0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118

resource
0b7419df1a25616cabc2ab48700d3c2b_JaffaCakes118
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc3.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRichEdit.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 1c53ebe661032c1c34d719c239ed452345383f3b252da4315176d160e5dc5d07
MD5 0b7419df1a25616cabc2ab48700d3c2b
SHA1 fe4a962a60e7a151c3ce6868166889c888357d38
SHA512 95c453b70c99b00bbbbfa244cea44bedb160e8a2fa522216e4839a45af4416313f67606ef154b1981038410205deab6741a0dc3241fc7ba4c8f1d9d4807c1dd1
SSDEEP 6144:Lsv7FH1yd7PxUK0AgLiqldTTDhz5R1EgGlhv9PGtgZ:OJmPEDHT91Ejlp9ety
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/1clogo.bmp

SHA256 da7a0f562ab4168b2b17fd7e7903a073b26b6ccf1bd079c3bada8eb1a83eca37
MD5 89b86b7029cc44a4711bf92145a610bb
SHA1 a6334b866f19cca2848d6248afe9cc31af17d950
SHA512 45ad593afea0959e4c374dcd0cbd086b687c2b86569e4fa446da6e43a028dd3a5b9861b7473d8a3190d00ca6a84a5be7e209dc6ecb120d0bb7440dfc6ddebc13
SSDEEP 192:H4NPdUVrjFYUaSkkedw3WliSQBOtPnlyuxdGVkKgaeie/3fffffffffffffffff0:H4NPdUVHRFI3AObxdGVk0M/k
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/FMlic.txt

SHA256 9fb89feba57e8fc01a61eaaf538634b4317d6bbcb0a8d5b203b946a3cb7b8ab4
MD5 c9e21d627f91e5f124364903cbc6ee2a
SHA1 877cebcc698323f266b71189ee45cecc2b582e5a
SHA512 337b8c53114b0a65351943891863108a5c8f9797153abe1d681045380c75bff346d4bfc448ff5ebdce5bee4fca9709cec58cf151873d48f607db9f8c5e175f77
SSDEEP 384:Y/rLAosg2BF7k4ZYAggj79qBQsG3t4DssaQjKISTJpkr4fe4ZCBWMBng5HRH3KIT:tE4KAOMwss8TJGr54EckgZZKIn9t
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/IMlic.txt

SHA256 acb0eae794d493311814e7c7328fbe622c972155bc31890a94ba9349c0678a2a
MD5 f2f85ed648214eb7169fe5b9b7eec007
SHA1 d09ab3e63c87986f8d0ab38a534c1b68041cf04e
SHA512 1600ede7a040348d1d75fbe425c6e104cbfec9501cd111e48d2686c9f8cf1eee4d039aa866503b6079adce38e100630bd24c2b644738664651c1e5eeae510b2e
SSDEEP 384:qlxM/46k1oiSTqYZLRJgYRSA5Gyf+p9cpfEiNaXEenj:xJioZlX5e4pfEiApj
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Yahoo_tb.bmp

SHA256 1456c9c191b53c5aa7be52fa29e3816236947c5e7c8eccd1f9803d36f391915f
MD5 155774ade9cb563281fe5505e5df7e29
SHA1 68c13f043078d1126dab9454dab1d36a725662bc
SHA512 b84fbd3daabbb706e975d3fc2647690794c8ac466d56e48ad9ef5c7fbb89a13d80f17134c8c2d4400bfc1d84ac07e5f3320996b29c165f4c3ee3a579ff63a90d
SSDEEP 192:ar6MZWnLhoUHDE9gJYlvxO+d3xyZt9tXVM:am1PDEuJYlv0sxyVhVM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept.bmp

SHA256 7baca1380f469042514a5fef60dde2361aa47e8bb0fe8e01c1ec175d22c97251
MD5 d2b45ba831902d1f030b7090682cfa1e
SHA1 398c9098d01b3d333ed11971cceb4d685a561814
SHA512 c195b1aeea3b35c111750ab423bbdd4c03ad81701539db77961f079eefce80da013ed1341254d38ea819528ea50e4de5236f2e9d10c4f7d7eb17db65d70919fb
SSDEEP 48:Fg2Cnww2i1SJ4Gw102JLDJ111hZKtZVpPjB8kmM5vfr7GDoxetl3g8uZ:Fg2OD1SW02JHF0tZVpmhM5vDaw84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept1.bmp

SHA256 114c238c17d1cbc30e0d1f30fc5db00f6cfa579d27f755b6494bdcf1687e285b
MD5 cec7eff3bd27fb989b1862b65cf92bef
SHA1 4b61a2778f759e8b6c5c5fff51d0607455528480
SHA512 2bfad999a07d4126a83772af059af66f97a1a3e2156e486309639c0d7efcaed57933faa80f295429eff2cbcd450c4851d191e2f370ebed06fb45a12dd922a1b0
SSDEEP 48:Fg2CsF1wk8ig4C7Q10DGG+D9HG1111jZgHI5PjlimMxrhoDUgt3g8uZ:Fg2l192G0DGB9syH45PMdhwLe84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept2.bmp

SHA256 f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
MD5 f642e8cfce23aa5d124533357de7394b
SHA1 80ce98a2bc4b416db357ea52a74424d742cfaa55
SHA512 d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
SSDEEP 48:Fg2CsFXtwOW3iC4CnE10DGGiGpUDQ1116ZlNCmNdFIz6PjfmMMrhHDaBr3g8uZ:Fg2lXtJz50DGXGUZrUmND3yMShj/84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept3.bmp

SHA256 b77cd138ed85e75c1e68d8c4709db2b4bdee1cac79cd56fde3d10f9c2199ebd9
MD5 f9fb54ee9ebc5ca38459de73f3055784
SHA1 d2e58aef1bbebfdf4265002b12f402fb805d2bce
SHA512 f821a21e77be530db3aa0b80cca0157f39fd905f1546a85ee94b3ba6e28cc91fe186cb43cd8684bb6306b249ece2e07552655b03c11195c854689e308bd38b18
SSDEEP 48:Fg2CdtwWoiI4E10jUDK1116ZuWdFv6PjImMxrCDYV3g8uZ:Fg2ctvy0KrUWDChMd6l84
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/accept_disabled.bmp

SHA256 569192f00ddc6b69100c9b011da239b92a84bdc5e3a28770cec701812e8336ee
MD5 faed4204d8c08024779adf904ed75e12
SHA1 cf26eeeb72173880036134912c756067dbd54da3
SHA512 f9de87ffebcb85923baf558fc10251425a4942d47523ad88981eb23d285ef797c48b23ad8a5a4d6149b7bb1cab546be0f963f1ef2c9e1eb41d0eff0f984ffd0f
SSDEEP 192:FgllG0GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG6:FgllGNpXeBr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/bab_tiny.bmp

SHA256 1456c9c191b53c5aa7be52fa29e3816236947c5e7c8eccd1f9803d36f391915f
MD5 155774ade9cb563281fe5505e5df7e29
SHA1 68c13f043078d1126dab9454dab1d36a725662bc
SHA512 b84fbd3daabbb706e975d3fc2647690794c8ac466d56e48ad9ef5c7fbb89a13d80f17134c8c2d4400bfc1d84ac07e5f3320996b29c165f4c3ee3a579ff63a90d
SSDEEP 192:ar6MZWnLhoUHDE9gJYlvxO+d3xyZt9tXVM:am1PDEuJYlv0sxyVhVM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/back.bmp

SHA256 31a7ec21f242e29ce30a5edb920dcd140965aaa06ea169daec9be8f741db86e8
MD5 9800a9c2062734a6afb798431171e26e
SHA1 5191679a3483f62d90622fdfe75dab82d35771f6
SHA512 778faf0d8271d7314266e16282a540d477db22384b45b55b1cfcaa819ef95bfb7fa36effa8cf49afe8528f1b35c0b86f51b28a9f861b7bc3d923b8b9af12e52c
SSDEEP 384:7SrsXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXe9c:7NXXXXXXXXXXXXXXXXXXXXXXXXXXXXXF
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/back_dis.bmp

SHA256 fd3da2ca9def807d9d99643ee25babe556c3f5627a77157ba46937ca74ea39c6
MD5 ea98cf0fdb2aaf4cfbc687182fa74092
SHA1 51bd833a42fc60bd267c5f7fe973e2f1d07e860f
SHA512 4ea42f4983629b40a0d6d1705354fc8c78be296ab55e603b0a709f5856ec1085642cbd171b4c7e59cc20d11a3ed9fc552c00619866e961ef83306e6c9aab97b2
SSDEEP 384:Fga1zXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXyb:FjzXXXXXXXXXXXXXXXXXXXXXXXXXXXX0
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/box.bmp

SHA256 9313b0a9d2b046699cfaf101e045e85e42e9f6ecf11a7d958927ab0bdb3fde59
MD5 8c2f861625e0f82c79389ee0b5dec960
SHA1 9e00713cce2220f99ce3929f407f66965e4c51a9
SHA512 edcd6007cb34c30f7b13f190a328969ca5feaeee990fd211a2d7e4f36f2e8177230e7f6e01a4bc817527270e432eaf8531904afadb1e0383181d1f1a238e103f
SSDEEP 6:HUndthO36rbo+FwroDRITWb8F8xk/eRITWQbo+Ft:HUnfhY6vo+CrWRuWb8F8xSeRuWWo+3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/box2.bmp

SHA256 74bdef71616b13a054843007cbc84b76080e9596412ca5a8c5296062868215e0
MD5 6dd4027352ebf48f6c8d0e8abd11005b
SHA1 fd50c484dcd5e7ee5658716f658a1ad36edaf926
SHA512 00c39ae80f1b4e59f2c471c1a150e6eb2c4bf47ebcb983b981677b8ee544691c6e8f404ba59baa4bc98ed43130094d8b6cb1a9595c8045146d14ac8db9d8c36e
SSDEEP 48:w6/tcbHfPJCiqWlXQrqDRolwSAQ1V9dbealxnrnxRT+Q79mltzzfTytcm:w6cCOlDuH3/X3rnn+vS
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/box3.bmp

SHA256 184280c8f51472b14b8352b9058456d65f2637c34b04173cff898f7da6c5c5d2
MD5 6fcba5242e2d35ea798f08bb2feea672
SHA1 7d022db1acefd9d7eb4b72ae9f37bf8995121f39
SHA512 d99de8ffac78257e7c527680d4d8fe10fd0176ce33c2eb9262cd781ecbe2310678086eb5e86df8700f47edb9ab2566e2baf02e945975654e92c6b1881bd025b6
SSDEEP 96:w6DBLqELUZCoeWHdvh6KmsjyC5Gq/HM+BOgkdNWY:w6JqELUZCRW9h6KmsGQG0HM+BO/H
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/close.bmp

SHA256 88e80aba7e4829be6be737104ff63a1649dc353743a5e07a4d4f5b9aa00e6918
MD5 79114724e31adb29ff557447751bed14
SHA1 60fd361d27738e9f86a9949cc41d607bfe76b8da
SHA512 a225525a585da2d41262737daf37e60eccd89b70e159d88f04bf5360a8d8d5c2e8f2cb28cc1a333c15fa5df232005f3b4f264b3daf9fc3c748e43daa81bb1c94
SSDEEP 384:FgyyHXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXG:FyXXXXXXXXXXXXXXXXXXXXXXXXXXXXX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/continue.bmp

SHA256 d740fa2635760e8b415a5a1aea038316268eab8a7d0374504654ee201c0f27c3
MD5 4f6971c9739940d66df07ed3328f646f
SHA1 08439065abed69871a35b471f082c6fc8830582d
SHA512 1bdc43dbdfdfe16be9ec9aa330716aadf07c47d956a09ceab2f572ce8f62ab8f94e37f2d55c717cc22d3eb7f17135b1b1314bf01ac0c25a3c533ee398ac7eae5
SSDEEP 384:FgLyEXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXgIXXXXX4:FXEXXXXXXXXXXXXXXXXXXXXXXXXXXXXq
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/continue_dis.bmp

SHA256 ba69ef98533c78c90000e3e5a3f3d8d024cd1b93b564bd0d51ba135e5f8c6038
MD5 f1b813d56a04062a784c954520ca49b7
SHA1 f38b01893b11909d1c26aaaf58b3b79ce9405169
SHA512 af28afa804b10ba46d427e6fe38422007f7fc3430a6965e2837fdbc5120e268d76502c51b0dd43c388db877716af688897755ad9c367685ab584459164014a4e
SSDEEP 384:FgLCgXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXCPXXXXX6:FzgXXXXXXXXXXXXXXXXXXXXXXXXXXXXb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/decline.bmp

SHA256 eab3f8b4cada67892acc64a6233742f1c81d1709e7b5eca06672378a9b54005c
MD5 4e34c7ad18913485c49528203402b4f1
SHA1 5d3229b72f7d8203c6a3e4bd1dc36337589a8be8
SHA512 8fbc89ed67e5a932591f62dfc7a095f9be65c5da5ca037c2b7264d2e5d7137bb6601da527d53c7559afeef85b958ef934e851f3fc42b2a0a8d84ed794f7ece07
SSDEEP 384:Fg7wXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX7X5:FrXXXXXXXXXXXXXXXXXXXXXXXXXXXXXl
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/exit.bmp

SHA256 29a9662fa319e93a07be4092fce50c2dbecd38d871d972417d22dddb7d625462
MD5 89551601eb7b7d93133b03aa46a28f9b
SHA1 b5d39119ee6676906e53235ddac67739d3967eb0
SHA512 024dcf10bdfd7776fcc91cbc4509de6e1a3061ea13f737a4455159e32966b026c6292c51c8cac52b373bb8b74034042f7315518031a719f66e4cf66d8a2a2741
SSDEEP 192:7rZxHv4XXXXXXXXXXXXXXXXXeXXXXXXXXXXXXXeXXXXXXXXXXXXXXXXXXXS:7rkXXXXXXXXXXXXXXXXXeXXXXXXXXXXB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/gen_tb.bmp

SHA256 1456c9c191b53c5aa7be52fa29e3816236947c5e7c8eccd1f9803d36f391915f
MD5 155774ade9cb563281fe5505e5df7e29
SHA1 68c13f043078d1126dab9454dab1d36a725662bc
SHA512 b84fbd3daabbb706e975d3fc2647690794c8ac466d56e48ad9ef5c7fbb89a13d80f17134c8c2d4400bfc1d84ac07e5f3320996b29c165f4c3ee3a579ff63a90d
SSDEEP 192:ar6MZWnLhoUHDE9gJYlvxO+d3xyZt9tXVM:am1PDEuJYlv0sxyVhVM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc3.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
MD5 9d8ce05f532dc7b5742831ec8a63c2d8
SHA1 b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA512 98f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
SSDEEP 384:Aj+e6b0GUi0VV/0BiYkUm4i+Hr4Bc+AmPiMUTMF620Ac9khYLMkIX0+G2CykiDM:Aj+e6byNskUbi+Ly8xMSMj4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

16031

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/next_dis.bmp

SHA256 569192f00ddc6b69100c9b011da239b92a84bdc5e3a28770cec701812e8336ee
MD5 faed4204d8c08024779adf904ed75e12
SHA1 cf26eeeb72173880036134912c756067dbd54da3
SHA512 f9de87ffebcb85923baf558fc10251425a4942d47523ad88981eb23d285ef797c48b23ad8a5a4d6149b7bb1cab546be0f963f1ef2c9e1eb41d0eff0f984ffd0f
SSDEEP 192:FgllG0GGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGG6:FgllGNpXeBr
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRichEdit.dll

IMPHASH 8c822ac3e4d332dd16e1002a92e3c264
SHA256 48b006c850221f013d2ca5b464c9e9dc3e56ee62b0cb6e1e2dcb56ae4e1edc8a
MD5 11ffcbcf1d3eada2e342558858b29779
SHA1 8ecd443d2800aa0900a720288ec87223df7042e9
SHA512 891b65613643a9e8b00768888b1754a10c596e7bb866a1e786d893f32d60711ba627b83af8556a7d065b8d92748e5ed724726a596aa5670bce37ff7975b2c330
SSDEEP 96:daXX5j7uelHp9JDm5YjDfj2NTA2NeeRp8lZBu7OhB7lkZ3hBWhyK/7fc5:q5fPlHM5zyZkZXQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

6816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\work\CM\NsRichEdit\Plugins\nsRichEdit.pdb

$PLUGINSDIR/popwarning.bmp

SHA256 b4adfa698527b673e42d53f4f16ca41564f8628c757930958d25506b2f7ec912
MD5 43f9a98e6a7d158c4870e08846861641
SHA1 5c8624694db42dc548ed074c702ed55e605a5b12
SHA512 77939a700b5f9024247a3688b83f485ccb1ff98599c10005fa418155ee5bd99d304bd8e7e64d26d23e7b43c29e4f1c45095c03613ca128838ca416de19e714ab
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/popwindow.bmp

SHA256 6d15a9f9aff9c4cfdf76d0d4b6988b2288c2ae4970502f06410c56d7c2e6c7d8
MD5 c03ef13824452482149544b5f151b3ab
SHA1 7352205d89c5b16294a96f6a12f3c3940eab10ab
SHA512 99ff308afc8b3825e2342ad780a9f24eb68d9156e1e9911fad7d09825298bad628ea9d58ab947aa48462bf1b81c8e64b6ddf6b8b2ded4c78b75f3d7629240652
SSDEEP 96:NJMaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa6:NJUC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/popwindow_close.bmp

SHA256 3426b2ad8e22c752abc37194cbd3e91c1a7690838cdbb934f7ec6741397fd7e3
MD5 c37952f7c4d0c9f1babf160ce9c1a70c
SHA1 7e42c9f17af5eb5defe38d8f27c40b67fdc6dd81
SHA512 7f9680b1377547b5348526eab2098da99ecfbbf11557afdbc928c1ae4105f39e13be32c685634dd872d27c74af53f1d4549266f542692ad2efefde711194001c
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/skip.bmp

SHA256 a4acb445bdc94b951334ed467a3d165446457487f70877f7554e1d8e7afdef58
MD5 f2f64c5809be74da2dfe6e0eea5a4242
SHA1 6ec394130b6ef5fa5945c629f1aa157cdbde9814
SHA512 7769c5fafb26b07d22227c6d9d5e12082d2a0f94584c174f9cf41165bcabb2c061557544fa14e421433f3cac8b0ef9a5aa2b797ddbdf5a12660e89c40e3ad72e
SSDEEP 384:Fgye5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXA:Fw5XXXXXXXXXXXXXXXXXXXXXXXXXXXXA
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/v_sign.bmp

SHA256 b371a34ff2eee757b4b201303c175cc7c67d0a1ae940cd9ffdc399ce6260911a
MD5 d988221412cc88fb7837b949bd4f3ee0
SHA1 eff16cfeadddcbd651f1e891007d1decb813d22a
SHA512 56b32a1bc7875e490754f57eabf81433286926e89e8c311b62911b64d81ee406a646266d927902ff3ee14e09071f780c90679438754bee618408d832b5f14928
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/x.bmp

SHA256 1ff50d42ad12bc928f38ed8c4c9cbeb22bac386e68f54bec61d6a6b7904b71b5
MD5 80730d8d5b1c7d04b9b2da32f778a229
SHA1 535c3f57cf9fd1e53c7bd523fa41b5628fd5a5d3
SHA512 5f6d180e2e67c6529ed6891575be725adcaa51b32a6c2f8e00f87a88a77ed5616d2c9c2bc2c842bba0c4217759064469fafdb4f9b5db1d81d28c29e298285536
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer