2ee36c351e2018158b9c56858498ca90_JaffaCakes118

resource
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/ExtractDLLEx.dll
unpack002/$PLUGINSDIR/InetLoad.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/Processes.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/$PLUGINSDIR/chrmPref.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/linker.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/facemoods_w7th1.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/facemoods_w7th1.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 0a80f855140ec625ec1d9f231e57f957c0c44cc358427740796669a467601001
MD5 2ee36c351e2018158b9c56858498ca90
SHA1 25f9342e2151858c89281db5e9f38996f79edb46
SHA512 07395c24e136424d12875347519c8a9342e43d7e904c161d1b0efadafd03600921bf824d40d59e5a6c836e6bb56b94f1626a50ea20c5a0edbc0bf4652a361a4f
SSDEEP 49152:H/hV3mDLG2KCglbTNgJRYCAqJFBLrnPKW57D:fjWXG2+sRiMFhnPKW5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

00:c0:f4:65:80:b0:71:e7:a8:24:d0:16:de:4f:5b:de:8e:0e:95:ef

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=WebDevAZ Inc,O=WebDevAZ Inc,L=Arizona,ST=AZ,C=US,1.2.840.113549.1.9.1=#0c14737570706f727440776562646576617a2e636f6d

Chains

Jul 5, 2024

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$DESKTOP/ezthemes.com/Folder.ico

SHA256 700db4935ad00edba7dccaa035c53e0f9754200ef548b44c188f98cfd7a8cbb7
MD5 5d83d43a929368a98e5caed3bf6029b5
SHA1 cead44cb3cb03acfa5e73f895969f1277fbb7727
SHA512 38e2e659109082004a3bbf53fec6e6c3e241273f5a8b2a348c3de79f72b57370821ece15f39c0c89b4e33f5d736500c3f5c1ad857a4684f3d145e8a8c7845dd7
SSDEEP 192:E5snTUQlohvelYIifGeUnaZT6O6Rl4aTaTI8:E+nTpulelYPU+6O6Rl4aTaTI8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/EZT_EULA.rtf

SHA256 482a0dc0ecd1099bc772e3021907635ad53164897dcd3c97d86eda4d00a7a719
MD5 3584a8d7f66ffad1b321d682bdd71c12
SHA1 88e7aed78aa695f34200bab80d2686770f8a8d0d
SHA512 48a68cc55c006d4eef7cc4c334ccf3caaa4af2aa966157ba3b08eaaabe4f3093ef05745d5e80e342a37a383be0112bbb28f9031977d9e495ea9e09591dd935b4
SSDEEP 384:AGtwgDrN79ozVzEFHQezWf4RnDQg4so6iETJTPwa54vg3Rvjlyb3OEi6rGsNAYAG:AG7QezWwnDQgxPiKvjlc7hAZqCM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/EZT_left.bmp

SHA256 9b0fdc57b136c7e252ca5cc61ab738d68316600bbef896e813e87df07215ebf2
MD5 58018a8ad29769492fc03c5c789ca114
SHA1 0bfc17d8bb3ac7a7ca517650b8afc9f4a8ba5039
SHA512 a1354eaabcd8a8bbf13c1670e08b7848f10cbeadca64944525f9ec927f518d05d56060ffb849a99bde0f14fac339a142b4acae6ebd1cae4097157433e9629723
SSDEEP 768:Y/GDQtMllhHFCxZNKcIuMrEwYTtIgGfM8enUf:cn8HFC5KcIuMaJI7fCUf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/EZT_up.bmp

SHA256 40a5055639d9d5b26a8e660a59d66234f5c7d1f03d567000338c4cc9f334beca
MD5 20920aef05aaa506e6d2cb4bf0c88483
SHA1 a561f7e64ad2f58221b6df6cc2771792dcecc8c0
SHA512 baa32e695348acd4d2e80685118ea2f0bd4539fc2c9d50d116dcaf0a525cd7cedd7540ef5dfba4623d4de1b3dae0676a3ba3b48c5723fbeae1677a66c848f345
SSDEEP 768:bIwP6QySVySX2tYquIhSGUSS6e3LjcxJETxjGfQDO6uvlccZ5GHh7:XyQymySX2tYqlMmAjXKfkuvlccvk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/facemoods_terms.rtf

SHA256 7faf940cf5a2abc900639ade3262db9a9b0f623047a67e6b165c73aa33b90d35
MD5 021f978d062bdf04b58327f3b67c8aeb
SHA1 704ddc83f32a5ce6c95a1ce9af74f8f7b60c2a95
SHA512 f69264f3aff95d0fde5a582fa75a8d8bd74eeac255e6e7beb7723ae5260a5e1fc05e25e446a786b0003b40f3e75610ccf82013e6a86c73dd3c9a32ce20d7b97b
SSDEEP 768:l813p3VdAkF8bmrF5oa5Fscm0GEsGugGcQ/yK74fsWc24hAZqC3:l8TN8bqbGZytsWcwj3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/facemoods_up.bmp

SHA256 df1b85edea21a1cb4e155290a09b2048b9c80f0699707829bdcc51758702ed0e
MD5 211882b2ae5f5fd627c639af1b2ca2d3
SHA1 970cb56dc424de5d670a1d03ebe1e05f5c4f0d9a
SHA512 f26a80eb50bf536bf834953bac9847727cba3d60996b2e6729a2202d8cab3e75bef755bee17bdad32efe850088e36c40bb109cfd68de2886e8400ee394efb33d
SSDEEP 768:9/MY/w+AB2yinyoDSYSbR7rhpRB9lTWlnL15T64FLF/+Wp:9//s2yin3fSbRhVa15vFpR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/facemoods_w7th1.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 a6c006ac1c2a5d7abcdc63cf2b792aba71d495e05d468daa5a27e21edf07a063
MD5 07659cb933fe369e32d58f9fb096234f
SHA1 34ac909dc3b652c7a4f07daa0410f9c5ee0c745b
SHA512 6460b73534f6f42ca69a49c4d8208f832af85fa46bb186838cf965ff26578f648c9d9a30fedbbdabd96e8340cbf442e81b82b8fd9865931a08feb9f82d98ce24
SSDEEP 24576:73Hdk4yO1bzppgJLo01dvXjyoLTkyXN3VOBj7mEsLz:ztNCLbdzLTpXDOR7ELz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

65:d5:6f:02:f4:e2:83:44:34:f2:fc:90:be:71:62:72:b1:67:8e:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Sep 5, 2011

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/Local Storage/chrome-extension_ihflimipbcaljfnojhhknppphnnciiif_0.localstorage

SHA256 2af3e0f282942a6a94d441acd9fe930fe2401fbdfbc67a1e44f490fe914afe7d
MD5 97471c285c1afe9b7a2604b573ea4dcc
SHA1 722841633891847a5636d0ef48799e3b0e431c91
SHA512 eb33ef015ac8ff79fc13dcc0bb62629d0c32fef36b7997f01117616c403864bf3419d0d8d5aa0b16939b26e86f831bcacf60da42a239b6d199880ce958da4374
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ExtractDLLEx.dll

IMPHASH bab48790663c56c456d63bc3e045f161
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Processes.dll

IMPHASH eaa5f91829171a65db414b9e64ec9548
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/chrmPref.dll

IMPHASH 93bde92aa23094d5545e87c4d138f2ba
SHA256 a87ec5894c667c5eb22201172792027a525a375a9e6468aa4612ccf6875b1112
MD5 e02590b95a6be07cea5c5f3daf66e775
SHA1 28b6350c43d3804f69faa5f48cab70e229dd182a
SHA512 30e3abdeb2fa3c2e1bdc94e1e2b9f7fa9c85ff3d10198166e99e66a92a0ae4d62871a621eab069b1dfe2a99a7a4d457a494d91c811f1bd93c51f120f5ff692b5
SSDEEP 3072:0DNlF2bX2rBTxNwIjCRMOwt+kG2Dkq150yurKNN535xzFHcu:0DNlF24BmXH2f50L4ji
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

58477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcpyA SetEnvironmentVariableA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA WideCharToMultiByte MultiByteToWideChar GetLastError GetProcAddress GetCurrentThreadId WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA FreeLibrary LoadLibraryA CreateFileA InterlockedIncrement InterlockedDecrement GetProcessHeap GetLocaleInfoW IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID ReadFile ExitProcess RtlUnwind HeapFree HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetModuleHandleA LeaveCriticalSection EnterCriticalSection SetUnhandledExceptionFilter GetOEMCP GetCPInfo HeapDestroy HeapCreate VirtualFree HeapReAlloc IsBadWritePtr WriteFile FlushFileBuffers SetFilePointer TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA TranslateMessage

$PLUGINSDIR/modern-header.bmp

SHA256 9ca35a9dbdd4d596bcb7a3344fb0d7e7a8adbcb8fd11122484abbd5b53d8eb20
MD5 6ca928e60a9a3bf068f2380bdc9b44d8
SHA1 a03b5daf578a5ed7248c99e8e6a8814f4756782b
SHA512 fbc5e1397df6e24027fe6cea61c35c8e2874421ddf7ba1868972eb0a2a6d935087c78b2a424c2a1584e4444964f11ba2ee11ef67beff6c52e64fd1ba71b226c0
SSDEEP 768:O0m/4YIIIyI2IRQICIyIdIKIgIwI+AG9kAUIJ6XI3IJIFIHIrIYIDIpIAIAIAIc:O0zYIIIyI2ImICIyIdIKIgIwI1G9V6Xa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/Mozilla Firefox/searchplugins/fcmdSrchw7th1.xml

SHA256 ecf12f08b7aba181eba8de39fc16ea02ae9d8fbe1a082672681287fa8919012d
MD5 7ae4c660f70d7ae92e9899c676d66c6d
SHA1 cb4b1f481a92324f410f1675c4f5452dc5a66b3b
SHA512 b02f3835db16f32005892632529487a1b04bc5d778b046da59b88355634b23f7086953b2dd3ffaa79df19eed3d83b5473b61b0e3cd895685c17ae8ceafe01221
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/chrome.manifest

SHA256 43ab7764aaa9c7edc9eaec626832bbfda1dad0a234a49227c6611c34880aef57
MD5 edfe1d268ee42f8e4cb0ea2d57a88c2d
SHA1 8e3c934c51c319697030132eefdd1f55b6457fad
SHA512 0d4706f2662bbe2d882adabe99a5baa53f0b0b10cff1331bb06e88715e43d385232726b1ba4f8fcdb2e36276bad20aa7d625378b09c801084f1f8be0e662ab8d
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/components/FFHst.dll

IMPHASH 42265262b1570e7f94a9fb42ce88043e
SHA256 73f1c3bed7c14088ad837cf6468aecbdf37f8e9ca86faeb4fc7e5d79af071e09
MD5 4d858f32da07588f97a992cd083334ca
SHA1 75572a0793acb41e977c8ae0adc290f5b23da946
SHA512 37bb7b0ce98c2e345ce5508af2d7dbb30a85a2ce90d55887318105d71a88965445c2d1e7d7c129c400fd38435ea01bc72fac93e75770f01a8a114ad35e279fb4
SSDEEP 6144:XyWoZ5OaHK/HHWAV4/yZj8sNkWS4P7voGfk:if5zHK/NVpwsNkWSAoGs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

75:57:ed:00:83:5c:35:87:44:61:68:0e:da:cb:dd:0b:e6:25:24:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

62073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetMemoryManager NS_CStringContainerInit2 NS_StringContainerInit2 NS_CStringGetMutableData NS_CStringGetData NS_StringCopy NS_CStringContainerInit NS_CStringCopy NS_CStringContainerFinish NS_CStringCloneData NS_CStringToUTF16 NS_StringSetDataRange NS_CStringSetDataRange NS_Alloc NS_GetServiceManager NS_GetComponentManager NS_UTF16ToCString NS_StringGetMutableData NS_StringContainerFinish NS_StringContainerInit NS_StringGetData NS_StringSetData

kernel32

InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA MultiByteToWideChar WideCharToMultiByte GetLastError lstrlenW lstrlenA GetVersion lstrcmpiA lstrcmpiW CompareStringA CompareStringW GetEnvironmentVariableA GetEnvironmentVariableW GetStringTypeExA GetStringTypeExW CreateFileA InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA DeleteFileA CloseHandle GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA GetFileSize CreateThread SetThreadPriority ResumeThread Sleep TerminateThread FindClose FindNextFileA FindFirstFileA RaiseException GetCommandLineA ReadFile SetEnvironmentVariableA WaitForMultipleObjects CreateEventA CreateMutexA CreateSemaphoreA PulseEvent ResetEvent GetLocaleInfoW GetTimeZoneInformation SetConsoleCtrlHandler IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW SetEvent ReleaseMutex ReleaseSemaphore WaitForSingleObject FileTimeToSystemTime InterlockedDecrement SetEndOfFile GetStringTypeA LCMapStringW LCMapStringA FlushFileBuffers SetFilePointer IsBadCodePtr IsBadReadPtr CreateDirectoryA GetCPInfo GetOEMCP SetStdHandle WriteFile GetTempFileNameA MoveFileExA GetTempPathA EnterCriticalSection LeaveCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind ExitProcess GetCurrentThreadId UnhandledExceptionFilter DuplicateHandle FatalAppExitA HeapCreate VirtualFree IsBadWritePtr GetModuleHandleA TerminateProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA SetUnhandledExceptionFilter TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

CharLowerA PostThreadMessageA GetMessageA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA CharLowerW CharUpperA CharUpperW UnregisterClassA

advapi32

RegOpenKeyExA RegCloseKey OpenProcessToken RegQueryValueExA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA

ole32

CoTaskMemFree StringFromGUID2 GetRunningObjectTable CreateItemMoniker OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString

oleaut32

VariantClear VariantCopy GetErrorInfo VariantChangeType SetErrorInfo BstrFromVector VarBstrCat SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen DispCallFunc VarBstrCmp CreateErrorInfo VariantInit SysStringByteLen

nspr4

PR_sscanf PR_AtomicIncrement PR_AtomicDecrement

shlwapi

PathRemoveFileSpecA PathRenameExtensionA PathFindExtensionA PathCanonicalizeA PathAddBackslashA PathFindFileNameA StrStrW StrToIntExA

Name

.text

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_34_/extensions/[email protected]/components/FFHst.xpt

SHA256 5ca47fcca69bbe5538dbe464b57793aa0cd43410bedbc5a5ec34f52a3d6b683f
MD5 7b5b54d8cdf80a11234a81fed704647b
SHA1 6174bd947e18056633b74551c4b330b824022058
SHA512 64102bf7911dd3e5a38ff9bf86231faf9c4f957d7a77fc706fd1f709738ac30b6a715aa1ddb0f4dd3691a70be85e103912cb00a8d0e3ee4d8a87a3f1ac11df6d
MD5 SHA1 SHA512

NSIS installer

installer

$_34_/extensions/[email protected]/facemoods.jar

SHA256 0b206703b286d945e5903caa43ed7b4be2c85d92b48919e376ea4bf1856b674a
MD5 35da6847680198d8cd54ed025657c1a4
SHA1 3b1ad576de71152f3096d709ea828855e08280c7
SHA512 ba9629577bc191b726e56e423acb48446e8ef2513cfbab247d5ed7501ad73f5093952e0bdb98202264cfb02aa7d65ce808896038a9a924b0fec47020edf30c9f
SSDEEP 768:bx635O0ft5QuOUg+gojzo0s7xcey9T9os4aObu:P2t5QGbjzIO/oMF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/facemoods.css

SHA256 ff33aa2b11164eed3dd5faf5bb07135cf30b87716c7edb6e6dd57e999bfe8376
MD5 1f378d2823131ebc4ca52591a3550306
SHA1 fdbf6f788c5c13511a9128b7f76a560aec165bbe
SHA512 38e832be660ea6a7bf62f38a1b69ee3c2d9bc71a13c5a1f9227e191e1b47b59098e1953126b56f95e74c1ce0ef2f2b59853693ce19bf6b72a86a179feb195840
MD5 SHA1 SHA512

NSIS installer

installer

content/facemoods.xul

SHA256 87308004d025e2a5c31a8b88c2430dcfb846b4ab08a71eaec98b97170ea41d1c
MD5 5f6549a7206671e4b1ec31b7d19f1c73
SHA1 9d5583ded41b79ba4b42f9c1d84aa23136de9e2f
SHA512 a53b2ec39ff6487786b7995b2ce494d775ce8f47f56ab2800caf8537eafa63c1d6fb3c7407a7a1662889ce85c11b9ce8473354f063e39b093c4e761c799728e8
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/arwDwn.gif

SHA256 09d5f001629c8f26137e88cf7a0f7636e6c17d0d75abff9fd3ac106a85571617
MD5 2aa11fa4dcf0f03a0c8fb08170272566
SHA1 9e304d6bd0b0183a54baa2821772aa9f72ef149f
SHA512 8ee3d2e19a20ae5a2d84eed2c722d4bafe9ccc67eb7a061723f660178564945d5938584614f2bbdf5c90b2c78eddd3368196828a2992935f3a688db46f624080
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
MD5 SHA1 SHA512

NSIS installer

installer

content/imgs/pref.jpg

SHA256 ab3399db35e9b42ab47b09f0a51c67b53d43f97d30f248b3042149a07ed5d504
MD5 8e13e2ebfe19e34aa34740aca5d4cb28
SHA1 23be684b0e1d653b056b4f8ef16418f58f39833e
SHA512 baf8fff280b1c88d19ac1fb5b83f9ba9ed025ccbaf3732b73604b9f1c33cd50b45cc5fc87ee5e7dec809b6e577be5140e8723996b44106e6d0c09abac1f12118
SSDEEP 384:s1ndjYSIVuiwK1ndjYSIVCnXP/EZyn/Qb0qM2sAF63WbUhSWxH6gwbhD57z016y0:s1lmApK1lmQmDsAloYtZbhxFlXWnkb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/imgs/search.png

SHA256 d7233956f9c2915306281a7e5f03b81af05add35737ee58d7a1088ed06e50af2
MD5 db16cf66110b470e05c94713568f68f0
SHA1 05c592716c053946681c725f4255322310cb851a
SHA512 bcd57eed0db752dc5868988b3f03b7bdc8e4a213b8df9787fda5387fbb8d2074fe0f48432ccf8ed24af86ad3879a1b2b0c8a75dd1e7fe814b96b5c48c07eb0b0
MD5 SHA1 SHA512

NSIS installer

installer

content/mtstart.js

SHA256 9ce029c379fa6709794e48fed80a981fbaf5baf69ca842fca1bf9e796f40cd5b
MD5 9978cfa2a984e8c46eb7701ef27735ce
SHA1 ac622df5ba595f6d1ae7e88541c62462b5176fb0
SHA512 8d18218313b7bc21517556049452da3e887e531b357804a26d6ab31d6ea2467ae858889ecec7ba42607e197c0c54b4d13143c0fa42264299e050fd8f394d524a
SSDEEP 192:YoBWK2dgQbyHafCl3HdHmJTC6axF8CPyjdSgpVbJzTgSCevXmIXHdbKi7p:YoHQGaKl3HcJTbR5RgS9mIXHtF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/prefLoader.js

SHA256 542b9822100d6d18f43312dc798b0dccc1a5326750c5687de2c775c2d3129213
MD5 bf06e3e9873338fafb57fca1d1f2c92b
SHA1 7fa1107fb960809be8f38a6aacb0031a47cd7a09
SHA512 f50d1b8b22dcb102d5ca318b791c2f29cf4d4b24716f84cb4efe1688ae214d65ade2dc32567fc68fd3f8de2e3abb61ebcda703e615f2be3efbc53d305809b003
MD5 SHA1 SHA512

NSIS installer

installer

content/preferences.xul

SHA256 8c8ea8500f2db6ceb7d1380ddfcff2ab880a03005b6c828cc5f32eba6fbb22f3
MD5 030273c1c6a64d21030cef66cce08235
SHA1 0560817783bdfb1d039ff05968aa372e5681397c
SHA512 6be19dbc6fa143aa2a9e0ff8c6180ee38ccef279c7c43667bf9438cecf0ace02fe14abce09e6a01e812d8d4cc85ffc58ef32a602b89640656c3cef61d9cb8b19
SSDEEP 96:PSK+p08ouSUdUFvc2+Db5MoknwUpHtf60a1YZCBddL7m:op0RGalV6kFiHYZCBd9m
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

content/tmplt.js

SHA256 cca94fab70df6e53ac189d41e112425482712e87b67e09abffcc7494caa0bbd5
MD5 63e3e1967199054335ed1a8ecdd24901
SHA1 386daff20cab67c044d2e5b9f63c97be05d2d98f
SHA512 029a8d6f231f3d082ade80aa85de9d57aaa1e4f1a812bc0b541dd03667bf2a8325251b8c34b8580cbcb571ec2cf7884d47e667b27bfc52d4448ea3b8653077b0
SSDEEP 192:dxT17sFA/oRQwGPV4UlbLQzJSc7LK8Jt8ZaG5:vpUAgG59xlbQccv8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$_34_/extensions/[email protected]/install.rdf

SHA256 c2543ebbd797df0c4ef70cf0ab74150fa97e9cbd6d180c3ff34747ab4e35efb1
MD5 d6977d18d103e1fd91c3f964970bac2e
SHA1 b3e9689f55793cb3bd08fcc43de1c15c49d93e4d
SHA512 c2fb5da3d19c0da254cabc9d470a09631be5f88a841db5366e1ab9eadca77def60c38d56ab08308a537d7cf6b8035f90076c611b0cdb294bff3fdba09f87852d
MD5 SHA1 SHA512

NSIS installer

installer

bh/facemoods.dll

IMPHASH 44f4d3d27a95aa836b9d7cbf6a70fcc2
SHA256 b52d250a3cc40ffd3da353fc02a2b8f5c93ce7341b071228c8401a780c56313b
MD5 d0813204b590d8e8b98627fd75610e9d
SHA1 8d465e41bd3a156d6c3b12a562473193b9878a7d
SHA512 698698aacdf240812c5ab76cff7d5b4313c552b7df276cb3a63f56e13ac8400477bb01c6b93bfd7ef191bdf834db62afc34d42db239c4108b2eb9f36a18297a6
SSDEEP 3072:XPDSnuDyl0Gk5SMir25KeUpSDeVWwUz+JS4v5r95paU5paJu8cr2:fDzg0GRkKkwE4Vw7JuD2
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

7e:3c:b1:8d:65:9a:9e:15:44:d2:f4:f3:b6:95:85:de:2f:68:c6:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

110596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escort.pdb

sensapi

IsNetworkAlive

kernel32

WideCharToMultiByte MultiByteToWideChar lstrlenW EnterCriticalSection LeaveCriticalSection GetLastError lstrlenA lstrcmpiA lstrcpynA lstrcpyA GetModuleFileNameA lstrcatA IsDBCSLeadByte InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryExA GetModuleHandleA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc lstrcpyW GetCurrentThreadId GetTickCount FindResourceExA GetProcAddress LoadLibraryA WaitForSingleObject ReleaseMutex CloseHandle CreateMutexA LoadResource GetCurrentProcessId QueryPerformanceCounter IsBadReadPtr GetCommandLineA FindResourceA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LockResource FlushFileBuffers SetStdHandle SetFilePointer IsBadCodePtr GetStringTypeW GetStringTypeA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange SetUnhandledExceptionFilter LocalFree HeapSize HeapReAlloc SetHandleCount LCMapStringW LCMapStringA GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError HeapDestroy VirtualFree IsBadWritePtr TlsAlloc HeapCreate

user32

EnumWindows DefWindowProcA RegisterClassExA UnregisterClassA CharNextA GetParent GetFocus GetWindowRect SetWindowLongA GetClientRect ShowWindow GetClassInfoExA wsprintfA LoadCursorA CharLowerBuffA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA SetWindowsHookExA CallNextHookEx UnhookWindowsHookEx FindWindowExA EnumChildWindows GetClassNameA GetWindowTextA CreateWindowExA GetWindowTextW GetWindowThreadProcessId SendMessageA SetWindowPos IsWindow CallWindowProcA GetWindowLongA MoveWindow

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoA

ole32

CreateItemMoniker CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance StringFromCLSID OleRun CLSIDFromString GetRunningObjectTable CLSIDFromProgID

oleaut32

VarUI4FromStr SysStringLen VariantClear LoadRegTypeLi VariantInit SysAllocStringByteLen SysStringByteLen DispCallFunc VarBstrCmp SysAllocStringLen SysFreeString RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

StrStrIW SHDeleteKeyA SHDeleteValueA PathFindExtensionA

facemoods.crx

SHA256 cc45a7785adf370466c050f324dc9cbb675ba6db452137acf91df3c8938bf977
MD5 c950d4862ff0dcff908a8934b28702e8
SHA1 910e844373c425ae105362e12007ed48ff6c18bd
SHA512 f159b788b79918240b7e9639affa24b0cccb340a9c53be7c59ed885617966ea8034c4e909cc19813ce240d1871b1bdd0c7dd9299791a7e554953e0fc2ac18730
SSDEEP 768:fqAW3YRsRdUby35PlH6ROtBxowFxA2JAQlwNnVwFDFYa9E5Tt:fqjoY2ePa2J3anVA+v
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

background.html

SHA256 78ab5fb51f864d9d2339675d9d91cf3193ef025eb20463c2fa9ea336f4ca3d4a
MD5 fbdfef4069293dcf23f0b1267a787a75
SHA1 588e1faa002e88bfd20e93d9e71aa168f7e485bd
SHA512 b5bc4b91984c8b0ada360c6de44150af1f50cc447b12494449e416dfb145ac4343ff0a5fe14def05cc7a5ed485c1c684cc7d7fc3c4146988923309c2b88d1602
SSDEEP 96:CmUiiJEqpy7u0/c8pNcmjH/cLSIFRYwjNytpFOma8ihI:Cbiohy7FZ3/cLZztjyaU
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

dropdown.html

SHA256 c02fe7b99841c5760d7d485e28d937c27b55e6d37ad272cf380b4fd6c742c284
MD5 ac34e394f4c6a5c815dedbd1d74e9bb4
SHA1 a089dde39d842ebd0bcd85a20cbf3376e7c192f0
SHA512 0dfffa3344eceaeff82a90c71ed5c59ed35af15f4a73fd51aae20b279a86a896ef50dc1b1fce21f3b89990c5dcd4da627eff29befbdfc00a2d5f5bc7127f4826
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

img/128.png

SHA256 fa00a8498a9db637baae05a7d5e2d23b72e68bd34b428ce4198340a6782df8de
MD5 7ad77b02b20fb1fd0297f1c9f677497c
SHA1 4a636e1949b351eb7164117188aee83c9396cd4d
SHA512 d864c72d52d1ccb9564f5fe56cb92694c171e6c241e7511cd8e133bf3241c1f1e3b06e3421dd535211503a13024d4c59db40050ba4df333e06edcfda89e51f0f
SSDEEP 384:5JXE05Pm3eHcTqG0hjZBfZLmjpwFYeGr2JaBcHXGx:r35PlH6ROtBxowFxA2JANx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

img/16.png

SHA256 b748184b727f2175a5f1cf310784599aa9030fd124d9a764277e7aac301a7159
MD5 5203b90cf64318066ad46298257b5e60
SHA1 3350f62af4e81a6f8988b73150fa53fc9edb68b7
SHA512 f70085cda636d40ff8e58282fd68efcc974f42e048a877851ee977f79b3c4912a632d628302de5116c08b9d1778fe6bf0b797c712f644118e23f5a7039b6fa8a
MD5 SHA1 SHA512

NSIS installer

installer

img/32.png

SHA256 822adc04180e8893f87a63b750f6fcc0b0d996a02aa2f3c49855c73caffd2c00
MD5 289aa791661f74cac22be15fc7c67a05
SHA1 c9d9d3376dc8ac169270229119d92e27f495bdc4
SHA512 1770b50e02f3010d08d26ac4bf6bc989ef52106df8541a4f9003f26d73a114a381900e9d4f62e7e398be4bcc867b9c769fbff068882e7bd78462dd98bceef0ab
MD5 SHA1 SHA512

NSIS installer

installer

img/48.png

SHA256 10817f3e7123712637eb946460f63ae1e24982024a3c29576ae2396a151131ba
MD5 2b5730585dd3c65960696e60d5430901
SHA1 e891f335bc79488db2eeb4ed2661c8085dafa931
SHA512 9f48f03918c3098b1692550f10c0fcf1060860f07077ea0da691cf157d6ae1de830fc5e4562094973a52c0ca63879bd330a3954f103fc9a55b3bfbf55ff75002
MD5 SHA1 SHA512

NSIS installer

installer

img/64.png

SHA256 21f5ff83f481a3cc7533dc7f3a31addf4db959ca5862c8a8bfeae02291de9b15
MD5 6e83973e8a36db265f574777e13a80c2
SHA1 13eefd936445583e86c0b23edb9313075fb3888f
SHA512 5438f3ee5c2cb745b264cd82b255005e93cca611265c0d4bb042b2022708c0b4cdf89ba863137b02b5f83df97bdd96a8a6095f059c65bb2607d9e51ed44759be
MD5 SHA1 SHA512

NSIS installer

installer

img/ajax-loader.gif

SHA256 11beae7afc13803e67f552dd3c9e73ecd1be724cc8d2f9be4ab6859da46d8e4f
MD5 120815c454179a5f747e9d0110796dd9
SHA1 b8af186281369b2d6805cbc10fabccb14e30c4b1
SHA512 93d10b41fab7e25df20e2bcfff85f9eb01591b20437ba341102fafcb960ddb7f07e0ccb8f59dbddde8281ef06fe333e27d9db651bae0d79a5c4d970f47f984fd
MD5 SHA1 SHA512

NSIS installer

installer

js/FMLoader.js

SHA256 5402031db339d17b640b61270312b6410bb20a64e28f0dc3e7d013dc1fddd91c
MD5 67b08bdeebe5cfc7da0aa85e9ffce6a5
SHA1 9e52347c65f33e8a677e39c304173ddfd9e66624
SHA512 6553fbbd5216f3e31255f2902c70df2f570e27b6636a3c21a500278b60523589c454d07e42ec699e0124218198f4d257ae10a8ec755c3af40a17530c3c47267b
MD5 SHA1 SHA512

NSIS installer

installer

js/mtrprt.js

SHA256 53b99d7ea55da3a43552a7ac0645e1de57e275db32ea089634e9266cafe959ce
MD5 31fd19e19c8d40d794b24813c3c4d789
SHA1 2a66c42b3a4a6d63247b1fcce2fb28eab92b6ac3
SHA512 7ef3ff6f565cc8dcafd63e660c71fbbeb20971b9eb1cd7319d37ebe7dbad4d43f3dfa109cc4bca4a98ca6cea11879160affad4837656550017025fe528c64c68
MD5 SHA1 SHA512

NSIS installer

installer

manifest.json

SHA256 403a4c391d84381d720b3f2c37e3e41e896720128940f4a5eaa58b6ecbc467a3
MD5 c663b52985167a419a3946c8b888692c
SHA1 53f9ffba9c4ba3a5cae0b29d98096ce8d5559f2b
SHA512 30c74212e995edcad5a4834ab04c81fd9c780b8ec87fec2907d36e71485b899e62d18a04f98e43bf490c82aa47f7b619e7ee01cc06f87c3827c2c3893b4f93c4
MD5 SHA1 SHA512

NSIS installer

installer

style/facemoods_chrome_1.0.1.css

SHA256 b6b253a03768c1a6597aec8537cebbac12c270418e6889c9a1e5036bf675535e
MD5 932e88939025dea549719b7ffb869668
SHA1 5ce566e183cea2674950c26746b9de5319434e24
SHA512 373056ec4d2e2cdd0a82c5d3f993532c409efe3a9e48c9ac4e42a7f7f41d89145d6fe68174dc7b105cf82f0cb14b545ac47dfb560496af23a7556ab6ad82310b
MD5 SHA1 SHA512

NSIS installer

installer

facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
MD5 SHA1 SHA512

NSIS installer

installer

facemoodsApp.dll

IMPHASH 54c66c30640ceaf09d0e7010ae8bba2a
SHA256 baf97779f0d58566e68e114a1fff1d926d25067c555d6c5ecc6708a452df7648
MD5 582b370e077dd9412daa10e8b7ac9015
SHA1 538a2aa698b3f41a1f0d0bcd195021946b4786a5
SHA512 f7d5b884300ca9f6de5df799e823a6bf630c83f75e4ed031dd3082b712c9f771e9378702ddc4a7ef9621141f1787c5db53768f2ba04b1f340fc59d6dfbdf0e30
SSDEEP 6144:jZTa9MWQh27pYg7Gg1uLJk352ADl81q3uF7EVfc:NTaqvh27pugwLJ2llU6u
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

36:1d:6f:d6:eb:70:ac:b0:5d:6e:0e:88:e6:e3:dc:82:8b:2d:f3:53

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

164632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortApp.pdb

iphlpapi

GetAdaptersInfo

kernel32

DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA lstrlenA lstrcmpiA lstrlenW lstrcpyA GetModuleHandleA GetModuleFileNameA LeaveCriticalSection InterlockedIncrement EnterCriticalSection InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA CompareStringA CompareStringW GetEnvironmentVariableA GetCurrentThreadId LoadLibraryA FreeLibrary GetProcAddress FileTimeToSystemTime SetEnvironmentVariableA DeleteFileA GetVolumeInformationA WaitForSingleObject GetTickCount ReleaseMutex SetEvent ResetEvent CloseHandle RaiseException CreateEventA InitializeCriticalSection CreateThread CreateFileA ReadFile WriteFile SetFilePointer GetFileSize VirtualProtect VirtualQuery IsBadReadPtr GetCurrentProcess SetFileTime SystemTimeToFileTime GetSystemTime MoveFileExA FileTimeToLocalFileTime GetFileTime GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTempFileNameA GetTempPathA CreateDirectoryA FindFirstFileA FindNextFileA FindClose FlushFileBuffers SetStdHandle WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange Sleep GetLastError SetUnhandledExceptionFilter CreateMutexA GetCPInfo GetOEMCP GetCommandLineA GetSystemTimeAsFileTime IsBadCodePtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemInfo VirtualAlloc RtlUnwind ExitProcess LocalFree GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings TerminateProcess

user32

CharNextA KillTimer SetTimer DispatchMessageA TranslateMessage PeekMessageA GetParent MsgWaitForMultipleObjects

advapi32

RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA ord165 SHGetSpecialFolderPathA

ole32

CoTaskMemFree OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize StringFromCLSID

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayCreate SafeArrayDestroy GetErrorInfo SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit VariantClear VariantCopy VarBstrCmp DispCallFunc RegisterTypeLi UnRegisterTypeLi LoadRegTypeLi LoadTypeLi VariantChangeType VarUI4FromStr VarBstrCat

shlwapi

StrToIntExA StrStrW PathRenameExtensionA PathFindNextComponentA PathIsURLW PathAppendA PathFileExistsW StrCmpIW PathFindExtensionA SHSetValueA SHGetValueA PathFindFileNameA

facemoodsEng.dll

IMPHASH 8b24b5fee3a50d84bb40a6cbf9737945
SHA256 7de1b95a08372d216e24078ad54f27783a6d04b88cac51f35deb8373cfe19c1b
MD5 45300e499ccca60e2a6869170eca9966
SHA1 fd9e5c83ff7337560e3f7f4ad9573934023b351b
SHA512 5733c6648f7ec897c8ca6f311b03d6b244ecd5865bdc4d1b79ba7edadefb38d88bc51297ee05973586dbec64b9c8a6f4817e17d84f2108443a991b6dc87bbc73
SSDEEP 6144:7LAZ7H7AcAV7PdAZckYFZboqfYCKNpPrnvxJYr7KU10:gZ7H7AcAVwcproqwCKNpjnXUK
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

79:80:a0:09:0b:3c:6b:a1:0b:3b:eb:5a:14:31:66:ee:d6:d5:58:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

227318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortEng.pdb

kernel32

CompareStringA CompareStringW GetEnvironmentVariableA SizeofResource LockResource LoadResource FindResourceA FindResourceExA CloseHandle WaitForSingleObject FlushInstructionCache GetCurrentProcess HeapAlloc GetProcessHeap GetCurrentThreadId CreateFileA CreateThread HeapFree GetTickCount MulDiv GlobalUnlock GlobalLock GlobalAlloc lstrcmpA GetProcAddress LoadLibraryA GetDateFormatA FileTimeToSystemTime SetEnvironmentVariableA FileTimeToLocalFileTime WriteFile GetFileTime Sleep ReleaseMutex SetEvent ResetEvent CreateMutexA CreateEventA MapViewOfFile CreateFileMappingA OpenFileMappingA GetFileSize UnmapViewOfFile ReadFile SetFilePointer FreeLibrary WideCharToMultiByte HeapDestroy HeapReAlloc HeapSize MultiByteToWideChar lstrcpynA InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange CreateDirectoryA FlushFileBuffers SetStdHandle GetLocaleInfoW IsBadCodePtr IsBadReadPtr IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetOEMCP SetUnhandledExceptionFilter TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCPInfo LCMapStringW LCMapStringA GetTimeFormatA GetCommandLineA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LocalFree GetModuleHandleA lstrcmpiA InterlockedDecrement InterlockedIncrement lstrcatA GetModuleFileNameA lstrlenA lstrcpyA IsDBCSLeadByte GetLastError LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW

user32

CreateAcceleratorTableA ScreenToClient UnregisterClassA CharNextA CharNextW SetWindowLongA PostMessageA GetClassInfoExA wsprintfA LoadCursorA CreateWindowExA RegisterClassExA DestroyWindow IsWindow IsWindowVisible SetTimer IsChild GetWindow GetParent DefWindowProcA GetWindowLongA CallWindowProcA SetWindowTextA GetWindowRect MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA FindWindowExA EnumChildWindows GetWindowThreadProcessId EnumWindows SystemParametersInfoA InflateRect SetForegroundWindow GetWindowTextLengthA GetWindowTextA AnimateWindow GetCursorPos OffsetRect ShowWindow MoveWindow RegisterWindowMessageA SendMessageTimeoutA GetCaretBlinkTime GetFocus GetClassNameA SetWindowPos RedrawWindow GetDlgItem SendMessageA SetFocus BeginPaint EndPaint DestroyAcceleratorTable GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor UpdateLayeredWindow CharLowerBuffA GetClientRect

gdi32

GetDeviceCaps OffsetViewportOrgEx CreateSolidBrush GetStockObject BitBlt CreateCompatibleBitmap CreateDIBSection DeleteObject SelectObject DeleteDC CreateCompatibleDC GetObjectA

advapi32

RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegCreateKeyExA RegSetValueExA RegEnumKeyExA RegQueryValueExA RegEnumValueW RegDeleteKeyA

shell32

SHGetFileInfoA SHGetSpecialFolderPathW

ole32

CoTaskMemFree StringFromCLSID StringFromGUID2 CoCreateInstance OleRun CreateItemMoniker CoInitialize CoUninitialize CLSIDFromProgID CLSIDFromString CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal CoGetClassObject OleInitialize OleUninitialize GetRunningObjectTable

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayGetDim GetErrorInfo SafeArrayGetUBound SafeArrayGetLBound VarBstrCat OleCreateFontIndirect VariantCopy DispCallFunc LoadRegTypeLi VarUI4FromStr VariantInit SysAllocStringLen VarBstrCmp RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString VariantClear SysStringByteLen SysAllocStringByteLen SysStringLen SafeArrayDestroy SafeArrayCopy SysFreeString

shlwapi

SHDeleteValueA SHGetValueA StrToIntExA SHSetValueA StrCmpIW PathFindExtensionA

gdiplus

GdiplusShutdown

ws2_32

WSAStartup WSACleanup getaddrinfo freeaddrinfo

facemoodsTlbr.dll

IMPHASH c5bd7ceec8c30d0cd7560ee6100655d6
SHA256 9e935e603e75690b3d56c748b2a435fa41fc3bb52508692c847b07acaeef45b1
MD5 0fb336ccb1fe21397098026df36fd914
SHA1 3fa3c67b6f4721a7d77cd478bd9b10a0377520fc
SHA512 28ccfcb2326812ff06ac097fe94fb117c3487c4aff8e5fd8b9e1eb8e51a57097eaab353239d6279b052abe7751e96e3aeccfb15ba1bca4305cd91ee7c6bd9b22
SSDEEP 3072:QJSxWnSCeKgNAO3HFubEz9Ev6U04Ws55h5paU5paEMlJ:QSxgaUbb674WE07N
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

9d:ea:86:7b:90:3e:02:11:14:5d:8c:48:88:7a:af:5d:71:e7:86:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

Minor OS version

0

Major OS version

4

Entry point

76049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escorTlbr.pdb

kernel32

GetModuleFileNameA GetCurrentThreadId InterlockedIncrement InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA HeapFree GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpA WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA GetModuleHandleA lstrcpyA lstrlenW lstrcmpiA lstrlenA SetStdHandle SetFilePointer IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetCPInfo GetOEMCP TerminateProcess GetProcAddress IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCommandLineA VirtualQuery GetProcessHeap HeapAlloc GetCurrentProcess FlushInstructionCache FindResourceExA FindResourceA LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetLastError WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InterlockedExchange InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetSystemInfo VirtualAlloc VirtualProtect GetSystemTimeAsFileTime RtlUnwind ExitProcess LocalFree HeapSize HeapReAlloc HeapDestroy GetACP FlushFileBuffers

user32

CreateAcceleratorTableA GetClassNameA SetWindowPos RedrawWindow GetDlgItem SetFocus GetFocus IsChild PeekMessageA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor MsgWaitForMultipleObjects GetWindowTextLengthA GetWindowTextA SetWindowTextA DispatchMessageA ScreenToClient GetCursorPos SendMessageA GetParent GetWindow GetWindowRect CallWindowProcA GetWindowLongA DefWindowProcA IsWindow RegisterClassExA CharNextA CreateWindowExA GetClientRect LoadCursorA wsprintfA GetClassInfoExA ShowWindow SetWindowLongA IsWindowVisible TranslateMessage DestroyWindow UnregisterClassA DestroyAcceleratorTable RegisterWindowMessageA

gdi32

GetStockObject GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject DeleteObject SetViewportOrgEx CreateSolidBrush GetObjectA

advapi32

RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA

ole32

CreateItemMoniker GetRunningObjectTable CoTaskMemFree StringFromCLSID OleRun CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemAlloc OleLockRunning CLSIDFromProgID CLSIDFromString CoGetClassObject

oleaut32

SysFreeString SysAllocString VariantClear VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit UnRegisterTypeLi RegisterTypeLi SysAllocStringLen DispCallFunc OleCreateFontIndirect

shlwapi

PathFindExtensionA

facemoodssrv.exe

IMPHASH 5bb76c9b862d3d66ddbf9ae1fa74b496
SHA256 856b3b38f679af08a54656a9e820702602e832ffae2e66c8c903891140a7ba23
MD5 e83686c5f2273f8a7561897dd5f4e570
SHA1 b46c493e729674c1f02ae94d32c476e5b5077625
SHA512 f6147079dd8ef60b5c9a470df2cdd435c0813b9eb28999a660c54a74fa63ef05f4c665016363cc3489240235c36a8af9c0472306b0fd18cfcb49c3059513909e
SSDEEP 6144:OuugnYauQVYW6jPF0bVNjkKKAoY9Si5MGUIKT:OuFYauQVxVNjlJf5Ux
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

f6:32:d9:41:0f:c5:f1:76:65:7a:6e:cd:f8:d5:61:6d:77:53:2d:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Sep 5, 2011

Minor OS version

0

Major OS version

4

Entry point

145035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dvlp\bin\facemoods\esrv.pdb

sensapi

IsNetworkAlive

kernel32

FileTimeToSystemTime FileTimeToLocalFileTime InterlockedDecrement GetFileTime WaitForSingleObject lstrlenA InterlockedIncrement lstrcmpiA lstrcpyA GetModuleHandleA GetModuleFileNameA lstrcpynA IsDBCSLeadByte LeaveCriticalSection EnterCriticalSection GetCurrentThreadId Sleep CreateThread CreateEventA lstrcatA SetEvent ExitProcess GetTickCount FreeLibrary LoadLibraryExA GetCommandLineA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc CompareStringA CompareStringW GetEnvironmentVariableA GetProcAddress LoadLibraryA SetFilePointer CreateDirectoryA GetTempPathA MoveFileExA GetTempFileNameA SetEnvironmentVariableA GlobalUnlock GlobalLock GlobalAlloc CreateFileA lstrcmpA ReleaseMutex ResetEvent CreateMutexA MultiByteToWideChar lstrlenW WideCharToMultiByte CloseHandle FlushFileBuffers SetStdHandle IsBadCodePtr IsBadReadPtr LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTimeZoneInformation SetUnhandledExceptionFilter GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate GetSystemTimeAsFileTime GetStartupInfoA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetDateFormatA GetTimeFormatA RtlUnwind LocalFree HeapSize HeapReAlloc HeapDestroy FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange WriteFile MulDiv

user32

SetWindowPos MsgWaitForMultipleObjects PeekMessageA GetWindowTextLengthA GetWindowTextA ShowWindow CharUpperA LoadIconA CharNextA SendMessageA UnregisterClassA DestroyWindow PostThreadMessageA DefWindowProcA LoadCursorA SetWindowTextA GetWindow SetWindowLongA IsWindow GetClassInfoExA CreateAcceleratorTableA GetParent GetClassNameA RedrawWindow DestroyAcceleratorTable GetDlgItem SetFocus GetFocus IsChild GetWindowLongA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetClientRect FillRect SetCapture ReleaseCapture GetSysColor GetMessageA DispatchMessageA TranslateMessage KillTimer RegisterWindowMessageA PostQuitMessage CreateWindowExA RegisterClassExA CallWindowProcA wsprintfA

gdi32

SelectObject DeleteObject CreateCompatibleDC BitBlt GetDeviceCaps GetObjectA GetStockObject CreateSolidBrush CreateCompatibleBitmap DeleteDC

advapi32

RegDeleteKeyA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegCloseKey

shell32

ord165 SHGetSpecialFolderPathA Shell_NotifyIconA SHGetFileInfoA ShellExecuteExA SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString CoTaskMemFree StringFromCLSID CoRevokeClassObject CoRegisterClassObject CoTaskMemAlloc CoCreateGuid CoTaskMemRealloc CoInitialize CoUninitialize StringFromGUID2 CoInitializeEx OleUninitialize OleInitialize CoGetClassObject

oleaut32

SysStringByteLen RegisterTypeLi DispCallFunc VarBstrCat OleCreateFontIndirect GetErrorInfo SysFreeString UnRegisterTypeLi VariantChangeType LoadTypeLi LoadRegTypeLi VarUI4FromStr SysAllocString SysAllocStringByteLen SafeArrayCopy SafeArrayDestroy SysAllocStringLen VariantCopy VariantClear SafeArrayUnlock SafeArrayLock VariantInit SafeArrayGetDim SafeArrayGetUBound SafeArrayGetLBound VarBstrCmp SysStringLen

shlwapi

PathFindFileNameA StrStrW PathFindExtensionA PathIsURLW StrToIntW SHGetValueA PathRenameExtensionA PathAppendA

uninstall.exe.nsis

SHA256 1726c56d80afe7d18c4a46e10a3b52de14ce9353659e5805034ad855a40299c2
MD5 bf1634fbcdbd45094bc2c137e43c029b
SHA1 d85ca3d3c113d96a73829f0d832f1498b431017e
SHA512 368ba7543286e4e492d69914ac5e64ae6bf68d9292411cb2bcafb85b38cc821996e14336d9166a9b97c9caedfc8a0b6db9acd6cfda23909bdf259f0e1702e1ff
SSDEEP 1536:Vw4I3JGjef21W4CBrtlp6bUi4VhYJfQfa:esiO1Yrtfm4VOP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 cb63b733a13c8765dc27269201021a4d6eb8b69996968707877dc7714de4695f
MD5 28b63cef8cadb57989672f95d2308462
SHA1 1fc67afbbb05d4bc9ad8eb548d93f9f6c51d1051
SHA512 8bb8e22636f7669005f955dea5bcbf2fbff57aa1664628a9dd43ba9217bb338c39510e99e73f09087a0a5059d60a9442e28df3ef84829f4f0cd67cfaea77a5a3
SSDEEP 384:iuKjwGitNo3psYgmyZBOpTMx2gUwJEMiMUTMF630Ac9khYLMkIX0+GTQ/h:izwDtNoSYgmyZ0KriMSMM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

15535

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/linker.dll

IMPHASH ecfc30d297c65075fc7d3aa46feca14c
SHA256 75db16ea26ec8c6e728f4a99b737c8b3a6548b4c6b47fbe20286683df4745574
MD5 8b1a528ab4dbb024442b42d7a0fedead
SHA1 95d45da81fe6d595147c18dfbd8e63915825c16a
SHA512 9ed39f5a657dfcd04f3d9ec5592a826e9120128056ca17495b267355452cffd247d35a051edb810fd7647bbbcbea30844a426ea18c5bfdabedc792a172aa4d97
SSDEEP 96:lFi2eJMNhAXZqUCN9jna18wz7u2OwJbD+Sgd+SyVOVZ:l7eCAejna1bHewJn+Sm+SA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/rk_banner.bmp

SHA256 8c7d6bf3132acf6c26b0998e3446c18948c5e6d0827e98c7c2d12d679405e9bc
MD5 6d971c06061ffe1974405bd3c3a45c42
SHA1 c2fa698022eb6b0b05f33c51c9623a3d6dba0767
SHA512 545f70f15b1c1ce08099d28872aeb90ce7587d015c3e9ce5b9db507108b6313da2dad9032957dbfe19d39512b1144200f804f6820b540707b20dd34311de6eca
SSDEEP 48:2wRcmjhBEywB9+yCZKxFNsAZ01/7z9z7TStK1O0KZpwAJEGjpoh6qJ57+nQM+1Bb:2n+zK0h9bpz0OvDBWGkNHLIf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/rkinstaller.exe

IMPHASH 938f2da2102daa2604b773017a49c17c
SHA256 f8d11b1e3e027355a11163049b530de4fd67183abd08a691d5d18744653ef575
MD5 af8ac2a4307d949833cf26af5d958bdf
SHA1 0fede0997d3c5b9f1f70f99e42166e33e4c4ca15
SHA512 6d69cadccfa1891141c4951a70ab2c2938d5a1345656bf6de0d479f5fc828d11f22cbb888596d25437ebf3e41576acfec52d2ebc481748306774ac472018cd9f
SSDEEP 6144:ZZmQiKD+jSaSIBRN1u49+BbE5VjPr6FkC+rfnsQg7zRQiV/R7f2tTBqHtSu:yKDJ3YaojD6FkC+rfns597f2tTsNb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

219933

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\trunk\client\BundleInstall\SmallStandalone\rkinstaller.pdb

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

wininet

InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetGetConnectedState HttpQueryInfoA

comctl32

ord17

wsock32

closesocket shutdown ioctlsocket gethostbyname setsockopt socket connect send WSAGetLastError listen WSAStartup WSASetLastError recv select __WSAFDIsSet htons bind accept

kernel32

GetStartupInfoA GetCurrentProcess OpenMutexA GetSystemDirectoryA InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrlenW WideCharToMultiByte GetModuleFileNameA GetSystemTimeAsFileTime Sleep CreateDirectoryA RemoveDirectoryA SetEvent OpenEventA GetVolumeInformationA GetVersionExA GetWindowsDirectoryA SetFileAttributesA GetFileAttributesA WriteFile CopyFileA WritePrivateProfileStringA FreeLibrary GetProcAddress LoadLibraryA WaitForSingleObject CreateProcessA lstrcmpiA ReadFile CompareFileTime GetTimeZoneInformation GetDiskFreeSpaceExA GetDiskFreeSpaceA GetModuleHandleA FindClose FindNextFileA FindFirstFileA GetTempPathA HeapAlloc GetProcessHeap EnterCriticalSection LeaveCriticalSection GetLocalTime OutputDebugStringA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapReAlloc VirtualAlloc FatalAppExitA VirtualFree HeapCreate HeapDestroy IsValidCodePage GetOEMCP GetACP TlsAlloc GetConsoleOutputCP WriteConsoleA GetStdHandle SetHandleCount SetStdHandle CloseHandle DeleteFileA GetTickCount GetStringTypeA GetStringTypeW SetConsoleCtrlHandler SetEndOfFile GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA GetLastError GetTempFileNameA HeapFree CreateFileA MoveFileExA WriteConsoleW CreateFileW ExitProcess HeapSize GetCurrentThread SetLastError TlsGetValue GetCPInfo LCMapStringW LCMapStringA GetCommandLineA CreateThread GetCurrentThreadId ExitThread LocalFileTimeToFileTime SetFileTime TlsFree TlsSetValue OpenProcess LocalAlloc LocalFree WaitForMultipleObjects TryEnterCriticalSection CreateEventA ResetEvent CreateMutexA ReleaseMutex CreateSemaphoreA ReleaseSemaphore CreateWaitableTimerA CancelWaitableTimer SetWaitableTimer QueryPerformanceFrequency QueryPerformanceCounter SystemTimeToFileTime FileTimeToSystemTime GetDateFormatA GetTimeFormatA GetSystemTime GetComputerNameA GetVersion GetPrivateProfileSectionA WritePrivateProfileSectionA FindFirstFileW FindNextFileW GetShortPathNameA FormatMessageA GetModuleFileNameW LoadLibraryExA MapViewOfFile CreateFileMappingA GetCurrentProcessId UnmapViewOfFile Process32Next Process32First CreateToolhelp32Snapshot SetFilePointer DeleteFileW InterlockedExchange InterlockedCompareExchange MultiByteToWideChar lstrlenA RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException FileTimeToLocalFileTime GetFileInformationByHandle PeekNamedPipe GetFileType GetConsoleCP GetConsoleMode FlushFileBuffers

user32

LoadImageA GetSystemMetrics LoadMenuA KillTimer GetClientRect SetWindowTextA PostMessageA SetWindowPos LoadStringA PostQuitMessage GetDesktopWindow GetWindowRect MoveWindow DestroyWindow DefWindowProcA CreateWindowExA ShowWindow UpdateWindow LoadIconA LoadCursorA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage DispatchMessageA SetForegroundWindow ReleaseDC GetDC ExitWindowsEx

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA SetSecurityInfo SetFileSecurityA GetSidSubAuthorityCount GetSidSubAuthority IsValidSid SetTokenInformation GetLengthSid SetSecurityDescriptorGroup SetSecurityDescriptorOwner InitializeSecurityDescriptor AllocateAndInitializeSid EqualSid RegSetKeySecurity RegDeleteKeyA RegSaveKeyA RegFlushKey RegEnumKeyExA RegCreateKeyExA SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl FreeSid RegOpenKeyExA RegDeleteValueA RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyA RegEnumKeyA RegEnumValueA RegCloseKey OpenProcessToken DuplicateTokenEx CreateProcessAsUserA GetTokenInformation

ole32

OleRun CoCreateInstance CoTaskMemFree StringFromGUID2 OleInitialize

oleaut32

SysAllocString SetErrorInfo VariantChangeType GetErrorInfo LoadTypeLi VariantClear VariantInit SysFreeString DispGetIDsOfNames CreateErrorInfo

shlwapi

SHCopyKeyA

gdi32

GetDeviceCaps

shell32

SHGetSpecialFolderPathA

$TEMP/rkverify.exe

IMPHASH 1161b78a97b6ce8841f8a608bc05e129
SHA256 1fb9cb60b11165df3298dee55b59517e3ed15957b820b19b4ca0d8f9f2e20173
MD5 11033fe49e144984b82ae16ce1221cd0
SHA1 5cafb0702e89b7a0982e33e8a5c5d52d0e17a1c2
SHA512 7eda789c95f11dea47189a6240fc791450fdf2496d26062824eb1d55581bbe8ed887a16c4e274f1ef86b8de27a582d39074e22f98129606f8e1a0300480a0bca
SSDEEP 6144:4vDfx5VSvd4vsG5eAFtU2K+Z+E1FgOMgEChTBqOhdKr0Y1445vbrr6zAHFf:4vDJ5VSviLtUDE/QChTsOYM4dr+zAx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

107879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

version

VerQueryValueA

kernel32

LockResource LoadResource FindResourceA GetModuleHandleA DeleteFileA Sleep CloseHandle GetTickCount WaitForMultipleObjects FreeLibrary GetProcAddress LoadLibraryA GetTempFileNameA GetTempPathA CreateEventA OpenProcess SizeofResource GetModuleFileNameA GetCurrentProcess InitializeSListHead Process32Next Process32First CreateToolhelp32Snapshot Thread32Next Thread32First InterlockedPopEntrySList WaitForSingleObject InterlockedIncrement InterlockedDecrement InterlockedPushEntrySList HeapFree GetProcessHeap CompareStringW CompareStringA FormatMessageA lstrlenA LocalAlloc MoveFileExA GetWindowsDirectoryA WritePrivateProfileStringA GetVersionExA GetVersion GetLastError WideCharToMultiByte MultiByteToWideChar InterlockedExchange LocalFree GetCurrentThreadId SetUnhandledExceptionFilter DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId UnmapViewOfFile GetComputerNameA MapViewOfFile CreateFileMappingA WriteFile SetFilePointer CreateFileA GetLocalTime GetSystemTimeAsFileTime SetEvent ResetEvent ReleaseMutex ReleaseSemaphore CreateMutexA CreateSemaphoreA GetThreadLocale QueryPerformanceFrequency QueryPerformanceCounter GetDateFormatA GetTimeFormatA HeapAlloc RaiseException TerminateProcess UnhandledExceptionFilter IsDebuggerPresent RtlUnwind HeapReAlloc VirtualAlloc VirtualQuery GetCommandLineA GetStartupInfoA ExitThread CreateThread LCMapStringA LCMapStringW GetCPInfo ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapSize HeapDestroy HeapCreate VirtualFree GetStdHandle SetHandleCount GetFileType GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetTimeZoneInformation GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA GetStringTypeW GetUserDefaultLCID EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle GetLocaleInfoW CreateFileW SetEndOfFile SetEnvironmentVariableA

user32

SetWindowsHookExA UnhookWindowsHookEx wsprintfA

advapi32

RegOpenKeyExA RegSetValueExA SetSecurityInfo InitializeAcl OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegQueryValueExA RegCloseKey

ole32

CoInitializeEx CoInitializeSecurity CoSetProxyBlanket CoUninitialize CoCreateInstance

oleaut32

SysFreeString VariantInit VariantClear SysAllocString

Uninstall.exe.nsis

SHA256 1fff05e6e01f4862ca337e81bdc988c6fa754feaff2a7d95af765b5d9561aff6
MD5 710a0b98b880309fd35874540a968046
SHA1 851c0046534be7d4287831649a51bca7f7af7abb
SHA512 3172b84a81f0e737cacd8482dc3db66ed7af23e58f03b748498fbfe81858a4277bdd98b79033a5d3ed77b2506345d07cd6613efdabc9f27133ce16ac0eea9cf7
SSDEEP 192:1m1+uKfrDiuhHBoFx+0MJs9vgXN/iX9d6Yd:0LaiuhhoF40A4Q/c/dd
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer