43815ba4a61004342ca9023ad2865a57_JaffaCakes118

resource
43815ba4a61004342ca9023ad2865a57_JaffaCakes118
unpack001/$TEMP/Predecease.dll
unpack001/$TEMP/bookmark/thanks/MFC80JPN.dll
unpack001/$TEMP/bookmark/thanks/cert2spc.exe
unpack001/$TEMP/bookmark/thanks/interfaces.dll
unpack001/$TEMP/list_users/IEHost.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 daac4d73224f384f1cbfbe6ed8aac201fea29a086ea6f57283e0b92d68791930
MD5 43815ba4a61004342ca9023ad2865a57
SHA1 e4d0105b21f815298925dfdf08aa3c13bb85fb5d
SHA512 22f4c7209283f9d66c6ebc6b17b92ea0d53d5de698e5a689a0381acd54d8bf795e5386cfa3a68a50daeda488c73b4801c09729294826e46be8905277333f1dc9
SSDEEP 6144:XPCganNbEEaEWQSdyRQbBo4y+Wd2fbiXs1GElMX4p3voQJ2:tanFEEBnwybAzfucti4pvl2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$TEMP/Aphagia

SHA256 e48e374b69fb40a79abc3c93d37834e244fba66b91b7ab30e2cb73bf267735a2
MD5 3aac0e962324fa759aca8df8b591732c
SHA1 3eb3273562eb36fdd0843276e640f3f157423b60
SHA512 bbe785c2b74e8e0a86a5c2ff91190b5dbb2d49a37329ce48ee0732b35b3621808bfb82ae29700a8e8ae24f9a6af97a175296d549e9dfaadf00c5ba36df54e279
SSDEEP 3072:KUM45k3Bonnq9p8+Wd2iYDz7imo9XxO470Bb/GEpUvyM3eLwY5d:KUM463Bo4y+Wd2dbi9sDGElM3cwY5d
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/Predecease.dll

IMPHASH 2a16b692a36ad81404bfad3463c3ded9
SHA256 b2e96ee15b7553cc22f0c43f80e2308a50f43d0dea020f9672d7a975bc51e34c
MD5 4d1b85d0694a24b83403d75d07438deb
SHA1 0ada9f3851482638e8be5fcaa589760d9df84d4f
SHA512 8438cc4a4f909501ec4bff8ae77123e0c016962db4c9229c4b658d17518044598a9a11521db7e4b238b4d063750d147685081ce5dadc48d8db5cd60ae0ab2faa
SSDEEP 768:EmMJa3TjbYMF9YhE0RmnTEDj3vyVTsU9MBacUF+n:EmXRF9wIBRdMUcUsn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/bookmark/thanks/69.opends60.dll

SHA256 647a5c5fff49a5b936f92f1f074d2d8c66204ed486cec12d3fb2e3ce1e30dbe3
MD5 c169f4c07092a565283dd8ba7712484b
SHA1 8871f882152339810da164120251c38500e76d0c
SHA512 db49323c2e49799e916467cca7063d81aea0a7bda0c32484b9f637c46cf18d9400888ec536d75d32bcee483cf3e6dafe1c3a66f2ba326d36cff5be37417b6434
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/79.opends60.dll

SHA256 92d13bd99d241df155dd56df72168e7a10662364dcde27ef06dde39731b5bde6
MD5 39d618d08910862f6fa19763ef8eb95a
SHA1 ec9946684d5e72dbc5bdcffa31167ad1a19e29bd
SHA512 ef157ac89850f9e5838c01307849aea5759868d045836b6fb3fad6834c5edde8882603e1a2f0aa4eefc5c37bb2583720f55263291fbfe902239998623be849f8
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/CertStoreQuery.xml

SHA256 90293e0cc7d4556a551e1e503ff6d26cd187b5bae74889b2b83ee6bcac808e57
MD5 2ddff1c4cfd81e8a71f1b81eda167458
SHA1 2db0f98883dc8e5251b2e93805af2e4e820b9242
SHA512 a604817481e8e80053ef2fc4f23b308ec9abab4825ca00e2bc44d4765b677f785f3d2c05228cf2e46e090046fb98bee6e234599a1714334b6464eca383feffb6
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/MFC80JPN.dll

SHA256 d688bbc45a22814403bda7609ec1650589f5d0acb8287ad72c6e493d51441e27
MD5 3e9b3cadc71ab38ff8183299ef772367
SHA1 4c9a4f181c31b92af497996a5f9c28b549633f12
SHA512 4e49cd5737213dde86e662a12df5c0feb94adc30d54d5dc9219285047526ca0e6899ee59a3027cc2572b8c79f4af97c9b8a5392b911ddb873d734537d90a6e60
SSDEEP 384:hDNCysL/tAGqyVVp7vheBWlWRUJkQbXDr10Jh8I2Bb4:hZXsZAGDN7vQtUJkkr10IIc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/bookmark/thanks/Schema.xml

SHA256 2d4ef1b35bf7821263b277b1b073b5f07809314ceebecab280ad61d3ca094a8f
MD5 e9a755109a83f9a91c0a37585d489b5e
SHA1 b15e318ee0988932d144eb07525e1ee8b41b488f
SHA512 0aec1d22812e997278de2b4ff231988c93cc506cde930881dfa73c6d37650f649aab1cfea670866601b485ae2dee3fce7ebb29b9459ee5cd01a93388915b3a6e
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/cert2spc.exe

IMPHASH eee3da4a931a35aab985602afc0ab483
SHA256 c25f774434af1c494594d8315ca8cfd12257c53b8e3682e626b230b79dd5a863
MD5 15d14d0403243f2939389b50e62a5d9c
SHA1 29ca8ad75a159cf8740f21f8e1a2649abf81589e
SHA512 83f0b6074911f4f8fc74d556537c9a8a1999cfbf5b8dedd97a9b5824d3b3bc39b7e8b876e5aa68a9eb597ac89ccaba9a516df21446200aa172994718c62a1ead
SSDEEP 192:nuF8MV0BxUAOW/3m3tGdqhIEg0YHvWCcqoS/W5e:n+8MVA1S3txg0avW1xS/W5e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

5259

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/bookmark/thanks/crtowordsde.dll

IMPHASH 6f988c1a610d6d6041dba23a9db823d1
SHA256 6279439648d1a49260ccfec46a80625b2aeafad80c2a9025ec07eba00f56e007
MD5 9fed64eea493bcf3cefa9df973bc4a53
SHA1 fecd887152f633bc5f7dcea0d064b0482f262840
SHA512 e265765505fb19e84e37615b7128b21183519c885ebffe2ad9036550dc1b9ecfce7a8f77c687b7d00ef9adfbc250fc5781667f24ec2887eb30eedb59f80d28fb
SSDEEP 192:ZDMGdIACora7NXqHP4oKvZeSK3Xz7Ygx1LfYL/CldolMvMjGwPyMojT+KzVMiDMD:bdIA9h0ijvx1LwLCcY9jBJJLDkL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=Business Objects Americas,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Business Objects Americas,L=San Jose,ST=California,C=US

Serial Number

62:38:83:0d:12:9b:9a:97:ce:d5:b1:d8:76:03:24:5b

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 24, 2004 - Feb 19, 2006

Minor OS version

0

Major OS version

4

Entry point

7645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

y:\components\cpp\ufls\crtowords\de\UniRelease\crtowords_de.pdb

$TEMP/bookmark/thanks/editbin.exe

IMPHASH fee3a3a6eb1f13a63454550347b7ff2f
SHA256 51ff3ff717529746ccea8412da24a6d57b6c04d32aad04059b53b49d93776de4
MD5 ef322d97e0bf036e236a85a19d85235e
SHA1 3c72a0f0173911cc712bd2e4602816bb2ccea697
SHA512 bf4ad9c7909439ca3e225959f70f48169ba729f0d45fb1ea5e4c00d60e9da5bb7cb4ed91f1d443df2b4d4b57d44161fe3148cba773be6c13534b019beb9a75ae
SSDEEP 384:DtJDDMj+hlgzaDSSBgWVb7aWpRLCcMe/oTC0z:TUmPeSBTXL3d/o+O
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

67:5f:dc:1c:72:fa:b4:0a:57:b9:dc:18:ac:65:cd:fb:9a:01:ce:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 13, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

5

Entry point

6336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

editbin.pdb

$TEMP/bookmark/thanks/interfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e030f6f525673325d2a605d418f6869019e4dfa83809fb367b71538ad796e7b9
MD5 4fca230d88b5afa87caa2428031ebed1
SHA1 4a350e06c30aaf1f7f62a6cd50cb1a7d355f98b2
SHA512 109deca8be8d449845c39ce4f297c547d7375a756cb76a61bcdf768e71d44a6347b474cd2093bb765b1beedf36c60cdcf8041781e05b2143f61e7427108a5772
SSDEEP 192:rAh/YQtAlig3s2vMOlNT7ITIaUWylGYtmW8xfQ0igt7w5iW920TEWX:rOByig8iMOrMTIaUyWqligVw5iW92AEy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/bookmark/thanks/io.pagure.lohit.devanagari.font.metainfo.xml

SHA256 6a5f630eb67eac5461ba28274936c01e9ffe05758312424d0b9752227efb3108
MD5 c1a224bcd81d85d525dc050bf2250690
SHA1 28e3364259ac5be5c0e096591f2be8b457aff72b
SHA512 f1a66ea8b81967f8bd3569c7603bafe502a2d8c1bc2f00dfa6fc6d60b0762d39d78f2ca7d9b82addc1de3280ec2972bd4752650f706069ef043f2737a5a4c768
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/iso3166.xml

SHA256 1850a71c3ccfc19320f3b898669786765fe64c831196a12c1d1183b3980e84c2
MD5 3edc5a2d15fe481c73fa3df052906dfe
SHA1 06de2ee1ef69b4f096ba94f43e9c67e8f8603d47
SHA512 67f39eb635ac985a22b6456631daafc913b99e090520480dd38fc9fb034f92605012b48ecc8cb582a4dcc80dbcf95c3f18c5196d151a267d3c4091eea7600302
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/quotecloseactivity.xml

SHA256 58906c62907bdc55cd4f51a2cf2d175cbdb7a6eedbcc0f2e680e84af00028e1a
MD5 ba8cf06284acb2d7ce02448a890bbb2a
SHA1 239c6abbc29d6551a55d56133c8f7b6f4803ff4b
SHA512 2901ecec1bb8e493af96604699df5ec8413e533343631aee0783eddca80560d3f7d1fa4a31d433337895fc4edd49b31d90d9c1423597a18b0e24e383e4129c1e
SSDEEP 384:pUnUyUQUAUYUrU4PUeU7PUdUnTPUgUYcUlU1UPUKUGUqUEUHPUIUm4fBsxvfBsaE:fUfTwkfcfxfzql
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/bookmark/thanks/vnd.adobe.photoshop.xml

SHA256 a0f180d65e764c7f821f15f0fa49815ccef579a887d85654ab771b250a358da8
MD5 045a75447cc1814c592fc333a78d6d8e
SHA1 c5ae49b817fd0f3fb914d7e60d45b74d342049a7
SHA512 6a9024cc08d6707871e9d5218db430f469ea3a5ee656ddb57bd59ff840270b1bcf45f008a0d42431ce94dc39bd5d351792aa1448872f3b62bab6489b6e3d064d
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/bookmark/thanks/x-reject.xml

SHA256 3168abaa921b08a82cad8ee6075890164787fd96820b62411cfd48b3a0693639
MD5 e544872a5c6705c8db112396595f5416
SHA1 f0bb2763b582b383932a1b37984785d6a0b0ba19
SHA512 6d5af3c831f283648db60eae2e4de0e229976e62819fd454e207be9cd4428b6c554556a30d82cf042db7a5409c89964ee3ed784a28bc4945b105ebecf0b983c7
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/list_users/4.opends60.dll

SHA256 243f5d4a34cfe932b9c7ba2a1a0a5a4e66952bfb454fb7becf8d43b6be6bca2d
MD5 6dd3e060afd3f50cde4f99b268bbe4b2
SHA1 71d21643a449b436f31f67d25adb32ab56c895e2
SHA512 9b201956d90f887adfa47c43d2cb016d37c82db250160fa2e5652d4bede4e24d50644448603126c4d6d7f288f6eb853a423e06254462c146c29de65758ea1de4
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/list_users/IEHost.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f88b3210c26494d64c7a2f376b166953370e21abaaed8f2ce9882c975a352ca7
MD5 3cf103c013c83dd3bab1620d1605906f
SHA1 b16be1b09cd68118111d9729b288215a9d05b448
SHA512 41227daea0da05be9c61e7558aface164f8220b1b4122c219fe8fff727cfd8be7bae18bfecf456b6f8d09fbe5fe1115ea6e09b1d9dfe16eb3bb33f28db5abb0f
SSDEEP 384:iGS88qBmW9dxYavRMiAOtGjxdUhDfSao0qSxhM8bS01jzfWtuw8W:H8qBvt9vRhAOtG9CSQpt1k
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

28702

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

IEHost.pdb

$TEMP/list_users/org.gnome.evolution-data-server.calendar.gschema.xml

SHA256 676e448e709211146f4b5e2701023a4c926c14e479a9d99b3106b4113b207f5c
MD5 3309bfc9c328cb1688a8882b519445d1
SHA1 3e22c81de06a12ea4ad3189f1f51d88bba521f19
SHA512 1b2f34b945a98f7fa97885da67bfcc51d1251822bace0c198bed994fe64a2143ed7e43b864bedd4ad637b29aff5f8cfcd39f6a4ea638efc915451ddbf42ece3d
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/list_users/pkcs7-signature.xml

SHA256 cdbd74e235fadd5e64eb1cb328a577e03d9a0a697bfe6188b3c1faab7b0f14d1
MD5 f6ed4770c3f53631686a3bfb9f077659
SHA1 361c425a6990ec1d97d07383c23c5a53321e452a
SHA512 4b07baa357f1b85f63bdcf5785aa04e3ae4ade5f79bb732fe2b32bca02bed5c8208d79a7ed6c880e278d8befb6f42642d1147a85983d7aecb84328b821869fe3
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer