18677673a4fcc32c112683be8e3fb132_JaffaCakes118

resource	yara_rule
static1/unpack001/kailleraclient.dll	acprotect

resource	yara_rule
static1/unpack001/kailleraclient.dll	upx
static1/unpack001/mame32k.exe	upx

resource
18677673a4fcc32c112683be8e3fb132_JaffaCakes118
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/kailleraclient.dll
unpack002/out.upx
unpack001/mame32k.exe
unpack001/uninst.exe
unpack001/zip32.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IMPHASH dfb06052e74b26a42b0e490bd1c07959
SHA256 dbb4b94d0c47becbc462509af38fbc1a38a91809b44d318260e6a3c6e846749f
MD5 18677673a4fcc32c112683be8e3fb132
SHA1 32509dc3c7ef6f168208bc6113c39366430a7049
SHA512 bbf7d37bd3a60bf31e6b897f8ba073ae19730c1046997aa329f5ef5b2d9b1c5bb084e7c4776a934d324a5c834e4cd509e3731175802976ee5b89f3523de8e8fc
SSDEEP 196608:2WRlNkD3533EKQTzzDXMyUY/mB1iq67CPDKFXdim5BlIjdfZQ/dCXx8X0D47tNX1:2WcEHLXMyUY/6iD7CPD8d/5IzaJvBNX1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer MulDiv FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData RegisterClassA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA EmptyClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetForegroundWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/BrandingURL.dll

IMPHASH 135de77644e2add2fd9dd8176740e7e0
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 ead5ba6e0d1434f293d705616e946fc341cb933dea614f5435e343f8671505af
MD5 3ddcaad323608a3c4335cd21ec2a6d10
SHA1 558324adb1728b1d5b24cd0e407cafa4adc3465c
SHA512 09c18d87806c23055f70c01f72aab6f462b69ba2d6ad0de225d82c7f32f01337e19137a63f76728bde5fceb69593e518f1fd02622b55695766148a3aa2e7766c
SSDEEP 96:bPqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqS:bA/3qvcKB7QOwnZiHxwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 b2a7aa2f785e542c0f51c8329ff6ed30d19e01c7d9dbb547172c992ace132835
MD5 fc096fd1aa92908f2bb8cdb6b2ac25f1
SHA1 e96cdb30579931a51f7d604775ff94b12bf766be
SHA512 2dfee4d4648554b9c1f6071a1b7ec3104f9925c8d1df2eb35c9ae567b5a9f62eb84120513a26684f8586fd7544e172c5982015843aa5f1ba838e9f0247df28aa
SSDEEP 3072:fOP7oH4SggTKBpOxIAGExi06kOBMTAlDYo549IznV+1qqfTR7/cVTkjuR:fNEIc6eBMTAlDYooonV+4qrRTcZk0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$SMPROGRAMS/Âå¿ËÈË2/ÐÂÔÆÈí¼þÏÂÔØ.lnk

SHA256 c755fd0b870f2367e644f899afd720c4aee7b019b5584a14421c407e7910de14
MD5 4c2a7c403e0c28333f645a363f606da8
SHA1 fe61f5e318e323fab9af329245e4bba6128aa5c6
SHA512 8516481f41413d3ec958a07af39aad889840f964d7cb1f8027142f9c65abea9821e3bf2fcfdd9fb2b1c676031d3096d478bf06586deaaac05a7d451b0c2146e5
MD5 SHA1 SHA512

NSIS installer

installer

MAME32kui.ini

SHA256 c89be839df206e4b71106d9640b6f2c89ad12161509b970a7d28d2ddfe239009
MD5 749de8c8e9012a6659feb4a1eb3ff258
SHA1 3a4b23da7cc56b476a1c2bd45e10d9cd1b04a7f0
SHA512 07284771837f3fa02d00fde81c390f14cff0bcda201c7ce61e696b44e7b1700048de20d724b2c5cd09aabba7021adc0c3f27b9776cd0d791c88f0a2bdd9f4acc
SSDEEP 768:BxrrggRxIiAWBBy/LghJx8ZnafpaJ0mCJqN8GUkKao88yfpIxZHZsZiKKIK8k3WS:HKGhy0mhPHNRIxZHeJ0Rj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Mame32.chm

SHA256 ad8b509ca1471c69c052230777cd14a5ae947e9e9a2ab3553be797c3b9af80a5
MD5 a197174720acb2e0917253e6c983ddb9
SHA1 707dabc9c496239d818f57d6dcc9029350adfbe0
SHA512 6952c3e703feee7e96e4a12e6443322e8629aa74104d806e6363d03eb79d6c9f309661d50f50257b4a526ca3b8dfdd7ef3e02fc096942686e1d25dcc9c957ab3
SSDEEP 3072:0+QtQ9EkuJDop9QuUdr2pwCGTC+0vCC0PzJYOwMsU:0+QtQif+p9QttEXh+KezJH5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

cfg/default.cfg

SHA256 ba2e3b135c20a056b75c0039b1ed5d34bf76c89d10166c3cffe7ba4ccaba19ce
MD5 5beba435cd219c3abed19b1e69d8e1a5
SHA1 0945b68d75286c21062b87b6fbceb4398fa965b9
SHA512 8b7eb675062aba2507d9177566176274b17350e2c5c3ecacf052469184abd57e9b5d19b04d594266db87abda3a84aacf4120768bb64b4a58fb01089a0d70bbbf
SSDEEP 96:QhDGokqhg7z6Aa+nazIBulIyO1/jVM1vPd2iuthhyya/zUhEyY/32/hEyO/rYhE7:SGEya3lIyEM1vPddJyobya2ayEPy0V2m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

cfg/megaman2.cfg

SHA256 6862b877faad106267fc07f4c0ef86860c1ccc924a1fdc8a01527d155b0657b7
MD5 c8ef4a843c65cc7631c2a2aa8cae5e35
SHA1 3461609490449f623f40b544b9c2bfd3d0cd1617
SHA512 d1eb3b0b90f5a01ca6ff0496516d386c6ae4b8b626adb75e24efbbd792073e2c954a12c25ea94344bde11f63ebacdbd801bb5a4a778a3ee77df5d31aa69f5466
MD5 SHA1 SHA512

NSIS installer

installer

ini/MAME32k.ini

SHA256 0b54ea91837b6abd56762d64f9f205ad81c321c0beb3d6fc03a13220a6db5acb
MD5 8591545071f3cdf561ac40bc171c0954
SHA1 99afae7060df1a755315cde98a4902da5e7715a1
SHA512 0309b6bb3c08f1f257d36ab4fa0104b2609cb0a827f3c07a78dec943b858a075ab6ff3dbc647b1511c5aa9acc1cc9823f70b5cde3ace07d1bbc86960f87efcec
MD5 SHA1 SHA512

NSIS installer

installer

join.wav

SHA256 8ee15241a69eba72e79bb95a4c63136ccbba216ee65d7c1902fdb26a2cf8f365
MD5 0104677c700a9999f142d9eb3bc3461a
SHA1 7a9786ada75896a4dadb859ce84700c06e4ecbeb
SHA512 498ab62eb1f53d6ca25851c7693850ed7e108980d4514effa200d82a0671e8edcf0b34f25556c94e5c59fd3184d60f40333c5b102170ce5a555bc5299be1b4ee
MD5 SHA1 SHA512

NSIS installer

installer

kaillera.txt

SHA256 0a542524b0165b5322f6863e8d9a56a76ac191fd66b170be5c3411b1fcbc9885
MD5 f94d99db5bae4aef55243a50f7f1f99b
SHA1 2683dfc0b204858ac5936da305b8f353dd046459
SHA512 c9c4a008a865c6a5b873fc79b3fcf76424752a8b5fe70863e67217be625940545d1b0c1cbbfc947015465537f99b7570d889007947200bf9a36d71ce62181713
SSDEEP 192:eM7Bnyle43UegppJtGCWNjlunq9QrDeAa3d:dyhXgpftGiECeAu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

kailleraclient.dll

SHA256 454440aeedb3b569bf49f11c953d0d5bb8ba42ff60d58c8ae6696eecc920280e
MD5 919aceb24360595da69d975e08a08ea5
SHA1 15d2a05133047fabeee62de7d5df533106d29f2b
SHA512 358fbcb31db1ab882c9ed7415be96962f5a22eec6417ef1537dff95271cee3cb4f7c8eb7685b8f5cdce316d530ac23ff303ace68d2cf83d8decb221b6789dbcb
SSDEEP 768:2LiLjbKGY60H17PJc/TG0BXOZDRmDOCjq/:UK/Oh17PeqAgDRmal/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

88528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 7fdc9b7b4fdd5e97bbe7e7afed76368b9fea3a6337520401d5791fbc136de0c7
MD5 7786b6f2a3c3b1a997c3303d8bb1aecd
SHA1 c6e0407284406d1eb0d0d695fa973df677009d84
SHA512 2c6ab86bb7783e0c1c21aaa64591ae02d76e85b968d5eb678ae354359220c66fa1406c420e50a24bfb39fe1aeae936c7a55636cf2e87f19e7b4e73fdac4ef49d
SSDEEP 1536:gAtzMG+p78mPwxvw3o2sPKDLPgC9Kgz/:dMh0YIra
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

51339

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mame32k.exe

SHA256 bc3195c50eac0cbf4591bea14aa5666b7ec71c7a0c3185a4dd3a77608442726a
MD5 635f4bedc82b1f90e40919130685e972
SHA1 4e966f3dd0a3f4018f0af3e936deab90df6b9e70
SHA512 8f47d846afeffe4b0221ba9228588fbda11051040526c2194e313763b1ce9499443f80e223759e39ffcd8c36cffbacc82d7da5a73cf75e9e108102ce3b7f240a
SSDEEP 49152:JYjAmLixk+br/lLH6CHBXB5tus9x2gLoMRRcU8SsdU6un+vQIas3uG0KbN:JY1ck+f9zTBxjnL2JU8e6pQM3N
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

19831920

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_DEBUG_STRIPPED

PDB paths

nvram/megaman2.nv

SHA256 7242b44fd3fc4486c4480fddbaf5bac03f8a16ccb99d561fecffba1b28d8fc5c
MD5 9d37f53a922db5492392c88e94a98e5e
SHA1 cce869453a8af8e212d775bd402b5fac50bb091d
SHA512 2d4bf4eec58fe3ac43fb2e2f4337e9956e1a3226ab3fceecf3f5a1d0e2faef3c104126042a30a3a1835672c57d76b2319ad34a83ba0e69746072cce8864a6992
MD5 SHA1 SHA512

NSIS installer

installer

readme.txt

SHA256 14e67ec1988313432b1b97d9850f40c4c2d7116a90843e0e535b93bdb0ff5d76
MD5 b6dcdf56988c8a561144729bccace158
SHA1 93963b96bab37f4eaa87963b2a61149330761c1a
SHA512 ecc7bc676e26cbf8309f8405c0d98194b86e22233f9a0b393ee74ee6ea9bdccdc33de4f47f8c2d5fb88e5e0f70d907d37ba1559fc3bf384ca170ed3175c0723d
SSDEEP 384:r5lWS7GrmOP+l+43sXdu+dRt5KltlmYfL7W32frMXkK:r7D+mOP+l+43sXd5/kdfbfrukK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

roms/megaman2.zip

SHA256 4ce1cc1a2ffdf74fb62e18b08719aebac4d46cc803db06d3359dcccafdff4a9e
MD5 ec529d013ee925708ceae170a9986c92
SHA1 07e299bdc31fcbe21c5bc5d5ca78343f1170486f
SHA512 1cf7160c27b11d6b8c9c6a803d34ee5d0701e05e33d67f862af58de35f7dc1c4bedd2919176e3e931f73b0f270ada4a40e198399e012bae7a01ba08d5c843506
SSDEEP 196608:1XK5l13fIleqkYFei1AeZh0M6yLErBt3uaBuJQ16G:1XK5lhxq9FQe30ZlBxPB0Q1v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ChinaEmu.nfo

SHA256 5c26a7bc36e4effb53473d4c438a4a20595f7286573b9834f47138aa5f47181a
MD5 e3b04fbbc0cdbc23691f2d6af6e877be
SHA1 8482201ce9019acea5b1a7504f4ff3bfe0df7a91
SHA512 8e08b4a811a42410a367984f08cbca394d2199a1686ca3b3226af98ece3d664c45ce8b284be4ae57c503a5a976957c8072351333ef69651cc5e722e803c5a444
MD5 SHA1 SHA512

NSIS installer

installer

read_me.txt

SHA256 ac5aa12a2678c408130755ed7b957470c4ff4b057cb5ba0385fd6b16b226906c
MD5 f92bd70032e4af479022fb22c3059f3c
SHA1 2a821e4865a21d3a5571c5c729b5a83e28480d9a
SHA512 0a9a070f3f321246f1ba123d92f505f45258bfa52624ee97b57f64b47db2a2b2ebae2599c2445f36f94333c958b186b0d62bb755b008699501ec7804accc7f54
MD5 SHA1 SHA512

NSIS installer

installer

rm2.01a

SHA256 3f6dd3b0be9d339a55e515015999db46ef6193025de170409382d7c5ccc64b36
MD5 3577aae2e8f5adc82d33b93e54268cea
SHA1 0939fac70042d0b4db5c2fdcef1f79b95febd45e
SHA512 c2f80746f44c3408ba640c329a8755f0cd6e09d1a14eb3c1b882726bca880f5d11640d0b6465b100c66f315e76e3c5bc3d352682f113b9a0399fbd4200c87582
SSDEEP 1536:u2KGm9hj4FUJf/Soec/dLJMLPXY9IK16pAdDMhC5o61dvq1kSbtI:Vyj42fqXcVLKebwAWhC6D9bS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.02

SHA256 0a0df7ef5deb63066341db69eda4ef4cca1999efdda115e4a76ff9a7be40b518
MD5 8da722a33d3cc70eb51b2142d578c8c7
SHA1 5c3e41eb61610b3f8c431206f6672907e3a0bdb0
SHA512 a15c77d6c91668a439b093485f17201bfb67d00c2a7572cfa7ae8a8e0a20f9b43b2199c67ec8f7cf291d1b45ee462f121be39275abf4d9286ac0b77908f52cea
SSDEEP 768:oEypy4GVnGP+U5ZbLT/sOjNr95G5XiZ/8OTmYGBkpLw86w23Px4QH:BypcYL5ZbJC8K
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.05

SHA256 28989cd3f92834b08251ab2bb0e04e9f525fb4db86654e35151970178bb0bea3
MD5 ceb4d15a51a1826f107249c390a904db
SHA1 1b80c40389b51a03b930051f232630616c12e6c5
SHA512 ebaab624c8a41d27eb9865009d1e3145292e65aba0bb791616fb3b949b9b983537dd05d0a7eb213a72248ec819476f30dec3941cd363c75715224573c661a307
SSDEEP 3072:Mh90TsN5+ETmfkEk8zh9XzP5BsB7GY6pAanND4FFbU+YUM8wmVgDsVUlfHVtU:MWfMub5BsipA8NELFgQV1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.11m

SHA256 89793aa84d6646f19a0d6afcae9721b2906b12e6fc69ec7f6c1c7a4a1df99b74
MD5 51b67812c6e09e6767899c569156a63b
SHA1 0a35d9ca8ebcad74904b20648d5320f839d6377e
SHA512 3be6b866f8ca24cefa9f3d23e64c40f56ed3e621fa89336627a9b936cb3353c5f5b8889aacd9334bd2f07149dff623564889fb1df653653b29556760753e71cf
SSDEEP 49152:uTCaEXP6tMjZHBz8sE0Sp8qopMo3EiKg4bBH8OTkcEMveBsjt5gQl/W1m8uBz30:uCaEXP2MjZhz8sE0Sp8qopMo3EiKgQU8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.12m

SHA256 4cbadab5b1206ad53e7793015bf034d047238120f15443fb835395214a66f648
MD5 0670bd86d1e34338665f1735d4530a0f
SHA1 f96b172ab899f2c6ee17a5dd1fb61af9432e3cd2
SHA512 13efa1e6e6dd12d7e62631360a1abc39f91db0ec0aaf144b1111cd9616189ef7a1b9214f38b457a058794a62bb8c763728772845899aaa0539ff6cc2d17df206
SSDEEP 49152:WHtF7nHYflZvjur0TxDkwwwVx2iiMotqXorFbUliRMcYPqCDJaRhwDSuJuMiH59+:WNF7n4flZvjur0TxYPwVkiiMo8XorFb+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.14m

SHA256 263c2fb5d31550b31b1e2e1bd725bd528116f8ada998e9bae2ae4ffb1ff03466
MD5 42e007109ff8bb57414b99e3b4cc32cf
SHA1 c1c5c2d9d00121425ae6598444d704f420ef4eef
SHA512 5ce732e790784fce791fbf0b2798dfd3144bd77f7dae6c16e18857e08189cba4fddfefa6d9e670b6cd52716510d188ac9abfbdafb06d49a5153f540bb5c7cb71
SSDEEP 49152:nitDnOy7XlPeOYP/f+YjNWLsdPD/IsPZ7HcucIoGxzq27+CrQBaT9xy4j3ou4/vv:itDnOy7VPeOYP/f+YjNWLsdPD/IsPZ4z
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.16m

SHA256 683c25f63d77ba8f6206393667b8d7ab1762522f711599cd4f977863ee01dae8
MD5 ca7bcaa5d4d2207fa78364e2b7623454
SHA1 38724c49d9db49765a4ed9bc2dc8f57cec45ec7c
SHA512 0885b4a15b3279ecccfbee99f1eef57d1f09e698cda1279ef7a05c7307c84e3ca7aa1bacd98d4a74f8afbb06037b1f57726cecaefd1d085a1ddd0c02351f83ba
SSDEEP 49152:bO0hPMMMDneXYY4Vyj8tj44E+Q3jDlF27/Eyjk91xPKL:S0hPMMWneXYY4Vq8tj44E+Q3jDlF27/V
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.18m

SHA256 00ed0b744a843b36df66c4e5ce43d444fd8cfd68475f01696842b04148e6bd46
MD5 a2f5cebd16642950d494a61d9af7bc37
SHA1 20cb58afda0e6200991277817485340a6a41ae2b
SHA512 99b512022f2975a900ea599566a69e7cba3f0b20e9ac9f6dd88c4707fab3b9f6912cc36aefcd68340261386bf17e50bc8ebcb209b904e43fc81e501759a5f7c5
SSDEEP 49152:Zh14XuHHBTQmt1bibwx9zIK9Pup2vx1pyAx5oWq7aWxkCumYui2X/xEEo3HxCWSE:Zh14eHHBT3t1+bwx9zIK9PupIx1pyAxX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2.20m

SHA256 a1e059685fd9ba97361e723fc6bb24e62fe933072b885312b31a9aff95633bef
MD5 03e3a8233eea812ff31bca4c4da3784a
SHA1 aeb4acff7208e66a35198143fd2478039fdaa3a6
SHA512 254e20ce2a7532539ac8dd04d021d6527734f2008a3d445e1d55948e33cccf0b4caec72570273e4af17e8e59d7cd6943bd412ba76c4bfa1a1da32bed6e8b9125
SSDEEP 49152:qMMGbujb98ACSGsN5ESjF8vS6SAk6f3IudlZe/WXMxPpTj8:qMMGbYbmACSGsN5ESjF8vS9ARf3IudlZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2u.03

SHA256 d0d05a74c1c24f10e3d2b5e65f76e6a8fc4ff09e5a72dc498c4411ff3daa07d2
MD5 e5dc303e92741cda96339bffb2c873c9
SHA1 919ef08311008288b31ed42fb13172580d50433a
SHA512 6d575916df380c87887f4ba55ca4b432b577c183e17f0b5240596b2c92473dfc229361f890b1e24900ff36eb910c280690f309c88787f32338bb16cf99a400d3
SSDEEP 6144:CG5i0PZ2jE5wpyR1ni/kx0XAfqfrd1CjV4QgaaN0av9678bg02konUlNmlqZd+39:CexspU1i/kiQfw1CpHU0F0k6UUPKvH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2u.04

SHA256 ec53e552e1c7dc330be2be35ab8d44ad676ca597fd60b9fd3177f32c5c6bab44
MD5 220163e44d8ca34e93b5f6a5f2e41a17
SHA1 466b818a01ad367a8df6df8661f616f5a0236714
SHA512 e5bf46d28cff726a0cb9e757ea2312267507ff1cd3f7170383a08fc432727c452eb5a2dcf4ce89056665bb44006bac5be02487984d10af66a0abc5326bc30b4d
SSDEEP 6144:ByTNrfsxh6suMosZOCsTP/0VRYo/IxhLRylnNpwReKl53d2W0Z9M9oYDoefpaqRV:UTNrfsgLRyRG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2ux.03

SHA256 24e6c450d197cc2ca56d3e49778c864d44e031a87a48fe168106fe97d30cc643
MD5 90f5e24b7df4c2bda3fe35c4144b8b86
SHA1 b71779d095556308c6eb9264bfa1e5d269dd3e8b
SHA512 32ae9111efe631163f8cdff2209388980abaeae9dbb214244fd76e6ac80490b11dfe43a97a8a586fcdbb2507af73f92c05a930d1cc314b02cd49cfbda1d9c5bf
SSDEEP 12288:i5ycldg3vT9fv9T4UFPVGuKXp5BYMnbf9xSUd+WZ0o/zTBwgnPcXfTjE:i5ykg3vTTTNhVw9Z9xSo75vkXfTw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

rm2ux.04

SHA256 e998d0fb7b2980cbdf8536822e73499a5acc72aeb01b9ea5e3f5126a482a9ac2
MD5 ebb537871b724f3fdd62d08ab6e3c29b
SHA1 e0831c188816f13b8ce48ded556bb51dd8cd026c
SHA512 5f5802f78d104639ebd00ea09ec4a1d61d09e1cfd45215ff139abba87c54d2f7489f69a108db2d7bfcdcb4fc915b11cf169aa550228ad4e554d3b1089cbd38c1
SSDEEP 12288:XgX+3HLXVuuz/ygQZR1QRDpFx6aqkS9z:XPXXBcMpxUh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

roms/neogeo.zip

SHA256 186f799467ba4a1970430a3135709c66ae7e921abdd450bca68083cb1a2e44f9
MD5 503c6b3d40a5b31edc884d0532f71951
SHA1 6af9979f114aa186463cc089e1a817de0d1470c4
SHA512 6b352bca057ec6d5414516206e5e8a8f20fdcfb430736f9bfd82de7cff07f1adff8eb05d1af827d8cfda399058a1343e366337068255a0b3e71f08b1959706cf
SSDEEP 1536:T2cxK3p2skVYh8YlCJ409T8eeg136BldgpiC/ccgJMvKfCTFhpHjOF:BK3QskVe8sCJt8Fg13MmiNRaoCf1jOF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

neo-geo.rom

SHA256 ae1c5cc9a0acdead8a3d5a16ee84f575582f2209677464b05a2b8b0451f658a1
MD5 2968f59f44bf328639aa79391aeeeab4
SHA1 4f5ed7105b7128794654ce82b51723e16e389543
SHA512 77259946ff012f84fb280534b1a8a8d692424e7fb48c48ceffbb52c403637e2e24c92c4ef7b32b80fa42ef8c60709804c29e52b36d00318b09f8021d808390e4
SSDEEP 768:OO/9WnlTo/MR/a1aJNyCDmVeeSPzd7bLIFnxu2AlqOM77YD+3GAPzvauBneijnwh:z/9WnGUa495mxI4n7PD/pJofbUFsVff
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ng-lo.rom

SHA256 6f01090a5022916154a0eb1cc4eb3a15d6f6da00c0ee6ea73d67830974aa691a
MD5 e255264d85d5765013b1b2fa8109dd53
SHA1 2b1c719531dac9bb503f22644e6e4236b91e7cfc
SHA512 fd0ec0ef2c53d56f1a5bb040c3cb0b5c0fbabe5b8d7a8bfac54bd70963c2e8c5dddebe8c5f460e0a7c930e1f95ba2947ffd6c52acf9bde0589efe0e204c4b537
SSDEEP 768:eItpgxgqgmj7y/yEyAZ9MZMOMO3XaPa8aYRVIJIaIeDLeHeAegFxx:3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ng-sfix.rom

SHA256 a2747cc4a637b7c2814730364016661e3f029a3c1de174b0919fe0324c8da943
MD5 eba274d931f630efbbf723c19fcd8744
SHA1 4ae4bf23b4c2acff875775d4cbff5583893ce2a1
SHA512 afd7ebb928aab75891f1fb2d5adc5286fe2141d8fc8e623b2eb7f57337dceab547471241f17b447fce397460c4e0b88d83b87df54e799c4b01fc8b2b15d8fdfc
SSDEEP 768:+JLIbLoQiYhW1Qe3Mhw1YBinCvEQhboE5i9GtUSG:1bMQ54QNw2inCFbI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

ng-sm1.rom

SHA256 a2963c38861f92252a241ab285ac8144ccd252b5e1593f51f3c0598e85c143c8
MD5 0ebb67f617a0da8209f0e736811bfafa
SHA1 977387a7c76ef9b21d0b01fa69830e949a9a9626
SHA512 7966f1d3b14cff42f6b624f614ebc39f2f4dcc6a32bd7172d9ec3d28232d2ffdf6d1284da431619629fb647d7a0d96306d03eb22a71192c20e34b2b961fa2309
SSDEEP 384:4dd7wDuFuqu4AeB35uY6dfyLBFGdaLbClAw3sHfTaQo:4ddkDUnu4j2IFk16xH2Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninst.exe

IMPHASH dfb06052e74b26a42b0e490bd1c07959
SHA256 fb89af8a9da6bb598d80ce0d9f7fd30153481cb61c84544fe091c41aeb5fdb10
MD5 0f41245212d62872820929a2cf5ec2bc
SHA1 5d232092927a7a8ab1f128610af1b3affd916657
SHA512 a79402a289cb5a8cecbcd7ae816d4bbd3bbda373b57a83d621f28b88bdf63a601c45c6ca8b393704637725496b99a71e103b9a282090b6f7f0793035f846dd00
SSDEEP 1536:shq3+uta99Hj25XvwLXJLiFYRN6QcIwpl6Sx:OstajHKBvYXJLYq44Sx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer MulDiv FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData RegisterClassA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA wvsprintfA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA EmptyClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SetForegroundWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/modern-header.bmp

SHA256 ead5ba6e0d1434f293d705616e946fc341cb933dea614f5435e343f8671505af
MD5 3ddcaad323608a3c4335cd21ec2a6d10
SHA1 558324adb1728b1d5b24cd0e407cafa4adc3465c
SHA512 09c18d87806c23055f70c01f72aab6f462b69ba2d6ad0de225d82c7f32f01337e19137a63f76728bde5fceb69593e518f1fd02622b55695766148a3aa2e7766c
SSDEEP 96:bPqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqqqqqqqqqhqS:bA/3qvcKB7QOwnZiHxwo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

zip32.dll

IMPHASH db1e4d25a40dfd2a9f2ff326c81166fe
SHA256 76a5e818a126e420bff92c0da8faae6987a04fe273388da7d83cba7d30526e0f
MD5 95a9097e1a76dfa1141eb8a6e3094e6a
SHA1 3af4b2116d663dad207ab2aa0994ba78c58beec6
SHA512 df86defc1f2e0994c54b7cf544a892cbc9a743138cb2e38396b62d32e47871410c3b75586be78ba89777674fe1eee15af66407edb460b8db5c2496a62fe11332
SSDEEP 3072:xJyyFyyqlFbPm+lmUE5gV1Y4P4csxMwUtYojrOV/k:DyyFyyqlFbPXlmvo1Y4wNMv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

64409

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetDriveTypeA LeaveCriticalSection EnterCriticalSection InitializeCriticalSection ReleaseMutex WaitForSingleObject CloseHandle InterlockedExchange CreateMutexA HeapFree HeapAlloc GetProcessHeap GetLastError CreateFileA GetVolumeInformationA lstrcmpiA FindClose FindFirstFileA GetVersion GetFileType GetFileTime GetFullPathNameA FileTimeToSystemTime FileTimeToLocalFileTime FindNextFileA GlobalLock GlobalAlloc GlobalFree GlobalUnlock lstrcpynA lstrcpyA lstrcatA GetFileAttributesA GetCurrentProcess HeapReAlloc GetLocaleInfoA EnumSystemLocalesA GetTimeZoneInformation GetSystemTime GetLocalTime MultiByteToWideChar ExitProcess TerminateProcess MoveFileA SetStdHandle lstrlenA GetCommandLineA SetHandleCount GetStdHandle GetStartupInfoA HeapDestroy HeapCreate VirtualFree VirtualAlloc SetFilePointer WriteFile ReadFile WideCharToMultiByte GetStringTypeA GetStringTypeW RtlUnwind FlushFileBuffers GetCPInfo IsValidLocale IsValidCodePage GetProcAddress SetEnvironmentVariableA GetUserDefaultLCID GetVersionExA SetEndOfFile GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW DisableThreadLibraryCalls CompareStringA CompareStringW GetACP GetOEMCP RemoveDirectoryA GetCurrentProcessId LoadLibraryA LCMapStringA LCMapStringW GetLocaleInfoW GetCurrentDirectoryA SetCurrentDirectoryA DeleteFileA SetFileAttributesA SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime GetFileInformationByHandle PeekNamedPipe

user32

wvsprintfA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges GetSecurityDescriptorLength GetKernelObjectSecurity OpenProcessToken

ÐÂÔÆÈí¼þÏÂÔØ.lnk

SHA256 c755fd0b870f2367e644f899afd720c4aee7b019b5584a14421c407e7910de14
MD5 4c2a7c403e0c28333f645a363f606da8
SHA1 fe61f5e318e323fab9af329245e4bba6128aa5c6
SHA512 8516481f41413d3ec958a07af39aad889840f964d7cb1f8027142f9c65abea9821e3bf2fcfdd9fb2b1c676031d3096d478bf06586deaaac05a7d451b0c2146e5
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer