d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
d39886dc4819d2c2bd7ead8500464ca8_JaffaCakes118
unpack001/$PLUGINSDIR/EBanner.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 ece9aa21823a7917ed872ea70a662677910851f3090af69bcbc983020b794c96
MD5 d39886dc4819d2c2bd7ead8500464ca8
SHA1 d6a3e87c78b7fee60767aea435d62164a2a09c68
SHA512 0f8f47defcf1a4d5d068ea2ed567b547a05e5bc8ecfc9c84c4e742561b1c9b119eecbd77e0ef1d6230a6eb7ed70935870dd6539731d5a3e92489b0ce8ca38c04
SSDEEP 6144:1sgykiIp8NhbeQTsEVRUrjLNWhOncw18dc:tykiIwbhjvUrjpQcwK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/BabylonToolbar.bmp

SHA256 a131d0dac7dcf0a052facc38a09f3c0a253af05a2d11c19148025c9862929a88
MD5 39c781c62e6c77979e84dd77768500dd
SHA1 42e5ca212bf6cc9f9ea5ae372ef99b490a0d44e8
SHA512 1f436cbb371c5689246f5fd06bbf34d4bbda7c9d70c3268e0ef40bf271f5e70c73033cf7874d77537bdf441b66ce84df96b5499a76b10cc2e475cd4d178974a1
SSDEEP 192:A6NWXSrrrt5c/YQ5O8q20aQJ5nbbPTZmEMSTzLmf5MIYRzh:eghTt7rvvX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ConduitToolbar.bmp

SHA256 59fbcaba8ecd995604a5bb3f830bbc2d6688d163645377c92fb72c7dbe9dc11a
MD5 8aac35d5d5ac35176ea94a0ffa2e00b5
SHA1 bdc6a45ce9f023543cfa7e700021e854cf9f9674
SHA512 7977ec9d9a7d82a5a2f0cebaef877975c0528d1f4f89934c7934de7d8bac3cde015575172db1fb3bdbb27bd465821a2bcc59a1a944c21d1137e0067efaa4103d
SSDEEP 192:A6NdFf/zS9WvTil1CUTZtuIpvv6ixMUMjwY1q9yJf02MQHiDk6znewKzIJ25qtHK:fdFjS9WvTil1jzvCDM2WDXwJ5cSAKtZV
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/D1_PriceGong.ini

SHA256 b403643f1ffd2abf74fa1961904fae601abcfe2db46b6f4a9b3a6faf5b262cfe
MD5 3b24d8496fe0031e0bf33f9c95e787ea
SHA1 733996c5df842d3cd00f0e9889a238cbfeb92ce7
SHA512 f64e20456a0f09a98f5d1434230978919d2f4ba1a740a30a7516eae4458b3310aba5ac103e532a0a2a50e7dcf650c3d7cf5cfb654875710b9ea2cbd194f5b6da
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/D1_swim.ini

SHA256 82f539889dc552d358da2cbdd14cb90a5468a06dc978b849254d68e88144d3a0
MD5 3bb4465b07a2cb4fafc022606046897b
SHA1 e845acebc68842b9fad433ae189cfa9319994bc2
SHA512 557ae0eedc20715406657467e1d9641bd0194784e657befa17a8a58b4a50a01dab3eab7e5a0f96fef9a76555cbad9ae1d69a8f77f44ec503925cd84f74e8436f
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/D1_zYONTOO_SWEETIM.ini

SHA256 9b7db65180729b5e24742aa97224dfe868eebb371e571001efbd06b4a13dd0f8
MD5 1de0c01023aca5756f411a6d594e2aa5
SHA1 b9cbeef839ac5b5412801f0623375beed9c4b411
SHA512 cad0e9c05975032cdb2620478803bb24f4fdadc5fbcd7a0872f52c2c1a370fc80503f3cdfbca29efbcd7624ed46564716579405115c826d438d17b3d0a0e85e9
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/EBanner.dll

IMPHASH c759d72719f57a6b126c48a6fe97f6e7
SHA256 dd519ae6d7fd6df0c32db834df215df2fe7c1d044b800922a58da7f4f00b95ab
MD5 cce7bc13dbc3faea7769fcf7727eb19f
SHA1 59633ed1adc02235ca058883534ff36be4fb3f37
SHA512 21e4a8ecd383d59ef24f590367328248d21c7fe452fc5c3a42ec597f920e79caf6a8047babb9fb44d2cca8329dd7d14b39cf13a0934aee409fa5bdd7c2e4f121
SSDEEP 96:9agsHJMYSzHl+I3tFGLafz6Dy/qCWDIH7:9DspmHlv3Lnf0yiCmIH7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5732

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NoBundle.ini

SHA256 bd066d9569f51a554404d90f05291ac988410bc57e054a34beeca23e4f5e2537
MD5 3d38adc374c8604d0c009d2f2964a5a6
SHA1 aad5c6b249f42df94ed647ebe5b70810120e3f58
SHA512 d3cd5b707c1c758f96f038e7605e115d57827c24ac2651e3763f70aa00707976d96de49bb1f40303c635aab2749b6190ee30b575ce99832d56fbf0348c4de999
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Post_red5.ini

SHA256 63720bc104665d9f887dbf573d551711aaebfb37e21dd80cfd9e5effc98a4577
MD5 fb5ea37fe8657ea6924f15f3cf295297
SHA1 29e4b504d2c00f8c2bb57f9554caf9384cef88f6
SHA512 31ff9f90b703207c293850ddc6f753f36e45acf8f72611c847bb769f853f40ffaff800cb3215a45a47a99315b3894b717263d4c429e0c190bdfb82c544f9d7b1
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_BABYLON.ini

SHA256 62b4b9c717ed862c4f563480c41fbd780cfa26634bc21a4f116e688fc3465c76
MD5 fc0ae5ea8daf4272f09c4349af784b38
SHA1 dc5792d71f8d728b895e783f76917d0a59faa27a
SHA512 f864600f7968700e44f321ba11d18abab1d91d5be4528b66341117cd652ac2e6b95cec301235b5e34bdbff0ae5637774c6f27d2b7c8056e782ef821dbd1f23bb
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_BABYLON_quick.ini

SHA256 04e869cc1fea2b32c5ad8f3c0a4c962851239d30674d83bdb6aff5f1bae606ad
MD5 f74a6a7c73fc7a322ad8d8643ea581de
SHA1 427900c3af5fec0b2029c661d2fa6676030dbc39
SHA512 ad7bef6b5c4a2c974be85f52808e71699d4855dd5d7b61c7a634995a8dd7435cd22570fae85887cd48c0d5d86f21192b12fecda6d7da80e5b2dd6e0775421412
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_Conduit.ini

SHA256 f2730ee77d703d2528cd5ead781bf77afe3ee5591140bb0de88f3fb3dea575a4
MD5 1de8c90413a7140962ef7219b6f8b462
SHA1 5487faef041819dec4608aa248b0a401a23de8d8
SHA512 f2b1258bd786edd787d372e2442f8ecb553f921ae017be1939aa0d3cc9d3fc6a93af0a497a81994bd8e1980c4ec8faaf2b42b24f0bd8d3a9fc703e9881f5f253
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_Infospace.ini

SHA256 d9fded9e4332909a2dff31e36b0b8d6b435004e66324a37d213e28b9ae58b0f4
MD5 9f9edf659e8571678f311fdc59b1ddf1
SHA1 0dfc154b3123cf3ce74554898dfc4556534ae757
SHA512 b2d22737e246ac1ed3aef890e395b5712f72cd8d64826d18753953150a300fb92f1b762e7f9b1adcbe4482258a404e3dca3c4021620d1645c47ce9eb2b5a41ea
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_Pricegong.ini

SHA256 29d50e3ec13196381a8977ac0e6e1d9862597fed8dad2e2d903f6e8ca16b9320
MD5 35d5578b5acbb327bfed9e8467e4e176
SHA1 7872d00c93a94dbce540ff428cc82b4980ba5b1e
SHA512 bd951da350283e6f04f45e371231dbac131d47f05a0a7a483930a521c8c8a860b3a28f67cc613f474ee1aa8cebac3ce1269afdd0ea9df0939bb92cbc85999160
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_babl_gong.ini

SHA256 a6f3035adfce37381c85e7cd1d682934015b0be4a2b28b552502dc044447bfc1
MD5 cba5346a70823e2ad6528372d805cf49
SHA1 05b03a6c403305f224955f830fb6708150cbf206
SHA512 1c4c45e5ad277c231d0f750c60ce6aa45719c273a8c6e5471f57b19555be124250724ffb21a802e8579d8c3696ee25eaa63f8ba07af00d27d93eb64f4a10576c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_conr.ini

SHA256 8e574029d5733e73353b72b9d2dd95b2efe925adf8c814a796e0554f92f38e65
MD5 b75c24702d87cd35c7041a7872e1ca32
SHA1 94eb64074994222a0fb25b40e92eba64c274d3a8
SHA512 7fea480018050ae6c52020ff0f72a093cd4b117b8a226f7d6c6cce6109ae93635c567ad8730c64b197d74658956543e2f8a1645e94031bdb3542bc48d83edc82
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_incr.ini

SHA256 2be200589fd1a55c459e512f539cc2a90842a2fc9933fac29728b6864c0ab675
MD5 e3c42c857b1fda90a1b4e308eae17078
SHA1 601f60632c37f7e68859c0eedf95422697f83b08
SHA512 849ca15d1b2a84e86d185638640de3c15b5ac89ef1c7d449d9ef5a9ad34716ee26e13d8228d186b80133dddb2a74900fb06d2fa119dc720360c25cf4a9271dc6
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_mood_dply.ini

SHA256 ed3e232ee7aa561ffcb826db87a9d556791a77657028427a1141ca10d46d8a01
MD5 305eb42394f4a8994214de31ee37671a
SHA1 a898792df31c47f57eeb83d6562f367f8fe86450
SHA512 f54ef219ca08c77d8e40f85560192d576665df9bebef50ae2dac8109e34e3a6e2f887f0428a3b858ff89a2b2cf8949ee7b62873f78803441f64e0b97fcf3b2b6
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_mood_red5.ini

SHA256 32c8a13fc239c8039ecf5b20aafa3e8cf1bb1fb5a2a5aec49d40cde9bfff646a
MD5 498cbb5f53bf1c2866b1e2d00fc15be5
SHA1 ecbe65dc279ea93d8b449d3a5554077d4f18af56
SHA512 aeae891e599d64708453979fcc12ad51cc9d459d7f424289931163cf2d5bef2f7767ad99df6880f2d9e851563a64de886ddf77ca181529dd9257446f14aa4c4e
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_pjoy.ini

SHA256 d4fcb7f71ddce1340d3d44208346902b060d07ef4dd1f84c57b00e97d3798e85
MD5 4199bebcc02b1e810d5bcaf08e6073e6
SHA1 c0ea2c3b2db1ae20ce721432e0decea4e8ddce5e
SHA512 8207f5080c05c9b71a42c692991e23c8bcb775f9dc72a2e5fb4c2752ab695326db1f1834b631c3fb540377a2d50216a2f38f6708d633d5188e5e9ec133e014e2
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_red5.ini

SHA256 3dd3d65c0741852622eb9f4570059d2e1095e5b00eef91c5bdc73d0956889244
MD5 210bd518d23e28fd05371758764ec56d
SHA1 21e8b62670fd6e5e545aeb000e6fab99717b43b4
SHA512 69506e7c33063a9eb79666f6c23baad328fd33fe823d00c1419730da5293c3670ac7d286735ca860acaed54c693e5fb5e559595cc576e3d568e17eefbd194743
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_swim.ini

SHA256 24bed4bf4252c66d5046588bd74900dd8d39d4aed8a0a6624194c48646e8ec34
MD5 b226808a9abb85ebfb8f0f38f05059da
SHA1 b9b3d071c2fead7de584ef6fae43a21433dfe667
SHA512 daa7dfa3c93dc23398fce92b04d27a792441c7af8a8f11f25bc34d6db08f3bc4d5200f417315a7c7d2aeae017f799a2154072dd3ad2d3e2d248af52e1f8e4486
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zYONTOO.ini

SHA256 8216c219877c4299e3ccc0483ac519d25a3fc8ddd900ef9885f5216ef0a395f9
MD5 3ced1836ebee0c942994aafbc43eb39b
SHA1 f890926dfe6f4e1b35e061d072b1330f51d1d4c5
SHA512 3c8987cfd29add5b3e25d83c2f323ad28e0009008c4e683909d2ac566bdb799c8d9fc922b2a83e09e210f90213048967752d6f5128da1ba8792319b4e0bf10ef
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zYONTOO_BABYLON.ini

SHA256 864c9c1e3ebe9440cc201e5ffa251e27abe31ff348e9e954acd513872d0351d3
MD5 58e241b25db92205a8053e4aa4da1203
SHA1 9380de6a36e3d64a252da9ae5cad4f0f9ff88045
SHA512 fdfc5b1e293776f6a34751304943f8930dedaf5e661fff48589c0f7e8462d628d0b30d1d881d2babd69090bfa4eaa8dfa8460bdf167b0d6cd36efb00c8f26bdf
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zYONTOO_SWEETIM.ini

SHA256 a2ac01cf4bddad8e1e91f0d69a68385186aef29afdc305d207a93d72bb5a98e9
MD5 783c3cc6741c3dec1e6a7ee40ebcc2f8
SHA1 100391316354aa52d8e1f11d0ad86d4d07dfd769
SHA512 cddb821efc571c609589a067c19dddac8e0fe0904375bed285e7812266fa7f95b90ce18830fa527bc469af11a37d2b890abc147e15daf6517f0463bcc0aaa057
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zYONTOO_wsmk.ini

SHA256 a02a747727e6197c024bfddcd01efec29befb22320ea7bc303501fa702efbb13
MD5 ce955fb7a917bc7d650607456eb5f589
SHA1 d4da78176f855d5842f4f302cb611106468bdef9
SHA512 208783793c3300637bf0a0aefbac650f505aebabaa6953eddd3253736484f0392acdd5325dc5818f441b18f6e7d071b133f02cbd3be5c5599f060bc67ee4c9bd
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zYONTOO_zBABYLON.ini

SHA256 dad4748fe45ee6571bd104b44c0702e79d8a50082def0a97e7bd701f4162d8fc
MD5 96743804dd81f1fd9a5b49bbd5196fe9
SHA1 b306a23f579e98eddcc48f74402efa06f5f84777
SHA512 52e06431c36c6756a0d78aafe2a5f7ab09b172f7e602caecfea012c9521af3fffa14647dadd6aa302a8efbcf97ba31734e0da678b8d4690254043cba03a8f004
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zswim_red5.ini

SHA256 900b48d75294d40c0c6460ec0b5142e366ac337cdc31d38691d84949da01afc6
MD5 7e9e1e9ab068211a12b18064331b8ec3
SHA1 05b3fb6b45c99e191c4ac636aa9e94fcb2eae3fc
SHA512 b5960727c41030aaba898fe3e5c64206498102ed786446304410552dc39ec69f676e9f8a12e5cfd9125cb0ff6cc42e88b689f0b454d06377e5be671631128151
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Single_zyon_zbab_gong.ini

SHA256 be08b2c1ce0ecd38e5ff9d2e7c82625ee4ff473ce98b5d5f9b89494c62117f36
MD5 c71e6ae9b753456916c3cc79c969bb16
SHA1 8b9311f2e7a6a11e92089d738aabc5053c4e39cb
SHA512 d7b1e2f54d522beaf0d749647b61d3ce641772bd0705b3d51bb585fe80114ffc85114548e379b0b014e64c7d16ea036dec0563efbf534f6421a38f4154a00b7c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/SweetIM60.bmp

SHA256 1c4f3340ca38125ac0de80f8d52000e30970a77d60820154a6d85896fb7e4719
MD5 92afff49f6a0bcefd69d02732ee155b8
SHA1 e81b74c57622a6f1ebb48ca92a38b595726c02f9
SHA512 cfe37902e3213624dc972f9abfa4f8aba4c6120468ea14100e07a9e91a222a604cc41eda0e28458bb771f0fb30d75d28b52f4ba74c89405081229d769911917a
SSDEEP 384:Qj2TZIL0d222fe3ir5C3wDz4cnbT5yenIQ:ZZIL0d222Zc3wnfbNysIQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ToolbarASK.bmp

SHA256 5f142c2ae2e8fa6b7fb5d18dca039b3faf48d7cf06273a8a1a64317a64fa3f14
MD5 466827fe1a8d652a027c96fe611f8063
SHA1 12ad0367865cd3a1d1f393667982910431acf81b
SHA512 d8a65a4a323f805dfa5b76f68fb560b43efa3f4df8c154b9ac73f8ae4915f936042b3cb71cafdde0af085476c8ba8696fd99b40d8af6984041eab7b1e982b94e
SSDEEP 384:Cpaa3lxj0Caz1dr/JIMR5GcA/NCaSQzLOznH0WikLZimoKSPm:CXPj+juMR1yrxzLmnUCimrSPm
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ToolbarImesh.bmp

SHA256 b61bc3d0f2b1abb555eaa84cc061822d399338489344092b21642d130c342d09
MD5 eff20d384064e6fe1a44adb6bec9f7de
SHA1 109053e8fe29320a2fc07ad24688127e3eb79cd9
SHA512 b84a6452c286273b99207050fa695868c0c39937d0d52218d537749467349debb136f62c3bb3d62faf95a7ea3fee9be0e9fba7f56f418d82394fa079c3b40584
SSDEEP 768:hcdAjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjY:Sdp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ToolbarSafeWeber.bmp

SHA256 1510703215a9d6c4781685158ded608ebc433bdee20b937d2293091edf5bd929
MD5 80b9d58882741a7d7ba957505bd7415f
SHA1 d0d3deaf7e262136e8a0b16c5fd4fdfbf24804a1
SHA512 a4cf8f62d5dad7c0207bc3af0f12739fb9347d2c79c970ff8ba1083b51c836cc93da3c16726baf4299ecd83a56777cd21e61f54c4e6743022cf53ef2b24047e2
SSDEEP 384:iA+nSKTJ8TrwJDUMjRrL/LK+M1PLDOAGEFEQ9YVAUUe9aT65ME:iDSKTCTUJDUM9O+G0E3YseHME
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ask.bmp

SHA256 9cfcdb2581317e119435a88701f616881ee648a077f5d3822c63a5cd603b5b07
MD5 3ba431ce49a2b54bef1713f1fe001b42
SHA1 d92774bb0cd0a640f87b1aa4aef429c39c9ffc09
SHA512 fd90d1aacfc0fbebf6b74975e682b610a7c20cb7d9ad7aea5936ff9a457be3da4525a0e9b96fb9c78671247bf273c075152fa69577469c766fc90aaf3df6cccd
SSDEEP 24:Q4cQ70SG5rDpUgRlNkU18qeMNXZUS9BS5Bg0tVJD+SxVkgUYjbUebD9BSUdGS6k2:QK0dr1eq7rQJJUcvJhch8wol5OUE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ask.prev.ini

SHA256 a64069c047fa644119fd260d4e35578dac9fb8065b65be976af399888589a430
MD5 a3dc9320a52df66bb1f45fd35e656876
SHA1 985a2a61560b23521fd9879eec4d66d24d2f6977
SHA512 2690af0a4f10a394a318dff23cdf1c8b933a498a2936760c251fed4e48f1c2aad9b76eaf70f81ab57f0801db94ae53e9f0db4fab46582c1364942e6c22c59229
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ask1.ini

SHA256 5df1a749be2d2fa14947964a47ff008a2b500593c60f9459dc684aaa95b4f83a
MD5 6c13a89cbb10a92bf4759d2124ee953d
SHA1 6b8919c047a498a3822db4a43c20152fbf3edbe8
SHA512 988f5f4ff7637b6b6f7394400abf8c82cb97fc4bb1ec5527c0fe5a646e295cd00d688496e4169cfdc4d3ea9126b16ddbfb78608a8de3318857c7154abb27338f
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bndo.ini

SHA256 7e674320d462cb4a957189241f1c8e3255e9bbbf1c06ed837367f164240551f5
MD5 aaa4d5bb0a424424c718b3be687fe9c8
SHA1 c5e232842ff358b6e6eb47a17e7958f8bf608726
SHA512 53bddf20332c1e2eb8d709f7c8b00220ebfe17c7ebe2917b5535a799595ef97e38b95a96d6e55fd4d302374fa70fbf102816405231dec5e8f034869a50856282
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bndo_v1.ini

SHA256 dbecd0b400168a6825060144f486eb6504a9e1588138e80cec2f82f002b41d8d
MD5 9d2f70eafa98cfd019efdb4900a9058b
SHA1 ec1dfe18775829274859ace03e43e6691974dd5c
SHA512 b9237e48633b7e4b8b2317379673b73c182070fddd0e2388c0317ee9b1bad79d99c0c026f12b44ff6ee8423935afd831ed0c04866264cffeec705df41b5e8356
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/facemoodsToolbar.bmp

SHA256 12cab19c6aa58fe47674375706ef3fd22236b5896c308b71c998976f9578933b
MD5 b48e5955cdc2a57888a2eb0b60fd541c
SHA1 8c4ff0080f69646b5df4e39b8a36e65f17ab59b2
SHA512 820ea156d5d89c04b364bb57a81e128442f3d5aae3dab8a2834c25fbc18c81d0b2883b2633231eecb4c20f7a10ac9193e6fef700eb71e607c93027be71782e6d
SSDEEP 384:jxpbnxVe69Jdyh1jD64PqG3Hh74LWcLoLnOUKVPrUc:FpbxldyhB53OLWLjyVPz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 615bf32e15aaa8d58832df2298f75dd2b29ea5f25bf152c99630315cb618a31a
MD5 7569b23f19a0f5cb4c1d3b30a296c4bb
SHA1 c5f3546b3c795e46445393960694a2341692ddc7
SHA512 11663bf180f9540ad247957b6793f8afd1b4e66f3b692b4ad05735f07459dd524571245928c40e26e3de691472508f5632fcd4add1eebad559d504eca32c08a9
SSDEEP 384:gBCwUYeQ8geEQyhUtXlcgCHe8DSMk8/UhU7ya4Lp0Ac9khYLMkIX0+GvRgbJ1:pwUEpet1cgCHe8DNN/UhUua4L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/infospaceToolbar.bmp

SHA256 da03ab48beed52dc19ec0fcc28ed28e651c1d0c810df3687184fa333f0078d91
MD5 d83ec8bfd1a37865ea4efccdb902fc36
SHA1 98da017770de37e6b4e90dc35ac6afbb46e7c0d9
SHA512 5e60801387c706e56830903795123acebae22f3ddde85707df8951cf62328d9716a15ef45fc73f7607532128f9934716434ba937ebdee1de163643f79e496fba
SSDEEP 768:Jz+++++++++++++++E+G++++Rkj++v+++Kk//+XDFbEnnq38BIwnxk4n5dPPNLoW:NmX5bExZnjdPlL6W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/iwt-install.jpg

SHA256 76fc44808e73bc90e0c4128ef88653dbefacc0029206a6b64792e9a12645e97d
MD5 ada04c889cc5fb6706ed584f1c580804
SHA1 0990f3a30a78ece58334cc588e263ee571ea075d
SHA512 f0a9568bc052ea70f782fab7f67a63747f808b9958a1ed89f726b0f23afc6dc7c9e82bba16d2db2c9709c994294e53b1ad177833357b5dfba28413ef87a882b1
SSDEEP 768:uS+VhDScVhD7KLkMOrwvvfHDpNgCdDatQ5sXXdC5oFx:9+Vh1Vh7uNvfVNldmG5qXgMx
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/safeWeber.ini

SHA256 e158c198c8091c19098c48bb14c57f1acf65ba6103478e414824355e8020aa48
MD5 35087c95cdec38ebb4b6f243f5eee530
SHA1 620b9731659080377459c30fe9a0473875b19ed8
SHA512 7eb0844b6c050f8322eba81060fdb6f29fb8e57343f32b2abfcfa74ce91c921d4261321297c3afcab6bfe4761b8612b6d51e025cdc3fbe095ec26d413801430a
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/win.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer