Rewind_0[.]1[.]4_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Rewind_0.1.4_x64-setup.exe
Size 5.9MB
Sample260705-138xesbx9l
SHA256 af5a199fbd87f162ff5aa50632cc6357185cb991e146d8e7b50cf9a7d64b4b73
MD5 500324fdb585fb840dad4a0ef6137124
SHA1 962b16717cc3f54ff328f6fa9c74ce1dd5bdf10f
SHA512 290429fdc327d3ba878b826140594f2751e346d7b4dca21644139dd2a0aefe79b82ee72d2ec59353c1bfaffba481a203cddad999696a480416f1fee5ff905cbf
SSDEEP 98304:n5sGlgg1gRUEVa2TYfXNpFnZyBdOAagGoftwtixKFtmblG/LmokffiHUG5l:n5HEUEQ2MfXLFnc/J7pftwEKYlGa5i9l
TLSH
T1905633089F496EF9DA115D7757BF0AE6CE8D24B2D331068BFF813649523C7640878B8A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
Rewind_0.1.4_x64-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/Rewind.exe
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

Rewind_0.1.4_x64-setup.exe

.exe 5.9MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB
Rewind.exe

.exe 21.2MB
uninstall.exe

.exe 75KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 30KB

Rewind_0.1.4_x64-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 af5a199fbd87f162ff5aa50632cc6357185cb991e146d8e7b50cf9a7d64b4b73
MD5 500324fdb585fb840dad4a0ef6137124
SHA1 962b16717cc3f54ff328f6fa9c74ce1dd5bdf10f
SHA512 290429fdc327d3ba878b826140594f2751e346d7b4dca21644139dd2a0aefe79b82ee72d2ec59353c1bfaffba481a203cddad999696a480416f1fee5ff905cbf
SSDEEP 98304:n5sGlgg1gRUEVa2TYfXNpFnZyBdOAagGoftwtixKFtmblG/LmokffiHUG5l:n5HEUEQ2MfXLFnc/J7pftwEKYlGa5i9l
TLSH
T1905633089F496EF9DA115D7757BF0AE6CE8D24B2D331068BFF813649523C7640878B8A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Rewind.exe

IMPHASH fdd9d27b5faf8980080e93fb5ced3287
SHA256 16cbf6bd2691d035e3fa604b803a4412079db627c693aff8f8ae6abbe325a751
MD5 faa889641ad1ca39815b730ba8626e8b
SHA1 e3c10e5ab5d52d7767e25bdbdb326a2fcfdbcc4f
SHA512 a6f7d2cc6887e711ea6b3002e1583caa316cf8c6b5c80ae1c515e1cd574918ef672a88f94cdbbf90eb691d71f0438907826a8f4ca854a1ba40d25a071061acef
SSDEEP 393216:NJf/sfivFAPNGRJuBR+UbbM3TpPWNX8f95yrEV:NJnsfivFAPNGRJuBRelWNXcM
TLSH
T10A2728217B5A996CD09AC47483478BB25A3170DB0B35BAFF449496383F6DBF42F38258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13858416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Rewind.pdb

kernel32

WaitForSingleObjectEx SwitchToThread ExitProcess FindFirstFileExW CopyFileExW GetCommandLineW SetThreadStackGuarantee GetProcessAffinityMask SetFilePointerEx TerminateProcess GetProcessId GetWindowsDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext ReadFileEx QueryPerformanceCounter QueryPerformanceFrequency CreateMutexA ReleaseMutex GetFinalPathNameByHandleW HeapReAlloc SetFileInformationByHandle MoveFileExW SleepEx WriteFileEx FreeEnvironmentStringsW CompareStringOrdinal OpenProcess ReadProcessMemory ReleaseSemaphore GetProcessIoCounters GetSystemTimes SetEnvironmentVariableW WriteConsoleW SetWaitableTimer GetExitCodeProcess GetProcessTimes VirtualQueryEx ResetEvent GetVersionExW GetSystemDirectoryW WaitForMultipleObjects GetTempPathW DuplicateHandle UnregisterWaitEx SetThreadPriority GetCurrentThread OutputDebugStringA OutputDebugStringW LoadLibraryExW GetCurrentProcess GetConsoleOutputCP GetSystemInfo GetEnvironmentVariableW FoldStringW GetModuleFileNameW GetSystemTime GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetThreadExecutionState GetCurrentDirectoryW SystemTimeToFileTime FileTimeToSystemTime TzSpecificLocalTimeToSystemTime SystemTimeToTzSpecificLocalTime RtlVirtualUnwind SetLastError IsDBCSLeadByte GetCPInfo WideCharToMultiByte CreateWaitableTimerExW CreateProcessW MultiByteToWideChar CreatePipe ReadFile WriteFile FlushFileBuffers GetNamedPipeClientProcessId GetNamedPipeServerProcessId DisconnectNamedPipe CreateFileW WaitNamedPipeW ConnectNamedPipe CreateNamedPipeW AreFileApisANSI FileTimeToLocalFileTime LocalFileTimeToFileTime GetFullPathNameW CreateEventW CompareStringW SetEvent FreeLibrary LoadLibraryA LoadLibraryW WaitForSingleObject CreateDirectoryW DeleteFileW GetFileAttributesW RemoveDirectoryW SetFileAttributesW SetFileTime DeviceIoControl MoveFileW FindClose FindFirstFileW FindNextFileW SuspendThread LCIDToLocaleName CloseHandle GetStdHandle GetFileType SetEndOfFile SetFilePointer GetConsoleMode GetLongPathNameW GetShortPathNameW GetUserDefaultUILanguage CreateHardLinkW CreateSemaphoreW CreateThread LocalFree SetHandleInformation GetFileInformationByHandle GetModuleHandleW lstrlenW SetFileCompletionNotificationModes ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetCurrentThreadId GetSystemTimeAsFileTime GetModuleHandleA Sleep GetProcAddress RtlPcToFileHeader RaiseException FormatMessageW LoadLibraryExA GetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx GetOverlappedResult HeapFree GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort HeapAlloc GetProcessHeap AddVectoredExceptionHandler InitializeCriticalSectionEx

advapi32

GetTokenInformation CopySid GetLengthSid IsValidSid RegCloseKey SystemFunction036 RegGetValueW RegQueryValueExW EventUnregister EventWriteTransfer EventSetInformation EventRegister RegOpenKeyExW LookupPrivilegeValueW OpenProcessToken RegOpenKeyTransactedW RegCreateKeyTransactedW AdjustTokenPrivileges AllocateAndInitializeSid RegSetValueExW CheckTokenMembership FreeSid RegCreateKeyExW SetFileSecurityW

oleaut32

GetErrorInfo SetErrorInfo SysAllocString VariantClear SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtOpenFile NtQueryInformationProcess RtlGetVersion NtReadFile RtlNtStatusToDosError NtCreateNamedPipeFile NtCreateFile NtDeviceIoControlFile NtCancelIoFileEx NtQuerySystemInformation

user32

CreateIcon GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ToUnicodeEx GetKeyState GetClientRect SetWindowTextW GetWindowTextW GetWindowTextLengthW SetForegroundWindow CreateMenu SetWindowDisplayAffinity SetWindowLongW EnableMenuItem GetSystemMenu EnumDisplayMonitors MonitorFromPoint GetKeyboardLayout GetRawInputData SystemParametersInfoA SetPropW GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible DestroyIcon GetMenuItemInfoW GetCursorPos MonitorFromWindow RegisterRawInputDevices ReleaseCapture SetCapture SetMenu DrawIconEx DestroyAcceleratorTable RegisterWindowMessageA SetParent MapWindowPoints CreatePopupMenu GetWindow SetFocus ShowWindow ReleaseDC IsProcessDPIAware GetDC MonitorFromRect GetMonitorInfoW EnableWindow IsWindowEnabled GetSystemMetrics CreateAcceleratorTableW GetWindowRect RemoveMenu CheckMenuItem DestroyMenu SetWindowLongPtrW FillRect GetMenuBarInfo OffsetRect GetWindowDC DrawTextW GetMessageW GetWindowLongW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn PostQuitMessage IsIconic MsgWaitForMultipleObjectsEx CharToOemBuffW OemToCharA OemToCharBuffA TrackPopupMenu InsertMenuW SendMessageW CharLowerW CharUpperW CharToOemA TranslateMessage AllowSetForegroundWindow SendInput AppendMenuW SetMenuItemInfoW RedrawWindow AdjustWindowRect DestroyWindow DrawMenuBar ScreenToClient DispatchMessageW MessageBoxW TranslateAcceleratorW PostMessageW EnumChildWindows DispatchMessageA GetMessageA RegisterClassExW DefWindowProcW GetForegroundWindow PostThreadMessageW PeekMessageW RegisterTouchWindow IsWindow CreateWindowExW AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos ClientToScreen LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

comctl32

DefSubclassProc TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass

ole32

CoTaskMemAlloc OleInitialize RegisterDragDrop CoInitializeEx CoTaskMemFree CoCreateInstance CoSetProxyBlanket CoCreateFreeThreadedMarshaler CoInitialize RevokeDragDrop CoUninitialize

gdi32

DeleteObject CreateSolidBrush SetTextColor SetBkMode CombineRgn CreateRectRgn BitBlt CreateCompatibleDC DeleteDC GetDeviceCaps CreateDIBSection SelectObject

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

shell32

ILCreateFromPathW ILFree DragQueryFileW SHOpenFolderAndSelectItems ShellExecuteExW SHGetKnownFolderPath ShellExecuteW SHCreateItemFromParsingName DragFinish SHAppBarMessage CommandLineToArgvW

ws2_32

WSACleanup freeaddrinfo getaddrinfo WSAStartup closesocket recv WSAGetLastError shutdown bind WSASocketW WSAIoctl connect ioctlsocket setsockopt getsockopt getpeername getsockname send WSASend

bcrypt

BCryptGenRandom

secur32

ApplyControlToken AcquireCredentialsHandleA FreeContextBuffer InitializeSecurityContextW QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext FreeCredentialsHandle EncryptMessage DecryptMessage

crypt32

CertCloseStore CertEnumCertificatesInStore CertDuplicateStore CertFreeCertificateContext CertOpenStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain CertGetCertificateChain CertDuplicateCertificateContext CertVerifyCertificateChainPolicy

powrprof

CallNtPowerInformation

pdh

PdhRemoveCounter PdhCloseQuery

psapi

GetProcessMemoryInfo GetModuleFileNameExW

api-ms-win-crt-math-l1-1-0

trunc round floor __setusermatherr roundf pow

api-ms-win-crt-string-l1-1-0

_wcsicmp wcsncmp wcspbrk strcpy_s strlen wcsncat wcscmp wcslen wcscpy

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit _c_exit _cexit __p___argv __p___argc terminate _exit _initterm_e _initterm abort exit _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-time-l1-1-0

clock

api-ms-win-crt-heap-l1-1-0

malloc free calloc realloc _callnewh _set_new_mode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

Name

.text

Size

13.4MB

Virtual Size

13.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.8MB

Virtual Size

6.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

745KB

Virtual Size

745KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 6a7cb8be7a1d847945da484f391550055af37a0378828f2b235abee382204fe3
MD5 a8b7a60fc7223b026f5b24e9eb27d1e3
SHA1 16ed5e2fcbf58b0ea9e883bbe7e391c69b1e6720
SHA512 604c45e2bcb6860f9e157e714d410458c5d101bc93627fbd26a33256cd4ae75547c7f273fc1b434493bda6fe2604847337b4a2065a0c4e32ea7120298806d1c2
SSDEEP 1536:tmsAYBdTU9fEAIS2PEtuOgdLeAyNxWpMq/uhXJCWwL2P95:sfY/TU9fE9PEtuOceAXXuhsWBn
TLSH
T10273C00837E0C4A7D9B206311D7A97A67FF5E91218B8871B23509F6EBD31641DE1E3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 7317e5508923f425bced2698bb89f79b00fcddcd1028f44b598732b2e3711464
MD5 fc4691e51cdfac476b2fc63bbe951e82
SHA1 6532da4545864c6ec95f62f27f2199bfd668560b
SHA512 5b544832f1b1b8f2e1c6f8d61a839bea22c2c3d7e2a03671a12bab936e46a6f3fa3dd8aa53ec91157c1de08f0b349d6d2c1aec29385ad38cc0b2ab4c033c58ed
SSDEEP 768:IMSeZbzz284uMJSmuGrAFKpnp0jdhK7R+qV0Z:IjKfAuXiMtXIV
TLSH
T16FD23918FCC56FB6E2DF1575240C596E429FC8180B14CE9BD7A25E22E9E63722EE500F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Sharing

General

Malware Config

Signatures

File Explorer

Rewind_0.1.4_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

Rewind.exe

kernel32

advapi32

oleaut32

bcryptprimitives

ntdll

user32

api-ms-win-core-synch-l1-2-0

comctl32

ole32

gdi32

dwmapi

shlwapi

shell32

ws2_32

bcrypt

secur32

crypt32

powrprof

pdh

psapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

msvcp140

generic

uninstall.exe

advapi32