9369094bfe5430d2b41fadecca6cdf39_JaffaCakes118

resource	yara_rule
static1/unpack001/eMule Turbo Accelerator.exe	upx

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/SkinMagic.dll
unpack001/UpdateApp.exe
unpack001/eMule Turbo Accelerator.exe
unpack002/out.upx
unpack001/packet.dll

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 d047f39babae81dbfbde5afee704e1b0d2314159691c8e0cee95dfaa8958e885
MD5 9369094bfe5430d2b41fadecca6cdf39
SHA1 eb71cf48d4fe381bb98efab45770461e2c0f5d93
SHA512 7587d0a3e632cf76ef41fcc7758e91d9d0e08533e4b5f7318787d96122e8be2c78e30e700ca008fa451711f16237736e6876ab52979a22f045509b32e7dd4bf9
SSDEEP 49152:x1BH+WE9cV5Gx5xNnaG2gnVYPa1hS5jkkjxi:LZ+WEE5GCGbnVYyHHkjxi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

5a:27:bc:40:26:d0:9d:5e:44:53:81:5f:75:6a:bb:53:06:ee:30:52

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

Chains

Apr 13, 2018

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

Serial Number

c6:67:10:f8:a0:ab:39:43:95:39:eb:e7:b5:f9:18:6c

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2017 - Nov 8, 2018

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/PW001.exe

IMPHASH e00de6e48b9b06aceb12a81e7bf494c9
SHA256 b65bd44fcbcbe3bd70e1a665dc8f9e8a878c24eb230d0ebf5bf0e1adb017ec01
MD5 4c9ec35033d6049fc2b772d5bd7f063d
SHA1 59fb04eb6a4ea03aa98967683a6bc58be98cd68a
SHA512 720a0d43693cdc5549c204dc352b2d55e65790575cba3f7f35b2a5ee5dce7f1b7c9989c34608d27d335dcc00460a305b500579d7a0959e3419e50af80c099e53
SSDEEP 24576:jG50ZfFK6ln+3Med97Mjn9foX4OoIVRY0dGxsAI02F+02+tsC:jG5UfgQ+/w9fMhGx59Ov
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

5a:87:77:80:c3:cd:2e:2d:72:04:fe:7f:82:9b:26:e4:13:ae:5c:ad

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

Chains

Nov 10, 2017

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Prospera Software\, Inc.,O=Prospera Software\, Inc.,POSTALCODE=30024,STREET=1000 Peachtree Ind Blvd\, Suite 6-189,L=Suwanee,ST=Georgia,C=US

Serial Number

c6:67:10:f8:a0:ab:39:43:95:39:eb:e7:b5:f9:18:6c

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 8, 2017 - Nov 8, 2018

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jan 19, 2010 - Jan 18, 2038

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Minor OS version

0

Major OS version

4

Entry point

84180

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

VariantClear SysAllocString

user32

SendMessageA SetTimer DialogBoxParamW DialogBoxParamA SetWindowLongA GetWindowLongA SetWindowTextW LoadIconA LoadStringW LoadStringA CharUpperW CharUpperA DestroyWindow EndDialog PostMessageA ShowWindow MessageBoxW GetDlgItem KillTimer SetWindowTextA

shell32

ShellExecuteExA

kernel32

GetCurrentDirectoryA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InterlockedIncrement InterlockedDecrement GetProcAddress GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr GetFileType SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapSize GetCurrentProcess TerminateProcess IsBadWritePtr HeapCreate HeapDestroy GetEnvironmentVariableA SetUnhandledExceptionFilter TlsAlloc ExitProcess GetVersion GetCommandLineA GetStartupInfoA GetModuleHandleA WaitForSingleObject CloseHandle CreateProcessA GetCommandLineW GetVersionExA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte GetLastError LoadLibraryA GetModuleFileNameW GetModuleFileNameA LocalFree FormatMessageW FormatMessageA SetFileTime CreateFileW SetLastError SetFileAttributesW SetFileAttributesA RemoveDirectoryW RemoveDirectoryA CreateDirectoryW CreateDirectoryA DeleteFileW DeleteFileA GetFullPathNameW GetFullPathNameA SetCurrentDirectoryW SetCurrentDirectoryA GetCurrentDirectoryW GetTempPathW GetTempPathA GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW FindFirstFileA FindNextFileW FindNextFileA CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetStdHandle WaitForMultipleObjects Sleep VirtualAlloc VirtualFree CreateEventA SetEvent ResetEvent InitializeCriticalSection RtlUnwind RaiseException HeapAlloc HeapFree HeapReAlloc CreateThread TlsSetValue TlsGetValue ExitThread

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 11cd6df8cede073a0e00bd840833dd26
SHA256 4f26394c93f1acb315c42c351983dafc7f094b2d05db6d7a1ba7dcb39a3a599e
MD5 1fc1fbb2c7a14b7901fc9abbd6dbef10
SHA1 4d9ed86f31075a3d3f674ff78f39c190a4098126
SHA512 76d8ff7fc301cc5ff966ad8be17f0f3f2d869ef797c5a2c55a062305c02133a842906448741bf9818ec369bbb2932b9a9c2193ebc59835b50e8703db0090fdb2
SSDEEP 384:ya3Bj/GAqvdXP4P4IVlht8zNHxKNSJvor9e9dQTIHzOZwceyeZwd6TJdpq:yRtqLhtqKNS5sAvQTIB86T0
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12556

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetErrorDlg HttpQueryInfoW HttpEndRequestW HttpSendRequestExW HttpSendRequestW HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW InternetCrackUrlW

comctl32

ord17

kernel32

GlobalAlloc WideCharToMultiByte MultiByteToWideChar LoadLibraryW lstrlenW lstrlenA lstrcatW lstrcpyW lstrcmpiW GlobalFree MulDiv LocalFree LocalAlloc GetProcAddress GetModuleHandleW GetTickCount TerminateThread CreateThread SleepEx lstrcmpW lstrcpynW CreateFileA CreateFileW DeleteFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextW SendDlgItemMessageW SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextW GetWindowTextW GetClientRect GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW GetParent FindWindowExW LoadIconW IsDialogMessageW SystemParametersInfoW GetDlgItem wsprintfA wsprintfW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW IsWindow DestroyWindow ShowWindow SetWindowPos IsWindowVisible CreateDialogParamW

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

SkinMagic.dll

IMPHASH 73311293c21223a65c49aac91966fa84
SHA256 886c9d39ace6e0d914cd97a1a1233be51c4a201c22f6cc4861e7c0d90ac895ef
MD5 59e53588f0a12d54bf1b0b24182d098f
SHA1 857f40508d08dfbeb26afc46601cad32fe1414b7
SHA512 4cf12296de0273cf715cc3f9997ca97afff2cbb58327b62735100e33f38068444aa90a99b77d756990a816a57ce5bc5a040e1db9c2e5944b01e4a3211574f049
SSDEEP 12288:jTKUXiZ222S+P01CDDnrUyRo2d8x3Ti+CBis9T:ViZeNP0ofrUyR58x3FCis9T
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5965

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetEnvironmentVariableA lstrcpynA CompareStringA lstrcmpiA CompareStringW GetLocaleInfoW GetTimeZoneInformation LockResource LoadResource lstrcmpA lstrlenA GetTempFileNameA GetTempPathA FreeLibrary GetProcessHeap GlobalUnlock SizeofResource FindResourceA GetTickCount CreateEventA CloseHandle SetEvent WaitForSingleObject CreateThread EnumSystemLocalesA GetUserDefaultLCID GetSystemInfo GetCurrentProcessId VirtualQuery WriteProcessMemory VirtualProtect FlushInstructionCache GetWindowsDirectoryA DeleteFileA RaiseException HeapSize ReadFile SetFilePointer SetUnhandledExceptionFilter FlushFileBuffers IsBadReadPtr IsBadCodePtr SetStdHandle CreateFileA CreateFileW SetConsoleCtrlHandler SetEndOfFile InterlockedExchange ExitProcess GetVersion GetCommandLineA lstrcpyA GetModuleHandleA GetLocaleInfoA IsValidCodePage IsValidLocale Sleep InterlockedIncrement InterlockedDecrement GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA MultiByteToWideChar RtlUnwind LoadLibraryA IsBadWritePtr HeapReAlloc VirtualAlloc GetOEMCP GetACP GetCPInfo UnhandledExceptionFilter HeapAlloc FatalAppExitA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapFree WriteFile GetProcAddress HeapDestroy VirtualFree HeapCreate GetEnvironmentStrings GetEnvironmentVariableA GetEnvironmentStringsW FreeEnvironmentStringsA WideCharToMultiByte FreeEnvironmentStringsW GetStartupInfoA GetModuleFileNameA DeleteCriticalSection SetHandleCount GetFileType GetStdHandle TlsGetValue GetCurrentThread GetLastError TlsAlloc SetLastError TlsFree GetCurrentProcess TlsSetValue GetCurrentThreadId MulDiv TerminateProcess GetSystemTime GlobalLock GlobalAlloc GetVersionExA

user32

GetIconInfo DrawIconEx GetClassLongA InflateRect EnableScrollBar GetScrollInfo GetScrollPos GetScrollRange SetScrollInfo SetScrollPos SetScrollRange ShowScrollBar EnableMenuItem GetSystemMenu GetCursor SetWindowLongA CharUpperBuffA IsWindowEnabled LoadStringA CallWindowProcA CallWindowProcW IsWindowUnicode SetWindowLongW GetWindowLongW DrawFrameControl DestroyIcon GetDC DrawStateA SetFocus GetFocus EnableWindow SetRect GetWindowWord DrawIcon ValidateRect GetSubMenu GetMenuItemID EqualRect IsMenu DrawMenuBar CharLowerA CharUpperA DestroyCursor LoadImageA SetCursor CopyIcon CopyRect MapWindowPoints GetMessagePos GetCapture DrawTextExA CreateIconIndirect GetMenuItemCount CreatePopupMenu InsertMenuItemA EnumChildWindows GetMenuItemInfoA LockWindowUpdate ScreenToClient IsWindowVisible GetCursorPos DestroyMenu ReleaseCapture DestroyWindow DrawEdge FillRect BeginPaint EndPaint ClientToScreen PtInRect KillTimer InvalidateRect SetForegroundWindow SetTimer UpdateWindow UnregisterClassA LoadCursorA RegisterClassExA CreateWindowExA GetKeyState CopyAcceleratorTableA GetMenu IsRectEmpty GetWindowInfo GetWindow IsZoomed MoveWindow ShowWindow PostMessageA ReleaseDC GetWindowDC GetClientRect GetWindowTextA DrawTextA SetWindowRgn SetWindowPos RemovePropA SetPropA RedrawWindow DefWindowProcA GetSysColorBrush GetSysColor GetMessageA DispatchMessageA IsWindow UnhookWindowsHookEx SetWindowsHookExA GetParent GetWindowLongA GetActiveWindow GetClassNameA GetPropA GetMenuState GetDesktopWindow SetCapture SendMessageA CallNextHookEx OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetSystemMetrics SetMenu

gdi32

GetDCOrgEx GetClipBox SetTextColor SetBkMode CombineRgn CreateFontIndirectA OffsetRgn CreateRectRgnIndirect CreateRectRgn GetStockObject CreateSolidBrush BitBlt ExtCreateRegion GetRegionData GetTextExtentPointA GetDIBits CreateICA DeleteDC SetBkColor CreateBitmap GetObjectA SelectPalette GetDeviceCaps RealizePalette CreateCompatibleDC StretchBlt CreateCompatibleBitmap RestoreDC SaveDC Polygon CreateDIBitmap CreateDIBSection SetDIBitsToDevice SetStretchBltMode ExtSelectClipRgn RectVisible StretchDIBits PtInRegion ExcludeClipRect GetPixel SetPixel LineTo MoveToEx Rectangle CreatePen SelectClipRgn GetClipRgn TextOutA GetTextExtentPoint32A IntersectClipRect GetRgnBox GetTextMetricsA ExtTextOutA UnrealizeObject PatBlt SetBrushOrgEx DeleteObject SelectObject CreatePatternBrush

imagehlp

ImageDirectoryEntryToData

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueA

shell32

ExtractIconExA

comctl32

ImageList_Remove ImageList_GetImageCount ImageList_Destroy ImageList_GetIcon ImageList_Create _TrackMouseEvent ImageList_GetIconSize ImageList_DrawEx ImageList_Draw ImageList_AddMasked

UpdateApp.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3012adea80c90e5fabb0dc794d6bd0bd6a8be1076d2a7381c56af952bc750be5
MD5 dd3f55f51b18813dcadf40b2690bb9fd
SHA1 81699d1641af3e2218350f9d26feefc8c2dcf991
SHA512 a2de0aca5e53dd15a5e69283bce285d5d36f1e5d0af08965437ab90a0e2cc33e9bdf7d3fa79984f47b925cc963a35156bd232b915b987ee3c2785a8d960df40a
SSDEEP 3072:DOtBlrzu2WI0OHzHtBlrzu2WI0OHzumg9ytBlrzu2WI0OHz:Dqnzu2WITnzu2WIc30nzu2WI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

232606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Work\Visual Studio\UpdateApp\UpdateApp\obj\Release\UpdateApp.pdb

eMule Turbo Accelerator.exe

SHA256 91ab8a432935a5408de4289783b4e24e48e2ee4a159ce9250a9b3f1f7af92cc9
MD5 a4ff177f2b932fd66525e80996603331
SHA1 ec24a956dad9f3bf6e8a2a29e735f309ab8203f7
SHA512 29c456d803b655adfd68abb26e6facd7ffddca5b54bfe7b86027fddca4331ca78a4b71911ce32be22498903b08025f03c3f79d076bdaa8f3fd3d628b1fb722d9
SSDEEP 6144:LJuNlS9WL/gx7uQNAbIbQMxQFIbm7cTjr5qS9ysYeWw1WGEl5xUBMw7hu:LJuP/oCQA0Zbf5D9yZeWlGgQ7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

1823616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 5ff940cfdcd599b59e6596877f099ec96fbf356037951c9574e55ff5c988987f
MD5 bd06cbc8eb52f93c739554ee24972780
SHA1 db91866374ee59b72611e5c5749c8e2e27a4b8a3
SHA512 597b73ae2093588045cfef28e4cee4a0a3f542ad3640ea232c7fc77402cf54da2a803ff5d2351037da475805e3b0bda5d91238da9b058ac6ae4f0a56a138d35d
SSDEEP 12288:YixnHxwiSyekm8t19BUbbG0qsd4nw7GmaPKWusyhJL7:YOekmCUbbG/w7GmaPun
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

351931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

packet.dll

IMPHASH dc8c0d40b34348cdabb47af1cd619332
SHA256 0b681d867089f44fd9c25a343b94b229b3d9db65d060c6c3767535a31e3eeee4
MD5 c123eb3439ae8ab13a971bb6f0515411
SHA1 3ffa02b544b90433e816136e3bbffad0ca19735c
SHA512 99f91d83d43dd73b6737dbbbf4eebf045d9e6a3f2a690210c67f363fa734d1a60b8b306798950668f80762798f52c7c2cfb65260766bbc5aced65ef306fb7aa7
SSDEEP 768:ZPwRf6Bph61db4Ws71Ti/kZSC2pZplWsv9Q/OpKX:wZGr71TiYSCa4ilKX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12173

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DefineDosDeviceW GetSystemDirectoryW SetLastError GetFileAttributesW CreateFileW ReadFile WaitForSingleObject WriteFile GetLastError DeviceIoControl CreateEventW GlobalLock CloseHandle GlobalAlloc GlobalFree GlobalHandle GlobalUnlock GetCurrentDirectoryW SetEvent VirtualFree TlsFree TlsAlloc HeapAlloc HeapFree InterlockedDecrement InterlockedIncrement GetCommandLineA GetVersion GetModuleHandleA GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate MultiByteToWideChar VirtualAlloc HeapReAlloc InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess RtlUnwind TerminateProcess GetCurrentProcess GetCurrentThreadId TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW LCMapStringA LCMapStringW GetCPInfo GetOEMCP GetACP GetProcAddress LoadLibraryA GetStringTypeA GetStringTypeW

user32

wsprintfW MessageBoxW

advapi32

QueryServiceStatus StartServiceW RegOpenKeyExW OpenSCManagerW OpenServiceW RegCloseKey CreateServiceW CloseServiceHandle ControlService RegEnumKeyW RegQueryValueExW

skin.smf

SHA256 c4b5976257a752409726e4a2cfbcef02cf55046fe48deaaa7aab2145f037918e
MD5 ab63292619ce8e5d50eb84dc130458f8
SHA1 4de80a20ae13a8aa6f4e614da4085fec3e029e58
SHA512 8186da764b7dbbeac3599abc1368e3104935031ddc9ad748fdf06c81c72c06f32d16604e9de5ca2ddd6931c3dcfd211fb1c0104a3f313e40c6bd96d2f3724629
SSDEEP 1536:KzP0qqJuAhoXTd5Fbg387zFNGhCB6hu2mnV+1Ks8CoKX08iO/EtDi1:RqEBoXTd5F82FwhC8hu2mn01fVoJti
MD5 SHA1 SHA512 SSDEEP

uninstall.exe.nsis

SHA256 33553462a16e52ae10c7622c31ad31b0a5ca14f67b54b110f97dd682901237b6
MD5 d216b4db2328d87931252b75566405bd
SHA1 e6b53cf0e8738ffc84d10a33af237e5730fcc7fa
SHA512 8aa55862f18b7d2eab7efe74f1bb57685a0bb7cefd5db370bb1682b036bc086378530ce0914cef1ac354a774177077c8f6092282d04ba5fc39195b621391ced0
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer