05df8d890eb18614a7d206b41453d306_JaffaCakes118

resource
05df8d890eb18614a7d206b41453d306_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/TypeLib.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$R2/NSIS.Library.RegTool.v3.$_2_.exe
unpack001/$SYSDIR/DWSHK80.OCX
unpack001/$SYSDIR/MSVBVM60.DLL
unpack001/$SYSDIR/VB6KO.DLL
unpack001/$SYSDIR/dwsbc80.OCX
unpack001/$SYSDIR/dwshengine80.dll
unpack001/efbbar.dll
unpack001/nnlogon.exe
unpack001/ntmEnd.exe
unpack001/sslaunch.dll
unpack001/uninst.exe
unpack002/$PLUGINSDIR/System.dll
unpack001/urld.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 59c995dd4d2e86e4fb4f34f353fd0b8a23f44a2774599a1e864514d0f74e6ae7
MD5 05df8d890eb18614a7d206b41453d306
SHA1 cc82be272582f757e9322035310921a9cb92a71e
SHA512 5718ece11b633617a3ea351c56e8519340802ced96501e16b1eff6e57a64f94d657f3ab1e493fe9384818619f4a86997db64f20dc3840ab72f07dd44aed365b2
SSDEEP 24576:3Tf2xjlqWR966T2xttTo2RigiBMyWGLETufJLckEY/fudN9GQcCeIRLhlAB2lf:jurqC6u3+yW8EChcC/fkGQwIRLhlKQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TypeLib.dll

IMPHASH eb1a2c7475dd540716bf042f99de49fc
SHA256 75c206fba2ec5d344ca514e6451d8892f939f15e8afc1c132bbc9eca886ed1de
MD5 56abaa41368ddf53d01421760f9d72f4
SHA1 68a4e41d46366e8116bdfeba34d94b628fc6fb45
SHA512 98aaee865ee756f6193fb89f35aaf019953c597f92f0e6d3f4a8ead27d5c09f8ac9d39b547a655f2eb4ce6b8867b4e12a20f43749bce3bc2a5f7e668378649d9
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R0

IMPHASH 2e845afec111d03ab7afda2c15e4dae5
SHA256 1003a84d5e1e35e0873ed0b6ed184e7348480184beeb714ee0e65107edfdbb3e
MD5 3984956c55c48b8822e908df7fe019fd
SHA1 2e68f7b39e9ba71aa673c54ebbad7233218590d9
SHA512 44180b1705b60782a5bb7ff3f371ab55de7c012006e8659a15af03f35dfe15729493083de03047d12898248f5802f2f4f4759eef0dcece4bee92f0153c40172e
SSDEEP 3072:pdNVHMZC51dzABC8e/zTqqfiZIE8+i8nyP2PaxxG9p:phsATqqiZIEHyeizGv
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ee:2b:3b:21:1c:15:f6:7f:0e:2c:8f:ee:56:da:99:fd:fb:39:dc:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Chains

Oct 13, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Serial Number

40:9f:a8:40:e5:fe:40:9e:c5:c4:87:4e:39:4e:b6:50

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 14, 2011 - Mar 15, 2012

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

11216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

CoInternetParseUrl

ole32

CLSIDFromString CLSIDFromProgID CoTaskMemFree

advapi32

RevertToSelf GetUserNameA

kernel32

GetProcAddress GetSystemDirectoryA GetCurrentProcess GetTempPathA RtlMoveMemory GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA CloseHandle lstrlenW

user32

IsWindow GetWindowTextA FindWindowA AttachThreadInput SendMessageTimeoutA SetForegroundWindow GetWindowThreadProcessId IsWindowUnicode GetClassNameA RegisterWindowMessageA BringWindowToTop GetForegroundWindow GetParent

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaAptOffset ord696 __vbaFreeVarList _adj_fdiv_m64 ord512 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaResume __vbaStrCat ord660 __vbaLsetFixstr __vbaSetSystemError ord662 __vbaHresultCheckObj ord557 __vbaLenVar _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord300 ord301 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord304 ord305 ord306 ord520 ord307 ord309 __vbaVarTstLt __vbaRefVarAry _CIsin __vbaErase ord709 ord631 ord632 __vbaNextEachCollObj ord525 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaExitEachColl ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 ord560 __vbaObjVar ord561 DllFunctionCall __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt ord310 __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaStr2Vec __vbaStrUI1 __vbaExceptHandler ord312 ord711 ord313 __vbaPrintFile ord605 ord712 __vbaStrToUnicode __vbaDateStr ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str __vbaFailedFriend ord608 ord716 __vbaFPException __vbaInStrVar ord717 ord319 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaDateVar __vbaI2Var __vbaLsetFixstrFree ord537 ord644 ord645 _CIlog __vbaFileOpen __vbaVarLateMemCallLdRf ord648 __vbaVar2Vec __vbaInStr __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 ord577 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord104 ord610 ord105 __vbaLateMemCall __vbaAryLock ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaVarLateMemCallLd __vbaUnkVar __vbaVarCopy ord616 ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str ord540 __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaStrVarCopy ord650 _allmul ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj

$R2/NSIS.Library.RegTool.v3.$_2_.exe

IMPHASH a56a9c58ddb2b2da8fde66551747ce70
SHA256 13e8d49e4729e2e6f71956770582c1ec2b632068a3cc9eb8fdc7a3428bab151c
MD5 1f694e53532eb452ce7ae7f4523fde76
SHA1 59609431a30f3a01aa07003dd09e9600961fbc2f
SHA512 046334e0ea75227938c706c2fa7a7ca64cc10433eeeb1835a045f5a079beceb1a059e44f348d2f1d6e2797de966c3004f3a9c37b78a1b18c90fb851edeac38f9
SSDEEP 96:GFw199Edyn/3sxi2sS8HVrqbdC9Xh+MClQGZ56:D19CgfsbsS8HVWbd9XlQGZ5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$SYSDIR/DWSHK80.OCX

IMPHASH f978e4fab943d628f5846aafd74b8faa
SHA256 8413fe7000baca9e7a2fdef33922d17d97ef9d16799444b945b3c73fee953c6b
MD5 956041a95acf9738b712c71c55672094
SHA1 84959e2c0b07d631de4f71da32e1c3c301285e68
SHA512 c93085f6e4159e3a75e9167e036214930a3ec3960d5eb3e0812f164a841f60b1c3454bcc7a2227b7d0e80c303db11d322a1e6862d643a614c32e4d6b1798b298
SSDEEP 6144:BE0Jarr0dWt86FKhOO1ITPKFD7Mq0BTv:+0c3mWi6ElKR
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

104385

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dwshengine80

ord303 ord306 ord304 ord3000 ord307 ord217 ord305

kernel32

InterlockedDecrement GetProcAddress GetModuleHandleW GetCurrentThreadId IsDBCSLeadByte SetLastError FreeLibrary LoadLibraryA LoadLibraryExA GetCurrentProcessId lstrcmpA GlobalFree GlobalSize lstrcpyA _lclose lstrcatA WaitForSingleObject ReleaseMutex DebugBreak CreateMutexA MapViewOfFile OpenFileMappingA CreateFileMappingA OpenFile GetVersion IsBadReadPtr FreeResource GetPrivateProfileStringA GetPrivateProfileIntA _lread _lwrite _llseek FileTimeToDosDateTime GetFileTime GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess Sleep MultiByteToWideChar InterlockedIncrement WideCharToMultiByte lstrlenW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError lstrlenA lstrcmpiA SizeofResource LockResource LoadResource FindResourceA FlushInstructionCache GetSystemTimeAsFileTime GetCurrentProcess MulDiv GlobalUnlock GlobalLock GlobalAlloc IsDebuggerPresent GetModuleFileNameA GetModuleHandleA DisableThreadLibraryCalls InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange

user32

SetTimer GetWindowTextLengthA GetWindowTextA SetWindowTextA IsDlgButtonChecked CreateDialogParamA EnableWindow GetDlgItem SetDlgItemInt SendDlgItemMessageA GetDlgItemInt KillTimer DialogBoxParamA DestroyIcon GetParent SetFocus GetAsyncKeyState MapVirtualKeyA IsCharAlphaA RegisterWindowMessageA LoadIconA DrawIconEx SetRectEmpty GetDlgCtrlID EndDialog SetDlgItemTextA LoadStringA UnregisterClassA GetPropA UpdateWindow GetClassNameA IsWindowEnabled EnumWindows GetActiveWindow GetWindowThreadProcessId PostMessageA SendMessageA WinHelpA CreateWindowExA GetFocus IsChild RegisterClassExA InvalidateRect GetKeyState IsWindow DefWindowProcA CallWindowProcA BeginPaint GetClientRect EndPaint IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos LoadCursorA GetClassInfoExA GetDC ReleaseDC GetDialogBaseUnits GetWindowLongA SetWindowLongA DestroyWindow IsDialogMessageA MoveWindow ShowWindow CharNextW UnionRect PtInRect CharNextA wsprintfA MessageBoxA CheckDlgButton CharPrevA

gdi32

CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileA Rectangle DeleteMetaFile SetTextColor GetObjectA CreateRectRgnIndirect DeleteObject GetTextExtentPointA GetTextMetricsA SelectObject CreateFontIndirectA GetDeviceCaps GetStockObject SetTextAlign TextOutA

advapi32

RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegEnumKeyExA

ole32

OleRegGetMiscStatus OleRegGetUserType CreateDataAdviseHolder CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateOleAdviseHolder CoCreateInstance StringFromGUID2 OleLoadFromStream WriteClassStm OleSaveToStream OleRegEnumVerbs

oleaut32

SysAllocString OleCreatePropertyFrame SysAllocStringByteLen LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi VariantChangeType SysAllocStringLen VariantClear VariantInit SysStringByteLen SysStringLen CreateErrorInfo SetErrorInfo SysFreeString

msvcr90

?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __clean_type_info_names_internal __CppXcptFilter _adjust_fdiv ??3@YAXPAX@Z ??_V@YAXPAX@Z strstr memcmp malloc free memcpy_s _CxxThrowException strcpy_s _initterm_e wcsncpy_s strncpy_s strcat_s memset _recalloc sprintf_s _resetstkoflw ??2@YAPAXI@Z __CxxFrameHandler3 ??_U@YAPAXI@Z _purecall strlen memmove atol strcspn memcpy ?terminate@@YAXXZ _except_handler4_common _unlock _encode_pointer _lock _onexit _decode_pointer _malloc_crt _encoded_null _initterm calloc __dllonexit _amsg_exit

$SYSDIR/MSVBVM60.DLL

IMPHASH ce5958d8adf86078d58c0c6f95621ee9
SHA256 0202ddcf449dc8a0b4c56e786222da56c23c97bdc721d751fb169881df2626fe
MD5 88ef14f379e050e8df3ba9a9462945e9
SHA1 b965d2bd4e3528d7b76ad465ae2c75a83507cf4e
SHA512 5efe90bd5ad79b833f94ce51a4b6fafbe26e09497ecbefff03bff7a8d9d2d4c4dbd30c74ac445e53cbce183fd992176226a3408cbbb677c6e69ba10d1b6f683c
SSDEEP 24576:CnsZfH8WK6FuXqt5K8whx12tnqIVB62ezzV8d/v3HTYTcfzBRKdfg6:Cim7x12tnq+62ezzVK3HTYoai6
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6904

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

GetTimeZoneInformation CreateThread ExitThread FlushFileBuffers CreateDirectoryA RemoveDirectoryA MoveFileA LockFile UnlockFile TerminateProcess SetEnvironmentVariableA GetCPInfo GetACP GetOEMCP SetHandleCount GetStdHandle FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetStdHandle GetStringTypeW RaiseException LCMapStringW GetStringTypeA GetModuleFileNameW GetUserDefaultLangID GetComputerNameA SetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime SetFileTime GetLocalTime SetLocalTime RtlUnwind OpenFile CreateProcessW IsValidCodePage FormatMessageW GetStartupInfoA UnhandledExceptionFilter ExitProcess SetCurrentDirectoryA GetStringTypeExA GetVolumeInformationA FindFirstFileA FindNextFileA FindClose VirtualFree GetSystemInfo VirtualAlloc VirtualProtect FlushInstructionCache FindResourceExA GetShortPathNameA WinExec lstrlenW lstrcpyW WriteFile SetEndOfFile SetFilePointer GetSystemTime SystemTimeToFileTime WaitForMultipleObjects ReleaseMutex CreateMutexA GetCurrentProcess DuplicateHandle ResumeThread GetCommandLineA TlsSetValue TlsFree TlsAlloc GetVersion CompareStringW lstrcmpiW MulDiv CreateProcessA GetExitCodeProcess LoadLibraryExA WaitForSingleObject ResetEvent SetEvent CreateEventA GetTickCount GetEnvironmentVariableA FreeResource GetSystemDefaultLCID GetPrivateProfileIntA IsBadCodePtr GetUserDefaultLCID GetSystemDirectoryA LoadLibraryA GetProcAddress Sleep GlobalDeleteAtom HeapDestroy SetErrorMode GlobalAddAtomA ReleaseSemaphore LCMapStringA CreateSemaphoreA VirtualQuery GetCurrentProcessId MultiByteToWideChar GetProfileStringA WideCharToMultiByte HeapReAlloc GetDriveTypeA CompareStringA GetFileAttributesA GetCurrentDirectoryA GetModuleFileNameA SetLastError GetFullPathNameA SearchPathA GetFileType GlobalUnlock GlobalFree FindResourceA LoadResource SizeofResource GlobalAlloc GlobalSize GlobalHandle GlobalReAlloc GlobalLock _lwrite _lread LockResource GetTempPathA GetTempFileNameA lstrcpynA _lclose _llseek FreeLibrary GetLocaleInfoA lstrcmpiA GetLastError GetModuleHandleA GetSystemDefaultLangID FormatMessageA HeapCreate GetWindowsDirectoryA GetPrivateProfileStringA lstrcatA CreateFileA ReadFile CloseHandle LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement IsDBCSLeadByte IsBadReadPtr TlsGetValue lstrcpyA DeleteFileA lstrcmpA GetCurrentThreadId GetVersionExA HeapAlloc HeapFree HeapSize lstrlenA

user32

DdeClientTransaction DdeAbandonTransaction DdeGetData DdeGetLastError DdeCreateDataHandle DdeCmpStringHandles SetCursorPos EnumClipboardFormats DestroyCursor GetAsyncKeyState WaitForInputIdle GetForegroundWindow VkKeyScanW SetWindowsHookExW keybd_event CharUpperBuffW CharUpperBuffA CharLowerBuffW FindWindowW FindWindowA SetActiveWindow GetClassInfoExA LoadIconA LoadImageA RegisterClassExA FrameRect CreateDialogParamA IsDialogMessageA EnableMenuItem ShowCursor OemToCharA CharToOemBuffA GetWindowTextA EndDialog DrawTextA SendDlgItemMessageA SetDlgItemTextA GetWindowPlacement GetSystemMetrics LoadBitmapA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects WaitMessage PostQuitMessage UnhookWindowsHookEx RegisterClipboardFormatA CreateCursor CreateIcon PostMessageW PeekMessageW EnumWindows EnumChildWindows GetPropA RemovePropA SetPropA SetForegroundWindow ClipCursor CallWindowProcA DefFrameProcA GetKeyState GetDlgItem IsWindow UnregisterClassA RegisterClassA AdjustWindowRect GetTabbedTextExtentA TabbedTextOutA FillRect CharToOemA MessageBoxA wsprintfA WinHelpA GetDesktopWindow SetRect GetWindowDC DestroyIcon GetClassInfoA AdjustWindowRectEx GetMenuItemCount RemoveMenu GetMenuStringA GetMenuState DdePostAdvise GetCaretPos CharPrevA CharNextA GetUpdateRgn GetUpdateRect PtInRect ChildWindowFromPointEx ReleaseCapture SetCapture InflateRect GetWindowRect ClientToScreen MoveWindow IsWindowEnabled IsChild SetParent IsIconic IsZoomed DefMDIChildProcA MessageBeep PeekMessageA PostMessageA LoadStringA AppendMenuA DestroyMenu CreatePopupMenu GetMessageTime GetMessagePos DrawFocusRect CopyAcceleratorTableA GetWindowRgn CharUpperA TranslateMDISysAccel SubtractRect IsRectEmpty InvalidateRgn InvalidateRect CopyRect GetDCEx IntersectRect LoadAcceleratorsA BringWindowToTop GetWindowThreadProcessId AttachThreadInput EqualRect EnableWindow SetFocus SendMessageA SetWindowsHookExA GetClassNameA LoadCursorA SetCursor SetWindowLongA GetWindow GetFocus GetKeyboardLayout GetSystemMenu CallNextHookEx GetParent DestroyWindow SetWindowTextA SetWindowPos UpdateWindow CreateWindowExA SystemParametersInfoA GetCapture WindowFromPoint ScreenToClient SetTimer IsWindowVisible ShowWindow KillTimer GetDC ReleaseDC MapWindowPoints GetCursorPos GetCursor OffsetRect GetIconInfo DefWindowProcA BeginPaint GetClientRect EndPaint GetSysColor GetActiveWindow GetWindowLongA DdeDisconnect DdeConnect DdeSetUserHandle DdeNameService DdeCreateStringHandleA DdeUninitialize DdeInitializeA DdeFreeStringHandle DdeQueryConvInfo DdeQueryStringA DdeFreeDataHandle SetScrollRange SetScrollPos DrawFrameControl LockWindowUpdate CharLowerBuffA IsClipboardFormatAvailable SetClipboardData GetClipboardData OpenClipboard EmptyClipboard CloseClipboard GetCaretBlinkTime SetCaretPos GetWindowTextLengthA CreateCaret ShowCaret HideCaret DestroyCaret GetScrollPos GetClipboardFormatNameA DrawTextExA SetWindowRgn ToAscii CreateAcceleratorTableA DestroyAcceleratorTable ShowScrollBar GetScrollInfo GetLastActivePopup GetMenuItemInfoA SetMenuItemInfoA SetKeyboardState GetKeyboardState GetQueueStatus GetDoubleClickTime SetWindowContextHelpId TrackPopupMenu SetMenuDefaultItem DrawMenuBar DeleteMenu InsertMenuA GetSubMenu GetMenuItemID GetMenu SetMenu CreateMenu ModifyMenuA CheckMenuItem BeginDeferWindowPos EndDeferWindowPos DeferWindowPos PostThreadMessageA VkKeyScanA CharLowerA DrawIcon MessageBoxIndirectA DialogBoxParamA IsCharAlphaA EnumThreadWindows SetScrollInfo

gdi32

RestoreDC RealizePalette SetROP2 SaveDC GetClipBox SetWindowOrgEx ExcludeClipRect CreateHalftonePalette GetTextMetricsA PatBlt EnumFontsA TranslateCharsetInfo GetROP2 SetBrushOrgEx GetDeviceCaps GetObjectType CreatePenIndirect CreateBrushIndirect Rectangle GetStockObject Arc LineTo MoveToEx Pie Ellipse SetStretchBltMode GetPixel GetTextExtentPoint32A SetPixelV StretchDIBits GetCurrentObject TextOutA GetBkColor StretchBlt CreateDIBitmap CloseMetaFile SetWindowExtEx CreateMetaFileA EndDoc AbortDoc StartPage CreateCompatibleBitmap StartDocA CreateDCA ResetDCA Escape ScaleViewportExtEx SetViewportExtEx SetMapMode DeleteMetaFile PlayMetaFile SetAbortProc DeleteEnhMetaFile PlayEnhMetaFile CreateICA GetEnhMetaFileHeader ScaleWindowExtEx GetWindowOrgEx GetPaletteEntries CreateDIBSection CloseEnhMetaFile CreateEnhMetaFileA LPtoDP EqualRgn ExtCreateRegion GetDIBits SetTextAlign GetWindowExtEx GetViewportExtEx CopyMetaFileA CopyEnhMetaFileA PathToRegion EndPath BeginPath WidenPath GetTextColor GetMapMode SetDIBColorTable RoundRect CreateEllipticRgnIndirect CreateRoundRectRgn GetSystemPaletteEntries GetNearestColor CreateCompatibleDC SetViewportOrgEx BitBlt DeleteDC IntersectClipRect OffsetWindowOrgEx SelectClipRgn SelectPalette CreatePalette PtInRegion OffsetRgn ExtSelectClipRgn CreateRectRgnIndirect CreateRectRgn SetRectRgn CombineRgn CreateFontIndirectA GetTextExtentPointA GetObjectA GetBitmapBits SetBkMode SelectObject ExtTextOutA CreateBitmap CreatePatternBrush SetTextColor SetBkColor CreatePen CreateHatchBrush UnrealizeObject CreateSolidBrush EndPage DeleteObject

advapi32

RegQueryInfoKeyA RegCreateKeyW RegQueryValueExW RegEnumValueA RegEnumValueW RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegOpenKeyW RegSetValueExW OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegEnumKeyExA ReportEventA DeregisterEventSource RegisterEventSourceA RegDeleteValueA RegSetValueA RegCreateKeyA RegSetValueExA RegEnumKeyA RegDeleteKeyA RegQueryValueA InitializeSecurityDescriptor SetSecurityDescriptorDacl RegOpenKeyA RegOpenKeyExA RegCloseKey RegQueryValueExA

ole32

CoTaskMemAlloc CoTaskMemFree BindMoniker RegisterDragDrop RevokeDragDrop DoDragDrop CreateILockBytesOnHGlobal OleFlushClipboard OleIsCurrentClipboard OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator CreateDataAdviseHolder CreateOleAdviseHolder CoRegisterClassObject CoRevokeClassObject CLSIDFromString OleDoAutoConvert OleRegGetUserType OleSaveToStream ReadClassStg ReadClassStm OleConvertIStorageToOLESTREAM OleConvertOLESTREAMToIStorage StgIsStorageILockBytes StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes OleCreateFromData OleCreateLinkFromData OleGetIconOfClass OleGetClipboard OleSetClipboard OleCreateLink OleCreateLinkToFile OleGetAutoConvert OleCreateFromFile CoMarshalInterface CoUnmarshalInterface CreateStreamOnHGlobal StringFromCLSID StringFromGUID2 CLSIDFromProgID ProgIDFromCLSID CoGetClassObject CoCreateInstance MkParseDisplayName CoIsOle1Class OleQueryLinkFromData OleQueryCreateFromData GetClassFile CreateBindCtx OleDuplicateData ReleaseStgMedium OleSetMenuDescriptor CoRegisterMessageFilter OleUninitialize OleInitialize CoGetMalloc OleRegGetMiscStatus CoCreateGuid IIDFromString CoFreeUnusedLibraries CoDisconnectObject IsAccelerator OleIsRunning OleRun OleLockRunning StgCreateDocfile WriteClassStg OleSave StgOpenStorage OleLoad CoLockObjectExternal

oleaut32

OleTranslateColor OleCreatePropertyFrame VariantInit VariantClear SysAllocString SysFreeString OleCreateFontIndirect OleCreatePictureIndirect SysAllocStringByteLen OaBuildVersion SysAllocStringLen VariantChangeType SetErrorInfo CreateErrorInfo GetErrorInfo DispGetParam LoadTypeLi SysStringByteLen LoadRegTypeLi RegisterTypeLi LoadTypeLibEx UnRegisterTypeLi LHashValOfNameSys SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate OleLoadPicture SafeArrayDestroy VariantCopy VariantCopyInd SafeArrayDestroyData VariantChangeTypeEx CreateDispTypeInfo DispGetIDsOfNames DispInvoke SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElement SafeArrayPutElement SafeArrayRedim SafeArrayCopy OleIconToCursor RevokeActiveObject SafeArrayAllocDescriptor SafeArrayDestroyDescriptor SafeArrayAllocData SafeArrayLock SafeArrayUnlock VarDateFromStr SysReAllocStringLen GetActiveObject VarR8FromStr VarCyFromI4 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromDate VarBstrFromCy VarI2FromStr VarI4FromStr VarI4FromR8 VarR4FromStr VarCyFromStr SysReAllocString LHashValOfNameSysA SysStringLen

BASIC_CLASS_AddRef BASIC_CLASS_GetIDsOfNames BASIC_CLASS_Invoke BASIC_CLASS_QueryInterface BASIC_CLASS_Release BASIC_DISPINTERFACE_GetTICount BASIC_DISPINTERFACE_GetTypeInfo CopyRecord CreateIExprSrvObj DLLGetDocumentation DllCanUnloadNow DllFunctionCall DllGetClassObject DllRegisterServer DllUnregisterServer EVENT_SINK2_AddRef EVENT_SINK2_Release EVENT_SINK_AddRef EVENT_SINK_GetIDsOfNames EVENT_SINK_Invoke EVENT_SINK_QueryInterface EVENT_SINK_Release EbCreateContext EbDestroyContext EbGetErrorInfo EbGetHandleOfExecutingProject EbGetObjConnectionCounts EbGetVBAObject EbIsProjectOnStack EbLibraryLoad EbLibraryUnload EbLoadRunTime EbResetProject EbResetProjectNormal EbSetContextWorkerThread GetMem1 GetMem2 GetMem4 GetMem8 GetMemEvent GetMemNewObj GetMemObj GetMemStr GetMemVar IID_IVbaHost MethCallEngine ProcCallEngine PutMem1 PutMem2 PutMem4 PutMem8 PutMemEvent PutMemNewObj PutMemObj PutMemStr PutMemVar SetMemEvent SetMemNewObj SetMemObj SetMemVar ThunRTMain TipCreateInstanceEx TipCreateInstanceProject2 TipGetAddressOfPredeclaredInstance TipInvokeMethod TipInvokeMethod2 TipSetOption TipUnloadInstance TipUnloadProject UserDllMain VBDllCanUnloadNow VBDllGetClassObject VBDllRegisterServer VBDllUnRegisterServer VarPtr Zombie_AddRef Zombie_GetIDsOfNames Zombie_GetTypeInfo Zombie_GetTypeInfoCount Zombie_Invoke Zombie_QueryInterface Zombie_Release _CIatan _CIcos _CIexp _CIlog _CIsin _CIsqrt _CItan __vbaAptOffset __vbaAryConstruct __vbaAryConstruct2 __vbaAryCopy __vbaAryDestruct __vbaAryLock __vbaAryMove __vbaAryRebase1Var __vbaAryRecCopy __vbaAryRecMove __vbaAryUnlock __vbaAryVar __vbaAryVarVarg __vbaBoolErrVar __vbaBoolStr __vbaBoolVar __vbaBoolVarNull __vbaCVarAryUdt __vbaCastObj __vbaCastObjVar __vbaCheckType __vbaCheckTypeVar __vbaChkstk __vbaCopyBytes __vbaCopyBytesZero __vbaCyAbs __vbaCyAdd __vbaCyErrVar __vbaCyFix __vbaCyForInit __vbaCyForNext __vbaCyI2 __vbaCyI4 __vbaCyInt __vbaCyMul __vbaCyMulI2 __vbaCySgn __vbaCyStr __vbaCySub __vbaCyUI1 __vbaCyVar __vbaDateR4 __vbaDateR8 __vbaDateStr __vbaDateVar __vbaDerefAry __vbaDerefAry1 __vbaEnd __vbaErase __vbaEraseKeepData __vbaEraseNoPop __vbaError __vbaErrorOverflow __vbaExceptHandler __vbaExitEachAry __vbaExitEachColl __vbaExitEachVar __vbaExitProc __vbaFPException __vbaFPFix __vbaFPInt __vbaFailedFriend __vbaFileClose __vbaFileCloseAll __vbaFileLock __vbaFileOpen __vbaFileSeek __vbaFixstrConstruct __vbaForEachAry __vbaForEachCollAd __vbaForEachCollObj __vbaForEachCollVar __vbaForEachVar __vbaFpCDblR4 __vbaFpCDblR8 __vbaFpCSngR4 __vbaFpCSngR8 __vbaFpCmpCy __vbaFpCy __vbaFpI2 __vbaFpI4 __vbaFpR4 __vbaFpR8 __vbaFpUI1 __vbaFreeObj __vbaFreeObjList __vbaFreeStr __vbaFreeStrList __vbaFreeVar __vbaFreeVarList __vbaFreeVarg __vbaGenerateBoundsError __vbaGet3 __vbaGet4 __vbaGetFxStr3 __vbaGetFxStr4 __vbaGetOwner3 __vbaGetOwner4 __vbaGosub __vbaGosubFree __vbaGosubReturn __vbaHresultCheck __vbaHresultCheckNonvirt __vbaHresultCheckObj __vbaI2Abs __vbaI2Cy __vbaI2ErrVar __vbaI2ForNextCheck __vbaI2I4 __vbaI2Sgn __vbaI2Str __vbaI2Var __vbaI4Abs __vbaI4Cy __vbaI4ErrVar __vbaI4ForNextCheck __vbaI4Sgn __vbaI4Str __vbaI4Var __vbaInStr __vbaInStrB __vbaInStrVar __vbaInStrVarB __vbaInputFile __vbaLateIdCall __vbaLateIdCallLd __vbaLateIdCallSt __vbaLateIdNamedCall __vbaLateIdNamedCallLd __vbaLateIdNamedCallSt __vbaLateIdNamedStAd __vbaLateIdSt __vbaLateIdStAd __vbaLateMemCall __vbaLateMemCallLd __vbaLateMemCallSt __vbaLateMemNamedCall __vbaLateMemNamedCallLd __vbaLateMemNamedCallSt __vbaLateMemNamedStAd __vbaLateMemSt __vbaLateMemStAd __vbaLbound __vbaLdZeroAry __vbaLenBstr __vbaLenBstrB __vbaLenVar __vbaLenVarB __vbaLineInputStr __vbaLineInputVar __vbaLsetFixstr __vbaLsetFixstrFree __vbaMidStmtBstr __vbaMidStmtBstrB __vbaMidStmtVar __vbaMidStmtVarB __vbaNameFile __vbaNew __vbaNew2 __vbaNextEachAry __vbaNextEachCollAd __vbaNextEachCollObj __vbaNextEachCollVar __vbaNextEachVar __vbaObjAddref __vbaObjIs __vbaObjSet __vbaObjSetAddref __vbaObjVar __vbaOnError __vbaOnGoCheck __vbaPowerR8 __vbaPrintFile __vbaPrintObj __vbaPut3 __vbaPut4 __vbaPutFxStr3 __vbaPutFxStr4 __vbaPutOwner3 __vbaPutOwner4 __vbaR4Cy __vbaR4ErrVar __vbaR4ForNextCheck __vbaR4Sgn __vbaR4Str __vbaR4Var __vbaR8Cy __vbaR8ErrVar __vbaR8FixI2 __vbaR8FixI4 __vbaR8ForNextCheck __vbaR8IntI2 __vbaR8IntI4 __vbaR8Sgn __vbaR8Str __vbaR8Var __vbaRaiseEvent __vbaRecAnsiToUni __vbaRecAssign __vbaRecDestruct __vbaRecDestructAnsi __vbaRecUniToAnsi __vbaRedim __vbaRedimPreserve __vbaRedimPreserveVar __vbaRedimPreserveVar2 __vbaRedimVar __vbaRedimVar2 __vbaRefVarAry __vbaResume __vbaRsetFixstr __vbaRsetFixstrFree __vbaSetSystemError __vbaStopExe __vbaStr2Vec __vbaStrAryToAnsi __vbaStrAryToUnicode __vbaStrBool __vbaStrCat __vbaStrCmp __vbaStrComp __vbaStrCompVar __vbaStrCopy __vbaStrCy __vbaStrDate __vbaStrErrVarCopy __vbaStrFixstr __vbaStrI2 __vbaStrI4 __vbaStrLike __vbaStrMove __vbaStrR4 __vbaStrR8 __vbaStrTextCmp __vbaStrTextLike __vbaStrToAnsi __vbaStrToUnicode __vbaStrUI1 __vbaStrVarCopy __vbaStrVarMove __vbaStrVarVal __vbaUI1Cy __vbaUI1ErrVar __vbaUI1I2 __vbaUI1I4 __vbaUI1Sgn __vbaUI1Str __vbaUI1Var __vbaUbound __vbaUdtVar __vbaUnkVar __vbaVar2Vec __vbaVarAbs __vbaVarAdd __vbaVarAnd __vbaVarCat __vbaVarCmpEq __vbaVarCmpGe __vbaVarCmpGt __vbaVarCmpLe __vbaVarCmpLt __vbaVarCmpNe __vbaVarCopy __vbaVarDateVar __vbaVarDiv __vbaVarDup __vbaVarEqv __vbaVarErrI4 __vbaVarFix __vbaVarForInit __vbaVarForNext __vbaVarIdiv __vbaVarImp __vbaVarIndexLoad __vbaVarIndexLoadRef __vbaVarIndexLoadRefLock __vbaVarIndexStore __vbaVarIndexStoreObj __vbaVarInt __vbaVarLateMemCallLd __vbaVarLateMemCallLdRf __vbaVarLateMemCallSt __vbaVarLateMemSt __vbaVarLateMemStAd __vbaVarLike __vbaVarLikeVar __vbaVarMod __vbaVarMove __vbaVarMul __vbaVarNeg __vbaVarNot __vbaVarOr __vbaVarPow __vbaVarSetObj __vbaVarSetObjAddref __vbaVarSetUnk __vbaVarSetUnkAddref __vbaVarSetVar __vbaVarSetVarAddref __vbaVarSub __vbaVarTextCmpEq __vbaVarTextCmpGe __vbaVarTextCmpGt __vbaVarTextCmpLe __vbaVarTextCmpLt __vbaVarTextCmpNe __vbaVarTextLike __vbaVarTextLikeVar __vbaVarTextTstEq __vbaVarTextTstGe __vbaVarTextTstGt __vbaVarTextTstLe __vbaVarTextTstLt __vbaVarTextTstNe __vbaVarTstEq __vbaVarTstGe __vbaVarTstGt __vbaVarTstLe __vbaVarTstLt __vbaVarTstNe __vbaVarVargNofree __vbaVarXor __vbaVarZero __vbaVargObj __vbaVargObjAddref __vbaVargParmRef __vbaVargUnk __vbaVargUnkAddref __vbaVargVar __vbaVargVarCopy __vbaVargVarMove __vbaVargVarRef __vbaVerifyVarObj __vbaWriteFile _adj_fdiv_m16i _adj_fdiv_m32 _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan _allmul rtBoolFromErrVar rtBstrFromErrVar rtCyFromErrVar rtDecFromVar rtI2FromErrVar rtI4FromErrVar rtR4FromErrVar rtR8FromErrVar rtUI1FromErrVar rtcAbsVar rtcAnsiValueBstr rtcAppActivate rtcAppleScript rtcArray rtcAtn rtcBeep rtcBstrFromAnsi rtcBstrFromByte rtcBstrFromChar rtcBstrFromError rtcBstrFromFormatVar rtcByteValueBstr rtcCVErrFromVar rtcCallByName rtcChangeDir rtcChangeDrive rtcCharValueBstr rtcChoose rtcCommandBstr rtcCommandVar rtcCompareBstr rtcCos rtcCreateObject rtcCreateObject2 rtcCurrentDir rtcCurrentDirBstr rtcDDB rtcDateAdd rtcDateDiff rtcDateFromVar rtcDatePart rtcDeleteSetting rtcDir rtcDoEvents rtcEndOfFile rtcEnvironBstr rtcEnvironVar rtcErrObj rtcExp rtcFV rtcFileAttributes rtcFileCopy rtcFileDateTime rtcFileLen rtcFileLength rtcFileLocation rtcFileReset rtcFileSeek rtcFileWidth rtcFilter rtcFixVar rtcFormatCurrency rtcFormatDateTime rtcFormatNumber rtcFormatPercent rtcFreeFile rtcGetAllSettings rtcGetCurrentCalendar rtcGetDateBstr rtcGetDateValue rtcGetDateVar rtcGetDayOfMonth rtcGetDayOfWeek rtcGetErl rtcGetFileAttr rtcGetHostLCID rtcGetHourOfDay rtcGetMinuteOfHour rtcGetMonthOfYear rtcGetObject rtcGetPresentDate rtcGetSecondOfMinute rtcGetSetting rtcGetTimeBstr rtcGetTimeValue rtcGetTimeVar rtcGetTimer rtcGetYear rtcHexBstrFromVar rtcHexVarFromVar rtcIMEStatus rtcIPMT rtcIRR rtcImmediateIf rtcInStr rtcInStrChar rtcInStrRev rtcInputBox rtcInputCharCount rtcInputCharCountVar rtcInputCount rtcInputCountVar rtcIntVar rtcIsArray rtcIsDate rtcIsEmpty rtcIsError rtcIsMissing rtcIsNull rtcIsNumeric rtcIsObject rtcJoin rtcKillFiles rtcLeftBstr rtcLeftCharBstr rtcLeftCharVar rtcLeftTrimBstr rtcLeftTrimVar rtcLeftVar rtcLenCharVar rtcLenVar rtcLog rtcLowerCaseBstr rtcLowerCaseVar rtcMIRR rtcMacId rtcMakeDir rtcMidBstr rtcMidCharBstr rtcMidCharVar rtcMidVar rtcMonthName rtcMsgBox rtcNPV rtcNPer rtcOctBstrFromVar rtcOctVarFromVar rtcPMT rtcPPMT rtcPV rtcPackDate rtcPackTime rtcPartition rtcQBColor rtcR8ValFromBstr rtcRandomNext rtcRandomize rtcRate rtcRemoveDir rtcReplace rtcRgb rtcRightBstr rtcRightCharBstr rtcRightCharVar rtcRightTrimBstr rtcRightTrimVar rtcRightVar rtcRound rtcSLN rtcSYD rtcSaveSetting rtcSendKeys rtcSetCurrentCalendar rtcSetDateBstr rtcSetDateVar rtcSetFileAttr rtcSetTimeBstr rtcSetTimeVar rtcSgnVar rtcShell rtcSin rtcSpaceBstr rtcSpaceVar rtcSplit rtcSqr rtcStrConvVar rtcStrConvVar2 rtcStrFromVar rtcStrReverse rtcStringBstr rtcStringVar rtcSwitch rtcTan rtcTrimBstr rtcTrimVar rtcTypeName rtcUpperCaseBstr rtcUpperCaseVar rtcVarBstrFromAnsi rtcVarBstrFromByte rtcVarBstrFromChar rtcVarDateFromVar rtcVarFromError rtcVarFromFormatVar rtcVarFromVar rtcVarStrFromVar rtcVarType rtcWeekdayName

$SYSDIR/VB6KO.DLL

SHA256 52b64e2bfc9ee0b807f2095726ace9e911bcd907054ac15686a4e7d2fd4dc751
MD5 84742b5754690ed667372be561cf518d
SHA1 ef97aa43f804f447498568fc33704800b91a7381
SHA512 72ac19a3665a01519dac2ad43eb6178a66ad7f4e167f2a882cbca242978f8debe3e15d0e210c3b0391590699999f33a1fd5de4ca6559ff894b4e6cb4ac1415a0
SSDEEP 768:J2rURM7RMwTQvsF51u5tyxwgyBEkLki6Ynb:J2rwWRjM0FCagQi6Yb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

$SYSDIR/dwsbc80.OCX

IMPHASH c9ec1a52290f09be08b86844f9145fc4
SHA256 242934d4d92948817dd00eec4e8592f7044f5bfc7b2ad2603c826c5cea7b09e5
MD5 456b24a38b8e2d2f3303e0b4d05cc929
SHA1 3c981bbac31706cc9189605959f9eba7acbb17a7
SHA512 4476f50a9ade47c848f882b56758111d39a79e61ac62cebf09c8b8d7baaaa77767c11da6e6732caa383b372d0d8a49be116e111299f637e2ea722fa5fd978385
SSDEEP 3072:K33ebWXothdt1FFfPLyKq1YeoXijMkcI1SjX7iO1ChheO/n3hzOi:DN9LjgiiO1ChheO/n3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

92251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dwshengine80

ord3000 ord513 ord217 ord305 ord303 ord304 ord306 ord302 ord301 ord202 ord512

kernel32

GlobalAlloc IsDebuggerPresent GetModuleFileNameA GetModuleHandleA DisableThreadLibraryCalls InterlockedIncrement InterlockedDecrement GetProcAddress GetModuleHandleW IsDBCSLeadByte FreeLibrary LoadLibraryA LoadLibraryExA lstrcmpA GetCurrentProcessId GlobalFree GlobalSize lstrcpyA lstrcatA _lclose WaitForSingleObject ReleaseMutex DebugBreak CreateMutexA MapViewOfFile OpenFileMappingA CreateFileMappingA OpenFile GetVersion IsBadReadPtr GetPrivateProfileStringA GetPrivateProfileIntA _lread _lwrite _llseek FileTimeToDosDateTime GetFileTime GetTickCount QueryPerformanceCounter SetUnhandledExceptionFilter GlobalLock UnhandledExceptionFilter TerminateProcess Sleep InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent RaiseException EnterCriticalSection LeaveCriticalSection FlushInstructionCache GetCurrentProcess GetCurrentThreadId SetLastError MultiByteToWideChar GetSystemTimeAsFileTime WideCharToMultiByte lstrlenW InitializeCriticalSection DeleteCriticalSection GetLastError lstrlenA lstrcmpiA SizeofResource LockResource LoadResource FindResourceA MulDiv GlobalUnlock HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange

user32

SetWindowTextA SendMessageA GetWindowTextLengthA GetWindowTextA EnableWindow SendDlgItemMessageA DialogBoxParamA DestroyIcon GetParent PostMessageA SetRectEmpty LoadIconA DrawIconEx WinHelpA CreateWindowExA GetFocus IsChild RegisterClassExA InvalidateRect GetKeyState IsWindow GetDlgCtrlID EndDialog SetDlgItemTextA LoadStringA CharPrevA UnregisterClassA RegisterWindowMessageA DefWindowProcA CallWindowProcA BeginPaint GetClientRect EndPaint IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos LoadCursorA GetClassInfoExA GetDC ReleaseDC GetDialogBaseUnits GetWindowLongA CharNextW DestroyWindow IsDialogMessageA MoveWindow UnionRect PtInRect CharNextA wsprintfA MessageBoxA CreateDialogParamA ShowWindow SetFocus GetDlgItem SetDlgItemInt IsDlgButtonChecked GetDlgItemInt CheckDlgButton SetWindowLongA GetActiveWindow

gdi32

CloseMetaFile RestoreDC SetWindowExtEx SetWindowOrgEx SaveDC CreateMetaFileA Rectangle DeleteMetaFile SetTextColor GetObjectA DeleteObject GetTextExtentPointA GetTextMetricsA SelectObject CreateFontIndirectA GetDeviceCaps TextOutA GetStockObject CreateRectRgnIndirect SetTextAlign

advapi32

RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegEnumKeyExA

ole32

CoTaskMemFree CoTaskMemAlloc OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder CreateOleAdviseHolder CoCreateInstance StringFromGUID2 OleLoadFromStream WriteClassStm OleSaveToStream CoTaskMemRealloc

oleaut32

SysAllocStringLen OleCreatePropertyFrame SysAllocStringByteLen LoadRegTypeLi VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi VariantChangeType SysAllocString VariantClear VariantInit SysStringByteLen SysStringLen CreateErrorInfo SetErrorInfo SysFreeString

msvcr90

_amsg_exit _adjust_fdiv __CppXcptFilter ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __clean_type_info_names_internal _initterm_e _initterm _encoded_null ??3@YAXPAX@Z _CxxThrowException _decode_pointer ??_V@YAXPAX@Z ??_U@YAPAXI@Z __CxxFrameHandler3 strstr memcmp malloc free memcpy_s strcpy_s wcsncpy_s strncpy_s strcat_s _recalloc calloc sprintf_s _resetstkoflw ??2@YAPAXI@Z _purecall strlen memmove atol strcspn memcpy ?terminate@@YAXXZ _except_handler4_common _unlock _encode_pointer _lock _onexit memset __dllonexit _malloc_crt

$SYSDIR/dwshengine80.dll

IMPHASH f100d2d25a87b6fc145678492da88656
SHA256 a8ab488c1ffeed943a68ce7f72fa2eb1b9b21b62c01fbd405a93906a4b357621
MD5 df901a23e6da0cad1981f0a7c13fbf24
SHA1 78f8f8e857e5ce4dce9fdc6658b5780b07167df7
SHA512 1d530caccd728006b1c169a9684044b45384ff4caca02f95c26e15339c4bcfad00f70a85b9f3b6d6d84aed242536ecea454636688e33fa6c6558f67378fc8228
SSDEEP 3072:jVEYo+V9rYoQ7/pnDeZtVbbOtF4759qDD2:jVEYdHE/CbOto59
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

91850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentProcess OpenProcess GetVersionExA CreateEventA GetCurrentThreadId IsBadCodePtr RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError FlushInstructionCache DisableThreadLibraryCalls InterlockedIncrement InterlockedDecrement GetModuleHandleW IsDBCSLeadByte SetLastError SizeofResource LoadResource FindResourceA LoadLibraryExA lstrcpyA IsBadReadPtr lstrcatA DuplicateHandle OpenFileMappingA CreateFileMappingA UnmapViewOfFile OpenFile GetVersion Sleep InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime SetEvent GetProcAddress FreeLibrary GetModuleHandleA lstrlenW IsBadWritePtr CloseHandle LoadLibraryA CreateMutexA DebugBreak GetCurrentProcessId ReleaseMutex WaitForSingleObject GetModuleFileNameA lstrcmpiA lstrcmpA WideCharToMultiByte lstrlenA MultiByteToWideChar MapViewOfFile GetSystemDefaultLangID TerminateProcess

user32

DestroyWindow PostMessageA MessageBeep FindWindowA SendMessageA SetForegroundWindow GetWindow SetWindowLongA DefWindowProcA SetWindowWord GetWindowWord CreateWindowExA RegisterClassA CallNextHookEx UnhookWindowsHookEx SetWindowsHookExA GetWindowThreadProcessId SendMessageTimeoutA GetForegroundWindow GetWindowLongA GetClassNameA GetKeyState GetGUIThreadInfo SetWindowLongW GetWindowLongW CallWindowProcA CallWindowProcW SetRectEmpty EnumWindows IsWindowEnabled UpdateWindow GetPropA CharPrevA LoadStringA LoadBitmapA GetDlgCtrlID GetParent SetTimer GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos EndDialog KillTimer CharUpperA GetActiveWindow DialogBoxParamA CharNextW CharNextA RegisterWindowMessageA GetWindowRect PtInRect ScreenToClient InflateRect InvalidateRect OffsetRect IsWindow GetClientRect ClientToScreen ShowWindow UnregisterClassA

gdi32

SetTextColor DeleteObject CreateFontIndirectA GetObjectA

advapi32

RegDeleteKeyA RegEnumKeyA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegCloseKey

ole32

CoTaskMemFree CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc StringFromGUID2

oleaut32

VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysFreeString SysStringLen SysAllocStringLen SysAllocString VariantChangeType SysStringByteLen VariantClear VariantInit SysAllocStringByteLen

msvcr90

__clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _encoded_null _malloc_crt ?terminate@@YAXXZ _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock _except_handler4_common _itoa_s atoi memmove _recalloc ??_V@YAXPAX@Z strncpy_s memcpy_s strstr ??2@YAPAXI@Z _resetstkoflw memset strcat_s wcsncpy_s strcpy_s _CxxThrowException free malloc memcmp memcpy ??_U@YAPAXI@Z __CxxFrameHandler3 ??3@YAXPAX@Z

ChangeMessageDetect ConstituentEnable DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer GetGraphicalControlForPoint HookWindow HookWindowsHook SetHookMode Spxrvv2 Spxrvv3 UnhookTheWindowsHook UnhookWindow VerifySystemHooks dw2IntegersToDWORD dw4BytesToDWORD dwAddFileTimes dwConvertDoubleToFileTime dwConvertFileTimeToDouble dwCopyData dwCopyDataSpecial dwDWORDto2Integers dwDWORDto4Bytes dwFreeUDT dwGetAddressForObject dwGetAddressForVBString dwGetControlNameByID dwGetInstance dwGetPropertyValue dwGetReturnHlstr dwGetSpyWorksVersion dwGetStringFrom2NullBuffer dwGetStringFromLPSTR dwGetWndInstance dwHugeOffset dwInp dwInpd dwInpw dwIsValidName dwMakeROP4 dwNegateFileTime dwOutp dwOutpd dwOutpw dwPOINTStoLong dwPackUDT dwPackedUDTSize dwPrivGetMapping dwPrivLockMapTest dwPrivMemTest dwRegisterUDT dwSetPropertyValue dwSubtractFileTimes dwSwapBytes dwSwapWords dwUnpackUDT dwXAllocateDataFrom dwXCTSWL dwXCopyAnsiStringFrom dwXCopyDataFrom dwXCopyDataTo dwXCopyUnicodeStringFrom dwXFreeDataFrom dwXGetControlIDForHwnd dwXGetEditLine dwXGetHwndControl dwXGetModuleFileName dwXGetSpyworksAppID dwXGetSpyworksFormID dwXGetVBNames dwXReleaseSpyworksID dwXSetForegroundWindow dwiGetControlExtender dwiGetControlHwndForName dwiGetControlNameForHwnd dwiGetControlNames dwiGetControlUnknown dwiGetGraphicalControlForPoint dwiGetHwndHookList dwiGetObjectPropertyHelper dwiGetPrivateInfo dwiGetProcessHwndList dwiSetObjectPropertyHelper dwiShiftGraphicalControl dwiShiftGraphicalControl2 dwiShiftWindowControl dwiTest1

UrlUpdate.exe

IMPHASH 4cbf148669482228ddfaf747b9ba50a3
SHA256 94a6a81ad5c12aec33d7274e43ed8197cd476bb9680724995631fd971e8a3d86
MD5 df4c70adfe3ee8e7d0a7d396754681ea
SHA1 86d6bc8e6961a01aa689909d678512e0e3bc202c
SHA512 94e8fa6c92cbb30320b2067158549e6079be66489c4a2c8008ec7675d9135cddd477137b3c08fe7e7a41d2da6fcc3732d9ae10e8bc47226108938249fa33fa4e
SSDEEP 3072:T6npLFsb893Sn3dkJht04WD2spOL/KGKlhcpguZh5pXK1zZcsbAM:+0nNke4WdUL/KGKlhcpguZHpXK1z0M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

13236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

urlmon

URLDownloadToFileA

oleaut32

SysAllocString

advapi32

OpenProcessToken

kernel32

GetSystemDirectoryA GetCurrentProcess GetTempPathA RtlMoveMemory GetPrivateProfileIntA FileTimeToLocalFileTime WritePrivateProfileSectionA FileTimeToSystemTime FormatMessageA GetWindowsDirectoryA MoveFileExA GetCurrentProcessId GetLastError Sleep SetLastError SetFileTime SystemTimeToFileTime CloseHandle ExitProcess GetTempFileNameA LocalFileTimeToFileTime GetFullPathNameA OpenProcess DeleteFileA

msvbvm60

__vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 __vbaFreeObjList ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaCopyBytes __vbaResume __vbaStrCat ord553 ord660 __vbaLsetFixstr __vbaRecDestruct ord661 __vbaSetSystemError ord662 __vbaHresultCheckObj ord557 _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct EVENT_SINK2_Release __vbaBoolStr __vbaForEachCollObj __vbaExitProc ord300 ord595 __vbaObjSet __vbaOnError ord302 _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord598 ord306 ord520 __vbaStrFixstr ord308 ord309 __vbaRefVarAry _CIsin ord631 __vbaNextEachCollObj ord525 __vbaChkstk ord526 __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaDateR8 ord561 __vbaI2I4 DllFunctionCall ord670 __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStrUI1 __vbaExceptHandler ord711 ord605 __vbaPrintFile ord712 __vbaStrToUnicode ord606 __vbaDateStr _adj_fprem _adj_fdivr_m64 __vbaI2Str ord607 ord530 ord608 ord531 __vbaFPException __vbaInStrVar ord533 __vbaStrVarVal __vbaUbound __vbaVarCat __vbaDateVar __vbaI2Var __vbaLsetFixstrFree ord644 ord537 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaNew2 ord648 __vbaR8Str __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList ord576 _adj_fdivr_m32 ord577 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaI4Var ord610 __vbaAryLock __vbaStrToAnsi __vbaVarDup __vbaFpI4 ord616 __vbaRecDestructAnsi _CIatan __vbaCastObj ord540 ord618 __vbaAryCopy __vbaStrMove ord542 ord543 ord650 _allmul ord544 ord651 ord545 _CItan ord546 ord547 __vbaAryUnlock _CIexp ord580 __vbaFreeObj __vbaFreeStr

autoup.ini

SHA256 1a54283b3ed0cd813fc8e53377e2fa7bcfcdbcc27ba2aa00b5d588c3037c0d1a
MD5 31109213e0602348cca02b50a129dda6
SHA1 8a4ba2381a7bae11b34a7e7b04006eee6b225e98
SHA512 7e913e81af16bfd04c061ff408a3d751149ef2c5f46ec2c73e2e196a79d6d5271c37976eb3db15dc87d15140ffd8a5b639b97d307fc0583e3e8fc0fa825f0b93
MD5 SHA1 SHA512

NSIS installer

installer

bhocfg.ini

SHA256 d865151fc6bd08ae20c1252b197b658fc293a5183ec1f294a05d305c714070f5
MD5 8eb1f202b12256dc732a17590d7d508e
SHA1 8b032c6f45112d2aa3e72bcdfbcbd00144418e54
SHA512 3ef8dfae492a5dd2887e7ea2e41a879322cdce86f8ee97e3438a47164c39d11349559c18e8bb27017f6ede0c4c5c69dfe05bb870657468f2faa9431de105f7bd
SSDEEP 192:mPzZqnq9B4eLwrAhqVsG3XuJ2RRccxf70CIPtX8X:mPzZqnq98Ahq2OyeDIK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

bhocode.ini

SHA256 7198951fb2445568ecd0d83214a5e7337ff6710b785aeaebf641f24ed409ebd7
MD5 2b4c5c5deee9d19992825eb9843c6ee8
SHA1 2bd5c9a61ada3ccf8f112477b54b789982350855
SHA512 a092d28acb8f3f8e9c23183d8c486407c2051391c8d41237ed8e840a5a301753ff7fe928c5701c0c5501e6d49120cb459ce56f6de01bb7087dd8a548b2de38ac
MD5 SHA1 SHA512

NSIS installer

installer

efbbar.dll

IMPHASH f8422f0450fc5da280dfde447fa2d466
SHA256 acf3a2dc80f5deb6d81c674a5edc163ea8ba6e6898c750159cf74ae8f00199f2
MD5 da641973a719e465fb28389c8277009f
SHA1 d3c808a07226304e6549eed80b87272e1bcda0ea
SHA512 6bffd8ffe167b0426a5021ecaefd9f1473a401e73db88708ed0561f1f2cefe18ae1b958ba7e079622b62e10d25fa0b5cc5802642f627f95275d45cd524f8c40f
SSDEEP 3072:Wf3mtWDf4Jlt71YGCKPMEPHNE2I/1/7Fx:WPm2fw7q8PLPtnm/
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocString

urlmon

CoInternetParseUrl

advapi32

RevertToSelf GetUserNameA

comctl32

InitCommonControlsEx

ole32

CoCreateInstance CLSIDFromString CLSIDFromProgID CoTaskMemFree

kernel32

GetProcAddress GetSystemDirectoryA GetCurrentProcess lstrcpyA GetTempPathA RtlMoveMemory GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA CloseHandle lstrlenW GetTickCount

user32

MessageBoxA IsWindow GetWindowRect GetWindowTextA AttachThreadInput GetWindowLongA SetForegroundWindow GetWindowThreadProcessId GetClassNameA SetWindowLongA IsWindowVisible GetFocus ShowWindow BringWindowToTop GetAsyncKeyState GetForegroundWindow GetCursorPos GetParent

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaAptOffset __vbaLenBstr __vbaStrVarMove __vbaFreeVarList _adj_fdiv_m64 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 ord517 __vbaStrErrVarCopy _adj_fprem1 __vbaRecAnsiToUni __vbaCopyBytes __vbaResume __vbaStrCat ord660 __vbaLsetFixstr __vbaSetSystemError ord661 __vbaLenBstrB __vbaHresultCheckObj ord662 ord557 __vbaLenVar _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release __vbaVarForInit __vbaExitProc __vbaForEachCollObj ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord520 __vbaBoolVar __vbaRefVarAry __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaErase ord632 ord525 __vbaNextEachCollObj __vbaVarCmpGt __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaExitEachColl __vbaObjVar __vbaI2I4 ord561 DllFunctionCall __vbaVarOr __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaR4Var __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaPrintFile __vbaStrToUnicode ord605 ord606 __vbaDateStr _adj_fprem _adj_fdivr_m64 __vbaI2Str ord607 ord608 ord716 __vbaFPException ord717 ord319 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec ord648 __vbaNew2 __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 ord577 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord104 ord610 ord105 __vbaVarAdd __vbaLateMemCall __vbaAryLock ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaFpI4 __vbaVarLateMemCallLd __vbaUnkVar ord616 __vbaVarCopy __vbaVarTstGe ord617 __vbaLateMemCallLd _CIatan ord618 __vbaAryCopy ord540 __vbaStrMove __vbaCastObj __vbaStrVarCopy ord650 _allmul ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr

efsbar.dll

IMPHASH 070d5ebb721bafb3cf8902887baed7a8
SHA256 61dc360cc369d3718dba0f9abef8abdef86631f6926758935f29d0b12e6cf8cc
MD5 06ba55c2784d6be5bd400a469e2a602f
SHA1 9c0942b4941430e79bd94735a9c5b9b5ab99424c
SHA512 502c8c2c8b8294454db8bc38d6b5cc11355c33e22533951622284c3e96f3e568d08173780d84a029a090041e67c6bcd9568150ce28acc3c2aaa83a9fe5cc6c1d
SSDEEP 1536:WeBE9b4kRDjvf7fE3ojwG/Ih/3RtR8izcT2QsbIpF4srfQuRRoFvC0U0ZaRKrhC/:WeBXkjvjE3AAxLR86cL71RoF7wu2cY
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

39:0c:f7:41:8e:40:65:c1:56:55:ff:4d:89:fb:74:57:4e:e1:80:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Chains

Oct 13, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Serial Number

40:9f:a8:40:e5:fe:40:9e:c5:c4:87:4e:39:4e:b6:50

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 14, 2011 - Mar 15, 2012

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

InitCommonControlsEx

oleaut32

SysAllocString

urlmon

CoInternetParseUrl

ole32

CoCreateInstance CLSIDFromString CLSIDFromProgID CoTaskMemFree

advapi32

RevertToSelf GetUserNameA

user32

MessageBoxA IsWindow CreateWindowExA GetWindowTextA FindWindowA AttachThreadInput SetForegroundWindow GetWindowThreadProcessId DestroyWindow GetClassNameA IsWindowVisible ShowWindow BringWindowToTop GetAsyncKeyState GetForegroundWindow GetClientRect

kernel32

GetProcAddress GetSystemDirectoryA GetCurrentProcess lstrcpyA GetTempPathA RtlMoveMemory GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA CloseHandle lstrlenW GetTickCount

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaHresultCheck __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaAryMove __vbaAptOffset __vbaLenBstr __vbaStrVarMove ord696 __vbaFreeVarList _adj_fdiv_m64 ord512 EVENT_SINK_Invoke __vbaFreeObjList ord516 __vbaStrErrVarCopy ord517 _adj_fprem1 __vbaRecAnsiToUni __vbaResume __vbaStrCat ord660 __vbaLsetFixstr ord661 __vbaSetSystemError __vbaLenBstrB ord662 __vbaHresultCheckObj ord557 __vbaLenVar _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release __vbaForEachCollObj __vbaVarForInit __vbaExitProc ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaBoolVar ord520 __vbaVarTstLt __vbaBoolVarNull __vbaRefVarAry _CIsin ord631 __vbaErase __vbaNextEachCollObj __vbaVarCmpGt ord632 ord525 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord529 __vbaExitEachColl __vbaStrCmp __vbaVarTstEq ord561 __vbaObjVar DllFunctionCall __vbaVarOr __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaExceptHandler ord711 __vbaPrintFile ord605 __vbaStrToUnicode ord712 __vbaDateStr ord606 _adj_fprem _adj_fdivr_m64 __vbaFailedFriend __vbaI2Str ord607 ord608 ord716 __vbaFPException ord717 ord319 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaI2Var ord537 ord644 ord645 _CIlog __vbaFileOpen ord648 __vbaNew2 __vbaVar2Vec __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 ord577 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord104 ord610 ord105 __vbaLateMemCall __vbaAryLock ord320 __vbaStrToAnsi __vbaVarDup ord321 __vbaVarTstGe __vbaVarLateMemCallLd __vbaUnkVar ord616 __vbaVarCopy ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str ord540 __vbaStrMove ord618 __vbaAryCopy __vbaCastObj __vbaStrVarCopy ord650 _allmul ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj

iewindow.exe

IMPHASH f056f5cb00c3565cbf7ed854854fa8e2
SHA256 b697f80f2fd2a0f12e8fa9bcf02cedf1306f618d1328ace2e7954038eab6716a
MD5 a9750f0259293728bd56dc8a6509ab04
SHA1 11f79809356887f995896febf2cde9da0bbc48bb
SHA512 3a3c659183e2ca1c5a03f579fbaa9f76b731030c06571fe73b12bd8e2a4d626764e4cb7aea35803199a8da9db217985215bab48c199c7564a20bd2bd592a9a1b
SSDEEP 6144:QzIHrlVzNOKvt9mI0E3BDh/9nk85ziUpUox/vb5FH7869Hbdgt:KKQKHH0+BN/9HdiBohT5FoyHbI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

fa:41:83:e1:06:41:29:1e:91:8b:d0:58:40:fa:a8:eb:67:4b:13:18

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Chains

Oct 13, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Serial Number

40:9f:a8:40:e5:fe:40:9e:c5:c4:87:4e:39:4e:b6:50

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 14, 2011 - Mar 15, 2012

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

24740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

urlmon

CoInternetParseUrl

shlwapi

SHAutoComplete SHDeleteKeyW

ole32

CLSIDFromString CoTaskMemFree

oleaut32

OleTranslateColor

gdi32

SelectObject GetObjectA GetDeviceCaps CreateFontIndirectA CreatePen MoveToEx GetStockObject CreateSolidBrush LineTo SetTextColor DeleteObject SetBkMode SetBkColor

user32

SetWindowPos IsWindow GetWindowRect CreateWindowExA GetWindowTextA ScreenToClient FillRect SetParent InvalidateRect AttachThreadInput GetWindowLongA SendMessageTimeoutA GetClassLongA SetForegroundWindow SetWindowTextA GetWindowThreadProcessId EnableWindow MoveWindow FindWindowExA GetSysColor DestroyWindow GetClassNameA DrawTextA SetFocus SetWindowLongA IsIconic SendMessageA ReleaseDC IsWindowVisible WindowFromPoint RegisterWindowMessageA CopyRect GetFocus ShowWindow keybd_event BringWindowToTop GetDC GetAsyncKeyState SetClassLongA GetSysColorBrush GetForegroundWindow EqualRect GetClientRect GetCursorPos GetParent MapWindowPoints

advapi32

RevertToSelf GetUserNameA

kernel32

GetProcAddress GetSystemDirectoryA GlobalUnlock lstrcpyA GetTempPathA RtlMoveMemory GetPrivateProfileIntA GlobalFree GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA Sleep MulDiv CloseHandle lstrlenW GlobalAlloc OpenProcess GetCurrentThreadId GetExitCodeProcess TerminateProcess GlobalLock

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLateIdCall __vbaLenBstr __vbaStrVarMove ord696 __vbaFreeVarList _adj_fdiv_m64 ord512 __vbaAryRecMove EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy ord517 _adj_fprem1 __vbaRecAnsiToUni ord518 ord519 __vbaI2Abs __vbaCopyBytes __vbaResume __vbaStrCat __vbaLsetFixstr ord660 __vbaRecDestruct __vbaSetSystemError ord662 __vbaHresultCheckObj ord557 __vbaLenVar ord558 _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release ord592 __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord300 ord301 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord305 __vbaFpR4 ord306 ord520 __vbaStrFixstr __vbaForEachCollVar __vbaBoolVar ord307 ord309 __vbaRefVarAry __vbaFpR8 __vbaVarTstLt __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaNextEachCollObj ord525 ord632 __vbaVarCmpGt __vbaChkstk __vbaCyVar __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError __vbaExitEachColl ord529 __vbaStrCmp __vbaAryConstruct2 __vbaVarTstEq __vbaNextEachCollVar __vbaObjVar ord561 __vbaI2I4 DllFunctionCall ord563 __vbaVarOr ord670 __vbaCastObjVar __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaR4Var __vbaR4Cy __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew __vbaUI1I2 ord601 _CIsqrt __vbaLateIdCallSt __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaStr2Vec __vbaUI1I4 __vbaExceptHandler ord711 ord313 ord605 ord712 __vbaStrToUnicode __vbaPrintFile __vbaDateStr ord606 _adj_fprem _adj_fdivr_m64 __vbaI2Str __vbaFailedFriend ord607 ord608 ord716 __vbaFPException ord717 __vbaInStrVar ord319 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaDateVar __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen __vbaVar2Vec __vbaVarLateMemCallLdRf __vbaNew2 __vbaInStr ord648 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 ord577 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord610 __vbaVarAdd __vbaLateMemCall __vbaAryLock ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaUnkVar __vbaVarTstGe __vbaFpI4 __vbaVarLateMemCallLd __vbaVarCopy ord616 ord617 __vbaRecDestructAnsi __vbaLateMemCallLd __vbaR8IntI2 _CIatan __vbaUI1Str ord618 __vbaAryCopy __vbaStrMove __vbaCastObj ord540 __vbaI4Cy __vbaStrVarCopy ord650 _allmul __vbaLateIdSt ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp ord580 __vbaFreeStr __vbaFreeObj ord581

navigator.ico

SHA256 3def1f97c65b6ba6cd0ae2828f25ce79ba4c72591c78ecbf2a47b9f7cf56e3fc
MD5 c27322a57b70d220423b344b67f697c8
SHA1 155a335440a734686c7d9ded93fadb1f4a7bb3d0
SHA512 8874b3bc418e42525a66211598f3cd2dcbc8770d1efacf4c49e9771ba6e16ae50c1fff2ae470d782b38f2907cf6f7d7ed0b1def1ca4d001d71cb1fda7eeda003
MD5 SHA1 SHA512

NSIS installer

installer

nnlogon.exe

IMPHASH 0f6521efe2d57b917abb4225eeeffdc8
SHA256 8a730e05ec59ca9c2bea7b950b7178c5174da28d0843ba1f3f10b47e352b219d
MD5 4f8ec9279ce71a9feafd811a2a0fe8fc
SHA1 8c5e103eeb3dec74297b41739a28eb0c1b4d0478
SHA512 61c0b531b0530afba51138bc8d876a715e059fa716652b9155bead099c1e6dea9a972f219bc593d6e0ef4d7bc849a9108cb6cd99eb72e61d8d0f45e3199908c9
SSDEEP 768:G1UEOcy9lHXBT/J33p47yTeXeJIYwnbVYcWB5vUL6CdLQC2fQEH:G1UMERp47yTLJGnbVYWL7dLAQEH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10894

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

DeleteCriticalSection GetModuleFileNameA InitializeCriticalSection GetExitCodeProcess WaitForSingleObject FormatMessageA OpenProcess Process32Next ProcessIdToSessionId Process32First WritePrivateProfileStringA WriteFile GetModuleHandleA GetVersionExA WTSGetActiveConsoleSessionId GetLastError GetPrivateProfileSectionNamesA lstrcpynA lstrcmpiA GetPrivateProfileStringA Sleep EnterCriticalSection GetLocalTime CreateFileA GetFileTime CloseHandle FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileA CreateToolhelp32Snapshot LeaveCriticalSection RtlUnwind GetCommandLineA GetVersion ExitProcess HeapFree HeapAlloc InterlockedDecrement InterlockedIncrement GetCurrentThreadId TlsSetValue TlsAlloc SetLastError TlsGetValue GetCPInfo GetACP GetOEMCP TerminateProcess GetCurrentProcess UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers MultiByteToWideChar GetStringTypeA GetStringTypeW SetFilePointer LCMapStringA LCMapStringW SetUnhandledExceptionFilter IsBadCodePtr GetProcAddress LoadLibraryA SetEndOfFile ReadFile

advapi32

LookupPrivilegeValueA DuplicateTokenEx SetTokenInformation AdjustTokenPrivileges ImpersonateLoggedOnUser CreateProcessAsUserA RevertToSelf StartServiceCtrlDispatcherA CreateServiceA DeleteService RegisterServiceCtrlHandlerExA SetServiceStatus StartServiceA OpenSCManagerA OpenServiceA CloseServiceHandle ControlService OpenProcessToken

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

nnlogon.ini

SHA256 258f40fc4beb20611b8deb813c4dbe3ed1703bbe77d645128b4834695bc491c5
MD5 12f559c0ac1e5f955a36eaa33e1ed037
SHA1 658ee97061327975e7da5cc808ac473114000e32
SHA512 f8a345ee8fd5a5690e50761fc93135ada07ecb6d24ece25a767fd119651e4829d0de3c8b60509ace3081478b1bdb4204e0ea0bfa3f668685b2928a79c3094098
MD5 SHA1 SHA512

NSIS installer

installer

ntmEnd.exe

IMPHASH d0fb765084a07b4713899c8666b1c17e
SHA256 8ca20b7266869e61c89e8fe518f346b6ed995acf975cecb7b3285e2904cf86af
MD5 ab03bef566e8703f78d69cb08684efa0
SHA1 86783b312c751df73a4714c66627cced3c55de85
SHA512 d36384e92883278bc166d51a31a424a9276800c6257b065f1d208d845e1c5c9892e8d67a4a96dd1dc9266906073f7f9bd89fc4c8c42b5e2aaafea26e9600f74d
SSDEEP 192:Au+VfsLSl3P3K9IxQDKH+Tw0Pk+KcI6CkwJACVD9SfR0FaW0yRK8M:m29ISDKHyEOuJ3MW0yRvM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TerminateProcess

user32

FindWindowA GetWindowThreadProcessId GetClassNameA

msvbvm60

_CIcos _adj_fptan __vbaVarMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaFreeVarList _adj_fdiv_m64 ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaLsetFixstr __vbaSetSystemError _adj_fdiv_m32 __vbaAryVar __vbaAryDestruct __vbaVarForInit __vbaExitProc __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaStrFixstr _CIsin ord525 __vbaChkstk ord526 ord528 __vbaGenerateBoundsError __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaObjVar __vbaI2I4 DllFunctionCall ord670 _adj_fpatan __vbaLateIdCallLd __vbaRedim __vbaRecUniToAnsi _CIsqrt __vbaObjIs __vbaExceptHandler ord711 __vbaStrToUnicode _adj_fprem _adj_fdivr_m64 ord608 ord716 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaUbound __vbaI2Var _CIlog __vbaErrorOverflow __vbaInStr _adj_fdiv_m32i _adj_fdivr_m32i __vbaStrCopy __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaI4Var __vbaAryLock __vbaLateMemCall __vbaVarDup __vbaStrToAnsi __vbaFpI4 __vbaVarLateMemCallLd __vbaUnkVar __vbaLateMemCallLd ord617 _CIatan __vbaStrMove __vbaAryCopy ord618 _allmul _CItan __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj

ntmurl.dll

IMPHASH 2e845afec111d03ab7afda2c15e4dae5
SHA256 1003a84d5e1e35e0873ed0b6ed184e7348480184beeb714ee0e65107edfdbb3e
MD5 3984956c55c48b8822e908df7fe019fd
SHA1 2e68f7b39e9ba71aa673c54ebbad7233218590d9
SHA512 44180b1705b60782a5bb7ff3f371ab55de7c012006e8659a15af03f35dfe15729493083de03047d12898248f5802f2f4f4759eef0dcece4bee92f0153c40172e
SSDEEP 3072:pdNVHMZC51dzABC8e/zTqqfiZIE8+i8nyP2PaxxG9p:phsATqqiZIEHyeizGv
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ee:2b:3b:21:1c:15:f6:7f:0e:2c:8f:ee:56:da:99:fd:fb:39:dc:5c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Chains

Oct 13, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Serial Number

40:9f:a8:40:e5:fe:40:9e:c5:c4:87:4e:39:4e:b6:50

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 14, 2011 - Mar 15, 2012

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

11216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

CoInternetParseUrl

ole32

CLSIDFromString CLSIDFromProgID CoTaskMemFree

advapi32

RevertToSelf GetUserNameA

kernel32

GetProcAddress GetSystemDirectoryA GetCurrentProcess GetTempPathA RtlMoveMemory GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA CloseHandle lstrlenW

user32

IsWindow GetWindowTextA FindWindowA AttachThreadInput SendMessageTimeoutA SetForegroundWindow GetWindowThreadProcessId IsWindowUnicode GetClassNameA RegisterWindowMessageA BringWindowToTop GetForegroundWindow GetParent

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaVarTstGt __vbaStrI2 _CIcos _adj_fptan __vbaHresultCheck __vbaStrI4 __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLenBstr __vbaAptOffset ord696 __vbaFreeVarList _adj_fdiv_m64 ord512 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 __vbaStrErrVarCopy ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaResume __vbaStrCat ord660 __vbaLsetFixstr __vbaSetSystemError ord662 __vbaHresultCheckObj ord557 __vbaLenVar _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release __vbaVarForInit __vbaForEachCollObj __vbaExitProc ord300 ord301 ord595 __vbaOnError __vbaObjSet _adj_fdiv_m16i ord303 __vbaObjSetAddref _adj_fdivr_m16i ord304 ord305 ord306 ord520 ord307 ord309 __vbaVarTstLt __vbaRefVarAry _CIsin __vbaErase ord709 ord631 ord632 __vbaNextEachCollObj ord525 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaExitEachColl ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 ord560 __vbaObjVar ord561 DllFunctionCall __vbaCastObjVar __vbaRedimPreserve __vbaLbound _adj_fpatan __vbaFixstrConstruct __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew _CIsqrt ord310 __vbaObjIs ord311 EVENT_SINK_QueryInterface __vbaStr2Vec __vbaStrUI1 __vbaExceptHandler ord312 ord711 ord313 __vbaPrintFile ord605 ord712 __vbaStrToUnicode __vbaDateStr ord606 _adj_fprem _adj_fdivr_m64 ord607 __vbaI2Str __vbaFailedFriend ord608 ord716 __vbaFPException __vbaInStrVar ord717 ord319 __vbaUbound __vbaStrVarVal __vbaVarCat ord535 __vbaDateVar __vbaI2Var __vbaLsetFixstrFree ord537 ord644 ord645 _CIlog __vbaFileOpen __vbaVarLateMemCallLdRf ord648 __vbaVar2Vec __vbaInStr __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i ord573 __vbaStrCopy EVENT_SINK2_AddRef ord681 __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 ord577 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord104 ord610 ord105 __vbaLateMemCall __vbaAryLock ord320 __vbaVarDup __vbaStrToAnsi ord321 __vbaVarLateMemCallLd __vbaUnkVar __vbaVarCopy ord616 ord617 __vbaLateMemCallLd _CIatan __vbaUI1Str ord540 __vbaAryCopy ord618 __vbaCastObj __vbaStrMove __vbaStrVarCopy ord650 _allmul ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp __vbaFreeStr __vbaFreeObj

ntmurl.exe

IMPHASH 36236f3377aa689f7f81d6f5aac47359
SHA256 9f0e364297feda755f3b134b0db882369c3b6ca1985691c49f4b3bba02c7f316
MD5 8ad6d0d50e3b19f6b4bee7b9bcba2c73
SHA1 d1b1ce5e137f15b2d11261879139b4d078b5f734
SHA512 64ccd7f2aa385d6be9755432a48805519932cc220db7581daa3cb8123678d5433529c7f6b94eed3e319fad3781941356740eded95ee5024a788860d373b3a8fd
SSDEEP 6144:nfWUIstzkIotRfXZpMTjlhbIhPdoxVRXzJlOBOxuewBuo:+tsmi/YFoxVlJkBOxuDB1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

22:c2:b8:56:0e:f4:9e:29:b2:97:16:4b:dd:9f:a5:37:4a:04:37:a0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Chains

Oct 13, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=(주)링크프라이스,O=(주)링크프라이스,L=kangnam,ST=seoul,C=KR

Serial Number

40:9f:a8:40:e5:fe:40:9e:c5:c4:87:4e:39:4e:b6:50

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Feb 14, 2011 - Mar 15, 2012

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

18536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

version

GetFileVersionInfoA GetFileVersionInfoSizeA

urlmon

URLDownloadToFileA

shlwapi

SHDeleteKeyW

advapi32

RevertToSelf GetUserNameA

ole32

CLSIDFromString CoTaskMemFree

kernel32

GetProcAddress GetSystemDirectoryA lstrcpyA GetTempPathA RtlMoveMemory GetPrivateProfileIntA CopyFileA GetModuleHandleA FormatMessageA LoadLibraryA GetWindowsDirectoryA GetCurrentProcessId FreeLibrary lstrlenA Sleep CloseHandle ExitProcess lstrlenW OpenProcess GetExitCodeProcess TerminateProcess

user32

GetWindowTextA FindWindowA AttachThreadInput GetWindowLongA SetForegroundWindow GetWindowThreadProcessId IsWindowUnicode GetClassNameA SetWindowLongA SystemParametersInfoA SendMessageA RegisterWindowMessageA BringWindowToTop SetTimer GetForegroundWindow KillTimer

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaHresultCheck __vbaStrI4 __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaStrVarMove __vbaLineInputStr __vbaLenBstr ord696 __vbaFreeVarList _adj_fdiv_m64 __vbaAryRecMove ord512 EVENT_SINK_Invoke __vbaRaiseEvent __vbaFreeObjList ord516 ord517 _adj_fprem1 __vbaRecAnsiToUni ord519 __vbaResume __vbaVarCmpNe __vbaStrCat ord660 __vbaLsetFixstr __vbaRecDestruct __vbaSetSystemError __vbaNameFile __vbaHresultCheckObj _adj_fdiv_m32 __vbaAryVar Zombie_GetTypeInfo __vbaAryDestruct EVENT_SINK2_Release __vbaForEachCollObj __vbaVarForInit __vbaExitProc ord301 __vbaOnError ord595 __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaBoolVar __vbaStrFixstr ord307 __vbaRefVarAry __vbaFpR8 __vbaBoolVarNull _CIsin __vbaErase ord631 __vbaNextEachCollObj __vbaVarZero ord632 ord525 __vbaChkstk __vbaFileClose EVENT_SINK_AddRef ord527 __vbaGenerateBoundsError ord529 __vbaStrCmp __vbaVarTstEq __vbaAryConstruct2 __vbaPutOwner3 ord560 ord561 __vbaObjVar __vbaI2I4 DllFunctionCall ord670 __vbaFpUI1 __vbaLbound __vbaRedimPreserve _adj_fpatan __vbaLateIdCallLd Zombie_GetTypeInfoCount __vbaRedim __vbaRecUniToAnsi EVENT_SINK_Release __vbaNew ord600 ord601 __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStr2Vec __vbaExceptHandler ord711 __vbaPrintFile ord605 ord712 __vbaStrToUnicode ord606 _adj_fprem _adj_fdivr_m64 ord607 ord608 ord716 __vbaFPException ord717 ord532 __vbaUbound __vbaStrVarVal __vbaVarCat __vbaDateVar __vbaI2Var ord537 ord644 ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec __vbaInStr __vbaNew2 ord571 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy ord573 EVENT_SINK2_AddRef __vbaI4Str ord681 __vbaFreeStrList ord576 _adj_fdivr_m32 ord577 _adj_fdiv_r ord578 ord685 ord100 __vbaVarTstNe __vbaI4Var ord610 __vbaLateMemCall __vbaAryLock __vbaFreeVarg __vbaVarDup __vbaStrToAnsi __vbaFpI4 __vbaVarCopy __vbaVarLateMemCallLd __vbaUnkVar ord616 __vbaR8IntI2 __vbaRecDestructAnsi __vbaLateMemCallLd _CIatan __vbaCastObj ord540 __vbaUI1Str ord618 __vbaAryCopy __vbaStrMove __vbaStrVarCopy ord650 _allmul ord651 _CItan ord546 __vbaAryUnlock __vbaVarForNext _CIexp __vbaI4ErrVar ord580 __vbaFreeStr __vbaFreeObj ord581

sslaunch.dll

IMPHASH 6ffa5f5d1228a2c4756bfa1b12af339a
SHA256 572b99582027ac31ea036ddb8066bb4118e7c44ab98125a35f863cc710a4ebcf
MD5 412706c54d6ed78c5cd624dc55ef293f
SHA1 a4edb4fe218916ed2294458e7829ed608d6eb4f0
SHA512 1e8fb64759f17223f93260ce27d6e877ff8f704391703457e52925582d88b1b094f824708157aa336291cefff478041986a223ee5ffc03af1b6c9563512bc6c2
SSDEEP 768:Kb2Dit2ndfPVoTXTrYTxx7kw0wgN8OJ96/P/LQvsbA:Kb2PHKTXKmw0wgazQvsbA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject FormatMessageA GetLastError OpenProcess GetExitCodeProcess ProcessIdToSessionId Process32First CreateToolhelp32Snapshot GetLocalTime CreateFileA GetFileTime CloseHandle FileTimeToSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime Process32Next DeleteFileA GetStringTypeW GetStringTypeA GetCommandLineA GetVersion EnterCriticalSection LeaveCriticalSection HeapFree InitializeCriticalSection DeleteCriticalSection ExitProcess InterlockedDecrement InterlockedIncrement TerminateProcess GetCurrentProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile HeapAlloc VirtualAlloc HeapReAlloc RtlUnwind SetStdHandle FlushFileBuffers SetFilePointer GetCPInfo MultiByteToWideChar LCMapStringA LCMapStringW GetACP GetOEMCP GetProcAddress LoadLibraryA SetEndOfFile ReadFile

advapi32

LookupPrivilegeValueA DuplicateTokenEx SetTokenInformation AdjustTokenPrivileges ImpersonateLoggedOnUser CreateProcessAsUserA RevertToSelf OpenProcessToken

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSQueryUserToken

tagstemp.mdb

SHA256 504890d04367979ba23222b15892df6b75f140fde436219bb4d49ac5e949597a
MD5 499943ab2d6a704f9d7dbb8ec1aeed61
SHA1 f98e08c95e7229e3e32d587e061c8548e0e4d411
SHA512 c4c7d8ec105fc77e6e109fb1e6aed317a41b794b2c87d55d84e23e74fb4fca546f8e95b590fdedbfbd3295f0ee08bb6cca2f8979022ced29e62a6851f26b2d3d
SSDEEP 384:d+9M0+Ude3Lud8VyXQR2N0P8428riVHY1cFvBE6W:d+F+jLwQR2NEUE6W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 0f3803845427e12de89862bf806efe0c4744729dc796397910192fbbf2a4e335
MD5 d9f6fc53bdd3f32fd1f11f6eaf1615b1
SHA1 88c99848cf141b9b533f65206cdd9ef10453ad06
SHA512 7c377c9241571cf5f4e93c99f4db0dffcf4c363b71b4650b5b200ed38a1985d0a7657ffdc9caf210a802b11673993fc14f4bcd6aeb41dc5e47726cc78250d95f
SSDEEP 1536:cpgpHzb9dZVX9fHMvG0D3XJMgdLeAyNTHf2N:qgXdZt9P6D3XJMceAuON
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urld.exe

IMPHASH d1b5b04e15c76b3b2b1da01ca25c6614
SHA256 e56aa545162c1da6c7ff2b9ae7df78eb7adfa99c9648a6a6c013ff28e5246f82
MD5 2b44719cfe2006f025445f2b62bfdbaa
SHA1 8114afce7e26087e398ae1103c6012139a564242
SHA512 12297a70cab4b2d4530b666f2a6449221c476de5763c0ed56d33da94ebcc568f192332bb2a7b13a1702e84140b5232bb4feea304b7d224a241db26db01a5a97d
SSDEEP 384:2GAqrVdL9+3K9DhDu2fkSfD/DK0Sn1We9:2GAqr/LvjMSrLAb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer