89c5e2ae2648672d61b4fa36e5957e55_JaffaCakes118

resource
89c5e2ae2648672d61b4fa36e5957e55_JaffaCakes118
unpack001/$APPDATA/scriptlibrary/MCppCodeDomProvider.dll
unpack001/$APPDATA/scriptlibrary/autolaytui.dll
unpack001/$APPDATA/stow/gutils.dll
unpack001/$TEMP/TenrecSaggar.dll
unpack001/$TEMP/crm/IEExecRemote.dll
unpack001/$TEMP/crm/StoreAdm.exe
unpack001/$TEMP/redesign/pbo/ProjWizUI.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 e6af8c20aa307a53eb603f3e0d8858cff02f49495c9b51ce410cc841581283d4
MD5 89c5e2ae2648672d61b4fa36e5957e55
SHA1 1f86886ae34f934ad3529bb29541999b3731fd82
SHA512 eea49c866e687f17f276d9ab21fedbd27582128e76fdabca2338717fd18cc5e3d3a8dc13797b53b7a76f99334df4fab4240ac0e44ec175e4038e666f0c132b6f
SSDEEP 6144:JPCganNlPCaxFExssRVNJRImf5K91o2JxS/EGXCRWoGDn8gBfjv1haN3YqC8hA:HanLvxFE2stJ6mxKo2JxmuAn8gxv1s5o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/scriptlibrary/39.opends60.dll

SHA256 ec5c0007401f1caa74892f1937494453139a00191cdbc6b5db6b26cc9fd651d1
MD5 d7cdf6f5f061d313ef2aabdd84fa89c0
SHA1 9bf71a5803e670b4811416d2d412dc965164583e
SHA512 274357e0265d3f5707c977f99be19a83e9b044faf481a7f3075c0da25b08e586ea17813c21b397a934deecf2f757cbb48a461fcb84cde9f1f511c5d5a21478ff
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/scriptlibrary/MCppCodeDomProvider.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d828cda4a89557b24cc2a492cb3f6b09ec69c3ea00d36f5024b58942db9d76ea
MD5 dea1dfbd72e2534ed39c737bfbfcd82d
SHA1 72ea9b3a4017d0c37d0f5b20e02008ffbc88b79d
SHA512 254c575fa45b90d58111336600b1df25b33ac246c75b4edf4abc7500e118a66a78a26871af046bcb080fc31e82181a4599e8ff4761cf560fdec7c1c7649ebe16
SSDEEP 768:ejSqkAVXYRXpXfkPcPMdFwBKmq5aYFRJevf:BqkAKfkkPMdmBKm2aygn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\binaries.x86ret\bin\i386\Microsoft.VisualC.VSCodeProvider.pdb

$APPDATA/scriptlibrary/appledouble.xml

SHA256 aff63b4856bae8f62a1dc3d93291222b44f5c7bda18220da69cf4752adfc272d
MD5 9979c1e956bc68cfa19e9d1c558ac883
SHA1 08157f842e931bedbcf817ca458308fbe03e9d3e
SHA512 8e5bc15652067aaeded3b79ae54b2bcbca5b0a075fdb3468a382507c4ecd7ab1d5bc1ae0e7938692b27b280c93c5fff361248f5b9c1ac6e630b644796fa4146f
SSDEEP 96:AyDolLcldchgt/OUfHhK4JOPTrGvL4SiE3kifeQKbZK8yBiZ8PnPpMmRlH19p/6e:iTPQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/scriptlibrary/autolaytui.dll

SHA256 c9b43f966e47ce35d13d0d78af049a2382b3c0a58f4e44306123e805f9d0df83
MD5 1afcdd3beb62da7b5b695fc0666d26ec
SHA1 271c9c73e25b66fac894ad77af57a12b4fb80602
SHA512 d11c904ca069a27f12c2908b1625171fa583f9ed17c1efccd52aaed1c8591fb2377137915c56d09e331071c6a79c98f8f6baceab1dc97fa0f96c5f6360be812a
SSDEEP 96:9gTwNo4ON4YwU7ftsj0Y8nA5K49EWbkzQWPVnPV:9gGBIZUmWgzQWNd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

f:\binaries.x86ret\bin\i386\VC7\VCPackages\1033\autolaytui.pdb

$APPDATA/scriptlibrary/org.gnome.desktop.datetime.gschema.xml

SHA256 db8f91d8966e24570844f4f0e52b6d5e4d0212cb398c71509f5f3cab6b39d292
MD5 04016f7cbd5909f2c5ae787c74613fcd
SHA1 e5e3508fa934fe49e0440adf7c03a345ae4bb4d5
SHA512 cd68c141192a75ce1df1c0b737e39a887b2fe7f10035f51a8d25fb5f9557306c0305b9913749311051770eb81855a65b0ebd0cba94607ba74cdc79378d694969
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/scriptlibrary/previewobjectbar.xml

SHA256 11bc7e1f12262bb43d0a0f2095dcc80af809080b8edc18b7e3fc67764c863695
MD5 7968543d27de56eff89d751a51083318
SHA1 208f69b31ab7abb50754da1be75b14ef9ff378cf
SHA512 61aac728d1ad45660ded553bab84c748c025b26faba16736d949707e7a29189e9f93365d86c28b5f417159c860265c2dde5fbe42eb948502155dac1bedc570ce
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/stow/gutils.dll

IMPHASH 8992e0e73338e8ec5646ea66e35aece0
SHA256 9a77a59e040e99459d1ab2be8c5721b0c61aa608abb81c24e7b355f1c2f49176
MD5 657d1d110e247fec5b6653f69c562e9a
SHA1 ab92a9a74c55c5e5d05f1f3dde518371dda76548
SHA512 1faaa0140ed68a335e9c6067767dd8514c635e5a222e611c52e2fa1fd66d39263f4a928bf71843b8bc0a0355ca008408af5f9cf67e82e96c139ce291871074a4
SSDEEP 768:qlcsy/f7ZAVLfhvKsUNfK74vGHpXwIxYD7LCKD0k7u1WZ7gxU9:ay/TZULfhyHE744wIxy10kSO7H9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

9732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetTickCount GetLastError Sleep GetProcAddress QueryPerformanceCounter GetCurrentThreadId GetModuleHandleA GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter WriteFile FlushFileBuffers GetACP WideCharToMultiByte MultiByteToWideChar SetFilePointer ReadFile IsDBCSLeadByte lstrlenA lstrcpyA GetComputerNameA OutputDebugStringA GlobalAlloc InitializeCriticalSection ExitProcess DeleteCriticalSection GlobalHandle GlobalUnlock GlobalFree CloseHandle GlobalLock EnterCriticalSection LeaveCriticalSection MulDiv CreateFileA GetCurrentProcessId

msvcrt

wcspbrk wcslen memmove _snprintf

user32

RegisterClassA LoadCursorA SetScrollInfo SetScrollPos SetCursor SetScrollRange RegisterWindowMessageA GetSysColor FillRect DrawFocusRect InvertRect DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA EndDialog DestroyWindow SetDlgItemTextA EnableWindow ShowWindow CreateDialogParamA ValidateRect ScrollWindow GetKeyState SystemParametersInfoA CharNextA GetDlgItemTextA DialogBoxParamA GetFocus GetWindowLongA SetWindowLongA PtInRect DefWindowProcA RedrawWindow InvalidateRect GetParent SendMessageA SetCapture BeginPaint EndPaint DrawTextA GetClientRect GetDC ReleaseDC CreateWindowExA CharLowerBuffA wsprintfA LoadStringA MessageBoxA ReleaseCapture

gdi32

DeleteDC SetBkColor GetStockObject GetDeviceCaps CreatePen CreateSolidBrush DeleteObject LineTo MoveToEx GetTextExtentPointA GetTextMetricsA Rectangle ExtTextOutA ExtTextOutW GetTextExtentPoint32A GetTextExtentPoint32W SetTextColor SetROP2 EndPage StartPage EndDoc AbortDoc StartDocA SetAbortProc SelectObject

wsock32

htons listen accept socket WSAGetLastError gethostbyname closesocket connect bind

comdlg32

GetSaveFileNameA PrintDlgA GetOpenFileNameA

AbortDlg AbortProc Format List_AddAfter List_AddBefore List_AddFirst List_AddLast List_Card List_Check List_Clear List_Create List_Delete List_DeleteFirst List_DeleteLast List_Destroy List_Dump List_First List_Init List_InsertListAfter List_InsertListBefore List_IsEmpty List_IsOK List_ItemLength List_Join List_Last List_MakeOK List_NewAfter List_NewBefore List_NewFirst List_NewLast List_Next List_Prev List_Show List_SplitAfter List_SplitBefore List_Term SocketConnect SocketListen StatusAddItem StatusAlloc StatusCreate StatusHeight StatusWndProc StringInput Trace_Close Trace_Error Trace_File Trace_Unattended checksum_file ctree_create ctree_delete ctree_find ctree_getcount ctree_update dodlg_stringin gbit_alloc gbit_findfree gbit_free gbit_init gdate_daytodmy gdate_dmytoday gdate_monthdays gdate_weekday gfile_new gfile_open gmem_free gmem_freeall gmem_get gmem_init gmem_time gtab_wndproc hash_string readfile_delete readfile_new readfile_next readfile_setdelims tree_addafter tree_create tree_delete tree_find tree_search tree_update utils_CompPath utils_isblank

$APPDATA/stow/model40.xml

SHA256 7f1c23dc7aec8d8bfdc917d10fa3974a95db573391304907558ab630d92bf192
MD5 163bd5f380d02af949755123afe7b2ac
SHA1 5365f953fb3076919db5322bea3077cfa54f7868
SHA512 4fab714ea8a80a17083e150d3de5583f56ba4b860b2577abc7a1227f708f986f8a8763ed118005656491c1774e471bc22448706b48e65f9b1adb57270853c82e
SSDEEP 96:9CCDlSO/f12RBUIaArCUtEqkCBHq+K59eT595/59k5p55v75AZ5Ul:BlSE+rCUtEqkOqvopoX6Ml
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/with/count/ConmanClient2.exe

IMPHASH 4cb3e4d7adf4bf7704cb1da2096dfea2
SHA256 42a36dab0912246c14d677b5baa3cd0e384acf645fc51db39aac04f2ab1bb760
MD5 91dc7b85d80a43fd42a0ce82e077f8b8
SHA1 a1c00dc46465141a48f180c9dfc49e9af925e248
SHA512 73f73d73b9b370cbaa606b5b4fc16bdee9780a4afa773aed6aa1a368ad4681493c9b83e8bdc69b4a01f311f171d1e5b3545ac7bfd3577d434668023c08539dfc
SSDEEP 768:1K9IyEL30E1DYXw0kYCmp0K4ZJg0cDDzssseYp24/JFcZ1GgAsEr:XFHYF6K4ZJg0aXssJYpDhFcZ1KsEr
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

5

Entry point

38029

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CE_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ConmanClient2.pdb

$APPDATA/with/count/MicrosoftWindowsCEForms.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cbba64117b44e28ba4d05f74d4b11b9770922dfaf50d46316227c5012913068d
MD5 d818d217b0a8055ae995e94a6caa9db3
SHA1 f8d9307e9ce7803f48a37778e935ba114a492b12
SHA512 55b907a136563dcfbe85ef38c1599f76f6b77c7bdd9ef52d708f5fa783bb5ad1c5a01138473e835efca10abb733ae6a03532ca2ec7414e7edc4caaca95fd8b03
SSDEEP 384:IX/u/+j0QSjE1tmD6NQq36jWa7NEhN3JkWXjYWSYLCcM36mn9:Cj0rg7Q6NYYL3u6Y9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

48:27:82:e8:7b:6c:ee:f6:81:27:f2:fc:dc:7b:7a:c2:c6:71:47:5b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

May 23, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:fa:aa:11:d7:13:01:30:93:20:84

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2002 - Dec 20, 2012

Subject

Serial Number

61:05:f9:0d:00:00:00:00:00:07

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 14, 2005 - Nov 14, 2007

Minor OS version

0

Major OS version

4

Entry point

18782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Euchre

SHA256 327decae3bff690bdbf51b9a0c3e5d4cde0ba02a96db7a21ad6f9b52f68fb66b
MD5 daf7b305dfcdfdc4ac475f437e86c646
SHA1 6136ac48324bd99f3335aafa9216caa77b7c3376
SHA512 dfc95d30e220b47f3da78378d3f4a6ab090b3d4a43835795742b5a6c8ccdd7d294752daf2316d901224b3b11a7c245a036ec6c05db1b8f11b9ac64122b05aa29
SSDEEP 3072:0nzlZSwL0dDoGkIXXyyBBNppDVlwg8k1hpPm9OgK3:0nzHSZdoGDnygBpjv1TuYD3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/TenrecSaggar.dll

IMPHASH a3810d07530dbe9e584367ce431db16a
SHA256 785275c1afb2a166f159c391a21afe5d82c30cc479a7837c28abb89adff67b87
MD5 edb845779d91dcc37810eec0f029dfd3
SHA1 8ed5905bf015d0f7508b2af8b6be79a368aceada
SHA512 829b227037b4e3be5811b396ebaf7dbffb1ada24d955025d96f81a61d774c400b6c3997133f72cb1a601a7de60033baef344333bc8cd8749628eac4d206f2016
SSDEEP 768:JT0LUpldyjKuOexoIhIOGnTEDVBP3vydFd1sbUKV:JSCyhSgY4BidFiV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

7126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/crm/IEExecRemote.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 46862e0cd12555ac96a76ce1ffca06d6ef250b709e09e5c8441793d4c04e5a38
MD5 0d5fe1c95afe423b214f13e856d0f1a5
SHA1 539727bee5ba21bbf8591a4927807a7a42d9161d
SHA512 d578184f1f37bca0cbbd893984b1159c4d541b290f7a1339759b9cd870f450edda76807e853fc6bd8da91d6186dd07ad05012218cfcb910cdae07f4180e442ba
SSDEEP 192:azEJySPTVhqQwRGC19x4VIJI13WyNNtrW/:NJySBk9RfNxJI13WyvtrW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

IEExecRemote.pdb

$TEMP/crm/StoreAdm.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fc764006b963e0c0a0e15cdc273a4491bca5e5fb2045bbbd3c79538bc0bb695f
MD5 a9c6d50aed840dc5ecb9456efb6c4205
SHA1 b85b0392743c4f0d9f94a872247a7556770757dd
SHA512 ed9d46486358ef3cd637317a5a107b89ce42556c91fe07e27e37386f8b13c7ef0a80798436fb63175cd00d02635ac894fa16ba99e5faf9cd34757f3d5f712da8
SSDEEP 384:5rZgYkNCU+htQdugbMHFu+Eg6ihJSxUCR1rgCPKabK2t0X5P7DZ+kgpWDa9rW:5rZgYkNCU+hMuQMH45FRJCg1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

24958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

storeadm.pdb

$TEMP/crm/type-windows.xml

SHA256 4f6d6e9524bc54b6c1ab6a4cfcac8a43b345161523481fb7a53e10a2b665da4b
MD5 21d3ea0e2b51ded4e3870d401897a9d8
SHA1 7f5466aaaed49adb2c7ae1e39f69c29143bd6ebf
SHA512 63d58290afa7b505643fe6abc7637fe38af8b16cce94079eb7cbc9688595297acbb01652a6d55b9acced96dbe5913124a243536c8f6fd4c7b9815b28129c49d0
SSDEEP 192:4vEQXQjISxWn7RSsRTeHXkkqs6FdVUUbtFHgwo:9HXkkqs6FQcHgwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/crm/wikipedia-zh-TW.xml

SHA256 3a5e487dfb2d53f38a1e9ed225b523b6c7948ff927c6b0300eaf22e6dc7406f8
MD5 8c4bf828a45106666ede14e362084c52
SHA1 c26bfdd3f2c2b04e03a3f566fb1547cfbfc7f36d
SHA512 523d74b4825a298d211461430fb1b26b72de6eabd96f61c095b2ccf3c042d06e5cd5b5e062d69bb9b40adb35afbfea39adf7a1d035631ca003ca621aeb8dbb82
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/redesign/pbo/ProjWizUI.dll

SHA256 9ea6362959d9aaf043928ff088084998b13ccc7eb06b9c650b5dd2cc0a2a5bd2
MD5 311aa10ab1c6fe05e80463232e10efa0
SHA1 19ca5bb1a25514fb7d93aabb7fe7af88ea4961d0
SHA512 1ac12b778fb851cc38fda1754fd4ca3f073641614042035d1c8f8ceffd9adeeb7c4faf588beb9d3b1faa1f6782f2564435d8360655343f131b6f2bbe4171e1de
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/redesign/pbo/ram.xml

SHA256 df2f6772f39e58c4bc87fa67159fa02db547919d2d7bca004c7eb7031e945cc9
MD5 099c0e30587beed73816bf36972ef532
SHA1 2eeab4014240ebbd0e2d67535490b11e0d6d2169
SHA512 9e9e8f54befeb79cd6cc25e653ec8e715e8fd86e379bbfbbcbbc66c261922b4c75375fa7403898c23ed6737ccb0b7daf623aab0cd50deac577925a2571bd3ca1
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/redesign/pbo/x-ocl.xml

SHA256 a0fccbd1a3d7d4545a9a0196ea4a6dffa107dc4bf6bb74696dce5ef44efbbf78
MD5 d0ef4f69b86bdb3806e39c07d3d4d47e
SHA1 3f418e11842e61cd14d049ea9dba03abe46474bf
SHA512 06ce594be0b4f31d3520d36700801b052236c232a6495a9eb51cf4b19238d7128f4632ca455974b7d6e63b71418fad3a12f50a115ed26d23e9292c3b4c1babc1
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer