cdba0935f95f8e97ffadb50d510ace60N[.]exe

resource
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/fct.dll
unpack003/$PLUGINSDIR/NSISdl.dll
unpack003/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/bin/firsttime_setup.exe	nsis_installer_1
static1/unpack001/bin/firsttime_setup.exe	nsis_installer_2
static1/unpack001/bin/prepenv_setup.exe	nsis_installer_1
static1/unpack001/bin/prepenv_setup.exe	nsis_installer_2

cdba0935f95f8e97ffadb50d510ace60N.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 af8b500428ae1502c2b6c3ed6f91714b873f8c4f418847cd234fb2b9e2b5a0c2
MD5 cdba0935f95f8e97ffadb50d510ace60
SHA1 22940e1590aaa949c23faeaf02c46c0e1c8c9d6a
SHA512 d6428c70a44b77ad441ecd806a80e5c4f56400cc41e6675598f86d467b3ec6870787d0304dbe183a6e7f510e869f54c12081db67d58f685d62e11cd8c0565f2e
SSDEEP 12288:ZpG3lMqLngPixjkRGAy4EkqDkJE+FUsr0v:ZSMqLgPilOytc2cLr0v
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3b:e6:be:a9:aa:b2:9a:88:fa:16:ac:0d:68:6c:88:08:52:02:6e:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

May 2, 2012

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$APPDATA/Genieo/Application/TrayUi/bin/gentray.exe

IMPHASH b3778e9cf72153344dbdd55454337c13
SHA256 41e09d91850d85cf97ba5cef2936cf9bda879595694b1457e27c9aecad1ac349
MD5 7103eddedf089adaff84539585df19af
SHA1 a4cbef70b9233956bcfeccff176ae971fb16b73e
SHA512 38fd37ce6e3a72cd350dc6535222dffc011d0c66dfb09ce4adb3cb2ed1eb1834b7444172500e7e2062b8660b0c61925fbb2d249b5fced9166c7da7c49b93e191
SSDEEP 12288:X1yFkepOza4J1k7/g/DP6eUbJn6uviTd8e:FynpV4J1S/YDPeJn6xTd8e
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e9:3b:5b:71:3b:84:97:23:9a:ae:4e:7f:2a:a7:35:21:db:af:58:08

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

Apr 23, 2012

Minor OS version

0

Major OS version

5

Entry point

97744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

K:\projects\AnabelPackage\build\src\TrayUi\Release\gentray.pdb

ws2_32

shutdown inet_addr htons socket connect send closesocket WSAStartup WSACleanup recv setsockopt

urlmon

URLDownloadToFileW

psapi

EnumProcessModules EnumProcesses GetModuleBaseNameW

wininet

HttpSendRequestW InternetCloseHandle HttpOpenRequestW HttpQueryInfoW InternetSetOptionW InternetCrackUrlW InternetConnectW InternetReadFile InternetQueryDataAvailable InternetOpenW

kernel32

LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection GetLocalTime DeleteCriticalSection GetExitCodeThread CreateEventW VirtualQuery FreeLibrary SetEvent GetTickCount ReadProcessMemory GetProcAddress OpenEventW HeapAlloc HeapFree GetProcessHeap GetPrivateProfileStringW DeleteFileW SetLastError GetFileType SetHandleCount IsValidCodePage GetOEMCP CopyFileW InitializeCriticalSectionAndSpinCount LoadLibraryA GetModuleFileNameA GetStdHandle VirtualAlloc VirtualFree HeapCreate HeapSize GetCurrentThreadId TlsFree TlsSetValue TlsAlloc TlsGetValue GetCPInfo LCMapStringW WideCharToMultiByte LCMapStringA RaiseException GetStartupInfoW HeapReAlloc RtlUnwind GetSystemTimeAsFileTime IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess InterlockedDecrement InterlockedIncrement WriteFile InitializeCriticalSection SetFilePointer GetFileSize TerminateThread lstrcpynW CreateThread GetTempFileNameW GetTempPathW ExitProcess GetModuleHandleW CloseHandle TerminateProcess GetExitCodeProcess OpenProcess GetLastError MultiByteToWideChar lstrlenA Sleep GetCommandLineW CreateDirectoryW ReleaseSemaphore WaitForSingleObject CreateSemaphoreW GetStartupInfoA ReadFile GetConsoleCP GetConsoleMode GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetLocaleInfoA GetStringTypeA GetStringTypeW SetStdHandle GetModuleHandleA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEndOfFile GetACP

user32

IsWindowVisible wsprintfW FindWindowW GetLastInputInfo GetDoubleClickTime DestroyMenu PostQuitMessage PostMessageW TrackPopupMenu SetForegroundWindow CheckMenuItem ModifyMenuW GetCursorPos GetSubMenu LoadMenuW RegisterWindowMessageW KillTimer FillRect InvalidateRect SetTimer DefWindowProcW SetCursor EndPaint BeginPaint ShowWindowAsync ShowWindow PtInRect RegisterClassW LoadImageW SetWindowPos SetWindowLongW GetWindowLongW CreateWindowExW LoadCursorW DestroyWindow GetWindowRect GetClassNameW DispatchMessageW TranslateMessage GetMessageW SendMessageW

gdi32

CreateCompatibleDC CreateRectRgnIndirect SaveDC CreateDIBSection SetStretchBltMode GetClipBox ExtSelectClipRgn RestoreDC TextOutW SetTextAlign SetTextColor SetBkMode CreateFontW SetPixel DeleteObject CreateBrushIndirect GetStockObject DeleteDC SetDIBitsToDevice BitBlt SelectObject

advapi32

RegNotifyChangeKeyValue RegQueryValueExW RegCreateKeyExW RegCloseKey RegEnumValueA RegQueryInfoKeyA RegOpenKeyExW RegEnumValueW CryptHashData CryptDestroyHash CryptCreateHash CryptReleaseContext CryptAcquireContextW CryptGetHashParam

shell32

Shell_NotifyIconW ShellExecuteW CommandLineToArgvW SHAppBarMessage ShellExecuteExW Shell_NotifyIconA ShellExecuteA

ole32

CoUninitialize CoCreateGuid CoInitialize StringFromGUID2 CoInitializeEx

shlwapi

StrTrimA SHRegGetUSValueA SHSetValueW SHGetValueW SHRegGetUSValueW

iphlpapi

GetAdaptersAddresses

$APPDATA/Genieo/Application/TrayUi/conf/conf.ini

SHA256 ecfb4de970e9753555ed35d73826ed7a540763348ef85b0096e947aa4ce9dcd9
MD5 8a9654187aaf89737fdcff72ca57a7dc
SHA1 4aecc873bc3abc065f8119586cfb6f8f06ec178b
SHA512 e68b766313dc29c3561d44b17f34ecf7c974ab12ddaa4b8e078e212063f16c0557ce160a2b434c7976fdb2d22006384b2281a5ff5d02cc30af64b0ddbe328ee6
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/Genieo/Application/license/Apache log4j 1.2 - Project License.htm

SHA256 7357717c3e79e70f40399915dc5c93bd7174749764d345a6c4073ebe63b2bd91
MD5 52486847bedbc3b57533f9f522cae148
SHA1 d9bcc36c905494a029f9b348051fa8673b61344d
SHA512 1b6a8f4b8700a09dc6f3e4f7af5a2330e4285b32f8dc1cbddcefbd1367b0eef5b54c06dde8db88035b31dc3c1805d3e2947f1dad9625df6ff8e3bf97752453d0
SSDEEP 384:2kEFEAU3P2TLqu9vlKM1zJlFvmNz5VrlkTS07H9:OYaqu9TzJlFvAfxk1r9
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/IE HistoryView Freeware Internet Explorer History Viewer.htm

SHA256 a5153fe19acac1f79c2a2bb93b6b9be9695afd6ae329be15b57eb7c672038d18
MD5 f5b751338a501ac924345d0121fd1e4f
SHA1 4872e2693224a0f2162dd77e2ed1d6bb77a538f0
SHA512 772260f3df392f36be3d22de1ce09a1cacb5a6ac8b7f4b15a11d198dda375b14fecdf75f602ec2126ec418b11f373756044d0e4989ddc759cdfa47c4b1776c3a
SSDEEP 768:dz34hiCHrWAKq9jwJeVGGe8UyYVMYkSun/g7Q:ZynSAKq+J8evhiSun/g7Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/JDIC_Plus_index.html

SHA256 cbf30fd1ad8a8cfcafdc00ba1ae3effc2323ccdcdaf4795dfd10f7787d87897f
MD5 7b44d4ba805668607bf7a83471fd034e
SHA1 22abb2f0b989670bc0f05f9cec5db30df41d862b
SHA512 1f9b4c0709bcd317d7fc538afac9d3810dbc8d4057a768bfd6e538a3b6a936c2a864b1f515c3c4b381d032cc84740d511fc870be0b04d8699cdd398342a37a23
SSDEEP 384:S7vDEgesdKwY1M5/HjgU297/pe7+MzSYdFznLD6no0b+jKy42z1xqMF:S7bYXJYfznLDKo5jKy42hxqg
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Application/license/JDOM_FAQ.htm

SHA256 493fa128494447a50a45e14d5943f6db7df4e5fe2af10a55972c9c14a917721a
MD5 3d9a7c1bd514b292beefb4ac53e0589b
SHA1 dcab081d7221da2819cd633522be981d31aba88c
SHA512 4cf28c31b0ad90b56c52a5cf0bf1b3bd42775908593a731af2592e546c62cfef1ccaeb1030ac73677d06b69aef437a1f45b912ee8e2c9bf57a44822917931120
SSDEEP 768:hkUhH2rvZ8O+WKcL9IX9AnRxwYVqqYK1GPHU88IRrCUh2:hOvF+6G0RqzK1GPHIIRrXQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/JavaMail API Reference Implementation  Project Kenai.htm

SHA256 d979decee709ca79f4c407e47107b4e10440e530f680cccfb4ff527fb544f994
MD5 0aa0444d60a9c8a7d6d9c169baba6c08
SHA1 38b14c28a60b05b3e8909cdb8e7cc401f161aacf
SHA512 432e0cf8684f8aee8724a5544677ab6a25839b383016b4c713b176b251dda417e27b167d0b34c117c306914788ce543e0e2abc06953523500944714a5c9dcf23
SSDEEP 384:tGE14msGb6LnyT/OPAxBL7jbYgUfdp/s8Pd3dOdYRpAoqnNVz0RqJXnXYaPa:uG3wV4wwi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/JavaMail_SMTP.txt

SHA256 5ddda1e1cbbc542f38683655b16dbd69502518cb235f17c5236e6b09a0b197be
MD5 75ae5bee3372290d1075dfee3be32bea
SHA1 1fc2eb95ad8c660259590ef104a4eebe0b2d165b
SHA512 568300a4f5af275b153ef1b00f71ef80b6b1398032984cdf9c35a873fcacd174ffa57a48753fec124438126f551d43303b615ec3651427feaff36239a32b2fde
SSDEEP 384:BwrHXQ3wDzZksApECCRCoXR89DkGkxS5T:BgCIzZksKEXIFf
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/Jericho HTML Parser.htm

SHA256 c52b720bc5783c209d9cab139b65bcf78e7b7172124a6e2a562fe46d06c1ebe2
MD5 f369216e52090241bcaf3dd83430267a
SHA1 e4c922043b077da0ef22f4a581d5985a1944e53f
SHA512 7083f3a6d5f89753f885e89c22728b01ea9c464b0ea5b8ab704684f5e839163099ddfd1f42b91f1335f303dc6fd24a447ddeb9a90f7c88daff3bd33e08412001
SSDEEP 768:QFVnTbh1aNM1nozRlhmArcXhWtc80LM2Qj2yDSrnhb/u7u:QFd50NM1nozRlhrrcXhWtc80LM2Qj5Sz
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Application/license/JettyNOTICE.txt

SHA256 d0e2cb654041decbe512f5bbf4905618b07ee5d1d791e740cf84874c2e427330
MD5 395c49f95e29aa55020e6ac7044f8861
SHA1 b0077233f931ddcde18c11a867ac06dc3d0aefef
SHA512 39682932e0dbd54cf0342ecddf9f461cc2840b7dc433addcd6db02775f03c23762a3f26e3dedca1d249830f1c156b4cd24d3716a5b55458f61c37a89fa2638ad
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/Genieo/Application/license/Launch4j - Cross-platform Java executable wrapper.htm

SHA256 e814e77923b1c622df9df86088784b3b0fa8f36eaec5badf203034a7718256aa
MD5 b767118dc5230c1d9ae7c309c87b280a
SHA1 1ce56097cd58640676c8245fb66e443e2b782b3b
SHA512 e66ac2a5fac30b46ed53731321c86d7ae2daa1a472fc48defff8aed21dc516c4a08319ee7753c447a2de7f1322704353fb44d7d0e552f6eb09c672dca7cfefc6
SSDEEP 192:FN4+16IyqPZMsouJAxNkfwz4Ws5rH49CN71uEAPRc+k6yfm:Fq7C5oqAxNLz4WmeCNY1PRk6yfm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/License - jQuery JavaScript Library.htm

SHA256 efe6e6bb6388ed19a984bb74dbd12eabfc15abfb84b843326afa8886855d17e3
MD5 f9b122c546010aad3310781f32553ac0
SHA1 88c3a0065b627050e34a5c712acd8c801bf6261a
SHA512 4d7e7aa4f27c639e61cd1a7af4e29762ec112941d3dfeb7d6fad27e2938b0bff4ce0279514f5088a2c20b5f3a9d9df51335b5002a0deea00f77bc09b9b8c9254
SSDEEP 384:klH21N91v7AL513Tu0oJu1JcdfJuDi2uTu1XNtGLpJ:hzkntGf
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Application/license/LicenseAgreement.txt

SHA256 c8eacc620d8e7213aa326f44d6d2f2c840817ba364b03ec69fb03a44313f5624
MD5 a3886d86d265f2cee4e010fc8d70a924
SHA1 3fe67b5c50bed9fb47fdd993df603fb458cc21f3
SHA512 9353bceda9d8a0189aab432513e10f9a7eb33b9564ad8ed2e82cc2c5716cb5c35bfd984b979508d317b4884a3a368cc9d2cfebae17aa118a407b875925dabb86
SSDEEP 384:jtgTnEjNnkZsUoF0/5t8Rsshaj8yB+2pA+Qz0et/K:BgTnkNnkZsUoA5t8RTk4yBHAj0Iy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/Licenses.htm

SHA256 17c1a6c710bc560ca4bcade1086ff9adac3700b5563488f3838740aac81fb2a0
MD5 e73b4c3655c5a5f7726eae8a078fced1
SHA1 46f9349199984bdfca1adb2849c029eb5c380f64
SHA512 5561d8e41edee9ea6b0ae6af2bc7f78684e444bc04c6e414e7bf86ac2ff447ee62b7bb1246575e86e0694c007bd68f481b63e656b32fa27930630155af84f812
SSDEEP 96:XXcZA8PWsgxCigYDlXJQ7Tw0l18D834bejJZIqgXNRmZVvyKiA02wa8GGaZ:XXcHreQXMAJgXNRmjvyKiSwa7Z
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Application/license/MozilaHistoryViewbrowsers.htm

SHA256 6d91011f886f96a454efbc74a75a61700f8506966b5d7d29bc6e090ecb4488ae
MD5 f66e16b413807981865fdf7d40c4c68f
SHA1 407c7a45fe438d7ed3846bc34b21d83051ec26b4
SHA512 7d5be0ddb471bb686ea4920c86107cbf74d6a01b2a1f13ffb564545bc9159873b6beb742436380e063e7945e97fb0d273f0979bb0419c5b8145b1141480125cf
SSDEEP 192:GkBggQON6t58NZ2m42XQpiAS2GjByCZ2ELbJ1u1xoWWiHDAYZuEZ2g8NuhIW6atR:GkWJ4b0xoWWiHDBuGwiM2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/MozillaHistoryView/MozillaHistoryView.chm

SHA256 42c89ce034b38fa2cd30a9031ef79bf7105b0722e9ab4bd5c4ff1dcb9b3ce786
MD5 b63249fbc7cb896d11472fa8de515932
SHA1 d27f95f1bcffb122c4584f9ac5382c284e12d3ac
SHA512 322d447289906c79d061ace5e6463ce032603ed73d4457f50d525326a198f4e72107c02a18c0c50b6ccd96f311b94ea50fa8ef472def9f6179806b7408c99e94
SSDEEP 192:seZpnyxwAaOe86x0ZEZAu4J6qVVuwQhM4Kx:seZNy6AaOdh5uc7Cw2MR
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/MozillaHistoryView/readme.txt

SHA256 dca05cca9e00037671e4fccefeddfa99512e8b7bd19e45d635d38662b33092b8
MD5 4982f452327591d9284ee52d98c1a1a7
SHA1 f92c2018061cfa15abab05ff1aa0aaa78241447b
SHA512 c4cefd766d28ac6dd78202eef1f55c1845ea317cc4f8c1f8273b4b081a56c62fdc5d3a076810f9ac17f3c727cdbd3bad4b60e4378e16fa2a9f5eb1eae6be25d5
SSDEEP 48:AKko9XRQqEzuJzddE9kPvNuU4+n+TRYVdrgPPrBO3URXZhFLfkZTZE+VulDOOoal:AKR9XyWekn3xbrgPzk5ubloashFUr3OC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/OpenSorcePackagesInUse.txt

SHA256 ed34f8c6b4e4048c1f6e02304c9fbf286668659dbdd7bcf9051219bf2afeb543
MD5 3609dcdecfc3fbac95b5e145f3576c4a
SHA1 b2c7b4d74da33e87c04d3beda8ec7628ff5098cb
SHA512 5de198a29ee6704c43ae0e23e005e8aca320607d05812a1e550e31f13971cc8de2d4dde13fc59dca1547968b1697e5854227b2dcd57de820ca261d00eced1671
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/Genieo/Application/license/SQLite Copyright.htm

SHA256 241e9658c3386da53c31761a4d2560ab5d9008819ef5b3fc7d474211a7564646
MD5 72c3e6b369e63215b2ce7e57c5e4bdf6
SHA1 16caafae369f2549323cd982cfb94084be8a5496
SHA512 ac6bf6795e38ba60b3c4030cb6d8d44352b3b0a13b326d9c631aaaf20e52002712a14bfdc1ef37f407a7c2c50d5e9ec4b18dee48c88a6e2a1414108132207a44
SSDEEP 192:sZq3L3/ORLhcS5RLZ3I/9IdJ5o9ZJTesDGuWwx:eEPotdhLO9ZJTesD3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/iehv/iehv.chm

SHA256 6eaca79eabbef97b7f3453c74c59a76823260f46e802d181244cb85f4d62780d
MD5 8edc7fba167e853a60af4367b0737be5
SHA1 5305ef17fe2a3b33293e2143a4755a2d508cd5c4
SHA512 776ffa054d7960d9331262d59340ef65fde14cd8ff58701ffb5cb1730bba369f3d77cd2eba3646cc76d7ed5944666c0319800a46eadd7c2b94c44b2bdeb62dd2
SSDEEP 192:eut9UCLExqGLe4uF/gHUTyKdWF8Vqi4nW7FG:eutuCIssbnHUTy1C0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/iehv/readme.txt

SHA256 cc6a911a2a55318174c215cf14ed70c2fe9d4cb35b2a90d329ac6f9dfa8f720c
MD5 60451e72fd45c96dcf34de383c5bad88
SHA1 3a1a5c1f6c7f792d2ce60608367604992e74b7b2
SHA512 c06c62dce67364155090673f9056a9dd25c606abdfd5a7c4df5a3eed2b9008bd5d82f342ab169da67d818afbc2b72274e3166581c25ad6cb27bf88f550bbf675
SSDEEP 192:QMoDMKXLawhdDDx/xJb47hvHhOXoeg+LvS9PucbJNI+O:QnDMKdT2S+9GcLIz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$APPDATA/Genieo/Application/license/license.html

SHA256 24170bac83d56cdc1203ce955cbf24c10c9877ed8c6dc4756cfd545c365abd31
MD5 501df5a2bfca887ea5c3054af3a17ba6
SHA1 55a0dfcf7b4bcc7dc0fbdd9e7a659364d14f2265
SHA512 bd88ef7b7fe93f5edd268c147296b677d3cf2016bc0505211613adb63aeb290da32ef227ec7af679e5be86691eceaa3c285ff2217d8174db0de9c400c098bfd5
MD5 SHA1 SHA512

NSIS installer

installer

$APPDATA/Genieo/Application/license/oauth-signpost - Project Hosting on Google Code.htm

SHA256 7048ed50e38689d2a1b781a1deeab14922e76cdede86535e67ae04e6e94991ac
MD5 625c268782deae0f66936f6cde95c4ed
SHA1 91c8e1eb0062e1364654368e65d81d5c6898165d
SHA512 d8826e7a176ace5029cc61d0496f7ef8a9cd5219c502f08ac88d325bb00b448af680547aaaf3fe50d2057c22a17d2ab11b1e09f1b7876b80761bb80310331434
SSDEEP 384:7x1ufJepJkxV6I2ZfAiCN0lzQxtNoAhoCYRZ7Yk/a:7bpJkxQI2ZfXCN0mxtAHPsk/a
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Application/license/reallysimplehistory - Project Hosting on Google Code.htm

SHA256 56ab687c4015559bd5287a445ab87fada22e266060cd2fa2d6449927a5e2a700
MD5 9259bd3855bd2493dcc8946b6d57019d
SHA1 5751d45609093e0ac6a512d5a97c11aba6cd8a6e
SHA512 45edac4b55159ab775434c2ad0cb8369b8d1df79d7cb9c5a7cdb27133c1c6afe46155fbb7e87f991424ca77bceaafbf0889fd217ec405d3444c6a015908fef9d
SSDEEP 192:m6rR1POdCarUa4MW77IUFTGYeI9gfVbnCekfMQwF:0dprUa4M00GN9gfVDCBfMQwF
MD5 SHA1 SHA512 SSDEEP

polyglot

NSIS installer

installer

$APPDATA/Genieo/Data/Updater/conf/updater_manifest.xml

SHA256 febb8a07636d1a8889e2598a2c6d4fa5760a97561886c5262e148c8cfeeabf4c
MD5 7db09648fc3b116c0776938d1e1b932c
SHA1 1323ce940a385cd46c2edaa7675b79db09141afb
SHA512 c6411b4e32391b6c50e5bee7264845546d1227d7579544a764d8a3746adade2b595a80f13de1b953c508a6dd645523f06f2dc9c192d82e84a0394d78b33acda7
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/fct.dll

IMPHASH ea6c66dd8fdf3fe3fb04ddbc357acc4c
SHA256 010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29
MD5 e3f3809f51c7982d96aaf9c090f7d176
SHA1 7494daa8000c0b31c58d94edc509232569a4606f
SHA512 3fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc
SSDEEP 48:qlQOVagyAU3gJS+Tgc43uiu7Dh/gdp/gRfykVwv+:qa33gJS+ccQuiuJE/kyku
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

bin/IeSearchProvider.exe

IMPHASH 5aa5e2115acb84d43a302c287efcf624
SHA256 64c2c76ee519eb914801cbdc0a0738bb04ecff8a9c0fab5ff54d529a1dfb5670
MD5 b26556dda849dbf6f2fa2ef9c4e54a8c
SHA1 20cf4b6da4accf855a8bddfaa4326554b6f00c74
SHA512 ac0a8a3ad0c12e3639b26c559d44861215e3c04dfdccff965c90303bb8d53c4f1adde22c0d382b894de76db3804657b20e18b9f19684811ca604f596d16a2d10
SSDEEP 768:ubiJQ5LiEy1wNBdIpc1tEeA/mJerBPPY2trcD0NJwwRfbkKYqL:ubtLiDpc12l4erhYJD0hRf4lE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

df:6d:25:3f:7b:f8:e3:54:fe:b2:11:dc:7a:58:92:69:b7:01:c2:1a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

Apr 23, 2012

Minor OS version

0

Major OS version

5

Entry point

5208

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

K:\projects\AnabelPackage\build\src\IeSearchProvider\Release\IeSearchProvider.pdb

bin/firsttime_setup.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 989ae86605b72a6a0a8ab1a717dd8bc424219269e8791d67d75119a4124374a4
MD5 dcd3312faeed8844d73d70dc0bc48424
SHA1 2a9c9f54db8ab56cd3828e2aa4b5575862600931
SHA512 f87a85987c0dfd0ed35364cadcd8221f83a0f0bf275d0ace267762e0b8623341741ac12ee2351e15c821f3ad45917bb4d38a5caab1fd69df60d65df05127265f
SSDEEP 768:N1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJMToEqnhXs/gL7KYe:bQpQ5EP0ijnRTXJMT1qnhx7le
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ec:5b:4e:14:f0:b8:0e:fb:1b:c5:01:af:0e:a7:65:f8:dd:4f:4e:6a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

Apr 23, 2012

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

uninstall/firsttime_uninstall.exe.nsis

SHA256 5dff76cec9462866fdb1aba636d73e8e443760ae2b0e97c0da99487f072240fa
MD5 4b95b22ae583839052db1ad7fccb4af8
SHA1 3bcb37e808d3defc803a8df16c878aebc0a8fba4
SHA512 6f790bc84519e9c5f92771cc9902a56bd3ae53e2a8e53844d5789f0816cf3c3341363f118be05687ed578e2227db76975001ce5d4bc5ee61afdee0cab0ce5dc6
MD5 SHA1 SHA512

NSIS installer

installer

bin/genupdater.exe

IMPHASH 4a32787cd777e971d1221d3db9bc7980
SHA256 9f4a160ad96e6b2ebc8312a9d7883493bbeb474432565dedc33541f8758812eb
MD5 986cc427326543cb6428895c9d18285f
SHA1 29f9700c639df045b7959aada45654f27a200e1c
SHA512 272d40369d636bb8753afce3336691014f8648601b466a73768f1b66da89b2b0ca23c6bcadd1a4d5e6069432b0a333cbb1e2d37005a08310ede655fa57ec6e4d
SSDEEP 6144:AKoXP+/yLLYXcdwwvGgpiaWsrzxE/Ngba:AXXPsEsXGwngpi/YxE9
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

41:73:15:d9:7d:81:29:8c:b8:c9:ab:5b:f7:27:3f:c6:56:72:2f:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

Apr 23, 2012

Minor OS version

0

Major OS version

5

Entry point

50651

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

K:\projects\AnabelPackage\build\src\Updater\Release\genupdater.pdb

wininet

InternetCloseHandle HttpOpenRequestW HttpQueryInfoW InternetSetOptionW HttpSendRequestW InternetReadFile InternetCrackUrlW InternetQueryDataAvailable InternetConnectW InternetOpenW

iphlpapi

GetAdaptersAddresses

kernel32

CreateDirectoryW DeleteFileW GetFileSize SetFilePointer WriteFile InitializeCriticalSection CopyFileW LeaveCriticalSection CreateFileW FlushFileBuffers EnterCriticalSection GetLocalTime DeleteCriticalSection CloseHandle InterlockedDecrement CreateSemaphoreW WaitForSingleObject ReleaseSemaphore GetPrivateProfileStringW GetTickCount Sleep CreateThread OpenProcess TerminateProcess GetLastError CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcessId GetModuleHandleA GetPrivateProfileIntW GetExitCodeProcess GetTempPathW lstrlenA MultiByteToWideChar WaitForMultipleObjects HeapAlloc HeapFree GetProcessHeap SetLastError WideCharToMultiByte lstrlenW TerminateThread CreateProcessW GetSystemTimeAsFileTime GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId RtlUnwind RaiseException HeapCreate VirtualFree VirtualAlloc HeapReAlloc GetModuleFileNameW ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA ReadFile GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount SetStdHandle LoadLibraryA WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CreateFileA HeapSize

user32

SendMessageW FindWindowW PostMessageW GetLastInputInfo wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegEnumValueA RegQueryInfoKeyA CryptGetHashParam CryptHashData CryptAcquireContextW CryptReleaseContext CryptCreateHash CryptDestroyHash

shell32

ShellExecuteExW ShellExecuteW

ole32

CoCreateGuid StringFromGUID2 CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString VariantClear

shlwapi

SHSetValueA SHRegGetUSValueW StrTrimA SHGetValueW SHSetValueW SHRegGetUSValueA

bin/prepenv_setup.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 264c71cdea66bb3daca3672fce45b1b8cde978395f8759f860be1f636f8f18ee
MD5 61da75f3837f56b4c8a4641e9a34c22b
SHA1 74ab9feab44a3064688ee4734d0a2930d062422c
SHA512 a2df1d258562debe19111066468be0696f72459eb4f3935cfbbeca15097bfceda759ae6eaaf2eed4f7b5148fe45ee501d80d6467ad4082c0909c0128ef5a5871
SSDEEP 768:B1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJOrbbO+gs6EtPmK62hsx43Ih9kUKYt:vQpQ5EP0ijnRTXJOLOxa+K62hDIh97lt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c6:34:a3:7b:08:cd:f9:cd:c8:7e:b9:8c:4b:dd:70:33:2c:16:00:e3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Genieo Innovation LTD,O=Genieo Innovation LTD,L=Herzliah,ST=Israel,C=IL

Chains

Apr 23, 2012

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R2/uninstall/prepenv_uninstall.exe.nsis

SHA256 d2b973efee138df75f93edcfa75fc80a0fbecfa4bf0ac5b21b34cf3c441dfb74
MD5 53ae2ebc0bb5bf0ec761cff6d8d69eb1
SHA1 09285a97634ecdac326ba2f3a252a84c40aee0ad
SHA512 b4f1167ca4e928dd26e5c4cd9ba646df08f03e1a326d61875e4345dc7c876aae90c51024f59a9a066b79c409d6862608fc354c40427e743907234b8bc58daf3d
MD5 SHA1 SHA512

NSIS installer

installer

conf/conf.ini

SHA256 9fa119137767b82d3f79ef819004b9a5288a9f244202cb43a07deb77a17fe260
MD5 08e88b4716a7dc0a6530d85491d19736
SHA1 f56f189e549770ad693a26cac7e4dfa1e628adf9
SHA512 22573165e1a7952bbccc4f3e3df11581bdec3da26f36a253aed3896a1127174b6bc7855086bae191ace660757f69a8ca79ddbbcaf6b242ae4b1fb0155fa8e2f1
MD5 SHA1 SHA512

NSIS installer

installer

uninstall/updater_uninstall.exe.nsis

SHA256 51e8b5f0189ea5fe7ea00d80f11f60ba8e0d4e0c5b8d495b7933c8bdd4945d4e
MD5 f2adb66ead271cc63213e2befd6c5ec9
SHA1 6a308fd9c3af9a0426f5b1937f342d30dda37843
SHA512 3f1b6c9d8b5afa36b6a5b7038b1c444d4cdcca90e3fd32fa8c3052118301868ccca9d0bb8adca2248125966337b3430c3e5c976693bcaf6f1d3b570fc5c938bc
SSDEEP 384:zUvQaDGNXr//jsKCTarAuJ+ceHQ+hb8ya1yfaI/mlG3O/fMrvo9fDC1pURTpjlCI:gQs2ETTvuHejhb8yQW9GGsUrvo9W1pUB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

cdba0935f95f8e97ffadb50d510ace60N.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$APPDATA/Genieo/Application/TrayUi/bin/gentray.exe

PE Signature issue

ws2_32

urlmon

psapi

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

iphlpapi

generic

$APPDATA/Genieo/Application/TrayUi/conf/conf.ini

$APPDATA/Genieo/Application/license/Apache log4j 1.2 - Project License.htm

$APPDATA/Genieo/Application/license/IE HistoryView Freeware Internet Explorer History Viewer.htm

$APPDATA/Genieo/Application/license/JDIC_Plus_index.html

$APPDATA/Genieo/Application/license/JDOM_FAQ.htm

$APPDATA/Genieo/Application/license/JavaMail API Reference Implementation  Project Kenai.htm

$APPDATA/Genieo/Application/license/JavaMail_SMTP.txt

$APPDATA/Genieo/Application/license/Jericho HTML Parser.htm

$APPDATA/Genieo/Application/license/JettyNOTICE.txt

$APPDATA/Genieo/Application/license/Launch4j - Cross-platform Java executable wrapper.htm

$APPDATA/Genieo/Application/license/License - jQuery JavaScript Library.htm

$APPDATA/Genieo/Application/license/LicenseAgreement.txt

$APPDATA/Genieo/Application/license/Licenses.htm

$APPDATA/Genieo/Application/license/MozilaHistoryViewbrowsers.htm

$APPDATA/Genieo/Application/license/MozillaHistoryView/MozillaHistoryView.chm

$APPDATA/Genieo/Application/license/MozillaHistoryView/readme.txt

$APPDATA/Genieo/Application/license/OpenSorcePackagesInUse.txt

$APPDATA/Genieo/Application/license/SQLite Copyright.htm

$APPDATA/Genieo/Application/license/iehv/iehv.chm

$APPDATA/Genieo/Application/license/iehv/readme.txt

$APPDATA/Genieo/Application/license/license.html

$APPDATA/Genieo/Application/license/oauth-signpost - Project Hosting on Google Code.htm

$APPDATA/Genieo/Application/license/reallysimplehistory - Project Hosting on Google Code.htm

$APPDATA/Genieo/Data/Updater/conf/updater_manifest.xml

$PLUGINSDIR/KillProcDLL.dll

kernel32

generic

$PLUGINSDIR/fct.dll

kernel32

user32

generic

bin/IeSearchProvider.exe

PE Signature issue

ole32

shlwapi

kernel32

generic

bin/firsttime_setup.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

uninstall/firsttime_uninstall.exe.nsis