fdb196fa39c5df406a77c82f4036f6bd_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsRichEdit.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	upx
static1/unpack001/$PLUGINSDIR/nsRichEdit.dll	upx

resource
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsRichEdit.dll
unpack003/out.upx

resource	yara_rule
sample	nsis_installer_2

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 118758238637f66385c493b98cdd53daf77a7e7bf9f7ec1023c3cb46c39d2580
MD5 fdb196fa39c5df406a77c82f4036f6bd
SHA1 9c310d0aab3659006fa4c8f066581fc2ffd7a32d
SHA512 11f3926cd32f9feb80f1de55fd1ebba7d354ca3b6312e07903c812992c51f22aa7fe2b3d400d20296df3c6becd753119daa48f67f09be341b8ae80bf2bdfc35f
SSDEEP 3072:VxFM5spM4P/NEkxhJR7aOAYXTQempzGWchGKR6bFllBwV6AuJJzUgLyBQ4JVVoDN:UAJmYt7rAYX0LzxLDi4yBFJo2i
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

9e:dd:9d:1d:1d:26:58:08:59:ca:19:a4:47:45:e9:c9:e4:d9:01:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=IN SITE GROUP LLC,OU=IT DEPARTMENT,O=IN SITE GROUP LLC,POSTALCODE=49000,STREET=GAGARINA AVENUE\, 115\, OFFICE 20A,L=DNEPROPETROVSK,C=UA

Chains

Jun 19, 2015

CN=IN SITE GROUP LLC,OU=IT DEPARTMENT,O=IN SITE GROUP LLC,POSTALCODE=49000,STREET=GAGARINA AVENUE\, 115\, OFFICE 20A,L=DNEPROPETROVSK,C=UA

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=IN SITE GROUP LLC,OU=IT DEPARTMENT,O=IN SITE GROUP LLC,POSTALCODE=49000,STREET=GAGARINA AVENUE\, 115\, OFFICE 20A,L=DNEPROPETROVSK,C=UA

Serial Number

bd:73:94:af:91:5e:f7:87:0c:93:e9:c2:a5:45:b8:00

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 18, 2015 - Mar 17, 2016

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 5, 2015 - Dec 31, 2015

Minor OS version

0

Major OS version

4

Entry point

17323

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

264B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/StdUtils.dll

IMPHASH 2c9af842676b96750379e168992b2ead
SHA256 93530c4c3cfa4a6c87671050a52eb673228a597e9052622e57bec02fec5328ce
MD5 62cd3e9089314d24f0817c231dfa859f
SHA1 907fc4cef9bf22b3814dcf1cd06fc2b3c3ec842e
SHA512 ccbe4f18013fd1055ca575d15faec1773268404b5dd1af40de865b39bf18457ca8d9078d3d3932fffdcebb5e76a807adce39b1091bda897ca53d60c6798fd041
SSDEEP 384:1DBI+2XKPdeyYTpLhDaSR61M01rP41WKSthVGBJwSAkBMyO:1K+2XsdeyMRhOSRAn1wWXKM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

9104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH a576be1e9e1e488f8ee747d4b18fa7df
SHA256 5c25a47da05d6ec943baec00977aae4825fe06db370b765afc1a5d39670ccbe2
MD5 e7143c9655d4d4a9efaa578748c6bc45
SHA1 f8ac5c6ecf4847e1bbeafe021881a46e20f09e7c
SHA512 deadec14af2048188ae6c56cacec0fad9e9c86bbd352e664a999f2df8d0cef23575e6cc85bdfdc5105d69f5b0bdcca95a7b9f052f31676295ab6e3cae01cf8de
SSDEEP 384:EjuFHgNpQsSBO9+N5qoNvRjEJMmG+cGSjOBhpVPY8cCBfbwdxc4:ZOkooN6JMmGU6OBhbajxp
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/inetc.dll

IMPHASH 389abcab5eb660264df56ed18f31520e
SHA256 2b7a69e98ed4975fd4eade513cff17099c43b3eebe7e7641696d1d20e8e14b2f
MD5 29e2dcdfb57ee3ab5e2bbc2fc3c42f02
SHA1 bd6cafcce5b70ee15311f9f53e9fd4aac819ccda
SHA512 f71c981b3b5308566b56156462d106ebf8e49a32e55b70891f9d70338941afd347cb4df374fe38b9b3d7309f63dd75a7c80ebe02bb8941d558cd638a6f8daf7a
SSDEEP 384:ViY1+aFplLBSgN9afuzwZAEecpuB3NVeMUPOSya4fa0Ac9khYLMkIX0+GGxky8oO:ViY1+a3e1mwJKVSPO5a4fsO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19041

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

memset _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul _mbsstr _mbschr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/license.rtf

SHA256 58606a097a62f50c0b52d9003c591e7b943afd45f821c590c6f548ecb4294d95
MD5 335e86da2f14164b7967bb13bd55ede6
SHA1 754059d45800e5b1e9f6bc67ffb6a7f00c197144
SHA512 13bcd69c7356fa994cf526cf63e6f7a3d057857c6c3a95f453946fb0a8db2d5d58e84be336183b8dbaa1ade13f900fcdfdac7f0f7d7e000013e8fadafa7af0ff
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 4fb4d15e957b6564bf15c23e80f0202a
SHA256 82e21860521feea4d15ff7f30538b9d0ed1860747c98549ec85217178a6db632
MD5 66cfc94903c8cfa492fdab42bde2026d
SHA1 d07194419d914eae5dc54a480ebddb0a8cb32f25
SHA512 ecbc2c9361bef9332fe8e1675d11884c344b26f437eee9db3ec0b5999bf20e16b1d863c192e2091375a870cf8f4674deec16875ba56757b88cc859288305eeb7
SSDEEP 192:mMmfEKSweFA9/H5aE3KRmQv295JrbQMH2klPdIobEEdTFdHg:OfEBwe+VH5avmQv29XrUMHVlPFEEdjHg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsJSON.dll

SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

32816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 4d7e5fd6876faf344ae0bd745280d5177788042ddc19142c97dbc9c28dc4de2d
MD5 b101a98f76cf132dfc655824d87b295c
SHA1 355a198f8c305b9e1bd84400ad46ae23abdcef34
SHA512 184d0c6a37d7a069b70aca58ad77e9385e091e69566280c84f19a480f03ba59d94285acc9b21421513e3da4c1e1c81fa0c3ba00ab58023e1206bf9a7a2270b15
SSDEEP 192:YWDCOyGwZKGCH81xyNFZOcmNQdZiiYpDcr:YvOfGCH8TsFZOcyYZirc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRichEdit.dll

SHA256 f00bd6d3e7c7b8e8ad18b7dc6275fb80cc720fb164200a6506f50f6e66998b12
MD5 02f1858b3131ffc3fc5e3a5391d3a489
SHA1 454a6d749cf55ff990bd9f57941aca9d1f1674f6
SHA512 8147fa8014a5065f4fed7de1fbb9c2ee2c1b94d63596f7bbcf6821ecd41a73d25ebdfa1e71ca74d7598cba063042b6dfcaf050a23d0c855a7b6fbc94147ab41b
SSDEEP 96:Z3CA+/dN6g2Aznq+1kaNar7ta6mKAJN0u4KOhB7lkZ3hBjB8wZ:Z3G/D26EaNar7QKzLdZkZX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

31120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 639c7bed82ae97cd15ed07ada74b3665d996164b05c2799a7b1f673e21a36ed0
MD5 12d39a8db6f35d86337a545cd850afd8
SHA1 669612f56703c4058e5265dab73a4d713c19da84
SHA512 811ae00441a23f23b0588cbd19ba4c31e8021c4e2197ba69c84531b6b32ebfbca38c9f4f1a5fdc7be155a29bbf56ba55d450d335df41da6495a36a98d4d71a3c
SSDEEP 96:Z30Sa1ZTB0XzNNwJTV1Kl0RYjDflWIOhB7lkZ3hB:Z30Sa1T0v21KyRoqZkZX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/360TS.jpg

SHA256 8cf3ade71650eae84bab4082e7d0d0b051c33d64a018bbfe1d3d4841859a8ac5
MD5 ebd5f9305af3e74d1b2e77b88a541d63
SHA1 b82655ec8e3fe4e77b8962a8eb6e6f44086a21c2
SHA512 51b5a8a0ab78c6e247aedba54ecc663680bd91ef74ecb4a876422979a49cb2e7ea67476f07cbe3f8323400869b813f6fe1b8b810aae350be976003d361aedfc4
SSDEEP 768:cIs7ANcL9le7C6jf2sXqguHz1/rlo7fIXJgAa1Pg9R9JKBA9dSK2t5qyjmM:1sENca7C6jOsXxuT1BobIZgFtgP9JKBJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/opera.jpg

SHA256 cf8d309b8a50ef970d5b84a4ce0d28d855c8a63f221c6d31de67bcfef0bb02dc
MD5 ed936cb5559efaf46180dce1fee37243
SHA1 0394b61db0809f1105b550529ef0234a0c454d68
SHA512 c7d34b2471b4a26e712012a2d2e95e2700f6e51090e461055f830da91a22426ca8095aa2ce1c7dc874b8b8c2b21680cd45affaa668f571a35b468e49d0361094
SSDEEP 768:zJSuWXRz2aU8ORL359hH5chL1+1gUUPffETAVmKG:z4uWXJe8IL3cO1gfneAUF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer