2100dd61aa4983e8d3fdee18ade84c21_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	acprotect
static1/unpack001/$TEMP/SDM143/ExentCtlInstaller.dll	acprotect
static1/unpack001/$TEMP/SDM143/resourceDll.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	upx
static1/unpack001/$TEMP/SDM143/ExentCtlInstaller.dll	upx
static1/unpack001/$TEMP/SDM143/Free Ride Games.exe	upx
static1/unpack001/$TEMP/SDM143/resourceDll.dll	upx

resource
unpack001/$PLUGINSDIR/SelfDel.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$TEMP/SDM143/ExentCtlInstaller.dll
unpack001/$TEMP/SDM143/Splasher.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 480b5066ad2a0c76aa3cd99d7626845ad79dfb80488491bfbeb0b29ed0e95a7d
MD5 2100dd61aa4983e8d3fdee18ade84c21
SHA1 061f3aac07cdc9177e0fb3642bc1d2c923500e90
SHA512 3c543ebc060cc2486fa09176682a5fc92776b1e1d091905a3b79d1fceff3b02c005472dcff30c8df7b2d9eb795ab82c329ccc4e20761cfd588469c3f4e5f60be
SSDEEP 24576:+QXvmjWP/UVldr7wh3dsT8FRZuzslwXpdy2NZQ6yHp4PZwfQ95a3g6:NFHmr0NsEuYA82HEHiPZwW5aw6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

65:d3:9e:0b:87:67:22:79:9c:a8:fb:dc:ec:c2:26:ce:14:b9:1e:d5:e7:d0:f2:cc:84:e5:10:28:84:c4:ac:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Apr 27, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/SelfDel.dll

SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
MD5 e5786e8703d651bc8bd4bfecf46d3844
SHA1 fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
SHA512 d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
SSDEEP 96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

30272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 91eadf9505a1212432547314f75e4d01be393f1392ae03f11e9534804213ae4f
MD5 517aee7f68b46b0f550dde61c5dcb66d
SHA1 20981977561bf589d7f5539776eaf9fd8a87542e
SHA512 96b5aaf5ece2e66d5726c1f33be31297f0754f771a202dfb2edd0f118e60dd6238c482f4ac36697bb3d14c106356be1178adab4ed71c213a322129d2a4e68433
SSDEEP 96:SHT97mC9avbWxOcAwdr28H2gFiFS7xg+TSc:SHTRmC9avyhA78WgiSS+TS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
MD5 14f5984b926208de2aafb55dd9971d4a
SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/SDM143/ExentCtlInstaller.dll

SHA256 fa4601e6048ca661536882e91e9756526de719c5db298f5481f892c121200a66
MD5 b7ad06c57419ed74fff4872b8693c353
SHA1 753e6a6f55503ff14f243e07c80915df445d8efa
SHA512 838c9211fef9de1706409b8304ed43236d4b3dbfa551c56d51f15c4c31e18a2a7f64722ef4c6c291768ecf7ca40d9ae1ec08f3afab4979323a66caeb3452aa8f
SSDEEP 1536:JyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/:o9eS3sF5EsuyQgp2out/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

396992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/SDM143/Free Ride Games.exe

SHA256 b07ca37c2938966d2290c8b76f039febe8da9a919ad235b8eedaa583ce991b92
MD5 dc7b5f12c7ff9af697203cb0c59a3516
SHA1 1769c4f64f8ab818a797e3fa1e5331a50ffdd678
SHA512 904ae1dc91e5315f05be5cd7239f3fc4d3702b8c78dfd93d76b64d1cc1d7051aa005de2c69e5a8654eae8131dbd3d80c66f6e33d7c8b097972285405a5799350
SSDEEP 12288:Q/1wvJbps7IlWti1FacZ4I8zvk9ZqxGC5Ppy2NNoSYt:Q9wv1psV8F3ZQzM9wFppy2Nk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
NSIS installer

installer

Digest

7f:8e:36:af:2a:59:6d:7f:8e:f7:41:31:53:7b:a5:cc:d9:d0:d0:0a:e2:ee:b3:4e:d5:09:55:78:45:fe:93:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Nov 20, 2017

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

1363568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/SDM143/Splash/loader1.jpg

SHA256 3006d27765d5ee4204c312e02347d09b7ef7d7ceb0f712ebc5fb4b1eef7df2bd
MD5 069fc33dd659035d7d2251abad8beeb7
SHA1 e380ffeda732ca18902a9dd0b937a59cb530e574
SHA512 746ce0e229e30fd9a18e5897f363ceec11d06967651c7c6c8b9de7dfbfe5329559f975401c093a575d437c58cdd52926118b1e1a6d30b16c2671a284c8259cff
SSDEEP 192:BrRn82K0GaMCICNTcatbgmkXP3bvGhnwSkR7fhL4O1zbSYfMFFmbu:T82KsvcVmaP3KNktelSMfJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader2.jpg

SHA256 22a9972800d0e6bc97b6f883052a2e8145e91c5301c3c861c682edbdbe6c7192
MD5 af853a9f5673a3c3575291eca0fbb9ea
SHA1 40e41b1d46984b33f930a0d0aafe811efe962ccb
SHA512 2187eb2f7a11e9cfeabb3843391a931883f6391302027aed008c0c0a9af4378fe15590cc2e19b320eaa18ecf823d1e8ab61f6136c9df0202360434b1b8a374f3
SSDEEP 192:BX/d61tAWLQ87GaDbdNPwFbuAAWc871MhbxaRt0wVg6prSXoFkhcb7qBzmhPf97n:D61tzLQ2DBNMyY1MC3Df9SXs7AzWt7Nd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader3.jpg

SHA256 8b102d38a8095a6165aada839a756b9d76cb9d433eacdb7c6ca95c0a51e76779
MD5 649604df8cc5dedd3b85323519b32228
SHA1 56bc8b6a4624663d3c6344ac0a10833309d430ab
SHA512 9b8ddf44e86b73763d39c25a0b03459ab98c3e6ecb64c4e131e4393258e9be8de652dfbd871405b748aea35e7b728cb81d715e8fe4b6e66db1c7d00221bc6e84
SSDEEP 192:BdPT8W1ugGaQLGaIuh8qGDcaVbGkX0XxayZGTjFXoFhUms6wnFpuOTW:H8W1q/Dhicxa00yZGhXshM6ofTW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader4.jpg

SHA256 1d79485f51813e85ef150e9612a5cdb6fb17f748d54503a2792965d99b95bbf5
MD5 822ac13d718afad4f2178cca348b52c4
SHA1 9dd5b3f05f0f2f16700afafb43292bd16a3fc196
SHA512 a13e7e78b2f95bc58ba03e29ddb6a9f8412e473b98cc94f907ae4c8a06b9d1b1be0e6156c515ce875ab7429e85a30c54541eeb75f7def9efc10dff5e10348ec8
SSDEEP 192:BFc6mBxGaonGgmnzXAYGcVjnv1HlLknXXkmYkykbcTVmWkHnIbgJwaNtkPm8Rzn:1SoGgEQiVzz8XdnykbcxFkHuqwQqlRzn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader5.jpg

SHA256 674aa4d23e072ad568af3f20173297dc3b339e6252ccd07c80591cdda584aab4
MD5 e10e6948952154dc44cef8873c0e4d6c
SHA1 92f7a127c0b9db011489e558a51b88330f2d5e01
SHA512 02ad5427a5643a0d99e7d04dbc58f4a1038dccf3afd4d44a33bbe542f94af07d609aff979ebb8bf5ee5a5c8b719cd6461eb17c85051dd3e16e0d117dfc8c3936
SSDEEP 192:B3EfGaAv4HwBeyfJSbnOWSEV8xao0iV1GiYe2XoFYL0sqSy8KfXn:KAv4QBecJknOzGjo5UBFXsUlqFXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader6.jpg

SHA256 59ea97dfddc92f57f9bebfd566ec4f31966bcc0fc5841fb06f69eebfaa1b0fdb
MD5 c2ea2fa6b012e2b697a6aaa91a46202c
SHA1 6490b26596fae9e1aceb4781dffc8a3acc4e764c
SHA512 953b478790be26c2d9f6ccae2c527f9474433e18cac88370e89c6388d9261d60d13bea1f774efd8a6da52cbe1b4de5f456e3085bceee62624fde24c94817df3b
SSDEEP 192:B5RB8CfDGaMZJZxUCZoLftH749/wfhL4O1zbSdQezOo+dBqe:z8YrYvUCZoLftMdIelnN0T
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splasher.dll

IMPHASH 8926e573f4b66cfe7558e5db5a6688aa
SHA256 7868cec689ba10bb6d8a5a1abc0508183b817e5814fc504e090e104dd7d37483
MD5 a6a8f89250cdc734a163868a0f5cccea
SHA1 6ab06aaf1e795bc1a72c8095708568cf2d3bed38
SHA512 7991d28467ee0a896e304d18c7fc4caac9e9ac2f57198313d5688ddc68e22ae80447c92a097b5e4ed6ff86a90df607ff1ffa61c07082f85b5f222b07aa4a7ca2
SSDEEP 12288:xI2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw:8TayPLDltMUiQ8Zceqw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

170110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Work\TFS\ExentServices\PC\Share\Splasher\Release\Splasher.pdb

kernel32

OutputDebugStringA CreateEventA SetEvent WaitForSingleObject GetModuleHandleExW GetTimeZoneInformation CompareStringW GetDateFormatA GetTimeFormatA AreFileApisANSI GetModuleHandleA FindFirstFileW GetCurrentDirectoryW GetFileAttributesW DeviceIoControl HeapAlloc GetProcessHeap HeapFree GetTickCount CreateFileW ReadFile SetFilePointer WriteFile GetLastError SetLastError FlushFileBuffers FindNextFileW CloseHandle InterlockedCompareExchange InterlockedExchange MultiByteToWideChar InterlockedIncrement InterlockedDecrement WideCharToMultiByte GetStringTypeW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime TlsAlloc TlsFree TlsGetValue GetCurrentThreadId GetCurrentProcessId OpenEventA ResetEvent TlsSetValue ResumeThread LocalFree FormatMessageA QueryPerformanceCounter GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA GetCommandLineA RaiseException RtlUnwind GetCPInfo ExitThread CreateThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW GetLocaleInfoW HeapSize GetProcAddress GetModuleHandleW ExitProcess HeapCreate HeapDestroy GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode LoadLibraryW SetStdHandle WriteConsoleW FindClose SetEnvironmentVariableA

user32

GetDesktopWindow GetWindowRect UnregisterClassW DispatchMessageW TranslateMessage GetMessageW SetTimer ShowWindow SetWindowLongW CreateWindowExW RegisterClassW DefWindowProcW PostQuitMessage SetWindowPos ClientToScreen GetCursorPos SetLayeredWindowAttributes DestroyWindow LoadStringA ReleaseDC GetWindowDC GetClientRect GetWindowLongW LoadCursorW

gdi32

DeleteDC BitBlt SelectObject CreateCompatibleDC GetObjectW

oleaut32

OleLoadPicturePath

Name

.text

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/SDM143/cmhelper.exe

IMPHASH f5c5d75dcb7ff0affa88aae192f72bf4
SHA256 9c980d85903561c44f84faaee80d911bf3c9ef9d238fe69b7ccc6998d0fe9232
MD5 2c3c18baaee7775b6d588cdf1529e528
SHA1 88fa58fbabde59e80c96e7676730ca40d1649b9a
SHA512 4b69953b02d5c810003eb938da85b51b4906c48e48f441175a3ab76b6e8e5dc293ee683a9c90503b3db4ae72cd6557b8609dc1f4fefc82322f946a7072208348
SSDEEP 6144:lcF3h+/MWLriz/BaQKoiQH22uhJFJoaMOKFNgv5x48yH2geFELNtgd:lcF3h+By/BaQKoiQHa7oG/Fhd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c7:b7:0c:e2:14:5c:2a:13:eb:d9:e0:5b:bb:da:ee:4a:51:ef:22:f5:99:79:be:80:c7:a0:89:3d:ea:40:2c:cb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Nov 12, 2017

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

113053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessA GetModuleFileNameA GetCurrentProcess OpenEventA WaitForSingleObject MultiByteToWideChar LocalFree CompareFileTime CreateFileA WriteFile CloseHandle GetSystemTimeAsFileTime InterlockedDecrement LoadLibraryA FreeLibrary DeleteFileA GetLastError GetModuleHandleA GetProcAddress WideCharToMultiByte GetVersionExA SetEvent GetCommandLineA SetEnvironmentVariableA SetEndOfFile GetLocaleInfoW ReadFile SetStdHandle IsBadCodePtr IsBadReadPtr GetTimeZoneInformation GetStringTypeW GetStringTypeA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale GetFileType EnterCriticalSection Sleep InitializeCriticalSection InterlockedExchange DeleteCriticalSection LeaveCriticalSection InterlockedIncrement lstrlenA RtlUnwind RaiseException HeapFree HeapAlloc GetStartupInfoA GetVersion ExitProcess HeapReAlloc LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW TerminateProcess HeapSize GetACP GetOEMCP GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue SetFilePointer FlushFileBuffers SetUnhandledExceptionFilter GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle

advapi32

CreateWellKnownSid OpenProcessToken DuplicateTokenEx GetLengthSid SetTokenInformation CreateProcessAsUserA ConvertStringSidToSidA GetUserNameA RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegCloseKey FreeSid

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize CoTaskMemFree

oleaut32

SysAllocString SysFreeString VariantClear

wininet

FindFirstUrlCacheEntryA CreateUrlCacheEntryA DeleteUrlCacheEntry FindNextUrlCacheEntryA CommitUrlCacheEntryA FindCloseUrlCache

$TEMP/SDM143/resourceDll.dll

SHA256 e31a495075247fba426b5a4928560a578eaab44f828a2fdca496a05589509352
MD5 0c395ce6f6961054219b6d34927f8903
SHA1 55fd653c8f6d1253e221d49f1dd097ea73262d55
SHA512 e6b2f487eea8c5687a41ad58d955cb67b48881a728eb84f730a1d8ec50057bf80f77a21e22ad977673bff9d783deac02ebeab7252ccc7f98b3ecc34486b2b67b
SSDEEP 3072:GZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vHKJA+KCbxQ9w9ZcnPfout5zes5Cq:wWwqGaJfGZ1Mq5BRjh86arKfoS5z5l
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
NSIS installer

installer

Digest

a5:a6:73:f6:ae:9d:d6:36:3a:dd:95:55:37:5d:bd:5f:8f:36:73:7c:3d:85:f3:d7:f2:e0:9f:f4:3f:6c:be:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,ST=Israel,C=IL

Chains

Nov 29, 2016

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,ST=Israel,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,ST=Israel,C=IL

Serial Number

1e:33:b8:5f:e8:ed:0d:1c:b4:2e:58:0d:5a:97:07:d0

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 7, 2016 - Oct 2, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 2,O=GeoTrust Inc,C=US

Serial Number

2d:4e:86:50:85:be:e0:0e:13:72:28:b3:d0:b1:32:e9

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

0

Major OS version

4

Entry point

620448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer