494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118

resource
494b4a4f6f9fc3d298619519417bac4a_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/Unlocker.exe
unpack001/UnlockerAssistant.exe
unpack001/UnlockerCOM.dll
unpack001/UnlockerDriver5.sys
unpack001/UnlockerHook.dll
unpack001/eBay_shortcuts_1016.exe
unpack002/eBayShortcuts.exe
unpack001/uninst.exe
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/eBay_shortcuts_1016.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_1

IMPHASH 1cf4252ebbb4f173d97a6ef4f79a60b5
SHA256 d4979877d317ac3ee167239f647f6a55a821cfac7875528e3bbecb7110f2f60b
MD5 494b4a4f6f9fc3d298619519417bac4a
SHA1 c1e1bda6a632ae178386b89da3a3d15d97ef9bca
SHA512 b81e78488654f27fb9c8725e4f0c1555eefabe8958a72dd36a90362689aebc990213f4aafc082baebe6f6683082aad0a7bac62365ca3854df36598db4e33f320
SSDEEP 6144:+O9jt6wZu8OGauB794zlvkuymdzXZIwaUPT3Pbkx:oQauB794zny3wpPbbkx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17 ImageList_AddMasked ImageList_Destroy ImageList_Create

kernel32

ExpandEnvironmentStringsA GetEnvironmentVariableA lstrcmpiA CloseHandle SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess WaitForSingleObject GetCommandLineA GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA GlobalFree MulDiv DeleteFileA FindFirstFileA FindNextFileA FindClose GetExitCodeProcess SetErrorMode GetModuleHandleA SetFilePointer LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile lstrcpynA

user32

ExitWindowsEx CharNextA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint PeekMessageA

gdi32

GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SetBkColor SelectObject

advapi32

RegEnumValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegEnumKeyA

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1024B

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/InstallOptions.dll

IMPHASH 922b855d216a21490e4bcbf6c29b7f7d
SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
MD5 07f3b3445f66e1089567796bf3c8be78
SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH ee01c5cc33cdb3294484fc93e41c14ad
SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
MD5 2c3c8976d729d28478a789217a882291
SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5094

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH a75ed4b57a83b633f5cb5d4939d72f27
SHA256 5e97602008ba004c72d58f71e77ffe0a0ea01103867eb12a9ec0f28e72f440d8
MD5 afd989ef7eec6bf952bedfce541fe236
SHA1 5654b71c5b1089c2cec6381d8da5bd14a14e1a37
SHA512 f4e3d88477d39218667dd482a08904b2b69435db7d1fdd492380544aff83895d393a288c329da69074b69c68f51db45f694dfea81fc12fa2042ed43b3d06440c
SSDEEP 192:XZNEnGTkTwat3s8pXqrpxwvcq5/pZquJKeS:y3nX/N/P9JJS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

README.TXT

SHA256 7c00bf4e04f2d7a452fee25fbcf69e08345a8a741695679b63e9e5d50c860848
MD5 1e4f56310340d972501b8931b5ab43e3
SHA1 04336a4eb4a258bb02479ab9dc2e90c330cff257
SHA512 270eb0d37d1df439e8de81bb82f4991dd12d306d18c870a1a4eb4f093d12b89562d165ca2ce72fc6012f8ad774378be87abd59467f4e30b5b8895f60de2754f6
MD5 SHA1 SHA512

NSIS installer

installer

Unlocker.exe

IMPHASH 733844f6b8efb74f4dfc996131bcb3e0
SHA256 a85f81b612b907b88b4ae0068f50d091031e7026e33831b9e4d1680f2be78f4f
MD5 aeb7861bf49f5d0b1834e3571bca1803
SHA1 dfc9af417868a6d5023d2fd6b487d3139d781f3f
SHA512 b215b1e29d77bda9359bc0934bece99e93f8daec8e2e12b5d42cf873c66e93d267c7b73cd1dd03ed9a685133c6bd89ed7f9238f598e483c2c1ab2ee4e5d651ff
SSDEEP 1536:1juMk1QewWFHiUzyJBGMXW6hlFTaBpTwUFbFkKABTP4ZhOQS62Sl3niH/q:0dwWJiUzTMXW6MkDKABTP4ZM1o3+/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

80486

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

psapi

GetModuleFileNameExW GetModuleBaseNameW EnumProcessModules

comctl32

InitCommonControlsEx ImageList_ReplaceIcon ImageList_Create ImageList_SetBkColor

ws2_32

recv send connect htons gethostbyname socket WSAStartup

shlwapi

StrStrA PathRemoveExtensionW PathStripPathW SHDeleteKeyA StrToIntA wvnsprintfA PathStripToRootW PathIsDirectoryW PathFindExtensionW StrStrW PathSkipRootW PathRemoveFileSpecW

kernel32

Module32NextW GetModuleFileNameW Module32FirstW Process32NextW CreateThread ExitProcess CreateFileA QueryDosDeviceA CreateToolhelp32Snapshot lstrcmpiW GetCommandLineW lstrlenW lstrcpyA LocalFree GetProcAddress LoadLibraryA lstrcpyW GetLongPathNameW CloseHandle ReadFile CreateFileW WriteFile GetModuleHandleA MultiByteToWideChar GlobalAlloc GlobalFree lstrcmpA RemoveDirectoryW DeleteFileW SetFileAttributesW GetFileAttributesW GetShortPathNameW MoveFileW GetVersionExA GlobalUnlock GlobalLock GlobalReAlloc FindClose FindNextFileW lstrcmpW FindFirstFileW lstrlenA MoveFileExW VirtualFreeEx WaitForSingleObject CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess DuplicateHandle GetCurrentProcess TerminateProcess Process32FirstW

user32

DialogBoxParamA wsprintfA CharUpperW SendDlgItemMessageA UpdateWindow InvalidateRect ShowWindow GetSysColor GetDlgItemTextW GetClientRect ClientToScreen GetDlgItem CallWindowProcA DestroyCursor SetWindowLongA SetCapture SetCursor LoadCursorA PtInRect ReleaseCapture GetSystemMetrics LoadIconA DestroyIcon SetDlgItemTextA SetDlgItemTextW SetWindowTextA PostMessageA GetWindowRect GetWindowPlacement EndDialog SetWindowPlacement GetDC SendMessageA DrawTextA MessageBoxA wsprintfW MoveWindow

gdi32

GetObjectA CreateFontIndirectA SelectObject

comdlg32

GetSaveFileNameW

advapi32

SetNamedSecurityInfoW RegSetValueExW RegCreateKeyExA RegCloseKey RegOpenKeyExA RegQueryValueExA FreeSid SetEntriesInAclA AllocateAndInitializeSid RegSetValueExA

shell32

CommandLineToArgvW ShellExecuteA ExtractIconExW ShellExecuteExW SHFileOperationW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW

ole32

CoInitialize CoUninitialize

UnlockerAssistant.exe

IMPHASH a510baa3ecd268c6c6bb7d395fef0aad
SHA256 7e19483efccc4e439444025a25c781439a88b95622262775e721f67319b83457
MD5 403e928ba217e38485009636c793f3c9
SHA1 2db1a193f60139fb7da1c21b9a6558d75694f996
SHA512 870937a2a923a7b6905c5e8b844a5840d012678cd698013e94b0cf265677643cde05ceebbbf7f848273a44e83eb0b6a2ae5749d4e9c9f438c57838a5021475e6
SSDEEP 192:nbr+2TqhWJa+De9zf8pRvBpD3FMXKv+abapT4SYCjtTGcrkOLQPF8llmY:nv/T3Pe9z0pRb3h+abUT4uJxLU8lE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

UnlockerCOM.dll

IMPHASH a30b5e81cdef9a17a4be6d6a228e9362
SHA256 fa029fb257464e1d18e3695f886bb66187218c4cc82e2c80936a51db56ccd586
MD5 da66ceaf1def4da337f1542e0308483d
SHA1 cc62fce6bd958292064127a723bd936b95960edd
SHA512 96708333bac542b7d88a133c2c06aa5b3aadb80edf63ede21a234047f2ad63714699cef8f66630052b9e35daff6bb34ee9b72d519af8ba6c9f3bac96d809a676
SSDEEP 192:k/+TMPhYSg1aKp94lyRJBRY+lxQ4xX9DDAveJjIK7:k2TMPhan4ybFlxQ4dt4wd
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

UnlockerDriver5.sys

IMPHASH 2a015bf36d12492d1085356809814d9d
SHA256 75cf9471ba3ea54e5be66cd7612da134b3370d7c3fba8b2682093c03a0ad87b5
MD5 4847639d852763ee39415c929470f672
SHA1 ba5bf16f30378754dd06f0610a8e833421cf43ea
SHA512 21d02f833ac1ff3df4a0fff8452c7020dac0c892432fc4e06ba622aeca990954c445a57e399055c5c0dcc56552c33cae98d549efa45f7e0c0105fe8adc5da0b6
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8192

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

UnlockerHook.dll

IMPHASH f4d093db5e466a48d555b9ceadb39dab
SHA256 38e03771b1de28f3bc950fcab0180c089b626ae8c8a4635f4df22028b4f71dde
MD5 78d62115f51b641a9f12afdf50a352fc
SHA1 b801bfa7200bd378c53056e3b330dd4d2bfc622a
SHA512 061a8f13d1e9c4f3ac4183ed0a89dd940c89ab6c1962af53028cc871bf9f2eaf15cfbe0facbcec21612a81fafcac789d64cb4cbf6847165ff7a2af60467707d9
SSDEEP 48:C5H6MwSw43mN6MB+xolFebsyJaeGIGDTHxRNimznQ4wZK0E8ee1kAosky4+i+O:AHBn4BlFI4xpkEtjJ+7O
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5382

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

eBay_shortcuts_1016.exe

IMPHASH 36276e7c12820586c6f4cfea7e3f74d2
SHA256 77be1948f4fe4fd51902dc5ab17976caa5e29751da5954cc567e546d688da47c
MD5 25bacc8b5eff6ce21247aa497a76899b
SHA1 ba6c6840226b65fedee212ea4cdf0dff3cd70dee
SHA512 f96544cde0fd32cb668c2bf6972eb0f7ce6a628f6e4372b7227ed0262249618192bf0ab5e6a7fd6794b3077f069ded003015fbb9b0817eeb4777255fa4101d17
SSDEEP 1536:PjmS7uQiR7abLJqiX0DImJicz5sJ6RWOM+Dat:PjhhbyDImJiNYEOM+E
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

eBayShortcuts.exe

IMPHASH beeed81e1037e72e2bb3878a044e5e55
SHA256 8afa0da48df023bc22d1aef74a08fa0cd8965324fb31cdc6fe989739b0a3107e
MD5 0b0f7f4080cb14f33dd4b240b0f5c7f2
SHA1 795cce5554bbb5a5fa85a920965e89f3df1964fb
SHA512 78eabd9f9c7ff3be102e12e5e9694834a4b46e61a422df095bc86e4f755e361b6eb12d5e99a113b350c0cc177cb0ec2d3c7c211f936c8606cb18870f68e97a75
SSDEEP 1536:Xa28Axv2H7zKxpjf4iDt0ZB1pIAxD/QmJScwm:q1VCAx7QmN
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

1

Entry point

42340

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

gdi32

MoveToEx

kernel32

CloseHandle CreateDirectoryA CreateFileA ExitProcess FindClose FindFirstFileA FindNextFileA GetCommandLineA GetCurrentDirectoryA GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetStartupInfoA GetVersionExA GetVolumeInformationA GlobalAlloc GlobalFree LoadLibraryA MultiByteToWideChar ReadFile SetCurrentDirectoryA SetErrorMode SetFilePointer SetLastError Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue WideCharToMultiByte WriteFile FreeLibrary GetLocaleInfoA GetPrivateProfileStringA GetSystemDirectoryA WritePrivateProfileStringA RtlMoveMemory

ole32

CLSIDFromProgID CoCreateInstance CoInitialize CoUninitialize ProgIDFromCLSID

oleaut32

GetActiveObject SafeArrayCreate SysAllocStringByteLen SysFreeString SysStringByteLen VariantClear VariantCopy

user32

CreateDialogIndirectParamA CreateDialogParamA CreateWindowExA DialogBoxIndirectParamA GetWindowLongA GetWindowTextA SendMessageA SetWindowTextA DialogBoxParamA GetWindow

shell32

ShellExecuteA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

comctl32

InitCommonControls ImageList_ReplaceIcon ImageList_Remove ImageList_GetIcon ImageList_LoadImageA

uninst.exe

IMPHASH 1cf4252ebbb4f173d97a6ef4f79a60b5
SHA256 b29fad48875e434911692a13881cc49c2349b9ed402316da67cc5da3daea191f
MD5 9b85c3ff3184aa53f4f28b8c6253babf
SHA1 ab23d393eb0c0b622bc7b6ea62f31c2c5d7fecb2
SHA512 fb6629c3cfb892d8bdfa6e3d1061ec8926c6d09f23d26033afa95b8ebc7284c52fcb9f481945431bb76bef411364c63f84c77068b5717506e6dd22ccbc270b68
SSDEEP 3072:1aF6FILxuJ8JutbHewZuOf/iYxnlJQGpwsIdQS:+O9jt6wZug3puGS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17 ImageList_AddMasked ImageList_Destroy ImageList_Create

kernel32

ExpandEnvironmentStringsA GetEnvironmentVariableA lstrcmpiA CloseHandle SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess WaitForSingleObject GetCommandLineA GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA GlobalFree MulDiv DeleteFileA FindFirstFileA FindNextFileA FindClose GetExitCodeProcess SetErrorMode GetModuleHandleA SetFilePointer LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile lstrcpynA

user32

ExitWindowsEx CharNextA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint PeekMessageA

gdi32

GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SetBkColor SelectObject

advapi32

RegEnumValueA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegEnumKeyA

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Name

.text

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

1024B

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

20KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7rdata

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/InstallOptions.dll

IMPHASH 922b855d216a21490e4bcbf6c29b7f7d
SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
MD5 07f3b3445f66e1089567796bf3c8be78
SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH a75ed4b57a83b633f5cb5d4939d72f27
SHA256 5e97602008ba004c72d58f71e77ffe0a0ea01103867eb12a9ec0f28e72f440d8
MD5 afd989ef7eec6bf952bedfce541fe236
SHA1 5654b71c5b1089c2cec6381d8da5bd14a14e1a37
SHA512 f4e3d88477d39218667dd482a08904b2b69435db7d1fdd492380544aff83895d393a288c329da69074b69c68f51db45f694dfea81fc12fa2042ed43b3d06440c
SSDEEP 192:XZNEnGTkTwat3s8pXqrpxwvcq5/pZquJKeS:y3nX/N/P9JJS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10193

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer