295b9467242ffd0d1e31974abb86b2e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
295b9467242ffd0d1e31974abb86b2e0N.exe
Size 580KB
Sample240821-d659dayard
SHA256 c6921322345430afa00d52c102743511c57e26c65466fb813e38f4c4fc1ba7c2
MD5 295b9467242ffd0d1e31974abb86b2e0
SHA1 4294a12f5c579818f12ff640c6f9050ee83374a7
SHA512 74abf081b7ddbcf4fd0d3e1f07718e7a74961a0d9522908fb52234b08d2ed0cfa0c70ef0cd8d5837b666e0f03233b19eb0fa3c3160f31b81ab6e30ed413effac
SSDEEP 12288:sb9CUPXAl01bP5LuzS66LY3Tdw/8NpBoIwxNspBjvrEH7CQ:s9CUPwWD5am6gga8NpKIwxi3rEH7CQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
295b9467242ffd0d1e31974abb86b2e0N.exe
unpack001/Regshot.exe
unpack001/Regshot64.exe
unpack001/uninst.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

File Explorer

295b9467242ffd0d1e31974abb86b2e0N.exe

.exe 580KB
Regshot.exe

.exe 550KB
Regshot64.exe

.exe 715KB
english.bmp

838B
korean.bmp

840B
language.ini

56KB
regshot.ini

4KB
regshot.url

166B
uninst.exe

.exe 33KB

295b9467242ffd0d1e31974abb86b2e0N.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 c6921322345430afa00d52c102743511c57e26c65466fb813e38f4c4fc1ba7c2
MD5 295b9467242ffd0d1e31974abb86b2e0
SHA1 4294a12f5c579818f12ff640c6f9050ee83374a7
SHA512 74abf081b7ddbcf4fd0d3e1f07718e7a74961a0d9522908fb52234b08d2ed0cfa0c70ef0cd8d5837b666e0f03233b19eb0fa3c3160f31b81ab6e30ed413effac
SSDEEP 12288:sb9CUPXAl01bP5LuzS66LY3Tdw/8NpBoIwxNspBjvrEH7CQ:s9CUPwWD5am6gga8NpKIwxi3rEH7CQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

Regshot.exe

IMPHASH a17c1245fbe8bdea436b98f9df8d6965
SHA256 3d120c7348dc4055d8c587712cae723acf6a1dc25c85b272aca1b864ed773153
MD5 9cc811d3bb2af7f566ac8a353c7234bd
SHA1 e00b7940ae06f88ba127fd20bafbdff6edbdf288
SHA512 8c79a2464e299822f0ccb6850da5b879c36a9a5ffeaacd1356dc01da4063f8d7f237db55d94837ef91b4bdb3fa96d0852d42f717b3d6609a9be291f21c29e2e0
SSDEEP 6144:hLSfOPbXh7zfkTYygiHmMOWtQmYfVXdW02EZ2TKLlGd2dKzAez3rkEqm:h+fo18mMOYGllMTK5Gd2dKEZ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

277666

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

f:\temp.cpp\Regshot\Regshot.70\bin\ReleaseStatic\Regshot.pdb

secur32

GetUserNameExW

mpr

WNetCancelConnectionW WNetAddConnection2W

kernel32

TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree FindResourceExW LockFile UnlockFile SetEndOfFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetFileTime GetStartupInfoW GetSystemInfo VirtualQuery GetSystemTimeAsFileTime RtlUnwind RaiseException Sleep ExitProcess HeapSize SetUnhandledExceptionFilter GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA VirtualFree TerminateProcess UnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetACP GetOEMCP GetTimeZoneInformation LCMapStringW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetThreadLocale DeleteCriticalSection GlobalFlags GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA VirtualProtect GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW LoadLibraryA GetVersionExA GetCurrentProcessId FreeLibrary GetModuleHandleA GlobalAlloc MulDiv MultiByteToWideChar GlobalLock GlobalUnlock GlobalFree SetFileAttributesW CopyFileW GetTempPathW GetTickCount ReadFile GetFileSizeEx MapViewOfFile CreateFileMappingW GetFileSize UnmapViewOfFile lstrlenA FlushFileBuffers VirtualAlloc CreateProcessW InitializeCriticalSection WaitForMultipleObjects QueryPerformanceFrequency QueryPerformanceCounter GetTimeFormatW GetDateFormatW FreeResource IsValidCodePage WriteFile GetLocalTime SetFilePointer GetCurrentProcess DeleteFileW CreateFileW FormatMessageW CreateDirectoryW ResumeThread SetWaitableTimer CreateWaitableTimerW CloseHandle CreateRemoteThread InterlockedExchange WideCharToMultiByte HeapReAlloc GetDriveTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID FileTimeToSystemTime lstrcpynW HeapDestroy InterlockedDecrement HeapFree InterlockedIncrement HeapAlloc HeapCreate WritePrivateProfileSectionW lstrcmpW lstrcpyW GetPrivateProfileSectionW LeaveCriticalSection EnterCriticalSection WritePrivateProfileStringW GetPrivateProfileIntW FindClose FindNextFileW FindFirstFileW GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError ExpandEnvironmentStringsW FindResourceW LoadResource LockResource SizeofResource LocalFree GetPrivateProfileStringW lstrlenW lstrcmpiW GetPrivateProfileSectionNamesW LocalAlloc GetModuleFileNameW

user32

PostThreadMessageW RegisterClipboardFormatW CharUpperW GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn CopyAcceleratorTableW SetRect IsRectEmpty CharNextW UnregisterClassW LoadCursorW GetSysColorBrush SetCursor GetMessageW TranslateMessage ValidateRect SetWindowContextHelpId PostQuitMessage WindowFromPoint MapDialogRect GetAsyncKeyState RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetForegroundWindow DispatchMessageW GetTopWindow GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DefWindowProcW CallWindowProcW PtInRect GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowThreadProcessId GetLastActivePopup UnhookWindowsHookEx EndPaint BeginPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW CopyRect SetMenuItemBitmaps GetMenuCheckMarkDimensions GetMenuState CheckMenuItem GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetNextDlgTabItem EndDialog GetWindowTextW GetFocus SetWindowPos IsWindowEnabled IsDialogMessageW SendDlgItemMessageW GetWindow DestroyIcon InvalidateRect SetWindowLongW GetWindowLongW MoveWindow ScreenToClient SetWindowTextW PostMessageW SetDlgItemTextW SetFocus GetDlgItemTextW GetWindowTextLengthW ClientToScreen GetDlgCtrlID GetSubMenu GetWindowRect LoadMenuW DrawIcon IsIconic LoadIconW IsWindow MessageBeep ShowWindow UpdateWindow SetMenuItemInfoW SetMenuDefaultItem EnableMenuItem GetMenuItemID GetMenuItemCount DrawMenuBar ModifyMenuW wsprintfW ReleaseDC wsprintfA GetDlgItem GetParent EnableWindow DestroyMenu TrackPopupMenu GetCursorPos AppendMenuW CreatePopupMenu SendMessageW GetSystemMetrics GetClientRect LoadBitmapW GetSysColor GetDC MessageBoxW

gdi32

GetTextColor ExtSelectClipRgn GetRgnBox GetBkColor EnumFontFamiliesExW GetMapMode GetStockObject SetDIBColorTable SelectObject DeleteDC DeleteObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW GetDeviceCaps TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateRectRgnIndirect CreateBitmap GetTextExtentPoint32W BitBlt CreateCompatibleBitmap CreateDIBSection GetObjectW CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegQueryValueExW RegQueryInfoKeyW RegEnumValueW RegConnectRegistryW RegUnLoadKeyW RegLoadKeyW AdjustTokenPrivileges GetTokenInformation OpenProcessToken RegEnumKeyExW RegCloseKey RegOpenKeyExW

shell32

SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetFolderLocation SHBindToParent SHFileOperationW

comctl32

ord17

shlwapi

StrRetToBufW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoInitialize CoUninitialize CoInitializeEx CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal OleUninitialize CoFreeUnusedLibraries OleInitialize CoRevokeClassObject OleIsCurrentClipboard OleFlushClipboard CoRegisterMessageFilter

oleaut32

OleCreateFontIndirect SysFreeString SysAllocString SysAllocStringLen VariantTimeToSystemTime SystemTimeToVariantTime SysStringLen VariantClear VariantChangeType VariantInit SafeArrayDestroy VariantCopy

gdiplus

GdipGetImagePaletteSize GdipGetImagePalette GdipBitmapLockBits GdipBitmapUnlockBits GdipCreateBitmapFromScan0 GdipCloneImage GdipGetImageWidth GdipFree GdipDisposeImage GdipGetImageGraphicsContext GdipDeleteGraphics GdipDrawImageI GdiplusShutdown GdipGetImageHeight GdipGetImagePixelFormat GdipAlloc GdiplusStartup GdipCreateBitmapFromFile

Regshot64.exe

IMPHASH 23f72123f56ba55d73dc3c4c7d869cdb
SHA256 730b26bac77f2524364b85ad1c42a585a04bdc80b3e83832b9dcdf9455365783
MD5 47066544a5f5b1e7e4317eea18273432
SHA1 b085ecb313807d7b8f861577710718a7976718c9
SHA512 4d9ab2a7bf6ccb2493e1467d10db4fd13e15503bb960d8b70be940adce467e73c28e7b3e40a668f303b1f8819871a858e33861c77eb7410b86f617631f1e6f05
SSDEEP 12288:QaciR9/Rb5rXYQfJ3W6XB5eUEpeNWqP+UeARHxl+21z/gAuDyKBURS:QccGJ3fBZ3rr82lvTLRS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

362464

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\temp.cpp\Regshot\Regshot.70\bin\ReleaseStatic64\Regshot64.pdb

secur32

GetUserNameExW

mpr

WNetAddConnection2W WNetCancelConnectionW

kernel32

GlobalHandle TlsSetValue LocalReAlloc TlsFree FindResourceExW LockFile UnlockFile SetEndOfFile DuplicateHandle GetVolumeInformationW GetFullPathNameW SetErrorMode FileTimeToLocalFileTime GetFileAttributesW GetFileTime GetStartupInfoW GetSystemInfo VirtualQuery GetSystemTimeAsFileTime RtlLookupFunctionEntry RtlUnwindEx RaiseException RtlPcToFileHeader Sleep ExitProcess HeapQueryInformation HeapSize SetUnhandledExceptionFilter GlobalReAlloc GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree FlsAlloc HeapSetInformation TerminateProcess UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext GetCPInfo GetACP GetOEMCP GetTimeZoneInformation LCMapStringW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode LCMapStringA GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA TlsAlloc TlsGetValue GetThreadLocale DeleteCriticalSection GlobalFlags GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA VirtualProtect GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom GetVersionExW CompareStringW LoadLibraryA GetVersionExA GetCurrentProcessId FreeLibrary GetModuleHandleA GlobalAlloc MulDiv MultiByteToWideChar GlobalLock GlobalUnlock GlobalFree SetFileAttributesW CopyFileW GetTempPathW GetTickCount ReadFile GetFileSizeEx MapViewOfFile CreateFileMappingW GetFileSize UnmapViewOfFile lstrlenA FlushFileBuffers VirtualAlloc CreateProcessW InitializeCriticalSection WaitForMultipleObjects QueryPerformanceFrequency QueryPerformanceCounter GetTimeFormatW GetDateFormatW FreeResource IsValidCodePage WriteFile GetLocalTime SetFilePointer GetCurrentProcess DeleteFileW CreateFileW FormatMessageW CreateDirectoryW ResumeThread SetWaitableTimer CreateWaitableTimerW CloseHandle CreateRemoteThread WideCharToMultiByte HeapReAlloc GetDriveTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID FileTimeToSystemTime lstrcpynW HeapDestroy HeapFree HeapAlloc HeapCreate WritePrivateProfileSectionW lstrcmpW lstrcpyW GetPrivateProfileSectionW LeaveCriticalSection EnterCriticalSection WritePrivateProfileStringW GetPrivateProfileIntW FindClose FindNextFileW FindFirstFileW GetProcAddress GetModuleHandleW LoadLibraryW GetLastError SetLastError ExpandEnvironmentStringsW FindResourceW LoadResource LockResource SizeofResource LocalFree GetPrivateProfileStringW lstrlenW lstrcmpiW GetPrivateProfileSectionNamesW LocalAlloc GetModuleFileNameW GetStdHandle

user32

PostThreadMessageW RegisterClipboardFormatW CharUpperW GetNextDlgGroupItem ReleaseCapture SetCapture InvalidateRgn SetRect IsRectEmpty CopyAcceleratorTableW CharNextW UnregisterClassW LoadCursorW GetSysColorBrush SetCursor GetMessageW TranslateMessage ValidateRect SetWindowContextHelpId PostQuitMessage WindowFromPoint MapDialogRect GetAsyncKeyState RegisterWindowMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture SetWindowsHookExW CallNextHookEx GetClassNameW GetClassLongPtrW SetPropW GetPropW RemovePropW GetForegroundWindow DispatchMessageW GetTopWindow GetWindowLongPtrW SetWindowLongPtrW GetMessageTime GetMessagePos PeekMessageW MapWindowPoints GetKeyState SetMenu SetForegroundWindow IsWindowVisible CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DefWindowProcW CallWindowProcW PtInRect GetMenu OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowThreadProcessId GetLastActivePopup MessageBoxW UnhookWindowsHookEx EndPaint GetWindowDC GrayStringW DrawTextExW DrawTextW TabbedTextOutW CopyRect SetMenuItemBitmaps GetMenuCheckMarkDimensions GetMenuState CheckMenuItem GetDesktopWindow GetActiveWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow GetNextDlgTabItem EndDialog GetWindowTextW GetFocus SetWindowPos IsWindowEnabled IsDialogMessageW SendDlgItemMessageW GetWindow DestroyIcon InvalidateRect SetWindowLongW GetWindowLongW MoveWindow ScreenToClient SetWindowTextW PostMessageW SetDlgItemTextW SetFocus GetDlgItemTextW GetWindowTextLengthW ClientToScreen GetDlgCtrlID GetSubMenu GetWindowRect LoadMenuW DrawIcon IsIconic LoadIconW IsWindow MessageBeep ShowWindow UpdateWindow SetMenuItemInfoW SetMenuDefaultItem EnableMenuItem GetMenuItemID GetMenuItemCount DrawMenuBar ModifyMenuW wsprintfW ReleaseDC wsprintfA GetDlgItem GetParent EnableWindow DestroyMenu TrackPopupMenu GetCursorPos AppendMenuW CreatePopupMenu SendMessageW GetSystemMetrics GetClientRect LoadBitmapW GetSysColor GetDC BeginPaint

gdi32

GetRgnBox GetTextColor GetBkColor ExtSelectClipRgn EnumFontFamiliesExW GetMapMode GetStockObject SetDIBColorTable SelectObject DeleteDC DeleteObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx Escape ExtTextOutW GetDeviceCaps TextOutW RectVisible PtVisible GetWindowExtEx GetViewportExtEx GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateRectRgnIndirect CreateBitmap GetTextExtentPoint32W BitBlt CreateCompatibleBitmap CreateDIBSection GetObjectW CreateCompatibleDC

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

shell32

SHFileOperationW SHGetFileInfoW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetFolderLocation SHBindToParent

comctl32

ord17

shlwapi

StrRetToBufW PathRemoveFileSpecW PathFindExtensionW PathFindFileNameW PathStripToRootW PathIsUNCW

oledlg

OleUIBusyW

ole32

oleaut32

gdiplus

uninst.exe

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 2c25de8830a6bb037a47028ea7e1e458d6741291e185b021631c53864deec4a2
MD5 90ff1f5caaf6c77f6c188420f6ca70a3
SHA1 59d0416186f9e197cd3c88454dfb69654e81ac08
SHA512 ee1814110c3b5eb2d17d555e770f1e96a764fc1ad01533aa8eeee4ce4575a764d1ea0feefbe3246ec438ebbd3e3edc7db015b5ff6bf28aa00695df9f29404b16
SSDEEP 768:RyqO0NeJ44sQ3Vs6jTL2yxMxSw5+1K9XfmYTIA3ydfdcbJRnGpjMcA:LHNSPseOQ2HcK9XfFyBdcKpYZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

Sharing

General

Malware Config

Signatures

File Explorer

295b9467242ffd0d1e31974abb86b2e0N.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

Regshot.exe

secur32

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

generic

Regshot64.exe

secur32

mpr

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

generic

english.bmp

korean.bmp

language.ini

regshot.ini

regshot.url

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic