2a5e3f17fb10a4563e7596f1a163c885_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack003/$PLUGINSDIR/md5dll.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack003/$PLUGINSDIR/md5dll.dll	upx

resource
2a5e3f17fb10a4563e7596f1a163c885_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/ZipDLL.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsisXML.dll
unpack001/$PLUGINSDIR/nsisos.dll
unpack001/BHO.dll
unpack001/Uninstall.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/inetc.dll
unpack003/$PLUGINSDIR/md5dll.dll
unpack004/out.upx
unpack003/$PLUGINSDIR/nsisXML.dll
unpack005/npGamePlayLabsPlugin.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 737dac882bbacfd5b483c79f559d4214cd06a45cfc21995acb21a496bf2f3254
MD5 2a5e3f17fb10a4563e7596f1a163c885
SHA1 faf136b60cf0bd620cfacf7e2cca0eae085eb00a
SHA512 5bc77f3f225d7ec0baccd786661af03114395d44a760b55052970de41a9997f4fdc934b30945be7a1c855f70a1d40071c7dca4642c31678f7c7e7d23a79356e7
SSDEEP 12288:Sn3HSdtYaKtTRt9qQqn+oOaU3EfCuQLVOfpH5dZW04w9m8346dysK/Gq:S3ydtYRtdqM3BpohNWcRo6YX/Gq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ee75cece63794fa22feebed80a358b16
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetVersionExA lstrcmpiA GetCurrentThreadId GetProcAddress GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA SetForegroundWindow CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog SetWindowLongA LoadImageA GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA DestroyWindow

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation OpenProcessToken FreeSid CloseServiceHandle EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ZipDLL.dll

IMPHASH f10b94e3705eae25c7617ba56a648b77
SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
MD5 2dc35ddcabcb2b24919b9afae4ec3091
SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

62931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiA GlobalFree lstrcpyA lstrcpynA GlobalAlloc GetLocaleInfoW LoadLibraryA IsBadCodePtr LocalFree FormatMessageA GetLastError MapViewOfFile CreateFileMappingA CloseHandle UnmapViewOfFile GetDiskFreeSpaceA CreateFileA GetCurrentDirectoryA SetFileAttributesA GetFileAttributesA GetDriveTypeA SetVolumeLabelA DeleteFileA MoveFileA CreateDirectoryA EnterCriticalSection Sleep InitializeCriticalSection InterlockedExchange DeleteCriticalSection LeaveCriticalSection InterlockedDecrement InterlockedIncrement WideCharToMultiByte MultiByteToWideChar RtlUnwind GetCommandLineA GetVersion HeapFree HeapReAlloc HeapAlloc RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime SetEnvironmentVariableA SetCurrentDirectoryA GetFileType FlushFileBuffers SetStdHandle ExitProcess LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter SetEndOfFile ReadFile SetFilePointer GetACP GetOEMCP IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetProcAddress GetStringTypeA GetStringTypeW IsBadReadPtr

user32

SendMessageA GetDlgItem SetWindowTextA FindWindowExA OemToCharBuffA CharToOemBuffA

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH 177dccc4d0323e428824818efd241cc7
SHA256 55ec0f7d4c14b8b36e18203dad5604d066979e18017207f1165f17691845b161
MD5 aaf5a62051c11db6aa1a651bb9c295dd
SHA1 75413fd14a67a468578c9d8fbd1c0a810c5044d0
SHA512 f35a6c4e133d5dd396cc326f7f7365483de0477629e290a91b2200253cf7bb39e0d8ab700eda66d88c7b5568cfac069d4a7b277400ad776d64611a3723362466
SSDEEP 192:QvqKNVSPpH4sI76ffQ+AEl+Nmq5i0ynCW3:QvqKPwW7GABNRi0i9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisos.dll

IMPHASH a70233c77fd258ec47709388c2338273
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP 48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

80B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

588B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

156B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

96B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

BHO.dll

IMPHASH c761ee75e6ee4a51e7561318a338d3c5
SHA256 277b179862655d592587ad3597c1c5ebf8f99a76247a5b8561aec45d8e8edc33
MD5 d7dc7dfe31fa56bbf486e947d89c68f3
SHA1 674356049964ef722e4282b06bca73f82a8ca28d
SHA512 b252f756d5cb86af57436b6eb73563d37c2b1e95df38e003df7c4107ead2503f69d8d33ced1f84dba370f7ca54b1ca05a8a2e0630f71100fed7a502720e9ee5b
SSDEEP 12288:S9wRMzTXIQyjP85LkkiAKmvTuEp+V9ma29fi0sfBmYblZPx:SiWzcWTuY+Ga0sfBmclZ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

203016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\Ivan\Documents\generic_exe\Release\BHO.pdb

kernel32

HeapAlloc HeapFree RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetSystemTimeAsFileTime GetCommandLineA Sleep ExitProcess HeapReAlloc HeapSize VirtualFree VirtualAlloc HeapCreate HeapDestroy GetStdHandle GetModuleFileNameA GetACP GetOEMCP IsValidCodePage LCMapStringW LCMapStringA GetStringTypeA SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount InitializeCriticalSectionAndSpinCount GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetProcessHeap CreateFileW SetEndOfFile FlushFileBuffers SetFilePointer ReadFile GlobalFindAtomW LoadLibraryA GetVersionExA GlobalFlags GetModuleHandleA WritePrivateProfileStringW SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalReAlloc TlsGetValue LocalAlloc GetCurrentProcessId GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryW InterlockedExchange InterlockedCompareExchange IsProcessorFeaturePresent FormatMessageW LocalFree CreateThread GetTempPathA GetTempFileNameA GlobalHandle GlobalFree GlobalLock GlobalUnlock MulDiv lstrcmpW SetLastError lstrlenA GetCurrentThreadId GlobalAlloc GetCurrentProcess FlushInstructionCache CreateFileA WriteFile CloseHandle WideCharToMultiByte LockResource InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection GetThreadLocale SetThreadLocale LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary GetModuleFileNameW lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException GetStringTypeW lstrlenW

user32

DestroyMenu LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect GetMenu SystemParametersInfoA IsIconic GetWindowPlacement GetDlgCtrlID PtInRect GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetSystemMetrics GetSysColorBrush UnregisterClassW GetWindowThreadProcessId GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW EnableMenuItem CheckMenuItem PostMessageW PostQuitMessage UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu CreateDialogIndirectParamW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW CreateAcceleratorTableW RegisterClassExW LoadCursorW GetClassInfoExW IsWindow SetFocus GetFocus DestroyAcceleratorTable GetDesktopWindow BeginPaint EndPaint CallWindowProcW FillRect ReleaseCapture GetClassNameW GetParent IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient ClientToScreen GetClientRect MoveWindow GetSysColor SendMessageW SetWindowContextHelpId GetWindow SendDlgItemMessageW SetWindowPos CreateWindowExW MapDialogRect DefWindowProcW GetDlgItem ShowWindow GetWindowLongW SetWindowLongW DestroyWindow CharNextW GetWindowRect UnregisterClassA

gdi32

TextOutW RectVisible PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap GetStockObject GetObjectW CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject ExtTextOutW

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegQueryValueW RegOpenKeyW RegEnumKeyW RegQueryValueExW RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW

shell32

ShellExecuteA

shlwapi

PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW StrStrIA

ole32

CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoGetClassObject CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc OleInitialize OleUninitialize OleLockRunning

oleaut32

SysStringLen SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VariantInit VariantClear DispCallFunc LoadRegTypeLi VarBstrCat SysAllocStringLen OleCreateFontIndirect VariantChangeType

wininet

InternetReadFile InternetOpenA HttpQueryInfoW InternetOpenW InternetConnectA HttpOpenRequestA HttpSendRequestW InternetCloseHandle

ws2_32

WSACleanup WSAStartup

Uninstall.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 83c859f2c0de9fd43eba3699ef5a61bc40b28fb92831488f0223918a3903beb5
MD5 53ec2bfd9b7eb90ad32ab312ff7aff85
SHA1 dcb6660f5743155c80fbcbc7487b6c9234fd7c21
SHA512 853c56029b4a72970f1b49433dd15f4b8437bf5b4b3d930483da8f4faa2d95efacbdb92067131b6c155d5473d217687c75fd6e39a9172c3fae4fba0295c66fc5
SSDEEP 1536:FQpQ5EP0ijnRTXJ1gdLeAyNL4bK6MPLWhbhRgPbgmBY/V5D+DQ1sucVU1jb:FQIURTXJ1ceA/Amg8oY/V5CCSVeb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ee75cece63794fa22feebed80a358b16
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetVersionExA lstrcmpiA GetCurrentThreadId GetProcAddress GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA SetForegroundWindow CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog SetWindowLongA LoadImageA GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA DestroyWindow

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation OpenProcessToken FreeSid CloseServiceHandle EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisXML.dll

IMPHASH 177dccc4d0323e428824818efd241cc7
SHA256 55ec0f7d4c14b8b36e18203dad5604d066979e18017207f1165f17691845b161
MD5 aaf5a62051c11db6aa1a651bb9c295dd
SHA1 75413fd14a67a468578c9d8fbd1c0a810c5044d0
SHA512 f35a6c4e133d5dd396cc326f7f7365483de0477629e290a91b2200253cf7bb39e0d8ab700eda66d88c7b5568cfac069d4a7b277400ad776d64611a3723362466
SSDEEP 192:QvqKNVSPpH4sI76ffQ+AEl+Nmq5i0ynCW3:QvqKPwW7GABNRi0i9
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

gplplugin.crx

SHA256 857a92a0c8b56a4d0cda32ab21c15c603a76aca3abba2c115d97162a4e57fb5d
MD5 0652af5cc34ac5006ecc8f16cd69f8e8
SHA1 1c5a3430b0dbae294ff4717f4876370adb0685b7
SHA512 41a48e0dc906378b36fd343b12e63029edfaa0d0eed731ea0160a33b18236443f2777cb084975ecda7f186abe236eae7e10645c542b859913a357ce84f695b0a
SSDEEP 6144:Q3Mn725hXitzB/6wGIAdvcJr8L0sy4vpKqsrIzpHwXHDG7Z+:Q3Y725UNBjGXdv3VxKriHwXjWZ+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

background.html

SHA256 000b26615758b233b4f0d51184bfb53a52faab7d5b7e2d815601b639b0eac0f0
MD5 44282252d78e1809f3134b150656f974
SHA1 7ccdbad3a4cca9133881224fca03dbb9a0749c61
SHA512 f893615152ee296de224f356d7022c4c521e2f0e93d26e31739dde52b7984fb92a0bcf4d26f527ebba28657c96601939219028a6478c86050b45d0b2eae053aa
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

gameplaylabs.png

SHA256 10891f1aad4230aeeadae9050985e606672a1b413e5e861623fe1d2676332af3
MD5 5a79636390e96cf97887e3c334992322
SHA1 2dfa908cb4b3b6a61c3d4127c31a52c6175ce422
SHA512 6d11edea3cadc33bb96ee3115c3e0b165226c9c873bf778f5cfa6895403b9b72f97fefac13fb0327e8463d284b68e73f20a849b61dc045e1a4b83b788b59c17d
SSDEEP 192:+lzm/ANIkdzBz0J3NuXuJlefUd2GepkUVC1OIp8erDG9dTewnhZNhq4Tk:kW0u3NuXuvefsVAZVC10sc4whZNg4Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

gameplaylabsplugin.js

SHA256 11b63d424c1dd2ca11c168795e0f604d69a8366410238b388f9d34a9b7eb9b1c
MD5 1be740fca0bdb481c5d337cbb1f58dc1
SHA1 25ba78f7b3cb887be47e3078c81b3b833c67644d
SHA512 d1112b96c7a45d68ea82ace16d4b8bde0d8ad7f94ea24eb043e3e3c45939496486de8bc3a3b7d77225b8b166e4c49a6548f43df0be51260a87dae897199699a9
SSDEEP 192:1tZ26JlyX9Rg33S3+AwYkI+PXupdU5JVHJx9fmAmIgmli3gv30y1OcaK3HUmQSzf:1tZ85Vktf96Igm530yYc9HASzjk37c
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 81836ef9fbbee2c5b016ff88b6f3e2a72913452e3dfc8e5a6d1f85380ba69544
MD5 f2a6bce32bab787325e83e04b4cb979a
SHA1 909792bde058621fd8e77fe9736bdbb511ce9a62
SHA512 e7fea57aa702c03177fbb560fdb3e64122d8eff7ea6717e364ec150d681ffbfce5cd4eb1f91eb8e793286d21957c56960fdb9fe4f6e162b564b05681e7407815
MD5 SHA1 SHA512

NSIS installer

installer

npGamePlayLabsPlugin.dll

IMPHASH 9100feedaf2ba624188f295beb0fca7a
SHA256 2b405d30678fd3e3dba8a0bf0e72188d35fe13cf8a473b80815d0468cabea1bc
MD5 5ab9cc1a15495dc63cde9ce24b9eea00
SHA1 a79e6a04378ca0cecd957fff176ff1764e317387
SHA512 56a2b1bfb29ac3c73add677eae4baad542aff22234cba8e1bea135d4049d3eeaedf39656a4f8ca72470c853a7c73514bfe36b58820a419d9523464b2f8292f86
SSDEEP 12288:ZAai+K9XSY0nlUGokk7bBTQTHqO+N/tR/dvLn1ZFLhSeX3POwoa/B1vSwJHI:Bi+AH0li7FcTHqO+NjdztLh3POwoa/B8
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

188503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcessHeap CreateSemaphoreA DuplicateHandle GetCurrentProcess GetLastError LocalFree FormatMessageA MultiByteToWideChar LCMapStringW InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RtlUnwind RaiseException TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA GetCurrentThreadId GetCommandLineA LCMapStringA GetCPInfo GetStringTypeW WriteFile GetStdHandle GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize ExitProcess GetModuleHandleA GetACP HeapFree IsValidCodePage HeapCreate HeapDestroy VirtualFree VirtualAlloc HeapReAlloc SetHandleCount GetFileType GetStartupInfoA GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetFullPathNameA GetCurrentDirectoryA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoA GetStringTypeA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale LoadLibraryA GetLocaleInfoW FreeLibrary InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetTimeZoneInformation CreateFileW CreateFileA SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA WaitForSingleObject ReleaseSemaphore GetModuleFileNameW GetModuleFileNameA WideCharToMultiByte FindResourceExW FindResourceW LoadResource LockResource OpenEventA ResetEvent SystemTimeToFileTime WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerW SizeofResource SetEvent CloseHandle GetOEMCP lstrlenW lstrcmpiW lstrlenA LoadLibraryExW SetThreadLocale GetThreadLocale FlushInstructionCache MulDiv IsProcessorFeaturePresent CreateEventA

shell32

SHGetFolderPathA

oleaut32

VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysStringLen SysAllocStringLen VariantInit LoadRegTypeLi OleCreatePropertyFrame VariantChangeType SysAllocStringByteLen SysStringByteLen SysFreeString VariantClear

advapi32

RegEnumKeyExW RegDeleteValueW RegCloseKey RegOpenKeyExA RegQueryValueExA RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegDeleteKeyW

shlwapi

PathRemoveFileSpecA

user32

GetClientRect UnregisterClassA GetKeyState IsWindow UnionRect PtInRect GetParent RegisterClassExW CreateWindowExW DefWindowProcW SetFocus BeginPaint EndPaint InvalidateRect SetWindowLongW GetFocus PostMessageW CallWindowProcW IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos GetDC ReleaseDC LoadCursorW GetClassInfoExW ShowWindow GetWindowLongW DestroyWindow IsChild CharNextW

urlmon

CreateURLMoniker CreateAsyncBindCtx IsValidURL

gdi32

SaveDC SetMapMode SetWindowOrgEx SetViewportOrgEx DeleteDC RestoreDC CreateDCW CreateRectRgnIndirect SetTextAlign TextOutW LPtoDP GetDeviceCaps

ole32

CreateOleAdviseHolder OleRegGetMiscStatus OleRegGetUserType OleRegEnumVerbs CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

Name

.text

Size

420KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

gplplugin.xpi

SHA256 a4902ba9d269b8632c23f2346a3510a479d371a45e4e7c45cecf209f8bc63e8b
MD5 0ad6b991d1de54786ce66906c8e570ee
SHA1 ea862986ee9248a2107da8ec60cf8703bdb9c939
SHA512 cad25763870638fae2dc84d13dd00887621bb98b24f7fa80bba3f0beb142d52c65009940f467b78838a97685eb35f196af94b5ee8b3a22b0f9c55ce1a9186a3f
SSDEEP 384:9aWW0u3NuXuvefsVAZVC10sc4whZNg4Afwet9Bc1iL7:9aWW0u3gXuvkiAm10sc4+64Aoet9Bc1y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome.manifest

SHA256 a069b94477de17537409d425fe8af2f9a16976b376e47e21d4e97cf94ec0d29c
MD5 3e29d727b3701ad9d8a52599dc42303f
SHA1 8528ca9f5590994cf7ef3806292229b5f6b93535
SHA512 61adbe2629e344115ae15d24eed309119c7c59e615d3340ac41e63b725d98568dc6ef918e1e3ff61d72c115665db2ccbb6c69c24420eac0aaa9b5c362655c867
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/ff-overlay.xul

SHA256 1ee4d28eb45c2a72410cc5f9cf3e63b2fb81a569279a11df8c1024362df71cfb
MD5 72901d21be852ca237914390c85eaf05
SHA1 1d148bb39e8197bf7b0e796047ba7db256357239
SHA512 29f133791a64c807412d556696d902881b05a573e4e50a3dd76b2e98f68d690ccd14332c5a03a8d58fcd9550f3ce6a8e58c869a5cae4f6b1df81d52b3d63b30c
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/icon.png

SHA256 10891f1aad4230aeeadae9050985e606672a1b413e5e861623fe1d2676332af3
MD5 5a79636390e96cf97887e3c334992322
SHA1 2dfa908cb4b3b6a61c3d4127c31a52c6175ce422
SHA512 6d11edea3cadc33bb96ee3115c3e0b165226c9c873bf778f5cfa6895403b9b72f97fefac13fb0327e8463d284b68e73f20a849b61dc045e1a4b83b788b59c17d
SSDEEP 192:+lzm/ANIkdzBz0J3NuXuJlefUd2GepkUVC1OIp8erDG9dTewnhZNhq4Tk:kW0u3NuXuvefsVAZVC10sc4whZNg4Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome/content/overlay.js

SHA256 92919939dd77d7ff2494243e3a330341049aa95de17ab35233fc4943a07f7dec
MD5 0a67e6b41f44c8f0dae9ec71dd66c14e
SHA1 50f339c7544bbe96fe3f40e3c93814c874127681
SHA512 d2ee684104f3ada14e8a73cc3819b9d4ce532699c7de9e0a50d49f46b3987aedd7a1d5777aae9012a866f8a645643df591ba81afd96eace4841e8b555f1ba489
SSDEEP 384:Z6L936xaJat4SzjB3EO0xY9bXs2RqtoRNA+J3XLILIzC6HT:Z6h68Ja+SzjB3EO0xY9rs260ZJ35tT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome/locale/en-US/overlay.properties

SHA256 c8128e650c5555779951c93927758d2086acddb97d7f23a9fea85e81a0a1f52c
MD5 370a63ae583752078f750f1cc1ee1db9
SHA1 1c61e6b7e507c4d05f84879c99c3ed881c3ad98f
SHA512 ce0f7f14a2f17c0b17226c9a4708f657d448ad8e5570ad85cff587e0fdc3f6ba613d2b0f085097bd1b32c67847b53778d88b0a27cf6d1522d6d5ec601383aee8
MD5 SHA1 SHA512

NSIS installer

installer

defaults/preferences/prefs.js

SHA256 07089a8f3cb98b96af5b0eea4da653b0079d2d6d56eea1e395aa10d2dd363d50
MD5 3442a0d27a45d40a53c1251596c22c66
SHA1 3ebb9f3d4c2c18b08420c8b6f7bef78cb6bb9a03
SHA512 eb5b3f1b0db02c2931327b9a13810a661d47f936d1869dcf45073f50791f069187571e71c76707ac3799c155ec8d1fe6792bc7da8547512df3fe614870ac13d5
MD5 SHA1 SHA512

NSIS installer

installer

install.rdf

SHA256 8a64aa40eda034ff0e61bf1ad37f1461c1da0d81c15ef60c939f723b11523cb4
MD5 42e601a46701d322263bad936ce1ccf6
SHA1 36a007ef73dec4dbf40ca43d4f7adc7dc6d73766
SHA512 3c7c18549dc17e975e3f1b7ce1fdb43f7842f7302730692d532dda22c7908970c30395b1d3d40a0c018b37e5c121176fed5ebe4f36c515f2283c0031a84d526f
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer