209abf5674723414fea9b155223cbc40_NEAS

resource
209abf5674723414fea9b155223cbc40_NEAS
unpack001/$PLUGINSDIR/Base64.dll
unpack001/$PLUGINSDIR/ExecCmd.dll
unpack001/$PLUGINSDIR/Inetc.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$WINDIR/SVCPACK/CLEAN.EXE
unpack002/$PLUGINSDIR/InstallOptions.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$WINDIR/SVCPACK/CLEAN.EXE	nsis_installer_1

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6c7456eee52d013b21e1ac0bc1fb7c909cef3707cc27d9dfc618f1a15664fca2
MD5 209abf5674723414fea9b155223cbc40
SHA1 34ae49fc1c885a4b2914ee68d1a64f2bb540c2f8
SHA512 9a581b0d320fd9a796f8d25341ae0b1b7e9b0667a280aba6f32b738063544c8419da858b3f63bdd5d2a8b58f9b8cd9518851f898aed739c1ff3da94ef107c8f9
SSDEEP 6144:tQqDnQA7HMC3/IanKyooC2rmR0oABEON7cJk2idNDFaacc/LIL/HPaWbwTPrwL8Q:F7Hr0wCOmR4EON7+khg1cw/vTt8Zq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Base64.dll

IMPHASH 1ba6926a1ee4e4cda118768081f528d5
SHA256 7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
MD5 f0e3845fefd227d7f1101850410ec849
SHA1 3067203fafd4237be0c186ddab7029dfcbdfb53e
SHA512 584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
SSDEEP 48:SxSrr7xd14m4bLKwvnvcfDw1hEiauGkDVK+hIg4qT9/3lt:zr7xd14m4qw/vGwrEickDVthcE/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecCmd.dll

IMPHASH bf44c9fb48bb8c36b3e2527e7252350d
SHA256 1f4bd9c9376fe1b6913baeca7fb6df6467126f27c9c2fe038206567232a0e244
MD5 b9380b0bea8854fd9f93cc1fda0dfeac
SHA1 edb8d58074e098f7b5f0d158abedc7fc53638618
SHA512 45c3ab0f2bce53b75e72e43bac747dc0618342a3f498be8e2eb62a6db0b137fcdb1735da83051b14824996b5287109aa831e5859d6f21f0ed21b76b3d335418c
SSDEEP 48:ifXNtGNjFizsU35iej7luiwa28mDJmDKUOMQH0glay/Aa4r/:5Fef5iej5txKJKenlV4r/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5433

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/f1.ico

SHA256 91d0c4f8d8e49b84673ef2c8c9c05cc14b4fbfcdb17489612aad4e382a4eebaf
MD5 5858df8bc0d6ed1d6e0320cacc2e3e08
SHA1 01b4c25cb1cb049dc45c0cc4e12b772bda52c48d
SHA512 cd708ae1b464c6de21e4819601055bf7fc6c16dca14180f4ea8f3f97097aceb7e6f2e0264da4415ccbe7b03fe468991c894a7a41cb690e5941ba9f9ee3e69d47
SSDEEP 3072:Bftkp8bhzC05dOQM4ULvC6H66766GQCRgnjYF8M666666666666666666665666y:B+pWh5dOTyRgEh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 cc7363c6ad6d453eadb37363f49631edca803c69cbd6fc91a37d85f79ee0ce51
MD5 6f180c7867c4b9026f0a6722a235cab3
SHA1 840eddc79fec16640ba817cdf26af88bc7afdefe
SHA512 38da2b2132b08e11d3bfb6e0d8e2f635ab1ae1173c2bd34721e8e53edbbc4266100c22e2cd5fc05aa939d7ce48bf0a99f23662d744a8034d71bd618709fe5821
SSDEEP 384:wqWg7kjku7aSQJM3kZaU6yaxVplb9BTlI60bJhgEiaOJQ:iyuhKa/FxVLbbTlIbbXgEiaOJQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/SVCPACK/CLEAN.EXE

IMPHASH 237a51742fed62d237b6f1b75452402f
SHA256 33788ffee5514634aa67654c2316ed26d015660060c053a3b8ced0b08dbf149e
MD5 bfb8242907cb40ff3b2d54a75e5935a9
SHA1 8456842d2f68ee404ed367f2869d9ea7abe53ee5
SHA512 976852965c38ed385cf0d2e5297dd96f693b364edac2c9a0695803061b9904a4a8c78948ec1a8e1e430e44fcdb85a4a861ceca7dc28d189a71c908b791b10798
SSDEEP 1536:RZFwlrRfoowfoMTIxpIplqu4VGPJB6Wm4QQC7Pxbo/74zaXLCF:RZGlFw7fonu4sPJBipWMzaXeF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess SetFileTime ExitProcess GetCommandLineA GetWindowsDirectoryA GetTempPathA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose MulDiv FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ExitWindowsEx CharNextA DialogBoxParamA GetClassInfoA SystemParametersInfoA RegisterClassA EndDialog SetClassLongA IsWindowEnabled SetWindowPos GetSysColor CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard CreateDialogParamA AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA wvsprintfA DispatchMessageA PeekMessageA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem LoadImageA GetDC EnableWindow InvalidateRect CreateWindowExA GetWindowLongA DrawFocusRect DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow TrackPopupMenu wsprintfA SendMessageA CallWindowProcA MapWindowPoints GetWindowRect ScreenToClient PtInRect LoadCursorA SetCursor DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetWindowLongA

gdi32

SetBkColor GetDeviceCaps GetCurrentObject GetObjectA DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegQueryValueExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 57354bdeea3dfae6e948101add87501a
SHA256 0f4d3cee24e3f310fa804983c931d3628613988a24f0be7854f63a9309b8e45f
MD5 1d5c649dde35003a618b9679d5d71b92
SHA1 0409bbab3ab34f8c01289cdd847b4d1a32d05b18
SHA512 b432ebcc52905662d61a3f17e08e209a3f9d836a9071b3b5e80070af7ebcf34cf66c44426dda041c2a258fda4787e5692e2b35acbcd73288fb84fe3c977bbfd9
SSDEEP 384:pKlm7i+c3QW6ckPhyDEaLnA2bbBBIXwZ:8qi8BcyhEhLBbbTI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10417

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 cc7363c6ad6d453eadb37363f49631edca803c69cbd6fc91a37d85f79ee0ce51
MD5 6f180c7867c4b9026f0a6722a235cab3
SHA1 840eddc79fec16640ba817cdf26af88bc7afdefe
SHA512 38da2b2132b08e11d3bfb6e0d8e2f635ab1ae1173c2bd34721e8e53edbbc4266100c22e2cd5fc05aa939d7ce48bf0a99f23662d744a8034d71bd618709fe5821
SSDEEP 384:wqWg7kjku7aSQJM3kZaU6yaxVplb9BTlI60bJhgEiaOJQ:iyuhKa/FxVLbbTlIbbXgEiaOJQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$WINDIR/SVCPACK/XPLODE.EXE

IMPHASH 9320216edabd52956503aaea36ed69ed
SHA256 df1d9b5af884b44a3e525131a3da01f757afda43322c1e2b96158d575e62233f
MD5 8a6383ae6cd83a17049c1d921ea552bb
SHA1 6c7412ae972490bbac70720165be642670dcf3d7
SHA512 5c587f1c71e4263fd4c6188e13b2196820a306dd2ecce858725476127f89569f36d17b6097f5063e3b8642838a9b9cbabe2bdb8fdde0722bdae756b0d928033f
SSDEEP 6144:BW8OwKNksCpmVEqxshkP5b+kyp1IqSKcNXgZy6Fh1k:B5Ow0CpmVEqukP5b+HLMgZyok
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c7:e3:c7:e8:c4:10:e8:29:a7:d3:b4:06:3b:ce:bf:5c:c6:dc:ab:ec

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=voidFX

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

142173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceW LoadLibraryExW lstrcmpiW lstrcpynW GetCurrentThreadId LockResource FindResourceExW CloseHandle ResumeThread WaitForSingleObject SetConsoleScreenBufferSize GetConsoleScreenBufferInfo AllocConsole GetStdHandle GetProcAddress LoadLibraryW FindClose FindFirstFileW FindNextFileW SetEndOfFile GetLocaleInfoW FlushFileBuffers GetOEMCP IsBadCodePtr IsBadReadPtr LoadLibraryA ReadFile GetTimeZoneInformation LoadResource GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetCPInfo GetDateFormatA GetTimeFormatA GetCommandLineA GetEnvironmentStrings MulDiv GetStartupInfoA SetHandleCount UnhandledExceptionFilter LCMapStringW LCMapStringA GetSystemInfo VirtualProtect TerminateProcess IsBadWritePtr VirtualAlloc VirtualFree HeapCreate TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc VirtualQuery SetUnhandledExceptionFilter SizeofResource MultiByteToWideChar FreeLibrary GetModuleHandleW GetModuleFileNameW lstrcmpW lstrlenW HeapAlloc GetCurrentProcess GetStringTypeW FlushInstructionCache GetLastError lstrcpyW GlobalAlloc GlobalLock InterlockedExchange GlobalUnlock InterlockedDecrement InterlockedIncrement GetProcessHeap HeapFree DeleteCriticalSection GetModuleFileNameA GetCurrentProcessId GetTickCount QueryPerformanceCounter InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException GetVersionExW GetThreadLocale GetLocaleInfoA GetSystemTimeAsFileTime SetEnvironmentVariableA CompareStringW GetStartupInfoW GetModuleHandleA GetFileType SetStdHandle CreateThread ExitThread RtlUnwind ExitProcess FormatMessageW LocalFree WideCharToMultiByte GetCommandLineW GetACP FreeEnvironmentStringsA GetVersionExA HeapDestroy HeapReAlloc HeapSize WriteFile SetFilePointer CreateFileW GetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GlobalFree CompareStringA

user32

SetWindowLongW GetWindowLongW wsprintfW CreateWindowExW CreateAcceleratorTableW CharNextW GetParent GetClassNameW SetWindowPos DestroyWindow RedrawWindow IsWindow GetDlgItem SetFocus GetFocus IsChild GetWindow DestroyAcceleratorTable BeginPaint EndPaint CallWindowProcW GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetClientRect FillRect SetCapture ReleaseCapture GetSysColor RegisterWindowMessageW GetClassInfoExW LoadCursorW RegisterClassExW GetWindowTextLengthW GetWindowTextW SetWindowTextW DefWindowProcW UnregisterClassW SendMessageW

gdi32

GetStockObject GetObjectW GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject DeleteObject CreateSolidBrush

advapi32

RegCloseKey RegCreateKeyExW DuplicateToken LogonUserW AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW ImpersonateLoggedOnUser RevertToSelf RegQueryValueExW SetThreadToken RegSetValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW

ole32

CoTaskMemRealloc CoTaskMemFree CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning CoTaskMemAlloc StringFromGUID2 CoInitialize CoUninitialize OleUninitialize OleInitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

VarUI4FromStr LoadTypeLi LoadRegTypeLi VariantInit VariantClear OleCreateFontIndirect SysStringByteLen SysStringLen SysFreeString SysAllocString SysAllocStringLen

comctl32

InitCommonControlsEx

shell32

CommandLineToArgvW

userenv

LoadUserProfileW

$WINDIR/SVCPACK/XPLODE.X4D

IMPHASH c70756297088ce52551019a022b5696b
SHA256 1ff5b5ee230972c6fd4ac8d50eae80e4b61b82a21f7d8455ca1259bd3ef53797
MD5 70cb2aca8fdd193a41573ceea9a66b0b
SHA1 fb450263e1c55b72fd6bd5e1f0650599d0fca3bb
SHA512 a0e622b655a57faa89b07afb21e07e2b074ff3d2538cab0fcec8452bd980737d575abad2f6b47267016af41660b41e270382b1127ffa0b2e32bd89ec48a15ef2
SSDEEP 1536:LPpQEStEKzL/yWxMyCHcWWpoBLVPwqNisnRmKBBcp66lZmvKQuRTl3Z7q+DGt69D:bpbKzVxfWWpoN2KBkYiQuRTl3Z7AtCD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:bd:24:96:13:a8:18:c9:10:91:97:e9:1f:86:ee:2a:72:14:6b:29

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=voidFX

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

39475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Programming\XPlode4\build\XPlodeGFXInstall\Release + SignCode\XPlodeGFXInstall.pdb

kernel32

GetProcessHeap HeapAlloc CloseHandle ResumeThread WaitForSingleObject InterlockedIncrement InterlockedDecrement GetCurrentThreadId lstrlenW lstrcpyW GetModuleHandleW GetModuleFileNameW GetLastError MultiByteToWideChar LoadLibraryExW lstrcmpiW lstrcpynW GetModuleHandleA HeapFree GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter IsBadWritePtr VirtualAlloc VirtualFree HeapCreate VirtualQuery SetUnhandledExceptionFilter GetCommandLineA CreateThread ExitThread ExitProcess RtlUnwind HeapSize HeapReAlloc GetCurrentProcess FlushInstructionCache LeaveCriticalSection EnterCriticalSection GetVersionExW GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange FreeLibrary LoadLibraryW FindResourceExW FindResourceW LoadResource LockResource SizeofResource RaiseException DeleteCriticalSection InitializeCriticalSection GetProcAddress FlushFileBuffers HeapDestroy GetVersionExA TlsAlloc SetStdHandle SetFilePointer GetOEMCP GetStringTypeW GetStringTypeA SetLastError GetCPInfo LCMapStringW LCMapStringA LoadLibraryA IsBadCodePtr IsBadReadPtr WriteFile GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount UnhandledExceptionFilter GetSystemInfo VirtualProtect WideCharToMultiByte TlsGetValue TlsSetValue TlsFree TerminateProcess

user32

CharNextW GetActiveWindow GetClientRect BeginPaint EndPaint DialogBoxParamW GetDC UpdateLayeredWindow GetWindowRect LoadBitmapW SystemParametersInfoW GetWindowLongW SetWindowLongW ShowWindow SetWindowPos MoveWindow SetWindowTextW UnregisterClassW EndDialog InvalidateRect

gdi32

GetClipBox CreateCompatibleDC LPtoDP CreateCompatibleBitmap DPtoLP SetWindowOrgEx DeleteDC SelectObject DeleteObject BitBlt

advapi32

RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegCloseKey RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoTaskMemRealloc

oleaut32

VarUI4FromStr

gdiplus

GdipSetStringFormatTrimming GdipSetStringFormatAlign GdipSetStringFormatFlags GdipDeleteFont GdipDeleteStringFormat GdipCreateStringFormat GdipCloneBrush GdipCloneBitmapArea GdipDrawImageRectRect GdipMeasureString GdipDrawString GdipFillRectangleI GdipFillRectangle GdipDrawRectangle GdipSetPageUnit GdipSetTextRenderingHint GdipGetImageGraphicsContext GdipCreateSolidFill GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdipGetImageBounds GdipDeleteGraphics GdipDeletePen GdipCreatePen2 GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipCreateFont GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipCreateFontFamilyFromName GdipAlloc GdipFree GdipCloneImage

$WINDIR/SVCPACK/XPLODE.XML

SHA256 4410ab6e2948fbe4fdca0ac8427ad0ed8068aa9d236e368dae756be77a57fdb4
MD5 b8f5221afb9a5b5cc890f68715723fdd
SHA1 a989be07917c7c3514124e74ec0947c29091c78a
SHA512 66b2e0f38df1586fdbdc913587f50318e59bca374d80c5bae48dad7a430b5d7a21332a38fb8222b9ce2bfb426f9a7ece5de938f9c3998110eea4d5605148ac02
MD5 SHA1 SHA512

NSIS installer

installer

$WINDIR/SVCPACK/XPLODEEXECUTE.X4E

IMPHASH 1f48ac7ba3a35648f1de04d78dfbb5a5
SHA256 b3ce298b40ee8a856ffc402bb08698c4cb5558605efb96cb12b8bf37957aeffb
MD5 8603ad72698e96e936b0b7f1ebe92030
SHA1 a57aca70d5781b4f97e614b119e369f24c30365f
SHA512 d216f47e6639b917859e0d06a7548bbeac47cb3da4ed468956f2956f7d41c7e2c3f47dd66de022930ee4d4cfbe70812498f9443e72b828966c77161c4ca67ad5
SSDEEP 1536:4n4VcYb097PAEC7hDRwfVZnWVjB5bl+NXEX6D:4n4VGPQ7wKNBll+NXEXQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

4f:80:d3:66:1e:5a:20:4a:39:e4:9b:88:40:5e:ab:66:f4:11:0f:39

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=voidFX

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

13822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Programming\XPlode4\build\XPlodeExecute\Release + SignCode\XPlodeExecute.pdb

kernel32

InterlockedExchange GetACP GetLocaleInfoA RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW WaitForSingleObject CloseHandle FlushFileBuffers GetVersionExA EnterCriticalSection LeaveCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap ExitProcess RtlUnwind GetCurrentThreadId GetCommandLineA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA VirtualQuery HeapCreate VirtualFree VirtualAlloc IsBadWritePtr GetProcAddress GetModuleHandleA TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter TlsAlloc SetLastError GetLastError TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW UnhandledExceptionFilter WriteFile LoadLibraryA IsBadReadPtr IsBadCodePtr MultiByteToWideChar LCMapStringA LCMapStringW GetCPInfo GetStringTypeA GetStringTypeW GetOEMCP SetFilePointer VirtualProtect GetSystemInfo SetStdHandle

shell32

ShellExecuteExW

Sharing

General

Malware Config

Signatures

File Explorer