81c1b6161ba281cbf27a06f42707bcf0_JaffaCakes118

resource
81c1b6161ba281cbf27a06f42707bcf0_JaffaCakes118
unpack001/$PLUGINSDIR/EBanner.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc3.dll
unpack001/$PLUGINSDIR/linker.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe	nsis_installer_1
static1/unpack001/$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b86a36090347d295298955a7bf2a99a7242a69dcc36edbd3e85b72c6eb6d0e71
MD5 81c1b6161ba281cbf27a06f42707bcf0
SHA1 a0a29aaae13a278ba95982d72237f2ed15ffb1be
SHA512 12366a89e89b35745bab801e54de237ffb8473b03784798dddf3fddc7af20aa97601b206923e948fe3d6128b722851f0873887b27b18fab53d18087018184f9a
SSDEEP 3072:xLk395hYXJi45+ElktDKJnRjy470Xatvsq3RVTZPsfI6R5+o2bqU4dF:xQqg1EesRjt70Xat1pU+o24dF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/1clogo.bmp

SHA256 8757ff66d03c7e8cdf429ab77e1b648064a34bad4c28f08f08f5770f05fe02db
MD5 fa3a4bcf15747bd465fb9b4afb273df8
SHA1 14b284b6e1552a9509089e8f4319e455a6e2896e
SHA512 04cd28b65f2f1eac3fb7d098e4e365ac23393e6fcb8393728b0baf24af3bea98570aa4c72033b8c7f23011886d9689b798f1ecb76f2d7460e64f4707e165a7a7
SSDEEP 384:HYmpb5ksAkrrXKUaAhSEWy05fDh4OW57RvhgUvNvFb2wjlqRw+V:LVrXZ3WGOY7Rvhdvk42
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogoEZL.bmp

SHA256 ff0e4e60d925761c8756c4bb93186855061b1b0008a2fdf735cd1a759709a937
MD5 0efd00dd1adab09815b57590db57a6a5
SHA1 401d0e7747f0c5f3815816f62bfbe9b25611c07e
SHA512 429f3d039b0a99b0971f857c4cc8391fe22149647ed0c20d57224535cb50436a35ba2fbf10ad1cd1125b8a1e30a69e76307835144b3487bbfc1c8d2af4291045
SSDEEP 192:8h04oH9wsHjzqqaF8tREFKcQtqRpaI55ZnQI5Zd34nCbiaoG9ffffffffffffffn:8hyFRHcPRRZnQI5Zl4CWaH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogoFTT.bmp

SHA256 4b1ffc812e389761479019b929d34a4d11323caff958fb8a74487342dfc5dd23
MD5 841fd20364e4c2442cbd5b99e2a4e4d3
SHA1 e5d4b7957ce0706a4c1c756309554c31d6be5e07
SHA512 2bc69c4126120a5ead1d939bff448b959d74bb40fd45cc0471f3603035ef1b944faeaa41136c52bd7a3a757ed9d9ee77cb6808623a88e0814dc1fc7c12b44768
SSDEEP 192:7CPt+RNU/YcsEpDBkM+wPqZn333mQIZfytmphbSe4eCbuwJG9ffffffffffffffC:7qBkMjCZnWQYj4fiwL
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/1clogobvd.bmp

SHA256 2448c00e0fb216b7d9a0d44cda419e89b10a5933b582a6bb620e78c59ba0c765
MD5 91484e211d4282fb392e49d541b21be7
SHA1 3bede7df18639611af5664e96e65441d69d7435e
SHA512 e2f5056979b46907341d850f6c2c2b8ed65625643cb4a4896fb40f1df7dc0aabf4b86f3d11f12035c4cf0c0efa6a657d0f82678e84c9368926fcda05ce7f6ebf
SSDEEP 192:x2LNXtw8XRX80mGWpxiCV7RekMLqSFkCAQL9nlPg4BCbumueTffffffffffffffl:xMN28J80oIW7QkML9bk4Iymp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/EBanner.dll

IMPHASH c759d72719f57a6b126c48a6fe97f6e7
SHA256 dd519ae6d7fd6df0c32db834df215df2fe7c1d044b800922a58da7f4f00b95ab
MD5 cce7bc13dbc3faea7769fcf7727eb19f
SHA1 59633ed1adc02235ca058883534ff36be4fb3f37
SHA512 21e4a8ecd383d59ef24f590367328248d21c7fe452fc5c3a42ec597f920e79caf6a8047babb9fb44d2cca8329dd7d14b39cf13a0934aee409fa5bdd7c2e4f121
SSDEEP 96:9agsHJMYSzHl+I3tFGLafz6Dy/qCWDIH7:9DspmHlv3Lnf0yiCmIH7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IM_tb.bmp

SHA256 bde5d954c4739fcdeab2ae4218bd0c22f3b8d6be159bcdc75a950c43131cf477
MD5 b761dfede17221f5a9832096f9f4de0f
SHA1 d37a0f584fe1897add707d3a3e1f13181285f8e4
SHA512 fca046d83aed46cb4568e61475352b28c5ab9c5f531fa41b2ae4d1c3686f083bf742637ec4a42d1db22ee87f38fdebfb149adee52ae85c0acffe4af471126153
SSDEEP 96:wdZaWwzCUmvv/WMDWf1hAYaZ5FcrpspQrT5eqq5CL9Kp:wOXm+odXFIiQBreCL9Kp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/accept.bmp

SHA256 7baca1380f469042514a5fef60dde2361aa47e8bb0fe8e01c1ec175d22c97251
MD5 d2b45ba831902d1f030b7090682cfa1e
SHA1 398c9098d01b3d333ed11971cceb4d685a561814
SHA512 c195b1aeea3b35c111750ab423bbdd4c03ad81701539db77961f079eefce80da013ed1341254d38ea819528ea50e4de5236f2e9d10c4f7d7eb17db65d70919fb
SSDEEP 48:Fg2Cnww2i1SJ4Gw102JLDJ111hZKtZVpPjB8kmM5vfr7GDoxetl3g8uZ:Fg2OD1SW02JHF0tZVpmhM5vDaw84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept1.bmp

SHA256 114c238c17d1cbc30e0d1f30fc5db00f6cfa579d27f755b6494bdcf1687e285b
MD5 cec7eff3bd27fb989b1862b65cf92bef
SHA1 4b61a2778f759e8b6c5c5fff51d0607455528480
SHA512 2bfad999a07d4126a83772af059af66f97a1a3e2156e486309639c0d7efcaed57933faa80f295429eff2cbcd450c4851d191e2f370ebed06fb45a12dd922a1b0
SSDEEP 48:Fg2CsF1wk8ig4C7Q10DGG+D9HG1111jZgHI5PjlimMxrhoDUgt3g8uZ:Fg2l192G0DGB9syH45PMdhwLe84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept2.bmp

SHA256 f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
MD5 f642e8cfce23aa5d124533357de7394b
SHA1 80ce98a2bc4b416db357ea52a74424d742cfaa55
SHA512 d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
SSDEEP 48:Fg2CsFXtwOW3iC4CnE10DGGiGpUDQ1116ZlNCmNdFIz6PjfmMMrhHDaBr3g8uZ:Fg2lXtJz50DGXGUZrUmND3yMShj/84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept3.bmp

SHA256 b77cd138ed85e75c1e68d8c4709db2b4bdee1cac79cd56fde3d10f9c2199ebd9
MD5 f9fb54ee9ebc5ca38459de73f3055784
SHA1 d2e58aef1bbebfdf4265002b12f402fb805d2bce
SHA512 f821a21e77be530db3aa0b80cca0157f39fd905f1546a85ee94b3ba6e28cc91fe186cb43cd8684bb6306b249ece2e07552655b03c11195c854689e308bd38b18
SSDEEP 48:Fg2CdtwWoiI4E10jUDK1116ZuWdFv6PjImMxrCDYV3g8uZ:Fg2ctvy0KrUWDChMd6l84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/anon.bmp

SHA256 5c42a00a748751ba9c1a1c4368cc24ff496312e79f044e60c9f2deadb4c805d8
MD5 a47a7ad599235252a67fe1e07d8b8384
SHA1 859b64bbd15d262431c839941e17714c2b9beb24
SHA512 80e3efcda521c7925a657f21b73fb4aacfd0fc4b41b24dbebb949e98ddccdac47ff44e4b3629e589833cb426e5203246e5f5bcb475f384c77446b5e5db87809c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bab.bmp

SHA256 884982b7af88633b71af65b0dba0e979088e628b33db4aac43ea458f2d94729a
MD5 f5f91b6d3443cc2fa5c4bd4728e78199
SHA1 f37c18381cbd141af3aa944eef58c28d76c09708
SHA512 a6da6b4720bf29e129fb94a674d185e578fa69e19a5023c97bb3dc85a5b2154f7d927d0ec3be1846314f550cb972605d518c336cc46180d30bb6c7182ad26bec
SSDEEP 192:VOn9I+52JSnIuCy8O0M+EKOJeuzbvx/Rkj:4n9ZlnZCy8U+/OPvFuj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/buzz.bmp

SHA256 54790dd24b9816a92eb517db6521b5278801bc30f68ffce546d2fab71ad9f327
MD5 9bf2c31ad1b106d1892ed521a1dce3a8
SHA1 c0ebc07b7182a526eb3ded9a3d35035da7c90f89
SHA512 e951458506efa4b08c475efce0ca746c3a4dc09534bb5b4e44162fb466b72d6b4741fc8844f554d85ac49cb563302dabf495919a09c60680cf89a148aef2d829
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/decline.bmp

SHA256 eab3f8b4cada67892acc64a6233742f1c81d1709e7b5eca06672378a9b54005c
MD5 4e34c7ad18913485c49528203402b4f1
SHA1 5d3229b72f7d8203c6a3e4bd1dc36337589a8be8
SHA512 8fbc89ed67e5a932591f62dfc7a095f9be65c5da5ca037c2b7264d2e5d7137bb6601da527d53c7559afeef85b958ef934e851f3fc42b2a0a8d84ed794f7ece07
SSDEEP 384:Fg7wXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7X5:FrXXXXXXXXXXXXXXXXXXXXXXXXXXXXXl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/fm.bmp

SHA256 33bf90bdcbc88567dd6c09ad2b2ca921dffa4ee989c789c6236b7caf2fdf0296
MD5 d88799a8c5f28f82829e6867a08f6398
SHA1 8268f8398365f6d1cac08a16290381d741adc30f
SHA512 003c3e922c87cc8c5964b126ef1b8d596bae07af6c855a43742deca18f1b59b887907739b7195f6e7ff764c29a5642f1c35a0aa50d714be2d2d1365843e4adab
SSDEEP 192:9o+3I8WEehtJC0y1ax60fkBsS/kFOAaehQF:9tVW9he0wax60fEsS/ybyF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc3.dll

IMPHASH a8b12938b3ada6957d61b4269a518f27
SHA256 052fd5356691da3962ad025bbb9d24150ef99e92a4e3b3f0beba33e008bf3617
MD5 8f2bda528c13722eb15d57ca27a21cca
SHA1 09d30b7665ad36377e29128fb9707783c9f1b714
SHA512 deb9b72f6b4e9b758095604c0b957e28abd6624e0d9273656a5ec4f9d971eecfb42f76ae44485fa39e2bb54a5111d63ffc48e7dc772c4e2692654c21b77865e2
SSDEEP 384:FLxY5zJDUU4ReYSiCpkzKJxB+1FNCJICD1zPF6H0Ac9khYLMkIX0+GMQ35EXs:lAJDUBQYl4kz4OPC3D1j31
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

14719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strchr strtol strtoul memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA InternetGetLastResponseInfoA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrcatA SetFilePointer GetLastError SleepEx MulDiv DeleteFileA lstrcmpA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree CloseHandle GetTickCount TerminateThread WaitForSingleObject CreateThread GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange GetModuleHandleA

user32

SetWindowTextA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA GetWindowLongA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos

$PLUGINSDIR/linker.dll

IMPHASH 5b9be84907034b8f0152e51177ceafc3
SHA256 53aa57e582dc56421c1191a0a9efac9c36960b903b7d825f3b9682605ec2b612
MD5 8450b29ee8d592c208ba1aaf6ee50267
SHA1 75096da057bc85cef63bb0eec168652ea75cf618
SHA512 d23a3057053a1f36f5eb212ae0b09b9b0b41e50b8a6a20bbc46c12c51199ad0bca741bcce17534488158e8f2b9470dbdac2aa059688b7588a05778c40d461039
SSDEEP 48:q/XgJspkvsIWyuS3fyVLkmqbIWXGuDNcGo+FLtLFSfrPIk2vIhll:4gJsFIWjS3qVomqIixo+9tLFUr4vMl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sIM.bmp

SHA256 8ab1be3ce78edfefd29fa82bbd1975d5af523ab20021273f884ed9e4bf871065
MD5 7d4dc66722957817cc5b680f36921445
SHA1 6e9c416eb750b5f42b9caca8e67e17bdc400c346
SHA512 8d03b88c36abad98d27d5b5e414707c7316b1c90d53a40e4c1ebe8c1fbbc6a3fb3b4809ad660a36d638f438015338515d7f31143ef1f50362216d65a0b3e3198
SSDEEP 192:HMDtz7OdpX2Ypl+DFNLB1vOLdsWwsrGaF:HMDtgpX24lcFNLvOslKx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/save.bmp

SHA256 ffdad025bdc9d97e6c1e93988f00e7f7f31e4aaac08f4b90b859d42c367c8880
MD5 4dc2697be8fa3fd4aa385d73ba500443
SHA1 fe7b27b85b1f5c52798b94e286efa830e539164a
SHA512 7c7524faf84d5b4d7d742eddad560f3a5824b19ffc258247845959ea91cb169416c55a64b46b5f021020ed352ac9cda657408a557cbd4ae65b4a8531a7a36930
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/skip.bmp

SHA256 a4acb445bdc94b951334ed467a3d165446457487f70877f7554e1d8e7afdef58
MD5 f2f64c5809be74da2dfe6e0eea5a4242
SHA1 6ec394130b6ef5fa5945c629f1aa157cdbde9814
SHA512 7769c5fafb26b07d22227c6d9d5e12082d2a0f94584c174f9cf41165bcabb2c061557544fa14e421433f3cac8b0ef9a5aa2b797ddbdf5a12660e89c40e3ad72e
SSDEEP 384:Fgye5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA:Fw5XXXXXXXXXXXXXXXXXXXXXXXXXXXXA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/yontoo.bmp

SHA256 98c055f90270f338716268f2e9dafe04f04d42abec9b36d336845fa6b65beef7
MD5 1f9c8d700b45338fed3d41baffcbf9ab
SHA1 f7255ded2c4ee447c2a21879dca04876bbd21048
SHA512 e310269643cfd19c595f4be1577d85a8298118294fedd9614ed3519dc6054c736f707fbe8353c1afdaaaf117a0e6aea5e24dada4aa93b1634c4ea35bbda4e2aa
SSDEEP 96:tg7tBYPQ9ZS1q4Xf5MQfjP5vzI0qykxinSySXhcsSQHP:tg7t+Peogw5rtdwwSR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PROGRAMFILES/1ClickDownload/$PROGRAMFILES/1ClickDownload/uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 af31fddfdf61a27a813e712d6b990a4ef5388a755cf166e0542ccc49c7a28a95
MD5 7f731258cc0237bf3a7a864a4c2f8c44
SHA1 0ee075a6edb910bedcaada45b4e68df778ba96de
SHA512 2363f31ecc88fc86039b051ae19dff6fd30e1379d7a1c1109190f9c4881f25e14a3dd0e7a0442a9416c45dd4113a555349e0a7e86ffe8aace0c6c096c47dbd27
SSDEEP 768:+4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJugd2iZQAm6kRRS+NoJRnMtAy:xLXB65939tY6HBg4sXJugdLeAyNDtT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer