264b27b9ac7ac6874e50d073638930b5_JaffaCakes118

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/FindProcDLL.dll
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IMPHASH b1a57b635b23ffd553b3fd1e0960b2bd
SHA256 b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce
MD5 264b27b9ac7ac6874e50d073638930b5
SHA1 4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265
SHA512 8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d
SSDEEP 49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

12:b1:58:f9:af:11:fa:9f:d5:5a:f9:0a:a3:6b:14:c4:6b:75:27:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Chains

Oct 21, 2019

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Serial Number

04:62:c3:bf:37:94:62:6a:95:d1:77:78:fd:de:d8:63

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 22, 2019 - Mar 23, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

4

Entry point

12908

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA Sleep lstrcmpiA lstrlenA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc GetCommandLineA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/FindProcDLL.dll

IMPHASH 8df26927f8978d4eb40ff179c0aa961b
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StdUtils.dll

IMPHASH ea9b3ea5cd9e2014ad3724e31f62cf5e
SHA256 2aaef1ed8a25097b3a807568daeffd3320fa29d6de66df90a57beaa8df8949cf
MD5 0061a96c8ff17ad0927aae65b5dfe06b
SHA1 9d1bd69d930ccda683e6b7c2c0d1dbe3b54861fe
SHA512 c6b887a4e1682ba1e126c93bc4d886c7f1ce392f97866e631c5b8a945824cbefc9af2429a14c2dac3b16d97bd33195d4378a7e92ae53fdeb47197452d4d90fc4
SSDEEP 1536:0yy+i55jAPWrI5qXgcAZ5c4DB5G7NXE9eOO2xwN:3y+i5i+kEQcAZXGx0cr2xw
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

69072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

isspace _msize ??2@YAPAXI@Z iscntrl isalpha sscanf abort _beginthreadex time srand rand strncpy isalnum strchr __getmainargs _strnicmp _stricmp ??3@YAXPAX@Z calloc free _wcsicmp _snprintf memset memcpy

shlwapi

ord176

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

GetVersion InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA DeleteCriticalSection GetExitCodeProcess InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject GetModuleHandleA GetProcAddress GetCommandLineA GetVersionExA GetFileAttributesA LoadLibraryW GetModuleHandleW FreeLibrary CloseHandle GetFileSizeEx ReadFile WriteFile GlobalAlloc lstrcpynA GlobalFree LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetVersionExW VerifyVersionInfoW GetLastError LocalAlloc LocalFree CreateFileA SetFilePointerEx MultiByteToWideChar

user32

MessageBoxW RegisterClassA DispatchMessageA UnregisterClassA AllowSetForegroundWindow SetTimer DestroyWindow wsprintfA GetWindowThreadProcessId LoadStringW MessageBoxA MsgWaitForMultipleObjects KillTimer PeekMessageA CreateWindowExA

shell32

ShellExecuteExA SHFileOperationA ShellExecuteA

ole32

CoCreateInstance CoUninitialize CoInitialize

oleaut32

VariantClear SysFreeString VariantInit SysAllocString

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 961a483377f9e64e52559c3a32ae9e6a1d69fc1aff1db35dc808dc6482634611
MD5 2ae57cb0b942a8aa96cdb98ab404e4d7
SHA1 7e4434f826cc050e02c4c026cd006a6a6a9e1564
SHA512 cad783f3e64744bb7c8a07a21843a1953247dfaf3eec22fd290db8034b704bd3ddb63d99a83d5075ecd061c5971746cc1250d5cda0f6002c647833a533a5ec3e
SSDEEP 192:O8B3k30+LOjcf0EcUuR1SXdsSjKpxBJFkcaOyKKNpIfF:O8Fk3J2cfA1GdJj6Tkca5Kms
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 16ee946b6a43b6df0c235a5e6ef3dcaa7915a046d08cd2d856e941387d3185d5
MD5 e9c7e6a6b484e7bac632fe22105647bb
SHA1 02781e1fc1ce10ddb8435c71eba8cda53b191c91
SHA512 b272a09f32e62377f94f96ec71865475990c92e5ffa7a2dacaa01307fe53d2f1d4db2e0164f0f9b8900fa66eb4a45e20fbf596cae5aa3e075f341c061db8e528
SSDEEP 3072:bRVARPgl9hehb8cnCzSmPAiCUmVC44NBKLs71lVbFitVYo0AJA8OyOWQ:bgRPOILnMLPAiaINBIs/IYlAJA3TD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

lander.ini

SHA256 12716129d868416e5a74e20f27ce1c83a0e7e3a93b2b2779244c5753004dd9e2
MD5 fdfee9c8468fa32041decb54b2561daf
SHA1 34bc705b9d0f5da8a2b5a72af9b4bb8aef7980ae
SHA512 8999d1683742fb496043228b1ab43c5c85b173fab0e4536958c779ebf3bf02c9d70180098d70b726d3c5982cfe44a3bf2ddbc59391fe2e1ca99fb18ca9736e06
MD5 SHA1 SHA512

NSIS installer

installer

pluginsetupadmin.exe

IMPHASH be1cf912c7eb13781ae5abe21c827ac8
SHA256 c007fefe59aa783e7ea677a6275f87b9675f750a8e31a67c8325440308eed90a
MD5 87daf3658c6aa863444532f1f324cca1
SHA1 c0caa342fcbde6a0c6b1566e71bc051117a7c40b
SHA512 050b10619e355fe16fc23bf83b7b38a5237adb80e406d79653c029182bf33a40c3717a12f80ce1e024e2afee305421b3f3947d38a833169576e1c3d0a9ebc551
SSDEEP 12288:7ugClTRuCj6KxXpDKlvuONobWHp9d/MJyKRs:78TRuo6KxZeluooKh/SyKRs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

46:6c:f5:96:05:83:60:4e:a5:4c:d8:9c:e8:a4:b8:56:04:ea:0c:e2:b0:47:e4:88:f5:6e:46:b9:6a:40:fd:8f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91510100MA6CU2BF03,CN=成都云合互动科技有限公司,O=成都云合互动科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e68890e983bde5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Oct 14, 2019

SERIALNUMBER=91510100MA6CU2BF03,CN=成都云合互动科技有限公司,O=成都云合互动科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e68890e983bde5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

b3:da:d0:38:c6:78:2e:2c:10:15:1f:7e:e8:58:a2:4c:27:aa:ab:be

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91510100MA6CU2BF03,CN=成都云合互动科技有限公司,O=成都云合互动科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e68890e983bde5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

May 3, 2024

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91510100MA6CU2BF03,CN=成都云合互动科技有限公司,O=成都云合互动科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e68890e983bde5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

02:b0:a2:3e:3c:75:dd:41:52:ae:c8:ab:e5:b2:08:4c

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2019 - Sep 27, 2022

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 10, 2006 - Nov 10, 2031

Subject

SERIALNUMBER=91510100MA6CU2BF03,CN=成都云合互动科技有限公司,O=成都云合互动科技有限公司,L=成都市,ST=四川省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c09e68890e983bde5b882,1.3.6.1.4.1.311.60.2.1.2=#0c09e59b9be5b79de79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

09:78:1d:9a:bc:06:00:70:ac:8c:fa:04:05:0e:cb:3e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2019 - Sep 27, 2022

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

0

Major OS version

4

Entry point

33109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

g:\pluginv3_compile\plugins\Release\pluginsetupadmin.pdb

shell32

SHGetSpecialFolderPathW

ole32

OleInitialize OleUninitialize

kernel32

FreeEnvironmentStringsA LoadLibraryW GetProcAddress FindResourceW FreeLibrary SizeofResource LoadResource MultiByteToWideChar LockResource FreeResource CloseHandle SetFileAttributesW CreateDirectoryW SetFileTime WriteFile CreateFileW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetLastError HeapFree GetVersionExA HeapAlloc GetProcessHeap GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId RaiseException RtlUnwind GetModuleHandleA ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep HeapSize VirtualAlloc HeapReAlloc LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA WideCharToMultiByte GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW

sz.exe

IMPHASH ef69579d12293bbff01a51390ca3f2c6
SHA256 bcc516b915a8826ef12689e455d0b1afaa7ad1eae534729eb43e6639a95992f6
MD5 5fd84590e2e1358a8e51fb76b1b3d721
SHA1 eea0902b66e1082a5ba9a1ad7c4bcd3fb5d53154
SHA512 3e9de52d11522b5115d30b51a6cf5b43e28df27432e7d0aa0eeecd0648ab1d3622b30f921bbed011681ba7c286d71053486bb0b6949103b69adab1cc4e5e1281
SSDEEP 24576:hyPL2BkBGuDHCu9lpaE6ua0gY28UlyvCKk3U9wlozxjv2k6DjIVnF0SK+OGkn:G2BkBpCurMpujW8ptxOkMj6nFjdO5n
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

19:46:ac:ac:3a:2c:98:27:c8:26:95:36:92:03:96:be:bf:17:c0:24

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Chains

Oct 21, 2019

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Serial Number

04:62:c3:bf:37:94:62:6a:95:d1:77:78:fd:de:d8:63

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 22, 2019 - Mar 23, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

5

Entry point

210827

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\37Work\pc_code\lander\sz_2345\04代码\Bin\lander.pdb

kernel32

lstrcmpiW MultiByteToWideChar LoadLibraryExW CreateDirectoryW GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW GetTempPathW WideCharToMultiByte GetSystemInfo CreateEventW SetEvent CreateFileW WriteFile Sleep DeleteFileW GetTickCount GetVersionExW ReadFile GetProcessAffinityMask SetProcessAffinityMask SetPriorityClass DeviceIoControl SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile CreateFileA GetLocaleInfoW SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA InitializeCriticalSectionAndSpinCount GetModuleHandleA GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeA IsValidLocale EnumSystemLocalesA FindResourceExW CreateProcessW FlushFileBuffers SetFilePointer GetConsoleMode GetConsoleCP GetDateFormatA GetTimeFormatA IsValidCodePage GetOEMCP GetACP GetTimeZoneInformation GetStartupInfoA GetFileType SetHandleCount TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle ExitProcess HeapCreate GetStringTypeW GetCPInfo LCMapStringW LCMapStringA RtlUnwind GetStartupInfoW GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess CreateThread ExitThread VirtualQuery VirtualProtect HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetLocaleInfoA GetCommandLineW FreeLibrary GetProcAddress GlobalUnlock GlobalLock GetModuleHandleW lstrcmpW MulDiv FlushInstructionCache GetCurrentProcess SetLastError RaiseException GetCurrentThreadId GetLastError GetModuleFileNameW ResumeThread TerminateThread GetExitCodeThread CloseHandle WaitForSingleObject IsBadWritePtr InterlockedDecrement InterlockedIncrement lstrlenW DeleteCriticalSection GlobalFree InitializeCriticalSection GlobalAlloc SizeofResource LockResource FreeResource LoadResource EnterCriticalSection FindResourceW InterlockedExchange LeaveCriticalSection GetUserDefaultLCID

user32

UpdateLayeredWindow GetDC GetWindowLongW SetWindowLongW ShowWindow ReleaseDC UnregisterClassA DefWindowProcW UpdateWindow ClientToScreen MessageBoxW SystemParametersInfoW SendMessageW GetClientRect IsIconic InflateRect SetWindowPos SetWindowRgn IsChild GetWindowRect LoadMenuW GetSubMenu RemoveMenu DestroyMenu TrackPopupMenu GetCursorPos LoadIconW PostMessageW GetAsyncKeyState MoveWindow CallWindowProcW RegisterClassExW LoadCursorW DestroyAcceleratorTable GetDesktopWindow InvalidateRect InvalidateRgn FillRect ReleaseCapture SetCapture ScreenToClient GetParent CreateAcceleratorTableW DestroyWindow CreateWindowExW GetClassInfoExW RedrawWindow CharNextW GetSysColor GetClassNameW IsWindow GetDlgItem GetWindow SetFocus GetFocus DrawTextW OffsetRect SetCursor PtInRect LoadImageW IsWindowVisible GetForegroundWindow PeekMessageW GetMessageW TranslateMessage DispatchMessageW SetForegroundWindow LoadStringW GetKeyState PostQuitMessage SetLayeredWindowAttributes RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW BeginPaint EndPaint

gdi32

CreateRoundRectRgn RestoreDC SetTextColor SetBkMode SaveDC CreateSolidBrush GetStockObject GetDeviceCaps BitBlt SetBkColor GetObjectW SetDIBColorTable SelectObject GetDIBColorTable StretchBlt DeleteObject CreateDIBSection CreateCompatibleDC DeleteDC CreateCompatibleBitmap CreateFontW

advapi32

RegSetValueExW OpenProcessToken RegDeleteValueW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegQueryValueExW GetTokenInformation

shell32

ShellExecuteExW ShellExecuteW SHGetSpecialFolderPathW Shell_NotifyIconW

ole32

CoCreateGuid CoTaskMemRealloc CoTaskMemFree CoUninitialize CoInitialize OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject CoCreateInstance OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize CreateStreamOnHGlobal

oleaut32

SafeArrayUnaccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayAccessData VarUI4FromStr SysAllocStringLen OleCreateFontIndirect DispCallFunc LoadTypeLi LoadRegTypeLi SafeArrayPutElement SafeArrayCreate VariantClear VariantInit SysStringLen SysAllocString SysFreeString

shlwapi

StrCpyW PathFileExistsW

comctl32

_TrackMouseEvent

msimg32

TransparentBlt AlphaBlend

gdiplus

GdiplusShutdown GdiplusStartup GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePalette GdipGetImagePaletteSize GdipGetImagePixelFormat GdipGetImageHeight GdipCloneImage GdipDrawImageI GdipDeleteGraphics GdipGetImageGraphicsContext GdipDisposeImage GdipAlloc GdipFree GdipGetImageWidth

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetConnectW InternetOpenW InternetCrackUrlW FindCloseUrlCache FindNextUrlCacheEntryW DeleteUrlCacheEntryW FindFirstUrlCacheEntryW InternetSetCookieW

iphlpapi

GetAdaptersInfo

uninst.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 1cb9f1b81e6c5b98feddee92c9d14fff89d4b111b0c0974c6e804d7dfdc36bdb
MD5 7ded51e887171a321fd7f5f59925ea42
SHA1 2d2654c5e0c4fb557383842a7de1c2036a2f569c
SHA512 980489325baa4c17d727334076e4228d582afe0884548bc132f4991cca6e96a92605c9b777af0b62162f90a326ee1145d2dcb056fc30390b28d6c9f015138827
SSDEEP 6144:H8LxBH3+tUVHZfKfj+v9ETgRPOILnMLPAiaINBIs/IYlAJA3Tfk6:M+tUT7OKMLPTaINBIs/nAW3Q6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

6e:34:94:b8:39:a1:bb:db:11:23:27:ef:d1:bc:ba:3a:3f:a1:82:c9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Chains

Oct 21, 2019

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=上海硬通网络科技有限公司广州分公司,OU=IT DEPT,O=上海硬通网络科技有限公司广州分公司,L=GUANGZHOU,ST=GUANGDONG,C=CN

Serial Number

04:62:c3:bf:37:94:62:6a:95:d1:77:78:fd:de:d8:63

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 22, 2019 - Mar 23, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/FindProcDLL.dll

IMPHASH 8df26927f8978d4eb40ff179c0aa961b
SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
MD5 8614c450637267afacad1645e23ba24a
SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4352

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WizModernImage.bmp

SHA256 16ee946b6a43b6df0c235a5e6ef3dcaa7915a046d08cd2d856e941387d3185d5
MD5 e9c7e6a6b484e7bac632fe22105647bb
SHA1 02781e1fc1ce10ddb8435c71eba8cda53b191c91
SHA512 b272a09f32e62377f94f96ec71865475990c92e5ffa7a2dacaa01307fe53d2f1d4db2e0164f0f9b8900fa66eb4a45e20fbf596cae5aa3e075f341c061db8e528
SSDEEP 3072:bRVARPgl9hehb8cnCzSmPAiCUmVC44NBKLs71lVbFitVYo0AJA8OyOWQ:bgRPOILnMLPAiaINBIs/IYlAJA3TD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/modern-header.bmp

SHA256 961a483377f9e64e52559c3a32ae9e6a1d69fc1aff1db35dc808dc6482634611
MD5 2ae57cb0b942a8aa96cdb98ab404e4d7
SHA1 7e4434f826cc050e02c4c026cd006a6a6a9e1564
SHA512 cad783f3e64744bb7c8a07a21843a1953247dfaf3eec22fd290db8034b704bd3ddb63d99a83d5075ecd061c5971746cc1250d5cda0f6002c647833a533a5ec3e
SSDEEP 192:O8B3k30+LOjcf0EcUuR1SXdsSjKpxBJFkcaOyKKNpIfF:O8Fk3J2cfA1GdJj6Tkca5Kms
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH f03b2bab186574d8892d3d73fa9fd3fd
SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
MD5 f832e4279c8ff9029b94027803e10e1b
SHA1 134ff09f9c70999da35e73f57b70522dc817e681
SHA512 bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
SSDEEP 96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer