904fd496b076d10ab4fc547559b5d0b4_JaffaCakes118

resource
904fd496b076d10ab4fc547559b5d0b4_JaffaCakes118
unpack001/$APPDATA/emergency/diffs/ActiveSyncBootstrap.dll
unpack001/$APPDATA/emergency/diffs/metade.dll
unpack001/$APPDATA/emergency/diffs/msdnmui.dll
unpack001/$APPDATA/emergency/diffs/vcdeployui.dll
unpack001/$APPDATA/toplist/mode/wbemDC.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$TEMP/Conservatory.dll
unpack001/$TEMP/firms/MicrosoftVisualStudioDesignerInterfaces.dll
unpack001/$TEMP/pntables/AvVsPkDH.dll
unpack001/$TEMP/pntables/vbapkgui.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 3a10c525b2f0a94e7e9facfa4685490e9a46d0d6a62be53f570fa845cd680c56
MD5 904fd496b076d10ab4fc547559b5d0b4
SHA1 b8e8a890eb523e786793e95a305d319632a60e87
SHA512 3c5f5ca06c0eb27ba1156d8ca3c9d7de23d3383cf8be2bd941bba14b22d81d7142a96c344941f006a82af80f617ee6680a090e56726ad2046580d2ed9374e8c2
SSDEEP 12288:EanbtiNPkq2Nu/RXNV74UlGpVXG455ihwSREfCYCNl2SSDlrgCemY87zvL:ztm8TN8oV2+UwrfCzNlkDl8S77zj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/25/66.opends60.dll

SHA256 e7ab6b06a1134f3efe20fc5816ad5402c8e111fbd5031ec4f2c520224b9d5bdb
MD5 3f2a75e68f8d67494b386dfaa5abe2b3
SHA1 f405e0bc8b4fc2cad111045c67e3c64343e2c7ca
SHA512 a7909c511287c5a2f59992bd674998d0714f100ceab30168d9c9f85fc3e6b9ba76d0066c2cea3feed9ae2e651605fdd0f3992c849300b9c073f4cb1d05ada90e
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/25/vcompd.dll

SHA256 1c3a71319639355f5eddb6a85f25d5de42e91cfe0fc0589fe77efd5903d6d77d
MD5 e31af3b8a32548786e51863d6dd2c584
SHA1 d7631fb52ab18f8587dd95f735ca9baef35fc31e
SHA512 a87e34be3689fce35f7857df50276c03ef6680d49219a3a87549ebbaa9a29eca29473b69288168a71cc90a3525875790f3e457d860d54d1f5d0ae2d6f08938c2
SSDEEP 768:WeN6bkNPd2tLrvhqjVZsnrL2jmPGLeUhLlLCI6ogak:+keLrvhq5mLS5eU5F8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/emergency/diffs/1.opends60.dll

SHA256 e78e084b6f4055ec343112544f8143140d9c401c3d5ed97e96ea305c0e1a2216
MD5 e143ae5b91c057e4cd5606207d21862a
SHA1 8b39091a49d5c020083460668fa7d204f9c9c0f8
SHA512 1c5f34650c0fb1a2f237cc974fa1587e3bc861c19fee352f09cdc7dfd111b9a10da47b34580bb79c4e5c22e8d2d70af51305c7537b7e9e93953f83b23459b692
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/3.COMServerPS.dll

SHA256 1eec0baff5fe77be2954f6fd125bff70699aa4aad30978ce650ee68cd0b478fd
MD5 276ede82296c5ff52d6647ae5fafc8c7
SHA1 501a3bf8b9442386009d6ff2c97cffc4e55b5b47
SHA512 a254bc3fa138c0e0c7a03eb1de25405d6db038f8c8593fab90ae18e1ed88caf642383d4c46738c33395bb3b4ea3c3120944a50ec408770fc326eb433dc6ff8cb
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/5.opends60.dll

SHA256 af70af914b3ac7d5dc4023934ebcfc189242f8e41c764cfcfae5ade6be3af993
MD5 66fed1f516433d0c1fdef577a5405339
SHA1 435fdf52257dc975db8b676828a147fd04f94b95
SHA512 597ef5dec02ff8c0a47eaf2e78ba37c76487b44864aad7baee0019c981d63d37d9aa8d2cec34dd58bade9a572cf1d40e18212faffacb295c86fa232b83aaf3f7
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/ActiveSyncBootstrap.dll

IMPHASH e31d4785817da405fe526d37d096e81a
SHA256 1bf2270bfa6bafe29329f9d84c5f8856b57c84af6f3ed05027cebc4f767d07ef
MD5 b59ec4aa8cc4eeb16e5567c085d5d677
SHA1 7c2442b35816e0517648a390f106910ae960f7bf
SHA512 719d127a378fb16772c5a6c4b6ea6225a27ad4cd2a0d84e237faaa7a1a4e63cdd869ad2cf04b57268e393f709adea2a8aa83c6a640111d93fd2071ebdac7a470
SSDEEP 768:MzE7orC6TyNqZ7t7Ahh5E4C6FHYm6d985dgn49kjkGnUOhBpEdpb:tkTym7t7Ahh93+dqgbjXUOhBpeb
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

31282

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ActiveSyncBootstrap.pdb

kernel32

WriteFile SetFileTime DeleteFileW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection LocalFree GetThreadLocale MultiByteToWideChar lstrlenW RaiseException LoadResource SizeofResource FindResourceW InterlockedIncrement InterlockedDecrement GetModuleFileNameW lstrcmpiW LoadLibraryExW CloseHandle SetThreadLocale Sleep InterlockedCompareExchange QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetLocaleInfoA GetVersionExA InterlockedExchange SetLastError GetFileTime ReadFile CreateFileW GetLastError WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetFileAttributesW

msvcr80

_crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CxxFrameHandler3 _wcsicmp memset _except_handler4_common __clean_type_info_names_internal _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt _encode_pointer _recalloc wcscpy_s wcscat_s malloc memcpy_s ??_U@YAPAXI@Z free ??2@YAPAXI@Z _purecall wcsncpy_s ??_V@YAXPAX@Z ??3@YAXPAX@Z _decode_pointer _CxxThrowException

user32

UnregisterClassA CharNextW

advapi32

RegOpenKeyExW RegCloseKey RegSetValueExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegCreateKeyExW RegQueryInfoKeyW RegQueryValueExW

oleaut32

SysAllocString SysFreeString SysAllocStringLen SysStringLen VarUI4FromStr LoadTypeLi LoadRegTypeLi

ole32

CoTaskMemRealloc StringFromGUID2 CoTaskMemFree CoCreateInstance CoTaskMemAlloc

shlwapi

StrDupW

$APPDATA/emergency/diffs/SystemMessaging.xml

SHA256 9549a643c76eafd286eee5820f16942d46b4a5309c13f3135f8f2afd8d1755d8
MD5 acde39a4105b6ebf2e127e1a9af2ef4b
SHA1 3622b0121b0a99887cf1ff90e5ff9b83a74213aa
SHA512 be96108bb358fc86a7203b8cd6539d39c4d0cc4f36a6a418b1227d746d5b13ba253256ca92692fd45dda1bcd1bdeecc37f28b17b9d0191f02eba42051c2e972d
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/amazon-en-GB.xml

SHA256 599b6ddc0c078c6e72de0f900e9e6bc6ec8adaaee683d78fb90860d90aa432a7
MD5 40264b293830342978d02c1620b0ff1b
SHA1 fb366782804a19f09e5e951659b8ac03a9523e39
SHA512 7b35d8bff92698f4549a21d91e5e1ac43eabad94dd2cf52f5459d36d613bed82e01fd2a06cef5851b9b41e4b6f9f85f66028a8e789c870b25575ffb96764e2f6
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/canontst.xml

SHA256 445b14e1805d6916e80be00474f7c45da4d67036fe38f5a12edb90ceeb7bee00
MD5 0896c70d9aa16cd09a5154ec907c6327
SHA1 8072364af5c7aab556d8f9657c782409d9ab8fdd
SHA512 7244aa8ea01516c43980ae8f8c2072cf5e78a2af72bbddacf0a9381589fc95f148e640183574c72ae72d700208a0abd26adcf6d1293a80ea81b5c97f179eba58
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/devenv.exe

SHA256 374c4bc0b4743621fddb79a9c56b8b01c097119f1488148d6bea946f6e1e3344
MD5 46f256b3a362ee2122a8a89d6af8a2d7
SHA1 15a631600c2a4d30a0f0868408b73000d984c4c7
SHA512 eba307bb868c5cd46c8550ae414e9daf8aad6dcd7149d1f96ecdcc346aa832dc7688972bc6905210e47f773b9f54cd48392faf61b109660093d6d77731a6c3c8
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/freecell.xml

SHA256 16058c4fbb64c5b43023135be0f6e862ba16d4adfb8d82a74ae513279fec55f4
MD5 abb455f70e7c6ef2a075d50e43da4d7a
SHA1 6c0c79288ccbb81165ec4a40dbc84142a23232e9
SHA512 350c0fc040cbf9b5e9a796a849702ff6dca18bb5bf916b93c523562ab47f87b8f9988289b748fcc18f97979368b4ab5abcac3b6581ca827899b1276b512b3591
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/guidgen.exe

IMPHASH 6e46e7490d332ef8350b59b0d2776127
SHA256 a2f590dea50cde47b0325d7a9adeea464257f46b76c059cf3e1ab2db65574685
MD5 58c655527b57d74ae3c189a60a42da18
SHA1 f267630311a1c42ce9c4f0deda00e4132e9f8b25
SHA512 03c708a23339792802f506278891005e521b7188d0558fcc0f25dfd0c7cb0048c8fbf1f9fb1ac65fd6ef4bc4c7cac1715bcd8f07dd82e3e6770e327cc630e209
SSDEEP 768:QRi/Yplgp4V5qWNqYoMfTF/K4itMpdRJDh9ODV0L3d/o+X:AKYLHV5ZNbnFy4itMpdD7ODV0R/oK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

58:05:0f:91:e3:d2:a5:88:a2:6a:e8:ca:68:a3:27:bc:10:62:81:50

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 23, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

4

Entry point

14404

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

guidgen.pdb

rpcrt4

UuidCreate

kernel32

GetStringTypeExA GetVersionExA InterlockedExchange MultiByteToWideChar WideCharToMultiByte GetLastError GetVersion GlobalUnlock GlobalLock GlobalAlloc lstrlenW CompareStringA CompareStringW lstrcmpiA lstrcmpiW lstrlenA GetEnvironmentVariableA GetEnvironmentVariableW Sleep GetStringTypeExW GetThreadLocale GetLocaleInfoA GetACP GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetStartupInfoA InterlockedCompareExchange

user32

CharUpperA CharUpperW GetForegroundWindow CharLowerW CharLowerA EmptyClipboard SetClipboardData CloseClipboard GetSystemMetrics EnableWindow LoadIconA OpenClipboard GetParent GetClientRect IsIconic GetSystemMenu SendMessageA AppendMenuA DrawIcon

ole32

CoUninitialize CoInitialize CoCreateGuid

mfc80

ord1620 ord5975 ord2248 ord757 ord4038 ord4014 ord6278 ord3801 ord764 ord1185 ord1187 ord1191 ord1084 ord2371 ord2372 ord1903 ord1063 ord354 ord3182 ord4262 ord4486 ord3949 ord2644 ord3709 ord3719 ord3718 ord2533 ord2646 ord2540 ord2862 ord2714 ord4307 ord2835 ord2731 ord2537 ord5200 ord1599 ord1655 ord1656 ord1964 ord5175 ord1362 ord4967 ord3345 ord6277 ord3802 ord6279 ord1522 ord2172 ord2178 ord2405 ord2387 ord2385 ord2403 ord2415 ord2392 ord2408 ord2413 ord2396 ord2398 ord2400 ord2394 ord2410 ord2390 ord934 ord930 ord932 ord928 ord923 ord5233 ord5235 ord5960 ord1600 ord4282 ord4722 ord3403 ord5203 ord4185 ord6275 ord5073 ord1908 ord5152 ord4244 ord1401 ord3946 ord1617 ord1207 ord5912 ord6724 ord1551 ord1670 ord1671 ord2020 ord4890 ord4735 ord4212 ord5182 ord605 ord3641 ord1395 ord4580 ord1873 ord4749 ord709 ord501 ord578 ord2322 ord4035 ord310 ord5807 ord6236 ord1122 ord6305 ord2168 ord3109 ord3683 ord4541 ord566 ord3333 ord4261 ord4481 ord2838 ord5566 ord5213 ord5230 ord4568 ord3948 ord5226 ord5224 ord2931 ord1920 ord3832 ord5382 ord6219 ord5102 ord1010 ord3806 ord5583 ord2018 ord2063 ord4326 ord6276

msvcr80

_initterm_e _setmbcp ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __set_app_type _controlfp_s _invoke_watson _crt_debugger_hook malloc free wcscpy_s __CxxFrameHandler3 calloc _recalloc _resetstkoflw memcpy_s wcslen _except_handler4_common _unlock _encode_pointer __dllonexit _lock _onexit _decode_pointer _amsg_exit __getmainargs _cexit _exit _XcptFilter _ismbblead exit _acmdln _initterm __p__fmode _configthreadlocale __setusermatherr _adjust_fdiv __p__commode

oleaut32

SysFreeString

$APPDATA/emergency/diffs/metade.dll

IMPHASH 1de10507a97bf483d0f2cdc54338e8f6
SHA256 1c55dab99bdf7461f211af018ce84478ff76f230133bfe3f8ed4b535a6a3cbd1
MD5 6ce0a00b9c336497b08106982b5f34d7
SHA1 5a513e808470c9375d99096020e021340ebef332
SHA512 abefa479dd072165c12cd4a04107fda982f2002bf33c28d8038b673632cf8f45e59ebc56c2501c7d12ed28e502361f95382322e7c3dc545601e0264f9e183ed8
SSDEEP 768:/lM05vRJQLrGB8vH/MON6s9+nQ8TYtehb1QsJcHO3pflk:i05ELr48vH/MOkDQ8TYteAsaHO5fl
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

27283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

metade.pdb

msvcr80

?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ _crt_debugger_hook __clean_type_info_names_internal _onexit _lock __dllonexit _unlock _except_handler4_common __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null _malloc_crt _encode_pointer wcscat_s wcschr __CxxFrameHandler3 memset memmove_s _mbscmp swprintf_s free malloc wcsncpy_s memcpy_s ??_U@YAPAXI@Z ??_V@YAXPAX@Z _recalloc ??2@YAPAXI@Z ??3@YAXPAX@Z _CxxThrowException

kernel32

InterlockedDecrement GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA GetThreadLocale GetLocaleInfoA GetACP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount InterlockedIncrement InitializeCriticalSection CloseHandle DeleteCriticalSection MultiByteToWideChar GetModuleFileNameW GetLastError FreeLibrary RaiseException lstrcmpiW EnterCriticalSection lstrlenW SizeofResource LoadResource FindResourceW LoadLibraryExW DisableThreadLibraryCalls LeaveCriticalSection InterlockedExchange WideCharToMultiByte LockResource FindResourceA FindResourceExA OutputDebugStringW GetProcAddress LoadLibraryW QueryPerformanceCounter Sleep InterlockedCompareExchange

user32

CharNextW UnregisterClassA

advapi32

RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegDeleteKeyW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegQueryValueExA RegOpenKeyExA

ole32

CoCreateInstance StringFromCLSID CoTaskMemRealloc CoTaskMemFree CoLockObjectExternal CoTaskMemAlloc

oleaut32

SysAllocString VarUI4FromStr SysAllocStringLen VariantClear VariantInit SysStringLen SysFreeString

$APPDATA/emergency/diffs/model69.xml

SHA256 fe837088556a93a062cc07147aa885d437b7499a15d28c318da0423216d67006
MD5 eaf3a2c8083ea4a9943aea1e3e93e7a2
SHA1 6bdea0d825a3d3f3d91915449790207cffceb90f
SHA512 9e67bd517b2b77ebd0b72ee4a31b5700f44efd629a1d562c9093bcc56ccd10899509c2112355d6092bdf48f6c2f8cd555a9452b17355f20969555f52caab328f
SSDEEP 192:Blyp5k9sufWUKEqkzRBRlWRlDRlMRlQFRlQkPRlQjrRlQlRlQnl:Bly/kqUjbDWDDDMDoDzPDcrDqDW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/emergency/diffs/msdnmui.dll

SHA256 8638015b2bbc5b04029749aeb78e14521b5928737ca5e03bbcc2c0ec1a47f6cf
MD5 f217fe7e8cbbebc61930bd60cfaea1e9
SHA1 18532b33579033f04b661a196d4ad5c0887f3736
SHA512 b1633fe45c85f0e63fd0f293a3f71a80f6a8f059fbb3e1d17feac1ea7e5fce5d5d08207f08a163dd4543228556570e9a0bf06f34ca73f17ef9efa60f5fd3059c
SSDEEP 768:A/MAM30cf+Mj4fIzdODwDp1Y94nqiRyW82CLorT:QHel+MFKEpqUqiYWBOq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/emergency/diffs/org.gnome.Shell.Screenshot.xml

SHA256 126d63093d3fa4fd677700cb229448a7b331fe79735937f9327d774724e91aae
MD5 bea4c0bb7f550ff6390ef9229d89e5ed
SHA1 cd1e3a3570e21e78e33e1936264c8b4c12ec7e1a
SHA512 43fff9b2806aadfda7e72dad96ff97c9dc7fcf36f7b4171acee0103426e804c8c453011d0a2f477fa6fd0f1e01e6c7b3fddc93cfaa4f36ac44ffac970b4b0502
SSDEEP 96:uaJE0NbFhwDBxwQVFA8bkBxHPLVFbmxjfzlk/:uWE0WDBxjbkBxHPvmxjfzl0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/emergency/diffs/regasm.exe

SHA256 325b14941e79aeb570eb4062714d446f70b51db3c14fa58c5d2f90c8dafe3c3e
MD5 0366f988e5ea426d80338070d8fa241b
SHA1 153b90af59d0598a0d5f5e083cb7ff24e2f7adcf
SHA512 563a39c5958ae6f507e37923959a8a2608c7e9a6f338053edc142d8038849043c6050df2946116876102704ff14d6b36314aca468d91a7f3279754df2aba0bc2
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/emergency/diffs/vcdeployui.dll

SHA256 116d2a7b1c04779dc774f9012dff83f01cc4905bfce0e745c1e6f1b469b445a2
MD5 86e8573da0da08bc5801eeb05722b900
SHA1 9df15367a068e8f16bea5b098c1bc5ab0fe8f816
SHA512 bcb449de7aac0e68802868948344f57d7113eb16209ac8d2b5fd68f387c21998748763e34bc15cfb2ea3d9b09df4379eeac9b7651064a633d09d2ae6befaa724
SSDEEP 96:yOKkWxHSIWPpJG4yQMsn+WT74+olgDS8zlzcWmzIBTCT5o4nzkInvzUiPjP7TPmP:hWxyIWRIx+4+Yu7RS/I1vIQG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/emergency/diffs/x-partial-download.xml

SHA256 5faef7a1b801296c027fab39df1f6be4c956da5dd48acc3cf6cd4f4a4df8f2fd
MD5 c1355336f525793dac7130d3a71b8d14
SHA1 9317d1685f1d72c4e851c7d55e2ba0a6037f8392
SHA512 5e52f3922eb2e6550d80598407436933d42131de323243dc673c60ed405f02f1ed246d9269b7afb63cbaec17f32610eda03e8fc7ad91d629e4ab4a9e714f1a92
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/switch/junk/executable/x-authors.xml

SHA256 50f5c3864a93a6d359936020c9261bb42ac518344c0200b34c73606282c98d6e
MD5 16272cf1b89bf80c10b0f0201590b346
SHA1 47594ebd74f2568003a36e377e4ebb77e13c4c19
SHA512 fbdc2e091db1fd3584eade73d0f35a32470cfe4310ced8684f782997e1470671189de73f40d9bdef6d2cd603749579860d46ba61eadf7f8b7e9a9cce23b02766
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/toplist/mode/ads.xml

SHA256 0b450ee92f36bdc37f6cf1d709b5cc980701f759b5c16a06125cec5ba91e25e9
MD5 0708a19066afaa45f6b7e558dbae0965
SHA1 eed040f8a6093bf013cc1af8baadd366706e19dc
SHA512 a469a8ce70ea71e62ac3caabd148fc21849fc6284613dde9cf5a1c7d81114d75cc105fc99a0101d02190bc8ce932be22f4dd133b920a9ceecc41c9c3e393d3d7
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/toplist/mode/wbemDC.dll

IMPHASH 431fe54e2b58562454620aa4a46d0f03
SHA256 697f768d749e5bfe8055997819fc0b088cb7ea2ce31e198b7210fa7dfa1ee597
MD5 a7d437a83378ac8f19797eff1044732b
SHA1 446f1802d1b199779ef8a35daf1c35125e193bd1
SHA512 1349e67e4a68191e05af24242108732abfddfcb9e38427987f8407038e441386a0a004b5a7eb3f5a793691d06bf124f226e749238302bdd6b538605c3e8eec1e
SSDEEP 384:Ht7JZXNm4ZDjaEyaD0eNB1QsubhZKCTVvt9Sj5ko8Zr6DtnWO93GjWz6ctY:HtFRjnaExG1NZKCdSj5Eyt/wW0
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

18414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wbemDC.pdb

ntdll

RtlUnwind

rpcrt4

NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_AddRef CStdStubBuffer_Connect CStdStubBuffer_Disconnect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported CStdStubBuffer_CountRefs CStdStubBuffer_DebugServerQueryInterface CStdStubBuffer_DebugServerRelease

oleaut32

BSTR_UserSize BSTR_UserMarshal BSTR_UserUnmarshal BSTR_UserFree VARIANT_UserSize VARIANT_UserMarshal VARIANT_UserUnmarshal VARIANT_UserFree

kernel32

GetStdHandle GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemInfo VirtualProtect GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA VirtualQuery InterlockedExchange HeapReAlloc VirtualAlloc GetCPInfo GetOEMCP GetACP Sleep GetEnvironmentStringsW GetLastError DisableThreadLibraryCalls GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap ExitProcess GetProcAddress GetModuleHandleA SetHandleCount GetSystemTimeAsFileTime GetFileType GetStartupInfoA GetModuleFileNameA HeapDestroy HeapCreate VirtualFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte

$APPDATA/toplist/mode/x-ole-storage.xml

SHA256 49a71f3a82ae40331dfd5a8b72159d3c38a83a90fc92b80550f5963ccd6b214d
MD5 dd37770c8bf2bdf74b0a3f26048ceca1
SHA1 c486e44ee7a9364dca029a87150347f407f0b822
SHA512 13eccbf982109aba686e58f38308b81024f9b1a3120d4954f8cc4ab82feee48a082f5a832f781f1fa818a84f895e71360ca2324ef67c22d99004d19f53ffd009
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Bortsch

SHA256 fb0c43ea5b29f44aedf038dc5f0dbe25f9678b726cbeb98b7326cb6c54fceaaa
MD5 0a1abca59ff51574b3ce8e0e9778314d
SHA1 c0d93d6c842297c70581a591b6a7809294749f69
SHA512 678acd9c8e999013238054e8bd771bc07f9c226d7d06b57544b6528cd7adee0f7265d16b2fc74a23c9444096a1fd793a94588d7afdfd71d76308a8acc6d25e2f
SSDEEP 6144:gWjMUC9TMG6eoVh8S79bmfNjs2oqCNle/6SDl2wDERssnbmYE7W3DHaq:gWjk3ih8SRqfCYCNleSSDltgCymYE74
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/Conservatory.dll

IMPHASH a63b05ac62bc2e597788846ab2216cc8
SHA256 0a5e2d346b9e7296275bf79fbda56cfc21a8af540b836dba04df1b6270bfe2c3
MD5 255c2887e6b5f9756a9a473952e0807a
SHA1 b13718feb8e932e6a59d76a9984fa043d6f7826b
SHA512 e45ee410d61639ea098c9d8f831126d62cb67144834e6da6bab5c929cc8fe7a92493ef8a0c83c73b19942540318598987214c6b3377d6959425a91d269527823
SSDEEP 768:GTLZ/ZYB0KBLqpnn9rhwmmnTEDi4hvyPTsU9MBacUlT:GTt/ZQ0EM99MJbdMUcUlT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/firms/58.opends60.dll

SHA256 5a744803791a179d144ea1e83372f3068eecea6292651100aa0db958689c079c
MD5 01dd3061171a9a383be2be899cbf339d
SHA1 6c8abae141a83479f08e155057f444bb0a812db0
SHA512 fce3a2c1693651e5031ec73024888983e472e10ff17de7d54daf1c0f52556538353cceb0645e580b6a62dde4433ee32665d4314fcfc44b9e7daac369c6b8a5bb
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/firms/MicrosoftVisualStudioDesignerInterfaces.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e030f6f525673325d2a605d418f6869019e4dfa83809fb367b71538ad796e7b9
MD5 4fca230d88b5afa87caa2428031ebed1
SHA1 4a350e06c30aaf1f7f62a6cd50cb1a7d355f98b2
SHA512 109deca8be8d449845c39ce4f297c547d7375a756cb76a61bcdf768e71d44a6347b474cd2093bb765b1beedf36c60cdcf8041781e05b2143f61e7427108a5772
SSDEEP 192:rAh/YQtAlig3s2vMOlNT7ITIaUWylGYtmW8xfQ0igt7w5iW920TEWX:rOByig8iMOrMTIaUyWqligVw5iW92AEy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/firms/Simple.xml

SHA256 bb8ef5afb8b4ad44c72623a734a6bd6d3aac4be668f6934e2f95d2148b5f2d1e
MD5 69cf5511636f283739bad867fa2a30e0
SHA1 c53b7339f841e07a7e44b9943e9c2c441c18c6c8
SHA512 456719bc3e9c8fb693b9ca55f5555061e32bd07402c43b5c72633fe319cc519629991d2269583a91df4c3f5da94fb9bc5b75f0dad0e20c811fc2fa0d952010dc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/firms/jp2.xml

SHA256 1a38c4be941d1e4b2324215c0adab0c79015096049b1d2fe5dbbbf4778929d8f
MD5 656bb2ade689970602fd1e1ca784e63b
SHA1 68239d9d97e07e7061eca4353403e15171433f78
SHA512 ecbb4ec7f00df0a8ce305f549ee3511d73158fa8a86e33b0ff713832dd77241c806f4b36f886479af1a176f484950946e214ed3bf8272d22ca73132c0c44ff6d
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/firms/model119.xml

SHA256 0104b6cd55054e213a52d4d4a796969fb0fb4361242446355dcfb9b0f1a94c13
MD5 a6131d4f652968f532cf938393c31c69
SHA1 05eefc8e1332ba5ca507b0bd9d182f80a3bb5876
SHA512 4ff5f820f69a4f0a4b1904ed6e60e5f2126614e881981eb7061cf2cb460b517dde43e2e20932985fdb9da1d1a4c98e103461f48577ff557805c21ffc9c12db62
SSDEEP 192:Bl3xsofWULEkO5RlQ4RlQ/9+RlQfRlJ93RlkRlw9+RlnRlQ0JhpRlQjrRlQjYRlC:Bl3QU0DfD5DwDLDkD1DnD/JhpDcrDgY2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/firms/org.gnome.desktop.wm.preferences.gschema.xml

SHA256 c5272f96654233d4e112d5a5fd42be2bfcb7d4cc97878014535a073bee0293c3
MD5 3dee44150a212f519f2d683c0efe4182
SHA1 48b2922e9c6b187543e61335f9fc5d917891460b
SHA512 e1057a26d5dec9c493a0062401ece14440b6af3a71ced2a005570b1cdd0975d38da47ceffc083013d23b862722f9fba126f8d6992d810cc12c8b36e2252522c7
SSDEEP 192:MNPM8bNpCFnGjmHQ0f060O0h030ID1R7jnYEnjNoEcRGGu:4MJGQ0c0S0ID1R7jnYEeu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/firms/yukon.xml

SHA256 cab52e7cfdad75171a75c7fddd5dc444d9c253a1a8e17efded045fcf7961302d
MD5 979500557c7bce26f0aa943330607f44
SHA1 538fc3548c66b835290b3f9580a02b2a70497f09
SHA512 c4f7fc62b9bcb1733151f28404b1be2d0c88a0cbab2219f2e2a08d562dc634e6ad170c89c4e97198355a8c8da26c31509eac92d0c76d7dbb302798e7cef89af9
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/hide/_archive/seo/25.opends60.dll

SHA256 b407fe7ddcc7303ef167873a6498e8ebd771e9b4b432ad0a458a029574ca6afd
MD5 09537416318f379396bddbc18046de39
SHA1 dc6111549ff49afa587425603cc0c545b034b988
SHA512 20b9ab08d3e940d687404436e2d6c8b4c1a9121987382c6253d7d93fc2b556fb8780742af08d8b73e4d50ea9b23d2e62298669650df60ed38e6f23c5c0155619
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/pntables/2.opends60.dll

SHA256 2100320c9cadec08a462bde5a3b09a0707dd023324d83a70246a938babfbc6bf
MD5 01244aa1c226c302338ce0fde142cff3
SHA1 1f468ca01049645911102c4b7303efd583e54950
SHA512 7a6a0bfc368dcb10f4fd9196fb9cc82e209c68b9e353a45f18d927e38b1a9c4bbcae758653098b58519504d4f3abb091c76acbac541c17902aa43e7d772aa5e6
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/pntables/53.opends60.dll

SHA256 567b2d1baa67b9c9281af950dc33ddbcf677bd4873c620445b226698806e6e8e
MD5 0a02a4a310870826d9e92e4a7be4a066
SHA1 bee248910241e48db17aa2733cf16b40ba55fa09
SHA512 1a93db122a230e3b3b1772c0fbee92fcb2a4485dc5f9ae6af696630d7b12896c7f04e8c95e37e1726c37124d83131be36aac9942629874bd8187af6a21498338
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/pntables/AvVsPkDH.dll

IMPHASH a22d4654114f2b83a1b8667cfbbd534c
SHA256 28b451525a9122e07d3925643c432fb5b6625919d2ce172a65f79eae64c3aa9f
MD5 dcb503b44bfe005df85e08a645e7c1e3
SHA1 30e1cf630147d901c792049b1902885b4ffe0af8
SHA512 9bba86c81d55e6bf200a73c1233d806b57f6049aa30d17d5ad0cf6ce32a6e28581148b61c6f6f88c212346fa2d6cbcacabfd88e724ff6ceb40637f719f2e6c5e
SSDEEP 384:UCjkl0Ke5XN3XEUwBxGTKyP5IULV7pTuWECTE9W8S9UkOWKrhmdTXcpddWBK2yW4:UCjGe5dE2KkrxVTPTeFS9UkOWqmdTp
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

14928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AvVsPkDH.pdb

msvcr80

?terminate@@YAXXZ __crt_debugger_hook __clean_type_info_names_internal _onexit _lock __dllonexit _unlock __CppXcptFilter __C_specific_handler _amsg_exit ??3@YAXPEAX@Z _decode_pointer _encoded_null _initterm_e _initterm _malloc_crt _encode_pointer ??2@YAPEAX_K@Z ??_V@YAXPEAX@Z wcsrchr free __CxxFrameHandler3 memcpy ??_U@YAPEAX_K@Z ?_type_info_dtor_internal_method@type_info@@QEAAXXZ memcmp

atl80

ord23 ord61 ord64

kernel32

GetThreadLocale GetLocaleInfoA GetACP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetVersionExA UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter Sleep CloseHandle GetProcAddress SetUnhandledExceptionFilter GetEnvironmentVariableW InitializeCriticalSection GetSystemDirectoryW GetVersionExW GetModuleFileNameW RaiseException GetLastError DisableThreadLibraryCalls DeleteCriticalSection FreeLibrary LoadLibraryExW OpenProcess ReadProcessMemory IsDebuggerPresent

rpcrt4

CStdStubBuffer_AddRef IUnknown_QueryInterface_Proxy NdrOleFree NdrDllGetClassObject NdrDllCanUnloadNow NdrCStdStubBuffer_Release CStdStubBuffer_Connect CStdStubBuffer_Invoke CStdStubBuffer_IsIIDSupported NdrOleAllocate CStdStubBuffer_CountRefs CStdStubBuffer_Disconnect CStdStubBuffer_DebugServerRelease IUnknown_AddRef_Proxy CStdStubBuffer_QueryInterface CStdStubBuffer_DebugServerQueryInterface IUnknown_Release_Proxy

user32

UnregisterClassA

oleaut32

SysFreeString SysAllocString BSTR_UserFree BSTR_UserUnmarshal BSTR_UserMarshal BSTR_UserSize

ole32

CoCreateInstance StringFromGUID2

advapi32

RegDeleteValueW RegFlushKey RegCloseKey RegSetValueExW RegCreateKeyExW

ntdll

memset

Name

.text

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

900B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

314B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/pntables/chunghwapost-zh-TW.xml

SHA256 ef20693ba2ccad6071793cc9e5cb02dec8f1d9fe937f678dbcf899053a5ab061
MD5 0e6da32d8024d69c8125cef3dd20b8ed
SHA1 b4bf6e64a4868cc0cdb01fc81657de9815e6be39
SHA512 1f9cba371d58d9f5f0996943483d00208f4f498dab667d37c3bdd9fb21c04cfd18f7ab9542ef7e3a06712846bbccb495fc9f942bfb08b692a4800b97bd68d5ab
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/pntables/cvtres.exe

IMPHASH acab46bf2f1f805110b896684dbe541f
SHA256 91b2e82a6bc7dff3cd1336caec81d515b7422c39a5ae19d5dc87673239f00430
MD5 d312a154a5f5e54bbbcf12a22b1b2058
SHA1 f8fa4c00c53d6800c81cfb8ff910514f6324ab68
SHA512 d42d9fa8bb383ac0f8643d2e87fc5a1c6b7c4d4bdbfbc5fdd3eb38d69202d2819166b62a069158d8f3c4999edc1591b75a768c90ea2aab76e2bd5bc3d8e4cdf1
SSDEEP 768:IaEu+pIy70T4voc53bxmB3aALsRO7kSDTvKdnGSL3d/o+S:MIa0Ttcl0B31LsRO7kAKdnGSR/ol
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

38:1c:48:34:30:8c:60:87:fe:08:13:c1:23:d2:0c:bf:a8:5f:38:8a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 23, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

5

Entry point

19623

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

cvtres.pdb

msvcr80

_putwch fputws _cputws vfwprintf _vcwprintf _amsg_exit __wgetmainargs _cexit _exit _XcptFilter __winitenv _initterm _initterm_e _configthreadlocale fputwc _adjust_fdiv __p__commode __p__fmode _encode_pointer __set_app_type _unlock __dllonexit _lock _onexit _decode_pointer _except_handler4_common _invoke_watson _controlfp_s _crt_debugger_hook __iob_func fseek ftell fread _fsopen _wfsopen setlocale _wcsicmp _wcsnicmp _wmakepath _wsplitpath _tzset _fcloseall _time64 remove _wremove calloc exit memmove _wfullpath __CxxFrameHandler3 _wcsdup sprintf strncpy _chsize fclose fwrite _splitpath _makepath strncat _ultow memcpy _fileno _get_osfhandle free memset strncat_s atoi strncpy_s _itoa __setusermatherr atol

advapi32

CryptGetHashParam CryptHashData CryptCreateHash CryptAcquireContextA CryptDestroyHash

kernel32

GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter InterlockedCompareExchange Sleep InterlockedExchange FindResourceA LoadResource GetFileType GetConsoleMode SetErrorMode GetVersion GetCPInfo GetSystemTimeAsFileTime GetModuleFileNameA CreateFileMappingA MapViewOfFileEx CloseHandle UnmapViewOfFile GetFileAttributesA GetModuleHandleA GetProcAddress GetSystemDefaultLangID GetConsoleOutputCP GetLocaleInfoA FindFirstFileA FindNextFileA FindClose LoadLibraryExA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter WideCharToMultiByte IsDebuggerPresent

$TEMP/pntables/hangul-keyboard-32.xml

SHA256 58e2afdc429641b7b30495851082d402d103496cd4c95b2a33caca780754206d
MD5 c9c76fa42be15a93760e95ad5d69e078
SHA1 4c83f638110611e26ae4009d07306c773c60e4dc
SHA512 c46e39074547788beb6423b4a350f0ed1f394bb76efcf5df2b7dd36692fa65bb51cf0d6bcec52601783450007281eeb515a4ae7c4f4c307f0d4d254d8f907d90
SSDEEP 96:OeVP0M02d/95VKxrRf5PPlUOBf/FPZODIqJ7tHpRRjfVjtzBvCkNXdSBXxAacp1f:O363L9jHWWIPEnMYV3H
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/pntables/type-apple.xml

SHA256 fa84460561e3c7b4caa584f8f5fda47c070061dced7e8e34418c936a7e66838a
MD5 94406299efa71b566167341c4bfa069a
SHA1 b6aaaff1d3f22ba27c13bbe3e969af6acb4fcea2
SHA512 cba741fc532ec91272bdba41d866e29f5f085a20435eca4eeca6def498777521f6e2d738ada8bd4a694a93bb2de5b6e9bb23361efc9fffed4ff7c40682d330a5
SSDEEP 192:4G8iEx5OVS5NU85FVWguvIuyagDag92hW5YDN0C2oPvkgq1irxTSZSMPDNRJ9:/Ex5OVS5NU85F51CXvkgq1+xTw9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/pntables/vbapkgui.dll

SHA256 f5a2fe02ccc6f5ec0ceedb6dc2cc8bd0b90cd8134511e24d6c81356c0c518b07
MD5 fdc097582165e0b7b1d6dce5d2c176b8
SHA1 00a152f27759c3ec5f5a1414586c8a7be5841384
SHA512 3154714b5a3633c5c0b6e3049a87dad234b9d7dd0f29a641bfa864be10e0262532720b155aa854c875b4687ef4446760431c8ac3b0adf9c5c56ec6b47eecb5fd
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer