63014ae4d367c93391e652530bb2af5b_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

resource
unpack001/$PLUGINSDIR/AnimGif.dll
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsWeb.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1bbd71e1f0adb50c9656aeb585ba5da54f9bb14fc8a0c868f23960e55dcf6c70
MD5 63014ae4d367c93391e652530bb2af5b
SHA1 ac694d68f99d8ea99188ba8157e80f070a270907
SHA512 a9d2a8d155a1f5a91c51537915d4b99e12304fcfd454395f5f2fe82f0502d18507bdbb5157830602d11ed3b0d2ef8601c801ea7a3c2f7c023553b5ae7e75b5c7
SSDEEP 3072:9gXdZt9P6D3XJv4B/N+wEP4HUOZjhatiWiJ6egdeGDFjCI42qwIVmqnvXypDnT8w:9e34WKtfia7dlDFx40e6DT6Dcs2jiS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AnimGif.dll

IMPHASH f600fe515bbb976d5966dd4286e0ebd4
SHA256 8fb060b77728fbe347e294d1174a732db7cf9c99b187f8f332662c87683fd0a3
MD5 200b6570553d00a76de8a5a6c9587f07
SHA1 08ca76a84cba8483ab34285d07909e08bdbf4a67
SHA512 01ab8aa80d7d5d3083f2e3016aab5dad29c0bbba18b225a5dde51b3bc6fa4c8c1278aec17d76bc5ee2b9ccb8532c22d79845162f752bba6ee12341b4d64304e8
SSDEEP 192:gOHvLYKKad68vn0YQRbqLGWSMRH00yQTbxDdHw:bvLXKa0OqRqS1MRH00HJdH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BgWorker.dll

IMPHASH db2755f409b81c4dbfc04f648cfb80b9
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ExecDos.dll

IMPHASH b997a221e444f5e6463b28778735cf2b
SHA256 d387b725afbd2a6f9b44999278d21025fae55b391e45f7751b88dfb13511a993
MD5 ebcf9f71d804abab3c2e5ce4c17dc22e
SHA1 17d13084e75cbfa5fbfdd0025e9a0ee5772ae765
SHA512 5576396c2d885c039668d7f401eeee583eb4de39e8497c3aaec32d47f4417a522fe6786c111d50a5fba7570f50e84144ef3a8aea42677d170e79114343c3a4a1
SSDEEP 48:qNpugCjmWaZ+rnHAUiP9JLw/RHFtly5vorpSpSi7+5HCAx31Oglt6Zlrz9QH96AD:r0W1nHAfPPORHnooAU3xYglt6WwE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

6301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/modern-header.bmp

SHA256 c2f4eff0ac47829b5fd127c1229374ff1faa2e366c0008279bca9f89c7a9de79
MD5 858dfb1e64a49ecbba17e28359373ea9
SHA1 b1b5b8fc819d69e1d6802339d4ae5da488f8109a
SHA512 c0f286d79bcec3f0c1defc6ed87d3ecf9874a89ceeb5c1d5c01e26658b5ef835fdf1a2a9450ee7120c2963077fc6e228de25b62411f92c9087bd11d66f36e616
SSDEEP 192:m30Lmk6pqGkd6iaS8+xmPz5G0XrO58rhMK4FFFzZDGQjRU:Dik6p7kd78WmPI0Xa5tK4Fu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 c1b7b7b772ec4f9db34b326554c243999b9600a6a50fb51accb48a0efb1a832a
MD5 3833bf91f507a995baed5b685eef0ac3
SHA1 af9f6883c8f97f654452891d4622f4b7914833c1
SHA512 936161d4b3db67ff48a64f67379a18c2c0dedfb508826026e8c5400a614c752c86b09a808f005022cbbe6866e083f6429c73684674c341aada831a9098537664
SSDEEP 1536:73GD+DDkB9qfkRQb4fi/P0IAb+c8CwZ7s:TE+cIi+pq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

SHA256 48941e9f5c92a33f1e60a7a844d562dd77ce736fd31b5503c980b49679dfe85e
MD5 f8462e9d1d7fd39789afca89ab6d6046
SHA1 7e9a518e15b7490245d2bef11a73f209c8d8d59b
SHA512 57dee2253abd7d17d53811d5e95237f9434288518fb043645524a517786db2d8a91df86a6da732c620f12ad0e7ea30a923b8d5f3de386c65bd3ff240bc0dff69
SSDEEP 96:TjGBPJ762z6gjutipI+h7jz5ozZt/aYfA7EfXxLfAZi:/ix7ibUpIS+Xa1wX2Zi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

35776

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 f7c16606a1bb3c3a4f8e19683dc68f2ea5e921fa2600b232f37b4d136643b49f
MD5 827c22af1bb471c44565674640927857
SHA1 ee55a665cc493eba5be48d99363fc0a95ed8df34
SHA512 ceb8f97d1892205f12f9c8493f774c01fe9b5828d3fcf63519be0789e80255fbd9bd9410e50812cb02a011118c74848368c8d2b94668f1de9506a53544be2800
SSDEEP 96:kEHvhxm50Qol5g2W7i45Y3ZeQ9DQiey5Ry3524jQwOODkjDf3GE6fA7EfXxLfA:lu50t5NL3XrgM4jDD/EPwX2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsWeb.dll

IMPHASH d12ed83df3a4aa87887f14a225ff95d4
SHA256 7d4da7469d00e98f863b78caece3f2b753e26d7ce0ca9916c0802c35d7d22bcf
MD5 84bcf3c71e70d5a6e9dc07d70466bdc3
SHA1 31603a1afc2d767a3392d363ff61533beaa25359
SHA512 61aefa3c22d2f66053f568a4cc3a5fc1cf9deb514213b550e5182edcecd88fadf0cb78e7a593e6d4b7261ed1238e7693f1d38170c84a68baf4943c3b9584d48e
SSDEEP 96:9E1ZgHfHizBkiz1zCuNrwXTP8Jx/N6SCMeNV37bnwXwPML/bUdut5tCsPb2N6nOc:9E1ZkGdbiSCMeNN7LwAY/gd+Oc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7872

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/ajax_loader.gif

SHA256 3d0580226138c9673aadaaf64d97c2a7c720d538f146c51c2c722d34e7ffa500
MD5 60d1f98dbb5a6ea9ac747c3e46c0c628
SHA1 25e7652b0ec4960afbb84adf52fd97d8a4e0048b
SHA512 e77a7fc0189ae278799f6bbfa23685081fcbc004dfd159c45a85122d8bd7f0273399a7c2c24ff1d69cc8ffd18784ca090a6f393220c09cfae66d104911c4ba3f
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/fondo.bmp

SHA256 c1b7b7b772ec4f9db34b326554c243999b9600a6a50fb51accb48a0efb1a832a
MD5 3833bf91f507a995baed5b685eef0ac3
SHA1 af9f6883c8f97f654452891d4622f4b7914833c1
SHA512 936161d4b3db67ff48a64f67379a18c2c0dedfb508826026e8c5400a614c752c86b09a808f005022cbbe6866e083f6429c73684674c341aada831a9098537664
SSDEEP 1536:73GD+DDkB9qfkRQb4fi/P0IAb+c8CwZ7s:TE+cIi+pq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/header.bmp

SHA256 c2f4eff0ac47829b5fd127c1229374ff1faa2e366c0008279bca9f89c7a9de79
MD5 858dfb1e64a49ecbba17e28359373ea9
SHA1 b1b5b8fc819d69e1d6802339d4ae5da488f8109a
SHA512 c0f286d79bcec3f0c1defc6ed87d3ecf9874a89ceeb5c1d5c01e26658b5ef835fdf1a2a9450ee7120c2963077fc6e228de25b62411f92c9087bd11d66f36e616
SSDEEP 192:m30Lmk6pqGkd6iaS8+xmPz5G0XrO58rhMK4FFFzZDGQjRU:Dik6p7kd78WmPI0Xa5tK4Fu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/instloffer.exe

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 364473e09b0d8af87e3b382bc3c8917558cda7be9e27ec06aca1c70c1ffd130c
MD5 fb9b18511894c93bca0f85ca949bca64
SHA1 638b081b36460365f61c70daafc4b37e836f407b
SHA512 0c63dcf2e18686e1add906d572f8ff3b93b756ccc83a38ae048fb1949528ed63d7521fdaee5e21f44209d65ec189f5e4fe68f228a9a91d6186ab2bea64d0f325
SSDEEP 1536:jldZEszWriITJGrvopX1VF7CXjl7ybqYPRSEvrGqEYii:j2szWOITsEL50jl7yx5SEvrGqEdi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

5

Entry point

13333

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$TEMP/license.rtf

SHA256 2b045f41d80f4e5b316fe8c057b0cbf053c51cec14d818febe18069fe46b0d46
MD5 3c630709141dbb3bc6f4aa0e2da2d267
SHA1 5bc7238cdacace891298efd3aadd3f7ea662b8b7
SHA512 138cea1304c6532daecca9deaba8f1957bfc19ea40238f796bdee5edd1f237998696d0070c8abddeeb01bbf572571263d8c91d949565890b347eed2b50f4a9b0
SSDEEP 192:a2VSPIiNgdCHjJnymr/AV311uqEd0mm7wadhXf5a:aKSgU4mr/AVyGwiA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/square_babylon.bmp

SHA256 947289a34258f6601fdb17549e373c7e7d5225b205602ae1cfd4b5c3eb18c8ea
MD5 811296be3855dbe1b72546ec798f0d00
SHA1 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
SHA512 87d07838c49cd960e5f3b77085326b856d432b2f9eefc364be4d5bb7bc8f41ac5d099ee3a3ff4551199171b19c922fb87c2f2a530061f40d2f5e48b9ab11e1bc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/square_babylonv2.bmp

SHA256 947289a34258f6601fdb17549e373c7e7d5225b205602ae1cfd4b5c3eb18c8ea
MD5 811296be3855dbe1b72546ec798f0d00
SHA1 900ea5e4da8c46c2f1a52f39eaa3b791b43c41eb
SHA512 87d07838c49cd960e5f3b77085326b856d432b2f9eefc364be4d5bb7bc8f41ac5d099ee3a3ff4551199171b19c922fb87c2f2a530061f40d2f5e48b9ab11e1bc
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/toolbar_bb.bmp

SHA256 337fbdd5f2720646eab2bcee1c7bf7dfa03a2768e6e43f154f521d2cbf387240
MD5 1687c82f77a6e033890d7fba31f85697
SHA1 a023733430f8e74f40dd6f70e30e05e244bfb559
SHA512 d7cee6563a7d77aeb755e151ff5891fa9fc8047cb3f57f39600f26d4d14b8843ef23601b18fc5522ad2a463c90856d5c6605d0d244da0126e2db6a307af186f8
SSDEEP 384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/toolbar_bbv2.bmp

SHA256 337fbdd5f2720646eab2bcee1c7bf7dfa03a2768e6e43f154f521d2cbf387240
MD5 1687c82f77a6e033890d7fba31f85697
SHA1 a023733430f8e74f40dd6f70e30e05e244bfb559
SHA512 d7cee6563a7d77aeb755e151ff5891fa9fc8047cb3f57f39600f26d4d14b8843ef23601b18fc5522ad2a463c90856d5c6605d0d244da0126e2db6a307af186f8
SSDEEP 384:VrZiqR04BGC08bNjBTkVwzs9v8JW6ry6WQu4xs3tg8maghAlvhLIkY1nMu+lf:1ZiqF4QbNtUAA8JVy6WQpqQapqe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer