Kraken_v1[.]5[.]exe

resource
Kraken_v1.5.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Kraken_v1.5/Kraken.exe
unpack001/Kraken_v1.5/dll/7z.dll
unpack001/Kraken_v1.5/dll/BCrypt.Net-Next.dll
unpack001/Kraken_v1.5/dll/DotNetZip.dll
unpack001/Kraken_v1.5/dll/SevenZipSharp.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Kraken_v1.5.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 e92d56612dc90ee84e96acb77d7b9183d8a16843ee0c401cc685442b95780c78
MD5 f9fe1fe3ec50ded5f77234bb40d926a1
SHA1 8492bd22bbc5b2b5f34e92a2207262f3d1d36443
SHA512 8b30c3b0ede129ddbf1335c1da6e522fa198cf6144eedfd18f3f3879a0f9ff60acf10ea8f537be0f7fb06d32fbf9c86ae18bebe6fa90f3ea644a1343adf9b430
SSDEEP 24576:dR1gStZ1uiTyqjAGqdKoOb8U6TRstNfkd:dfgqZQi/AhVwaetNfkd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
SSDEEP 192:yPtkiQJr7V9r3Ftr87NfwXQ6whlgi62V7i77blbTc4DI:N7Vxr8IgLgi3sVc4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 4c9e804ce1a391f8e603b7b9c732a6529c1e81be4d12f125c8562ea9d49095c2
MD5 583c38fb0f5af5fe584d9a9b01d6a3e7
SHA1 84dedf7064bb740614f8661793f429f5ee950d86
SHA512 298dac48f75b5d597474fe22e9d69782629c02ebc855f4df91d470edac47ccfb8fe407a1a504fa4a5c94c523c6f03b7b755105b852f25a12d778f2a42313143b
SSDEEP 192:Tg1E8f7JvEeXUUZn7ZkZ85leVlN0sfCm8:Tg1E87ZEYn7Zl4zNhO
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 a7b2f12e01cbea88d4f645f797f2ca6107d76ae13cd1be6dc532b759bfe0d925
MD5 9e4cd80a60db6947642677bf31a10906
SHA1 feedc432df18b13ffba2b7478347d885861701fa
SHA512 a02ae76b7a5df03a149a0b9c9efd314b8646b829b930233d0cea8b619b21720b383f92be95838310e7f1c4183d256823a96e48866b65ac7d2141ed4254ae471a
SSDEEP 384:0b5ZBhNII36iwq7VzVpaHsA2vxM+5GVTfoeydiszl:2XR360JzVpaHsAI75GRfovcs5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH ebc2d915841be8afc8fa1ee9f6850960
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037
SSDEEP 96:o3W4JlD3c151V1gQoE8cxM2DjDf3GEst+Nt+jvcx4K8qndYv0PLE:o3p3ggQF8REskpxZdO0PLE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Kraken_v1.5/Kraken.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 3c9660524b7579b5d93455727bab4339f55705a5dea3652ff14c757194fb8306
MD5 0992f76d80edfdd3817a64f8b7f76f2b
SHA1 a3c655ae31218b54e5996b3cc33a9970670f65c1
SHA512 a2e0660006e3e811dbbba82751081df661134cbc2403018d53c32b0fb35710b1863a00fc134eeb6df6e7ce832ce1f1e660246ccbb8b3b35aaf7e7d3c9b3a5f69
SSDEEP 1536:rqIxYs3cwu+DyGsCLhDkuIRA/IqYUHtI/t0Bn:rqMvu+DyGsCLleRA/IqDHtW0Bn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

58454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Nick\source\repos\Kraken\KRAKEN\obj\x86\Release\Kraken.pdb

Kraken_v1.5/dll/7z.dll

IMPHASH 622eae4411b119bf4ca7bee4fa1391c8
SHA256 db2897eeea65401ee1bd8feeebd0dbae8867a27ff4575f12b0b8a613444a5ef7
MD5 e7ae42ea24cff97bdead0c560ef2add1
SHA1 866f380a62622ab1b6c7705ddc116635e6e3cc86
SHA512 a4a27b2be70e9102d95ee319ec365b0dc434d4e8cd25589ce8a75b73bbe4f06b071caa907c7a61387b2ce6a35a70873593564499b88598f77a7c25c47448fb0a
SSDEEP 24576:ax6t04DSc9S0B07sjsPEtd+F5zrtV53SePrnvgwPWrlahtN:axBOp1B07sjsPEtd2znPrnIwuh0N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

848787

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocStringByteLen SysAllocStringLen SysAllocString SysFreeString SysStringLen VariantCopy VariantClear

user32

CharPrevExA CharUpperW

msvcrt

_adjust_fdiv _initterm _onexit __dllonexit ?terminate@@YAXXZ ??1type_info@@UAE@XZ _except_handler3 _beginthreadex strchr strcat strcpy memset realloc free malloc strlen wcscmp strcmp strstr _CxxThrowException memmove memcpy memcmp _purecall __CxxFrameHandler

kernel32

CreateDirectoryW InitializeCriticalSection ReleaseSemaphore CreateSemaphoreW ResetEvent SetEvent CreateEventW WaitForSingleObject InterlockedIncrement VirtualFree VirtualAlloc LoadLibraryW FreeLibrary QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection GetVersionExW LocalFileTimeToFileTime WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime FileTimeToDosDateTime DosDateTimeToFileTime GlobalMemoryStatus GetSystemInfo GetCurrentProcess GetProcessAffinityMask CompareFileTime WriteFile ReadFile GetFileAttributesW GetLastError MultiByteToWideChar WideCharToMultiByte CloseHandle CreateFileW SetFileAttributesW GetProcAddress GetModuleHandleW DeleteFileW SetLastError GetTempPathW GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW GetModuleHandleA

Name

.text

Size

864KB

Virtual Size

863KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

117KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Kraken_v1.5/dll/BCrypt.Net-Next.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a941f7f6e432ec664f1e7aa860d1f092daf67001a4d0512f4c4d32f7ca83c2a9
MD5 33bb61e8873204bad072aef2a1b9b727
SHA1 761f5a96bedcbbb83573996f8f2cb3ae969a825d
SHA512 c938433b3da5c8536510048d04310d2181196cb08a41a109cecbbf9c13cb38416bc9c02f840fdb05479cc0a987ea05eda1187e1b904df431ef27dee8c5a958e4
SSDEEP 384:OaqSXYzhI7ckM2ryrUi//Guy/Z7C8xBFHJJpJgLa0Mp1g:OBSIzhfkCYi/Bk93z9gLa10
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

23886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

BCrypt.Net-Next.pdb

Kraken_v1.5/dll/DotNetZip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aaaf2670c222cb0af424a796c4831af6258ee40da29ea81d9fc7e2fcb171f345
MD5 f292d363754984c8fbc921fa2b5e2700
SHA1 7a855f57741d91c12aef038aa4f18f259872ff3c
SHA512 be3fc49ef90a60ed6418f66a4a1196c56e97fad7519e9b0fde7d3c47711370a2b85b89ff496f896b3086744052c92f5baa31255c2db5e5a81fbc3bcc827b0041
SSDEEP 6144:BuCITwatNH6B1vHTSpbIeCHz927IWYgGtSV41kJDsTDD3sAJe6dwxLV/z:J/aOaIdHo72S4csfsqe6qfz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

452614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\dotnetzip-semverd\src\Zip\obj\Release\DotNetZip.pdb

Kraken_v1.5/dll/SevenZipSharp.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 49284b31f28d0a62d797cfcf17f464c8c2b22b29d0e8ab7c15c94724d83e595c
MD5 05c9849856abc683bcbc5c8d7921c146
SHA1 ad8ec49116b026eee2dd04d6434ede7ddce9734d
SHA512 c0bfb5d987fe06eba3a7b0f0c73e24cc74935a8d1efd8a79d64b36c56d498532e453049715fb8c1509eda50a0a2f1213ce67d1edaf6bfcb200e0be58af67ea5e
SSDEEP 3072:auMYWaB5+DBS4+aYX/PzJiXyjdZXUtd6uEhd/yZcvdUCG:auMYD7gJY1iXyjb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

156446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\Misc\7zip\CS\SevenZipSharp\SevenZip\obj\Release\SevenZipSharp.pdb

Kraken_v1.5/dll/Unrar.dll

IMPHASH 327af171c73523da5a912080c2fb8cfc
SHA256 ae7806bdb88085133901b967b6ce967d9f1bb8278d2e4f11bee6e92d76162afe
MD5 28187b4dc4981b13dc6cd59def43c04d
SHA1 80ec8ccf11a78a68f8ae8cca50b70511e03b1f25
SHA512 50e771b4fb7206cb2abc26528036b06ab4f5eff1a5a32040eb1ec84c5cf031151301193630f602d3f14a3565f600ba311cbe2c3f0968896e1a82da7e21fda163
SSDEEP 6144:HZ7eJnH7MNsxMihb57FmmNduXdIl3hUoBXA:5yuyhcwgXyljBXA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

1a:be:0e:15:05:9c:a7:4b:34:89:47:99:de:07:bf:fb:ff:47:b8:45:35:0d:9b:47:0c:26:88:9e:a7:fc:48:49

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Chains

Feb 21, 2019

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

1b:0d:1a:64:87:e0:f3:5a:46:50:c5:0e:26:bd:37:23:93:e0:4d:80

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Chains

Feb 21, 2019

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Serial Number

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 2, 2017 - Jun 1, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=win.rar GmbH,O=win.rar GmbH,POSTALCODE=10117,STREET=Marienstrasse 12,L=Berlin,ST=Berlin,C=DE

Serial Number

52:9e:3f:9f:cf:7d:58:d5:20:d6:07:ab:74:39:50:02

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 2, 2017 - Jun 1, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

1

Major OS version

5

Entry point

143163

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Projects\WinRAR\rar\build\unrardll32\Release\UnRAR.pdb

kernel32

RemoveDirectoryW CreateFileW DeleteFileW CreateHardLinkW GetShortPathNameW GetLongPathNameW MoveFileW WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer SetFileAttributesW GetFileAttributesW FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetFullPathNameW FoldStringW FreeLibrary GetProcAddress GetCurrentProcessId SetThreadPriority SetThreadExecutionState CreateEventW LoadLibraryW CreateDirectoryW GetSystemDirectoryW GetProcessAffinityMask CreateThread InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetEvent ResetEvent ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetSystemTime SystemTimeToTzSpecificLocalTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte CompareStringW WriteConsoleW SetFilePointerEx HeapSize DecodePointer GetConsoleCP GetProcessHeap CloseHandle SetFileTime DeviceIoControl GetCurrentProcess Sleep SetLastError GetLastError AreFileApisANSI GetConsoleMode GetStdHandle GetFileType GetModuleHandleW GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent WaitForSingleObjectEx IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead EncodePointer RtlUnwind RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW InterlockedFlushSList QueryPerformanceFrequency ExitProcess GetModuleHandleExW GetModuleFileNameA HeapFree HeapAlloc HeapReAlloc GetACP GetStringTypeW LCMapStringW SetStdHandle FindFirstFileExA

user32

CharLowerW CharUpperW CharToOemBuffW CharToOemA OemToCharBuffA OemToCharA

advapi32

FreeSid AllocateAndInitializeSid LookupPrivilegeValueW SetFileSecurityW AdjustTokenPrivileges OpenProcessToken CheckTokenMembership

Name

.text

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

228B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Kraken_v1.5/dll/licenses/7z License.txt

SHA256 dd394bc9623782fa6ef167cc5cad19447b01da49543edceedbc7d32342388fa2
MD5 95d8ca3a74ffecbe9eaa7b2f87bb0560
SHA1 57af486bf5526e52e6eec47539e3e82c7078754f
SHA512 8f3e62153c59f5a98e0fd35f74941acf2cf934dd766a97d4fd3b0c3bf54d4154592406b657baf21876ce26a49170defef906d05b9d3281f1bd11038bace35d96
MD5 SHA1 SHA512

NSIS installer

installer

Kraken_v1.5/dll/licenses/BCrypt.NET License.txt

SHA256 667195080140725a0780c0f742c4d4efe4c9ad41c1f695fba778209df2fe8a41
MD5 0d840cd5bc610535fda9431d35cd7fca
SHA1 d257ebbe1c97b4585f165c210f3d2da07467448d
SHA512 63fceea43c9188dd8c00390673b6678eec34c3425381e04045274a7708a579b5df28ee386685efee356cab996019f2da945a90b8f90fa77dbeff910854950982
MD5 SHA1 SHA512

NSIS installer

installer

Kraken_v1.5/dll/licenses/DotNetZip License.txt

SHA256 52039c67ebf34d3d5f22ce51a41c8e6695fbd3df781556bb69f7bad4c7962ced
MD5 8512d711dabdb0f894fa0030d60d5906
SHA1 4de33d319f87221ed9c9d849fe6ba6c97633db6b
SHA512 2656a819644f706dfc3cb9d236511940e0cb349a648a7bdd3eeae0e806c04ccd2691fad84e6e5a9930572e1fc5a8c77dee9fa580bcbab07dc79054dbc4500b25
MD5 SHA1 SHA512

NSIS installer

installer

Kraken_v1.5/dll/licenses/SevenZipSharp License.txt

SHA256 16f6cad09bf36154edbf16785d2990481ce1771e94881f22a232a20fbd5f76a0
MD5 7c87ed584f33074429014623799407e5
SHA1 1437cd354456a6a2a9abb1602b3753af18fffe82
SHA512 5788063dd14d310d4c56bb23ea6fb0d12f5db1eba48c0a8ef2a56fa4d004e05fa34fd837b36ea706701d5a2113482cc0f1c79917873bbf0b6e1335582111e445
SSDEEP 96:9LQQHFoJai1zuoScjqEpBOrYJGrYJktn3u3zuLTg7E1xjlwp:KQHFQzuoScVDOrsGrsQn3u3yPt1Twp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Kraken_v1.5/dll/licenses/Unrar License.txt

SHA256 9ddb490181a96cba3480fa45fd6edb5c7ef63a393aa804d71d92d231075c8abe
MD5 f77ab42034b9a62ef4c5281ce2017ebe
SHA1 6d48f2d97aa62f6e4464627e966f2141c27145db
SHA512 7bfb773f204cfd6fdc7955ede47a1d779dd796479cf85c542986733139215c39ac687e89cfaebcdce5e53ecb3c29594644680d2e228e958b18288ba5d78351ce
MD5 SHA1 SHA512

NSIS installer

installer

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Kraken_v1.5.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Kraken_v1.5/Kraken.exe

mscoree

dotnet

Kraken_v1.5/dll/7z.dll

oleaut32

user32

msvcrt

kernel32

generic

Kraken_v1.5/dll/BCrypt.Net-Next.dll

mscoree

dotnet

Kraken_v1.5/dll/DotNetZip.dll

mscoree

dotnet

Kraken_v1.5/dll/SevenZipSharp.dll

mscoree

dotnet

Kraken_v1.5/dll/Unrar.dll

kernel32

user32

advapi32

generic

Kraken_v1.5/dll/licenses/7z License.txt

Kraken_v1.5/dll/licenses/BCrypt.NET License.txt

Kraken_v1.5/dll/licenses/DotNetZip License.txt

Kraken_v1.5/dll/licenses/SevenZipSharp License.txt

Kraken_v1.5/dll/licenses/Unrar License.txt