11a56dab8a2508974bdaa79fd9996e83_JaffaCakes118

resource
11a56dab8a2508974bdaa79fd9996e83_JaffaCakes118
unpack001/$APPDATA/konto-eroeffnen/constants/MFC80JPN.dll
unpack001/$APPDATA/konto-eroeffnen/constants/makecert.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$TEMP/Holotype.dll
unpack001/$TEMP/public_ftp/MicrosoftVisualJUpgradeEngineInterface.dll
unpack001/$TEMP/public_ftp/nmakeui.dll
unpack001/$TEMP/public_ftp/sbscmp10.dll
unpack001/$TEMP/public_ftp/vcencbld.dll
unpack001/$TEMP/public_ftp/vsjitdebuggerui.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 f457caeb3fedec72b6d8ab1b6bfcf3cdb11e0c4cf07dee53f659c1e24de7f733
MD5 11a56dab8a2508974bdaa79fd9996e83
SHA1 37d015d047a3dfcc042a76a074ce994196f646f7
SHA512 9a5d08a91c30ebf149de082656ab8f29ac5cb3c23dccb482d35db6b57b6501dc180dc90d100a60993a25a34669de549e0274c3a12107372836e679fde465ab39
SSDEEP 6144:2PCganNtPKcXVnuuKe4NrSq9cTizZUPaAimU/BYjpT6/Ukpg33nD0gdzZ:EanDyCVuX/rjcT+gOC1eUk+XNf
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/konto-eroeffnen/constants/47.opends60.dll

SHA256 3965d0f1981b3da8dea582e371a0862100455809cef13164f9bd6dd59d44c2df
MD5 d1aa2ed18ff6f49b3b8986eb0a48cacf
SHA1 139973b18359e17f0f34a727bbbf81fab5f75c99
SHA512 d68cbe61358f229c1faedc310ed57c5b7dc0b325e22879a84e6036b585e4821ef2e562da4832d035a9cce8ebf8e79a2649d0f15ec212433d65979285e99992a1
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/konto-eroeffnen/constants/MFC80JPN.dll

SHA256 d688bbc45a22814403bda7609ec1650589f5d0acb8287ad72c6e493d51441e27
MD5 3e9b3cadc71ab38ff8183299ef772367
SHA1 4c9a4f181c31b92af497996a5f9c28b549633f12
SHA512 4e49cd5737213dde86e662a12df5c0feb94adc30d54d5dc9219285047526ca0e6899ee59a3027cc2572b8c79f4af97c9b8a5392b911ddb873d734537d90a6e60
SSDEEP 384:hDNCysL/tAGqyVVp7vheBWlWRUJkQbXDr10Jh8I2Bb4:hZXsZAGDN7vQtUJkkr10IIc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/konto-eroeffnen/constants/MicrosoftWindowsCEForms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cbba64117b44e28ba4d05f74d4b11b9770922dfaf50d46316227c5012913068d
MD5 d818d217b0a8055ae995e94a6caa9db3
SHA1 f8d9307e9ce7803f48a37778e935ba114a492b12
SHA512 55b907a136563dcfbe85ef38c1599f76f6b77c7bdd9ef52d708f5fa783bb5ad1c5a01138473e835efca10abb733ae6a03532ca2ec7414e7edc4caaca95fd8b03
SSDEEP 384:IX/u/+j0QSjE1tmD6NQq36jWa7NEhN3JkWXjYWSYLCcM36mn9:Cj0rg7Q6NYYL3u6Y9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

48:27:82:e8:7b:6c:ee:f6:81:27:f2:fc:dc:7b:7a:c2:c6:71:47:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

May 3, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:fa:aa:11:d7:13:01:30:93:20:84

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2002 - Dec 20, 2012

Subject

Serial Number

61:05:f9:0d:00:00:00:00:00:07

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 14, 2005 - Nov 14, 2007

Minor OS version

0

Major OS version

4

Entry point

18782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/konto-eroeffnen/constants/gnome-version.xml

SHA256 a2cc135c00bf07ab59e9a4e36c63151989c26b74c3b3cca4fdac598f9491f9e5
MD5 dd5f894b04669bb5e0da5e9ee830f787
SHA1 54aa1e0820379a81ec5a5dcc427a235c12139a87
SHA512 8e5319a670ccd42a424baae5654ad4aa5436b921e3f10ddb513eb75f4d037fa86349111c8a422de6e2f5132c0dd038bbadc28aafb0d5adf90528db856f736c84
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/konto-eroeffnen/constants/gtkwidgets.xml

SHA256 2cb905cbae60ebb1fe44ec147ccdceddb899431c8e5cb736b102405a12dbc41b
MD5 651bd654d29b55039a4b917c19c337db
SHA1 8ecd7e1263ad2d818eba442d107639d28e120ac3
SHA512 4defa3533255dc0662fe6841611b537f286477e1ca6515a2f369747af955175d647e5b5a872914a28059b84826a2d4bbfbda911b39783e029a24223db6008512
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/konto-eroeffnen/constants/makecert.exe

IMPHASH 34bca1a8725a684420029505cfe3aa97
SHA256 4d50ce341be70511e9a871dd347b3f5793ea97787cdfc92045c0bcc8aae6e298
MD5 ed1c00557cde869caa963bbf9c820f05
SHA1 53bbd8b86fcbee9316e02af399634522b12539b0
SHA512 509afc51b647a6904a3a4abf04b43dfaee5fa0878c3a822fce84dd58ce2ab1c15a38610487c520ca6f7c42ed37d754df55a82b0a81a28d31493f2535d9568405
SSDEEP 768:fqKIjHhW0CfW0FKT7vZKP1xG69D1/gEehcaLnTJ/2acSd:3RnfW0eoPPXpCnTJ/2acSd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

21857

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter GetProcAddress CompareFileTime GetSystemTimeAsFileTime FileTimeToLocalFileTime FileTimeToSystemTime LocalFree CloseHandle UnmapViewOfFile FindResourceA LoadResource SizeofResource LockResource FreeResource SetLastError SystemTimeToFileTime LocalFileTimeToFileTime GetLastError GetModuleHandleA MapViewOfFile CreateFileMappingA GetFileSize WriteFile WideCharToMultiByte LocalAlloc GetVersionExA MultiByteToWideChar CreateFileA CreateFileW DeleteFileA DeleteFileW

msvcrt

exit _cexit __winitenv _exit _c_exit strtok ??2@YAPAXI@Z ??3@YAXPAX@Z wcslen _wtol _wcsnicmp _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 _controlfp free _wcsicmp vwprintf wprintf malloc swprintf _XcptFilter wcscpy __wgetmainargs

advapi32

CryptGetUserKey CryptSetKeyParam CryptGenKey CryptDestroyKey CryptAcquireContextA CryptGetProvParam CryptReleaseContext

user32

LoadStringA LoadStringW

ole32

CoInitialize CoUninitialize CoCreateGuid

oleaut32

VarDateFromStr

rpcrt4

UuidToStringA RpcStringFreeA UuidCreate

mssign32

GetCryptProvFromCert FreeCryptProvFromCert PvkFreeCryptProv PvkPrivateKeySave SignError PvkGetCryptProv PvkPrivateKeyAcquireContextFromMemory

crypt32

CertFreeCertificateContext CertSetCertificateContextProperty CertAddEncodedCertificateToStore CertOpenStore CertCreateCertificateContext CryptDecodeObject CertComparePublicKeyInfo CryptExportPublicKeyInfo CryptEncodeObject CryptQueryObject CertStrToNameW CryptHashPublicKeyInfo CryptHashCertificate CertGetCertificateContextProperty CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertCompareIntegerBlob CryptSignAndEncodeCertificate CertCloseStore

$APPDATA/texis/71.opends60.dll

SHA256 e8292fb07ef7ba6c6cbf970494d14baa6107cd84a8f8a421f16c77e423e0f531
MD5 47afaddd615c7585bcaa3998841c07f1
SHA1 a90d4d3796b98e84ebaae1e5525c73760b6d8cde
SHA512 05b52ec788b1f996ff9fda517737ba2059ac520234558eb54f0a73668001f87eebacb709c2bd5010c2dfb006d4bf98e178141fd986f8a919ba286ca2a8f720eb
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/texis/org.gnome.calendar.gschema.xml

SHA256 d41a88a6d20d312329ddb689668a907afb14abac2463875e05ce010c5382dacf
MD5 4298d50de6afa51536e9d60f93086580
SHA1 62418dccf72ade346d87a2a51efcb31724893038
SHA512 9b0ebacaaee9eae064a31b398918a8e15a4664c32604930ed9721eabcb1d36b5a4765bc09ce54d5932ca39a9276c55e3615d36825780305029440e1862d74e22
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/texis/utf-16-2.xml

SHA256 130626a69f16bd4bb2a589b41ba8145e0c3549750267123e21959b904524543b
MD5 99e45b6104cec1dce3bd3bab25519c9a
SHA1 332a72133b42cae0e4c1c9b313eb5f1e6064a9ab
SHA512 db114c7efe0b5e2c52cfa1a5774c276cab3733dbb8beaaa27674874038bdea8c0b8c729f300f3f98fa564f3ca1dffdf27cfa775a3769005431a7c090acfb9a4c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Holotype.dll

IMPHASH 1d5fce208ac05d851b161ce1860de168
SHA256 383d775daef2b8cb6c5d055851ca23b1328d3a75edc01d0801ae72f429b667df
MD5 4b02b0b9a0cc891ff025510c605f08bd
SHA1 42c00ef177b2b4900eb982096c31c55ea636abe9
SHA512 a77ee6c2ef97f2898a4d3007c03a6856d98581251e6160bddd3d5f86ed433a06c5d2edba378abad5a664478b803ac1dd3161de0c74e1f4eacfb8718a08b8843c
SSDEEP 768:zSIY+guIUaTVNRhwUmnTEDm3vyU12wftb:HYnlhNv+4U1rfZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

5914

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Physicianship

SHA256 e7ab6dc9ac16dcda9c1956f49f3c75a19e15aa19293f6a5aba5d4d55e8d8260d
MD5 81cffd8247f593334b863bbd149127cd
SHA1 f3db02ac340b095b95712cd28fd23095d8132ab5
SHA512 0485e15557555f47a453f4c767581572696e308055902def76bbf08c4fbe6c703aaa4a9aed54c77df7b1377653a1290b0179634e4c5d706cd17a6f43cd2637ae
SSDEEP 3072:Hd4VsWYOGF+pTB8FFgOpUTApN23OgL1Pvyqj0gfL:8sWYj+pT6TUkpg3FnD0gfL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/public_ftp/42.opends60.dll

SHA256 97e327f5e11afd404d9f48b6aeab7353ec91daea8a592945f5f32faf82232203
MD5 4fd523513269bfc51954110c8317ef1c
SHA1 e270f7b387c49491722ceda7e5fdf77caaba9556
SHA512 0f0a4515db50d0174904b5e4fbe5f42a871eaf5a88576b3fe53f6f05fe0ffd0b32488e2bf4bc2e7fbb5d76f808e616af3a41339202e0566c0ef8cefc51c48756
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/47.opends60.dll

SHA256 3965d0f1981b3da8dea582e371a0862100455809cef13164f9bd6dd59d44c2df
MD5 d1aa2ed18ff6f49b3b8986eb0a48cacf
SHA1 139973b18359e17f0f34a727bbbf81fab5f75c99
SHA512 d68cbe61358f229c1faedc310ed57c5b7dc0b325e22879a84e6036b585e4821ef2e562da4832d035a9cce8ebf8e79a2649d0f15ec212433d65979285e99992a1
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/MicrosoftVisualJUpgradeEngineInterface.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 afae09aa5b7e708b885ad2a54d13db86a7a53b0c1b5b5490e7055ad859f5cc30
MD5 20712da756917c247c0b6b00bb323a92
SHA1 3839d561e4f98f90d1d6927f18da38c52c29487a
SHA512 442e0f6bf9c7857ed74a840c5d12ceffd362e106fafabeb3a6d1db55f82c8ad2cb188c4a97ae1dcbd1c17d8fa0950636c2b3aaa8226bb44eedf4384c2eded9bd
SSDEEP 96:B1ylB3oTgvhx6h2s6CX67RHY8O3mw1NRg2V2Ey2+E/M5dgiL3QN18xv+OKf3zzDn:Ng5whoCgHSVuKi68xWWLbNKOWN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

objr\i386\Microsoft.VisualJ.UpgradeEngineInterface.pdb

$TEMP/public_ftp/VB7TLDUI.dll

IMPHASH ecbfb5cdb40fe01cce60f0d617945eb9
SHA256 c94c8a2709401aad4a1e59ef412db3c12aff855b85fcdfe635e70b0ea2420aa1
MD5 0e492f70d49ed66ff7471d87c59f3489
SHA1 b35d34c232903f4ff0aa8de5082d1bccdd78cf67
SHA512 1f796a2c1360a41a7558b57043c09b2ebeef5fdeaab71cc53af0d28d9b467f43d5a6aee9b4adb0f17adee5f1d4458dbe9e374815fe434f8e8c278fe829a909d6
SSDEEP 192:laUmA3jzxOnLkv6N3Xz6vrkonZCwnRDcWWqf7L/CldolMvMjGwPgMvws+ebMNOk9:AncYD6LIwnVcWjTLCcY+wCbsOc9j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=ArtinSoft SA,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=ArtinSoft SA,L=San Jose,ST=San Jose,C=CR

Serial Number

45:99:ff:3e:ad:ba:0e:44:00:6c:fe:00:7d:cb:82:b8

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 4, 2005 - Jul 4, 2006

Minor OS version

0

Major OS version

4

Entry point

4881

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

h:\FreedomStudio\bin\Release\1033\VB7TLDUI.pdb

$TEMP/public_ftp/VSMigrateUI.dll

IMPHASH ecbfb5cdb40fe01cce60f0d617945eb9
SHA256 6a0062f006f1eb13c641a841b7dabf7dbdc810f946bffd9282f72141a72d3bd3
MD5 8a5d7b38d9bdd2d1c69a0e93147406fc
SHA1 543d2409257eeba9387bc281f100adf5dbc77966
SHA512 e3b3dcb12986995cb943a449ae80acf48ba6abe7e35673337595f919f9bc821313d35c4708657461c152cf36b1aa29c9ee32b7c9b8332da9b90b4ed2297e9150
SSDEEP 192:lZxn3fUnucJHN3Xz6vrk9l4cWLAwYWep+/WWqfkIL/CldolMvMjGwPgMvws+ebMg:xP6D6ml4cWLAwNes/WjbLCcY+wCbsOF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=ArtinSoft SA,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=ArtinSoft SA,L=San Jose,ST=San Jose,C=CR

Serial Number

45:99:ff:3e:ad:ba:0e:44:00:6c:fe:00:7d:cb:82:b8

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 4, 2005 - Jul 4, 2006

Minor OS version

0

Major OS version

4

Entry point

4881

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

h:\FreedomStudio\bin\Release\1033\VBUpgradeUI.pdb

$TEMP/public_ftp/alignmentbar.xml

SHA256 a85bdf21c0b15e280f389670b03697c2f55ad9b096dfea73cb5cec65f9b9aee2
MD5 5526272a8abb35d72c2a67b5157e3401
SHA1 4464eb7e7524d590b4a8b595410beb693c591729
SHA512 2ee8eace1cdfc56a9d075c7f72fa10b494983f2e27701986a877106effcd68aefb0014c75bdcc4b715efabc6e4f15f681af771509a204bb3d61ef2ad3a2e9649
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/cdcutterrollfeed.xml

SHA256 486f333081c78a3398a17758962ba2ec0dab738550ccf0b3a820d505d1536f7f
MD5 5cc0f659fd0a1aa69b91dcfbdf1ae309
SHA1 8ed4af78a8f77d8e963a20d80c7fb74a8fb22331
SHA512 f08fa08a2424dea3cc8942cfbc60c63add1dcb51ca4630d47c92714e3b2322587cdfaf851973945d8ce647196e915b56d3c4c8402db7be6dfeb4842cabcb6282
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/dconf.xml

SHA256 105f69a3e931439b3bf93dd621b154b18beba253908e6ec613fc61e2c388ae56
MD5 5e4d1c1af789ccb73e59ccb9a8ea2438
SHA1 63d64452cf50724e22df2fbdc1f5bdda09621151
SHA512 420241c49ac34eb8e8d5ae206669a1efc3fa431c9592d2b730a7f13ef451ac33e858ec7271f61e4b1685d5abc1c2b3062849b7a437d2215b5a1cc0526e374a89
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/gzexe

SHA256 6de8254cfd49543097ae946c303602ffd5899b2c88ec27cfcd86d786f95a1e92
MD5 5707c43e99bd5ae2c4660ec1bcc213c1
SHA1 c6247c24928bebbd3a6b74cf499e153f5673e590
SHA512 e7b1fe76b6c901531dec4369a7086eaf1e49a23cfef4d761e6b65fd4c505584f28b1d7f26089f14b963c997ac85dd6c310af0e01e0c51783481eb309a5aa08be
SSDEEP 96:KFM9R/fxEoPzmAdCbu3mQTfE9u550zbZC7A+yR+X67/cDbffJD6xP85BYk:GM9R/fWo7mAdCMmOuq0z1Cc+yR+X6zcz
MD5 SHA1 SHA512 SSDEEP

linux

NSIS installer

installer

$TEMP/public_ftp/iso4217.xml

SHA256 46b5eedf26952277f5d40c4f91ef6189470b3605ee8d4696c3563f4b8065f5ca
MD5 2517988885a4d66b617ee19b487bbbad
SHA1 1922d6481d3e5cccdc05065c9a640d1f62267d36
SHA512 83d52c7b35c373d065bd384aabe064cbdeedc0ed0e2533c12833e589c862a9d2f4382717c27b5d69e99cde4d9aa8a103e0542381ee38cea908c6558a46dc32e3
SSDEEP 384:8tuz1ubgswIVhFN01X39ZSSQ+5Mxrh8cZd:kuzo9Y3uz8w
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/public_ftp/model8.xml

SHA256 5d9653bbcaadf971a5e5de64971b0a343cd6d771d876220763a16b7fc6eff8df
MD5 4de920faa3891f12f8184cece60b4f63
SHA1 c15aba0c3b9c5562015b316b94306d9ff891a4fd
SHA512 8e94823e6b8444353b7fafce5d326415053a93c4decd6ce27a5e59299dc46aa17843f0d414a4bd92188c6b22a4c618313d55d4c721db74cb9a8465cf06b9c8ae
SSDEEP 96:9CCDlz2XUTnAx8UtEqkCBHq+K5BeT5B5/5BM5aT53JHhCO2pT6O2Nl:Blz2x8UtEqkOqPSVV5JhC9pT69Nl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/public_ftp/nmakeui.dll

SHA256 d96d797246852843f683dc6a991a3fe76c4c1f6dfc49f263d401c4faa21f7526
MD5 2a2c560038926a34e2c62b8e472a781e
SHA1 617c7e84be70058870e6fee1c414e77f9faedbbc
SHA512 09b0084f87fcb45529de3adf68d9567755918f634baba5f7ca4fa59ebd4015fcde6750565b6c335968980a27a31434a90c456cd7b05efe112ae71a7241fd036b
SSDEEP 192:nW8lN8fW4qYOoy6wdJ3z1gBN6fGgaudhuPKtiqDnlIHhCf79VK67:nW838fWGzrBN6ouTuEiqDnY0ZVK67
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$TEMP/public_ftp/pricelevel.xml

SHA256 749d52688c71d62bd37b52553d645b202802c6eb2e75c3ec697e76a6e1995078
MD5 16f659b5b6720a82059c74f54ea68421
SHA1 dd0b9b6b5ee9603b46818c14c0813914a37ad325
SHA512 b29dc978852bb617807f95725c01ca9fa425579c6c9a21ec873772a52901d019f674d2e78b96daca188836fb557042a3f963e473e3035e8df4379df5d453abb5
SSDEEP 384:gPUDtPUeUPUrUsWPU5U8UeU7U+UhPUDUKlU6UFUs7NsfBs/9fBsnsJzqfi:gGtyQowqfcfDzqfi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/public_ftp/sbscmp10.dll

IMPHASH 8033b5c6925cebd7857ec395d39ec885
SHA256 c384347aae8b3203b26e9be4d46e3c794ca1471e442e0edaec2f04140868f89a
MD5 5563cacc3607455df5c0eb4b990fe8e7
SHA1 bfb0aecf8c44269acc9b5ddfb6f4b19f281928d2
SHA512 0e57e495710ef3d9199a7d3f7817fdf74f55a5d4aaba9c1b92f54006790a50210ef4ea8024b6f0ac32cdd524ba0e030552f793b55d11d6ebe9ef1b6322b3b703
SSDEEP 192:rKBGIdbscDZe0HFN3X0S6vrk7WI5NzlW/7H:DIdbIkES60WITzlWjH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

5241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

sbscmp10.pdb

$TEMP/public_ftp/vcencbld.dll

IMPHASH 2563af79286ed233a78f7b56063a0761
SHA256 cfda3361936df0ce9f0fbe92d4a1c43cbe53448b97e0cce098dc2f786d273ba0
MD5 15f4aebe0ad31fb59402022d82573614
SHA1 55bd5382a75859b2e7fdd9e7d21f5ef694e3a973
SHA512 0ace197a5615550e8b72f3bd4da6f4cf5257fc34812ede96f6f2169ecd01b5baf333052af730602a87795e64e62b3bde390b32107bf4a1c69195d323c7ade00d
SSDEEP 768:g7Z4VhK+4QierfiLX7pld37Qh5CQNAF0Vt3KCc:eqFNGllNS5RWKt3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

11534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

vcencbld.pdb

rpcrt4

NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject

kernel32

FreeEnvironmentStringsW LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA MultiByteToWideChar HeapSize RtlUnwind DisableThreadLibraryCalls GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetProcAddress GetModuleHandleA ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement Sleep SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile LeaveCriticalSection EnterCriticalSection TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSection GetCPInfo GetACP GetOEMCP VirtualAlloc HeapReAlloc

$TEMP/public_ftp/vsjitdebuggerui.dll

SHA256 abc8fa1ebb38ac7cbdbc297264fe25a55e61f24b07c9d132b0c65b1a72d5757a
MD5 78a4efa1a9c8484e97490875e76f7ed9
SHA1 9a36e9d3e0afc1c38174884907cdfa9bbd501d01
SHA512 62aa6e7071a7a0bea35af8c4611500844b7cd68bed805911817f8d481da38bf2f5f3c5994af5926bb1ddb2988e9d9386f199ff4c7223ab239983a701f29ddf5f
SSDEEP 96:v1/EW9NAAWPVOvT1vm7jY0t3xTago/Y+alSvT3SdzkqN92E9/Y6kEyA5SgkLE2o3:vmW9NAAWNs00aDz9xdskJc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/public_ftp/x-changelog.xml

SHA256 f0afe107b7d008cb01941df81eae9b5055dcd13bb90587717d7a82be72430a6f
MD5 2e4e76f314a0c1d644dbaaedddf378b9
SHA1 38d0f3c29c5cb41f1ed96a8541224c6f75c2911a
SHA512 3ca85d5f160da110fd2213cf1d17c95fb85cf86b1f63a7322ae241f0a9d03f59b9b74eb4da8e59d382489aa29675df9dee642721c41237e5fe7f2e709c46cc45
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/x-kword.xml

SHA256 e474bf68c16bf07aa8d89c1b42c8ca638a7277903ff9eb6620698cd08d68b511
MD5 fc861af03018f90c454db955c21e2b4a
SHA1 7f1daa1642475256b8c6004c83d582e662644928
SHA512 d7db3533476aa32826724292ed9de5b22bd57efdb409ec5a920639157a044e807c33ce514309743541ca329073a2f43c07ee83dd723a762d985f03c919ac7fef
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/public_ftp/x-macpaint.xml

SHA256 ae18c22d8161665c55e321f53c0c07c285fa8c0ffcaaf0bee00ae3d7e662a72a
MD5 9bdfbf2e172312c48c045663705da487
SHA1 4b9104f75679a6804af6ea256779b16654a7f6fe
SHA512 fd7fd22f2ee7af0e02e8f46b7875111670700a7a5a5d70d9f91f060d9aca7be9720a79985448f5fc341fe76ea39ea7f7ae84736949c87443788011c787f886e4
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer