17c90249db8bf8b82f39cc97eebc2e55_JaffaCakes118

resource
17c90249db8bf8b82f39cc97eebc2e55_JaffaCakes118
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/ZipDLL.dll
unpack001/$PLUGINSDIR/nsExec.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6a813e0d322e4ea97b129ef599ea339f0dddaf7d85ac62d23eea877e53ae18f6
MD5 17c90249db8bf8b82f39cc97eebc2e55
SHA1 db46bfd8d9ce7e44a7f0355fe8512e5fbb974706
SHA512 f93110c363908da2d754745f8d2614b05229cb44d4b86dc2d26e0afae5f5da64dd57dd26e611dc620acb42a6bd1136e36a32ba05f1fca7bf6d7884c081bd68b3
SSDEEP 24576:S6Nzh36fPbs2wk+y19xV3XZ1/wB9mMj9kYjZrGGBv+zEJSEZS0Gc3xY0gWSjAz7P:PK/FDdV51/w/kQJ+wdZhnjiC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/FindProcDLL.dll

IMPHASH c480ee4d2a64d4a16edee43fdfe35079
SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
MD5 83cd62eab980e3d64c131799608c8371
SHA1 5b57a6842a154997e31fab573c5754b358f5dd1c
SHA512 91cfbcc125600ec341f5571dcf1e4a814cf7673f82cf42f32155bd54791bbf32619f2bb14ae871d7996e9ddecdfcc5db40caa0979d6dfba3e73cfe8e69c163c9
SSDEEP 384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ab0d6b61eda9d1dc039b5837f731d965
SHA256 3555afe95e8bb269240a21520361677b280562b802978fccfb27490c79b9a478
MD5 09caf01bc8d88eeb733abc161acff659
SHA1 b8c2126d641f88628c632dd2259686da3776a6da
SHA512 ef1e8fc4fc8f5609483b2c459d00a47036699dfb70b6be6f10a30c5d2fc66bae174345bffa9a44abd9ca029e609ff834d701ff6a769cca09fe5562365d5010fa
SSDEEP 384:w9JzaeWrF8d22hXAGFkr2WqErkuCYMAWS5Ns8AXXki:wLaBrrTXr3qruCYuS5qk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15015

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA lstrcmpiA GetCurrentThreadId LoadLibraryA FreeLibrary GetProcAddress GetLastError GetExitCodeProcess WaitForSingleObject DuplicateHandle Sleep GetCurrentProcessId CreateThread GetCommandLineA OpenProcess MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle SetLastError GetModuleFileNameA GetPrivateProfileIntA GetPrivateProfileStringA lstrcpynA GetModuleHandleA

user32

SendMessageW DialogBoxParamA CharNextA UnhookWindowsHookEx CallNextHookEx GetClassNameA SetWindowsHookExA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow GetWindowThreadProcessId MessageBoxA SetWindowLongA LoadImageA DestroyWindow GetWindowLongA EnableWindow ShowWindow SetWindowTextA wsprintfA GetDlgItem SendMessageA LoadStringA EndDialog

advapi32

RegCloseKey QueryServiceStatus OpenServiceA CloseServiceHandle OpenSCManagerA OpenProcessToken RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/ZipDLL.dll

IMPHASH f10b94e3705eae25c7617ba56a648b77
SHA256 6bbeb39747f1526752980d4dbec2fe2c7347f3cc983a79c92561b92fe472e7a1
MD5 2dc35ddcabcb2b24919b9afae4ec3091
SHA1 9eeed33c3abc656353a7ebd1c66af38cccadd939
SHA512 0ccac336924f684da1f73db2dd230a0c932c5b4115ae1fa0e708b9db5e39d2a07dc54dac8d95881a42069cbb2c2886e880cdad715deda83c0de38757a0f6a901
SSDEEP 3072:8CkSJJ30k1pn2T4ISnUGN+E8KnCOxA17jxLmRtWHyPDQFllOdJiSg:tkSJy+c30UxbKnA1hLKWSVdk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

62931

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiA GlobalFree lstrcpyA lstrcpynA GlobalAlloc GetLocaleInfoW LoadLibraryA IsBadCodePtr LocalFree FormatMessageA GetLastError MapViewOfFile CreateFileMappingA CloseHandle UnmapViewOfFile GetDiskFreeSpaceA CreateFileA GetCurrentDirectoryA SetFileAttributesA GetFileAttributesA GetDriveTypeA SetVolumeLabelA DeleteFileA MoveFileA CreateDirectoryA EnterCriticalSection Sleep InitializeCriticalSection InterlockedExchange DeleteCriticalSection LeaveCriticalSection InterlockedDecrement InterlockedIncrement WideCharToMultiByte MultiByteToWideChar RtlUnwind GetCommandLineA GetVersion HeapFree HeapReAlloc HeapAlloc RaiseException GetTimeZoneInformation GetSystemTime GetLocalTime SetFileTime LocalFileTimeToFileTime SystemTimeToFileTime SetEnvironmentVariableA SetCurrentDirectoryA GetFileType FlushFileBuffers SetStdHandle ExitProcess LCMapStringA LCMapStringW GetCPInfo CompareStringA CompareStringW GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter SetEndOfFile ReadFile SetFilePointer GetACP GetOEMCP IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetProcAddress GetStringTypeA GetStringTypeW IsBadReadPtr

user32

SendMessageA GetDlgItem SetWindowTextA FindWindowExA OemToCharBuffA CharToOemBuffA

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 a7b2f12e01cbea88d4f645f797f2ca6107d76ae13cd1be6dc532b759bfe0d925
MD5 9e4cd80a60db6947642677bf31a10906
SHA1 feedc432df18b13ffba2b7478347d885861701fa
SHA512 a02ae76b7a5df03a149a0b9c9efd314b8646b829b930233d0cea8b619b21720b383f92be95838310e7f1c4183d256823a96e48866b65ac7d2141ed4254ae471a
SSDEEP 384:0b5ZBhNII36iwq7VzVpaHsA2vxM+5GVTfoeydiszl:2XR360JzVpaHsAI75GRfovcs5
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/pantallatoolbar

SHA256 613ef8761f159f0cbd4b727ebc8f4c76b851a6a5b204b506213a51152f93d525
MD5 185f1505f3206a7a461f51e10d9dbfe2
SHA1 3121b89d7ac4d7a4a02654a5425b0291db3750bd
SHA512 6645ce210fe2751991d9deb0cc4f4a11f46292485135ae160c6d92e6be6fca814bf0e8e6788c6edbf4654256fc8a5cfba31b861f07538c6cb81d5932b6ac0bfe
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/Toolbar_Almeethaq.exe

IMPHASH 616f8a11d0ee76db2bc674f8299827e4
SHA256 bfba0fac599f252652137426f56b095685df45d7b64dcb4d8d8d510b741b3a71
MD5 60f696dcb8f5ac9d8f27ef996d176c61
SHA1 45a53ee8ea05a8db81a905800b024fd4d40d2281
SHA512 01e8bb3b538ebd63dcce3fa9bc54bcdc39b9591203954f70281a6ffa07f543594a1b17622c11167b2827e5c51759db32e56c3d09709d7c0131999e8c6b889e50
SSDEEP 24576:qbs2wk+y19xV3XZ1/wB9mMj9kYjZrGGBv+zEJSEZ/:q/FDdV51/w/kQJ+wdZ/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ac:29:a7:50:99:ed:d1:f9:44:21:38:6f:f8:f1:26:e3:06:d4:10:cd

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Babylon Ltd.,O=Babylon Ltd.,L=Or-Yehuda,ST=Or-Yehuda,C=IL

Chains

Sep 8, 2011

Minor OS version

0

Major OS version

5

Entry point

5204

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Projects\Babylon9\Release_Win32\Setup_Stub.pdb

$TEMP/captura.bmp

SHA256 37a0bdb3623c0a98d051b52fd7fc5c6baf30acfd01fa25a6973d59d93f211e60
MD5 df0dbd4b01ca64b0b3ca83517a923ca1
SHA1 cf1236ba6096629abe3e222027f770f27bbc861e
SHA512 cec172ff7dd7aa1940eda11a3a2ec061ba92f91d0b12e56063e8c532761de3c523320763675dbbc52df58d2afbf14edf1f958a2d6a29757dbfaebe2e616b8e6d
SSDEEP 192:at1UPqsnenPRtLjNT2F912QyHRCJ5UyGohUTXkdG:8nnPRtL5iF912JHQ/UyGo8iG
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer