setup[.]exe | Triage™

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect

resource	yara_rule
sample	upx
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx

resource
unpack001/$1/$_295_
unpack001/$1/$_296_
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/registry.dll
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

setup.exe

SHA256 637563daf92e141673828631def9d98f9732b6b0e2f7c2d7f96eafefc2d7bc9d
MD5 e9d5ed1f6293225fbbb8d862648258d6
SHA1 301c302c67608d713f51d073e764441088c8f343
SHA512 b83e556ef8e804bbf9080a0bd1ae62833f875a8c124c85690721bd33b5272688533009cc917dc2cf68008b22184c5f1c247a4ce19a8430fe36cfdbfa292e0558
SSDEEP 49152:2lXHf2BXHFfIaSX7PFt6lK+xjlGfq2CXJi:2luB1GcF9l8C5
TLSH
T113753367896F2A00DFD1FA3E503040174D7A638AC77F37AEA9597DAB536431309B622C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

7f:6f:2f:f4:4d:75:7a:49:dd:a5:28:fc:ec:ca:b8:14:1d:19:18:2f:6f:c7:b5:8b:7a:96:bd:c9:0d:24:d3:d6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=HRB 5898,CN=MUSIC Tribe Brands DE GmbH,OU=Research and Development,O=MUSIC Tribe Brands DE GmbH,STREET=Otto-Brenner-Str. 4a,L=Willich,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c1a74686f6d61732e7a696e74406d7573696374726962652e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13074b726566656c64,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 28, 2019

SERIALNUMBER=HRB 5898,CN=MUSIC Tribe Brands DE GmbH,OU=Research and Development,O=MUSIC Tribe Brands DE GmbH,STREET=Otto-Brenner-Str. 4a,L=Willich,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c1a74686f6d61732e7a696e74406d7573696374726962652e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13074b726566656c64,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

SERIALNUMBER=HRB 5898,CN=MUSIC Tribe Brands DE GmbH,OU=Research and Development,O=MUSIC Tribe Brands DE GmbH,STREET=Otto-Brenner-Str. 4a,L=Willich,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c1a74686f6d61732e7a696e74406d7573696374726962652e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13074b726566656c64,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Revocation Status

Not revoked

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Serial Number

61:29:15:27:00:00:00:00:00:2a

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=HRB 5898,CN=MUSIC Tribe Brands DE GmbH,OU=Research and Development,O=MUSIC Tribe Brands DE GmbH,STREET=Otto-Brenner-Str. 4a,L=Willich,ST=Nordrhein-Westfalen,C=DE,1.2.840.113549.1.9.1=#0c1a74686f6d61732e7a696e74406d7573696374726962652e636f6d,1.3.6.1.4.1.311.60.2.1.1=#13074b726566656c64,1.3.6.1.4.1.311.60.2.1.2=#13134e6f7264726865696e2d5765737466616c656e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Serial Number

7b:da:e2:ac:9d:a1:0c:ff:90:22:a9:d5

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 26, 2019 - Feb 26, 2022

Subject

CN=GlobalSign TSA for Advanced - G3 - 003-02,O=GMO GlobalSign K.K.,C=JP

Serial Number

50:67:fa:46:ce:6c:fe:95:15:a6:9e:b2

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 14, 2018 - Mar 18, 2029

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Serial Number

04:00:00:00:00:01:31:89:c6:50:04

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 2, 2011 - Mar 29, 2029

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

04:00:00:00:00:01:21:58:53:08:a2

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2009 - Mar 18, 2029

Minor OS version

0

Major OS version

4

Entry point

3439712

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$1/$_295_

IMPHASH b7ea62fa19d324cdf8df34805736d88b
SHA256 dbcad94024177ce8df121a428fb6b9db8d3c992ebee57f01d57f30bdfd2c0b4c
MD5 eb639085a89390b3b1e2b36403bf66c6
SHA1 4b88086d14fcf1c3414f97d34cf9d33789d77305
SHA512 ba631ddda67fd28f5f33956dbd4ad1f3e17be254bb055364bd96c8094ac9a0b17252d08ab3b7568103e38f1a746adad0391a761962ab7eda11a8e07208bec9d4
SSDEEP 3072:CVB1p8bviPnCevsQP1FQ8T11DhCRqaxNkmbUvFAjzJJeN+2ClhlskkzOgjJei0oC:FXDDlvkzFUpocl9s1hPKcQF+8wlg
TLSH
T1D224295A766904F4E4A7C43E8D47C147E2B174191B3197CF2B248B692F23BE4BB7A321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

84592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\wrk\prj\_Thesycon\Misc\DIT\_main\bin\release\x64\DIT_DllWrapper_x64.pdb

kernel32

LoadLibraryA GetLastError GetProcAddress FreeLibrary GetModuleFileNameA GetPrivateProfileStringA WritePrivateProfileStringA OutputDebugStringA GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext EnterCriticalSection LeaveCriticalSection ReadConsoleInputA SetConsoleMode GetConsoleMode GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetTimeZoneInformation GetSystemTimeAsFileTime FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA DeleteFileA MoveFileA RaiseException RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind GetModuleHandleA FlsGetValue FlsSetValue TlsFree FlsFree SetLastError FlsAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage CloseHandle Sleep HeapSize ExitProcess CreateFileA WriteFile FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapSetInformation HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId LCMapStringA MultiByteToWideChar LCMapStringW GetConsoleCP FlushFileBuffers GetFullPathNameA GetCurrentDirectoryA InitializeCriticalSection SetFilePointer GetStringTypeA GetStringTypeW GetLocaleInfoA ReadFile SetStdHandle HeapReAlloc WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile CompareStringA CompareStringW SetEnvironmentVariableA

$1/$_296_

IMPHASH 75d9820850ef89a802b0b81fa31aee35
SHA256 9e0865220f08d7d8f90b3eee58d26408b0e991580610762adf71d1258ed13515
MD5 e47b29307b6f847c93d1d891e3f00c94
SHA1 68e76c09c5e9d167b0868d1a232f77701888602d
SHA512 ee2d1ea90eded687a0c46f0953678fe622d2c98acfcf1a1df8997f89787ecb21b71c3e1567ce0679cedfb08001cd4321a410db947c1a9021145638c3f37768cf
SSDEEP 3072:gx35OO68+95IBYj0UGLglFeAGHVDjme8FpC8mTD6OUyVbze9MBw12nnGuYi7pXCC:gx3oO3+xj8pX8FpD6UykqVSI10w
TLSH
T16B545DC27F5D62F6E98E027486269321467E2A158770F2D3CF490D6D8C2A1C37CBDB5A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

138275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\wrk\prj\_thesycon\misc\dit\_main\bin\releasebasic\win32\DIT_DevInst.pdb

kernel32

DisableThreadLibraryCalls EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection LoadLibraryA GetLastError GetProcAddress FreeLibrary SetLastError FindFirstFileA FindClose FindNextFileA GetFileAttributesA SetFileAttributesA DeleteFileA CreateFileA CloseHandle CopyFileA GetCurrentThreadId GetModuleFileNameA GetPrivateProfileStringA WritePrivateProfileStringA OutputDebugStringA GetModuleHandleA GetCurrentProcess VerSetConditionMask VerifyVersionInfoA GetVersionExA GetSystemDirectoryA ExpandEnvironmentStringsA ReadFile GetFileSizeEx GetTickCount Sleep CompareStringW CompareStringA SetEndOfFile TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree HeapAlloc GetProcessHeap GetTimeZoneInformation GetSystemTimeAsFileTime FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA MoveFileA RaiseException RtlUnwind TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement HeapSize ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetCurrentProcessId GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringA MultiByteToWideChar LCMapStringW GetFullPathNameA GetCurrentDirectoryA WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers HeapReAlloc VirtualAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA SetFilePointer SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableA

user32

ExitWindowsEx

ole32

CLSIDFromString

$1/$_297_

SHA256 1e309f62f9cb9dcf12053ef5f1b0b2e2fad40b7f97656a3ae2dc088a48471ddb
MD5 a6af541830d79c480afe358779f1987c
SHA1 d02ec728a48d9968515b9f5feb7ff7656632a7f0
SHA512 9799df336cc960b74b072d52ab6bcd2c7a6c6eafa064a6dfc81b13b21b2839ffc916381d4be142cd1864b7d54de89797815ece81d47a9bd90a6867a9d3db5e38
TLSH
T122215B902A5635254239E13ACDF810C24FD61FAF5814F275C74CB96D8FA8507733DAAB
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
TLSH
T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
TLSH
T1D7F1A525A3E912ADF1FB4E71ABA3353257353D65AF23E23A1B01014B54716F4DC32B1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 ff00f5f7b8d6ca6a79aebd08f9625a5579affcd09f3a25fdf728a7942527a824
MD5 e54eb27fb5048964e8d1ec7a1f72334b
SHA1 2b76d7aedafd724de96532b00fbc6c7c370e4609
SHA512 c9ddd19484a6218f926295a88f8776aff6c0a98565714290485f9b3b53e7b673724946defed0207064d6ab0b1baa7cb3477952f61dbe22947238d3f5802fa4f4
SSDEEP 96:57GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgN532E:VKgfwgcr8zylsB49Ud0qJVgNQ
TLSH
T10ED1F73D75C33DB3C14ACA762C64292B0BB8C9261B5402109B6706D278D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
TLSH
T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 fd40149db75ce36b1819c09537af59e27b2c6b6f109fad65f5c7064799f54061
MD5 9ce0352d711b37647b45765db923a2a3
SHA1 0aec244be8da2e6957b45cbada7563250326c40e
SHA512 1ade4bebfd343c6385c4b7574784093df8b4a483760a2c5e296067f20416d3d74db0e7f2c0e5a8aa218b3412bdbf8cacdada127f8195290b28a4d27311669072
SSDEEP 768:40gFJMBrbxJQJFiXDYwQ5NTdKqP5sCOfZ7jrG0D33V:4fYBrbzmFizYwUK1G0DnV
TLSH
T1F8F28E46F6D08573E5624632057B773ADFB7831422921A936B6C1FBD7E712D3AE0B202
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

setup.exe

generic

$1/$_295_

kernel32

generic

$1/$_296_

kernel32

user32

ole32

generic

$1/$_297_

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/md5dll.dll

generic

out.upx

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/registry.dll

kernel32

user32

advapi32

generic

out.upx

generic

Sharing

General

Malware Config

Signatures

File Explorer

setup.exe

generic

$1/$_295_

kernel32

generic

$1/$_296_

kernel32

user32

ole32

generic

$1/$_297_

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/md5dll.dll

generic

out.upx

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/registry.dll

kernel32

user32

advapi32

generic

out.upx

generic