5f50464975e428e6464a57e81c87ae93470a8926ab30b4627066f1dad0df89dcN

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsArray.dll	upx

resource
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/Registry.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsArray.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/utils.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 5f50464975e428e6464a57e81c87ae93470a8926ab30b4627066f1dad0df89dc
MD5 23f5660524689c6b3a457c1e54a8b030
SHA1 806dd60e9665d4bc23528737d13233bb71c1ec09
SHA512 022b12cd70ef2179e19959d634410d0d041872d863329ef65354204c6b82308d706806f83b8606e1cda860623403e2847f6432fadaa9d4bd049ecab00faf05d4
SSDEEP 6144:8e34H2CNhDGwzZLCwlmRxpmd8BUcVCUJ9T/gNTtVx5hYy08G:CJhgFpmd8jVv9DgNTF5eiG
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Descarga Segura LLC,O=Descarga Segura LLC,L=Wilmington,ST=DE,C=US

Serial Number

4e:cb:44:7d:28:4d:e4

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 1, 2013 - Mar 30, 2014

Subject

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Serial Number

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Timespan

Jun 29, 2004 - Jun 29, 2034

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

03:01

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 16, 2006 - Nov 16, 2026

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 d6e429a063adf637f4d19d4e2eb094d9ff27382b21a1f6dccf9284afb5ff8c7f
MD5 55788069d3fa4e1daf80f3339fa86fe2
SHA1 d64e05c1879a92d5a8f9ff2fd2f1a53e1a53ae96
SHA512 d3b1eec76e571b657df444c59c48cad73a58d1a10ff463ce9f3acd07acce17d589c3396ad5bdb94da585da08d422d863ffe1de11f64298329455f6d8ee320616
SSDEEP 96:hrA2+5HGZFYJf9D8IjDflDCoMzncsGSmE:hE2+5mMJfJ8v1zFGSm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Eazel_toolbar.bmp

SHA256 37462e3df09b49d4e9cc7995a101b776db4d25cc66a8dc9d602ff33f1f55bb9a
MD5 df6d9d77bafebed82ff37a0ff8f3f309
SHA1 1aef0870cbc8a5ab8907920f55922313393bb987
SHA512 6e3f60c6808fe3e4d7a039ea8887687618376457bb17dd4e2a276d8243436e751a309059ceef56c22dd036b289cda93c9e666c0ce729ac6391989943b2c958c3
SSDEEP 384:JqsMXC1IIOc/j7WiV5I6P0gHCG29xuWC+FppXgRdstOgtEanGtLV86IPzCXxZxDD:JnxbnW8C6XCGXViHdwFIPzExZxYwGVPC
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_DE.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_EN.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_ES.rtf

SHA256 5eb6766f26d441567f42a956fd93ac0f99fc9e5abf8269240827a8d5ece61c13
MD5 1a266545a4c4d17fe384d1ec4cfa2988
SHA1 cd7fe0f6344e7695102b060e2f7c0e65b2290ab1
SHA512 82f6ddfb7c94f158066f3fe7657ac3bad9cae4f0eedee24954436633780083e84b30d222c1dfab721a967d9a6f3c053d4c6122948c9304701b4d1af2626ee8e8
SSDEEP 192:YfMfBroyGjQxyRPfuf4XxgTeqilSRMXy2:BBr/GthR+d2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_FR.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_IT.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_NL.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/License_PT.rtf

SHA256 0d121347542face1889918432c70ce29e0fed3f53a837c9d03c9a73f49ccc834
MD5 858d50016b5091a71bde743798e4fde9
SHA1 80fe9815569fab908af407db0b0c386ee5fb0499
SHA512 2fa1080a2d667629fe2862075855b6ae1c6b4e592fc2e119f2775fb1ede100cbe9efd5252241b6ee4eddf8925d99e1751f06c0c3f0ad2290f489e0caaac7fce2
SSDEEP 192:YfMZT9jNvNThXsR00Ao2dyTSWOrrgSRfM6+QxFHYidArvNK3pCnLPeWVRX2:X9jxBhXsR00odI1j6Hb8vg3pCLP1VRX2
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/delta_toolbar.bmp

SHA256 23d93cfc8e3390dea892bd98adbbb6bd0b77bf4200b9a06eed0e026a1f0822aa
MD5 e7af5afa3243b4435981d8292b20e4cd
SHA1 6e39669a929c3954808aeee4939bddd00671b4ad
SHA512 ab5ab27c3e49f55a02e132118dd557715e472dbdfda9f4b53bf392c07ab1dfa63e1521286a907539823034d20631e601786d654ec7adb273ebd3940cd4e4c921
SSDEEP 192:PR5njaXZxi34ncRvGiMFvknUmeCrofXPpJSEITis7zn28O8ul:PRVaFc1DMFaSAofXPpJS5+2L2fD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/headerleft.bmp

SHA256 e7e1bc451e96926a69959b0f530caff183a422083c3d82551fe6165951594b98
MD5 6c2a158e07b3f0b4a327ef3d6a8cad78
SHA1 05ead6b58f732b0c3674992b9524bfb1c2e5b397
SHA512 e06e842afd1030d98cfd4cf89f7e1b2377e882a1fb60b9112975b564d18d630e1766cae87b598ab31d8de7f662df390d8194ae21b028e0b869d3a3970fa93c5e
SSDEEP 1536:2/fdWG0PoXQNgfUPaIwpkuLuc+LslHGoiSGOHEUHlKZlRHnLk4PGwEddcAKHv0Fp:KMrffrbNFk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/iminent_non_search_big.bmp

SHA256 84d01ca8de12244781cb8045b2c24662832fdf8aef8727231a863ec944fd8dac
MD5 3c26290719f9ee54d39bb7fcf0cd0530
SHA1 90fd4ce2637ebe89d69bc9f868096e2cd989205a
SHA512 af33c7c9af8edc1dc61a4a80c6bb0a050077abbd6af38a081e3d620978edb40437a7126f9f1d86b6b035dc5243f44785e0032f6ad7f9d77e4d88893b5e3a3e79
SSDEEP 768:B40Hav5jQQXyi/m33fvkqSoukkpuXqEaLgbe666x1gAXh2:+0HYunf8qgwXqfLgzFXw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH bd6ec5720e47defd9ca15646962b5f17
SHA256 6a5060a808d9944286d1b38758674b2e206e0ab6235933c029ea9cac833dadca
MD5 ba2746d730da7f0fcac4866adfef6f51
SHA1 5a72a6a18514bed5fcae00f891f1c540bbd3341f
SHA512 bc518c1c280ab5101ebfd3f0ed5c18bdbedbb0d1840337cb13d2cca329f5e622d498868130187da997d21ce2ea8f664c12a34550788b6b55c1b8c54223c484bc
SSDEEP 768:4WZcbMjnQg12mHxBwmAHoGtGGCr+C3C5iAKonybl06rzJWNJbwpCfqDt4kJ:HZtQg1rHxymMtWJ3J9bK6rz0Nu5t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

HttpSendRequestA HttpSendRequestExA HttpOpenRequestA InternetSetOptionA HttpAddRequestHeadersA HttpEndRequestA FtpOpenFileA InternetSetFilePointer InternetQueryOptionA InternetReadFile InternetConnectA FtpCreateDirectoryA InternetCloseHandle InternetCrackUrlA InternetErrorDlg HttpQueryInfoA InternetGetLastResponseInfoA InternetOpenA InternetWriteFile

comctl32

ord17

kernel32

HeapSize RtlUnwind HeapReAlloc VirtualAlloc InitializeCriticalSection GetLocaleInfoA EnterCriticalSection SetFilePointer lstrlenA SleepEx GlobalFree GetTickCount MulDiv LoadLibraryA lstrcpynA CloseHandle ReadFile WriteFile lstrcatA DeleteFileA CreateThread lstrcpyA CreateFileA GetFileSize GlobalAlloc WaitForSingleObject TerminateThread GetLastError GetModuleHandleA lstrcmpiA GetProcAddress lstrcmpA LeaveCriticalSection GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter VirtualFree HeapCreate HeapDestroy GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount Sleep ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess SetLastError GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree

user32

SendDlgItemMessageA SendMessageA IsWindow GetWindowLongA PostMessageA SetDlgItemTextA DispatchMessageA KillTimer GetDlgItem IsDialogMessageA TranslateMessage RedrawWindow SystemParametersInfoA DestroyWindow GetParent SetWindowPos GetMessageA SetWindowTextA LoadIconA GetWindowTextA UpdateWindow SetTimer ShowWindow EnableWindow GetWindowRect SetWindowLongA wsprintfA MessageBoxA FindWindowExA CreateDialogParamA GetClientRect IsWindowVisible

$PLUGINSDIR/modern-header.bmp

SHA256 5343fe0d7ea90db466f951832f17f5615f00ca1ac58616406ad169f9b70da055
MD5 ab5c08c6663515427547db2864488286
SHA1 37303fc8ac00e84fd65dcc69a42ff00e1d0b1c7e
SHA512 a5dd5d2e17ed24ede319cb97f375f028f42015ef3da24cfe523ab318b71d99c0445e937001fcef1abaee5753fb1de96fafdb082ba9c96800a2ca8f66a83291d2
SSDEEP 384:rw8UtTBNd0FUfirWCUUl+7R/WJkScNBE7y1em:rWPfsWCUUQNZE72
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e7e1bc451e96926a69959b0f530caff183a422083c3d82551fe6165951594b98
MD5 6c2a158e07b3f0b4a327ef3d6a8cad78
SHA1 05ead6b58f732b0c3674992b9524bfb1c2e5b397
SHA512 e06e842afd1030d98cfd4cf89f7e1b2377e882a1fb60b9112975b564d18d630e1766cae87b598ab31d8de7f662df390d8194ae21b028e0b869d3a3970fa93c5e
SSDEEP 1536:2/fdWG0PoXQNgfUPaIwpkuLuc+LslHGoiSGOHEUHlKZlRHnLk4PGwEddcAKHv0Fp:KMrffrbNFk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsArray.dll

SHA256 af19101a9303306e7bb8c3ddb7f1174e43b9b8ef969e78b504545ed6afe42fb7
MD5 7b42ce0bb387ae8a452136da404bf6b0
SHA1 1d9a116d55be1beb0089e392d5ae342e2bffa8a4
SHA512 c50d4a172af361d2978d4204afb712581ffe558950b775e8f0a9fa29e6e8d2076e603fae5417358dceee30c4d4906d8d2dfb4879028818f0f303b8c21f2f6032
SSDEEP 96:WvGBPJ7s2zb0UTh76o11VzD73H5fA7tfXxLfA2i:oix710A7lv/3ixX22i
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

35824

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 d359d01ec25fac88bf36592421d3bc833bb3084785811ea9f5aca6ce6646bf24
MD5 e6451b50acb278862e1d0875c9cb6a37
SHA1 0a5dba7748d069465b3b5ff27b4fa83a02d762e1
SHA512 bca50329ac910c368b35f26b13cb456f975a54cd31febffe860bd9de69d2e57370e55c2294455d494295e05a370bc0af699de87b11891f306fad9298eb7f4cf1
SSDEEP 96:lEHvhxc+F9Qol5g2u7i45o3ZmG9Zpiz5RIC35Ct4kAlJ7igkjDf3GE3FfA7tfXxs:yU+F9t5t739KECst4kPg/E3OxX2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

8374

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/utils.dll

IMPHASH 2695a5acfdb825d3ded9c7c7bba7fb7f
SHA256 eff23a5d372e18b5647ab812e7600eaa84a893ce64f72c96e02592b96f93866b
MD5 ae97029e01393cb7ba395504c49d9fe2
SHA1 247b4e1b4100b8ba426fe8957b9de3f32b1bbaee
SHA512 5bdb06feeeb8ec51a760e804678ed9d67b7622466b40004d6ff4304d6e3e2b5c3dd6a377ce71a025b5658865f826c97069219c0a763ba28ba01d0127949fbc51
SSDEEP 768:mZjOX1HRn5MO7b0u6lv1hssQ55o4bECSq5GatiR:SjOFBE9hrg5olOtiR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6109

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Users\JUANJO\Documents\metainstaller\nsis\myplugin\release\utils.pdb

Sharing

General

Malware Config

Signatures

File Explorer