5c4736651f0c7a735b0086f17d921d06_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

resource
unpack001/$PLUGINSDIR/AnimGif.dll
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsWeb.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 e4a5c5a3d32c1d19ea0da2f3f789ec2e3ab471c7456366220ef219bf1ffc42b7
MD5 5c4736651f0c7a735b0086f17d921d06
SHA1 a384ac7fd290d4b476c82bd766695a0fc70b9db8
SHA512 31327c79477565d728e732eb1d7c77f48df11c2598ffce33dc1eb8ca116cdfbc351148edcf63c4c771134621acf66eaca2bf36d0d249d68fa38df5961564d1ad
SSDEEP 6144:je34aDr9U9uW6jmtWUeXWkNq6TLA+dcs2Ty5QFGkio:83QuhcW9hrTcs2EcGLo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AnimGif.dll

IMPHASH f600fe515bbb976d5966dd4286e0ebd4
SHA256 8fb060b77728fbe347e294d1174a732db7cf9c99b187f8f332662c87683fd0a3
MD5 200b6570553d00a76de8a5a6c9587f07
SHA1 08ca76a84cba8483ab34285d07909e08bdbf4a67
SHA512 01ab8aa80d7d5d3083f2e3016aab5dad29c0bbba18b225a5dde51b3bc6fa4c8c1278aec17d76bc5ee2b9ccb8532c22d79845162f752bba6ee12341b4d64304e8
SSDEEP 192:gOHvLYKKad68vn0YQRbqLGWSMRH00yQTbxDdHw:bvLXKa0OqRqS1MRH00HJdH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgWorker.dll

IMPHASH db2755f409b81c4dbfc04f648cfb80b9
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecDos.dll

IMPHASH b997a221e444f5e6463b28778735cf2b
SHA256 d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
MD5 ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1 17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA512 5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP 48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/modern-header.bmp

SHA256 269111a1d6aeba64f27d7abcd66ea71996bcf1d4cd8d3f0f9b928369f1b9a79c
MD5 240f29705ce89cf54564a8575a2b2311
SHA1 c6ade2d9cb5a783bd388f46a7ef98f3b4f88476a
SHA512 9ce76387c05e776f5ba1549c239d54f6d6c139e1006c53d593fb8eb253e116bceb392e48da0758f7be280fb80b1ba562f1f0e984dd9cef7d65e74c8bace5ee5c
SSDEEP 192:7TKrXDpPuD9LM41sIz2KVC8JMfesPHEIRQhVmTAAqcNTJwSa5esgpxNGRmHOVaaB:jpuW4ERDMra/mydS0Tt/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 38d4f42862777544a8ac7cd168a1df7a24a110f262db8c2e48866bfce575582b
MD5 178370f5fd558aea07a32818f96ddf67
SHA1 a71212a31d15cc947e0d19ffda3a90a79095f8df
SHA512 a866835e32b308ca1be9c3655058eadc5a0b79cde0b54b0b00daee0c5cc3a6af68d43435f3be31ae2dd53da45e3615366345d97177c4810e00af0a38fbbedd2b
SSDEEP 768:tdx8N+lD5iYcpfQ6xAgINpdvSSI4ZfvdLnKkAdkAjT0kAcK+LQ03YDikfKDp/vkC:9LndkDn7k3BTV0TI6um9s/ct
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

SHA256 48941e9f5c92a33f1e60a7a844d562dd77ce736fd31b5503c980b49679dfe85e
MD5 f8462e9d1d7fd39789afca89ab6d6046
SHA1 7e9a518e15b7490245d2bef11a73f209c8d8d59b
SHA512 57dee2253abd7d17d53811d5e95237f9434288518fb043645524a517786db2d8a91df86a6da732c620f12ad0e7ea30a923b8d5f3de386c65bd3ff240bc0dff69
SSDEEP 96:TjGBPJ762z6gjutipI+h7jz5ozZt/aYfA7EfXxLfAZi:/ix7ibUpIS+Xa1wX2Zi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

35776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 f7c16606a1bb3c3a4f8e19683dc68f2ea5e921fa2600b232f37b4d136643b49f
MD5 827c22af1bb471c44565674640927857
SHA1 ee55a665cc493eba5be48d99363fc0a95ed8df34
SHA512 ceb8f97d1892205f12f9c8493f774c01fe9b5828d3fcf63519be0789e80255fbd9bd9410e50812cb02a011118c74848368c8d2b94668f1de9506a53544be2800
SSDEEP 96:kEHvhxm50Qol5g2W7i45Y3ZeQ9DQiey5Ry3524jQwOODkjDf3GE6fA7EfXxLfA:lu50t5NL3XrgM4jDD/EPwX2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWeb.dll

IMPHASH d12ed83df3a4aa87887f14a225ff95d4
SHA256 7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf
MD5 84bcf3c71e70d5a6e9dc07d70466bdc3
SHA1 31603a1afc2d767a3392d363ff61533beaa25359
SHA512 61aefa3c22d2f66053f568a4cc3a5fc1cf9deb514213b550e5182edcecd88fadf0cb78e7a593e6d4b7261ed1238e7693f1d38170c84a68baf4943c3b9584d48e
SSDEEP 96:9E1ZgHfHizBkiz1zCuNrwXTP8Jx/N6SCMeNV37bnwXwPML/bUdut5tCsPb2N6nOc:9E1ZkGdbiSCMeNN7LwAY/gd+Oc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/ajax_loader.gif

SHA256 3d0580226138c9673aadaaf64d97c2a7c720d538f146c51c2c722d34e7ffa500
MD5 60d1f98dbb5a6ea9ac747c3e46c0c628
SHA1 25e7652b0ec4960afbb84adf52fd97d8a4e0048b
SHA512 e77a7fc0189ae278799f6bbfa23685081fcbc004dfd159c45a85122d8bd7f0273399a7c2c24ff1d69cc8ffd18784ca090a6f393220c09cfae66d104911c4ba3f
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/coupish_largo.gif

SHA256 2c8923f2ff4e81b9bfd9648272cff7130919169763f2c85da9ea0724db921805
MD5 3103efb8e353c83cf92cac5957e288a8
SHA1 281b88a3c49b168eb3f6118e9ae761fc37aed54f
SHA512 d298f24821542c2e237ad5743aafac25c92f0218a913fe33d8b7bcc4175a2d38cee9471fb5af987e0c343251f33f8d874ba1ba4a65a32aa444799a7742fbcacd
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/dealply_largo.gif

SHA256 93106d25cdc688b3506330f96e772c4825d8fafb41260cae6da61814707013ae
MD5 0522d4e0b8d96f080cefb462511ce2d1
SHA1 62a073478d96b15693c1c28a579f70d472064f89
SHA512 4cc658b7b3c90ce6941ecf4d47f6c70ca9baea3b33821d738900797378a61d8f77de98aa71685d9de16331c1faba72578969c5f58baaece9e5a040476059fe52
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/fondo.bmp

SHA256 38d4f42862777544a8ac7cd168a1df7a24a110f262db8c2e48866bfce575582b
MD5 178370f5fd558aea07a32818f96ddf67
SHA1 a71212a31d15cc947e0d19ffda3a90a79095f8df
SHA512 a866835e32b308ca1be9c3655058eadc5a0b79cde0b54b0b00daee0c5cc3a6af68d43435f3be31ae2dd53da45e3615366345d97177c4810e00af0a38fbbedd2b
SSDEEP 768:tdx8N+lD5iYcpfQ6xAgINpdvSSI4ZfvdLnKkAdkAjT0kAcK+LQ03YDikfKDp/vkC:9LndkDn7k3BTV0TI6um9s/ct
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/header.bmp

SHA256 269111a1d6aeba64f27d7abcd66ea71996bcf1d4cd8d3f0f9b928369f1b9a79c
MD5 240f29705ce89cf54564a8575a2b2311
SHA1 c6ade2d9cb5a783bd388f46a7ef98f3b4f88476a
SHA512 9ce76387c05e776f5ba1549c239d54f6d6c139e1006c53d593fb8eb253e116bceb392e48da0758f7be280fb80b1ba562f1f0e984dd9cef7d65e74c8bace5ee5c
SSDEEP 192:7TKrXDpPuD9LM41sIz2KVC8JMfesPHEIRQhVmTAAqcNTJwSa5esgpxNGRmHOVaaB:jpuW4ERDMra/mydS0Tt/
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/instloffer.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 be5c9c9a9eab047089059fadb21c8cbaf0510e542adebc90af693733dcc27885
MD5 7b8429a8226fcbcf83e70cb4f958b57e
SHA1 f7a5814767cdd0caa82274af6d66ce6ceff9c3ae
SHA512 4b1369dd4465ff572f99e961a495516a9839bcc1c3921af7c253bca1f41f45abdfd149e56b789bdf5e1786a1351864e9b7f3e8d1788e41e765b95cd5c63c736c
SSDEEP 1536:jddZEszWriITJGrvopX1VF7CXjl7yNp7hPRSEvrGqEYip:jOszWOITsEL50jl7yT7h5SEvrGqEdp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

5

Entry point

13333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/license.rtf

SHA256 b64310f29eeaf0f12c84c015b76af682a1904a4e25a9dcf3619a579d1315dca7
MD5 a68888617e49a38ecdc9d37d4ad4bb0f
SHA1 8ead5f3a07309bd43d4a7d3050816daa3eb794ba
SHA512 f8120ba06f7fa6c3f6e9e56be21d80deec2e8563fdebb168f9fa16cfe36cbdf84d78d5f750056b82bc6e9653104840f58a6e56cf69e25c60bd8fb64a64d3117f
SSDEEP 192:doyiN7vCHjJnNCN2N6Sc9wnsmjeA9WxAWRVEzSEfcrYEQxTHzridjlpNoj6RVIQj:OyU4CUoensmmxau0HCxpM6R+QDVsMx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/square_babylon.bmp

SHA256 947289a34258f6601fdb17549e373c7e7d5225b205602ae1cfd4b5c3eb18c8ea
MD5 811296be3855dbe1b72546ec798f0d00
SHA1 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
SHA512 87d07838c49cd960e5f3b77085326b856d432b2f9eefc364be4d5bb7bc8f41ac5d099ee3a3ff4551199171b19c922fb87c2f2a530061f40d2f5e48b9ab11e1bc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_babylonv2.bmp

SHA256 947289a34258f6601fdb17549e373c7e7d5225b205602ae1cfd4b5c3eb18c8ea
MD5 811296be3855dbe1b72546ec798f0d00
SHA1 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
SHA512 87d07838c49cd960e5f3b77085326b856d432b2f9eefc364be4d5bb7bc8f41ac5d099ee3a3ff4551199171b19c922fb87c2f2a530061f40d2f5e48b9ab11e1bc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_chiliads.bmp

SHA256 6a47dafda9e6787dcc419cb03ca044a6b71018b230fb526dc96fef55f8155930
MD5 6123c17e074663613cbc45437832629c
SHA1 81560f5bbaf97724cad15e9f08ea62356c277940
SHA512 1426ef4a5a3b2d2f22c1e3bed837e643eee368672fa2815c553162deda78175b909fd2884b4c154c182b4fe7c710f06025a6cde8dc4d3045a22b1b64ddf4cd7a
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_coupish.bmp

SHA256 afb96b543db9be3415a04fd4006cb9bb9a6f96c418fe3b5cb4c45f8680a57784
MD5 a0bffe3e1781ce470ccc1e0ed30ae30c
SHA1 b8ff91ed8e5f214811324da915768289aa42c2c1
SHA512 22220d69fe2afa29f81ece69377d090b6103d06a4c9b205183264bb8b4fee27182241189aebb4cc3bf855985b534512500bb535c088701dc3f2494bf154d612e
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_dealply.bmp

SHA256 ca92fa042464a3df010c0eb7ff6c4a8d7b7df453dd8c9f48fa523c28ac0a38fd
MD5 bf3af94325463cbdce55169d1380ab27
SHA1 bbdd69633deb72b4f0d3a2d430abdd589325abb5
SHA512 2ba198aaf2b3390dccc17a647a75da836fccfd896f65b16022f4cfd1afd57fe7fced2e044cf7f8b5a64cbbfb10bd2475a64454e1c7ed5f5c63cae7e7ceab9dfc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_incredibar.bmp

SHA256 36422f43869c70fe5661eccdd938da0a38e6a816381e6b7bbce5e667a2c84336
MD5 78839c0b9bb032f8f0e7cbf037b58175
SHA1 bed4a2bc46113617f71b7ed7e1166edeb2e0052b
SHA512 48e1e71e1259ea8b14c3e8f878e217431b47de6a327ad5bea7628af1181f6b55aaa3842cfb12762cc7855855d7a0bdb30d676741243781a8b95186202d815298
SSDEEP 96:ExgNxA89A/SXnrKhQuBTpKYQCutydtvXdP+Rb185o6IWin98ZbxT:SgNxA9S3+hdJp9xu6Bwbko6IWkWbxT
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/square_incredibar_small.bmp

SHA256 4d42d388adc0a98313d71f156a62be2816b32352b7dea76deef140190b8e28d6
MD5 41fa4354bad02ec6b6a38fc1a8ffd404
SHA1 7277effbf4d31a4c6d6d36fe6afa5081d518d83e
SHA512 2507e44b3bfe1564693b6a60196960d4b339f0d167566fec8214c2c51bccb8a9f539b10abdac0634a682fe7f5d73819a8e378881a7238ac71a0746da1dfe9c8e
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_sweetim.bmp

SHA256 8e0c3ec357dd597ef6595e04aee08b731cff90de88ef92d5bffe59071e135b0a
MD5 0d0bb5f85f2088d8a3bc8a597edf6adb
SHA1 7f599f94c49da57738877abcb81664556069dbd9
SHA512 fc24d720dc2eb4aea19ae79acaf087770c4291a6552fe4086e7a844d9ac3039f8924e6598524852f46620826c1a6cf5687d78ce2fa4f97146a26773baa9ddaca
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/toolbar_bb.bmp

SHA256 337fbdd5f2720646eab2bcee1c7bf7dfa03a2768e6e43f154f521d2cbf387240
MD5 1687c82f77a6e033890d7fba31f85697
SHA1 a023733430f8e74f40dd6f70e30e05e244bfb559
SHA512 d7cee6563a7d77aeb755e151ff5891fa9fc8047cb3f57f39600f26d4d14b8843ef23601b18fc5522ad2a463c90856d5c6605d0d244da0126e2db6a307af186f8
SSDEEP 384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/toolbar_bbv2.bmp

SHA256 337fbdd5f2720646eab2bcee1c7bf7dfa03a2768e6e43f154f521d2cbf387240
MD5 1687c82f77a6e033890d7fba31f85697
SHA1 a023733430f8e74f40dd6f70e30e05e244bfb559
SHA512 d7cee6563a7d77aeb755e151ff5891fa9fc8047cb3f57f39600f26d4d14b8843ef23601b18fc5522ad2a463c90856d5c6605d0d244da0126e2db6a307af186f8
SSDEEP 384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/toolbar_sweetim.bmp

SHA256 4ed1ad3fec1e38a8aaf3195e517e1cfd37449b1cb17777c18798dad40e838173
MD5 613cf2ed9ad9c9edc85f4b4a2ff8dfc7
SHA1 c837a569d952ffd0881ac78370afbf6dfd2894da
SHA512 6593a112d9cc059dc8c5f5961a0f1fb89f0e4f86cf39dffd4f0c9e2e3ef13c7d2afa620b2e2e5052eafb03cdada764d79d14af8876c10117f4322e924e689a27
SSDEEP 384:li3qTbIttIUVvah7usnoJICU3gG4vmjsB6L59wT8FjztbeKmR7qkfZeK768jsLLl:8afktBFEoJ1SsB9TuI7qGZeG3eLNnJR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer