64d4eefeba27b578640beaf6859ac311_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom_1.dll	acprotect
static1/unpack001/$PLUGINSDIR/version_1.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom_1.dll	upx
static1/unpack001/$PLUGINSDIR/version_1.dll	upx

resource
unpack001/$PLUGINSDIR/CheckInstalledKB_15-02-17_3_1.dll
unpack001/$PLUGINSDIR/CheckInstalledKB_15-02-17_3_2.dll
unpack001/$PLUGINSDIR/Processes_2015_02_11_2_1.dll
unpack001/$PLUGINSDIR/Processes_2015_02_11_2_2.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/System_1.dll
unpack001/$PLUGINSDIR/System_2.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo_1.dll
unpack001/$PLUGINSDIR/UserMgr_2.dll
unpack001/$PLUGINSDIR/inetc_17-05-09_1.dll
unpack001/$PLUGINSDIR/inetc_17-05-09_2.dll
unpack001/$PLUGINSDIR/inetc_17-05-09_3.dll
unpack001/$PLUGINSDIR/inetc_17-05-09_4.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec_1.dll
unpack001/$PLUGINSDIR/nsExec_2.dll
unpack001/$PLUGINSDIR/nsRandom_1.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsis7z_2.dll
unpack001/$PLUGINSDIR/version_1.dll
unpack003/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH fb8b591e24ae0292007bd816fe8b9461
SHA256 29bf1bd7dfb0fe799a29bb9162ff3c873857fb7c354843d7d022e11a9c842cd5
MD5 64d4eefeba27b578640beaf6859ac311
SHA1 f6ea710aac2fb4464dec25b71d3279104e332e41
SHA512 fa55dff9147f5977f9208d0eecebfff3e90013e09ab8bd373599003688ab97ac3cb0e6328a0acf472654a562cc42baad9e9b67d7bcca9a3c54024c86f56d561f
SSDEEP 24576:85mTMc+53iC7On3GH8fZbHNRwHFKdJMI997o:1Mcyt7AhNHNRwg/c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0d:a6:a4:b2:e5:3d:65:8b:93:1c:63:f5:08:22:8c:aa:3d:bc:2d:b5:37:6e:4f:fb:4f:ff:da:d2:60:0f:ae:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=5268403,CN=Dashlane USA\, Inc.,O=Dashlane USA\, Inc.,POSTALCODE=10010,STREET=Suite 504+STREET=156 5th avenue,L=New York City,ST=New York,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

May 16, 2024

Digest

e5:05:55:92:73:13:7e:cc:91:ef:28:10:91:ee:d4:ba:04:db:27:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Dashlane,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dashlane,L=Paris,ST=Ile de France,C=FR

Chains

Mar 2, 2018

CN=Dashlane,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dashlane,L=Paris,ST=Ile de France,C=FR

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Dashlane,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Dashlane,L=Paris,ST=Ile de France,C=FR

Serial Number

57:0b:bb:ed:8e:b9:6f:e9:57:cb:53:c8:22:75:9f:ce

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 21, 2015 - Oct 20, 2018

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

SERIALNUMBER=5268403,CN=Dashlane USA\, Inc.,O=Dashlane USA\, Inc.,POSTALCODE=10010,STREET=Suite 504+STREET=156 5th avenue,L=New York City,ST=New York,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

0c:95:99:50:2e:c0:42:a8:b5:4f:fc:46:36:87:05:d5

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 31, 2016 - Nov 5, 2019

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Serial Number

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 4, 2017 - Jan 18, 2028

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

1

Major OS version

5

Entry point

13385

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileA MultiByteToWideChar CreateFileA GetFileSize ReadFile GetTickCount GetModuleFileNameA GetCommandLineA SetEnvironmentVariableA SetErrorMode GetCurrentProcess ExitProcess GetVersion GetWindowsDirectoryA lstrlenA GetTempPathA CopyFileA WritePrivateProfileStringA CreateThread GlobalLock GlobalUnlock lstrcpynA CreateDirectoryA RemoveDirectoryA WriteFile GetLastError CreateProcessA GetSystemDirectoryA GetProcAddress lstrcpyA lstrcatA GetTempFileNameA MoveFileExA GetPrivateProfileStringA lstrcmpiA lstrcmpA MulDiv GetShortPathNameA GlobalFree GlobalAlloc LoadLibraryExA GetModuleHandleA FreeLibrary GetExitCodeProcess Sleep WaitForSingleObject CloseHandle SetFileTime SetFilePointer SetFileAttributesA GetFullPathNameA ExpandEnvironmentStringsA GetFileAttributesA FindNextFileA FindFirstFileA FindClose DeleteFileA CompareFileTime SearchPathA SetCurrentDirectoryA GetDiskFreeSpaceA

user32

EndDialog CheckDlgButton OpenClipboard CloseClipboard SetClipboardData EmptyClipboard IsWindowEnabled GetSystemMetrics GetSystemMenu CreatePopupMenu EnableMenuItem AppendMenuA TrackPopupMenu GetWindowRect SetCursor ScreenToClient GetSysColor GetWindowLongA DialogBoxParamA LoadBitmapA LoadCursorA SystemParametersInfoA DispatchMessageA PeekMessageA SetDlgItemTextA GetDlgItemTextA CharPrevA MessageBoxIndirectA GetMessagePos CharNextA ExitWindowsEx SetWindowTextA SetTimer CreateDialogParamA DestroyWindow LoadImageA FindWindowExA IsWindowVisible SetWindowPos CreateWindowExA GetClassInfoA RegisterClassA SetClassLongA CallWindowProcA InvalidateRect ReleaseDC GetDC SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutA SendMessageA wsprintfA FillRect GetClientRect EndPaint BeginPaint DrawTextA DefWindowProcA SetWindowLongA

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateFontIndirectA CreateBrushIndirect

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA SHFileOperationA ShellExecuteA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegQueryValueExA RegOpenKeyExA RegEnumValueA SetFileSecurityA LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegSetValueExA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleInitialize OleUninitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/CheckInstalledKB_15-02-17_3_1.dll

IMPHASH 5b77f1fbb7d5a077af6813f69ba3acfd
SHA256 92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
MD5 d2098d2c2d7d35c0d3c396ef6206b867
SHA1 10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
SHA512 61a2b45382feaae5ac75f2a9a250d2c2098918c2f89f53eb0ecfedcb63f7db87b72d27ab3c3602e62f6ec7a8bddce287cd49fa74688eeb6387ca4cbdc796436f
SSDEEP 1536:qbTMRUnE8Yc506eYYh20inHOVxcoG5iX7UXqI:6dnElcu6eRdVxTG5g7aq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

15640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\repos\Binaries\Installers\additionalPlugins\CheckInstalledKB\Release\CheckInstalledKB.pdb

kernel32

MultiByteToWideChar InterlockedDecrement lstrcpyA SetEnvironmentVariableA GetEnvironmentVariableA GlobalFree GlobalAlloc lstrcpynA InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc WriteFile HeapSize GetModuleHandleA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

SendMessageTimeoutA wsprintfA

advapi32

RegSetValueExA RegCloseKey RegQueryValueExA RegOpenKeyExA

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitialize CoInitializeSecurity

oleaut32

VariantClear SysFreeString SysAllocString

$PLUGINSDIR/CheckInstalledKB_15-02-17_3_2.dll

IMPHASH 5b77f1fbb7d5a077af6813f69ba3acfd
SHA256 92d2e4031540c2db9938f257e4c25fd61f3d8fce9397a6a7a83a6604a40c0c8c
MD5 d2098d2c2d7d35c0d3c396ef6206b867
SHA1 10d7bcdf07c9b3fb784dc0d6a6983d6846422e9d
SHA512 61a2b45382feaae5ac75f2a9a250d2c2098918c2f89f53eb0ecfedcb63f7db87b72d27ab3c3602e62f6ec7a8bddce287cd49fa74688eeb6387ca4cbdc796436f
SSDEEP 1536:qbTMRUnE8Yc506eYYh20inHOVxcoG5iX7UXqI:6dnElcu6eRdVxTG5g7aq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

15640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\repos\Binaries\Installers\additionalPlugins\CheckInstalledKB\Release\CheckInstalledKB.pdb

kernel32

MultiByteToWideChar InterlockedDecrement lstrcpyA SetEnvironmentVariableA GetEnvironmentVariableA GlobalFree GlobalAlloc lstrcpynA InitializeCriticalSectionAndSpinCount LoadLibraryA GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc WriteFile HeapSize GetModuleHandleA LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

SendMessageTimeoutA wsprintfA

advapi32

RegSetValueExA RegCloseKey RegQueryValueExA RegOpenKeyExA

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitialize CoInitializeSecurity

oleaut32

VariantClear SysFreeString SysAllocString

$PLUGINSDIR/Processes_2015_02_11_2_1.dll

IMPHASH cb66ac99cc061a206b0c73c8c928f003
SHA256 d8d618d75d0c01c39bfc0827d1414c2aeed299cf541d3387322d0fd91bfd06a7
MD5 0dc4361cc10bf4609baae53cca018a58
SHA1 b69e3ddb534f4ad10b6a532c9125b372ac73abc9
SHA512 1745d39ebcdb898fa752e2015356131e53bc064e79dad04c9b2917aa237088110291d8ca813e67ea71aa6c03614194a9c52285bfe7f18abe5c8b862b8520c293
SSDEEP 1536:J0wO3mVw8a7HzpyHrHhQl27ssSsVK5bamG:f6UimSsVK5mf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA lstrcpynA GlobalAlloc FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/Processes_2015_02_11_2_2.dll

IMPHASH cb66ac99cc061a206b0c73c8c928f003
SHA256 d8d618d75d0c01c39bfc0827d1414c2aeed299cf541d3387322d0fd91bfd06a7
MD5 0dc4361cc10bf4609baae53cca018a58
SHA1 b69e3ddb534f4ad10b6a532c9125b372ac73abc9
SHA512 1745d39ebcdb898fa752e2015356131e53bc064e79dad04c9b2917aa237088110291d8ca813e67ea71aa6c03614194a9c52285bfe7f18abe5c8b862b8520c293
SSDEEP 1536:J0wO3mVw8a7HzpyHrHhQl27ssSsVK5bamG:f6UimSsVK5mf
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA lstrcpynA GlobalAlloc FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH bc88e2cf32a9f678f70f6e24509afdf2
SHA256 72830b70d5758a90713b4f0f5c7138a4fe5b78a82a25ede01d6adb5e55e96798
MD5 b56556a129ab99dee768c15dd7fcfa2a
SHA1 3bacd77144ee06732fc0e595c7f1635382c9b6ba
SHA512 8b5899f8c14bb2b5de0cc6e6a8b2bdfe6f6161f4cc80c9f01fa49155f3ac72022d3a27ec7a7cc0dff7b699974df688cff1cdc61496d04f21119c9a7b06e41511
SSDEEP 192:2muTUV6D5KgWuDGY/nV2kU1ZH460axh+aJNPtHx3JyVt8SRx9Lo:2/HYglP/nVCFvAMXRw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6262

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System_1.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System_2.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 5197e2b5d0b686a43ee5fcfc134f44d9
SHA256 32dd7269abf5a0e5db888e307d9df313e87cef4f1b597965a9d8e00934658822
MD5 4814167aa1c7ec892e84907094646faa
SHA1 a57a5ecbdfa9a8777a3c587f1acb02b783afc5ee
SHA512 fb1f35e393997ecd2301f371892b59574ee6b666095c3a435336160481f6ef7ed5635c90ce5d2cf88e5ef4a5affb46cb841b7d17e7981bd6e998531193f5d067
SSDEEP 384:3A7q72y8XYDSDJe7H+KXKKK2KRKuKZrjVo787foI7:3sygyraXjQ7Zl99
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10324

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress GetCommandLineA CloseHandle GetCurrentProcessId CreateThread OpenProcess GlobalFree GlobalAlloc LoadLibraryA Sleep CreateFileMappingA GetVersionExA CreateEventA MapViewOfFile UnmapViewOfFile GetExitCodeThread GetExitCodeProcess FormatMessageA LocalFree GetPrivateProfileIntA CreateProcessA lstrcatA MultiByteToWideChar GetPrivateProfileStringA lstrcmpiA DuplicateHandle GetCurrentThreadId SetLastError GetLastError SetCurrentDirectoryA SetEvent GetModuleHandleA WaitForSingleObject lstrlenA GetModuleFileNameA

user32

DestroyWindow GetDlgItem wsprintfA GetWindowThreadProcessId PeekMessageA CallNextHookEx CreateWindowExA LoadIconA GetWindowLongA CallWindowProcA SetForegroundWindow FindWindowExA IsWindowVisible MsgWaitForMultipleObjects UnhookWindowsHookEx EnableWindow LoadStringA SendMessageW LoadImageA EndDialog MessageBoxA DialogBoxParamA SetWindowLongA DefWindowProcA CharNextA SetWindowsHookExA GetClientRect SendMessageA SetWindowPos ShowWindow GetWindowRect CreateDialogParamA PostMessageA IsDialogMessageA TranslateMessage DispatchMessageA GetClassNameA

shell32

ShellExecuteExA

advapi32

QueryServiceStatus EqualSid CloseServiceHandle OpenProcessToken OpenSCManagerA GetUserNameA LookupPrivilegeValueA AdjustTokenPrivileges GetTokenInformation OpenServiceA

ole32

CoInitialize

$PLUGINSDIR/UserInfo_1.dll

IMPHASH cce05dea98cbac3a9d486b233588f528
SHA256 77b40d42606d48f817b901f1e5abea114b4288b344b8c193bf3e3c52e469a926
MD5 d1e37112390e6bcca8362788d61becf5
SHA1 d97888f0f69d34de202e7c68b8ff5b2c2fec4c5f
SHA512 04121e5241ad14890095a6cf5e698979820fa97d911918b9b77f2064a713e20f4827f72c057d5da1789bc340d63f391872fe5dfbb79e6c33d3995f82c37fa51f
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4713

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserMgr_2.dll

IMPHASH bac2b3d4a0df9a23aee940b8ecd0d168
SHA256 54a9ab4ac127d950ad293a71f5a496af3ab09b70aa73839fd0f1c9cbaf35f70e
MD5 74813d238f84d5c0f5328bd7ba79537a
SHA1 5aeecd94f0902bad1572fd2cceada9ad44af6725
SHA512 ac7fb85c6375bc3e0e76b535550b604cbad31e69696030314f34e41d3bb5c04411ec826c89885c30556649961d45061f501db6a37a23bb419e4f1e7cea34deff
SSDEEP 768:WThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lW:aSCQeLCHpCyNV9ZTRbkuOQzyMVt/blW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13593

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalAlloc LocalFree GetEnvironmentVariableA GetProcessHeap HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetLastError CloseHandle FlushFileBuffers GetStringTypeW GetStringTypeA SetStdHandle LoadLibraryA GetProcAddress GetOEMCP GetACP GetCPInfo GlobalFree lstrcpyA lstrcpynA GlobalAlloc RtlUnwind InterlockedDecrement InterlockedIncrement GetCommandLineA GetVersion WideCharToMultiByte MultiByteToWideChar LCMapStringA LCMapStringW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess TerminateProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile SetFilePointer VirtualAlloc

advapi32

LsaOpenPolicy LsaEnumerateAccountRights LsaNtStatusToWinError LsaFreeMemory GetNamedSecurityInfoA SetEntriesInAclA SetNamedSecurityInfoA LsaClose ConvertStringSidToSidA LookupAccountSidA GetUserNameA RegUnLoadKeyA ConvertSidToStringSidA RegOpenKeyExA LsaAddAccountRights LsaRemoveAccountRights AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken LookupAccountNameA LogonUserA RegLoadKeyA RegCloseKey RegQueryValueExA

netapi32

NetUserAdd NetUserDel NetGroupDelUser NetLocalGroupGetMembers NetLocalGroupAddMembers NetLocalGroupAdd NetLocalGroupDel NetUserChangePassword NetUserSetInfo NetUserGetInfo NetWkstaUserGetInfo NetApiBufferFree

userenv

LoadUserProfileA UnloadUserProfile

$PLUGINSDIR/inetc_17-05-09_1.dll

IMPHASH da43597f2433dc85e07ab07af59ba0dd
SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
MD5 51843d1334d3d9e751622541bbc76131
SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\repos\Client-Stash\CppLibrairies\installers\NSIS\CustomizedPlugins\Inetc\Plugins\inetc.pdb

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcpynA MultiByteToWideChar MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcmpiA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextA SendDlgItemMessageA SetTimer KillTimer UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA GetDlgItem wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamA

$PLUGINSDIR/inetc_17-05-09_2.dll

IMPHASH da43597f2433dc85e07ab07af59ba0dd
SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
MD5 51843d1334d3d9e751622541bbc76131
SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\repos\Client-Stash\CppLibrairies\installers\NSIS\CustomizedPlugins\Inetc\Plugins\inetc.pdb

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcpynA MultiByteToWideChar MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcmpiA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextA SendDlgItemMessageA SetTimer KillTimer UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA GetDlgItem wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamA

$PLUGINSDIR/inetc_17-05-09_3.dll

IMPHASH da43597f2433dc85e07ab07af59ba0dd
SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
MD5 51843d1334d3d9e751622541bbc76131
SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\repos\Client-Stash\CppLibrairies\installers\NSIS\CustomizedPlugins\Inetc\Plugins\inetc.pdb

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcpynA MultiByteToWideChar MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcmpiA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextA SendDlgItemMessageA SetTimer KillTimer UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA GetDlgItem wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamA

$PLUGINSDIR/inetc_17-05-09_4.dll

IMPHASH da43597f2433dc85e07ab07af59ba0dd
SHA256 af1bc66bcf117b5ba88ed3be3676928eb527c98c50156405ddebe73db1f26e82
MD5 51843d1334d3d9e751622541bbc76131
SHA1 a900d1d1ce76187ebc5b743c08de7f77a6a2ce7e
SHA512 db2326f56811efb67b2c1a7855a2fdf4145bdacaa1cc3bdadfc586eba4b39eaef4ea95ea4e67fe0d3659dc37ce74da7f18479b016bfa4b602649ef5b61f90a6d
SSDEEP 384:30iWwxLQMUUwnbwG1pIXzLGfnEtVrr9LbQ0Ac9khYLMkIX0+Gk0d4yekRdX+:3VWsQMNw/1iXnGfnEvIWX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

4261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\repos\Client-Stash\CppLibrairies\installers\NSIS\CustomizedPlugins\Inetc\Plugins\inetc.pdb

wininet

InternetErrorDlg HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetOptionA InternetQueryOptionA InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectA InternetCloseHandle InternetOpenA InternetCrackUrlA

comctl32

ord17

kernel32

GlobalFree GlobalAlloc WideCharToMultiByte LoadLibraryA lstrlenA lstrcatA lstrcpyA lstrcpynA MultiByteToWideChar MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleA GetTickCount TerminateThread CreateThread SleepEx lstrcmpA lstrcmpiA CreateFileA DeleteFileA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextA SendDlgItemMessageA SetTimer KillTimer UpdateWindow RedrawWindow SetWindowTextA GetWindowTextA GetClientRect GetWindowRect MessageBoxA GetWindowLongA SetWindowLongA GetParent FindWindowExA LoadIconA IsDialogMessageA SystemParametersInfoA GetDlgItem wsprintfA GetMessageA TranslateMessage DispatchMessageA SendMessageA PostMessageA IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamA

$PLUGINSDIR/nsDialogs.dll

IMPHASH 95dceadde6710163136c5206beacb701
SHA256 518c3bb40f6e7c37beb3483284c12ed44038ae2a56bfe1604ffea6330f31b0d6
MD5 83cc33553a3b7aaefbfb7af4aa97ab08
SHA1 484ddfb9bde560fe354e5c101701c78564ab6ff8
SHA512 109ad559efb49fea41d39b49852c0d4ce5f611c75ae137e489231a3c260ba79a17918e71efc2d65d9e18cebb697044159784369bed32ee442c496716e63bf1bd
SSDEEP 96:yYPLOGJbpWd8k74+PAIfbGn0JOu4YTnqJ3yd1vrwcJG/05sVarU+TvQN:TaGvu8k74+PPymqYTK+rwcdsVatTv6
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6831

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec_1.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec_2.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom_1.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsis7z_2.dll

IMPHASH 93de66a5e39e0e29fa0c7c11ceeed8e4
SHA256 51f3274fcaf2ef42860f97bed95f407abc60ab31f81a42b38fb2ea1d9b0a434f
MD5 46e29660c591067e77276fa960625f57
SHA1 3c3206ec4415de4f09a2066a658fa12621e2ed74
SHA512 ed7f9babcaa6244eb8f42350a522f75b5078b2854919e281215a4a4ef62ec4bb731a457f5da3a615419a575986eb96517a6c5238f65b2173138c7fd4ff122d83
SSDEEP 3072:/U9a+LOBZgLCJqPb83T6RhYI3Y3de57FjqFJL4A1QH9ykgt1c32pk:kaVUmcQGLYoY3KMlq9H8jk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

93735

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError WideCharToMultiByte MultiByteToWideChar LoadLibraryA AreFileApisANSI GetModuleFileNameA SetLastError CreateFileW SetFileTime CloseHandle SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW GetFullPathNameA lstrlenA GetFullPathNameW FindClose FindFirstFileA FindFirstFileW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetProcAddress GetCurrentProcess GetSystemInfo GetModuleHandleA GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection CreateEventA ResetEvent SetFileApisToOEM SetFileApisToANSI GetVersionExA GlobalFree lstrcpyA lstrcpynA GlobalAlloc RaiseException LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW HeapAlloc HeapFree GetSystemTimeAsFileTime ExitThread GetCurrentThreadId CreateThread GetCommandLineA GetProcessHeap HeapReAlloc HeapDestroy HeapCreate ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA Sleep HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP SetStdHandle WriteConsoleA GetConsoleOutputCP VirtualQuery

user32

CharUpperW CharUpperA GetDlgItem FindWindowExA SetWindowTextA wsprintfA SendMessageA

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/version_1.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$TEMP/illustration_1.bmp

SHA256 8fb647ed4e69a245e724d5b8a71a66f29e49dd7e67a5ca17d8af0d3b11a9a32e
MD5 724d74406d359957e764e2aabceaa5b8
SHA1 6c3b06bd78b97571bd8d95b748586726d8b26bd1
SHA512 8db0386d83901924d72cf4685abc78628929f95b245379e9b37c41d8c6451cb50ff5dd80b3be649b8c7ef59789c996220e2aa3b91aafc7219c1f45bb8a7713c2
SSDEEP 768:bhqvhNqMFrm73ExrzPR28iMQcsmaBYRnnBX9IVdImfC:bhqZ0MFrm7Uxrzp28iMtaBYdnBXgnC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/illustration_2.bmp

SHA256 0a630f3e3a2b697692ff3c684f2d7a9bab0024fdf5d740cc680f42667f023aa7
MD5 aa587f21e04937933293b373755d62fa
SHA1 249ca72340793938e52e5aacd29b6ed1caafa068
SHA512 06204d74e3dfd4000145d25e847cbe346c9fec9b39b2744dd242bee13796d9b98ab3189bac50c637ff5a689c409b4f35ce88048aa5c3e7f2546d62d9dd493a1e
SSDEEP 384:zKPsQj7oeifIzFWv8bk3RCrqyELA/0LPtVq:WPss7oLkFxb48JEdVq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/illustration_3.bmp

SHA256 60b80f65a8bd7d1ebde061af66cfeeec0a0509a63f62c023c3b8c8f3cc2923a4
MD5 757bc63d38954ce0b7399218d7da41bc
SHA1 c499d91755b938fa1689a8a6194aa4d6a4cbd057
SHA512 af66f3ebd939f40ca150c469d7a37e8e3404db8e21ae51a6e2940f43afd8a937cbf57d3b9ea98652af5b55fa11c6a925ad4f7406a5d917ee10eab82daeb1e469
SSDEEP 192:zVMBJtwc1nUfjWi1RvegGFvijsHLLfiSqfOjIXXcMzGAUCRAXgQfgw7:z+JGjRRvM90srLi7S+XcMzGjCRogw7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/illustration_4.bmp

SHA256 c9d2674b1a940b244024ef8615375b0406291bf41994b23223237a8e9513cd70
MD5 db405e1ee2de39f8f6a6bbe6ba6076af
SHA1 3854ed7f9b6666d0a8691cb49e83a228f6f7df1c
SHA512 ba148c341b787261a3cae3578c50f386a4f8627b0753cdda811938b2afa95d6fcb29c69717bef6c5623d393fa66cd88d5585959ef51c871d612f9f04faa2906a
SSDEEP 192:zq4MTo3nV5RxNbg5W3AVpA3CX0Ydzz0JgDkLP/0dJCkzf7Ih8EMCtabUiZ:zqFoZ8U3AVqKztkLPur8tJ8bUu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/progress.bmp

SHA256 47bed08a46ba04a6434402de1bdb8a284f035857dab1f799d288d4355b339d92
MD5 68234002b3767847d8e6b05ec805501e
SHA1 e32c36f79be7bff3aa842e88e1050e7169af7264
SHA512 ace11af52bda9677128f3201e4477617a9bd43ea592d118dbc4abf926dac71614677746c910c6ddbc02c485c8225da4516ecd6c8a9e75de4382b139e924d0a55
SSDEEP 96:ChoSPDAdllllllllllllllG/M8mJa5/L7mznUH9ObmWdQVtEa1y7njCm3A+UMmVA:ChoSP0w+znGDASmutzZ0xLX5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/welcome.bmp

SHA256 6e1b4368b90abc03459c42c60daf104577e2af3841842fb5360dbbcc079047b6
MD5 104f8baf392ba892b55b451ec58bb6e4
SHA1 cb2136671cb5796563c1f7a063ab148fefc2299e
SHA512 2a95d6cd072f567aa39973526981a07a2eb90f243a1ee349c06495def5d4c4e76fce059f8b6e6f85ee29e8258d4f1792298e77b7639a949dafa5300664807fb4
SSDEEP 192:ChISPz2NZdL/rZznJWGZmqUYd+uxXufncU:SI0z2NTrHWGMqUYw2XOncU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/welcomeillustration_1.bmp

SHA256 a13ea77ea354163ddc55b8acdfe78f89d866b8284c123eed3eb0ad48fb233a3f
MD5 28c63a9d2cb7ed5894b297552a3e05b9
SHA1 414a3a00e2a5e3e0aac8ef4ff277ff5403457f9c
SHA512 92a3b6d9217f22670c8fdb2a48620dfa25699e3454ff6f8be1ec12e73ed197bc0c2c0178fcf12f8f94391098430427eb34c7040d59d87acbe1ef54bffa0d12ad
SSDEEP 384:zh17md9E7Q/blqD5RwtAKoaeMxP5qRnTyIyDJBRwOv8pqz5Ax1:z7md9AQ/bl0IozwPcTy1DtwOv8p
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_210_/bin/DashlaneUninstall.exe.nsis

SHA256 5a501bccd311f27cbd558b32921954b97a6a7d6be2c7199d6b3f667dc1a54340
MD5 83f6e951a76eec0e39cec4db178d0cfd
SHA1 abc1b1c06bd9e7fd1b624fabbb27a74848d9661e
SHA512 4c5bbfe81ecbecee3004610ce7101b693f18de068f60db72d295beb1b057f293da9e716316968e661610251b4249c2bb8a34c207c0f575972e3676f0f7dee308
SSDEEP 3072:7VeIivs8rHjCQGE/WdekPMyc1GDTvhGBqkdq51Hd5pPA5RVNSPdU75CgthekO:7ZiFrmDJwycKjLL5FXhA5RVoFUNekO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer