659b887c001152ac986216e876544518_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

resource
unpack001/$PLUGINSDIR/InvokeShellVerb.dll
unpack001/$PLUGINSDIR/MoreInfo.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsisXML.dll
unpack001/$PLUGINSDIR/registry.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/registry.dll

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 16771b1ced89bed951c8311cf2e67c9a1f4398f3f7335d4ed11bbcfbc8a3f00d
MD5 659b887c001152ac986216e876544518
SHA1 04b6cd459ecc974084cd324aef090f2c2c603426
SHA512 de69583a9381d5086f3e1da678bbd66d2e412daaf1d854747162c27e3957dd5bafd689531afe4eff42ed358f9c4a14a987ac793a560eb6c31681e8520952f649
SSDEEP 24576:L2KqYz3utEROE3cvWt9xkAzb8cQlE++NHXYNoPfS4:pD/OKc4xXz6F+iNoC4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Serial Number

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Bandoo Media\, Inc.,O=Bandoo Media\, Inc.,L=Panama City,ST=Panama,C=PA

Serial Number

3d:ec:b3:f6:06:98:17:01:01:07:78:2e:ab:f5:18:fb

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Nov 27, 2014 - Feb 23, 2016

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Ask_Logo.bmp

SHA256 41f1c48db65dac2e6c232de1976dd7cb02ca5b19e4c1b63ecd9150b1510ba2ea
MD5 0b566f28fde1bf7cf05492b75bc901d1
SHA1 947865d0589286380996b2a9001314ba64933e0d
SHA512 d26982bd9b1cb7197e823ce32b5a39fae5de8fced22da8b82b6742b3579920b8fb596198d92f345ed91df5eb6368f2be646719ece30d36714daf697ad3690bae
MD5 SHA1 SHA512

$PLUGINSDIR/InvokeShellVerb.dll

IMPHASH 1dd17c8be9b0761e58bbdf6fc06463e3
SHA256 2fddc8b8ab4bf4838ea374d25e4cb9e83362c3f1cb24f380137d14c814d56169
MD5 1a6e1ea7e90e50d9a18e034e7cde41a6
SHA1 93148d67fc2cee4537f749a8c98a0735065241a8
SHA512 53d35e9e4a0d45a5b37da7952f7bf8c26666fa57748c3d292fd154e40a602f08ad55735cefe9bdf043e03e3eff3e58d603bd9980ef291b3c5f409228dd5ba872
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4754

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MoreInfo.dll

IMPHASH 149adf074d317fbf0d2f17314bd18969
SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
MD5 bd393029cc49b415b6c9aeb8a4936516
SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ask_eula.rtf

SHA256 4346de72fee6dbe8b74218d8d9550395bf7f26634eb026ff6359fa0f855e9a4d
MD5 7bd45e3280288dda6fd602031e2066e8
SHA1 db4d49155de06f6a10ae50c01c612e4d998547bf
SHA512 a3a40b878d46531127a55550c807e6a17374d5d52bd645ba6b61fc0ae551d348247c4d4969c32e60b7bdad7ce1b3167f3d87b4eab2746ae305f182d4084c09d3
SSDEEP 1536:ZZAZp31HamwWkLTX6sbKIJ8rqj5mXoArAp0blt5S2y4e4N:ZIp3haYl2to
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner.bmp

SHA256 d25f7dd93e67f584a1757a72c975b19fedf7542035ad9afb8cb3c5b9f72f2284
MD5 6b2026ed4da8d06fc782c5df14bcf4b6
SHA1 a9d4cc4b5cd36e756a30f07d61c6674d453c8bdc
SHA512 89d13e0bf6dd5a933194e7fa195f79e6e5d1f8256fde88588ca888dfe62371a89bbd06a20a9fd5f1cd5caad5f39c08b1d99642a91134163037972459c24412f3
SSDEEP 1536:Q+SRMbb/JSaPPb24amJStPwRhIfQ4r58q2dTNDg:xcyXiRr58qaTdg
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_chrome.bmp

SHA256 2bcab7133ad8a297bdcabaae28f78bf866dc1f81e390d492b4895a6f52b8c566
MD5 fed4413fe3eced9c2d153c30a8fa1f10
SHA1 c0842ec5341cf83ee4d6eaf7e575f159af833957
SHA512 2123aca9ac292f6b9c9eb1f8ba8e66803298c84ebebc4723825943fd65bdbd1527a2fdc4533a9d65dab48e3f3dc76ed78394e821eb4d9885959c6137e1680cdc
SSDEEP 1536:J8TlgVNk8WPVNH4MIJWEiFzWmmlyGtFR75uu19GF:qd4fC
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_chrome_36.bmp

SHA256 2b853783fc2371eaa5368eda0caa0713f84478b3cff8b6f818218e5184be2f68
MD5 6b3459bff689b2381ab3d7a3ec9e2df6
SHA1 927fc83eb7ab55724bfa6e61344eae75bc0bcc50
SHA512 f75e93f14dfba8a62dfec9ad67af721dd07ab3aa5de3489e03c432913a5615f92d93c9a8e9b5d916163a83e7f4f56a597e6ac8592b9f2283d1df4abd1d4deb35
SSDEEP 384:RjheqtkCfTxg03CuA1Qk18AWCtJ0FTKPZYF/TVQNJVai14a3D/6:66k1Qk1HFkTKPZYF/TVQNJVai14a3D/6
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_ff.bmp

SHA256 40229a2948ab4b07e04d1fef3dc069e44a5dd505726c5960c4e4756f5a74212f
MD5 97f6e93ed18244e6f120b5ccee75f252
SHA1 03177a13384ab6fb868953881b0893e4c5fd8ebe
SHA512 ccf35640431ba42b4b897447095ff98f1e95979bb716b270543a73e53736786f27ae7fab828dc5abb957df886cddb42805b6dd3ad952b1f39ecf782ba56ebc5f
SSDEEP 1536:NFJeuNNNONNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNl:NauNNNONNNNNNNNNNNNNNNNNNNNNNNNB
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/banner_ie.bmp

SHA256 f432c5de7ca2ba5ada7a70e6e449c0b760683a9e3a4731473d1d6740e1eb6052
MD5 a9538f3e11df24ecab49e190f5f76a72
SHA1 0e5834eeda7bbc83dcc6e5b0995f456dc118ffc9
SHA512 43396ad465fff85232801bad155af23e5c1dc1796565ce56f2e2459efe5bef70d43106a982162e20b887626415d77586f5fc8dbf9a8ade19ad7aba6e9b0e4efd
SSDEEP 192:RbcEFCPPf4/76aTfPUCeP8QIwERlDCAYuZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZH:RzCnw/7FmPawERleA9JPUCl3vpqeWwS0
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-header.bmp

SHA256 8fc75b7d66f025aa82937b569bcee3f32b5d6d84954bd662160beccb9280f3e6
MD5 2e8831ab3cde2dce2c6cae8bbe099619
SHA1 db246e282e04f58c2fa60b85fc744eea4e0a8e5f
SHA512 6c45974d15e1f8518607dcbfdea84ee4dafbe44c6aa7f3a11800e045d3595f39c394d8c3df0b488bcf6936b595c1af30b5fadeca08af42b256f970cfdc52d120
SSDEEP 1536:Q+SRMbbhJSiPPPPPY2UGrg4PP1WURIxQ4r58q2dTNDg:xcyAy8r58qaTdg
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsArray.dll

SHA256 8f9bfeebfa3b070b116de61a63271b6c25af0dbb4bbfb4ae73e334d1f8517efd
MD5 7fc4723bb0a4118e5f91047021d1aacd
SHA1 092a321a21d802045105ecc8cd3c9d7d2c6da923
SHA512 1fe86533987ff1c4d446b231dc1ff2c3bbce224ae91b73ffead539f08740bfb06d2f40f1aedf0571106dc4e12eec27aa32018c2bf5361b7488c07b4d90800f02
SSDEEP 192:EaNHOZqWdn+/a4YZkv1uULW1C4w2X2bM:EQudRQaYAU6hX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

36256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 771c56e921b4afb27be8fc6b93a6efee818924e8ecf65edb8b0922c83ee35fd8
MD5 71369d6fabdb848702b1f425a5253dfc
SHA1 f506fa22ac1fe9c7a89c3e0e6d19263c653f4597
SHA512 5e1d8363acfe5c030c3d0baefa31003677b83165661c825b142a6d681520a0d73ee8064403f4f9eac120e71db98c5610db41a59e4f1e0acc4f06404420c892c8
SSDEEP 96:duNDLJvhx8NeQojexz2U96EFU83ACTbKsJ26ZHUDeA3leWHbGCE6oS+hSVfA7SfG:KNENebat3yCT5J1Z0HYW7GJ++hSe2X2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

9584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH 1156b4dd8fa8f1d42696b7a2d5b3e139
SHA256 e8b26d9497bf1f3be386158f7f338fa03c0cad9c893a7e96a0200a438c1733c7
MD5 a2725e4d4d57d9d497e0a384d2884417
SHA1 ee31ce04298964e5239368ca8fd7b3f1cda5d878
SHA512 8d69e6bdd73a9845ba02917bd7f8e17e9a7a818348899d5ebb6e9055094c9b746550d6807c0412c2537a59b916b377aced3cf3932eb361d923816fd05866de99
SSDEEP 96:z50nDR93puFU7aMlUzVaXYDNwIJ1uUgkWJozlfGa3CeOY3/wDQhmrjpcAWvPaSZm:l0n3h+4uaMzOi/EQO11WHaSWjp9ffbE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10369

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R1/$_1_/Uninstall.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 63aca71fc4d483663571e7fd733747a9c7afc527aba7cf3b7ccbbe8292aafb69
MD5 a7c8756c56e5a841b91da9d02e769f36
SHA1 2ac01ffff9f107f67c701c11a3c89506765689ce
SHA512 45e224f1c64aa70af39e59f8e2a5ad500d4bf1f9fa9156b0a6626b7737a43237c84562519a5694fe6db3b9696457ab2774fe9bc8bde5fba85fa9612eede969fd
SSDEEP 3072:i5BuYAVrgUCPnSA44444444444444444444444NoPAZ4444444444444yZ6NdraL:i50gUC6fPZ6NdGbOV1pZR4xjXiV2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

37:ee:e1:b9:39:df:fe:db:a8:4d:5a:bc:a0:a8:c0:d9:23:f9:c5:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Mar 23, 2015

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 8fc75b7d66f025aa82937b569bcee3f32b5d6d84954bd662160beccb9280f3e6
MD5 2e8831ab3cde2dce2c6cae8bbe099619
SHA1 db246e282e04f58c2fa60b85fc744eea4e0a8e5f
SHA512 6c45974d15e1f8518607dcbfdea84ee4dafbe44c6aa7f3a11800e045d3595f39c394d8c3df0b488bcf6936b595c1af30b5fadeca08af42b256f970cfdc52d120
SSDEEP 1536:Q+SRMbbhJSiPPPPPY2UGrg4PP1WURIxQ4r58q2dTNDg:xcyAy8r58qaTdg
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
MD5 132e6153717a7f9710dcea4536f364cd
SHA1 e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
SHA512 9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
SSDEEP 96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R1/$_1_/apphelp.dll

IMPHASH a67f45b2e1e209d365ca7136c58ff087
SHA256 3f6b1e16842b9ac03cf2aa285ce812d1c526f610854b7e110ac1b4625d55ecf6
MD5 fe83bf8c380b208bd7738ac0d5645962
SHA1 fd83745c0f286d9b2b43316ac9ee1d14459b47f9
SHA512 217df4fdf9e9e3c4b525d00c7c680fc77c63a52817c53b59e5f786eda68b766a8068e44c04c74dc8e695711051d59097c4c2b35e9f1eace38a5cec4e7530b2d3
SSDEEP 49152:+p8upoQCPbiRIO+/z0bZgvOJd20Zy5AmfsWJP:+G++FH
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

3f:3a:d4:d4:18:70:23:5f:58:82:14:b5:8e:72:65:44:02:40:60:b3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Mar 23, 2015

Minor OS version

1

Major OS version

5

Entry point

936509

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Work\jZip\G1\InstallCore\rbin\apphelp.pdb

wininet

InternetGetConnectedState InternetOpenW InternetReadFile HttpQueryInfoW HttpSendRequestW InternetSetOptionW HttpOpenRequestW InternetConnectW InternetCloseHandle

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

kernel32

Sleep CreateThread GetExitCodeProcess CreateFileW DeleteFileW FindResourceExW GetModuleFileNameW InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection GetVersionExW MultiByteToWideChar WideCharToMultiByte AreFileApisANSI ReadFile SetEndOfFile FlushFileBuffers GetFileSize UnlockFile LockFile GetFileAttributesA DeleteFileA GetFileAttributesW LoadLibraryA LoadLibraryW FreeLibrary QueryPerformanceCounter GetCurrentProcessId GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW LocalFree FormatMessageA FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileA HeapDestroy InitializeCriticalSectionAndSpinCount InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent GetTickCount GetFileInformationByHandle GetCurrentDirectoryW DeviceIoControl OutputDebugStringW CreateWaitableTimerA SetWaitableTimer SystemTimeToFileTime ResumeThread TlsSetValue ResetEvent OpenEventA TlsGetValue TlsFree TlsAlloc DecodePointer EncodePointer GetStringTypeW InterlockedIncrement ExpandEnvironmentStringsA TerminateThread GetExitCodeThread CreateMutexA WaitForMultipleObjects ReleaseMutex SleepEx GetModuleHandleA GetLocaleInfoW GetSystemInfo CreateProcessW InterlockedDecrement GetLastError WaitForSingleObject TerminateProcess OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot HeapFree HeapAlloc InterlockedPushEntrySList GetProcessHeap UnlockFileEx WriteFile SetFilePointer LockFileEx GetLocalTime GetModuleHandleW GetProcAddress lstrlenW FindFirstFileExA InterlockedExchange SetEvent CreateEventA GetPrivateProfileStringW WTSGetActiveConsoleSessionId CloseHandle FlushInstructionCache GetCurrentProcess SetLastError RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection LockResource LoadResource SizeofResource RemoveDirectoryW GetDriveTypeW FindClose GetCurrentThread SetThreadPriority ReleaseSemaphore DuplicateHandle CreateSemaphoreA LCMapStringW GetTimeFormatA GetDateFormatA CompareStringW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc HeapReAlloc HeapSize GetCPInfo VirtualProtect VirtualQuery ExitThread GetCommandLineA RtlUnwind FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA GetStdHandle ExitProcess SetEnvironmentVariableA SetStdHandle WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode HeapCreate GetACP GetOEMCP GetUserDefaultLCID PeekNamedPipe GetTimeZoneInformation GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA IsValidCodePage

user32

GetSysColor DefWindowProcW UnregisterClassA PostThreadMessageW DispatchMessageW TranslateMessage PostQuitMessage GetMessageW DestroyWindow CreateDialogParamW IsWindowVisible GetSystemMenu EnableMenuItem EndDialog LoadBitmapW DrawTextW GetWindow MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent IsWindow MoveWindow GetDlgItem SetWindowTextW SetWindowPos DialogBoxParamW ShowWindowAsync EnumThreadWindows GetActiveWindow BringWindowToTop ShowWindow SendMessageW ScreenToClient FindWindowExW PostMessageW GetWindowThreadProcessId EnumWindows CopyRect UpdateWindow CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW InvalidateRect KillTimer SetTimer GetClientRect EndPaint BeginPaint MapWindowPoints

gdi32

SetBkMode BitBlt DeleteObject CreateRectRgn SelectClipRgn CreateDIBSection GetObjectW CreateCompatibleDC SetDIBColorTable SelectObject DeleteDC CreateFontW

advapi32

RevertToSelf ConvertSidToStringSidW LookupAccountNameW SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW ImpersonateLoggedOnUser SetTokenInformation IsValidSid GetLengthSid CopySid GetSidSubAuthority InitializeSid GetSidLengthRequired CreateProcessAsUserW DuplicateTokenEx AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey

shell32

ShellExecuteW SHGetFolderPathW

ole32

CreateStreamOnHGlobal

oleaut32

SysFreeString VariantInit VariantCopy VariantClear

gdiplus

GdipCreateBitmapFromFile GdipGetImagePixelFormat GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipDrawImageI GdipCreateFromHDC GdipDrawImagePointRectI GdipFillRectangleI GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdipDeleteGraphics GdipGetImageGraphicsContext GdipCreateBitmapFromScan0 GdipGetImageHeight GdipGetImageWidth GdiplusStartup GdiplusShutdown GdipDisposeImage GdipCloneImage GdipAlloc GdipFree GdipCreateBitmapFromStream

msimg32

AlphaBlend

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock ExpandEnvironmentStringsForUserW

oleacc

AccessibleObjectFromWindow AccessibleChildren

ws2_32

setsockopt WSACleanup WSAStartup ioctlsocket __WSAFDIsSet getaddrinfo freeaddrinfo WSASetLastError gethostbyname socket WSAIoctl connect select getsockopt htons bind ntohs getsockname send recv WSAGetLastError closesocket

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

55KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

345KB

Virtual Size

345KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$R1/$_1_/license.txt

SHA256 ebc068afadc00b72158e1e3e365ea56464648f62daba95b5d5370a7cc4e12468
MD5 7483fa1bf5ad5c0bb562e33329d696ec
SHA1 1d49c5e96ff53a4ddd4df3976911d3a981708212
SHA512 71495a5cceb96ed12b9b0de1070c28aa180ed7984874285c87951ecf905451e1719e3b162b7079a9069fa25b66a772fdf8aa1477f3ca1bb2a31a9a52735c8cdb
SSDEEP 384:LFTwRWNsR/4hW2yTgv3pjrDHVMcR3vyVLqSwSd+pOBReiLH:BTw4WRkdB/BMc1EqSjzb
MD5 SHA1 SHA512 SSDEEP

$R1/$_1_/soffer.dll

IMPHASH ec7f08258a6e85455901e00bbb9a8ccf
SHA256 3c4307e83e3264571a5e5e80e01da4d7bce98f0c9e36564b10ff21edbc613330
MD5 0d1d780cd2d8445c4718d23e8f2551cd
SHA1 348618b28381aa43b1696ae26325a02e27c51c60
SHA512 02776fbbd10556d4152660440059eb29358103e1ae71df289ef0ef11f66d9bef4053813553a4fea71af427ae866e5c6222693b3e5295be9592827b073f592e34
SSDEEP 3072:ZPPxy2Bw7h8/BAH2l/c6Ny9xSLDUaWdgqXoldyXBvOtE:hPg2+d6AWzNyHSLDUaWl2dW99
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

31:25:b8:c9:51:04:6f:5e:f4:92:d5:61:e7:fd:90:10:08:00:76:48

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Chains

Mar 23, 2015

Minor OS version

1

Major OS version

5

Entry point

81698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Work\jZip\G1\InstallCore\rbin\soffer.pdb

kernel32

SetLastError EnterCriticalSection LeaveCriticalSection GetCurrentThreadId GetModuleFileNameW GetLongPathNameW GetProcAddress GetModuleHandleW lstrlenW ExpandEnvironmentStringsW SetEvent DuplicateHandle CreateEventW GetExitCodeThread InterlockedExchange WaitForSingleObject TerminateThread GetTickCount WideCharToMultiByte MultiByteToWideChar OutputDebugStringW GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW FlushFileBuffers GetStringTypeW LCMapStringW WriteConsoleW SetStdHandle LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode FindResourceExW SetFilePointer RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount HeapCreate TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle ExitProcess Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA CreateThread ExitThread DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange LocalFree FindResourceW LoadResource LockResource SizeofResource FlushInstructionCache GetCurrentProcess WriteFile InterlockedIncrement CreateFileW CloseHandle GetTempFileNameW GetTempPathW DeleteCriticalSection GetLastError RaiseException InitializeCriticalSectionAndSpinCount InterlockedDecrement GetConsoleCP

user32

MapWindowPoints SetTimer SendMessageW CallWindowProcW GetWindowLongW SetWindowLongW GetClassNameW DefWindowProcW EnumChildWindows GetWindow UnregisterClassA IsChild EndPaint BeginPaint RegisterWindowMessageW SetWindowPos GetFocus SetFocus CharNextW RedrawWindow CreateAcceleratorTableW ClientToScreen ScreenToClient SetCapture ReleaseCapture FillRect InvalidateRgn InvalidateRect GetDC ReleaseDC GetDesktopWindow DestroyAcceleratorTable GetKeyState GetSysColor GetSystemMetrics PostThreadMessageW MsgWaitForMultipleObjects PeekMessageW MessageBoxW IsWindow PostQuitMessage DispatchMessageW TranslateMessage GetMessageW IsWindowVisible SetPropW GetSystemMenu EnableMenuItem CreateWindowExW LoadCursorW GetClassInfoExW RegisterClassExW PostMessageW DestroyWindow CreateDialogParamW ShowWindow KillTimer GetWindowTextLengthW GetWindowTextW GetDlgItem SetWindowTextW MoveWindow MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect

gdi32

BitBlt DeleteDC SelectObject GetDeviceCaps CreateFontIndirectW GetObjectW CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush GetStockObject DeleteObject

advapi32

RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW

shell32

ShellExecuteW

ole32

OleInitialize CLSIDFromString CLSIDFromProgID CoGetClassObject CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc OleUninitialize ProgIDFromCLSID CoUninitialize CoInitialize CoCreateInstance

oleaut32

VariantInit DispCallFunc SysAllocStringLen VariantClear VariantCopy OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysStringLen VariantChangeType SysAllocString SysFreeString

shlwapi

PathFileExistsW

Sharing

General

Malware Config

Signatures

File Explorer