yiCmIH7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IM_tb.bmp

SHA256 bde5d954c4739fcdeab2ae4218bd0c22f3b8d6be159bcdc75a950c43131cf477
MD5 b761dfede17221f5a9832096f9f4de0f
SHA1 d37a0f584fe1897add707d3a3e1f13181285f8e4
SHA512 fca046d83aed46cb4568e61475352b28c5ab9c5f531fa41b2ae4d1c3686f083bf742637ec4a42d1db22ee87f38fdebfb149adee52ae85c0acffe4af471126153
SSDEEP 96:wdZaWwzCUmvv/WMDWf1hAYaZ5FcrpspQrT5eqq5CL9Kp:wOXm+odXFIiQBreCL9Kp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/accept.bmp

SHA256 7baca1380f469042514a5fef60dde2361aa47e8bb0fe8e01c1ec175d22c97251
MD5 d2b45ba831902d1f030b7090682cfa1e
SHA1 398c9098d01b3d333ed11971cceb4d685a561814
SHA512 c195b1aeea3b35c111750ab423bbdd4c03ad81701539db77961f079eefce80da013ed1341254d38ea819528ea50e4de5236f2e9d10c4f7d7eb17db65d70919fb
SSDEEP 48:Fg2Cnww2i1SJ4Gw102JLDJ111hZKtZVpPjB8kmM5vfr7GDoxetl3g8uZ:Fg2OD1SW02JHF0tZVpmhM5vDaw84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept1.bmp

SHA256 114c238c17d1cbc30e0d1f30fc5db00f6cfa579d27f755b6494bdcf1687e285b
MD5 cec7eff3bd27fb989b1862b65cf92bef
SHA1 4b61a2778f759e8b6c5c5fff51d0607455528480
SHA512 2bfad999a07d4126a83772af059af66f97a1a3e2156e486309639c0d7efcaed57933faa80f295429eff2cbcd450c4851d191e2f370ebed06fb45a12dd922a1b0
SSDEEP 48:Fg2CsF1wk8ig4C7Q10DGG+D9HG1111jZgHI5PjlimMxrhoDUgt3g8uZ:Fg2l192G0DGB9syH45PMdhwLe84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept2.bmp

SHA256 f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
MD5 f642e8cfce23aa5d124533357de7394b
SHA1 80ce98a2bc4b416db357ea52a74424d742cfaa55
SHA512 d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
SSDEEP 48:Fg2CsFXtwOW3iC4CnE10DGGiGpUDQ1116ZlNCmNdFIz6PjfmMMrhHDaBr3g8uZ:Fg2lXtJz50DGXGUZrUmND3yMShj/84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept3.bmp

SHA256 b77cd138ed85e75c1e68d8c4709db2b4bdee1cac79cd56fde3d10f9c2199ebd9
MD5 f9fb54ee9ebc5ca38459de73f3055784
SHA1 d2e58aef1bbebfdf4265002b12f402fb805d2bce
SHA512 f821a21e77be530db3aa0b80cca0157f39fd905f1546a85ee94b3ba6e28cc91fe186cb43cd8684bb6306b249ece2e07552655b03c11195c854689e308bd38b18
SSDEEP 48:Fg2CdtwWoiI4E10jUDK1116ZuWdFv6PjImMxrCDYV3g8uZ:Fg2ctvy0KrUWDChMd6l84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/anon.bmp

SHA256 5c42a00a748751ba9c1a1c4368cc24ff496312e79f044e60c9f2deadb4c805d8
MD5 a47a7ad599235252a67fe1e07d8b8384
SHA1 859b64bbd15d262431c839941e17714c2b9beb24
SHA512 80e3efcda521c7925a657f21b73fb4aacfd0fc4b41b24dbebb949e98ddccdac47ff44e4b3629e589833cb426e5203246e5f5bcb475f384c77446b5e5db87809c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bab.bmp

SHA256 884982b7af88633b71af65b0dba0e979088e628b33db4aac43ea458f2d94729a
MD5 f5f91b6d3443cc2fa5c4bd4728e78199
SHA1 f37c18381cbd141af3aa944eef58c28d76c09708
SHA512 a6da6b4720bf29e129fb94a674d185e578fa69e19a5023c97bb3dc85a5b2154f7d927d0ec3be1846314f550cb972605d518c336cc46180d30bb6c7182ad26bec
SSDEEP 192:VOn9I+52JSnIuCy8O0M+EKOJeuzbvx/Rkj:4n9ZlnZCy8U+/OPvFuj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/buzz.bmp

SHA256 54790dd24b9816a92eb517db6521b5278801bc30f68ffce546d2fab71ad9f327
MD5 9bf2c31ad1b106d1892ed521a1dce3a8
SHA1 c0ebc07b7182a526eb3ded9a3d35035da7c90f89
SHA512 e951458506efa4b08c475efce0ca746c3a4dc09534bb5b4e44162fb466b72d6b4741fc8844f554d85ac49cb563302dabf495919a09c60680cf89a148aef2d829
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/decline.bmp

SHA256 eab3f8b4cada67892acc64a6233742f1c81d1709e7b5eca06672378a9b54005c
MD5 4e34c7ad18913485c49528203402b4f1
SHA1 5d3229b72f7d8203c6a3e4bd1dc36337589a8be8
SHA512 8fbc89ed67e5a932591f62dfc7a095f9be65c5da5ca037c2b7264d2e5d7137bb6601da527d53c7559afeef85b958ef934e851f3fc42b2a0a8d84ed794f7ece07
SSDEEP 384:Fg7wXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7X5:FrXXXXXXXXXXXXXXXXXXXXXXXXXXXXXl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/fm.bmp

SHA256 33bf90bdcbc88567dd6c09ad2b2ca921dffa4ee989c789c6236b7caf2fdf0296
MD5 d88799a8c5f28f82829e6867a08f6398
SHA1 8268f8398365f6d1cac08a16290381d741adc30f
SHA512 003c3e922c87cc8c5964b126ef1b8d596bae07af6c855a43742deca18f1b59b887907739b7195f6e7ff764c29a5642f1c35a0aa50d714be2d2d1365843e4adab
SSDEEP 192:9o+3I8WEehtJC0y1ax60fkBsS/kFOAaehQF:9tVW9he0wax60fEsS/ybyF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inc.bmp

SHA256 1052eb7642dbaf990d4d2ffe584afd809dd06d918c9fe37b95323d14a877f16e
MD5 ce1b4ff27d6c5da979328e3fca113ec4
SHA1 06a504a9987ac715a621dc7cb66be09fbde5a878
SHA512 88887192110ce5bdcd256b85a20b2c6c13e4ad92ad59e9d156e53f05a1cfc34e18ef3782c3db81bac765bc1947ba6fad067609d32b9e626182575d48cc639bc4
SSDEEP 192:IatkIkb/aPFKgzfcOqg5Io3p0KPz2oAe1l6yThz:IatkIkrKFKmqmp0UqwldVz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc3.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
MD5 9d8ce05f532dc7b5742831ec8a63c2d8
SHA1 b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA512 98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
SSDEEP 384:Aj+e6b0GUi0VV/0BiYkUm4i+Hr4Bc+AmPiMUTMF620Ac9khYLMkIX0+G2CykiDM:Aj+e6byNskUbi+Ly8xMSMj4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

16031

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/linker.dll

IMPHASH 5b9be84907034b8f0152e51177ceafc3
SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
MD5 8450b29ee8d592c208ba1aaf6ee50267
SHA1 75096da057bc85cef63bb0eec168652ea75cf618
SHA512 d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039
SSDEEP 48:q/XgJspkvsIWyuS3fyVLkmqbIWXGuDNcGo+FLtLFSfrPIk2vIhll:4gJsFIWjS3qVomqIixo+9tLFUr4vMl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sIM.bmp

SHA256 8ab1be3ce78edfefd29fa82bbd1975d5af523ab20021273f884ed9e4bf871065
MD5 7d4dc66722957817cc5b680f36921445
SHA1 6e9c416eb750b5f42b9caca8e67e17bdc400c346
SHA512 8d03b88c36abad98d27d5b5e414707c7316b1c90d53a40e4c1ebe8c1fbbc6a3fb3b4809ad660a36d638f438015338515d7f31143ef1f50362216d65a0b3e3198
SSDEEP 192:HMDtz7OdpX2Ypl+DFNLB1vOLdsWwsrGaF:HMDtgpX24lcFNLvOslKx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/save.bmp

SHA256 ffdad025bdc9d97e6c1e93988f00e7f7f31e4aaac08f4b90b859d42c367c8880
MD5 4dc2697be8fa3fd4aa385d73ba500443
SHA1 fe7b27b85b1f5c52798b94e286efa830e539164a
SHA512 7c7524faf84d5b4d7d742eddad560f3a5824b19ffc258247845959ea91cb169416c55a64b46b5f021020ed352ac9cda657408a557cbd4ae65b4a8531a7a36930
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/skip.bmp

SHA256 a4acb445bdc94b951334ed467a3d165446457487f70877f7554e1d8e7afdef58
MD5 f2f64c5809be74da2dfe6e0eea5a4242
SHA1 6ec394130b6ef5fa5945c629f1aa157cdbde9814
SHA512 7769c5fafb26b07d22227c6d9d5e12082d2a0f94584c174f9cf41165bcabb2c061557544fa14e421433f3cac8b0ef9a5aa2b797ddbdf5a12660e89c40e3ad72e
SSDEEP 384:Fgye5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA:Fw5XXXXXXXXXXXXXXXXXXXXXXXXXXXXA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/yontoo.bmp

SHA256 98c055f90270f338716268f2e9dafe04f04d42abec9b36d336845fa6b65beef7
MD5 1f9c8d700b45338fed3d41baffcbf9ab
SHA1 f7255ded2c4ee447c2a21879dca04876bbd21048
SHA512 e310269643cfd19c595f4be1577d85a8298118294fedd9614ed3519dc6054c736f707fbe8353c1afdaaaf117a0e6aea5e24dada4aa93b1634c4ea35bbda4e2aa
SSDEEP 96:tg7tBYPQ9ZS1q4Xf5MQfjP5vzI0qykxinSySXhcsSQHP:tg7t+Peogw5rtdwwSR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe.nsis

SHA256 131284804a32dfa512d9386ca5c02f07f9aeaabd96bbf05ad8c7ef7f82fb108b
MD5 ae03f3c95333da90ecc61b43da272f15
SHA1 0e822a08cc08ad027698e9a23f3806769d004025
SHA512 62ef58a9443e81f5076e1154463fe9a8fc2e98a970f373c8e697bc7fb35dbccf3f832b4c5ad615906c41d3aa9e1d051333b33bad6bbfd4721aae3f17cd106063
SSDEEP 384:DnWvsOgYiePpRqmU7qsubjIhJuwb4xklCbpJ:avsONieP/wubjIh0M4EkJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer