4103f3ac4d5bc3546475e3d681665a48_JaffaCakes118

resource
4103f3ac4d5bc3546475e3d681665a48_JaffaCakes118
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$WINDIR/System32/MP3IFilter.dll
unpack001/Cleaner.exe
unpack001/Firewall.exe
unpack001/Sweeper.exe
unpack001/Uninstaller.exe
unpack001/firewall.sys
unpack001/foxiecoreu.dll
unpack001/foxietoolbaru.dll
unpack001/uninst.exe
unpack001/update.exe

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_1

IMPHASH e993db4f819ff0a3121bf9c6b6c636cd
SHA256 3c72f2851f20fee1e57a73226a2d4a54d88f55fbcaa817bac22eaf01cb79c8de
MD5 4103f3ac4d5bc3546475e3d681665a48
SHA1 1ca6c69a4437b7ac6d1528a627263ab94aaa538b
SHA512 74ecac7b514cb8c85ce99a69d52ce6365ddfa9dc557b21742a2e4e621ecff02048ff67679b20a6915cb86e0b7d9475eb871ee9424636e9d377eca254a0566ed0
SSDEEP 24576:Yk2nx/H2D3SrB0f1N93/FMEnh45Pr3HisdUXGN4r4ac13ehxqmQsTk01H4UTV+0O:YZBH2rKB6N9lePr33N4nhxqmQU464
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA GetCommandLineA SetFileTime GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA MulDiv GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData CreateWindowExA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx CreateDialogParamA EmptyClipboard DestroyWindow SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint GetDlgItem

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Dialer.dll

IMPHASH b34e411b555c469d4deeeb6647de46ee
SHA256 da8778fd0478c6e03cea874cd730bf1951978aba8b1c54a557a8b19c51e94717
MD5 bff79c5e0239acd6a66ff84809460bae
SHA1 6d94135e7e1ecb103f48118e650056084ce2ea8e
SHA512 367f86ec6c35ea1fcd8b61e30585590137a4c08ae6d70088a781fe578cd025809b01d5208a9dde54869c8571e65fd9df4b1ff94cf6e692d0e637a1705ea53130
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH 9d433976e02d79532f0d635ee81d0b20
SHA256 191fab998e58b66a2416873b06062166b547eb3ba06b1326a4a785a566aaf76d
MD5 f407939127208a009b9a825cb77ed3c7
SHA1 051d7fccf3fb544acaa8ab6be590bb4bc79cef82
SHA512 d45d08823ac7667f071b21d238b7fda43115db3195a442cb17d880d147e8a930374403c970afc31f676f01a83fb9c63e3be047de7e16718a08a1fdbe4b690901
SSDEEP 192:hzixixDOHhG9db9rd+oSVPECMlh3I8tqDyn/7hwbbHF1QuCb:hOx0DOHqrdwTY6+n/72bbMum
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH d79c2fe1aafe446fbd9b984f61377e3e
SHA256 262bb55f83a9b8cc5cca3743d04937a85628e3ffcbb91300356c1f03a96432b4
MD5 7459b4d61dd26d2864cb79cae1a5229f
SHA1 93d502f81050038528b25eb6d774f729ed50a7e1
SHA512 822e4e2c858827681b233a435fef8667f098210d68aeb489ccdbf8f3da76bf3c5222eb41237a33c3eb6fc02299cd93e6c25cb84631718974a968117a7b050fff
SSDEEP 192:/Ted/9E1XMNUrW7VymsS9W+7HaQM7zFSnQXiCVIXuZsav+zPzrR2/Mi:/TqE2UrW9tWeaQ6zF1NIXu6a2DP8Ei
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 a9b38a164cc032ead8fdedf6a987ecff1f933298c809c226a47ea57cc12710d8
MD5 da3ad52de0af75df8b459c4f8c0c85bb
SHA1 5bfce84b6f3d19a4b7388f374ce1b915fbc9bbca
SHA512 0d6141cda379f1889d4959ed945b1bb4e92e945a0e6ea99a2deee205106e7062debb6e5acecba3438d71d3206266fe69a293611fbee6d0564106e1bae4f35320
SSDEEP 192:pOSsJI/rqmIDNLU0dq51EgAiNbubv6tLZ:nHQQ0d01Egbq76t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 6a1b1a2591320b7d51eb7f4beca092b2fa5a238b33d536a1c79fb9fae801261f
MD5 3e64b5f29e0ca2d0268220a249bdd794
SHA1 e59d23e1474566c27971332b878af073d1d9c334
SHA512 699cf14eb2447d6c6eba1d8a6d68115fc303a14b028c7660d2d01391e300d053d0eb00ae522bc082f54ef623fe37b2ea1ae8b52dd8e1649a13570a6e49ba9084
SSDEEP 192:emiTtiTtiTt6TtQsTtkTtoTtVcTt0b6Ttw3T1iTernqsTtYT/TJTEUTfTMTkTVTS:eUn15qQKLRSnBG8926
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 44b2bfda73c1687f72d78ab31c909172b6394337fe93a8940baaf142d94cf958
MD5 42d12d4dff053bfb3269c1261e2d0885
SHA1 ed43f7540276bbb7354de7b24160cf85464de57f
SHA512 c6c0271fb585f66c7f7b82f3e83acdb263e727b99a162abbc4ecc9030199df89a66e34230dcde6413adbd99f5911fc09d7f3c5a31d119c9a33141abfa68ef503
SSDEEP 3072:JBaqoYVdrBg4RGSIyyZQ/LCk3YmKiA/3Kj:jyYO4QSbyZpkIBiA/3Kj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$WINDIR/System32/MP3IFilter.dll

IMPHASH dfa7cff6e823476172313d0a524655c5
SHA256 c45f1502a712ee2a4ba66eb0c3fd2ba58ab30a1b0ac78e643e8ed84042354482
MD5 812b0c669fba023dc9a057371e867528
SHA1 c1fa9956748571f184f1219d9d0cbf421fb8c71f
SHA512 9e223098e1d51bf40dbbac61dce8b110e2fd4fe73b4cf31c199e7ee135628d340ddde53aa5c95fbc39e30f323d62abce981b93d29f2e40b5cc424284abe4f197
SSDEEP 1536:qFCKwvz+Y8n8QiCfQOHqjiCtUacg7zZTR7rkNJrW4JbrZzzoMKeArPjeoX:qFCFz+Y8nFf1HnCyjgSjZzzojrPjeoX
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

72985

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LeaveCriticalSection EnterCriticalSection InterlockedIncrement InterlockedDecrement DeleteCriticalSection DebugBreak lstrlenW GetShortPathNameW GetModuleFileNameW FreeLibrary SizeofResource GetVersionExW InitializeCriticalSection GetLastError LoadLibraryExW lstrcmpiW lstrcpynW GetFileSize GetLocaleInfoW GetSystemDefaultLCID LocalFree FormatMessageW HeapDestroy DisableThreadLibraryCalls SetFilePointer ReadFile CloseHandle CreateFileW OutputDebugStringW lstrlenA FindResourceW LoadResource RtlUnwind HeapSize WideCharToMultiByte SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers GetStringTypeW GetCurrentProcess LCMapStringW TerminateProcess GetStringTypeA SetStdHandle GetProcAddress GetOEMCP GetACP MultiByteToWideChar GetTimeZoneInformation GetSystemTime GetLocalTime RaiseException HeapFree HeapReAlloc HeapAlloc GetCommandLineA GetVersion GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue ExitProcess LCMapStringA FreeEnvironmentStringsA LoadLibraryA FreeEnvironmentStringsW SetUnhandledExceptionFilter HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA GetCPInfo IsBadCodePtr GetEnvironmentStrings GetEnvironmentStringsW WriteFile IsBadReadPtr

user32

wsprintfW CharNextW

advapi32

RegCreateKeyExW RegSetValueExW RegDeleteValueW RegEnumKeyExW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey RegQueryInfoKeyW RegEnumValueW

ole32

CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID CoTaskMemFree

oleaut32

VarUI4FromStr

wsock32

ntohl

shlwapi

PathIsURLW PathCreateFromUrlW

Cleaner.exe

IMPHASH c3427a1e15be9b1ee21b9356e39136ff
SHA256 e5ab257fbb25770033521040df23220a8a3c55a7d75798e233bb5b4da85572e2
MD5 51941a7da30cf4a246200a8b084ff617
SHA1 f64d02b9d9c42e63ced72c622a76080408c33f05
SHA512 6489a1b5b43f1302db92af4e0157294c2df25287e0c260f47a49945a6dc17471ac90168f4cd863074f68ac5c82b1687ef03bb2a5d80c30bfe48ef4631725fc0f
SSDEEP 6144:TbH2x032xd42bYUQdF0MV97OICNSb6TLkC7XWG:Tr2xlbXVW97OICNSbg
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

48542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Storm\Work\FoxieCleaner\Release\FoxeCleaner.pdb

winmm

timeGetTime

kernel32

TerminateProcess GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime ExitThread CreateThread RtlUnwind VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetStartupInfoA GetCommandLineA HeapReAlloc HeapSize GetTimeZoneInformation UnhandledExceptionFilter SetUnhandledExceptionFilter VirtualFree IsBadWritePtr GetStdHandle ExitProcess GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle SetEnvironmentVariableA FileTimeToLocalFileTime SetErrorMode FileTimeToSystemTime GetOEMCP GetCPInfo TlsFree LocalReAlloc TlsSetValue TlsAlloc TlsGetValue EnterCriticalSection GlobalHandle GlobalReAlloc LeaveCriticalSection LocalFree LocalAlloc DeleteCriticalSection InitializeCriticalSection GlobalFlags InterlockedIncrement GetCurrentDirectoryA GetFullPathNameA FindClose FlushFileBuffers SetFilePointer WriteFile ReadFile DeleteFileA InterlockedDecrement GlobalGetAtomNameA GlobalFindAtomA lstrcatA lstrcmpW lstrcpynA WritePrivateProfileStringA FreeResource GlobalAddAtomA GetCurrentThread GetCurrentThreadId FreeLibrary GlobalDeleteAtom lstrcmpA ConvertDefaultLocale EnumResourceLanguagesA lstrcpyA CompareStringW CompareStringA lstrlenA lstrcmpiA MultiByteToWideChar HeapDestroy HeapCreate GlobalLock GlobalUnlock MulDiv GlobalFree CreateEventA ResumeThread GlobalAlloc SetEvent WaitForSingleObject CloseHandle ResetEvent GetCurrentProcess GetProcessHeap HeapAlloc HeapFree GetPrivateProfileStringA FindFirstFileA RemoveDirectoryA FindNextFileA GetWindowsDirectoryA GetModuleFileNameA WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange LoadLibraryA OutputDebugStringA GetModuleFileNameW SetLastError GetLastError LoadLibraryW GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA GetDriveTypeA FreeEnvironmentStringsA

user32

DestroyMenu GetSysColorBrush RegisterWindowMessageA WinHelpA CreateWindowExA GetClassLongA GetClassInfoExA GetClassNameA GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow UpdateWindow GetMenu GetSubMenu GetMenuItemID GetMenuItemCount AdjustWindowRectEx GetClassInfoA RegisterClassA UnregisterClassA DefWindowProcA SystemParametersInfoA GetWindowPlacement GetWindow GetWindowTextLengthA GetWindowTextA SetWindowPos SetFocus ShowWindow GetDlgCtrlID SetWindowTextA IsDialogMessageA SendDlgItemMessageA wsprintfA GetDesktopWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow GetNextDlgTabItem EndDialog EndPaint BeginPaint GrayStringA DrawTextExA DrawTextA TabbedTextOutA SetMenuItemBitmaps GetFocus ModifyMenuA GetMenuState EnableMenuItem CheckMenuItem GetMenuCheckMarkDimensions LoadBitmapA SetWindowsHookExA CallNextHookEx GetMessageA TranslateMessage DispatchMessageA GetActiveWindow IsWindowVisible GetKeyState PeekMessageA GetCursorPos ValidateRect MessageBoxA GetLastActivePopup IsWindowEnabled PostQuitMessage PostMessageA SetRect GetDC ReleaseDC FillRect OpenClipboard EmptyClipboard CloseClipboard RedrawWindow GetDlgItem GetParent SetPropA GetWindowLongA GetCapture InvalidateRect SetCapture GetWindowRect ClientToScreen PtInRect ReleaseCapture LoadCursorA SetCursor GetPropA CallWindowProcA SetWindowLongA RemovePropA GetSysColor GetSystemMetrics LoadIconA EnableWindow SetParent GetClientRect IsIconic SendMessageA DrawIcon CopyRect

gdi32

GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutA TextOutA RectVisible CreateFontA GetClipBox SetMapMode SetBkColor RestoreDC SaveDC CreateBitmap GetDeviceCaps CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject BitBlt GetObjectA CreateFontIndirectA DeleteObject SetTextColor PtVisible

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegQueryValueExA CopySid GetLengthSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority RegCloseKey RegSetValueExA RegQueryValueA RegOpenKeyA GetUserNameA RegOpenKeyExA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA

shell32

ShellExecuteA

comctl32

ImageList_Destroy ord17

shlwapi

PathFindExtensionA PathFindFileNameA PathFileExistsA

ole32

CreateStreamOnHGlobal CoCreateInstance CoUninitialize CoInitialize

oleaut32

OleLoadPicture VariantClear VariantChangeType VariantInit

Firewall.exe

IMPHASH 39363a90f70480c381842f22282dd0cb
SHA256 be9da8e57f2372c2e5fd4fae7b1c21f7d909c0e642d7abca6b566dd4a12e0231
MD5 a9bae7ec6bc658f5f3f21763afcd852e
SHA1 04dafcbe2e16735df793e344f9466e3cc5e9d23c
SHA512 cc2549dfe7fd41410e8b79600aea10b7578ac55bd2071922346c9f08fc5fa2fd1891adcdaed30a104673e3a724462b4a0cb02755ad04dd676fce63c788ed7886
SSDEEP 6144:W8gNW3H/AW45Iz87Aqozzg/JUUEa8K41RZoEhLQfeXM:hgUX/AW45Toz2Uva8oEJQ2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

161931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateProcessW GetPrivateProfileStringW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetModuleHandleW OpenMutexW CreateMutexW Sleep InterlockedExchange DeviceIoControl CloseHandle CreateFileW SearchPathW GetLastError WideCharToMultiByte CompareStringW TerminateProcess CompareStringA GetLocaleInfoW SetConsoleCtrlHandler SetEndOfFile CreateFileA LoadLibraryA ReadFile IsBadCodePtr IsBadReadPtr SetStdHandle GetStringTypeW GetStringTypeA GetProcAddress GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCommandLineA GetCommandLineW GetCPInfo GetModuleFileNameW SetEnvironmentVariableA GetOEMCP GetACP GetEnvironmentStringsW FreeEnvironmentStringsW InterlockedDecrement InterlockedIncrement FormatMessageW MultiByteToWideChar HeapAlloc HeapFree RaiseException RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime GetModuleHandleA GetStartupInfoW GetVersion ExitProcess HeapReAlloc FatalAppExitA LCMapStringA LCMapStringW IsBadWritePtr GetEnvironmentStrings SetUnhandledExceptionFilter FreeEnvironmentStringsA GetCurrentProcess HeapSize GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree VirtualAlloc SetLastError TlsGetValue GetCurrentThreadId TlsSetValue TlsAlloc TlsFree FlushFileBuffers GetCurrentThread WriteFile SetFilePointer UnhandledExceptionFilter

user32

LoadMenuW DispatchMessageW TranslateMessage GetMessageW CreateWindowExW MessageBoxW LoadStringW RegisterClassW LoadCursorW PostMessageW GetWindow FindWindowExW DefWindowProcW DestroyWindow RegisterWindowMessageW LoadImageW PostQuitMessage DestroyMenu TrackPopupMenu SetForegroundWindow SetMenuItemInfoW GetCursorPos GetMenuItemInfoW GetSubMenu

advapi32

RegDeleteValueW CloseServiceHandle OpenServiceW CreateServiceW OpenSCManagerW DeleteService StartServiceW ControlService FreeSid CheckTokenMembership AllocateAndInitializeSid RegCloseKey RegEnumValueW RegEnumKeyExW RegCreateKeyExW QueryServiceStatus RegOpenKeyExW RegQueryValueExW RegSetValueExW

shell32

ShellExecuteW Shell_NotifyIconW

ole32

CLSIDFromProgID CoCreateInstance

shlwapi

SHDeleteKeyW

Resources/AdBlock/adblock.dat

SHA256 37b8214e60716bd4a6558d273e0b572a31e137d8c3b8983648e6c60d30a02376
MD5 a4d356979dc638e87d68007d253db17b
SHA1 24bc544c8592225dc3c34173c11848d14ad9261d
SHA512 75154dab994fd281240242bf2cd9bf742daa43863d470deb492d984292e313419b84fcf36cc1ed2dfbf0446deafa6be75fe463808e8c0e4c01f9703c5eb1cffd
SSDEEP 192:HJRX1QlG+dgKupOH6qbdr4zGHX2BEmrbRYaTRDmCkWM:HJV1GpCKoOH6Ur4z22BEm/fVSWM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Firewall/spamservers.dat

SHA256 59a9cf63142998e588fa04505a63746eefb6bda87c180b31be687bebdd94f09f
MD5 d882abde9ea62c3875386b41e48eb0bf
SHA1 b29152f63cb09429aa53e67c800e9410b8d5ca0c
SHA512 3b161075db856b02dd9dd6523ea624f41d333984d89276817fcaf11f6bf9195d32d43a439ff5dd688503cced8843c688145960e0b2599a2cccc2e8cf5fa18728
SSDEEP 768:fsyyWSARWFRPXdU8dTSjtwMIZnwJMoZPVUeOx:fbIPu8dTSJwfwJFPFOx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Firewall/spyservers.dat

SHA256 7e5bf4ffc6ed3a25848a9c0c9f4815536481af48f651b657268b6d2cce291dfb
MD5 beebf42f705ae45ea311a05056ef6b05
SHA1 475109abfcbe5c0f74e78a7266cb9904194a0293
SHA512 382a6605bac3a09f45868e2a047353e174e8ce057465ce084c2d1a9277b4b5233c8e7af2c482033aad30cbe1b108eac0ffb95c7ee59dab6868a1d66d0752f060
SSDEEP 768:XliDcyIpNEiS4zCsBiDegrtfxU5G/NAq5trbbxfQSvMJ98soK7tEXF2hmyeW10zK:cIpNEiS4zp4rt5UktNWThj3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Firewall/wormservers.dat

SHA256 dbf3c2167bdfa227696258e48acedecad30a0e5ac3167302324de227dd3ec0fe
MD5 ed1e1af2101156c5ac3ca7b0459d61f6
SHA1 0ba5cc8b7b340077e2ce3eb489e7a30a2ce669f1
SHA512 9a6e649cdb72697fd48958097544a8f073191ca7b8bdbe665dcd86957b5a9a48f47533e247ec2458c421a5411d7009383461565d3d30e118ddf1368b26be6c1f
SSDEEP 1536:LVlnR1oFgNNcPT4dBDvTtf/c2BWnNkeBhE5:ZNNZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/HTML/Desktop.htm

SHA256 42f8b8de52e44c4f1fa86a833c71c88bb6310f8f82a45c3055cb1016e50b243c
MD5 a7a47c0a0dce2bec43dae167a5a3798e
SHA1 31e749363319f8a09267a45e109e7b11f7788b46
SHA512 b312f1453e36294c42ac59076d83601cb26750d58fdc528cdf0299cc0d80bf7d82b1392deffee3b6f56a1112581c76860deab5d1044cceba91cfb16f534ca657
MD5 SHA1 SHA512

NSIS installer

installer

Resources/HTML/Infinity.htm

SHA256 ac3b5875fa4dcb5996a5e19b7ef06717b8e147c632e899ff20433e44467024a9
MD5 fac517442f28d6f238d9d6f927e7f846
SHA1 14f6f1eaa3a15f96f0aa12f69e1425914754a636
SHA512 d4f9256716def9c05b0e12c11455af8b224c90d773585d1704a5c480e3b1a8124e76990c7a7c8330ee951ad0ace2bd59693114062171485cd5e77171120209d2
MD5 SHA1 SHA512

NSIS installer

installer

Resources/HTML/Query.htm

SHA256 e051d9a1977ace7a5b603ff9128b0be1d27b096372a158cf54b73caf90469486
MD5 6e77207ebcbfdd884890e2e44b3dc3d2
SHA1 fa55279fb6615617d16efc1c9fe038e559b93f11
SHA512 a206c27f52f065e4186a478978fd47f8ba89046102156f8c454ffcf6eb23a37a0befbaf3903369a8a4cf8cb001fb26668cbd30c65ce28c958209aa3b1e21e218
SSDEEP 384:lWHdS4+EB0SfVNNEfjqsCC7a/5tdgARrHJpkxHSEsAlkrYT:89S4nB0SfvNEfMrHJp8SRAlkrYT
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

Resources/HTML/index.gif

SHA256 6f87c4c54c4952dc6b7b6597df0e613a5db826698df5c945d186ca2f146f926a
MD5 c48108051d43407cca9d269d5fb46b9e
SHA1 0988e40c92489bc793eb60028f0a53881700c246
SHA512 05f22c60b211f6fd43179592e61a1b0da7f0db6e2fd2e3944b6b9127e55edb1c8b60e50a7e23d18f52a3e3f821fe8bbc6e37f6f142779b2389452d1c3b38a677
SSDEEP 96:R5HQtZs2BKhC2Ppp/U9P6r4UECPVOmni3+UA1CcoL1ijBuKwQDfH8J:At2oh2x6Ir4h0VOsi3a1CDBgBuKwQ7Hk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Icons/Cleaner.ico

SHA256 e2fe5d3f754a555b1e900d63149f049763c966897b713c3723ab4a4b76303c33
MD5 972c94e08687b2640294bc6b60ecd503
SHA1 b2085c2114a609221cb03a43fc0d83be9851e8d3
SHA512 06cedd7ee167366f0954c4737b6c46a460e341ed17c13cc2e3455a12ffe43cbce2a73aea3a4e6205cca10d1c2e0e4eabe68e76eaf33d2ed974b61be6243f540d
SSDEEP 48:mblSUZtfiaN4jWtt8YIQymsj5naUMl+/iRSHvetZI+9Rc+AR:m5LprtOj1x9evI+9RIR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Icons/Desktop.ico

SHA256 59e9945d468aee75c785d9bf9ccc5f52e555202b96a174498b04686e4273a293
MD5 84f2205a8db056a9a9b8fe4bae6dd3a3
SHA1 5754015cc3d3a660813702607a453fa6d94e06ee
SHA512 9acf27e281c50408657b6f380d9065077924d2b83528e9d0d80afaad6972405e7213c6b5074a7d907fa5e496dfe28c8a200a393eb33a11144ea87e6942a3af26
SSDEEP 96:BNv/BSG7UBFOUqDtZ8vWd/y6F5hYO1kPT9eei/ZalJ:BNhSG7UBFO/DIm5wpeeicn
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Icons/Infinity.ico

SHA256 f8d75629240bbfaaf8176992f4faca3e3c369b6bed63ed91056284302160d4cb
MD5 277e3cd3486ceb619cf405bf2963ca36
SHA1 be02f5e0edba54d5c91cfa13e18dd45d8c5c9046
SHA512 15d54895ad97142cec9351f5ab8952bf60f4aeff1bece95061893b6d54e9b7f8037f94b8f5c7738bb618b4636cf6e116df2e416b150b4b1022096cb63e863210
SSDEEP 48:2krdfcn1XTPrcwLNvplB4pls+avgdZZLn1XnhXKZnL+4ORoDjr8Y5us1Ukcf0H6U:dW9TPWplsfA/9nhXsnVCo/rXt9cMGf+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Icons/Sweeper.ico

SHA256 0eccf7922e4e76c7b22dec8a16d14442f7ad445e52aecd89954b9040ebd97804
MD5 e345ce1450360aa9407d133c97d4dc73
SHA1 05ac37ee340738dd5d27e0f5a08068d2dea3d2e0
SHA512 1c90c26b8ad9105057fc9652f28e06085699d0b5449fe872202b5318f791967f2132a912081b1c1144e2d3eb376fcf0cae6aff9eee0aa3bf763af85bb85d6d98
SSDEEP 96:Mh0JDk19PfOdL8/+dUygMRG+M2nBalBf0HVkIZnl:Q01kX65giM8BalBQVk2l
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Resources/Sweeper/pests.dtx

SHA256 24cc2b70c4241768e7f4f89c6c6818f2af1288678fa8378dc254f320c2d95557
MD5 df25ef21ae77cc1fe9eecadeecd76eae
SHA1 ee4d7c123e892d6b66c87753e61f3749baba8fcb
SHA512 bb14440e3dc381f67bb999d47d5ec710c04ddce92537f93c545061cd70dcb93746cd99c4cb5f1e87538359d118cb7c4c4e30de90744d4355c18d9beb54ed541a
SSDEEP 12288:aZkjiWnbbdLfsjoKmjt8msYM8W27CBwOnrPvxvG/fpeyjjikvHJximt:HjiWn94oKmieW1BznDpQfpeilkmt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sweeper.exe

IMPHASH 7c4127fa341057be609672d8f98d71d0
SHA256 11ebc6c6f5b190bed312e647083e732d42cac4add6dfe9e9d222ec124f8f058b
MD5 7cd2c463c22d951595bab50604e4361a
SHA1 9abcf1b6fb98452b88bcb4ebaa14f28d920260ea
SHA512 846367bdd9a2a1a3a3ce541c851b6c51937692039cc2d5124f5a12e967c67a53c7583496979aafe73123420ba84eab06034b9ed0e87e35d8aa0cbc4531c75c5f
SSDEEP 6144:UJQMK+wDFQvzzAK9JoDsG1KT01RjM759uF+xvtkqhC9ahrNprNdxTBHlejRFghha:NMK+wDFQvzzAK9JasG1KTaRM7LhxlhoV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

147249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

psapi

EnumProcesses EnumProcessModules GetModuleBaseNameA GetModuleFileNameExA

winmm

timeGetTime

dbghelp

MakeSureDirectoryPathExists

kernel32

GetLongPathNameA OpenProcess TerminateProcess CreateDirectoryA GetWindowsDirectoryA FindFirstFileA FindNextFileA FindClose DeleteFileA CompareStringW CompareStringA lstrlenA lstrcmpiA GetVersion GetLastError MultiByteToWideChar HeapAlloc HeapFree HeapDestroy HeapCreate GlobalLock GlobalUnlock MulDiv GlobalFree CreateEventA ResumeThread GlobalAlloc SetEvent FreeResource GetProcAddress GetModuleHandleA lstrcpynA lstrcmpW lstrcatA FreeLibrary LoadLibraryA GlobalDeleteAtom GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetCurrentThreadId lstrcpyA EnumResourceLanguagesA ConvertDefaultLocale lstrcmpA GetCurrentThread SetLastError WritePrivateProfileStringA LocalFree FormatMessageA InterlockedDecrement ReadFile WriteFile SetFilePointer FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFileSize DuplicateHandle GetCurrentProcess GetVolumeInformationA GetFullPathNameA CreateFileA RaiseException InitializeCriticalSection DeleteCriticalSection GlobalFlags LocalAlloc LeaveCriticalSection GlobalReAlloc GlobalHandle EnterCriticalSection TlsGetValue TlsAlloc TlsSetValue LocalReAlloc TlsFree InterlockedIncrement GetCPInfo GetOEMCP FileTimeToSystemTime SetErrorMode FileTimeToLocalFileTime GetFileAttributesA GetFileTime RtlUnwind ExitProcess ExitThread CreateThread VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetTimeFormatA GetDateFormatA GetSystemTimeAsFileTime GetStartupInfoA GetCommandLineA HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter VirtualFree IsBadWritePtr SetHandleCount GetStdHandle GetFileType LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeZoneInformation FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId IsBadReadPtr IsBadCodePtr SetStdHandle SetEnvironmentVariableA WaitForSingleObject CloseHandle ResetEvent GetModuleFileNameA WideCharToMultiByte FindResourceA LoadResource LockResource SizeofResource GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange

user32

LoadBitmapA GetMenuCheckMarkDimensions CheckMenuItem EnableMenuItem GetMenuState ModifyMenuA SetMenuItemBitmaps wsprintfA PostQuitMessage ValidateRect GetCursorPos TranslateMessage GetMessageA TabbedTextOutA DrawTextA DrawTextExA GrayStringA BeginPaint EndPaint GetSysColorBrush DestroyMenu GetClassLongA GetClassInfoExA SendDlgItemMessageA GetFocus SetFocus GetWindowTextLengthA GetWindowTextA GetForegroundWindow GetLastActivePopup DispatchMessageA GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageA MapWindowPoints GetKeyState SetForegroundWindow IsWindowVisible UpdateWindow GetMenu PostMessageA GetSubMenu GetMenuItemID GetMenuItemCount AdjustWindowRectEx GetClassInfoA RegisterClassA UnregisterClassA GetDlgCtrlID DefWindowProcA SetWindowPos SystemParametersInfoA GetWindowPlacement GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamA DestroyWindow IsWindow IsWindowEnabled GetNextDlgTabItem EndDialog ShowWindow SetWindowTextA IsDialogMessageA GetClassNameA SendMessageA EnableWindow CopyRect RegisterWindowMessageA DrawIcon IsIconic GetClientRect SetParent LoadIconA GetSystemMetrics RemovePropA SetWindowLongA CallWindowProcA GetPropA SetCursor LoadCursorA ReleaseCapture PtInRect WinHelpA MessageBoxA RedrawWindow CharUpperA CreateWindowExA SetWindowsHookExA CallNextHookEx ClientToScreen GetWindowRect SetCapture InvalidateRect GetCapture GetWindowLongA SetPropA GetParent GetDlgItem FillRect GetSysColor ReleaseDC GetDC SetRect GetWindow

gdi32

ScaleWindowExtEx SetWindowExtEx SetMapMode PtVisible RectVisible TextOutA ExtTextOutA Escape SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx GetStockObject CreateFontA SetTextColor DeleteObject CreateFontIndirectA GetObjectA BitBlt SelectObject DeleteDC CreateCompatibleBitmap CreateCompatibleDC CreateSolidBrush GetDeviceCaps RestoreDC SaveDC CreateBitmap SetBkColor GetClipBox

advapi32

RegQueryValueExA RegOpenKeyExA RegDeleteValueA RegQueryInfoKeyA RegEnumKeyA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegCloseKey RegConnectRegistryA RegQueryValueA RegEnumValueA RegOpenKeyA

shell32

ShellExecuteA SHFileOperationA SHGetPathFromIDListA SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal CoTaskMemFree

oleaut32

OleLoadPicture VariantClear VariantChangeType VariantInit

comctl32

ord17 ImageList_Destroy

shlwapi

PathFileExistsA PathFindExtensionA PathFindFileNameA PathStripToRootA PathIsUNCA SHDeleteKeyA

oleacc

LresultFromObject CreateStdAccessibleObject

winspool.drv

DocumentPropertiesA OpenPrinterA ClosePrinter

comdlg32

GetFileTitleA

Uninstaller.exe

IMPHASH 021da08a07fcf2dd324621ca70558988
SHA256 4d9fdc0327bcf498179b90ae8c83a89282af8f358fffa0abbc1d30fa68f54232
MD5 904b62bb34ba8d13925136f8329478b2
SHA1 680dc77ca6ed01bd737baa7a204520fdb248bf95
SHA512 01bb7691361e5a2afc319f7a5e79a300a61baa986e7f26dfbe8adac7ca08df8dce2be223a5094c1d8a0bf530451d7ad90b72f543aeeb661ecb108cd7edf9e024
SSDEEP 192:T6wyvtVjtbDdJeWAX3JYwfTqbDK0mPOcNKOQpIVEsRcBXnbW6OND3WyB8:T6wy5bgfTqT+TDQXnbRSD3WyG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

firewall.sys

IMPHASH 055fba7960e2e230066bcd8246ad7519
SHA256 1b6f32ee6b1e66a1c1804e0dc08a76340d7c38ff366e9170b2eac97466794506
MD5 5779f099684ddf70a0c63e21b498ad34
SHA1 9cc8f0be4d8e3ed1ab1ef4256f1e77c53fcd2013
SHA512 fa8c8b6085cac2070f004ebdc1f9a8dc02d27bcd53ec95b3e76e36cd9675b279cb36708a04eb3dfcc34a83e9cf8eb666cda8cbadc04bd8c2f9a8f239571fd064
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

foxiecoreu.dll

IMPHASH c0627660005467aa289882361cab88e6
SHA256 63505ff185c63732a42ded30d858906dfc3c4e3922c1f124841a0171f4f56cc5
MD5 2db21b165a85aef52c5074fb7f166938
SHA1 a9512fd2530a50b3faccad9594b552cd78a9d1cc
SHA512 ee9dc74756e1826b48a47d4e208609e2619d88b88952df6036852cb256f805c8469079ff585007ed132eea46760830eb177d671d121eb603e2af92423e984ce9
SSDEEP 12288:bAW5Drce/fYBUhLw625TDre6kNOaMZzVB3m2QaMPHfyVE7562us5bUAdlUz22EXu:MrOoetG322QaMPHfyVE7562us5bUAdlE
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

294949

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

OpenMutexW CloseHandle IsBadWritePtr GetCurrentProcessId FindResourceW LoadResource LockResource WideCharToMultiByte lstrcpynW GetVersionExW lstrlenA CreateProcessW GetPrivateProfileStringW lstrcmpW FlushInstructionCache GetCurrentProcess MultiByteToWideChar InterlockedIncrement GlobalAlloc InterlockedDecrement GlobalUnlock LoadLibraryW GlobalLock FreeLibrary lstrcatW GetProcAddress LeaveCriticalSection EnterCriticalSection lstrcpyW GetModuleFileNameA DisableThreadLibraryCalls GetCurrentThreadId GetModuleFileNameW GetModuleHandleW lstrlenW DeleteCriticalSection InitializeCriticalSection GetShortPathNameW HeapDestroy

user32

LoadStringW GetDC DestroyIcon DrawStateW CopyRect GetWindowRect OffsetRect UnionRect GetAsyncKeyState CharUpperW MoveWindow ShowWindow SetTimer GetKeyState DialogBoxParamW CreatePopupMenu AppendMenuW FindWindowExW MessageBoxW DestroyWindow CharNextW ReleaseDC GetFocus UnregisterClassW RegisterClassExW LoadCursorW GetClassInfoExW RegisterWindowMessageW DefWindowProcW GetWindowLongW GetWindow SetWindowLongW SetWindowTextW GetWindowTextW GetWindowTextLengthW GetSysColor SetFocus IsChild GetMenuItemCount GetMenuItemInfoW EndPaint FillRect CallWindowProcW GetClientRect IsWindow BeginPaint RedrawWindow DrawTextW TrackPopupMenuEx GetWindowDC IsWindowEnabled GetActiveWindow GetWindowThreadProcessId ClientToScreen GetSystemMetrics SystemParametersInfoW LoadBitmapW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW PostMessageW ScreenToClient LoadMenuW GetSubMenu SetMenuItemInfoW GetClassNameW SetWindowPos InsertMenuW TrackPopupMenu GetAncestor DestroyMenu EnableMenuItem EndDialog CreateWindowExW wsprintfW GetDlgItem SendMessageW InvalidateRgn InvalidateRect SetCapture ReleaseCapture CreateAcceleratorTableW GetDesktopWindow GetParent

gdi32

CreatePen LineTo MoveToEx SelectObject CreateCompatibleBitmap CreateCompatibleDC BitBlt GetStockObject GetCurrentObject DeleteDC DeleteObject GetObjectW CreateSolidBrush ExtTextOutW Rectangle CreateFontIndirectW SetBkMode SetBkColor SetTextColor GetDeviceCaps

advapi32

RegDeleteValueW OpenSCManagerW RegCloseKey RegSetValueExW RegCreateKeyExW RegEnumValueW RegEnumKeyExW RegQueryValueExW RegOpenKeyW RegOpenKeyExW QueryServiceStatus OpenServiceW CloseServiceHandle StartServiceW

ole32

CLSIDFromProgID CoCreateInstance OleUninitialize StringFromCLSID CLSIDFromString CoTaskMemFree CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal OleInitialize

oleaut32

RegisterTypeLi LoadTypeLi SysStringLen VariantClear SysAllocString LoadRegTypeLi OleCreateFontIndirect SysStringByteLen VariantChangeType SysAllocStringLen SysFreeString

shlwapi

SHDeleteKeyW

msvcrt

_strlwr memcmp free __dllonexit ?terminate@@YAXXZ _wtol wcsrchr wcscpy wcschr memmove realloc strncpy memset wcscmp wcscat time srand rand swscanf _onexit _wcsicmp memcpy strstr swprintf wcslen ??2@YAPAXI@Z ??3@YAXPAX@Z __CxxFrameHandler _chkesp _ftol _adjust_fdiv _except_handler3 _purecall _wtoi _initterm malloc

comctl32

ord17 ImageList_Draw ImageList_GetIcon ImageList_Create ImageList_Destroy ImageList_AddMasked ImageList_GetImageCount

msvcp60

?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z ?good@ios_base@std@@QBE_NXZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JW4seekdir@ios_base@2@@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Nstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??Pstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z ?eof@ios_base@std@@QBE_NXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z

foxietoolbaru.dll

IMPHASH b84d76b700212b1af91f965824331492
SHA256 a780a1a14935cafbbba21bc8232eb9c4a0e78d2ba0e6747134937e0fab33ba81
MD5 945756b60135ce3c3a1bd7c10d79db3a
SHA1 247ce597e68c8d74696910bee78e3ca42c74fe05
SHA512 ff82ab1c7e9aa2e234729ced2a8e3fa9309cc361652bccd29b4be0f9c60b411900dcf7885558cc666a015492e1e187135440d44c549a3b85921fdbe4ca0b20b3
SSDEEP 6144:/vBasnoZDc/4IWQmZvGbhOxDJLkGpiDdITVVmziaRV+XzNiRI9Ny8Qo:B9nAo/yHvGbKDJLkGIdITV6iaMzBNy87
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

180119

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FreeLibrary GetShortPathNameW DisableThreadLibraryCalls DeleteCriticalSection CreateProcessW LeaveCriticalSection InitializeCriticalSection EnterCriticalSection InterlockedIncrement lstrcmpiW GetCurrentThreadId GetVersion InterlockedDecrement LoadLibraryA GetModuleHandleW GetFileAttributesW GetProcAddress lstrcatW HeapDestroy GetModuleFileNameW GetCurrentProcess GetVersionExW lstrcpyW GetOEMCP GetACP SetStdHandle IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter CloseHandle FlushFileBuffers SetFilePointer WriteFile HeapSize TerminateProcess IsBadWritePtr VirtualAlloc VirtualFree HeapCreate GetVersionExA GetEnvironmentVariableA GetModuleFileNameA TlsGetValue TlsFree TlsAlloc TlsSetValue GetCPInfo LCMapStringW LCMapStringA ExitProcess GetCommandLineA RaiseException lstrcpynW HeapAlloc HeapReAlloc HeapFree RtlUnwind MultiByteToWideChar LoadLibraryW GetModuleHandleA InterlockedExchange Sleep GetLastError lstrlenW SetLastError LockResource LoadResource FindResourceW FlushInstructionCache OutputDebugStringA WideCharToMultiByte lstrcmpW GetCurrentProcessId

user32

SetWindowLongW LoadBitmapW SystemParametersInfoW GetSystemMetrics DefWindowProcW SendMessageW GetWindowLongW ClientToScreen GetParent IsWindow GetWindowThreadProcessId GetActiveWindow IsWindowEnabled GetWindowDC ReleaseDC CallWindowProcW LoadMenuW GetSubMenu TrackPopupMenuEx GetMenuItemInfoW IntersectRect OffsetRect SetCapture ScreenToClient PeekMessageW GetMessageW TranslateMessage DispatchMessageW GetMessagePos WindowFromPoint GetMessageTime GetDesktopWindow InvalidateRect RemoveMenu EnableMenuItem CharNextW PostMessageW GetDlgCtrlID RedrawWindow LoadImageW GetFocus CallNextHookEx GetClassInfoExW RegisterClassExW LoadCursorW SetFocus ShowWindow GetClientRect SetWindowPos MoveWindow GetWindowTextLengthW GetWindowTextW CreateWindowExW wsprintfW UnhookWindowsHookEx SetWindowsHookExW DestroyWindow FindWindowExW GetWindow GetKeyState GetWindowRect IsRectEmpty LoadStringW CopyRect DrawStateW SetMenuItemInfoW DestroyMenu GetSysColor DestroyIcon DrawTextW GetMenuItemCount

gdi32

DeleteObject SetBkColor MoveToEx CreateFontIndirectW SelectObject DeleteDC SetBkMode SetTextColor GetObjectW Rectangle ExtTextOutW LineTo CreateCompatibleDC CreateSolidBrush BitBlt GetStockObject GetCurrentObject CreatePen

advapi32

RegEnumKeyExW RegCloseKey RegEnumValueW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegQueryValueExW RegOpenKeyExW

ole32

CLSIDFromProgID CoCreateInstance

oleaut32

SysFreeString SysAllocString VariantClear LoadTypeLi RegisterTypeLi SysStringLen LoadRegTypeLi

shlwapi

SHDeleteKeyW

uninst.exe

IMPHASH e993db4f819ff0a3121bf9c6b6c636cd
SHA256 f97e623846f8f276f469772ca58d0c03a536e69b25f19207d6d06b556aaed506
MD5 d9ede82a6ff2ebd2fe6681dfe6a9d3d9
SHA1 3213e91ea6ffc5fcc2a404639aa5ed5120d1f68e
SHA512 b67c9af19cbdf1f65c6db8e9fe294e8a11ce1a606c4e5eff91375b1fb4d898ce0b5e064edf5c817e75b33a8aadbb9ac34f7553d99c437bb8ccf113464d2f441e
SSDEEP 1536:OWbXhuGWZzJkAKqQxenkJnuQcREYRNtuUBXn:OkxuGW5Jk33xenkJnrq3Rn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA GetCommandLineA SetFileTime GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA MulDiv GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData CreateWindowExA OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx CreateDialogParamA EmptyClipboard DestroyWindow SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint GetDlgItem

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/modern-header.bmp

SHA256 6a1b1a2591320b7d51eb7f4beca092b2fa5a238b33d536a1c79fb9fae801261f
MD5 3e64b5f29e0ca2d0268220a249bdd794
SHA1 e59d23e1474566c27971332b878af073d1d9c334
SHA512 699cf14eb2447d6c6eba1d8a6d68115fc303a14b028c7660d2d01391e300d053d0eb00ae522bc082f54ef623fe37b2ea1ae8b52dd8e1649a13570a6e49ba9084
SSDEEP 192:emiTtiTtiTt6TtQsTtkTtoTtVcTt0b6Ttw3T1iTernqsTtYT/TJTEUTfTMTkTVTS:eUn15qQKLRSnBG8926
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

update.exe

IMPHASH 2384322fefff03863661d42796fb6a08
SHA256 aa2f9a69f213e4f28e5a7725441c1822cefaf0899fb9ce612b037b1206096011
MD5 a325a98e64dd836da11a6d75d8aee127
SHA1 3fb4c84e314778c46c65de3b5d16bbeb08ad5336
SHA512 3b2e7f91019197146857ef4167ab24677a85babd98ea8aaa6c4842ad54fc3f4b6448b56471b1cb41109944c51798ae16d9163ec0c98dc9568ca44091abbf4509
SSDEEP 3072:56jPlsiQ3zuYgCic/MbR7Zn7eECfvUcZcetLYC1p9+2J+eNdP2NE7ERFMtnqCXi1:5/wbR7ZnrCfvURetLYm+24ih7+IXiv7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

116287

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateMutexW GetTempPathW MultiByteToWideChar Sleep lstrlenA ResumeThread lstrlenW WideCharToMultiByte WaitForSingleObject CreateThread CreateProcessW DeleteCriticalSection InitializeCriticalSection GetCurrentProcess FlushInstructionCache GetCurrentThreadId EnterCriticalSection SuspendThread DeleteFileW OpenMutexW HeapDestroy GetVersion ExitProcess GetStartupInfoA GetCommandLineA IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetProcAddress SetUnhandledExceptionFilter SetEnvironmentVariableA SetEndOfFile GetLocaleInfoW LoadLibraryA GetOEMCP CreateFileA GetACP LeaveCriticalSection ReadFile SetStdHandle LCMapStringW WriteFile CloseHandle InterlockedExchange InterlockedDecrement InterlockedIncrement HeapFree HeapReAlloc HeapAlloc RtlUnwind GetTimeZoneInformation GetSystemTime GetLocalTime RaiseException GetModuleHandleA SetFilePointer FlushFileBuffers HeapSize TerminateProcess LCMapStringA VirtualFree GetCPInfo CompareStringA CompareStringW GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapCreate TlsAlloc VirtualAlloc IsBadWritePtr TlsSetValue SetLastError TlsGetValue GetLastError

user32

FindWindowExW DispatchMessageW TranslateMessage GetMessageW PeekMessageW CreateDialogParamW SetTimer GetDlgItem SendMessageW LoadImageW SetWindowLongW SetWindowTextW ShowWindow PostQuitMessage DestroyWindow MessageBoxW EndPaint DrawIconEx BeginPaint ScreenToClient GetWindowRect PostMessageW GetWindow wsprintfW

gdi32

CreateFontIndirectW DeleteDC GetStockObject GetObjectW DeleteObject

advapi32

RegCloseKey RegEnumValueW RegEnumKeyExW RegQueryValueExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW

wininet

InternetOpenUrlW InternetCloseHandle InternetOpenW HttpQueryInfoW InternetReadFile

shlwapi

SHDeleteKeyW

comctl32

ord17

Sharing

General

Malware Config

Signatures

File Explorer