528b490bc46badb0d1653fe04dfd4877_JaffaCakes118

resource
528b490bc46badb0d1653fe04dfd4877_JaffaCakes118
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/CustomLicense.dll
unpack001/$PLUGINSDIR/GetVersion.dll
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/cpudesc.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/registry.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/IMInstaller.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 792c3d0c1f24a89c24d62fb979926a32ab7ff6a68362682336f7cae4c9001e7d
MD5 528b490bc46badb0d1653fe04dfd4877
SHA1 268c248abed01cbae87567dc593e8fdd1d62fc83
SHA512 c10f1153e9392562f43ceee4f83bf14578b1a620c139f6ee679083093bf35dd73a46a736ec1a13591ded893c514621ef090779d254772eb664beb4beace183fb
SSDEEP 6144:IQq/hEP2kQN6KXsrZ9Y5kygDw2keN1gqO8mxxmNuGjvJiRA:0ELYsrZ3yqPxN1g38mxxzAvJiRA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/BrandingURL.dll

IMPHASH 135de77644e2add2fd9dd8176740e7e0
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomLicense.dll

IMPHASH 0d87660e15e4e2499d63742f6c9630fd
SHA256 bbcab5c7e9f4b3f63184b23995e5b335a1c6ca5108aaa1be0eaf3fbf78afc1c4
MD5 ca37f2747e04ae09ae9f14852574abef
SHA1 e40bf34907337340520f368575c848ddb62f98c5
SHA512 ea781e646313bc458fba0ce66e357818725f385cb6c3383bb9c41dbb5221a6f43e3d8296aa3cbd5e8759d95d87a8eefa5f87665912fbc65c8eb4efcacabfdb60
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4679

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/GetVersion.dll

IMPHASH 5e41893d1528e7648e03f81030aca366
SHA256 7d76c7dd8f7cd5a87e0118dacb434db3971a049501e22a5f4b947154621ab3d4
MD5 5264f7d6d89d1dc04955cfb391798446
SHA1 211d8d3e7c2b2f57f54a11cb8bc4fa536df08acc
SHA512 80d27ee2f87e2822bd5c8c55cc3d1e49beebb86d8557c92b52b7cbea9f27882d80e59eefa25e414eecee268a9a6193b6b50b748de33c778b007cde24ef8bcfb7
SSDEEP 96:E12Z84uiwpGTVTDSpaHYfniz0R3GhCvXY6Ix5vdR7pBi46AQ5Vu4:2STVTGwYhR3GhCvy5vH7pBi46AQ5Vu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4662

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/IMInstaller.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 13d3ffe7288e2c8ee0bb101603282b85588c4e6a0433b86ef53674f6a1dcc17e
MD5 de27cfa64f976f323a85ee33de5b0c6b
SHA1 2dd2d039037662e5a8658243a8c1796acb746d83
SHA512 5d95a58b9ea0d31a1725c73b5368fe3d8092a5e5c24701afbca50765c0721ea5eb674e2dc61e2d9a554ea592896fb8cf3c92f6952ddc9163967bf984cc5d19c1
SSDEEP 1536:SpgpHzb9dZVX9fHMvG0D3XJC/g9rjd1V/DOSUvKIMDe:QgXdZt9P6D3XJRNhDmvKBe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3f:cb:ce:1b:5b:4d:36:6e:68:94:88:3c:c7:77:44:73:ab:e0:08:76

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=COLLABO INTERACTIVE SOLUTIONS PRIVATE LIMITED,O=COLLABO INTERACTIVE SOLUTIONS PRIVATE LIMITED,POSTALCODE=500034,STREET=1ST FLOOR\, 8-2-672\, ROAD NO.13\, BANJARA HILLS,L=HYDERABAD,ST=Andhra Pradesh,C=IN

Chains

Apr 19, 2011

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
MD5 b140459077c7c39be4bef249c2f84535
SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/cpudesc.dll

IMPHASH c6a59b1080c20e84c1c392f75b2d75f4
SHA256 e58e5d1d8da2ea526d0d754b4faad3773021166b0720723efb7b30f1f5075398
MD5 d25102051b33f61c9f7fb564a4556219
SHA1 c683964c11d5175171bd009cb08f87592c923f85
SHA512 8828eec31926251d7e51b5bf1050c3519c9b7fca4f978fb6ee0bf18f9642c3460687f10ff79e5892100ecadbf49725711567c348e1dfccb3644bd9ef992a92f0
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5380

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/fm_license.rtf

SHA256 a5e7ec057431a4866922b12373f39f8e3412e40d6b2f5471e08dc83abdce4a6c
MD5 4a6d1534a2473f9b4655920eceb4f424
SHA1 10bd36482cecfd0ed5a9794bdb2005b8162a8ca7
SHA512 a11606e3714e6552fc62089747ebc9e880932ffe6a49705311efca8b3a671f46c85507aa72a2a0f126558be68dcb22d9d1b672ffe8455fa72fd4838366eaa9de
SSDEEP 1536:Cp6nbg4Mdj7eHJm4ZFIcQtesQ1EJcdTc/FcT:CMnbg4MYr99YQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image.bmp

SHA256 a309127c63458e10e529ace468c7c5498f4a25d010bd6d026983376815fab13d
MD5 605a0ee0d61a03b098a4d892b66258fb
SHA1 3feb0f32cc65c6a5b222eceb163ac6a29a55de52
SHA512 55d27bc91f6dc8233bb5e59cf0e0ccb912d5db346208945db57e8f678f8f6fce31bdefe598c3f6ffa0b12a4162a7df327d96fc543484215334020ee4b0156a41
SSDEEP 192:HurK0jgVkM4I+eMTfp2uPLf2WwkfPijlFEYU:O2X+IuTuuijlWYU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image2.bmp

SHA256 ed25fbdee1e85e8517b460329ce33cfe25c7eb944a6191b7b31c05bb0b0cd350
MD5 bcae7c9348509112e9e8b38c822179c4
SHA1 0515cac7940e20c9abe22ff4b51375eed79f7ee6
SHA512 99f288ad56d95ff051293fc8a1d4594b0eb806003d064bcbb68e26ef25a506719a01eea2d9faa91551e976f39b8245a9bf000f5af8380e9a01a9283d1f83e370
SSDEEP 96:/qStzMd5mipsCpIzrfASgzgxmL6pb417LmoePnckMXlI1CEiFH0i:/dBKO/uQV+eP7MXG1CD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image3.bmp

SHA256 3b46a1e82738b6a064f021cad1c987e4231afc22fa60970c487f1782f932871c
MD5 3f12b10ad141b25a16ef0d9f55b4b845
SHA1 fe9f1a954e9e44a5d2fd1d3022392dce2563efea
SHA512 acbf16ed5d9034e0d7c49b444fb640263e729f368e1d1e359fd44d2af8f147315c9221059299ef039bac4280764b64c90a58dfcb7489e47a785125109f2a760e
SSDEEP 192:/iQhl9/oF9iympbfM4MdFGGpCTORIdDZtdUh7SndgL44/GtcEujtGFS5yxXorYMP:/Vhl9/obJmpbU4MjGG2ORY+h7UNXOdfB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image4.bmp

SHA256 de17f6f306876920a8bf8feacc07fccacf248e4581f81f920d57307e60b353cc
MD5 d88756efdd6c6089bd9b361f3e760832
SHA1 5725b89973390466da6d710ab6a19208f0707f08
SHA512 726e2fee332a1954a638dfe31f3f7d1029421dcc689c5c7e37aef30f2f45ba121101b1730e961cf41f4bf8f77f1d19f5cc685e75abdf028603d9cddd3ac5e28d
SSDEEP 96:HuBVm6unl0t3/qQnJMsUlErp9SRtws0Q6U6xZ/QSNmtXHmh9wTSkChUP:HuHm6uStrzqs9SXE/QSNmhmjwm4
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image5.bmp

SHA256 44473dba7bde9b8e51c34cf44de140533402ca786e4d260031fa233915033cbf
MD5 395390353e1278aac76c7381fafed19a
SHA1 93a132a0525c01e042955af27078e1cf79c7076c
SHA512 7bc346a470282f015a7b6dbb9dfd4449ad2c9eb56db543062699d4ac0556cf7132226cd537b525e55d9fbd14f82d3332a2c03e9d2e0a25b22b80214841261aa0
SSDEEP 1536:OvciZezsiSNMxLBnGkrjAPN7yJpSeOsSL/W3JuZb:OtILwUJpJOsKKe
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image6.bmp

SHA256 8ee9637c53c7cfb0ddc510df6f1c4eb576d2a92c9b491e305d588a2f376533c1
MD5 e2f8e5885b4a14b67f2a70484d18bc0f
SHA1 9498d369aee0182be98327fba0bbb697509b6ef4
SHA512 8922e5deb23962a332de1dfb0a0dfc6f703feabe6ff267aed2a0b6329abd62ba034bf6ba724569c2d87293822e95641e6c7aaaaa43d2c3993906efebd5792147
SSDEEP 1536:vNpScHz/aoeHZzfWLRwljWtSbvQrKpIJfBp590mOc5kjMsXvXMP:HScDMrNiBn+Fs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image7.bmp

SHA256 c3d9a503f78bf187adc7afec71995b36e0e914a70bd9885d81cbbf6a650fc4a1
MD5 6e2c913865ec7fe40f7f787a41362411
SHA1 ba273fcfcdfbcf6240aeca84f132c4d95b9f8de2
SHA512 a2cc700a33ba3f9db22bbca50d8fc2672842157841e28b13a0ee654c024bb9780254ea12d0d5fced951982ff27dae00b6c0851fff449f5bd1081197ea0d1f6f5
SSDEEP 192:/7mBgmGX4ORbcyybX1eDjPZfEXK92Yt+nJDxlfvJBrGvHkTQezjV0afqr7kcWIE3:/7aGBRbOcK69Hixl5tGcTJ3/I0zgfQP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/image8.bmp

SHA256 9218b519b25ac1eeb5198a86bfe14e37fc4b00d0ddd6c4fc2a7bec0c8a00c953
MD5 ef67c585edd9f3a4fbc7d0b7331772af
SHA1 b5270e3f248df6d9bb680d01fe1da4275f8dc0c2
SHA512 ee2e652c126af177bd2fb3ecde1264beb57ccf95027b6a12f0cf105e8c8b00f838ac153928345a83df87819495dce05ab9a5bb9f278f92ebfb5c8e8800a1af61
SSDEEP 192:/bfbl4PkRVfnKdDKB+krfSm5T2fxeZfwvR233zCI:/bjlTRVfk2B+UfSYwJ2GI
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 54317f9e35e039c28fdb421cf518703e
SHA256 45153adf50541316468e2b189a0f8127be9fb29e2f920e7eeaa6aceb438db8c4
MD5 134b93f8bd1f82cd2f1b06c878580703
SHA1 29cdbce7a2caf1f7e4d2a139c42336d490074665
SHA512 f970c38debb6631dab7369e2bc96237f16a8fd328d9d35a2b54cb688e1807f62cc6d63230afe89ce5c3945097ae4466872c72929a9623adde3ee57bddf54b692
SSDEEP 384:EBQCxl9oGPZsw1v6yBIgktbBYeTeXMK5HQ/0lR+Tya4LV0Ac9khYLMkIX0+GBxgU:goGFghBZTeXMK6cVa4L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14357

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strtol _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr _mbschr strlen

kernel32

DeleteFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError CreateFileA GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize

user32

MessageBoxA GetParent ShowWindow SetWindowLongA GetWindowLongA IsWindow SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SetWindowTextA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/license.rtf

SHA256 2fe05b388a51d617fa2fe958df887afc2fe44ff2b610613ad5b3619991fa255c
MD5 de475a7001cf25a3669adb1aa2696678
SHA1 2b5633023e109d728cf113c45aecd85a29423396
SHA512 e8ebc7d7c1566d66d1a70f9180a6f2e0b854dbc77e88332582a0f00c3475a54fc200e4c725a09a664f573ec2b0eb4bae1c449e02ef05ed13a62b633604eb45df
SSDEEP 768:onpT17dYreVOx49XvSMDcpzyA/mw3RgnaCwL9W5PfOyGlgODxyBrbWZQU/JbtH3C:Ibc/H3KtFFuCOWwu
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/ls_license.rtf

SHA256 e19ef1e9204758c4424b9a85fcf1216f32221fbe7938accadf38d373547c400a
MD5 8c9785a3b9234955bc80a02c71fa8a8d
SHA1 0b987d3d68c712eca80a175c197f99de2b8aab9d
SHA512 b80fbcfe67191b7b91f913efbd1b6c04b3ffbb2a57aa90b9ddb22dc130dfc3eb230f20293c1706162f7106d0381ff5e44f9a4e7c9ab5e02a780130ddc328ef54
SSDEEP 768:Fk6Oyj0LBk4oaqVYmfiBkyKWm+1URooIniyCDcpzyA/mwDWLePsrfKY7G5kIniyB:2y0reWrD
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/obes_license.rtf

SHA256 dad3ad31ee341b2f0213e9e006dd49b5a8c5a063a3d1e62df9fdfdc359a971d2
MD5 d5202603b21d9ae63536c5e470e82b5d
SHA1 f34cd7761441afb891af278aa45ae90d8b3a96d2
SHA512 997ed523f1f4f51693ac1e20f91f483bb2c393f7bda7cefc0e8a900ae0130f25d9aeffa97858116c8a999851b7e0128d2a4f091a8759801091f5cc83b394f75d
SSDEEP 768:2H6OygBgg1PALqZab8NJRi/hQZoLLXI1nqT2njX8x3b7G5V5V5h5G5P5N5T5gVVQ:CxwmwCHxHLBwNm/t8tZ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/obfr_license.rtf

SHA256 00616df5290ca0f698f935f8c66975d6082de86bf4d1f650e23e6ea5eb4598dc
MD5 473c155dd98254e5f856fb91168aec88
SHA1 6f2e59babce54278876b858ac6c337557ce63cbf
SHA512 b8f36be11af0a58332b280cbc3d665ac39b804b4281f25c4a90b6a15d5c25f36262cdf6c17faf89a43a486a26850bf27332a9ae0e9642710f6452f85ae03d633
SSDEEP 768:2H6OygBgg1PALqZvDcpzyA/mwhRgnaCwL9W6PfOyGlgOkauIKx49kWUSN4UIRop3:CFuQsb+aFAUk
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/obit_license.rtf

SHA256 4d54f2f00075e56da304055f5f9590dd4d18789cbe8005987cf0e9a46d9ca795
MD5 3a5d0450d0f15c968f4372b2d6730b17
SHA1 031196a88e4bcfdb0c83ee802c2041ed2f2d6872
SHA512 9e5333b8b5d5501da113f4ede50c6111e99b87c82a93cf1e1e10514c838ae5f5ab9e23c7da8eac8799a0d0eff2bdb034485f02465115215b440e0f0408cbb9a8
SSDEEP 768:RH6OygBgg1PALqZvDcpzyA/mwhRgnaCwL9W6PfOyGlgOkauIKx49kWUSN4UIRopS:9FuQsb+a8t4l8IP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/real_license.rtf

SHA256 4d8f8a38bcc254e89ffbcf6660648bcc5e04c9d4aaaadaf980b609d314906d38
MD5 61b8d4d0bc81434641ff0d7466ad00ac
SHA1 fc29bd42422605cc7bb4cbda698128ae424bf024
SHA512 8689666c6f28c53aa3a1d47a79aeaeb882129e1003cb1ea1feee6813a248d8078194b0ca471799e8c1474401416465ae05e571f19ab8fac8f44b0bef6581dd92
SSDEEP 384:Z75UjQjthSD0rPZLamcbae9SaRM49qUydLJVKni5j62:t5UjQjaDAwEmM49qDdLJAif
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/registry.dll

IMPHASH cd53277eaa7bbb8fb5b2b678274dcb4e
SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
MD5 24a7a119e289f1b5b69f3d6cf258db7c
SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ws_license.rtf

SHA256 0dc75fe46713e976efd62dd809b88f054c5b4b1742c4887cf0edda7e526fa0d7
MD5 3ab778973615835d0af851e9da08c5e0
SHA1 bd431ac25f8765313e6dc638dadcbb9066492607
SHA512 e9962139e0d9ecd231534e6f89cc015328ccf7dcea6b5e6025f4d92511594ec08b408b2d5b278f50d299a1dfcd37caeb5274f7c724176eb857fa80f092a8ad07
SSDEEP 1536:9ZWyTOWNwgJxiPcxiVPs9H8r9xoylvCgIxYqd+THsWiA:9ZWyTO3P4wJ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer