JaffaCakes118_5b484cd3c1964834f9158b523a7d1d55

resource	yara_rule
static1/unpack001/$PLUGINSDIR/SelfDel.dll	acprotect

resource	yara_rule
sample	upx
static1/unpack001/$PLUGINSDIR/SelfDel.dll	upx

resource
JaffaCakes118_5b484cd3c1964834f9158b523a7d1d55
unpack001/$PLUGINSDIR/IpConfig.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/SelfDel.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/fct.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

SHA256 118b41f3ca939b3bdecb5c70db87638fa3db033bffba99d521590856c5d3b7ef
MD5 5b484cd3c1964834f9158b523a7d1d55
SHA1 aa4344fc2770124d9c84d2508728a9bf4bdb16ad
SHA512 e6329ad1763e5e05a7a3b2c4b20b7852ec11d9446b917c3121f4dda71c7cf402e8d213bb365422da28aa9547259937c2937cebf6a00c581c74a6fe0c5b501425
SSDEEP 6144:dH1cG75+ZPPfnE2Qyn20UGTyniR1E2OGPT75+ZPPfnE2Qyn20Uc:p1cGF+ZPPfnEUnjTKiUhGrF+ZPPfnEUN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

272400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/IpConfig.dll

IMPHASH a9988f98d52a3c7d16228f87844f85ea
SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
MD5 a3ed6f7ea493b9644125d494fbf9a1e6
SHA1 ebeee67fb0b5b3302c69f47c5e7fca62e1a809d8
SHA512 7099e1bc78ba5727661aa49f75523126563a5ebccdff10cabf868ce5335821118384825f037fbf1408c416c0212aa702a5974bc54d1b63c9d0bcade140f9aae1
SSDEEP 1536:CPDzpyvLtmY7SeAmhPzV8+i7kRuACUxHf91MionF9JTwrLPG5zfO+lP7:UZl1e7L4ARzC3dwrLPG5zG+lP7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

12102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Projects\Visual Studio\NSIS Plugins\IpConfig\Output\Plugins\IpConfig.pdb

kernel32

lstrcpynA InterlockedIncrement InterlockedDecrement GlobalAlloc MultiByteToWideChar GlobalFree lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoA GetLastError lstrlenA WideCharToMultiByte HeapFree GetProcessHeap GetCurrentThreadId GetCommandLineA HeapAlloc RtlUnwind RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError Sleep HeapSize ExitProcess GetCPInfo GetACP GetOEMCP IsValidCodePage SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile GetModuleHandleA InitializeCriticalSectionAndSpinCount LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW

user32

wsprintfA

ole32

CoSetProxyBlanket CoCreateInstance

oleaut32

SafeArrayGetUBound SysFreeString SafeArrayGetElement SysAllocStringLen VariantInit SysAllocStringByteLen VariantCopy VariantClear SafeArrayGetLBound SysStringLen SysAllocString

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SelfDel.dll

SHA256 281c39b733579e031c62bdd247b41543ece1fe3bd6eda26fc8ad474b10f33101
MD5 7cff7fe2caea5184d98c147e7e263132
SHA1 21f39d3d0dd5f7198d67ef30e95d10ae3460093e
SHA512 fb1161b8571d1d0c67e2df0d571b08f5e7a73f81409aed847344154d02406910629181bcce4e18e998ec472f51a6a1b40d956a010abdd10e850413aafa87808a
SSDEEP 48:CzHDh3jgWMynQfXKsJ3eAn67wN4VDm0pmoZSeJY8JTaCILFoyTFS7lWsaEaSueq:S18WMynkXKOOATEVUPnS7s9TShqTM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

30144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 16b76fa1fdb38370620685dca43c8dc868c311a440416e5a99201af8602584f4
MD5 89e19ef4c9e148d9a25abb001b1bd707
SHA1 b344be397b903dfa19c82a19dca3520abd68412e
SHA512 17e04657483700a0d1ce1a588f587a0f17dbf7f07d945c08e88ee64bdc2a0ddded680aca1b009a1fab194bc97551733ae1b248ae7029c2e7a7555b59d189f785
SSDEEP 48:CV/wr5gIkjfqzDcFGb7Gfq815pwsL9ANPJ4ZAyTFS7lWsaEaSu:VgB2z4Wkp5L9ARJ4ZVS7s9TS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4998

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ee75cece63794fa22feebed80a358b16
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetVersionExA lstrcmpiA GetCurrentThreadId GetProcAddress GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA SetForegroundWindow CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog SetWindowLongA LoadImageA GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA DestroyWindow

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation OpenProcessToken FreeSid CloseServiceHandle EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/fct.dll

IMPHASH ea6c66dd8fdf3fe3fb04ddbc357acc4c
SHA256 010f5e0c69b4a630b08b2551e03d8044a33350f151848dcf50953407012fab29
MD5 e3f3809f51c7982d96aaf9c090f7d176
SHA1 7494daa8000c0b31c58d94edc509232569a4606f
SHA512 3fca284e384abc95201dc73f19bd9d75413e8890e819967070b9d9991115be2a8c17e07bd1aaaffcbc770b393bf9a2af253100ac4d9efba8d21110bac97737fc
SSDEEP 48:qlQOVagyAU3gJS+Tgc43uiu7Dh/gdp/gRfykVwv+:qa33gJS+ccQuiuJE/kyku
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5575

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

EasyOn.dll

IMPHASH 699f79c4518c9e55bd0f8a32a044cacc
SHA256 41321b02a4922ab9911e340c190eead9e17d5f56590921953b0658958e1bfba8
MD5 b8d58e3a0587f0015e5ef6e611444f30
SHA1 181d12bc03b329f4ddd4f85f792b2f0a7b9d147a
SHA512 b2e1c3f4ec7e1f468fd8e4d190a17268f2008dfc8e8a68e45b6a109cb98322c5363d49d5aaf8e76cf38c7fc1e813179f776dd90ad6ae55b6b46ddbafe1b56434
SSDEEP 3072:txSwDINkVwQag7NVj1agWgIknPGcnifj56:t4JwzRZPGl
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

65547

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord940 ord1116 ord1176 ord1575 ord1168 ord1577 ord1182 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord6663 ord926 ord4204 ord939 ord924 ord6467 ord1131 ord2725 ord3953 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord541 ord4486 ord6375 ord815 ord4274 ord5710 ord823 ord825 ord2864 ord3870 ord6197 ord2614 ord2764 ord861 ord537 ord1601 ord1232 ord2818 ord533 ord860 ord5683 ord4129 ord858 ord941 ord5194 ord5465 ord6877 ord6282 ord6283 ord6883 ord1997 ord798 ord540 ord539 ord535 ord800 ord801 ord342

msvcrt

??1type_info@@UAE@XZ _CxxThrowException __CxxFrameHandler memcpy _mbscmp memset strcpy _mbsicmp _initterm strlen _purecall free malloc realloc _adjust_fdiv memcmp wcslen ?terminate@@YAXXZ _onexit __dllonexit wcscpy _lrotl sscanf sprintf _except_handler3

kernel32

lstrcatA lstrcpyA LoadLibraryA GetProcAddress HeapDestroy IsDBCSLeadByte lstrcpynA lstrcmpiA GetLastError SizeofResource FreeLibrary WideCharToMultiByte GetModuleHandleA GetShortPathNameA DeleteCriticalSection InitializeCriticalSection GetCurrentProcess FlushInstructionCache lstrcmpA InterlockedDecrement InterlockedIncrement GlobalLock GlobalUnlock EnterCriticalSection LeaveCriticalSection MultiByteToWideChar lstrlenW GlobalAlloc FindResourceA LoadResource LockResource GlobalHandle GlobalFree lstrlenA CreateThread CloseHandle GetModuleFileNameA GetCurrentThreadId LocalFree LocalAlloc LoadLibraryExA

user32

TranslateMessage DispatchMessageA CharNextA wsprintfA CreateWindowExA GetDlgItem DestroyWindow InvalidateRgn InvalidateRect SetCapture ReleaseCapture GetClassNameA GetDC GetDesktopWindow UnhookWindowsHookEx SetWindowsHookExA SendMessageA GetClassInfoA ScreenToClient PtInRect GetWindowRect SetTimer SetWindowLongA SetPropA GetWindowLongA IsWindowVisible IsWindow SetParent ShowWindow MoveWindow GetParent CreateAcceleratorTableA ReleaseDC RedrawWindow SetWindowPos BeginPaint GetClientRect FillRect EndPaint GetFocus IsChild SetFocus GetSysColor GetWindowTextLengthA GetWindowTextA SetWindowTextA RegisterWindowMessageA GetClassInfoExA LoadCursorA RegisterClassExA GetSystemMetrics DefWindowProcA RemovePropA KillTimer GetWindow CallWindowProcA GetPropA CreateDialogIndirectParamA CallNextHookEx

gdi32

SelectObject BitBlt CreateCompatibleDC CreateCompatibleBitmap GetStockObject GetObjectA GetDeviceCaps CreateSolidBrush DeleteObject DeleteDC

advapi32

RegCreateKeyExA RegDeleteValueA RegCloseKey RegOpenKeyExA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegDeleteKeyA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CLSIDFromString CLSIDFromProgID OleUninitialize OleInitialize CreateStreamOnHGlobal StringFromCLSID CoTaskMemFree OleLockRunning

olepro32

ord253

oleaut32

VariantClear VariantInit SysAllocString SysFreeString SysStringLen LoadRegTypeLi DispCallFunc VarUI4FromStr LoadTypeLi RegisterTypeLi SysAllocStringLen

msvcp60

??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

Name

.text

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

EasyOn_D

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

EasyOn.exe

IMPHASH d52f9d9d194587a482c3976b441ddc5b
SHA256 9bf1cea5efcecb3dd7f28c3d6359037807b3379aeb82f154c27e1f84c3286f3a
MD5 e95bc409a64ea9a611bf6df227eb7e3c
SHA1 9388530cf6d248c1c73cee05a2d66c77a1cbcac4
SHA512 a5220d93b3c94d158e33b8d01fa2dc18dbf029ebd70871351b3b1c0fa6225d42e419122ecc0d0a12abecd3d42a90ab87793f239c21c63afcf05d6b2e10bc550e
SSDEEP 384:Evb1cDbSw+uaAMTyX8DfW18WPNc33fxYJLuPkCQuhD:ET1Y2w+lfTuGoHP23P8LuDZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

Serial Number

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Jul 16, 2036

Subject

CN=nbiz Ltd.,OU=Development Department,O=nbiz Ltd.,L=Gangnam-gu,ST=Seoul,C=KR

Serial Number

68:d3:a7:b1:e9:14:d8:85:50:9c:16:51:fe:20:08:d0

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Dec 4, 2010 - Feb 2, 2012

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12188

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord4710 ord2379 ord755 ord470 ord6215 ord6453 ord801 ord4299 ord939 ord535 ord537 ord541 ord858 ord860 ord540 ord941 ord4277 ord4129 ord2764 ord6883 ord4278 ord6663 ord924 ord926 ord6877 ord2614 ord5710 ord2915 ord548 ord5572 ord5683 ord1576 ord2820 ord800 ord4234 ord324 ord3597 ord4425 ord4627 ord5277 ord2124 ord1168 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord4998 ord4853 ord4376 ord5265 ord1134 ord2621 ord2514 ord641 ord815 ord825 ord561 ord3738 ord4424 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord536 ord4673

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit __CxxFrameHandler _setmbcp _mbscmp free malloc _splitpath atol _local_unwind2 _mbsicmp _except_handler3

kernel32

GetTempPathA WinExec GetModuleFileNameA CreateMutexA GetLastError CloseHandle GetModuleHandleA GetStartupInfoA CreateProcessA WriteFile CreateFileA FreeLibrary GetProcAddress LoadLibraryA GetLocalTime

user32

wsprintfA KillTimer IsIconic SendMessageA GetSystemMetrics GetClientRect EnableWindow SetTimer DrawIcon

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyA RegCreateKeyA RegCloseKey

wininet

InternetCanonicalizeUrlA InternetCloseHandle InternetReadFile InternetQueryDataAvailable HttpQueryInfoA InternetOpenUrlA InternetOpenA

Uninstall.exe.nsis

SHA256 24b601f350fe954ea9acf97da2fd351e57b520d591dcbfd4d8c5c9717cd78423
MD5 d552bf5f92a195eb5817ce4adebc8aae
SHA1 1e7d6a34cca321a9d38ad302352ea5473c341ce6
SHA512 4fe59127069ab78d422ceb8f3ffbc0edb42942f037a26c43e2657152efeedae1ee91627681bca69d9a63f88338d54d086f5b7814782534a3f714c189c30a5280
SSDEEP 1536:pafc/+6SBbqfNDP55fnTmmcQKI1taqgHSuUEUja0kqIzjbanyF:G76SB+ZP55fnPcHI1QHSnja05Kj
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 a827b1ffd3b28c2d69612af8c67c361a005587092a8543268d2314b1fdc8f318
MD5 ff7ef394d4910165cb8d91704724a1f4
SHA1 06532b918e823c93e539618409a7c49b94f96d2b
SHA512 4bf74649da97c33e912243c57aa386539177c8cafd8b694cb8a9c1530ddcf01ecccb692a47909acb8fe553a86b6928b562dc65f1eecd73eae63fc8fd8433974a
SSDEEP 768:aHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D39:apgpHzb9dZVX9fHMvG0Dt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer