21722a110bb1e6b58669826818f86cda_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	acprotect
static1/unpack001/$TEMP/SDM143/ExentCtlInstaller.dll	acprotect
static1/unpack001/$TEMP/SDM143/resourceDll.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	upx
static1/unpack001/$TEMP/SDM143/ExentCtlInstaller.dll	upx
static1/unpack001/$TEMP/SDM143/Free Ride Games.exe	upx
static1/unpack001/$TEMP/SDM143/resourceDll.dll	upx

resource
unpack001/$PLUGINSDIR/SelfDel.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 b157fd3064fc77b986f5333b9f0b898c5ea3677f1434fb8ca2369e18b43af166
MD5 21722a110bb1e6b58669826818f86cda
SHA1 314fb1740ce849295e5c34f71671cf631853872f
SHA512 4b30a12909ed2149e7a076d4b287d19b0fa012365decfe8aef989f330157d8505d1cd0e639127d1a977e8e3a361bd33300662a3ebb0edc8cc23dbd62e7180b5e
SSDEEP 24576:oDX2vzptbfKL1oX1Y5wrrRsrW7RdYxMn4iuKbQaqfQN+Qfsqo:QGvz5Xa0Nsr4Qx64qfqqB0qo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

c9:66:aa:75:40:0f:0e:ac:83:a6:13:1d:b4:af:b0:b3:d9:76:78:e5:9c:e1:8f:fb:34:93:a3:86:66:1d:8f:73

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah Tikva,C=IL

Chains

Feb 20, 2019

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah Tikva,C=IL

Serial Number

43:80:3b:f4:7a:f2:62:3c:87:ed:77:20:a4:d5:b3:c6

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 4, 2018 - Oct 4, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12514

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/SelfDel.dll

SHA256 d115bce0a787b4f895e700efe943695c8f1087782807d91d831f6015b0f98774
MD5 e5786e8703d651bc8bd4bfecf46d3844
SHA1 fee5aa4b325deecbf69ccb6eadd89bd5ae59723f
SHA512 d14ad43a01db19428cd8ccd2fe101750860933409b5be2eb85a3e400efcd37b1b6425ce84e87a7fe46ecabc7b91c4b450259e624c178b86e194ba7da97957ba3
SSDEEP 96:NdekHUj5z13cPopei+Ml9PNDFbS7xg+TScrQ5:NdeuU9xcPopr+M9FbSS+TSE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

30272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 91eadf9505a1212432547314f75e4d01be393f1392ae03f11e9534804213ae4f
MD5 517aee7f68b46b0f550dde61c5dcb66d
SHA1 20981977561bf589d7f5539776eaf9fd8a87542e
SHA512 96b5aaf5ece2e66d5726c1f33be31297f0754f771a202dfb2edd0f118e60dd6238c482f4ac36697bb3d14c106356be1178adab4ed71c213a322129d2a4e68433
SSDEEP 96:SHT97mC9avbWxOcAwdr28H2gFiFS7xg+TSc:SHTRmC9avyhA78WgiSS+TS
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4906

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 75ed40311875312617d6711baed0be29fcaee71031ca27a8d308a72b15a51e49
MD5 a436db0c473a087eb61ff5c53c34ba27
SHA1 65ea67e424e75f5065132b539c8b2eda88aa0506
SHA512 908f46a855480af6eacb2fb64de0e60b1e04bbb10b23992e2cf38a4cbebdcd7d3928c4c022d7ad9f7479265a8f426b93eef580afec95570e654c360d62f5e08d
SSDEEP 192:aVL7iZJX76BisO7+UZEw+Rl59pV8ghsVJ39dx8T:d7NsOpZsfLMJ39e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10020

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 6b7d154c806f1e47db325229c300c6df
SHA256 030bcfa82e3bb424835a5fa53a3ff17ab08557d3bbeea4815313036fc4bdafe1
MD5 14f5984b926208de2aafb55dd9971d4a
SHA1 e5afe0b80568135d3e259c73f93947d758a7b980
SHA512 e9ec97dd57ead871789d49ed38d9fde5f31d3cb2547810cae49a736e06b9f9b28cf8efea825eb83c3e07d880ee798abfb9069c6957416d5973c83e4531814e27
SSDEEP 96:k7GUaYNwCLuGFctpiKFlYJ8hH4RVHpwdEeY3kRlDr6dMqqyVgNJ38:Wygp3FcHi0xhYMR8dMqJVgN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/SDM143/ExentCtlInstaller.dll

SHA256 76814c96196776c5ed4d65b9144d66423c78fda2faa61daf87cf4c742c07551b
MD5 6b2c9276b76ff82abc5b12626a6b3201
SHA1 ff1c09a79230e66eb6df7f6d7848710f1acfffa1
SHA512 20bc0e0f236bf7f4cb91dfa205b41175abe2a830d4adb9f210d2da2291ddc444c8484485c5c97a0141cfb3763b1e46542f5b211057966d85dc4d4c764e8eefe0
SSDEEP 1536:GyrB9NViYoJ3w1NjSzF5yfBsiZpsVI2TFQblrjgZYBmmlNL9bnouy8/Dvs3h5h:19eS3sF5EsuyQgp2out/DvSh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
NSIS installer

installer

Digest

3d:0a:4d:02:c8:b1:27:7c:bc:8f:7b:a9:2a:0c:43:98:09:85:5a:c7:a7:1f:a2:7b:18:9b:7d:22:17:0e:8e:1e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

May 6, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

396992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/SDM143/Free Ride Games.exe

SHA256 18f4519d20252bf579b887adec25554ac412bd79604547cca12f9f589549f952
MD5 23cad4075e1fd5d47c0434fef549efde
SHA1 d7cdc7cb933466474986ae37fc7ebefdad601aaf
SHA512 e4176411caac89db8dd073f2b47b7970168dacad4cdecc6edae310591e279149430b10ab1f956a7722ab22677ca893bfc4eb3fe17009b9b73a95e288c12c89b1
SSDEEP 12288:0obl5KiSHoYxGZ2YI7jjN3iR4S/RQq4jrY+vyRPZbN7yTMhHoSKU:/bzKLHoV1wpwxZRsrY7RJATMP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
NSIS installer

installer

Digest

8b:fd:d1:01:0c:69:db:3d:0b:34:d1:b8:8c:a7:72:f2:d1:de:e4:79:26:d2:e4:fc:d5:c7:bf:30:b3:a2:23:3c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Aug 7, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

1360448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/SDM143/Splash/loader1.jpg

SHA256 3006d27765d5ee4204c312e02347d09b7ef7d7ceb0f712ebc5fb4b1eef7df2bd
MD5 069fc33dd659035d7d2251abad8beeb7
SHA1 e380ffeda732ca18902a9dd0b937a59cb530e574
SHA512 746ce0e229e30fd9a18e5897f363ceec11d06967651c7c6c8b9de7dfbfe5329559f975401c093a575d437c58cdd52926118b1e1a6d30b16c2671a284c8259cff
SSDEEP 192:BrRn82K0GaMCICNTcatbgmkXP3bvGhnwSkR7fhL4O1zbSYfMFFmbu:T82KsvcVmaP3KNktelSMfJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader2.jpg

SHA256 22a9972800d0e6bc97b6f883052a2e8145e91c5301c3c861c682edbdbe6c7192
MD5 af853a9f5673a3c3575291eca0fbb9ea
SHA1 40e41b1d46984b33f930a0d0aafe811efe962ccb
SHA512 2187eb2f7a11e9cfeabb3843391a931883f6391302027aed008c0c0a9af4378fe15590cc2e19b320eaa18ecf823d1e8ab61f6136c9df0202360434b1b8a374f3
SSDEEP 192:BX/d61tAWLQ87GaDbdNPwFbuAAWc871MhbxaRt0wVg6prSXoFkhcb7qBzmhPf97n:D61tzLQ2DBNMyY1MC3Df9SXs7AzWt7Nd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader3.jpg

SHA256 8b102d38a8095a6165aada839a756b9d76cb9d433eacdb7c6ca95c0a51e76779
MD5 649604df8cc5dedd3b85323519b32228
SHA1 56bc8b6a4624663d3c6344ac0a10833309d430ab
SHA512 9b8ddf44e86b73763d39c25a0b03459ab98c3e6ecb64c4e131e4393258e9be8de652dfbd871405b748aea35e7b728cb81d715e8fe4b6e66db1c7d00221bc6e84
SSDEEP 192:BdPT8W1ugGaQLGaIuh8qGDcaVbGkX0XxayZGTjFXoFhUms6wnFpuOTW:H8W1q/Dhicxa00yZGhXshM6ofTW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader4.jpg

SHA256 1d79485f51813e85ef150e9612a5cdb6fb17f748d54503a2792965d99b95bbf5
MD5 822ac13d718afad4f2178cca348b52c4
SHA1 9dd5b3f05f0f2f16700afafb43292bd16a3fc196
SHA512 a13e7e78b2f95bc58ba03e29ddb6a9f8412e473b98cc94f907ae4c8a06b9d1b1be0e6156c515ce875ab7429e85a30c54541eeb75f7def9efc10dff5e10348ec8
SSDEEP 192:BFc6mBxGaonGgmnzXAYGcVjnv1HlLknXXkmYkykbcTVmWkHnIbgJwaNtkPm8Rzn:1SoGgEQiVzz8XdnykbcxFkHuqwQqlRzn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader5.jpg

SHA256 674aa4d23e072ad568af3f20173297dc3b339e6252ccd07c80591cdda584aab4
MD5 e10e6948952154dc44cef8873c0e4d6c
SHA1 92f7a127c0b9db011489e558a51b88330f2d5e01
SHA512 02ad5427a5643a0d99e7d04dbc58f4a1038dccf3afd4d44a33bbe542f94af07d609aff979ebb8bf5ee5a5c8b719cd6461eb17c85051dd3e16e0d117dfc8c3936
SSDEEP 192:B3EfGaAv4HwBeyfJSbnOWSEV8xao0iV1GiYe2XoFYL0sqSy8KfXn:KAv4QBecJknOzGjo5UBFXsUlqFXn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splash/loader6.jpg

SHA256 59ea97dfddc92f57f9bebfd566ec4f31966bcc0fc5841fb06f69eebfaa1b0fdb
MD5 c2ea2fa6b012e2b697a6aaa91a46202c
SHA1 6490b26596fae9e1aceb4781dffc8a3acc4e764c
SHA512 953b478790be26c2d9f6ccae2c527f9474433e18cac88370e89c6388d9261d60d13bea1f774efd8a6da52cbe1b4de5f456e3085bceee62624fde24c94817df3b
SSDEEP 192:B5RB8CfDGaMZJZxUCZoLftH749/wfhL4O1zbSdQezOo+dBqe:z8YrYvUCZoLftMdIelnN0T
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/SDM143/Splasher.dll

IMPHASH 8926e573f4b66cfe7558e5db5a6688aa
SHA256 2e522a4da2c291ebcde484b4a04a6ef0691a732b9db454f12399d3e577327c96
MD5 41d94c8eb8cb17e04f8ec6e14132f9ca
SHA1 add92b031eb36b26335763780df88bca58636ed7
SHA512 0561594d671cc64717463d59e2f076453614584ccdd47b4a39cd347e9999ba63463233c75dd9972102a2634b1abfe6c97fa8f682d944bc5cf129724b7595faa7
SSDEEP 12288:2I2EL1NaycNyL+kNmQLnmQtMleiQ8Zceqw1:tTayPLDltMUiQ8Zceqw1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

37:31:1f:85:42:a7:03:be:e6:03:5c:72:80:88:ab:54:21:6c:82:54:b3:a1:b7:70:16:ab:0d:d3:c5:d7:df:8d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

May 7, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

1

Major OS version

5

Entry point

170110

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Work\TFS\ExentServices\PC\Share\Splasher\Release\Splasher.pdb

kernel32

OutputDebugStringA CreateEventA SetEvent WaitForSingleObject GetModuleHandleExW GetTimeZoneInformation CompareStringW GetDateFormatA GetTimeFormatA AreFileApisANSI GetModuleHandleA FindFirstFileW GetCurrentDirectoryW GetFileAttributesW DeviceIoControl HeapAlloc GetProcessHeap HeapFree GetTickCount CreateFileW ReadFile SetFilePointer WriteFile GetLastError SetLastError FlushFileBuffers FindNextFileW CloseHandle InterlockedCompareExchange InterlockedExchange MultiByteToWideChar InterlockedIncrement InterlockedDecrement WideCharToMultiByte GetStringTypeW Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime TlsAlloc TlsFree TlsGetValue GetCurrentThreadId GetCurrentProcessId OpenEventA ResetEvent TlsSetValue ResumeThread LocalFree FormatMessageA QueryPerformanceCounter GetUserDefaultLCID GetStringTypeExA FreeLibrary LCMapStringA LCMapStringW LoadLibraryA GetCommandLineA RaiseException RtlUnwind GetCPInfo ExitThread CreateThread TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetHandleCount GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameW GetLocaleInfoW HeapSize GetProcAddress GetModuleHandleW ExitProcess HeapCreate HeapDestroy GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetACP GetOEMCP IsValidCodePage GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapReAlloc GetConsoleCP GetConsoleMode LoadLibraryW SetStdHandle WriteConsoleW FindClose SetEnvironmentVariableA

user32

GetDesktopWindow GetWindowRect UnregisterClassW DispatchMessageW TranslateMessage GetMessageW SetTimer ShowWindow SetWindowLongW CreateWindowExW RegisterClassW DefWindowProcW PostQuitMessage SetWindowPos ClientToScreen GetCursorPos SetLayeredWindowAttributes DestroyWindow LoadStringA ReleaseDC GetWindowDC GetClientRect GetWindowLongW LoadCursorW

gdi32

DeleteDC BitBlt SelectObject CreateCompatibleDC GetObjectW

oleaut32

OleLoadPicturePath

Name

.text

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/SDM143/cmhelper.exe

IMPHASH f5c5d75dcb7ff0affa88aae192f72bf4
SHA256 93a63465ea363661a141043c404f5b94ab9ac6cfeee3fd158bdf4e1fc50e3af5
MD5 3a9774028e1e3968b8c202fd199d0084
SHA1 6e19763c3f42c8d6596135a7566bef07a0cbeadd
SHA512 ea7e67887d7b8fd3e6049ee1ba7a786bb895158279e464c5c7a35e323aefac34e81e5515e493acf447953a08f13b94024c4a460ebc77f03ef0d305feb8b81d06
SSDEEP 6144:VcF3h+/MWLriz/BaQKoiQH22uhJFJoaMOKFNgv5x48yH2geFELNtgxQh:VcF3h+By/BaQKoiQHa7oG/Fh0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

78:e4:e6:04:02:e4:95:09:8e:ab:c1:e9:ff:34:d9:48:c1:90:82:f9:47:7a:ca:96:5d:ee:36:37:a3:46:41:3e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Jun 20, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

113053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessA GetModuleFileNameA GetCurrentProcess OpenEventA WaitForSingleObject MultiByteToWideChar LocalFree CompareFileTime CreateFileA WriteFile CloseHandle GetSystemTimeAsFileTime InterlockedDecrement LoadLibraryA FreeLibrary DeleteFileA GetLastError GetModuleHandleA GetProcAddress WideCharToMultiByte GetVersionExA SetEvent GetCommandLineA SetEnvironmentVariableA SetEndOfFile GetLocaleInfoW ReadFile SetStdHandle IsBadCodePtr IsBadReadPtr GetTimeZoneInformation GetStringTypeW GetStringTypeA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale GetFileType EnterCriticalSection Sleep InitializeCriticalSection InterlockedExchange DeleteCriticalSection LeaveCriticalSection InterlockedIncrement lstrlenA RtlUnwind RaiseException HeapFree HeapAlloc GetStartupInfoA GetVersion ExitProcess HeapReAlloc LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW TerminateProcess HeapSize GetACP GetOEMCP GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue SetFilePointer FlushFileBuffers SetUnhandledExceptionFilter GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle

advapi32

CreateWellKnownSid OpenProcessToken DuplicateTokenEx GetLengthSid SetTokenInformation CreateProcessAsUserA ConvertStringSidToSidA GetUserNameA RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegCloseKey FreeSid

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize CoTaskMemFree

oleaut32

SysAllocString SysFreeString VariantClear

wininet

FindFirstUrlCacheEntryA CreateUrlCacheEntryA DeleteUrlCacheEntry FindNextUrlCacheEntryA CommitUrlCacheEntryA FindCloseUrlCache

$TEMP/SDM143/resourceDll.dll

SHA256 7d940af8950b106227539cd4bdfb62f2d37a4abeaf568ebe2275fd31058c2ca5
MD5 5cf0fba9e8775382233c8e63e52c838a
SHA1 b2a092f71eff0f6916652d7f3bfde9204eda5636
SHA512 73489e3638b98ffd7bd516bfed519cfd48758aaaedc11cb202d11822cad609caf9af95e9e864bd8a992be826945e6d018ce081f3970511fd49d7757ca6affd25
SSDEEP 3072:+ZY/h+iA4GaJfGZK2MiMq5dpNQA2Wj5vg/ySQGdXMd86a30GCooutkzjO:YWwqGaJfGZ1Mq5BRj2/yR8XMZ0CooSkz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
NSIS installer

installer

Digest

fa:d6:7d:3f:e6:c7:a3:4e:ff:b4:6f:7b:5e:f1:b8:ed:55:5f:d4:a7:bf:1e:af:13:34:d8:55:5b:74:e9:be:54

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Chains

Jun 19, 2018

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Exent Technologies Ltd.,O=Exent Technologies Ltd.,L=Petah-Tikva,C=IL

Serial Number

38:cc:14:0e:0a:cd:4f:d3:da:b0:79:8b:63:b2:9d:36

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

0

Major OS version

4

Entry point

620544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer