a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/Aero.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/Aero.dll	upx

resource
a2e2954e48a33e5b1a33bb0cdcf828e1_JaffaCakes118
unpack001/$PLUGINSDIR/Aero.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$SYSDIR/frapsvid.dll
unpack001/fraps_ru.exe
unpack001/frapslcd.dll
unpack001/frapsvid.dll
unpack001/Óäàëèòü Fraps.exe
unpack003/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Óäàëèòü Fraps.exe	nsis_installer_1
static1/unpack001/Óäàëèòü Fraps.exe	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 9f3f956525cecd7c4fb922f884a0deb3e151b9e23c98f08788939dfe18575dfa
MD5 a2e2954e48a33e5b1a33bb0cdcf828e1
SHA1 500e8724842b3807cd830b8627dd91fa68f9511f
SHA512 995a99187e493338c9931d118e77d9452cf3658e0735e2af68a39657b643d90579df3d72185b08a8932c71e9a0f7b63ecacc369a9046b21d9c4849be51a4d512
SSDEEP 98304:5DnasqRTz7P37Znjk6KOWf6X+ai9/d5ZO7l9e0:ZaXRTzL1nLKqOauTZiV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Aero.dll

SHA256 04a577df50431eb0ff6fb103566402bf66c50415bcc1f8a86b9c235053131455
MD5 243bf44688b131c3171f2827a93e39dc
SHA1 07e9c7bd16ae47953e42c06ae2606de188386f35
SHA512 a1a8c21d38c54a43d1c6c394f481dfbddcb359c617e9928ecca8f84d47354616a78d20735a1fe7bebd21626c21cf96d0e1a69e3e98f6b35f2a774cc0244f9516
SSDEEP 96:Mh1Wh+rTUNfwRtoqLOk+UVud5Wa7U2ZG:MTWh+cZG2qLOkjud5Waw2Z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

35904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 9fdb8f652eae63b05a83bef1860f17111af1a780e6deb11b360f8527c754ad6b
MD5 3bb0a09d3b6eed663024ec8ff84640fb
SHA1 4dc2c3cde2480f164abfbfad9da47ffeeb8646d0
SHA512 3220be67a3dbc71186ca7b5c3767e82020b24b71a7dc289db68ea8246b0c80f9dd2f44818ba532ba9d425e8751560746bc881fe22b1653e4f5956a64f7de59a2
SSDEEP 96:mzEYE1MGsx2mcFigmVTmKySTpMloH0xMjJiLal/oZIU7U2Z:mzl+MIFigmbV+igYl/oZrw2Z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BrandingURL.dll

IMPHASH 135de77644e2add2fd9dd8176740e7e0
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ba33bc98b417a821c596e7653c4cf56a95ecfb7c4f0e7c8f23b4be2c7b3c3ef7
MD5 24614bb78ac927051700a280004a87c6
SHA1 94cd0c53de6dcf3754b4da075db222394b046cf6
SHA512 fe1f945061e108d7ddcc910d3880f24ec18c5bc428bd9079fb40f3eafbd55bf863b95dba6883166e1937373ede657fcf0897237a76c76e07754f320db5515593
SSDEEP 192:eKX9/8eKOj8UPD7OJbQOJG6rF4DU8POVfCYGB:eKX9U3OjxP2NJzrF4g8POtW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 85f492b57362175e72d0c6ccb9069cb81f0928efc8cc619c52fc0d52de80ba49
MD5 32ce97d69b71578c1b6b9fa6d730145d
SHA1 8c2cb331ed73bb6cac51cbcab58f6d25bc486e81
SHA512 629c43ff0da99b3134cfcd3960d8e112d099ac3e8de7a9096f50e6309b43e07d3dd9b6ab7fb768b2f4958c661ab79857a0f46b64ff1214f1c7ad500b2b239241
SSDEEP 768:6EcJ0C1uexJ0TXaN2gAhb56GZ3JmbLzt1Yl85lkgAEEbNPwvv3rDW5jWd:6fRuoN2gUsAI7GglkgcBe3YjWd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/frapsvid.dll

IMPHASH 1d1d5ccfa729de80afc31ec458965001
SHA256 8effbb13e6e74778867fbb1ecd929df9b7335fc4d4f5532fbe7a91da82e6745e
MD5 2a4552b5bacb8f7a6ad00e9ad8b804da
SHA1 fe025c181ff1be4d9b6b81c200ca57026e4a1e11
SHA512 93c5b54ed4785dff6a1802d9454258b8f23b1ea59aebdcfe17a2b3bfd91ce3ff26c3c5d62df6bc5ad699be7f0a7fb6d69819ae81c061b67f7bb348f622bf285b
SSDEEP 1536:GJT5HqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqOFHkgGBh+7nptPrr5kC8wnLk:GJT5Hqqqqqqqqqqqqqqqqqqqqqqqqqqt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

20947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

DefDriverProc

kernel32

HeapFree CreateFileW IsBadReadPtr GetCurrentProcess WaitForSingleObject SetEvent VirtualFree TerminateThread CreateEventA IsProcessorFeaturePresent IsBadWritePtr VirtualAlloc ResetEvent GetModuleFileNameA GetProcessAffinityMask CloseHandle CreateThread GetCurrentThread SetThreadPriority WaitForMultipleObjects HeapSize WriteConsoleW SetStdHandle GetCurrentThreadId DecodePointer GetCommandLineA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetLastError GetProcAddress FlushFileBuffers Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW LeaveCriticalSection EnterCriticalSection SetFilePointer WriteFile GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc LoadLibraryW GetModuleFileNameW RtlUnwind

user32

EnumDisplaySettingsA MessageBoxA

HELP/help_fps.htm

SHA256 b1419a421ea79de26a910c941c72d8eef7f97f42e55c28e8f7df9d31be3a0889
MD5 f335e9e4e8a45c7dcfc30b5b8b61d838
SHA1 cbaa325097d7c203d7c875325a79de76f60e4d3e
SHA512 4f7d27ede6eb61ba7d656d44d1c442e1ac9db016f1278c67afcf6f4674ea3786d1f77f0cef1930f0f07e0db587c11ba79f652916b96b2e1995ed89f27762290b
MD5 SHA1 SHA512

NSIS installer

installer

HELP/help_general.htm

SHA256 731aa299a4024b9574282c12ff9385b6bc972a360d327633259c5bfff7bd8b86
MD5 ca2111dcbc54a05e596894f3b0b3e453
SHA1 4f22bd6da136ed717e06cc7abbb7d4995fbcaa02
SHA512 83a76b771711ef883de7808f0f5e9143614554bb6b82f810e3ffe0b936bb51ebcadd14df725869beed3cfe5dda122f57412a10d114eea79821d84c12c9bbb2cf
MD5 SHA1 SHA512

NSIS installer

installer

HELP/help_movies.htm

SHA256 241da611a040ed0d1b9e51d92eaa7ef7f9821cd1bcbfcbc6759db2babc4d6881
MD5 28ae0688b33354b80e4d29d980d648a3
SHA1 69fa776c403f75ce5961f04f9ac2b25479d6a17b
SHA512 d9e00c72a1bbfbb5376a65fd98335346593765bea0a7c7739d5b927e863ee54cc7a93b397e8c745a48bf9ef51cd9b56228ed0f3f76844298c7779dc5459397be
MD5 SHA1 SHA512

NSIS installer

installer

HELP/help_screenshots.htm

SHA256 b2bebc38395e4678c78af793b1c5ad214a3f832fbe860dedb0d8db36118350fe
MD5 834e553c909b7600700f25fcdfe8046a
SHA1 3d8a844cd24e519f73e6e14c83464ca801188aa5
SHA512 245dce23051e67dc786ef07bb0dcdc2c98bcad859bc4b4bc522a64b72db28a7d0fb657df7b27a7d0f3ab7612a11275ba04307847eb7836917b39d25517221205
MD5 SHA1 SHA512

NSIS installer

installer

fraps.exe

IMPHASH b020d1099840b739d629a15841d97c0f
SHA256 188ad0def854013f007218b20632c76ee3f8a7b1c9fd111aa467c4eafae485c9
MD5 9e45c606cfeb50db4576533b6902ea19
SHA1 5cb8a5194c0aad2901d6b79200a03833534707e3
SHA512 5c322ca96471f8c5a282b5aa3ab28249a6ec2573d23966c52cef6f171b6ae735178c49dffad87d471f0182b37c6ad91df5bd0e27d54491fc6710d0a65d6bb392
SSDEEP 49152:nFkmIdcKiBl3/gl3sMb0CopLi5U7lsu8ERXaiP/rNxB8PevZsr+OqIFwh4l1y:nFZ8cR/YlLb0Ccv7lHRqS/rXmPeOuivy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

95:6f:92:2e:42:10:bf:e6:d8:d7:97:40:38:b6:1d:81:a2:6c:e8:8f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beepa Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=Beepa Pty Ltd,L=Albert Park,ST=Victoria,C=AU

Chains

Jun 12, 2024

Minor OS version

1

Major OS version

5

Entry point

8572928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

fraps32.dll

IMPHASH 0a389bea4f5d171f6ebd9e96cea707fe
SHA256 d972834a5a97fcff4d521f93f36966f9a1710591db98c0b4bf7e4dc383783391
MD5 45920db266fda29a23f73ba8a8a3a13a
SHA1 f0c6d13065fb4cb8f944ce44870414d5a20db93d
SHA512 f600bfc631d8f6f4d8315c48c754b163975dbcc606f49a20f3bc41a7c493fcdd2db40cf018f369ad565915b2af539cf9e0cdbb0f5cca35f700c51de231d69d9c
SSDEEP 3072:sG+tisHDjPxt9ZUKkmjZqZfZ4KaBKuw9x+N7AahfaksCn:sjDb9PkmH9BKB9x+lAnrCn
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

af:c7:b5:5f:33:2c:64:be:28:88:61:a9:55:30:e2:5a:eb:69:a5:07

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beepa Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=Beepa Pty Ltd,L=Albert Park,ST=Victoria,C=AU

Chains

Jun 12, 2024

Minor OS version

1

Major OS version

5

Entry point

159214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualFree VirtualAlloc GetProcAddress GetVersionExA GetSystemDirectoryA GetCurrentProcessId MapViewOfFileEx OpenFileMappingA DisableThreadLibraryCalls GetModuleFileNameA GetSystemInfo CloseHandle UnmapViewOfFile SetEvent WaitForSingleObject CreateMutexA FreeLibrary LoadLibraryA GetModuleHandleA IsBadReadPtr GetCurrentThreadId DecodePointer GetCommandLineA RtlUnwind VirtualQuery EncodePointer IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection HeapAlloc HeapReAlloc LoadLibraryW WriteFile GetModuleFileNameW LCMapStringW MultiByteToWideChar GetStringTypeW HeapSize

user32

CallNextHookEx

gdi32

DeleteObject

fraps64.dat

IMPHASH 6ba5856a359ff4f354bf2b49ba321adb
SHA256 7d5a88574ea4599e5b46d8dad2943c16f65b8e4a6dd1b3f309001fa8c507b4c7
MD5 e820896189493e02a143158c96c939ff
SHA1 41996602cfd5a30e4e152e2299ff4776c998875e
SHA512 94068ff9dcbb2def2380ff73938e71eeb483e6238c51547d1de246313ed142e08d337cb380e777e5a3912abe59fdb824aa3c8f6cf0085a83604ef07bef1f9b45
SSDEEP 1536:V/+/9SftT3jmTtDe6mD7V+dTYJ+HJekbV5jokdJlE:l+/9mtT3jwet9+dsKJTbV5jokHm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

91:89:67:a6:fd:74:94:ee:e8:f9:7c:01:74:2e:80:3c:5d:12:61:6e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beepa Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=Beepa Pty Ltd,L=Albert Park,ST=Victoria,C=AU

Chains

Jun 12, 2024

Minor OS version

2

Major OS version

5

Entry point

12588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FreeLibrary MapViewOfFileEx GetCurrentProcess Sleep GetSystemDirectoryA GetLastError GetProcAddress LoadLibraryA GetModuleFileNameA CreateMutexA GetProcessAffinityMask GetVersionExA CloseHandle OpenFileMappingA UnmapViewOfFile GetModuleHandleA QueryPerformanceCounter FlushFileBuffers CreateFileW HeapSize HeapReAlloc HeapAlloc GetStringTypeW LCMapStringW MultiByteToWideChar WriteConsoleW SetStdHandle SetProcessAffinityMask ExitProcess ReadProcessMemory WriteFile GetCommandLineA GetStartupInfoW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer EncodePointer GetModuleHandleW GetStdHandle GetModuleFileNameW RtlUnwindEx FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc HeapSetInformation GetVersion HeapCreate GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapFree LoadLibraryW

user32

PostQuitMessage SetWindowTextA DestroyWindow CreateDialogParamA TranslateMessage MessageBoxA PeekMessageA SetWindowsHookExA SendMessageTimeoutA DispatchMessageA UnhookWindowsHookEx

advapi32

RegCreateKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

fraps64.dll

IMPHASH 5fe7d1c47f7b1d2a4b9bfc9ce6c2c467
SHA256 8d63ffccbfc9bccc0450dede55b654024404276b460c771dd403b3df88cf7882
MD5 fb03a922bd78fc49107de80177ecc70c
SHA1 b028b562d29166507b1a70dbb9c711e9bedde6a8
SHA512 a2fe650e441a416278817fb78a8557beea8472a6378b616d177b7823f46b85e36bc303471d42dc329e4b201afa0b85c27a5ac4489f252f665ef60780b5e430da
SSDEEP 3072:XoRcIU18Dw4vm7Q9IVESL0TqN23Xm6PvfQ9Txq8heTGp8NQfqq8wr5kBkX:Iw4Okl0zNUQ9TA8heTGp0z4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

NSIS installer

installer

PE Signature issue

Digest

0c:34:a2:3d:c3:65:80:2f:31:1e:17:80:f3:33:d3:ac:01:7b:0d:20

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Beepa Pty Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Development,O=Beepa Pty Ltd,L=Albert Park,ST=Victoria,C=AU

Chains

Jun 12, 2024

Minor OS version

2

Major OS version

5

Entry point

113884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualAlloc IsBadReadPtr GetProcAddress GetVersionExA GetSystemDirectoryA GetCurrentProcessId MapViewOfFileEx OpenFileMappingA DisableThreadLibraryCalls GetModuleFileNameA VirtualFree CloseHandle UnmapViewOfFile SetEvent WaitForSingleObject CreateMutexA FreeLibrary LoadLibraryA GetModuleHandleA GetSystemInfo RtlUnwindEx GetCurrentThreadId FlsSetValue GetCommandLineA EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext DecodePointer TerminateProcess GetCurrentProcess FlsGetValue FlsFree SetLastError GetLastError FlsAlloc HeapFree Sleep GetModuleHandleW ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapSetInformation GetVersion HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection HeapAlloc HeapReAlloc LoadLibraryW WriteFile GetModuleFileNameW LCMapStringW MultiByteToWideChar GetStringTypeW HeapSize

user32

CallNextHookEx

gdi32

DeleteObject

fraps_ru.exe

SHA256 67a3866453826fecbfc9883842490c971b4025d01e82284b516e8b6814b5575c
MD5 5a5c0885cf60d6f6f39c5db45e5e1211
SHA1 563ef5a069d0fcbc13cdb55d64aa7f4ef53689b6
SHA512 c5122e52fa013c0ee37e627288d2572ddfa8283eb80d6c474d158f6b24c10c8af452c53795f1a93f0a177c7ca51e821298422a67ee783219908e4ffe451c1042
SSDEEP 24576:gs+0T0KVhkFCTt8qEos2Z7Sk4DpGoGML99ZNHzYP7DVeuyNiyPytPxYS:9lTt8QR714DpGoPlNTWDQN3yb5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

295644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

.text

Size

283KB

Virtual Size

283KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

43B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

135KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.limage

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

frapslcd.dll

IMPHASH 0e9fc33cbed235c178491e233292dd9c
SHA256 399963d6ed6152c4b83dc62eb78c37ceac6e9979f96595307f1a4423d3a88299
MD5 005a49ba92f6822bc9f46f870fcaf65d
SHA1 070cb6544d2df211ada164da35908e73e9fb6ccc
SHA512 aecff46aa1d78a50ddc1275ff1e8c3243e23f8108cfe61430b844f2e95ae00ca989d5386656a74e9b4a5fb5b04b269474ed1dd8e554366092949cd9d3d34f4cf
SSDEEP 768:EzwRKcY/nfTuenNoD28smW4KjhA+GnTEDIMgvyeE+kbVUi:EzIKc8nfTuo+qJlAEevk+i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

13716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

frapsvid.dll

IMPHASH 1d1d5ccfa729de80afc31ec458965001
SHA256 8effbb13e6e74778867fbb1ecd929df9b7335fc4d4f5532fbe7a91da82e6745e
MD5 2a4552b5bacb8f7a6ad00e9ad8b804da
SHA1 fe025c181ff1be4d9b6b81c200ca57026e4a1e11
SHA512 93c5b54ed4785dff6a1802d9454258b8f23b1ea59aebdcfe17a2b3bfd91ce3ff26c3c5d62df6bc5ad699be7f0a7fb6d69819ae81c061b67f7bb348f622bf285b
SSDEEP 1536:GJT5HqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqOFHkgGBh+7nptPrr5kC8wnLk:GJT5Hqqqqqqqqqqqqqqqqqqqqqqqqqqt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

20947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

DefDriverProc

kernel32

HeapFree CreateFileW IsBadReadPtr GetCurrentProcess WaitForSingleObject SetEvent VirtualFree TerminateThread CreateEventA IsProcessorFeaturePresent IsBadWritePtr VirtualAlloc ResetEvent GetModuleFileNameA GetProcessAffinityMask CloseHandle CreateThread GetCurrentThread SetThreadPriority WaitForMultipleObjects HeapSize WriteConsoleW SetStdHandle GetCurrentThreadId DecodePointer GetCommandLineA TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetLastError GetProcAddress FlushFileBuffers Sleep ExitProcess SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar GetStringTypeW LeaveCriticalSection EnterCriticalSection SetFilePointer WriteFile GetConsoleCP GetConsoleMode HeapAlloc HeapReAlloc LoadLibraryW GetModuleFileNameW RtlUnwind

user32

EnumDisplaySettingsA MessageBoxA

Óäàëèòü Fraps.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 eb00750ef6df626d4850df879a4f920c6eed2ecabd5f86e91988f8f596ea6c23
MD5 399d16305e745034f8c8ff143730898a
SHA1 51549522884792f440e40dbaa4444a12f6119522
SHA512 c2a4a4f8508dde9c7ae9f68a5bef7dc69d68ffabcf5091ff6e2fe13dce7da42787ab01dbca5062d31ead5c86c628c9098332078f1885a52c8e108ba4218fde52
SSDEEP 3072:HQIURTXJ+9uekWqu3nASYc9EOshMntxb2qcpL:Hs4+1u3ASYhObtxbeL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ba33bc98b417a821c596e7653c4cf56a95ecfb7c4f0e7c8f23b4be2c7b3c3ef7
MD5 24614bb78ac927051700a280004a87c6
SHA1 94cd0c53de6dcf3754b4da075db222394b046cf6
SHA512 fe1f945061e108d7ddcc910d3880f24ec18c5bc428bd9079fb40f3eafbd55bf863b95dba6883166e1937373ede657fcf0897237a76c76e07754f320db5515593
SSDEEP 192:eKX9/8eKOj8UPD7OJbQOJG6rF4DU8POVfCYGB:eKX9U3OjxP2NJzrF4g8POtW
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer