28a913634090f1998493c698e2cfe8cb_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack003/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 be7642ea30ba44cfb03d91f0ffac94f260eafa5f993a9283a36c9f7a520ba971
MD5 28a913634090f1998493c698e2cfe8cb
SHA1 7588ef1c2d75e3c8b7c068d7d4dab4f2c632de0a
SHA512 7b828abc76102ef9eda656200f92f5653af94b971d90ab390cef9748c3c87260a3821d2b67465ba559e00a940bf032ce32fa24a43dd9d69e83b689474aa4b17a
SSDEEP 6144:Ie34MvEq1zQbe9DP3lpr4jAxLY6M+EVagKu:BVzQcbRx9GVPv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

31:82:0f:7c:49:d2:fd:af:de:e5:2f:5b:d6:1f:ef:a5:c0:37:8e:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Media Ingea SL,O=Media Ingea SL,POSTALCODE=29010,STREET=Pirandello 16\, planta 2,L=Malaga,ST=Malaga,C=ES

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/bloson.bmp

SHA256 4c96173bbf38464a389e228d2cbcc07ed0d6999febbf542a80eea8e22d2a97d3
MD5 852dd98c6793cb2083584e3d0ef70010
SHA1 245f1daf2228479a510562c368038654fbf1ef87
SHA512 8f991283f20f6954776ec4200b5c6632e3d7f9ce71147de9ffb282cf3490c902095d187b93b28a6d7aafe9d5b77ba0544f7380b58999b8da9572875fc527b522
SSDEEP 384:FuijHC1EbCjHN+5FJ8pUrw8CpRN9qPeuIe689RN1v5QNwCfwyPpQ:wi+s7S9u+tQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/datos.txt

SHA256 93f85e890edf263917f0337c3185a4ac843113b6fa1dcc48422ca98fc0d027cc
MD5 c9e216032ff9957443915dc747e3dd85
SHA1 f2a573ba60b126a22192f8962f82ffb92a2cc2b6
SHA512 3ef471a73005c30d85f5f516ff5c9e3b225a5968aa7361922422d99139a0b8cd5ba1ced99946a6651dcee5444dcb61fb2d72e7c571af76cbbfb265ea43092039
MD5 SHA1 SHA512

NSIS installer

installer

$LOCALAPPDATA/dealply.bmp

SHA256 0f84e3d4cf457f6601c12f52ea349e803ce12730de38657651b80e6cdcb6d098
MD5 622892e1bfd696d8964c75977e538674
SHA1 fd78c36c6aee910b534d075781869eac5e96564e
SHA512 0504546af904ba9074143173e498c51977c9913733689d1a8d22357e957b4311a62b177c180150f1b8a51986e4669935973f25f3840e39710fe3c167938206a4
SSDEEP 1536:uOPffSTfV5jJcuowkQU2+breKc2ANFDPIsjt:OLYct
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/facemoods.bmp

SHA256 7d6b6e9d5ff4b39c40b895fedf3ca1e1366f602960cb653ee89ea59b5dd811aa
MD5 1d6442c13237dcb3446f30ecc8066a48
SHA1 c9df7681d8a442000aa93401a772160fcf0d4103
SHA512 32ad14ba09c88e37ef3dded57676d45baf4c7a797e9b8921d7c54a3ce55a538f6c932d5e0d326f47b3100a980eee05fbe323a18bc422e6d4e2691613ff3b5342
SSDEEP 1536:HqCXbI0p3Ar2J3S9IRcxtVI5oBo9QqbRQ9EGnC/l:K/02r5KjAm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/lateral1.bmp

SHA256 e9be711645adceef7a7f55ad9b573cf67910c885ebf63024928656823079512b
MD5 09fbaede48cfedb759e640bed10d5dbf
SHA1 e1c0a5a77042595beae53955cad72143aac61045
SHA512 aeb67c0ccfea4b5c09dcbb398be9e863c3c35eb3f9cb8c8eb666e8d69fd00ac6195024e443333ce5645a04b00c38c17182533d9f8ba7312ff446f1be5cba0d28
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLe:mAiUHnoQkU6KCrdD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/lateral2.bmp

SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
MD5 d0d2b5814833b7412a66c89e8b75021d
SHA1 9b6c821d9078aa1054f522d3669686a1f7792b37
SHA512 04e1ae6a68ac73ef37bbe799e95ee6f218b846f129ee29fb7c6f24ea2134074dc88fc038fe67b47e49d7ce0675abb61c697eb54c6d67ac4b88984fefbefef141
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:CcAiUHnoQkU6KCrdD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/lateral3.bmp

SHA256 6b9ca40f2943ce7ca4585cf1d0dda3cef8c96b305a6eb1f4df2686bf10c842ec
MD5 e1ce13e6f1ed1f339f8595ccf9d0198e
SHA1 666997a9f8786074193c6cb2160c2ef3962d3ecc
SHA512 6eb991deee612f18635d84d9d889388e4c8f9d9cd7021bd05a1dce480d067733d7da77c2da96c536ac39abc826188123fabdf3a21ee7da515d2d01a9f97c18f7
SSDEEP 192:mWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2:RGjOTJthkj6K2rQe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/save_en.bmp

SHA256 c8af686faa44b1d9693a4f5aa0e1abc880e2bf75906f6c4dfcf60ccd87ceb153
MD5 415d20830ecd308d3af4a83209dfd3fb
SHA1 b3fd0de9252edaec00fb52836f5241f1d843d7f9
SHA512 f123daa815fc3821220c899028f8c6b4b8f2d324d53a42f9ddb55489236379264831b364c6b5bc850f81fd8a245581d7edf10df4b6c4294d1cba5954192e7f9b
SSDEEP 384:c354b2rREQRMOr5WK8nggvxJlhgeFVi7VZU:n2rRIO8nggvxJlhghVZU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$LOCALAPPDATA/save_es.bmp

SHA256 6ad2e8c78935d0b0e607218122c2d3e02dccd357955787c0e7188e2b21d5939a
MD5 7e0ea73191c835063a351dfc6478934a
SHA1 4ab8318d9ad0cdb21c555ee5d0c22c3060dca87d
SHA512 036d84cc7c4b8c301e6ec9b1511238959e40d40410588e144b50281325d711cf4e7fe7367ce176a922b61b1b070abb98685f9e38a9e323eebbd04fc90b09d504
SSDEEP 384:c33vkad0QYv/nBNUN3i7fBMnylwSi7VZU:daiQYvS34BYylwbVZU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ecedfdae5316b8a8529c71949cc1e0e53a3e4cbc9552ab3301ec961404185220
MD5 b94ce22e857bffbbff032d747653b3b0
SHA1 fd7ee723aefb384db149bf92a36603cfb70f4d98
SHA512 cd89199ed395ebf873712d4a41e74a8271834e8104e67adb833c8c5884d081b9b65c49d2fa902d4a15eb14dba42246486ebfd33ddf80f4ed1add6b8891b49733
SSDEEP 384:l121P4+YUzC3vygNWiWnBz+bYhDJi+u7KrEOn4VhzytFC+D:DttH/lW1Bz3Dk+x63Ga+D
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer