97ef848ee102cc753df5ec62b6de29834326bea5ebe2c4c496aea770dfc20670

resource
97ef848ee102cc753df5ec62b6de29834326bea5ebe2c4c496aea770dfc20670
unpack001/$PLUGINSDIR/NAct.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$TEMP/Install Firefox/interpreter.exe
unpack001/$TEMP/Install Firefox/psh_host.dll
unpack001/uninst.exe
unpack002/$PLUGINSDIR/NAct.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/UserInfo.dll

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 97ef848ee102cc753df5ec62b6de29834326bea5ebe2c4c496aea770dfc20670
MD5 34068e57346f6faf3e22b8ad26d01c7d
SHA1 b1b4fafd39f374a1a034c4d26d98830260ecd666
SHA512 fd52fa86c6b0f54cef2cb2a3304236888d4012ea0d2ee12ed9ca1f8fa66e07bac554df449d0578eb78f30db9105600f1273c4814d910992c8043db8ed518b92f
SSDEEP 12288:g0gJfdqc5D23eR6Q94hbOf2Mi1U8mz4hbOf2Mi1U8m:7q1xK3eY+3f29i8g3f29i8m
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NAct.dll

IMPHASH f0e46fcc791b9c06cb01f0d5f33906d9
SHA256 911ee21402b8d42d72af4756005f0d0f7d413ae96a1c5703a7fba55c0ca4fc39
MD5 c10ae206b544e53616a87c9c99724370
SHA1 c0665eaf5396b46ce87e0ff822f517d9cb157d2e
SHA512 e205798936a325b927f3b1fc208f09eb1e762e7a172d34d4b148e899d4a2b38c5d172f448e45acf1ab9d75cdc65e07c71fdff1fbc45caf83ab42da38bbe02fa8
SSDEEP 3072:PspUa3tc5V3h5LGOGVTRlxIvUP8sLAYvBaIQC2mCGYF9dmfPwlzz7+yQqA7xV+qW:U+a365V3Gvx+UP8sLAC7O9cfPUM8SMV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

55760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\devuser\Documents\Visual Studio 2017\Projects\IBuilder\Release (Demo)\NAct.pdb

kernel32

DecodePointer HeapDestroy GlobalLock VirtualAllocEx DeleteCriticalSection ReadProcessMemory GetProcessHeap VirtualFreeEx GlobalUnlock lstrcpynW MultiByteToWideChar GlobalFree WideCharToMultiByte lstrcpyW SetLastError GetCurrentProcess ExpandEnvironmentStringsW AssignProcessToJobObject TerminateProcess CreateJobObjectW WaitForSingleObject GetVersionExW GetExitCodeThread GetCurrentThread DeleteFileW GetProcAddress CreateProcessW GetModuleHandleW GetExitCodeProcess ReadConsoleW ReadFile SetEndOfFile WriteConsoleW SetFilePointerEx CreateFileW FlushFileBuffers HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetConsoleMode GetConsoleCP WriteFile GetStringTypeW LCMapStringW GetFileType GetStdHandle GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread FindResourceW LoadResource FindResourceExW CloseHandle RaiseException HeapReAlloc Process32FirstW GlobalAlloc LockResource Process32NextW GetLastError Sleep CreateToolhelp32Snapshot HeapSize SizeofResource OpenProcess GetCurrentThreadId GetEnvironmentVariableW InitializeCriticalSectionAndSpinCount HeapFree WriteProcessMemory QueryInformationJobObject SetStdHandle ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent

user32

UpdateWindow GetParent GetDesktopWindow SetClipboardData InvalidateRect GetClassNameW SetFocus AttachThreadInput EmptyClipboard CloseClipboard SetForegroundWindow ReleaseDC GetWindowDC RedrawWindow SetThreadDesktop GetThreadDesktop CloseDesktop CreateDesktopW EnumWindows FindWindowExW SetDlgItemTextW GetDlgItem wsprintfW GetWindowLongW GetWindowThreadProcessId PostMessageW GetWindowRect IsWindowVisible EnumChildWindows ScreenToClient SendMessageW OpenClipboard

gdi32

GetStockObject CreatePen Rectangle SelectObject

advapi32

OpenProcessToken LookupPrivilegeValueW DeregisterEventSource AdjustTokenPrivileges RegCloseKey RegQueryInfoKeyW CopySid RegEnumKeyExW RegUnLoadKeyW RegLoadKeyW RegOpenKeyExW GetLengthSid OpenThreadToken RegisterEventSourceW ReportEventW RegQueryValueExW GetTokenInformation

shlwapi

PathMatchSpecW PathFindFileNameW UrlUnescapeW PathFileExistsW PathFindExtensionW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ws2_32

WSAGetLastError htons connect socket send WSAStartup gethostbyname closesocket WSACleanup

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/Install Firefox/interpreter.exe

IMPHASH 5fd351b76ee659c0e4acca86df1ee513
SHA256 c15d0e4818aae771de7378c72d34db8239688d20ca1e040be7746206f40f95ac
MD5 fee504660fab528635f7dd4610bc98e2
SHA1 72b70d31cfeabc0fdc326d7fdfc3ea7fe1eca7ac
SHA512 e1329851ffc2e9de3602a86ad83e9a03842f6e7035a87ed986db39ad48cc4eb38061e22457f56258beb4a4b4c6ad7b92f975d4386e8fc570936dd2d28b273ac4
SSDEEP 3072:QACFegtXGOMZnhB5duMhIid7T1Faf3JqL7615+W3JijsvupUSK8oh/4F:9CFwOMZ/uMhvpT1BLm1p6K+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\native-powershell-0.0.3\x64\Release\test.pdb

psh_host

NativePowerShell_AddScriptSpecifyScope NativePowerShell_DeleteRunspace NativePowerShell_InvokeCommand NativePowerShell_CreateRunspace NativePowerShell_ClosePowerShellObject NativePowerShell_CreatePowerShell NativePowerShell_DeletePowershell NativePowerShell_GetPSObjectToString NativePowerShell_GetPSObjectType NativePowerShell_AddPSObjectArguments NativePowerShell_DefaultAlloc NativePowerShell_DefaultFree NativePowerShell_IsPSObjectNullptr NativePowerShell_CreatePowerShellNested NativePowerShell_AddArgument

kernel32

InitializeCriticalSectionAndSpinCount WriteConsoleW CreateFileW HeapSize ReadConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetConsoleWindow HeapReAlloc WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx CloseHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile

user32

ShowWindow

$TEMP/Install Firefox/psh_host.dll

IMPHASH f433e93ad4f68680ba36188ff5abaebc
SHA256 2201afa089a0bb4a14ee2cb9fd01d534426b4ed374d38262bea5f58a749baf9e
MD5 ed6a69d7cfdfcd37f896809edd3825be
SHA1 8dda95f77b3e180b408300b5b1dbe4bd41d0b13c
SHA512 9a53bbd0e30a91cdbdb549c2db802ceeecf1e87ea51d61190c735c9fb000acb9aa53f688868ae25ac5a8148f12c2f8a61b74ed7afd7b7c6526339e7629312fce
SSDEEP 6144:MG9xhJhUs8ghwOyeFajkU8EJxcjhaq+QCIr2j:bFUzFOyeFajkU8EJxcjhaq+QC
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36391

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\native-powershell-0.0.3\x64\Release\psh_host.pdb

kernel32

QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WideCharToMultiByte Sleep

vcruntime140

__current_exception_context memset __FrameUnwindFilter __CxxUnregisterExceptionObject __CxxDetectRethrow __CxxRegisterExceptionObject __CxxExceptionFilter __CxxQueryExceptionSize memcpy memmove __std_type_info_destroy_list _CxxThrowException __current_exception __std_exception_destroy __std_exception_copy __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit _crt_atexit _execute_onexit_table terminate _initialize_narrow_environment _configure_narrow_argv _initialize_onexit_table _initterm_e _initterm _cexit _invalid_parameter_noinfo_noreturn _register_onexit_function abort _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc

msvcp140

?__ExceptionPtrDestroy@@YAXPEAX@Z ?_Xlength_error@std@@YAXPEBD@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z

mscoree

_CorDllMain

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.nep

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

146KB

Virtual Size

146KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninst.exe

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 e0f1049ff31a8dc2964db0512a745ddb416b724c41670202d085ee94cf87cdcf
MD5 d91109242de7c22921a484fdafd07deb
SHA1 969a6652e339dc2d17492e1bce97587721b977dd
SHA512 c7c8f549b11359c60a8569d22e5b82ec4a6127b7b1d8675079d130d02d9a9ca27059354e5330e0bef7b12035928e27a4a791d7449e5cf7b7ef89430585616488
SSDEEP 3072:u5BuYAVrgUCPnJCryGwdtKhH7OAs2Fi3lkpVOCp81s1deWAeAfheDLxHRX:u50gUCxCrxo4hbOf2MSpBj1UhO3X
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NAct.dll

IMPHASH f0e46fcc791b9c06cb01f0d5f33906d9
SHA256 911ee21402b8d42d72af4756005f0d0f7d413ae96a1c5703a7fba55c0ca4fc39
MD5 c10ae206b544e53616a87c9c99724370
SHA1 c0665eaf5396b46ce87e0ff822f517d9cb157d2e
SHA512 e205798936a325b927f3b1fc208f09eb1e762e7a172d34d4b148e899d4a2b38c5d172f448e45acf1ab9d75cdc65e07c71fdff1fbc45caf83ab42da38bbe02fa8
SSDEEP 3072:PspUa3tc5V3h5LGOGVTRlxIvUP8sLAYvBaIQC2mCGYF9dmfPwlzz7+yQqA7xV+qW:U+a365V3Gvx+UP8sLAC7O9cfPUM8SMV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

55760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\devuser\Documents\Visual Studio 2017\Projects\IBuilder\Release (Demo)\NAct.pdb

kernel32

DecodePointer HeapDestroy GlobalLock VirtualAllocEx DeleteCriticalSection ReadProcessMemory GetProcessHeap VirtualFreeEx GlobalUnlock lstrcpynW MultiByteToWideChar GlobalFree WideCharToMultiByte lstrcpyW SetLastError GetCurrentProcess ExpandEnvironmentStringsW AssignProcessToJobObject TerminateProcess CreateJobObjectW WaitForSingleObject GetVersionExW GetExitCodeThread GetCurrentThread DeleteFileW GetProcAddress CreateProcessW GetModuleHandleW GetExitCodeProcess ReadConsoleW ReadFile SetEndOfFile WriteConsoleW SetFilePointerEx CreateFileW FlushFileBuffers HeapAlloc FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FindClose GetConsoleMode GetConsoleCP WriteFile GetStringTypeW LCMapStringW GetFileType GetStdHandle GetACP GetModuleFileNameA ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread FindResourceW LoadResource FindResourceExW CloseHandle RaiseException HeapReAlloc Process32FirstW GlobalAlloc LockResource Process32NextW GetLastError Sleep CreateToolhelp32Snapshot HeapSize SizeofResource OpenProcess GetCurrentThreadId GetEnvironmentVariableW InitializeCriticalSectionAndSpinCount HeapFree WriteProcessMemory QueryInformationJobObject SetStdHandle ExitThread CreateThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer InterlockedFlushSList RtlUnwind InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent

user32

UpdateWindow GetParent GetDesktopWindow SetClipboardData InvalidateRect GetClassNameW SetFocus AttachThreadInput EmptyClipboard CloseClipboard SetForegroundWindow ReleaseDC GetWindowDC RedrawWindow SetThreadDesktop GetThreadDesktop CloseDesktop CreateDesktopW EnumWindows FindWindowExW SetDlgItemTextW GetDlgItem wsprintfW GetWindowLongW GetWindowThreadProcessId PostMessageW GetWindowRect IsWindowVisible EnumChildWindows ScreenToClient SendMessageW OpenClipboard

gdi32

GetStockObject CreatePen Rectangle SelectObject

advapi32

OpenProcessToken LookupPrivilegeValueW DeregisterEventSource AdjustTokenPrivileges RegCloseKey RegQueryInfoKeyW CopySid RegEnumKeyExW RegUnLoadKeyW RegLoadKeyW RegOpenKeyExW GetLengthSid OpenThreadToken RegisterEventSourceW ReportEventW RegQueryValueExW GetTokenInformation

shlwapi

PathMatchSpecW PathFindFileNameW UrlUnescapeW PathFileExistsW PathFindExtensionW

winhttp

WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpQueryHeaders WinHttpOpen WinHttpReceiveResponse

ws2_32

WSAGetLastError htons connect socket send WSAStartup gethostbyname closesocket WSACleanup

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 45d25ca52c312b2254c60dbcb30342d1
SHA256 6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
MD5 c7ce0e47c83525983fd2c4c9566b4aad
SHA1 38b7ad7bb32ffae35540fce373b8a671878dc54e
SHA512 ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4706

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer