9ebd85210f51d18862b5d197e73309f0_JaffaCakes118

resource
9ebd85210f51d18862b5d197e73309f0_JaffaCakes118
unpack001/$APPDATA/yonetici/agent/ht/vcdeployui.dll
unpack001/$PLUGINSDIR/BgImage.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$TEMP/go/pidgen.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7c2c71dfce9a27650634dc8b1ca03bf0
SHA256 b1a522cf1688c79e5148c41caa7ebf9c71f9cb0a87e3d2c3acd4a0e5f9c22705
MD5 9ebd85210f51d18862b5d197e73309f0
SHA1 d2c5cd6181532dbb278a13af5b563feb41fb9fe0
SHA512 6bef4c9c01c706bcf24abb06dfd60929319018374e4e991382df492c206d03d5562a3faa7219c403d0866d227a9bc83f10dffd8b055609127e8833cb68d4d1e0
SSDEEP 6144:JPCganNRhnecKgH4G/ptftDbNZRcZEpK28TqGH+MnY47Z9toVk:Hanjh//XNNZ2ZeqH+8H19to2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13225

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetFileAttributesA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileTime GetFileAttributesA SetCurrentDirectoryA MoveFileA GetFullPathNameA GetShortPathNameA SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA DeleteFileA FindFirstFileA FindNextFileA FindClose SetFilePointer GetPrivateProfileStringA WritePrivateProfileStringA MulDiv MultiByteToWideChar FreeLibrary LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

GetSystemMenu SetClassLongA EnableMenuItem IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard ScreenToClient GetWindowRect GetDlgItem GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx LoadImageA CreateDialogParamA SetTimer SetWindowTextA SetForegroundWindow ShowWindow SetWindowLongA SendMessageTimeoutA FindWindowExA IsWindow AppendMenuA TrackPopupMenu CreatePopupMenu DrawTextA EndPaint DestroyWindow wsprintfA PostQuitMessage

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectA CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$APPDATA/yonetici/agent/ht/ZipExeStub.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 0e1d1b6545d1162c755e0b22c97dfd337dfc64fb8791704a93c84d448b44511f
MD5 69aa866258d8c730bf1feffeabe57fa5
SHA1 b4a895c279b6900e60cb5e90cdd5a6e9b79828af
SHA512 faf62cd96aacf1a94d4e893e4ecad9f494ecc61f548f0b955f3f47405696c6b1ccaac4a3b57dd9a56cbf0db81b64a36c55fce31a983a26be5a66d41c9b1ed5a1
SSDEEP 384:BsJQbkxQ7ECMcxIHe7g6ihJSxUCR1rgCPKabK2t0X5P7DZ+uelWLwWfLCcMe/oTC:BsJQb9Mcxqe7FRJBOtL3d/o+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ac:ab:63:74:01:19:27:a1:88:c0:5e:54:d9:bb:e6:fe:3b:ef:26:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

4

Entry point

25214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\binaries.x86ret\bin\i386\ZipExeStub.pdb

$APPDATA/yonetici/agent/ht/examplept-BR.xml

SHA256 465426b68347854c22fe1129fbe079653b39bc4e14dbc938ef62c9303adac49a
MD5 67b2b584b319746d71699d132656444e
SHA1 7f211ca9c882264a2162d86f91c78d2e018a24ff
SHA512 b7fb2e8e92d1743274a16e133d5bb8d21a85cd50cf692b7708c0c5350699e8e2dc52381cecfef3598bad616c9d017790cfd32f831a4fe8b8b81c89d3aca20af6
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

$APPDATA/yonetici/agent/ht/org.gnome.Software.Plugin.Fwupd.metainfo.xml

SHA256 895859fbd3771e3bc901cbdfb9ee281d1eebd5b02a8b88d25eea6fcc1dd6bd82
MD5 ae6936ff9ff23d51e9b215cffe7fc88a
SHA1 29ce1346146fda02cde6ba6c50841e523c051177
SHA512 23da8bac90ed76c1af5c122cf89ce250d2b24ef144999aa51bc7664a5c9dd983ade27e7b2dd966d768ddd18161f3572d90ae44a17a074b6a8d23399efa8f75bc
SSDEEP 96:xsLjYnaVFk4GABLahaQaPA920BdOn0hxftMooOrgp+92Ce8ayaW8QaYAo:qjmOnEEAB3MUBtLoQ/x8QaYAo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/yonetici/agent/ht/org.gnome.gedit.plugins.pythonconsole.gschema.xml

SHA256 20cc6c2a03bd19d6fd422193956faf50a5c04aefa516934c8d93975a852dd7d4
MD5 1c524cd57ebf3d65d44344df40a73239
SHA1 22107ec69cc374b5bf8f41a368aa518cc7f7a9fb
SHA512 cd31bbcbf11b956d542839c525d22fdda53b23749b5f72cb4abd5cf94c8f9715c4745cce8dbee9f02eabf6b0b0c324f06986c4df8e42fc4c5593c10b17f0c491
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/yonetici/agent/ht/vcdeployui.dll

SHA256 116d2a7b1c04779dc774f9012dff83f01cc4905bfce0e745c1e6f1b469b445a2
MD5 86e8573da0da08bc5801eeb05722b900
SHA1 9df15367a068e8f16bea5b098c1bc5ab0fe8f816
SHA512 bcb449de7aac0e68802868948344f57d7113eb16209ac8d2b5fd68f387c21998748763e34bc15cfb2ea3d9b09df4379eeac9b7651064a633d09d2ae6befaa724
SSDEEP 96:yOKkWxHSIWPpJG4yQMsn+WT74+olgDS8zlzcWmzIBTCT5o4nzkInvzUiPjP7TPmP:hWxyIWRIx+4+Yu7RS/I1vIQG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$APPDATA/yonetici/agent/ht/vnd.ms-wpl.xml

SHA256 a6243e4f4c8fbe07d685c9362840d1ff3a06a481e7b52f6fe6c0c21eb8399161
MD5 31dc7fa2e2be5066c80c1d08b218f90f
SHA1 fe5b902b5cb4b6354f5b593abeaabf428f8c6bae
SHA512 b224da4bff5b342252b67631a85805aeabd539216ac2ad535ed0ce29cf283f01a84f745868913e68bc32542d6c7693f0167be0e3eed60e181e60c1f270f3dd0a
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/yonetici/agent/ht/xslt+xml.xml

SHA256 2d20ee37cc0fd9998ab968356217bac38260e3acd64c144a233b41109e2759ba
MD5 ca91796da7987807353d4c4ba54d30ea
SHA1 b96da78081f8cd3ea4b2e96c71a06f47552953db
SHA512 bcc0624fd97ed167cab50c986b42a3739073a207c687625c80abadb00c21b15cd28c40661f09b33f152e85abc74fab2d54027abf1cabe0afe76d352e43c57e23
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/BgImage.dll

IMPHASH bdcecc8b26871abb93996c6c18e09c94
SHA256 c1593d641b89c8cf294ce4efeaea5d0a69b095f04947ecdabbef73d3225d3480
MD5 1f56d9c34643cc8033ec8e628df11cfb
SHA1 1231b571a298c16a1f618799fc7d20b72ccb2747
SHA512 a0c80e6f5c4aa6f34b601951033b709944d3522a6faefad11d9d8f1b4398d379d4e5618029c8134204f344e8a71bfff4e19c2d6693f2119ffd05e67dd9148d24
SSDEEP 96:8eU0AKTIfv7QCUsthvNL85s4lk38Eb3CDfvEh8uLzqkfnLiEQjJ3KxkP:tGBfjbUA/85q3wEh8uLm2LpmP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 ac9dfe3b35ea4b8932536ed7406c29a432976b685cc5322f94ef93df920fede7
MD5 0063d48afe5a0cdc02833145667b6641
SHA1 e7eb614805d183ecb1127c62decb1a6be1b4f7a8
SHA512 71cbbcaeb345e09306e368717ea0503fe8df485be2e95200febc61bcd8ba74fb4211cd263c232f148c0123f6c6f2e3fd4ea20bdecc4070f5208c35c6920240f0
SSDEEP 192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10529

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 8d4b1c275fd1cd0782a265080b56d1aec8d1c93edca5ef3b050d1d20d7b61f33
MD5 6e64e5d5f9498058a300b26b8741d9d5
SHA1 837ce28e5e02788da63a7f1d8f20207d2b0bf523
SHA512 f53514d36021d79f85df2494d403f03589b3ad848889b9224f962cc932ef740f127131a914c7171ad8136ca1ef631285ea1c80576db18ccf8ea56940eb00ea1e
SSDEEP 96:oWW4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4P8qndYv0PLE:oWp3ggQF8REskpx8dO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 20bc9f18cbf0b5fccf1f336a3608e7f7
SHA256 49b7477db8dd22f8cf2d41ee2d79ce57797f02e8c7b9e799951a6c710384349a
MD5 293165db1e46070410b4209519e67494
SHA1 777b96a4f74b6c34d43a4e7c7e656757d1c97f01
SHA512 97012139f2da5868fe8731c0b0bcb3cfda29ed10c2e6e2336b504480c9cd9fb8f4728cca23f1e0bd577d75daa542e59f94d1d341f4e8aaeebc7134bf61288c19
SSDEEP 96:4BNbUVOFvfcxEAxxxJzxLp+eELeoMEskzYzeHd0+uoyVeNSsX4:EUVOFvf9ABJFHE+FkEad0PLVeN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Priggery

SHA256 d0f0d9665350e8c9d21556c411ed4c2093c9c5a3883e0450b436f8bd7ad1435f
MD5 9e7fbac0230c2dc55ac3da6b6ab536b9
SHA1 6beb972e9b800c3725ec5598116c241cf5170bc4
SHA512 22ba9ff2e30e2ba873891fde6aa88f2b50727d628418e9266cd47716b2202ba9f003b23d1b8bddf40e33c0b85583cbda0e3d5693293be70e38053f5a3ce0c2a2
SSDEEP 1536:ztPrF3azEPJ1PZBRj1EsLzDa9wkhX4aJgcVqBdiuSt1NMPGeg2I:zZr7xB/EsLi+GdgcVSdiuUHR1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/go/25.opends60.dll

SHA256 b407fe7ddcc7303ef167873a6498e8ebd771e9b4b432ad0a458a029574ca6afd
MD5 09537416318f379396bddbc18046de39
SHA1 dc6111549ff49afa587425603cc0c545b034b988
SHA512 20b9ab08d3e940d687404436e2d6c8b4c1a9121987382c6253d7d93fc2b556fb8780742af08d8b73e4d50ea9b23d2e62298669650df60ed38e6f23c5c0155619
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/go/35.opends60.dll

SHA256 99e399e564c46308a2ec22a427f5338433a820c09ff559c8f6488be9199ed1ad
MD5 b330e04d27f2b76246c9401bb9df8405
SHA1 fea5928cf1704d14ee717bb703c65aedfb194751
SHA512 b07555fa3fb5e11e91583c28922f5a59f09e0cc8244b3bc5e62cfc231cd4a4da080f0653d404ca9a8ab332f61e393ed17235858e84dca0578f8ae51e9b5f30a9
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/go/Aspnetregsql.exe

SHA256 52d0c94b02ead7d72240945cc7c466de5cedafc40fab8ea46b79f39a02e12af6
MD5 56dc8b9e60abf8882887783bd9e324da
SHA1 bf634eead42101c576123d28cb6758addef168e3
SHA512 45d40c5f5c4ef797828ad46f1cc5ad24733917f2f468e2e18be35e21d12cbc453600818833954a4b54ca4213256a8441b8f44d24a01308b978bf1892dd3cfbaa
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/go/gparted.appdata.xml

SHA256 0da50a9b5903266615acafd3c34ae144ebb9862c4ab45b3091f1e91f9342c903
MD5 51af4d35ebd3f7a852179e9d3531a309
SHA1 25c463d5dc3817357f4ca04f9419997a7c00e083
SHA512 bb0513fb659585c4ef78787c9950bad45dd1832a3b8231f0446200ce000318cf09524b0a8effabdeacaf9b330760075523b3acfc3c31333a5fd45b297e8315f7
SSDEEP 384:qa0IlaNfoe+ymtnweWIrQuZBRDTZSb1vubJj8t:QIuA6KweWIrQuKb1vubJj8t
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/go/model112.xml

SHA256 8bb69013f7a47fd076d39ba1bdbbbf6ab5aad573073aa7cf604d3a6edc4a534a
MD5 29280614a435aa5a05a98bc814e418a1
SHA1 123bdddb3b548b9644cd1dbb6a23ec33a0c45055
SHA512 dce99a6b6764f660ec6eb43df386804c02a80d4f7e89b48be240cf03b1394c9bceb8b3f8e2e479035b58ed102655531c72ce82d40f2ea9d1bbd3609d71e0673b
SSDEEP 96:9CCDlg19Zd/s9u3Rn4UrrArCUIEqkCBHqe/5jR45ARN56RP51RlD5tRlJY5rnl:Blgzs9JrCUIEqkOqER/RmRrRlfRlJWl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/go/model41.xml

SHA256 a711c214075a338bdb84b9d6fd2f55ea93ef76c02c3a1d629ff56e1a46b98eba
MD5 b82ec2ef2c386f3b58fa43df2592a8b0
SHA1 93c88cc3fbef0cf62cd0f94725a3d3c56bb61ec8
SHA512 c7c0f4ce5355ee0631de6fd9e64589e8adcc9ced05b3a52258c484f03ec436c24f2ed9d75187e7541c5c903f463f72aab7cb17e3344aa0338778660ac704d940
SSDEEP 96:9CCDlhjMf12RBU8EArCMlEqkCBHq+K5KRDT5KR8/5KRL5vRs5aRa57AR+5NR+:BlhASrCMlEqkOqIRERJRJRdR9R8R+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/go/pidgen.dll

IMPHASH 558dd7f8712ddc8febfb7714c20526e8
SHA256 888f6c10d62ba7470fb457f054769e24a35edb86a3144214113b5a6472b0332f
MD5 d6daa21229600584d00093df481c921f
SHA1 a0848216ed5ddf3945938de79c746ce7424c30aa
SHA512 d0cd6370ee5bb8daad4f07a63bb16554a723ee0959bff447b0b67c41bb3f32404d1ba2eb219679498a55ea63204584f5c2fb2ae466c3d0654fa0e118069b06fa
SSDEEP 768:WGDpZQyMVVIDR4fUB+9RtYknN5EQmlCHhrBPsx1H9xllMGCacV:WGDn4KDOMET97ax1rcV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

6363

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/go/x-font-libgrx.xml

SHA256 1f8adb9d8885dda2e3b4cc3e75fc77e6d7f84a74b1c25709a19558bc43e6cd8b
MD5 ca5b40ed392130b592adf158aebf68ea
SHA1 a8c0dd7fdba8fbed5a5e8c819e6461bc598f2be2
SHA512 d1bb927ef6e306fac2d060f398a5aae621f08fe4e8c4d1a464ba6369449d008c06acc07f24813a40dba112b1981b42cd576d6030a638450fd76937491a3e2cc9
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/gone/documentation/spiderette.xml

SHA256 652eec07d20e5fcb14fdddba8a25136f3188f8eb44cc0dde39a71bd68c6b161c
MD5 f907cc4dd089ae8e4f41102ec0551405
SHA1 65fee33dc1487438ae54e70a85efae8a5abc9b33
SHA512 5b60cf77e3180296b45c48fccc4b1dbdb716481242b32ea3ace0a059f74045dd43254184f1871a5263eb846ec718fbc8a2af59cca25a2983e44512c13b2a5944
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer