a804ece5d512a297f3a16f2752e9722a_JaffaCakes118

resource
unpack001/$PLUGINSDIR/GetVersion.dll
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/balrocks.exe
unpack001/$PLUGINSDIR/blowfish.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/manlib.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsNHTML.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/$PLUGINSDIR/registry.dll
unpack001/$PLUGINSDIR/xml.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/balrocks.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 3ce6061c6ba624ee1cfef7e08127aa8e1287c413ea15a0ce174f830920a9582d
MD5 a804ece5d512a297f3a16f2752e9722a
SHA1 b0918998b1359b138442a6546e8bc22c8c93090d
SHA512 43043d19d8fa47c2b271fe28977eaa43920de6515344e07fee1a565c797e4931f204e833864a9fa5bf72165e64580bc36dedb77d3b8b5180fd1d241cdb028b6a
SSDEEP 24576:ncP9Edni7Ccb4DUZDIIHscLOll8EuTm4Av004bJd5A8f:clwniwAJssOHuTm4Av0LbSU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

bf:f0:4f:17:34:aa:a2:b0:98:68:2f:44:bc:dc:23:d9:83:e3:40:90

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Start Install,O=Start Install,POSTALCODE=95138,STREET=5655 Silver Creek Valley Road,L=San Jose,ST=CA/Santa Clara,C=US

Chains

Sep 20, 2015

CN=Start Install,O=Start Install,POSTALCODE=95138,STREET=5655 Silver Creek Valley Road,L=San Jose,ST=CA/Santa Clara,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Start Install,O=Start Install,POSTALCODE=95138,STREET=5655 Silver Creek Valley Road,L=San Jose,ST=CA/Santa Clara,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Serial Number

01

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=Start Install,O=Start Install,POSTALCODE=95138,STREET=5655 Silver Creek Valley Road,L=San Jose,ST=CA/Santa Clara,C=US

Serial Number

b8:34:31:de:b5:3c:53:9e:34:53:28:d4:7c:b9:e8:82

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 10, 2015 - Feb 10, 2016

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 5, 2015 - Dec 31, 2015

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/BrandingImage.png

SHA256 680e2313fdd39800762a11a9f620494800f63331a2672384800ba2a2699e11ae
MD5 e40a28f47ce552d8514275cb8a178f2f
SHA1 a7026a78d7c953ed6d5b91bb066e5a00f4617aa4
SHA512 00d27f26307c0e4b76962fb1fff79322bf94a428cdaffd487af1521335ce95d733552d2c86d0c0f9f4148c768188edda27de7c2f83a542c522cd80726fa06626
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/GetVersion.dll

IMPHASH 5e41893d1528e7648e03f81030aca366
SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
MD5 5264f7d6d89d1dc04955cfb391798446
SHA1 211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
SHA512 80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
SSDEEP 96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
MD5 b140459077c7c39be4bef249c2f84535
SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/OfferAssets.zip

SHA256 684352934a448121c1b9ad945d252053965e3dd3b78bd698c598b0472f9a7732
MD5 de3673e37a566c1aea4e9aa1a66d9885
SHA1 a2b5c348f07a93f683e3578618f1e639790ba842
SHA512 0830f494ddd8279e38bb9e3cf065f446e1319e3dec65f04f521691f73f5f8e73d686f034381db9e8958498195ceb35d469151934181c18a57d558254f068f88d
SSDEEP 384:ZtQ5325cAH5Qge5eBO7ca5OFchuAxAj6BDmsCAYyB5k/8htDglXcKBfNnVcWFMT:Cm5/ZQGU5go3x6OTjYyIkhtDgl/LvMT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

CompleteScreen.html

SHA256 86221e5206b6ee0c846f586eaacdf6d19525bac0150505cb83d5ec58b35426b0
MD5 4df926b8c628348262ced5501069c7bd
SHA1 a799813dab4e28e616bb379cc8c5a689df4aa273
SHA512 59c92b41223f730b020b868e752af86d0cfe9ecc09e9946c787f451d47fe99a1df36263a1060cff7a6a31ebf3239099e5df2924783d583b31547c34d618304c1
SSDEEP 192:SI1yaybWZ6QodpdCYv71QXABcBi9ikkiniNizowQvSwQj4It:SI11ybrhl1uABcBi9iviniNizr
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

InstallScreen.html

SHA256 4d86b36c86907b34e7631f2ea28c6306a851604caa4deed99409f616a11c44ae
MD5 eeae93190e02e53c256d99c34947c498
SHA1 3ce43fbf28a287159762294430cf3c6a01fb7071
SHA512 9d43190765d5ad20399f6cc6f4dbfdadfcba39b6e32ecbf3c329520a72377729859641588d83e5904c43e737d773486f502bf6c3932cd11f553e0b9d1c1207c0
SSDEEP 192:SI1yaybwZ6QodpdCYv71QX2Bmfi9ikkiniNizowQiwQj4It:SI11yb5hl1u2Bmfi9iviniNizd
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

LoadingBar.gif

SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
SSDEEP 192:p1I+c3Va7frt67FhQ0NFg9iKCqv6/WU5UL8biGeQX9za5ZGXffWuj:3Ipazkn1NFmDCW6/WU6UN9iZGPJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

but1.png

SHA256 104c0f5d980ca4b43cbc9b862a988231326e182ba90ab532dbed8b1674476303
MD5 5fb73730a4037951b3cca46ae1553882
SHA1 d6b4c25a00177963a0a1bff6b8e29711c320eb4c
SHA512 29c39b53bc2625cfc1ba25fff4b09be1bffc0b2c0a4d3b8bb0dcf9775457feea7f17334ae33e9b95f0e79800f7e4de3b7e0b88b70660fb9b4f93a64e4c4e1f4d
SSDEEP 192:VctsikVwM531kX96gFmjafaqbNZ/xtugB7I5aUf8BO7cab:WtQ5325cAH5Qge5eBO7cab
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

start-bullet.jpg

SHA256 6cf68b29ff63c1c635b3419971a0dcc4865a6211921b02c0cb0c00907522b36e
MD5 d7962a5e7c8a83bf7f49c57fdefcb9ba
SHA1 87364940fb47d2bddfba229336da70d92dc77c53
SHA512 4ff68d28917ee503d3e96467e8ec512ac7a8de0a8eef9fb36ca96f78f38af521dd7fd9c66aaf2b3dcd2ae859436bc3447ec90df5fdfb836ef020340fd50ab730
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/SienWelcomeScreen.zip

SHA256 a9b0461bcde5f216e4d5ef68f4622c280d786d21de51c6e8045955a04933d409
MD5 2c56c806464dc5cec00238b4616f5ff8
SHA1 1fd3de032b01152c94114ff6fa1613a6008cce82
SHA512 90a132e33fce631616ca40f14c1d18e55d0e2f13309ea0aeb7f82f883bcc88c1e11c27858292aa153dfca2e93605292c3ac5b069787049bb0d007d609d73b310
SSDEEP 6144:GzCrimgNPNUmekzc6epzFZvL1vmFFHlHjeejVqy6aQfnPtzS:6ygNiG4DBZvL1vgDnjcFPPtzS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

InstallPrompt.html

SHA256 97038d10082353fcc1924004430f36ca8ecd74fe7a67bf4fc6ae3f4c290fac0f
MD5 6e9714d235aae2e8f7102ea2b89ff74b
SHA1 0df7a08ada3a5bd082264fd2ade7d8c478aff5cc
SHA512 9c23660cfd9957b829a70b13191b9486f4636791407cec35040d2c286340a71a316641a7244a1ea9e94c50561ec54396174cb0126fcfc31d1f938d9b4fdd47ad
SSDEEP 96:SI1lZUYEd43JOdf9oPKjcjtA6jmxj8bbbqPK/EltTYW:SI1zLJSfVu/jIj8bbbqPK/EltTYW
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

InstallScreen.html

SHA256 625ae4f37090e8c5fe0515a51a4bcb4fd2e8388498527ebcd42ceac7c2d4d414
MD5 5b2947b18f290f032e7836531097bd3e
SHA1 a4110cea705a5f836f1d76d5cfe5d4f0f923c933
SHA512 9d61ac5806a46ab4e4f4bddc72179c3ebacec185987c83f7d891d46a6168a6d4e76487a0d6c251087194e08aa25d0d75861e02cb9115752b249250b37ab9956b
SSDEEP 96:SI1lZUYEd43JOdf9oPKjcjtA6jmxjebbbqPK/EltTYW:SI1zLJSfVu/jIjebbbqPK/EltTYW
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

WelcomeScreen.html

SHA256 59d23122b2adc2e656145dbccfba45dfca33fc3db9fb9a42fe26a4d02f5901fe
MD5 1f4bfdf66d6903dbb746134e91f26bef
SHA1 fce29730b54c9d1c681f09b0b5b0f88bd4d8eb73
SHA512 3ee71af8a2a54d5b0522d880b0767dd84017f65d667d1bcc2dcffe20eb3d214e002310f5ecaaf6021e3c4a711a887719b921e129cf50bb4b15d5e0950ac03d6a
SSDEEP 96:SI1lZUYEd43JOdf9oPKjcjtA6jmdjiQXbbbqPK/EltTYW:SI1zLJSfVu/jCj9XbbbqPK/EltTYW
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

res/layout.css

SHA256 fc413b9752f431468d1d0828985af788d5d5b52c5658e30b98b42cfc63b06dc3
MD5 245bb66f632325ee98488163092bd1c1
SHA1 834e11deb29f97577a95b13fdac966c4829a8d75
SHA512 5f5b959c551ae424e1121f886175043b77782467ae40c1937707b4c0b479d84a959e182650f2c4e7adb770938641be7049cccf626ebd3d9a46d82f9084875502
MD5 SHA1 SHA512

NSIS installer

installer

w_images/Thumbs.db

SHA256 3b76581e4798243bb4a4c272cd116ad70885dba6c561bf8407eb9c2ee1063643
MD5 58fa99e956ce49120610347dd91f5266
SHA1 97a15416b30637e4bccf3099aaddebb72ffc056d
SHA512 74dd1d16219ae1e7e80d40a53b8dfc44d1a6ac7ffe29eb53857c61fd2b68eb38606dc10845957ae6afcdc3208883cc37ebfe73ec8256b5c5758e256fede92a44
SSDEEP 1536:VHo/H/otHxM/NodsTi5owiQxowzLroNIzaYaU0rJoPt9LPozYkesozz5Yqobj0MS:1oHo/kNoX5oOoe/oqa2kJollPoUkesoR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/VLC-media-player-icon.png

SHA256 504e35b049b190dcef73f0c3c680aab8491035fba3763d376db5b3ae5f732bdf
MD5 130f51fc14ae4a7b8cc9e97134d765d3
SHA1 cb70c5da25693a26d53535e5022815e63e51959d
SHA512 828b55c1bc4c35113f3ec07cb6667e0728e951457980fb29dcc82a61b3966975efb79e276dab47b466ab4ed26135965bb705dd57d355e1a946bafad25316cd7f
MD5 SHA1 SHA512

NSIS installer

installer

w_images/accept.gif

SHA256 2fe2342fe4aef73fdec166f0a438e86d91efe86f812f0ab071c04fa9afc566d4
MD5 d286a8baa41e8acc9e0ce0a22b61972c
SHA1 70a12886f4e7411094baa3a868a54824b79bbc04
SHA512 81d5f23fa38c2055e451a66f32e55f6581b38276c5ed180a8ec00b0f76ce96b1ecee06d40270154085abf15fad2dfea7b531afc90c3205712b34ed797639f619
MD5 SHA1 SHA512

NSIS installer

installer

w_images/bg (3).gif

SHA256 96a6eb20eaec55791c7b505b427cba6b3b02f3e78278a47b48deb11ad3c79025
MD5 fc8f0fcf97c3397fea82fa4a5f6ce167
SHA1 6cf515e5d57a8c451e42b5bd80a74a6ba7eece7e
SHA512 6d347d7c82f44902406e06d2faacf63a379ac8460c8008e47380529be5f3aa0978c5478180e6c3d90de8a5c94dbb0abd0d070a477cbf1ecfe3d2f104ee0877a4
SSDEEP 768:kAxhVH1ERbElnzjVxBdIlOplSF9yOjBKZe:nnCbInv7PRWjZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/bg - Copy.gif

SHA256 18cdd25dde1cfcfdc5b39335abb7931e2e03ae7d76d8cd1ddff9aa8768f97c1d
MD5 c49bf263cef40820c56318dd88d7f5fa
SHA1 da48c50ae65bd5e742068e656a5f9532227cb5fa
SHA512 fb2ce6b2d018b27082904c4e18d77be702c3c73b60a11e7ef8b631994a6854c32785cbacfb52b266ceba72ab54f63b5680fd3758854f9f9f7a733c22b46f8200
SSDEEP 768:kAdGlP/Ltq/liBdK7DqxWPJA4q8LXx5Th3WPOcc99LdjoPRcfzMLslQ17d:ndGlP/L0/liBdgDqx8hjHNGPrMLyR1Xv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/bg.gif

SHA256 8291dfb3193d915aa6f57b1fafb4a423e5687f872903e4f422165e149f72f6f5
MD5 0c57c50ffc0abfc81fa3e86437a34b15
SHA1 7a139b9e640deaf1b789c727ad9ddc66ebb86f4a
SHA512 588d89e627368c56ad6358f7a86fd9ec7aeae8f406982a70bc5936869b3a01ced76bf9f3fb01a225efdfdf02e70bf02c6d6d40b527cfa56e6c8cf83d2f30fb05
SSDEEP 384:wbtsXEYnJvBWUSHU9VkB7W+f/a8/tyv3L5jTEhY02j:weXLJQXuOyia8/tk75HSYhj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/bg1 - Copy.gif

SHA256 1fc4025b3f0c97afbbbd8fe9560d14916c8ad83ea2631f2c0a39e46d2d248bb7
MD5 e9a7590facea4fb68ffd099290ff29a7
SHA1 c3f918cb32dc90ba90205569b3570923511418ca
SHA512 afc9aa64d64d78a82d847bdd6ae6f1010fb6b27e676cc27a800f9665045c1de4a6e4882dce63ce0b5badbeb07ef7c9d6a21dd50ddf3d07cb3152e3e5422c06b5
SSDEEP 1536:Hyi7KnXUh3tlSz2MgE+MHVF1lih78OuZP7m3lhUn73:SmKXUBtlPMn+az1liR8OqDa2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/bg1(1).gif

SHA256 045827eb714cd392105fd2a1494dcb16b1b992138bdc93eb07a46b92073c28dc
MD5 7a931750de96651466d4d677020b7cab
SHA1 641e07bbb0e2cb37ba01067f8208108ac2bf1cdb
SHA512 4cd071b7cd18d7a6d411da2f81cb6ae836471ce366ef2af8104266be431368737f860933933da4c6c7870e9ce740cb0050453820ae6c4119e24b6eb868ad4796
SSDEEP 384:w7KYOmmw6yP1TXMMTbKK+7nnfkZodKJ8tHEAvgw:4JmNy9rVbKXf5kbhw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/bg1.gif

SHA256 4ad8c185ceed51d93e3a9d310f6814751a68995754f02767109a236fb57460e2
MD5 956b4b691abb8711de7a4b2f84ef318e
SHA1 d95cb2a056a56953bf520dea5715c2a2f05418b4
SHA512 e677766f0ffe4c2d3da1c653b8809519768e298e4f75a41b08e11297501db69523a1b5bfb8d5b1c34d5c0f9efecc62c52444d21ca64c68fb1355ebaf3ad93744
SSDEEP 768:CrwOtk4S89womlZG9jvwNwEGtHzvdvhLW4u6/UimHZb4MIz+z:CntVS897mlZGpo6EATlvhS4u6/BmHZb9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/cancel.gif

SHA256 1bed685338ed03372615b8fdf809712f2564eafe6443998acf86bc14b11f6ad9
MD5 05091cc03e027e33f33032e6f534b3c4
SHA1 f39c36d20f063b4b50dd557d8f228c0818504155
SHA512 860d478b07a27e01b9d7154ca329b59eb1afdf3f5702816fc49b5f02b1d3c68385a6d991aaf1797c725a74c221daaaf7c094c7e9a6255810df2198f9fea88eaf
MD5 SHA1 SHA512

NSIS installer

installer

w_images/chrome.png

SHA256 020760a7871256b4e388b5217f5d610ed85e5064f8f89410526c9dbe288cccbe
MD5 5336a031c5d8f528aacc75541db85ffe
SHA1 fda30905a2dc6fdb82d0de277a24dcc2597fa9f5
SHA512 a9a64fbe6a31caa7621ea47a275e9e8afdcb4a503c4cb50354c3ef92e02f0e0e6a972cdba29824f925c9cfaa96482a3800e654119a9b8d285bab41f24dd69248
SSDEEP 96:T/2CziQ/fsJsq+p3VKTVXKNgXcFvLsfPzT4vsJqHL:TTPq+p3IxNXcFvLsDT4EJQL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/close.gif

SHA256 c5c6cbb883d8788dac059f1ff504eb005e8b5777f05ad7d65064c13c0a8390b0
MD5 39d41753d8f42eaf213b6fbc4ed0bcf3
SHA1 f6ed6fd65a3f41262974a50f1010fdc357f70d05
SHA512 71c69b225f17ead1b86832466d73117c806ab3f29af39f156cf33d76939d63a00af39121523fe9bc882281dce92be5866a3a725d5e709f4bda0708c86161ba06
MD5 SHA1 SHA512

NSIS installer

installer

w_images/decline.jpg

SHA256 74cf250b5b935ab332d5869bcd951ec3eaa5e84eab8c2e13f7c74189846c826d
MD5 648c90ff6d40ff07cc75e0796a1b27f3
SHA1 48b06b638dd121c0db9ee72a62d5351ef078ee00
SHA512 7c3ac0771111d79f436f38a282b827cc59ecae5ed4f0cfcbd3216f162488667d39b6b58765174a8ba36292bb3ee4e97323c1325f47bea6835c3d70dfa43bb535
MD5 SHA1 SHA512

NSIS installer

installer

w_images/finish.gif

SHA256 064953f78f7c942fa643b97fe469cc9c4d9aafd151a4d36622f2afb737086239
MD5 ca9b7a5a3606d8c875632083e811ef4e
SHA1 3763d6aa17de758037e178b1d0fd3fdeb7798c5f
SHA512 cf4c2e66e3b371c18f761473afcfd5000f6331fcde634ad1b33b21bbfb9f98e1ca385603b3904d4b74fcc2acd2e6556348cc3a3a1f1693fc71fdfbbcc6910d23
MD5 SHA1 SHA512

NSIS installer

installer

w_images/headicon.png

SHA256 e53623ea29a6f8bd90f13a06e383f822d1265d68359e5fef1a2a2065f9988a90
MD5 17f64491f3d9f6f36d66e3f08440b3e7
SHA1 ba48be52b5e85c997c8add711907ad521b3b33a6
SHA512 2a0fb97208de5f13b295c4705c21fd81f0bdfcc80465b3f1257cc3b34f393ca28cc20499953902cc7f597ba9b49af02bb09640d10b0b7f7f1189cc39a45b47aa
MD5 SHA1 SHA512

NSIS installer

installer

w_images/iconCheck.png

SHA256 a09413d94779f47174f548e0984957d91cf117f0f5d55ad02bb7a4b0fb2f7bee
MD5 28e31060097f72cb62b5d06201d70917
SHA1 5beb0a5db6ec12720199c990cae41d95ae80d910
SHA512 cfcdd27af4b8ee5bbc224575b70ed874990c0072373cd0269a262f7b63e07c97f283827035eb92b160e530f9cfd28f07ebaa04dd33e7b6660e3ed30b19f808a9
MD5 SHA1 SHA512

NSIS installer

installer

w_images/installNow.gif

SHA256 79a096c33b4818a40269ebc473c0ac7990c2176d784a552ec01df1a51e7adb4e
MD5 2931898a3e82f7216d995398a165bcd8
SHA1 81c2ccd306e593cac8ea595d7c7dff6aa9a57705
SHA512 ea179ea26e014844096e02a470b423407c1db47e1802b37b043ec85df2c95250a398f79557f3e75b539ec709dada99fba141f41c8842fd5e5df4ca9d5b7b5242
MD5 SHA1 SHA512

NSIS installer

installer

w_images/installOpen.gif

SHA256 865bc3bacf2f2a3473b75173d41877df16e8d3f5f4b302f7c46b61c50ceec49f
MD5 d8e651a455a702cbd6e3cb3b84022439
SHA1 276e630b16bed41cfa386b305b963fd49f0be3bc
SHA512 3cadfb2f1d8ef73a91370d1621e284bbd0cfe5da7ebf16fafd1ede0b224e9aff74a9f8d508d8b322aaab96d3f4a4afbf94549edf4112bef3ce43ca1a8831958c
MD5 SHA1 SHA512

NSIS installer

installer

w_images/later.gif

SHA256 c08be4914cac664f14c5e615397066d7f2f876dfb49963b77998291ec99a3070
MD5 e9ed68549a81f2d6ce5c03b1077b6ce2
SHA1 c447ac3f84330421d6ead70889276763a870f418
SHA512 d8f1cf7e83635921a8e3a1b9753bc0f5c0a2df9a2f4c6fdcb2ec19727d0eb8ffaf6dd3bf1859015dd58fb3a5cbdca8be00b5394139516aeb02946fb1518f290e
MD5 SHA1 SHA512

NSIS installer

installer

w_images/loading.gif

SHA256 4e97fa6fee5a4c50af8d7a81b31cb8a61152376539b1db1509c69545ef480f4d
MD5 a7d92aa1ed6f3495a72ed395c021587d
SHA1 deb39cab7618001b08cbe14f44ac00c0c6fca4f7
SHA512 48a1c5136bcc553c9b4f80722145c9728618b12fe306b29f71d7f07029a2c625622b5fc272ac7f1159a75125d3b9e20ab11f22f433b49d2ad7d45fb5ffcd8238
SSDEEP 96:XBWb2i9hkc8pZGJkWGmfKdZZDupb4xo0GlvZEVGxzwgJaR5UhIr:K29vSmWGmf66pb4x2ZqqvJa/UCr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/next.gif

SHA256 de3581ac91671992dda5ea379cc8cb99ab57ff0e1c0b40be4998ff42a01e7675
MD5 89c1ab2e3ee8210e1ae8d452079b716b
SHA1 26e65cd9315376cd430d8346f88005f20aeb149b
SHA512 59375f15753c966b7c1946da915dbc9a8cc49314e36c1d14fb5dc071f92e3a8da7d57fc6a3442c9dfbcfc7bf23ac6349d809e35996c607729666576008c84708
MD5 SHA1 SHA512

NSIS installer

installer

w_images/nextStep.gif

SHA256 38838277998817df58b6ed3148648855b5295393e0ecda33b759e6158e182343
MD5 1cabb358806e29df0cefd351666edfb3
SHA1 113bed46c6e0c43f7c17ae6aa2caacf1ac699df5
SHA512 212c859ef439bf3c661c36cb3988792570d2d9349db980d2b0c475ef2fcf5b7374e036445f131550e9ced7ca5a0e7971b4abcf40eee1b3c0b666d78da4c267c8
MD5 SHA1 SHA512

NSIS installer

installer

w_images/nextStepGrey.gif

SHA256 1429363715b3d4177005fb6066cba535cfc64ed108d10e97dea56e6b94fc6b12
MD5 3a0e3a5a52e24ddd4372c2425b1b2217
SHA1 b8119a4eb67fd665fbd5441f9c8fc511c222bfce
SHA512 2b8290b40dfa97afd18b178ba126ab89cc22f67a71f5bd383c94a7ee74cdaf0606083487843e5da986a649b964b3899a128c7a34b82e065819a2f56778e7c607
MD5 SHA1 SHA512

NSIS installer

installer

w_images/nextstep.png

SHA256 becbd0685763463e5b1e0e631fac2f57d8a813cfae8f5d06d57024ed859653a4
MD5 a5d01386d338ff3ac0f1fcb870312f92
SHA1 22a81dc01244fa747f38ee0258687ee8f8cf8d1c
SHA512 e9c7a2b143b66b0136f017e4a320c7caab8b5667588bc643b704fae98e1512fda3e7cc432da18ca8ed8bcb510cdf45ba95422576180ff1821c8ba21cd546d708
SSDEEP 96:U25eUOfhma3UqQJ7BHhLFEpeXBvc8eXmxp6iTJG+FA7+bo8GRiZsEzyspyP:9Ihma3U1RVheav4Gptk+A+08YieEOWc
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

w_images/progress.gif

SHA256 5f8470cb1a71349b290c4a4eef900a0fa1211e9519948aced9e9c809b52ca6be
MD5 2e624b39cd6b8d76f1197ffe965ee4f4
SHA1 0841846f05ed3ee4290cbf0422d362e3ce4fa1c0
SHA512 ba50ed1485d3f9c6a1e7e96421413c92e3610c34ff1508f44e6a9b5bb063fd766c52e00ee4433d7a41c4d3e01a99d68cf1b15abd12ac6b9fcc2a19b4f7c6ae51
MD5 SHA1 SHA512

NSIS installer

installer

w_images/progressPause.gif

SHA256 7fb708783127383577ee633d0ced5c0e787462e78613a858ab715ba6481bda41
MD5 3e22f9b475ec67a490c997fb64bd6967
SHA1 acc89b0d497bdc92572f1d1d2513536dbeda6d67
SHA512 bb9249b6f7fe6f12668824d6e79d485c9ca7f053f4a449265fe4bd7355468cf80bcc910554ba3f41030a37b602e70f6267df790b2cf70e8f57bab3e948a6a209
MD5 SHA1 SHA512

NSIS installer

installer

w_images/progressPlay.gif

SHA256 c229fabc4d49b48c2806118b283588e7f05e479000fcce2d544391e3bf42cb9d
MD5 8d902c371373e8f822480673677cf01f
SHA1 844b0bf0e9927d5f89c61c959a5664146bb90a67
SHA512 26b24f6a296cdccda050a2b482923b3593289253b64cfc7514beb0ecdf95a62e952fbc444ce99129a716af9744c7c33e5e8fcf0c316cb77d21261a92baac8607
MD5 SHA1 SHA512

NSIS installer

installer

w_images/special_offer_bar.png

SHA256 b19da0f85068d630188245a02fc73c0de589ff4e9a6b117a432432b51cd832b8
MD5 81b5ebe45529f07e0b4767ffdfa0dab1
SHA1 06ffcfaa8b03041f2097cb49fa4eb6020eea22ea
SHA512 76d7cfcf42eb540737739f6e4c646128cda5f17e0695d99ce6892e823dc704e55613d38b486b965e45e9eb8f70da125bbe8a91210cbad47983c9983e71d612d2
MD5 SHA1 SHA512

NSIS installer

installer

w_images/winrar.png

SHA256 e079ffea5382b34b687e0f80fc99dfcb9e05ab97ee15d612ee0957d959174fea
MD5 630d1cf848f5cacba2076453ed677001
SHA1 b42ba2d493cde6a5b6e955a1df65e66997236bec
SHA512 2f5b3b3e5eed95b888407e76f1d1c28f2f9125df7af1078b678e244f6854c4f2f5a729d266acce34ccb81292cb4742a1f776a626c82301a3f4c812ec50fe4eb2
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/balrocks.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 f5584a7fdeaf5b005d48f956b00602c6ca53784341282f6e8235d4c26fe6a26a
MD5 05ab0f3de92a6afcf2f81b80e31ebd3b
SHA1 ccad0063e6cef6604c35ea17f57bf1d94c01a8eb
SHA512 7480060f7e70f3a1e7b8f49959a187f2974169d9db96fef72589c3cacae8e69e743c29b91b5521e0ca79dee9d0e832fb18d3a39a0a34711ea74c12104f4a7daf
SSDEEP 3072:pY4FizYxCDRXJePxUxhp8OiHMgtzXHoL5MIW665A8W1x3EAvf+4DBiRx:pFJ0s5Uxhp85t5q2pd5A8W1ZEx6iP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/checked.jpg

SHA256 ddece3e8f7f73fb3a8649e59fa633307b607b496427a8fc3ee3bd70ca9c1394e
MD5 ebe8df5f4c8efc6d4c73266eacecf2dd
SHA1 9d9c6ba9b3bf3175bdbe068582fefca374b1b1ce
SHA512 ac32a0b183739b4c065efa1f639b3673caaad16e32e4f55bebc35dac86df009ea64816fbb9e64e0a7ffdbec69da4c9bc32f4b38c822daeae36ed1898dc90250c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/loading.gif

SHA256 476a7b1085cc64de1c0eb74a6776fa8385d57eb18774f199df83fc4d7bbcc24e
MD5 57ca1a2085d82f0574e3ef740b9a5ead
SHA1 2974f4bf37231205a256f2648189a461e74869c0
SHA512 2d50b9095d06ffd15eeeccf0eb438026ca8d09ba57141fed87a60edd2384e2139320fb5539144a2f16de885c49b0919a93690974f32b73654debca01d9d7d55c
SSDEEP 192:p1I+c3Va7frt67FhQ0NFg9iKCqv6/WU5UL8biGeQX9za5ZGXffWuj:3Ipazkn1NFmDCW6/WU6UN9iZGPJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/loading.html

SHA256 cf7c0a8543725a0d29e29b36273b64256b6d0e574a04ede6396f51d74aa0c25b
MD5 aba9d87b34bfc10cae08bc6af020afcc
SHA1 41972139244c88348873d4504038a1d17c1d986a
SHA512 704f14877104dd085db5e41fab81637f890dedb59527b6297e93c706797d2e44428663edfaa3c4ace513aa62c3e08484a6362c24438905feafcde4546e458a7c
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

$PLUGINSDIR/manlib.dll

IMPHASH 0cf8afbb6d069ff90746d30f6e78cadf
SHA256 5d39bdd81b123645e3f7cc1006deae96dbaaabe71946e235897a50fbb314e125
MD5 94ba775c8a1f4d6c9bb1966eddce22b5
SHA1 4ed1946ecfb758cc0f68aa452401b37454a107d7
SHA512 5f42ac7bd636ed372d4bc8d0c140007e2123cbf82effcacd388d67aedaef54110f9a01463d293016c2487de9f2725cefdc6f4e59e78c1bd6fb3f379e721c6e6e
SSDEEP 384:TVYyb6btb0e4JNvPuzsVAAah1vrmCBeGznQf58bt0Ac9khYLMkIX0+GGxky8oOwb:TVYybKhg2snCBPnQfCb/Ow
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18817

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

memset _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul _mbsstr _mbschr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsNHTML.dll

IMPHASH bad5a3a74473070303198a079b8c8e78
SHA256 ec84a8421ca1fd52674a56567a765429145091cb54e2f403f4f67609ec3f1558
MD5 84fa49e195b4aae7306d5db390460f09
SHA1 ffdd8ae60ac68845666822a4e7a4947716c53373
SHA512 c19afeb8b899a9cf170fec6ea04cdbbcf517960f1076b35a6bdac0efd405ed5ed619198c6f03b971cec0a8508579ef3a6a1faf10bb5a3bc4e4ccd43643111361
SSDEEP 768:YQY2zS952oBE3Ki+b+2RyxwyL1Aws5yMktpQ69ZT4XPA3Lu:NYvaoeKi+izwyL/yyMktpQfXPgq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

EnterCriticalSection FlushInstructionCache GetCurrentProcess InterlockedIncrement InterlockedDecrement lstrcmpA LeaveCriticalSection GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte lstrlenW MultiByteToWideChar InitializeCriticalSection GetCurrentThreadId lstrlenA GetProcessHeap HeapAlloc HeapFree lstrcpyA GlobalFree DeleteCriticalSection

user32

CreateAcceleratorTableA ReleaseCapture GetDC InvalidateRect InvalidateRgn RegisterClassExA LoadCursorA GetClassInfoExA RegisterWindowMessageA SetWindowTextA GetWindowTextA GetWindowTextLengthA wsprintfA ReleaseDC GetFocus IsChild GetDesktopWindow SetFocus DefWindowProcA GetSysColor CreateWindowExA GetDlgItem CreateDialogParamA SendMessageA SetWindowLongA GetClientRect SetCapture GetWindowLongA PostMessageA CallWindowProcA DestroyWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA GetParent GetClassNameA RedrawWindow IsWindow SetWindowPos BeginPaint FillRect GetWindow EndPaint UpdateWindow ShowWindow GetWindowRect MapWindowPoints MoveWindow

gdi32

GetDeviceCaps GetStockObject GetObjectA CreateSolidBrush DeleteObject CreateCompatibleBitmap CreateCompatibleDC SelectObject BitBlt DeleteDC

ole32

CreateStreamOnHGlobal OleLockRunning CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoCreateInstance CLSIDFromString OleInitialize OleUninitialize CLSIDFromProgID

oleaut32

DispCallFunc SysStringLen LoadRegTypeLi SysAllocString VariantClear SysFreeString SysAllocStringLen OleCreateFontIndirect

wininet

InternetAttemptConnect

msvcrt

_mbscmp __CxxFrameHandler ??2@YAPAXI@Z ??3@YAXPAX@Z memcpy memcmp wcslen _except_handler3 ?terminate@@YAXXZ free _initterm malloc _adjust_fdiv

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/unchecked.jpg

SHA256 b470b1c9ebf4cc00089ac7d1d1d4c049061ce620edcb134516015640a9dbf4bf
MD5 5b9b77eee69668a5bc4efb3a93f77b1d
SHA1 fc59b513a7f5818c23ba2aa43d9df9b1fff0d56c
SHA512 9abb0868eef71647b0ff48ecee5aea7f0ee928868f555d699f022a88378df254321f82245cdf0197c97912a59f8302b12ba3b8ff7600601d436978b39cb42558
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/xml.dll

IMPHASH b5ed5b3a951d4443ce56e5453702d536
SHA256 e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
MD5 42df1fbaa87567adf2b4050805a1a545
SHA1 b892a6efbb39b7144248e0c0d79e53da474a9373
SHA512 4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d
SSDEEP 1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

60879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer