c35b3b6eaccc5e4912c1555080dc76cb_JaffaCakes118

resource
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/bass.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 c79f2f6cd70358a2df2382bcb191aa6f22ba0d17d547e1e2c4350d0546c9be24
MD5 c35b3b6eaccc5e4912c1555080dc76cb
SHA1 c1a2b32895b0d7ea25927d350e87bc6537d7685e
SHA512 2b1c031915ab714a2bfa8d6e1c6e28fd35ca6650e776ce585d5196261bbb5347994f48009cf39f2cde48dd7cbd2b8baf90d530ec52da5ae51251e422789baf64
SSDEEP 393216:2vxV/QEoCv8ESxOmi6XmaGnPTOna6mefoehwnDBBDO:uV/QEbAX4rOna3myvD
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

0a:99:2b:5d:0b:50:d9:3d:24:c2:26:85:5a:de:03:7a:13:3d:d7:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=iWin\, Inc,OU=SECURE APPLICATION DEVELOPMENT,O=iWin\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 3, 2014

Minor OS version

0

Major OS version

4

Entry point

12472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Dialer.dll

IMPHASH de27b2cda885c04c790bdc36087040a5
SHA256 62f01d82e12633f1aa677a6c8c2e34316ab422d240179d8bac8ce6582f84f6f4
MD5 18adbaf253b4483e59a94be06a9135e9
SHA1 e096e87c93c80077d9726a585e52af2d46fa61ec
SHA512 2ec8ef2486f631e63ab357420535eca64f7d7c369988967fe46adf58a6f12944de385b8002436b1ddc1e88cbc6968c6981caa0bb10168a073644fd9c2ec87f83
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH 3fe69ff2de04834c67a82c79fa52ebe2
SHA256 21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3
MD5 714e0ecd29f9ec555f350f38672726c7
SHA1 555b1492e782d7a30f280f2aecb64c642c1aaad3
SHA512 ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312
SSDEEP 192:qcOqQ13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejiK72dwF7dBKEw:qcW13v5SdHeMRRKkwseji+BV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

GetDlgCtrlID CloseClipboard MapWindowPoints PtInRect DrawTextA GetClientRect SetWindowRgn GetWindowLongA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor LoadCursorA EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem GetSystemMenu GetClipboardData OpenClipboard LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/StartMenu.dll

IMPHASH 17fb6a8708b9c0bb2d5d8687870eb415
SHA256 ca0b34b6d8ea4638f620f250539301164b6a300f679b96e22a0b1f03f5e56440
MD5 28052e87fc73e2aad1db2db35eba62e7
SHA1 72e4c599b45605e36aa5fe7b39caf1eba531328f
SHA512 7759923e6c29a43dedee73ae0540d47b33a2861d6f3c0520deb90d068978494dbf01dde2974413699b2008306dbd753bdefdb5a78d4745d064ad6a5a3163fed2
SSDEEP 96:VgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tK3hhEl7y:VgiqVPgK8K9eIdE9B/tWhg7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 b414ffc98356691456fc6db5ac64ebc97ed50d4197a08b15fccdfc624f2b2e0d
MD5 c59a52b34c2f5859ef833fbec42e9ee9
SHA1 37e1dbdbdaaaebb24cc255d039d0c492137986f5
SHA512 f97522e10b802d562049f2375df22e1af43bb32a11217edd0441ab6bf0b768eb91bdd7fe390eaba3ce3f67eb45da31b62524486a1ced5aefd139cb27f9d8ef28
SSDEEP 384:OvxoyM4HD7xYLjfeb2JLQAsfxqBQPnSL+8muLWhTnbkWBbCiyUEsg4dwh:lynD7gfeb2JkAsfS+nkffL4fkWy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e91ea65af034f7beffd4d21a6a61a903b34b42cbf2bd7d8fb98299f086f5a966
MD5 ece52f6657bb7aa0604a0209f02719af
SHA1 4cdbce6289f5edb983e1ebfb64f09bce6a7bd0c6
SHA512 249e1d889580d355997bcb2b0724d56c5180b3e994fdbeffdc07233f3af5b65f5c5e59be53d92e86a5b3296984cecbfee61c0cc902fdb373c25ed52406be0c70
SSDEEP 768:eQOmB44444444444444444444444q4o4T4H0y44644l4444z444a9cVB8z6nNRZI:eTpcvXuUDpMJwjY92qVDuta/Ug
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 cb82268b778703db75961cddef33a695a674f0dfd28b7e710b198ef2d26d3963
MD5 a5a4cee2eb89d2687c05ef74299f0dba
SHA1 b9bff5987be422887f2f402357b47db2288a1a42
SHA512 f485267c6239f84d294ed4b0a82f317081e6e2e0c5613bd012bbd496b9ebccb8aca6944e80f84af51d17ac13f4d83480c34edfe37a3a9508ce0e67fc9f0b96f0
SSDEEP 384:yck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2xE:yck76gibLCMLDLCx04HNVxE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/pogotall.bmp

SHA256 6b4bb357c52dfaff0a63b470d2bdebdfc4ff8506f5a55cc9c6dba25b5d9f010c
MD5 2c55de7c380ce81dee36e25a1a7e85b7
SHA1 9403f3e7bcae09968c4cb805199b3b943de04a2a
SHA512 ad960f78dc0cb0eb8345230e36ec94ecd3886f007e23f87eadadf77cd69fd694f58b1556b6328e4198d130b19564eb1ba61f77c93ec3d0415e68fcb8475cf8b2
SSDEEP 192:bYK9zrCLISU7jVqOzbOXLRmpL0vs1fcA3b:bYK9zrCrUL3cmpcqb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/pogowide.bmp

SHA256 5a463c94c45bc93616eb9e0502c68221803eb83c88aabbff15ac0bcf907caf33
MD5 ef07dfc73b39553ed15d498939329e50
SHA1 721c503a3533c8fe998005c923489231def2af7b
SHA512 12cf4bcee34a1a25373fdb9cf6e720dbf590aff0a7a9319f25a0e7c7ebc85c8952b62046450b2a85fdcef83fb50d03e5f9e0a42b55818b60262599d08bf1888f
SSDEEP 48:Af1ZdOcZk517jXEVWY25hDmsctocm+VUzwFBT8NXOrLbNDHyxQ5h9:A5ilUVBCi5pVFcXoDSx6r
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

CI3.cfg.static

SHA256 0682506f9633acbeb867a62fbcf20c2cf70851b83077c4ac7ef87b226e9e9fb7
MD5 85323b66cde26820d06c31684359b11b
SHA1 70e4c7bf669a17bfb2cf87cab3a7528dbbddc211
SHA512 1fe513ef72e9d94c4f3ea7e71ed1e9de4eabd195ce4eac6d243805a7228d021fb97a21243cbdc0d552a88f9dc178f55add340387fee423ae09a693ef137da3b4
MD5 SHA1 SHA512

NSIS installer

installer

CI3.dat

SHA256 df43f33691795bcbc0cbcb80901127ac843e7f55e89fea8ac36d3ca8184f7843
MD5 7a7184fc3bc8461a2e1dda07fb4b8fb5
SHA1 17188d4e455d73997643ec01b0ae6f960814ba6a
SHA512 32ad0ca74be6af51e8fc70ed9cb49908102b2e763b2194572dd6c611f5621921f9525a0804f99736cab6b2d01818b293000517b699d0f80c98b021f7ff7d2d5c
SSDEEP 393216:4zQBhWKoUJK/2d95P/r64FoJNZRcdzTcL2na/dLYOnCS4u8+WwuRy:lWKdZd95P/r64Fo3ZRH1LYfSawug
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

CI3.ifn

IMPHASH daf574f3040b477b1ee15e12a0c73af8
SHA256 15c5e0826a4ec78ae00ccff64a3a63e365a6dfb2cd3efa87608e88ab45ec19cb
MD5 7fc7d17fe99e96b403224b6d0363f6e8
SHA1 a892e59ccb3b95ad8e50ab8bcfa9925b92c219fe
SHA512 9c3cfdbb3b93b61d9d38e65c9a1ab1da5bcbe6f428a6eebae53ea70fa1076c5996e9085a231cabe5c5cc1ca366880901f9c1f15a8cb8fcdc5f811f49323ffe8c
SSDEEP 49152:unEwQWnvUTHKW6NUUOnfPd5wydwdqWiK+l4/qB:unEAkKW6CUAfPSdZiK5/Q
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

14:ac:23:3f:0b:68:aa:ca:3e:57:2c:e4:19:09:cf:a1:ca:00:fb:cc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=iWin\, Inc,OU=SECURE APPLICATION DEVELOPMENT,O=iWin\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 3, 2014

Minor OS version

0

Major OS version

4

Entry point

2194254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW SetFilePointer CreateFileA ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA GetPrivateProfileStringA EnterCriticalSection DeleteFileA MoveFileA CreateProcessA GetStartupInfoA GetCommandLineA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP QueryPerformanceCounter HeapDestroy HeapCreate GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle WriteFile IsProcessorFeaturePresent CompareStringW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo LCMapStringW HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime GetStartupInfoW RaiseException RtlUnwind ReadProcessMemory LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA SetEvent CloseHandle GetModuleHandleA WritePrivateProfileStringA GetCommandLineW FormatMessageA LocalFree InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW GetDiskFreeSpaceExW CreateDirectoryW AreFileApisANSI

user32

BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage DispatchMessageA MessageBoxA FreeDDElParam

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Name

.text

Size

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

756KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

132KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

GLWorker.exe

IMPHASH daf574f3040b477b1ee15e12a0c73af8
SHA256 2fd882b6b2204bde9322d770a48e8bfdabc17d879840abee9952876c76591bd8
MD5 cd5c3746a0c9c36e4fa7c60f780b53c3
SHA1 38b818925e8687b3a03a5c04e277bd4c9067136f
SHA512 1094185d4e506f1da33ad437845332f42d5d82e9af06a2620502c5b7d23a25e08df0e7511c5c2b2a17aa7f4344ba48dfbbec70029b2580bf3b6d840bec18b002
SSDEEP 49152:IzroXxa1qMtyV1MtyfJTkbzvTrOnfPd5wydw8p:IzroXxa1qX8RbzLrAfPS8p
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

83:fb:17:ba:46:72:77:0f:9e:42:d9:19:7b:b4:a0:42:56:fa:ab:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=iWin\, Inc,OU=SECURE APPLICATION DEVELOPMENT,O=iWin\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 3, 2014

Minor OS version

0

Major OS version

5

Entry point

555854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualProtectEx GetLastError CreateMutexA ContinueDebugEvent ResumeThread OutputDebugStringA OutputDebugStringW SetThreadContext GetThreadContext WaitForDebugEvent WriteProcessMemory UnmapViewOfFile InitializeCriticalSection FreeConsole CreateThread SuspendThread DebugActiveProcess SetEnvironmentVariableA GetCurrentProcessId MapViewOfFile DuplicateHandle GetCurrentProcess CreateFileMappingA GetVersionExA GetProcAddress LoadLibraryA GetEnvironmentVariableA VirtualProtect VirtualAlloc SetLastError ReleaseMutex WaitForSingleObject OpenMutexA SetErrorMode GetShortPathNameA GetModuleFileNameA GetShortPathNameW GetModuleFileNameW GlobalUnlock GlobalLock GlobalAlloc WideCharToMultiByte IsBadReadPtr GlobalAddAtomA GlobalAddAtomW GlobalFree GlobalGetAtomNameA GlobalDeleteAtom GlobalGetAtomNameW SetFilePointer CreateFileA ExitProcess GetLocalTime MultiByteToWideChar SearchPathA GetTempPathA GetTempPathW GetTempFileNameA GetTempFileNameW GetWindowsDirectoryA GetPrivateProfileStringA EnterCriticalSection DeleteFileA MoveFileA CreateProcessA GetStartupInfoA GetCommandLineA GetCurrentThreadId ReadFile GetFileSize GetProcessHeap FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP HeapReAlloc GetStringTypeW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetTimeZoneInformation LoadLibraryW FreeLibrary SetConsoleCtrlHandler FatalAppExitA IsValidCodePage GetOEMCP GetACP QueryPerformanceCounter HeapDestroy HeapCreate GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW HeapSize GetLocaleInfoW GetStdHandle WriteFile IsProcessorFeaturePresent CompareStringW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCPInfo LCMapStringW HeapAlloc GetDateFormatA GetTimeFormatA GetModuleHandleW HeapFree GetSystemTimeAsFileTime GetStartupInfoW RaiseException RtlUnwind ReadProcessMemory LeaveCriticalSection GetExitCodeProcess GetCurrentThread SetThreadPriority Sleep GetTickCount VirtualQueryEx CreateEventA SetEvent CloseHandle GetModuleHandleA WritePrivateProfileStringA GetCommandLineW FormatMessageA LocalFree InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange DeleteCriticalSection SetEndOfFile SetFilePointerEx CreateFileW FindClose RemoveDirectoryW DeleteFileW DeviceIoControl GetFullPathNameW FindFirstFileW FindNextFileW GetFileAttributesW CreateDirectoryExW CopyFileW GetCurrentDirectoryW SetCurrentDirectoryW GetFileInformationByHandle GetFileAttributesExW GetFileTime SetFileTime MoveFileExW GetDiskFreeSpaceExW CreateDirectoryW AreFileApisANSI

user32

BeginPaint EndPaint KillTimer GetAsyncKeyState DefDlgProcA DrawTextA CreateDialogParamA RegisterClassExA DialogBoxParamA GetWindowTextLengthA GetWindowTextA SetWindowTextA GetDlgItem CreateDialogIndirectParamA ShowWindow UpdateWindow InSendMessage UnpackDDElParam DefWindowProcW DefWindowProcA LoadCursorA RegisterClassW CreateWindowExW RegisterClassA CreateWindowExA GetWindowThreadProcessId SendMessageW PeekMessageA EnumWindows IsWindowUnicode PackDDElParam PostMessageW PostMessageA IsWindow LoadStringA LoadStringW FindWindowA DestroyWindow GetDesktopWindow GetSystemMetrics MoveWindow SendMessageA SetPropA EnumThreadWindows GetPropA WaitForInputIdle SetTimer GetMessageA TranslateMessage DispatchMessageA MessageBoxA FreeDDElParam

gdi32

SelectObject BitBlt DeleteObject CreatePalette CreateDCA SelectPalette RealizePalette CreateDIBitmap DeleteDC CreateCompatibleDC

comdlg32

GetOpenFileNameA GetSaveFileNameA

shell32

SHGetSpecialFolderPathA

Name

.text

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text1

Size

756KB

Virtual Size

768KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.adata

Size

52KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data1

Size

132KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

856KB

Virtual Size

896KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Uninstall.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 0b0b36f894a702ac55405422733ccb22506c68e29848ae7eac9f0a4ce8cc597a
MD5 09028d06b307f49555dffb76dc82c880
SHA1 8f187451912fa4b5e0e3de3406d1d426e48f3fc1
SHA512 505f537225eefd85f94c0807b7452c1df41c32f6d79203a2e9a5cc166385605176a68217808e505389e08fb8a61211728643ab4acea381e06dc23145c257c94f
SSDEEP 1536:zCaIoX1oYOcbTMV88TXJLE/oRdvislP2jLE+Db6FPhjtxQsOk63dcBuX6gSzR/7e:zCaZ2Yrb0VTXJY/oqsl6D0ZWX3we6Z9a
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ef:70:37:8a:2b:58:1a:06:52:e0:3e:72:59:19:3d:c7:0d:1d:5d:a7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=iWin\, Inc,OU=SECURE APPLICATION DEVELOPMENT,O=iWin\, Inc,L=San Francisco,ST=California,C=US

Chains

Jul 3, 2014

Minor OS version

0

Major OS version

4

Entry point

12472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 3fe69ff2de04834c67a82c79fa52ebe2
SHA256 21fea4cf18de8e25d0ffa3375699150fcd04e6d470358696f2dffdd3fc09d7f3
MD5 714e0ecd29f9ec555f350f38672726c7
SHA1 555b1492e782d7a30f280f2aecb64c642c1aaad3
SHA512 ced5814f25b688d1ede5a1395bcca69e1a0cba260104f156dc03de6ebb2015f6d832fed86ac234c36a10a75be33f489a63c8bd6111e3aaf4b078af1d94b00312
SSDEEP 192:qcOqQ13v5z+dHeMR2QwHu5S9i/yULWWBZYJCSJyejiK72dwF7dBKEw:qcW13v5SdHeMRRKkwseji+BV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10703

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

GetDlgCtrlID CloseClipboard MapWindowPoints PtInRect DrawTextA GetClientRect SetWindowRgn GetWindowLongA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor LoadCursorA EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem GetSystemMenu GetClipboardData OpenClipboard LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 b414ffc98356691456fc6db5ac64ebc97ed50d4197a08b15fccdfc624f2b2e0d
MD5 c59a52b34c2f5859ef833fbec42e9ee9
SHA1 37e1dbdbdaaaebb24cc255d039d0c492137986f5
SHA512 f97522e10b802d562049f2375df22e1af43bb32a11217edd0441ab6bf0b768eb91bdd7fe390eaba3ce3f67eb45da31b62524486a1ced5aefd139cb27f9d8ef28
SSDEEP 384:OvxoyM4HD7xYLjfeb2JLQAsfxqBQPnSL+8muLWhTnbkWBbCiyUEsg4dwh:lynD7gfeb2JkAsfS+nkffL4fkWy
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/pogotall.bmp

SHA256 6b4bb357c52dfaff0a63b470d2bdebdfc4ff8506f5a55cc9c6dba25b5d9f010c
MD5 2c55de7c380ce81dee36e25a1a7e85b7
SHA1 9403f3e7bcae09968c4cb805199b3b943de04a2a
SHA512 ad960f78dc0cb0eb8345230e36ec94ecd3886f007e23f87eadadf77cd69fd694f58b1556b6328e4198d130b19564eb1ba61f77c93ec3d0415e68fcb8475cf8b2
SSDEEP 192:bYK9zrCLISU7jVqOzbOXLRmpL0vs1fcA3b:bYK9zrCrUL3cmpcqb
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/pogowide.bmp

SHA256 5a463c94c45bc93616eb9e0502c68221803eb83c88aabbff15ac0bcf907caf33
MD5 ef07dfc73b39553ed15d498939329e50
SHA1 721c503a3533c8fe998005c923489231def2af7b
SHA512 12cf4bcee34a1a25373fdb9cf6e720dbf590aff0a7a9319f25a0e7c7ebc85c8952b62046450b2a85fdcef83fb50d03e5f9e0a42b55818b60262599d08bf1888f
SSDEEP 48:Af1ZdOcZk517jXEVWY25hDmsctocm+VUzwFBT8NXOrLbNDHyxQ5h9:A5ilUVBCi5pVFcXoDSx6r
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

bass.dll

SHA256 fda6a046ccaa6bbb1a5f7c75e9ff7d936aaf841d1fbced495141604dcac081a8
MD5 048e4659465b2f39511cf2e81a7e5a3b
SHA1 f447e872bb8d0878d9a708ff661be523361464dd
SHA512 24cbd4dbe0fb6288611317f91de0c67d4c0012935a61361bdacaac679ed677477a2c7b4a9f3ca050b2b2a92fb188e874bc81b0f18462198ae2817c9df6cf71c2
SSDEEP 1536:DClBV+haFHIrvX3EyeswkxJd342m3OQ3m/FlXZOelGqNYQrEEqpeqsyFkXzLx4l7:et+UForv3ELkNpm3Ok2ZAwGSYsE9peqt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

258102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

BASS_Apply3D BASS_ChannelBytes2Seconds BASS_ChannelGet3DAttributes BASS_ChannelGet3DPosition BASS_ChannelGetAttributes BASS_ChannelGetData BASS_ChannelGetDevice BASS_ChannelGetEAXMix BASS_ChannelGetInfo BASS_ChannelGetLength BASS_ChannelGetLevel BASS_ChannelGetPosition BASS_ChannelGetTags BASS_ChannelIsActive BASS_ChannelIsSliding BASS_ChannelPause BASS_ChannelPlay BASS_ChannelPreBuf BASS_ChannelRemoveDSP BASS_ChannelRemoveFX BASS_ChannelRemoveLink BASS_ChannelRemoveSync BASS_ChannelSeconds2Bytes BASS_ChannelSet3DAttributes BASS_ChannelSet3DPosition BASS_ChannelSetAttributes BASS_ChannelSetDSP BASS_ChannelSetDevice BASS_ChannelSetEAXMix BASS_ChannelSetFX BASS_ChannelSetFlags BASS_ChannelSetLink BASS_ChannelSetPosition BASS_ChannelSetSync BASS_ChannelSlideAttributes BASS_ChannelStop BASS_ErrorGetCode BASS_FXGetParameters BASS_FXSetParameters BASS_Free BASS_Get3DFactors BASS_Get3DPosition BASS_GetCPU BASS_GetConfig BASS_GetDSoundObject BASS_GetDevice BASS_GetDeviceDescription BASS_GetEAXParameters BASS_GetInfo BASS_GetVersion BASS_GetVolume BASS_Init BASS_MusicFree BASS_MusicGetAttribute BASS_MusicGetOrderPosition BASS_MusicGetOrders BASS_MusicLoad BASS_MusicSetAttribute BASS_Pause BASS_PluginFree BASS_PluginGetInfo BASS_PluginLoad BASS_RecordFree BASS_RecordGetDevice BASS_RecordGetDeviceDescription BASS_RecordGetInfo BASS_RecordGetInput BASS_RecordGetInputName BASS_RecordInit BASS_RecordSetDevice BASS_RecordSetInput BASS_RecordStart BASS_SampleCreate BASS_SampleCreateDone BASS_SampleFree BASS_SampleGetChannel BASS_SampleGetChannels BASS_SampleGetInfo BASS_SampleLoad BASS_SampleSetInfo BASS_SampleStop BASS_Set3DFactors BASS_Set3DPosition BASS_SetConfig BASS_SetDevice BASS_SetEAXParameters BASS_SetVolume BASS_Start BASS_Stop BASS_StreamCreate BASS_StreamCreateFile BASS_StreamCreateFileUser BASS_StreamCreateURL BASS_StreamFree BASS_StreamGetFilePosition BASS_Update _

channel.tga

SHA256 a036a93f8eb11d9daec1233c2836fd52f29d65bcd3aaf3e658f6f383fbf3ef59
MD5 e4713012853c3e6ea41ef6edfcc600a0
SHA1 c4a7816a432030c837ed2799c0beddc5fa937c0b
SHA512 ef4f049a42b340af9a262387d8476390d3a535bb5b93591bb5d0a4b032d3deb719c4ede12764e64cde6b538c48803329f6fd3703ecb5e7426b6b23b24853d566
SSDEEP 768:QLRktbNWrOi3/E6N2hioYfqwrVt4CqtY9RqXx3qeJl6hjkPKM:Qgyf3/E6N2cpf7/LqtYWBqeJle6
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

eula.txt

SHA256 391ed1fcdf84034835a06987be959eed8b21107bbae79abeec5fa2ff92a36dad
MD5 d5e7371342227464c4c31d35db3204ac
SHA1 cdc3fb9e4214470a240e96d45ebf1d38dd687e2d
SHA512 299b99e6be6a2a2704a12a74b68530f3ec97eba9bffc522f38d709857c854a584ea0ebdbfa9be028389e38c39bec9c82fe629278e3c6a1704680c0f2ac45c84d
SSDEEP 192:13MBHiCC7mjZkL3I9d2fhNpm2DA0D5oy9Q:13MpiCbjesD25N02ksQ
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

glcfg.date

SHA256 f8149edde6a52c1e41f904cf2ccce6ea4bab82a32f0ac104174874d40b8faf08
MD5 280902d507a5edc2562d74047bd4651c
SHA1 330663f5dbc932d9e60190d93bfa8d7083a5d9db
SHA512 0c12e37ac3e1ccb79babf8065cd0ced1357140b4f81540e24a643827410012c485dbfaa79b7034cf5c9b31622d61a8088fc466245dc4af6744ac58018934335e
MD5 SHA1 SHA512

NSIS installer

installer

iastyle.css

SHA256 98380e15cf706b5e9be77932b9ff189693c5b2355833cc40a53b0a607114553f
MD5 f420ccaa0948b0a4cbc11d55ef6ab869
SHA1 762dcf37d6e39a309d5e99709af7bd9699d7924e
SHA512 522fed257f777c34d62a58fc05de243406b4e6e003bad69bdc3a549565c6ae01cb4c653a2de4a2963484c5b4e2e021282150f601fb11014aab7b798dd6dc50cb
MD5 SHA1 SHA512

NSIS installer

installer

icon.ico

SHA256 3be50b28599b727936911f9ae30bcc48491d2c26690dece58a7394e7a9213a2a
MD5 ce353b9a79fae2f695fbb67acd6bb470
SHA1 b02bc7df8e81e560dd8da2c3667cf0203948986c
SHA512 d945a94af010f2e123bf233a4beeb207b0fc5c2e437639307952aa1cdb887137a7864abe955d3af9274827d914218ff00656762cdfe4bf349d44604e523ec88c
SSDEEP 192:Lj4iXIOTU7rNL/QluApmD4WSj+XGp4BO+wnOP5Y6OgfbuR9LzLZZLQ5Ha2ckK:LjwEkVoluApmDXGEOvnihfbuRxNBDJkK
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/bg-top.gif

SHA256 b3ab458b85fa25b993e032637207f3672becb4422d0e9546e0b5683b7cdea5ac
MD5 81e35dccc0ade7890f2edc4826b323ac
SHA1 ca8ca73edec990ac6a99b60047e37b13e34ced66
SHA512 43290522688ffc4e0c022bdabbbf27bd3eab2b5fed778a2a26d56c6428ebb97023ff07987eba11d9587ad86a71ce77873c1af350786c99283e3e472f19e7f7dd
SSDEEP 192:a4y0VxwO5PM713BC/cRDNUWYoWSdko9aID2a1W:hy0VxXiRCkRhWS3Lia1W
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

images/bg.gif

SHA256 f325fb4ca1be35b37f35f6ed99729896c9e07459ac194ad7407a1fe15821328b
MD5 a2492eb75ebff76ddf750a21046398b5
SHA1 57229b7f08421787a8f1a67382711cfafb173d9a
SHA512 2426e8f57b23d9d8ccfcac097b544f3c728a55c538666ba555fb6e3d1c9d27ced7d51161056b2ff1677341ae0090ec067c00ef71c81e07576da86a333e80cf18
MD5 SHA1 SHA512

NSIS installer

installer

readme.htm

SHA256 8505c9dcfb645ebb69674413fd343ae032b17655b870aa0ec05527fb0725e21e
MD5 5b96088417f22f5e29a2e4085001c336
SHA1 3e65d8e17273abfdde2d03d01d112e0672db4cc0
SHA512 31cf772129525a9a31502715ffdc3b48144a294bb54e092a943de0d6218e31e873687e025572502c518fb733f90747a8967a2d0022f5af3ba166b1d34626c7df
SSDEEP 96:SM7bUxV3bpKQj6ZVcZPBPMDhi7aJr0QDBcjrfB/7fZN+D9oP0Bq+XEZuZSbuJgr:Sz+ZViPBChi7aOZE9oFZZv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

stdat.dat

SHA256 f06659bc856502db9f38342be7b425c7da2691ca07dbc37dc9ee166c1a9843e9
MD5 fd6783fe325a2bbc2b5df4adc688eb2e
SHA1 780b69b4b22ffcf6e1cdc0b2849c07c1cffe4e24
SHA512 84c9c96ca3479a15dad968e351804bcbf3947dc1c654c6b2ae19403a1b45bc8e0a7c0fe576172f00e2c6fce36436f4ecb203584801c0105b6c492feccb6bf6be
MD5 SHA1 SHA512

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer