Cursor_Lock_2[.]6[.]1_Setup[.]exe

resource
Cursor_Lock_2.6.1_Setup.exe
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/CursorLock.exe
unpack001/CursorLockSetup.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Cursor_Lock_2.6.1_Setup.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 323f10dc2f7921f2e87562ac1094f667dac01a2e34426aa03a6509761e5c1f3c
MD5 a14529624223a1f4e483b07957ed7b60
SHA1 81f64b95631ce13ad404d54fcbd20d3a5b779268
SHA512 d641d87b77193be3f0caca46c20e0a7a569ee92b570376c16720705867e7e8e84a8fcf8062234571efed6f48a533bf945b3c4c42aafe4d32994e925e48c1ca0c
SSDEEP 6144:QQq+6F0dmYK6ynxunVgNGC83fENxtXVT7Z:x6F0dmYlIx1Nb8PQ75
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/StartMenu.dll

IMPHASH a648aeaa164b592c1e8892a10400b5ae
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6391

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CursorLock.exe

IMPHASH c53b1f7129bf27744b8e28e1eab61eaa
SHA256 bc35417142da1b33d3972fe9f6adf43158ba101f35613d34b8f02cb78f01239f
MD5 aad91e7bf957e834205d913dffb0ac72
SHA1 d8c7ef403e4b48b2022a1e7c8259e9d2b2f3c99b
SHA512 252d49423ee342ba358bfe2b03bbd9479debc2ab62c157c0c91783b0910c8e584e01144106cbf6191ebaf5e117308e8d5ff5a034c9f13bcea2d28cd29cc7e1ee
SSDEEP 1536:GXbEc+2w6t3XtY2zCFa+y2i10MivzEJ7Vc9kgbtBYP5eECgDg5NOaF3PUS4:GrNjr6RfCviv64/eoECyg5NOaxPUS4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

33638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

PathIsRelativeA PathFindFileNameA PathFileExistsA

kernel32

TlsAlloc CompareStringW CompareStringA GetVersionExA CloseHandle CreateProcessA GetPrivateProfileIntA GetPrivateProfileStringA Sleep SetProcessWorkingSetSize GetCurrentProcess Process32Next Process32First CreateToolhelp32Snapshot OpenProcess CreateThread GetCurrentProcessId TerminateProcess GetCommandLineA ReadFile GetProcessHeap SetEndOfFile WriteConsoleW GetConsoleOutputCP WriteConsoleA LoadLibraryA CreateFileA InitializeCriticalSectionAndSpinCount FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer RaiseException RtlUnwind GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeFormatA GetDateFormatA GetStartupInfoA HeapAlloc GetLastError HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue SetEnvironmentVariableA TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetModuleHandleA GetTimeZoneInformation EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapSize ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount VirtualAlloc HeapReAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

RegisterHotKey GetMessageA GetForegroundWindow GetClipCursor GetClientRect ClientToScreen OffsetRect UnregisterHotKey GetCursorPos MonitorFromPoint MonitorFromWindow ClipCursor MonitorFromRect GetMonitorInfoA IntersectRect GetWindowThreadProcessId MessageBoxA GetWindowRect

CursorLockSetup.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 36c33cb43d0cb8cd3746fff0fa68f277f2a27f071fb167bb15a72b1fba816d51
MD5 bcd6d8d15f96b6cf22f7b4f07cd101b2
SHA1 f3469a43690595ae11d3d109c038358dbff3ffec
SHA512 5e776d605210e1834a1a852930955f09bc63c9f531a4af46a7fbf14cf180900e63fcba4761c190d696fe6db4bad1a9008389032586ae752021d11e5d68ac17de
SSDEEP 3072:Xd4dsYhc46/Xw/NnAqbAOi8DYm7Ln9X30CqT4T2hWO7MDWg8KKWKyMZzcwaoP5fB:to1ghWOYyKK0MnFpahY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

185886

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

readme.chm

SHA256 04855309c3857aaeff81b7f2696d3af432f403eb7b4bd93491deff7f99acd4ad
MD5 49710c3ac0c18700af5aa8fd8b40cfeb
SHA1 97e3dd1ce8112bb1dc8690c5b3dffc302427ad88
SHA512 78057fad95c3c8ca02dcb4694304b75a6b8bf347c87530b7af18e95be5c8979b086bf368144c05b83d4391ace0da092676762440cf14843443fc37d485c49b64
SSDEEP 192:YeyoTRZZWfhS9XM64vbqcPedHrcQHuQo8NyP:YeyoTRHv9c/J4HNHuQo+y
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer