Labyrinth_WIN[.]exe

resource
Labyrinth_WIN.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Labrynth_24.exe
unpack001/uninstall.exe

resource
unpack001/$TEMP/dxwebsetup.exe
unpack001/D3DX9_43.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

Labyrinth_WIN.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 8e13463aa73356382d7401aee3bb160fc070769321c8d17663d71fff783af0db
MD5 b435b45d8a1df8841af977c543f59b33
SHA1 7a72c231bf653cf8e5effd772c82615f60b5a014
SHA512 de2e1943ef9aadd285d28d260871ac4898d015937f95ad15ab4fcd195bb8b0e3e181b5c4bbfc538c32b072173078a9f8ea2f82398a1945cb5372fe99a29210cf
SSDEEP 393216:60OdVAZ5xMH3ixa9CAUcBhp3xdsSSoHLYoBc:64vg9LUcBhphGSrRc
TLSH
T17DD633966E964983FD21C13E59B8EEB7BB77EEC416BC060181ED3C97B52328018BC571
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Password

123

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Password

123

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 bb73815433bf696a9a509d6c67cea931335ce6c35327b4add87f59247f3dc4d9
MD5 adb0e43656ee1d43ea884d96b10390ee
SHA1 9a7ffefc06d59581a7e546bbf22567a9c8a66bbb
SHA512 4606f0fd8c1fdfed1969d1aadaa4a8c77129d9e1f86cf2285d9cccf1d4e1060a61405c1483f67f7f1b1fa06ea063f893ad841a0488e51114524cd5ce8a147e87
SSDEEP 96:2olI26gltSnMYKhNGH7uYiz0pACZXKOTqopMiEXeGsNgs:156glaCmKYXrqoQetf
TLSH
T1EBC22E5D0EA1A7E5E760ECF39351DC861362219410AD6FF4F7A7BD3C434259B3C6882A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 cc877c1a20e2509e0a90540882c1aae6dcf87023fde313c3233ecdc54c103ad0
MD5 81456c9f5ecf1f78638b01adf84ef232
SHA1 d24aa85ad349a7687358b7611eb0682d9bba3f3e
SHA512 7b336dbac5df269c09e33a9e7908f89e5986616d188cd677c575818f1e5f9e7215c75f0eded4e89b3d081e4b29c800bd87f4760b67c03f192d6536b13f31eb01
SSDEEP 192:oyHOuCuRpY4ri3Gn8YN/DPKRzGPXknAzo832mBB+G5c/2s7Znw3vlZPV2WG96:NHdp2mpHOt2v/PVVA6
TLSH
T145E398681F90E7D2E594CEF357549199636270CA01AABFE2E767F07C0BA308B3E5452C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Password

123

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/dxwebsetup.exe

IMPHASH 1494de9b53e05fc1f40cb92afbdd6ce4
SHA256 34f64699d4830145cae69bd40115b1f326e70fc6a98456cb3df996d947dddca4
MD5 bcbb7c0cd9696068988953990ec5bd11
SHA1 3c8243734cf43dd7bb2332ba05b58ccacfa4377c
SHA512 551a2e3aa5fc7c0e79c3bd7c5333df5f1920ea83fe35b99adbbe865ea926fa772d72709bde2ea8f2685f4914cd96ff7b5b6f894f9b99f1120c2abe89c390a786
SSDEEP 6144:3WK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQ43:mcvgLARDI1KIOzOR3
TLSH
T13454F15197E4817BE4FA1B351DF2025327797DA8ACB9E33E938618881D70380BE75B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

Password

123

PE Signature issue

Digest

25:ba:f7:87:7a:93:e9:f2:77:9a:d0:d8:84:ae:dd:db:7d:05:48:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 30, 2011

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:b2:9b:00:00:00:00:00:15

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 21, 2011 - May 21, 2012

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

23134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

FreeSid AllocateAndInitializeSid EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey RegDeleteValueA RegOpenKeyExA RegSetValueExA RegQueryValueExA RegCreateKeyExA RegQueryInfoKeyA

kernel32

LocalFree LocalAlloc GetLastError GetCurrentProcess GetModuleFileNameA lstrlenA GetSystemDirectoryA RemoveDirectoryA FindClose FindNextFileA DeleteFileA SetFileAttributesA lstrcmpA FindFirstFileA lstrcatA lstrcpyA _lclose _llseek _lopen WritePrivateProfileStringA GetWindowsDirectoryA CreateDirectoryA GetFileAttributesA ExpandEnvironmentStringsA IsDBCSLeadByte GetShortPathNameA GetPrivateProfileStringA GetPrivateProfileIntA lstrcmpiA GetProcAddress GlobalUnlock GlobalLock GlobalAlloc FreeResource CloseHandle LoadResource SizeofResource FindResourceA ReadFile WriteFile SetFilePointer SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetCurrentDirectoryA GetTempFileNameA ExitProcess CreateFileA LoadLibraryExA lstrcpynA GetVolumeInformationA FormatMessageA GetCurrentDirectoryA GetVersionExA GetExitCodeProcess WaitForSingleObject CreateProcessA GetTempPathA GetSystemInfo CreateMutexA SetEvent CreateEventA CreateThread ResetEvent TerminateThread GetDriveTypeA GetModuleHandleA GetStartupInfoA GetCommandLineA LockResource LoadLibraryA GetDiskFreeSpaceA MulDiv EnumResourceLanguagesA FreeLibrary GlobalFree

gdi32

GetDeviceCaps

user32

ExitWindowsEx wsprintfA CharNextA CharUpperA CharPrevA SetWindowLongA GetWindowLongA CallWindowProcA DispatchMessageA MsgWaitForMultipleObjects PeekMessageA SendMessageA SetWindowPos ReleaseDC GetDC GetWindowRect SendDlgItemMessageA GetDlgItem SetForegroundWindow SetWindowTextA MessageBoxA DialogBoxIndirectParamA ShowWindow EnableWindow GetDlgItemTextA EndDialog GetDesktopWindow MessageBeep SetDlgItemTextA LoadStringA GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

D3DX9_43.dll

IMPHASH 5fb75b2a87c1fa7cc3d7904a0b97084a
SHA256 0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f
MD5 86e39e9161c3d930d93822f1563c280d
SHA1 f5944df4142983714a6d9955e6e393d9876c1e11
SHA512 0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3
SSDEEP 24576:8UtU6OIyl2Wy9M3bJ45fPS0zFZghQ6aOiFaKOE31GrvFXl74YZ29X1MDd6olmrBs:8566l2u45BiNYFrz31Cv3D29kd6kWa
TLSH
T14895AF51C5191075FDE69030110D32B2219C9B316391ABCF665E2ED9FFB8BE1EAB8387
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

Password

123

PE Signature issue

Digest

9b:28:ef:17:5d:cd:b3:d3:ec:10:d1:6d:64:92:d2:24:02:c3:2b:3e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 22, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:06:94:2d:00:00:00:00:00:09

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

1

Major OS version

6

Entry point

1829901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d3dx9_43.pdb

msvcrt

_isatty _write _lseeki64 __pioinfo __badioinfo wctomb _itoa _snprintf _fileno isleadbyte ?terminate@@YAXXZ _onexit _lock __dllonexit _unlock _amsg_exit _initterm _XcptFilter srand strtod fread fflush fwrite abort _tempnam exit isalpha atof atol isxdigit _ultoa wcstombs _CIexp _isnan rand atoi isalnum floor _strtime _strdate sscanf isspace isdigit _setjmp3 longjmp ldexp frexp calloc realloc _CIlog setlocale _strdup free _clearfp ceil _controlfp malloc _CIatan _CIcos _CIasin _finite _CIsin _CIatan2 _CIacos memmove qsort _CIfmod _purecall _stricmp modf iswspace iswalpha iswdigit iswpunct _CIsqrt memcpy memset _CIpow ??2@YAPAXI@Z ??3@YAXPAX@Z _iob _vsnprintf _vsnwprintf _errno __CxxFrameHandler

gdi32

GetTextMetricsA GetObjectA GetGlyphOutlineA CreateDIBSection DeleteDC DeleteObject SelectObject GetCharacterPlacementW GetCharacterPlacementA SetTextColor SetBkColor SetBkMode GetTextMetricsW GetFontLanguageInfo CreateFontIndirectA CreateFontIndirectW SetTextAlign SetMapMode CreateCompatibleDC ExtTextOutA MoveToEx ExtTextOutW TranslateCharsetInfo GetCurrentObject GetOutlineTextMetricsA GetGlyphOutlineW GetObjectW

kernel32

DeleteFileW SetFilePointer GetFileSize CreateFileMappingA MapViewOfFile UnmapViewOfFile FindResourceA LoadResource LockResource SizeofResource FreeResource CompareStringA LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection FormatMessageA LocalFree CreateFileW GetFileSizeEx GetFullPathNameW GetLastError IsDBCSLeadByte WriteFile GetTempPathA MoveFileA CreateFileA ReadFile CloseHandle DeleteFileA InterlockedDecrement InterlockedIncrement IsProcessorFeaturePresent VirtualFree GetACP WideCharToMultiByte MultiByteToWideChar OutputDebugStringA GetModuleHandleA FreeLibrary LoadLibraryA GetVersionExA GetSystemInfo GetProcAddress VirtualAlloc GetProcessHeap HeapFree HeapAlloc DisableThreadLibraryCalls MoveFileW GetTempFileNameW GlobalMemoryStatus SetEndOfFile ExpandEnvironmentStringsA IsBadCodePtr IsBadReadPtr IsBadWritePtr WaitForSingleObject ReleaseMutex CreateMutexA Sleep InterlockedExchange InterlockedCompareExchange RtlUnwind QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter GetVersion GetTempFileNameA FindResourceW

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey

D3DXAssembleShader D3DXAssembleShaderFromFileA D3DXAssembleShaderFromFileW D3DXAssembleShaderFromResourceA D3DXAssembleShaderFromResourceW D3DXBoxBoundProbe D3DXCheckCubeTextureRequirements D3DXCheckTextureRequirements D3DXCheckVersion D3DXCheckVolumeTextureRequirements D3DXCleanMesh D3DXColorAdjustContrast D3DXColorAdjustSaturation D3DXCompileShader D3DXCompileShaderFromFileA D3DXCompileShaderFromFileW D3DXCompileShaderFromResourceA D3DXCompileShaderFromResourceW D3DXComputeBoundingBox D3DXComputeBoundingSphere D3DXComputeIMTFromPerTexelSignal D3DXComputeIMTFromPerVertexSignal D3DXComputeIMTFromSignal D3DXComputeIMTFromTexture D3DXComputeNormalMap D3DXComputeNormals D3DXComputeTangent D3DXComputeTangentFrame D3DXComputeTangentFrameEx D3DXConcatenateMeshes D3DXConvertMeshSubsetToSingleStrip D3DXConvertMeshSubsetToStrips D3DXCreateAnimationController D3DXCreateBox D3DXCreateBuffer D3DXCreateCompressedAnimationSet D3DXCreateCubeTexture D3DXCreateCubeTextureFromFileA D3DXCreateCubeTextureFromFileExA D3DXCreateCubeTextureFromFileExW D3DXCreateCubeTextureFromFileInMemory D3DXCreateCubeTextureFromFileInMemoryEx D3DXCreateCubeTextureFromFileW D3DXCreateCubeTextureFromResourceA D3DXCreateCubeTextureFromResourceExA D3DXCreateCubeTextureFromResourceExW D3DXCreateCubeTextureFromResourceW D3DXCreateCylinder D3DXCreateEffect D3DXCreateEffectCompiler D3DXCreateEffectCompilerFromFileA D3DXCreateEffectCompilerFromFileW D3DXCreateEffectCompilerFromResourceA D3DXCreateEffectCompilerFromResourceW D3DXCreateEffectEx D3DXCreateEffectFromFileA D3DXCreateEffectFromFileExA D3DXCreateEffectFromFileExW D3DXCreateEffectFromFileW D3DXCreateEffectFromResourceA D3DXCreateEffectFromResourceExA D3DXCreateEffectFromResourceExW D3DXCreateEffectFromResourceW D3DXCreateEffectPool D3DXCreateFontA D3DXCreateFontIndirectA D3DXCreateFontIndirectW D3DXCreateFontW D3DXCreateKeyframedAnimationSet D3DXCreateLine D3DXCreateMatrixStack D3DXCreateMesh D3DXCreateMeshFVF D3DXCreateNPatchMesh D3DXCreatePMeshFromStream D3DXCreatePRTBuffer D3DXCreatePRTBufferTex D3DXCreatePRTCompBuffer D3DXCreatePRTEngine D3DXCreatePatchMesh D3DXCreatePolygon D3DXCreateRenderToEnvMap D3DXCreateRenderToSurface D3DXCreateSPMesh D3DXCreateSkinInfo D3DXCreateSkinInfoFVF D3DXCreateSkinInfoFromBlendedMesh D3DXCreateSphere D3DXCreateSprite D3DXCreateTeapot D3DXCreateTextA D3DXCreateTextW D3DXCreateTexture D3DXCreateTextureFromFileA D3DXCreateTextureFromFileExA D3DXCreateTextureFromFileExW D3DXCreateTextureFromFileInMemory D3DXCreateTextureFromFileInMemoryEx D3DXCreateTextureFromFileW D3DXCreateTextureFromResourceA D3DXCreateTextureFromResourceExA D3DXCreateTextureFromResourceExW D3DXCreateTextureFromResourceW D3DXCreateTextureGutterHelper D3DXCreateTextureShader D3DXCreateTorus D3DXCreateVolumeTexture D3DXCreateVolumeTextureFromFileA D3DXCreateVolumeTextureFromFileExA D3DXCreateVolumeTextureFromFileExW D3DXCreateVolumeTextureFromFileInMemory D3DXCreateVolumeTextureFromFileInMemoryEx D3DXCreateVolumeTextureFromFileW D3DXCreateVolumeTextureFromResourceA D3DXCreateVolumeTextureFromResourceExA D3DXCreateVolumeTextureFromResourceExW D3DXCreateVolumeTextureFromResourceW D3DXDebugMute D3DXDeclaratorFromFVF D3DXDisassembleEffect D3DXDisassembleShader D3DXFVFFromDeclarator D3DXFileCreate D3DXFillCubeTexture D3DXFillCubeTextureTX D3DXFillTexture D3DXFillTextureTX D3DXFillVolumeTexture D3DXFillVolumeTextureTX D3DXFilterTexture D3DXFindShaderComment D3DXFloat16To32Array D3DXFloat32To16Array D3DXFrameAppendChild D3DXFrameCalculateBoundingSphere D3DXFrameDestroy D3DXFrameFind D3DXFrameNumNamedMatrices D3DXFrameRegisterNamedMatrices D3DXFresnelTerm D3DXGenerateOutputDecl D3DXGeneratePMesh D3DXGetDeclLength D3DXGetDeclVertexSize D3DXGetDriverLevel D3DXGetFVFVertexSize D3DXGetImageInfoFromFileA D3DXGetImageInfoFromFileInMemory D3DXGetImageInfoFromFileW D3DXGetImageInfoFromResourceA D3DXGetImageInfoFromResourceW D3DXGetPixelShaderProfile D3DXGetShaderConstantTable D3DXGetShaderConstantTableEx D3DXGetShaderInputSemantics D3DXGetShaderOutputSemantics D3DXGetShaderSamplers D3DXGetShaderSize D3DXGetShaderVersion D3DXGetVertexShaderProfile D3DXIntersect D3DXIntersectSubset D3DXIntersectTri D3DXLoadMeshFromXA D3DXLoadMeshFromXInMemory D3DXLoadMeshFromXResource D3DXLoadMeshFromXW D3DXLoadMeshFromXof D3DXLoadMeshHierarchyFromXA D3DXLoadMeshHierarchyFromXInMemory D3DXLoadMeshHierarchyFromXW D3DXLoadPRTBufferFromFileA D3DXLoadPRTBufferFromFileW D3DXLoadPRTCompBufferFromFileA D3DXLoadPRTCompBufferFromFileW D3DXLoadPatchMeshFromXof D3DXLoadSkinMeshFromXof D3DXLoadSurfaceFromFileA D3DXLoadSurfaceFromFileInMemory D3DXLoadSurfaceFromFileW D3DXLoadSurfaceFromMemory D3DXLoadSurfaceFromResourceA D3DXLoadSurfaceFromResourceW D3DXLoadSurfaceFromSurface D3DXLoadVolumeFromFileA D3DXLoadVolumeFromFileInMemory D3DXLoadVolumeFromFileW D3DXLoadVolumeFromMemory D3DXLoadVolumeFromResourceA D3DXLoadVolumeFromResourceW D3DXLoadVolumeFromVolume D3DXMatrixAffineTransformation D3DXMatrixAffineTransformation2D D3DXMatrixDecompose D3DXMatrixDeterminant D3DXMatrixInverse D3DXMatrixLookAtLH D3DXMatrixLookAtRH D3DXMatrixMultiply D3DXMatrixMultiplyTranspose D3DXMatrixOrthoLH D3DXMatrixOrthoOffCenterLH D3DXMatrixOrthoOffCenterRH D3DXMatrixOrthoRH D3DXMatrixPerspectiveFovLH D3DXMatrixPerspectiveFovRH D3DXMatrixPerspectiveLH D3DXMatrixPerspectiveOffCenterLH D3DXMatrixPerspectiveOffCenterRH D3DXMatrixPerspectiveRH D3DXMatrixReflect D3DXMatrixRotationAxis D3DXMatrixRotationQuaternion D3DXMatrixRotationX D3DXMatrixRotationY D3DXMatrixRotationYawPitchRoll D3DXMatrixRotationZ D3DXMatrixScaling D3DXMatrixShadow D3DXMatrixTransformation D3DXMatrixTransformation2D D3DXMatrixTranslation D3DXMatrixTranspose D3DXOptimizeFaces D3DXOptimizeVertices D3DXPlaneFromPointNormal D3DXPlaneFromPoints D3DXPlaneIntersectLine D3DXPlaneNormalize D3DXPlaneTransform D3DXPlaneTransformArray D3DXPreprocessShader D3DXPreprocessShaderFromFileA D3DXPreprocessShaderFromFileW D3DXPreprocessShaderFromResourceA D3DXPreprocessShaderFromResourceW D3DXQuaternionBaryCentric D3DXQuaternionExp D3DXQuaternionInverse D3DXQuaternionLn D3DXQuaternionMultiply D3DXQuaternionNormalize D3DXQuaternionRotationAxis D3DXQuaternionRotationMatrix D3DXQuaternionRotationYawPitchRoll D3DXQuaternionSlerp D3DXQuaternionSquad D3DXQuaternionSquadSetup D3DXQuaternionToAxisAngle D3DXRectPatchSize D3DXSHAdd D3DXSHDot D3DXSHEvalConeLight D3DXSHEvalDirection D3DXSHEvalDirectionalLight D3DXSHEvalHemisphereLight D3DXSHEvalSphericalLight D3DXSHMultiply2 D3DXSHMultiply3 D3DXSHMultiply4 D3DXSHMultiply5 D3DXSHMultiply6 D3DXSHPRTCompSplitMeshSC D3DXSHPRTCompSuperCluster D3DXSHProjectCubeMap D3DXSHRotate D3DXSHRotateZ D3DXSHScale D3DXSaveMeshHierarchyToFileA D3DXSaveMeshHierarchyToFileW D3DXSaveMeshToXA D3DXSaveMeshToXW D3DXSavePRTBufferToFileA D3DXSavePRTBufferToFileW D3DXSavePRTCompBufferToFileA D3DXSavePRTCompBufferToFileW D3DXSaveSurfaceToFileA D3DXSaveSurfaceToFileInMemory D3DXSaveSurfaceToFileW D3DXSaveTextureToFileA D3DXSaveTextureToFileInMemory D3DXSaveTextureToFileW D3DXSaveVolumeToFileA D3DXSaveVolumeToFileInMemory D3DXSaveVolumeToFileW D3DXSimplifyMesh D3DXSphereBoundProbe D3DXSplitMesh D3DXTessellateNPatches D3DXTessellateRectPatch D3DXTessellateTriPatch D3DXTriPatchSize D3DXUVAtlasCreate D3DXUVAtlasPack D3DXUVAtlasPartition D3DXValidMesh D3DXValidPatchMesh D3DXVec2BaryCentric D3DXVec2CatmullRom D3DXVec2Hermite D3DXVec2Normalize D3DXVec2Transform D3DXVec2TransformArray D3DXVec2TransformCoord D3DXVec2TransformCoordArray D3DXVec2TransformNormal D3DXVec2TransformNormalArray D3DXVec3BaryCentric D3DXVec3CatmullRom D3DXVec3Hermite D3DXVec3Normalize D3DXVec3Project D3DXVec3ProjectArray D3DXVec3Transform D3DXVec3TransformArray D3DXVec3TransformCoord D3DXVec3TransformCoordArray D3DXVec3TransformNormal D3DXVec3TransformNormalArray D3DXVec3Unproject D3DXVec3UnprojectArray D3DXVec4BaryCentric D3DXVec4CatmullRom D3DXVec4Cross D3DXVec4Hermite D3DXVec4Normalize D3DXVec4Transform D3DXVec4TransformArray D3DXWeldVertices

Labrynth_24.exe

IMPHASH 218d5f46517215e63e79fcce23f1d1b7
SHA256 14d9567961fe5d95b24f35f17a23a8d587f8fb85707fe3f9c3c72eb82d7dac32
MD5 b100c3c2d8394693509ee08a90892d0e
SHA1 b56953b872ea3767311836c841cca4f0afe0ebd5
SHA512 08dc1d7c2c5b51a6797153c0ae98ee0ff7979caaf77fdb82bcc4532696e8ec5df5b31d53ec508a76dffa8ddbcf6595431dbabd82f801a022715290a74f7d434d
SSDEEP 49152:fXah6xXWi7vYtxYJnuEN1dKqt81yByouF4UhXAtG9MGTGD:ZWmvYt2RdKqtcyByouhhXAt+MtD
TLSH
T165E58E407281D0B1E44161F8AC5AE6EF46297F61872895EFB7D03F1A6A776E01EB33C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Password

123

Minor OS version

0

Major OS version

5

Entry point

2152888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\hudson\GMBase\GMGreen\GameMaker\Runner\VC_Runner\Release\Runner.pdb

wininet

InternetCloseHandle InternetWriteFile HttpEndRequestW InternetReadFile HttpQueryInfoA InternetOpenA InternetCrackUrlA InternetCanonicalizeUrlA HttpSendRequestA HttpOpenRequestA InternetConnectA InternetGetConnectedState

d3dx9_43

D3DXCompileShader D3DXGetVertexShaderProfile D3DXCreateTextureFromFileInMemoryEx D3DXGetPixelShaderProfile D3DXCreateTextureFromFileW

dbghelp

MiniDumpWriteDump

winmm

mciGetErrorStringA mciSendStringA joyGetPos joyGetPosEx joyGetDevCapsA timeGetTime waveInGetDevCapsW waveInGetNumDevs waveInAddBuffer waveInClose waveInUnprepareHeader waveInPrepareHeader waveInOpen waveInReset waveInStart waveInStop

ws2_32

htonl htons ntohl ntohs __WSAFDIsSet getpeername select closesocket shutdown WSAStartup WSACleanup WSAGetLastError setsockopt ioctlsocket socket bind listen sendto inet_addr getaddrinfo send recvfrom inet_ntoa recv accept connect

gdiplus

GdiplusStartup GdiplusShutdown

comctl32

InitCommonControlsEx

kernel32

GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount SetConsoleCtrlHandler SetFilePointer SetStdHandle ReadFile VirtualAlloc VirtualFree HeapDestroy HeapCreate FatalAppExitA FlushFileBuffers GetConsoleMode GetConsoleCP WriteFile IsValidCodePage GetOEMCP GetACP GetCPInfo HeapSize SetLastError GetStdHandle SetHandleCount IsDebuggerPresent TerminateProcess GetModuleHandleA GetStartupInfoA GetFileType PeekNamedPipe GetFileInformationByHandle HeapReAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileA GetDateFormatA GetTimeFormatA DeleteFileA GetSystemTimeAsFileTime GetFileAttributesW SetFileAttributesW FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime FileTimeToSystemTime ExitProcess HeapAlloc HeapFree HeapWalk GetTimeZoneInformation CreateFileA MultiByteToWideChar GetConsoleWindow WideCharToMultiByte OutputDebugStringW FormatMessageW GetProcAddress FreeEnvironmentStringsA GetFullPathNameA GetCurrentDirectoryA GetLastError LocalFree GetModuleHandleW InterlockedDecrement InterlockedIncrement CreateThread GetExitCodeThread CloseHandle Sleep FreeLibrary LoadLibraryA GetExitCodeProcess CreateProcessW FindClose DeleteFileW FindNextFileW RemoveDirectoryW FindFirstFileW GetFileAttributesA CreateDirectoryA GetEnvironmentVariableW GetTickCount QueryPerformanceCounter QueryPerformanceFrequency SetCurrentDirectoryA SetThreadPriority SetPriorityClass GetCurrentProcess GetCurrentThread GlobalUnlock GlobalLock GlobalAlloc GetVersionExW GetUserDefaultLCID GetLocaleInfoW ExpandEnvironmentStringsA GetModuleFileNameW MoveFileA GetModuleFileNameA GetCommandLineA GetCurrentProcessId GetCurrentThreadId CreateFileW IsBadWritePtr InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection TlsAlloc TlsSetValue TlsGetValue TlsFree ExitThread WaitForSingleObject SetEvent CreateEventW WaitForSingleObjectEx RtlUnwind RaiseException InterlockedExchange LocalAlloc GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA CompareStringW SetEnvironmentVariableA SetEndOfFile LoadLibraryW GetProcessHeap HeapValidate

user32

SetWindowTextW GetDlgItemTextW EndDialog DialogBoxParamW CreateDialogParamW ScreenToClient ReleaseDC DrawTextW GetDC GetWindowRect MoveWindow GetClientRect SetCursorPos MapWindowPoints GetCursorPos wsprintfW GetActiveWindow DispatchMessageW TranslateMessage GetMessageW EnumDisplaySettingsW ChangeDisplaySettingsW GetWindowLongW SetWindowLongW UpdateWindow EnumDisplaySettingsExW SetDlgItemTextW GetAsyncKeyState SetWindowTextA IsClipboardFormatAvailable CloseClipboard GetClipboardData OpenClipboard SetClipboardData EmptyClipboard MessageBoxA SetDlgItemTextA IsDialogMessageW PeekMessageW GetForegroundWindow PostThreadMessageW SetWindowPos GetSystemMetrics AdjustWindowRectEx LoadIconW LoadCursorW RegisterClassExW CreateWindowExW SendMessageW DefWindowProcW SetCursor DestroyWindow PostMessageW GetDlgItem ShowWindow BringWindowToTop keybd_event SetFocus GetKeyState CallNextHookEx MessageBoxW SetForegroundWindow

gdi32

GetDeviceCaps CreateFontA SelectObject DeleteObject

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetSpecialFolderPathA SHGetFolderPathA ShellExecuteW

License.txt

SHA256 d7fa6ca4077f5319942b079113e918c12099866b4d74b1fcc0c74437463aafe8
MD5 e1c64620d09a3ea5b6e40a64d79b8e59
SHA1 a6405105345eb6fcc3eb58148e3f1e9574bafc3f
SHA512 c9f90f274094019d30ab6e9840ab225588f404aa514fa5fc13361576de85b5bfdcb02eb81572799ffaac0184351182478ad48cda9af710dd384e8169cc6c4eec
TLSH
T14C51336FAB8A137615D101B2164AF0C5FB1960343A7A0E1530AD811F3B93E34473B99E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

bass.ogg

SHA256 97970c91d315fbceede30d65b466b22ba64a9caa6f61812323f92233a9152098
MD5 7352fa4d498a25bf396b2c7788ae6c18
SHA1 89fb0c843ee319c7b861debea4c28e62eea04c4d
SHA512 80ee50e8968d2bc62aec1db38a0aed5b60c2d10b0bbe305ad26bfbe969426bbdc6e28d8fd48b03cb4fcbb9545a4b04d0e5707ce9c9cb7eb80be4677f3129a75e
SSDEEP 6144:dJtldd4kSiLRmV8QXBrWeEXlduW5EgUE4NpENEPkuwotH/nTZ4j:drlfTSm8REzuWCglN6wQ/TZG
TLSH
T13F64235A5D92EA8F44D1A038E57149F9324A9D183830ACFD7DE3BE9ED8CC795F182023
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

bassmid.ogg

SHA256 bb25ea3d11e21977042a4ff4dd0f38e8eb4d38be7104098eb421224e59da0e55
MD5 f812b2a598b71fa8d6e31f32937813d8
SHA1 225d69812fb010825921165f6bcac1206e340823
SHA512 e27157eeeb872825d9209722e0ec1a7f817cf4552c76b0aff7fc7f6589422b7d555dc1e34e87b6ae65a5d1d179a8c5135d556a5f64fa16d1b0fe641cbec3f6c4
SSDEEP 6144:ju0QqKmIvP1H2lARIEDeESMtJ8n7v5fzWBu76ni7HYhCtUqp2KhjYIQKo1hZ/:ju3qKmIlHS3EDrSZ+1gtUEfhjFQKo1ht
TLSH
T167742384BF47FB29C86278F1E6E047789067F763DAB4D550E991F9480A025CFCD188AE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

bassmidupper.ogg

SHA256 02a7b081a16a758da195e4819d0915dd8b6332662ecda899a5f3d08faaa36597
MD5 3a79002ab04a43e29fc61c28ec06ccd7
SHA1 3d555cd62f1c02bd249ee0d85ae084b0e2f4e3bb
SHA512 2fda2c1ce07d6a67ee019fe9c91ce6916dcb86373eb78bfd1341f06f026f9d100b8248418fd9ed9f0e9f8b0784342031d6337123b3a84c65d80c5505faf02daa
SSDEEP 6144:Smg7NHvcwSzKbMeckHoDHJV9Rmor1F0BB+VggDZkqtvGVlrvcl/MEp1sMZxyckjo:cpHE9kSkMJ5prs+igDZPODkBMEpqY7k0
TLSH
T19574239F9D7AD7FBC031613211ACB6DB93B1C41AA1D0FE03F58BA4255D37213A8D49A8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

bassupper.ogg

SHA256 9ff5b6179ca95d77c87cb60aafc4ac5e7dde4e75ab54a4eddff7d4ca74e2bc56
MD5 f3a41ec4196f9bb2a4ec6b648da17ab9
SHA1 d204fe935240db6169a8107e692550ac6abfb55d
SHA512 ecd0a64ac7f623767150a65ca6bbfc67d43c68542ee6d5bb7bd0d6817358532491a1d6a9b2a868e838a3c145ee59d9cba06bd41822365d13f5b7aa23c62cde44
SSDEEP 6144:bMqKL2es5OL7paSMkKZOGVbn945ylUuDtuIfFHgbrwVdEdcL8MnRbpQjPtVtHO+:beJs89yNt5JfeY1gMNpQTnY+
TLSH
T18F7422C35F054DD1F649037746A607E5C77DDA3C8218878AB704FAA68E73698FB0298A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

data.win

SHA256 7a05c405355d8ca6199fd88629dcf3174ea0dfcf94c9369b29020f4d017e37fe
MD5 852fd66933075fa14c9ab7d44789abe5
SHA1 d4589ebffe483a3506fe950c6708c1b479b6387e
SHA512 912c8d5529f08601ec843dd52ac686b73e773010b0588910b136baaf81dce5caa8bd8ef2dca7bd2eec75fb751a951201dce98eaa6e92f7606fc0e238896f6fcf
SSDEEP 49152:YQpxAEQ27BhCtseufN9Cydw1vdIvByuINDtn3ppYpnQmXB2t0kw:YQLAEQ6BMspNxwLtppqQmXB2t0k
TLSH
T1EA561A337842EDE2D91D76368D6F8D58A121FF818A2D42433A65FF1F9FF22188D42961
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dream_sweet.ogg

SHA256 1cb9f7b919a4416ace70f5c304540c1dba4326322fbf3f6b81e4098dd695c243
MD5 5ac56fdb137b90b1e2e29516d127f1b9
SHA1 3d5c03864e980316ce46538dd4b67781440ea023
SHA512 02542604392074d1facee899aa530d8a4d574fbd1b51ac19de9e77c85a5ded1659500332ba2f0e7d0563ad5437f268b9302cd3979db15a89065b4a5e36167ff2
SSDEEP 12288:lFy6adhg9uJJL66hURYIKgwnSSSTRTUgCoPFmRkLmP1Kkd5:Xo+76nIKgwnLSTRogjFTLI11/
TLSH
T11CC423F49E035EA6D2FA58B1E6A52CC33B7C8662763F45665811305D0CB2CF17703ABA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

dreamsweet.ogg

SHA256 6bd904e8fc7bd7b788ec2ad4cf8e8374ccdb001411d896131d7e4f11ef74024b
MD5 a8dc099c5485f25b63965892620e4a4f
SHA1 22276dacf149c6db0fea90b09643aca3194d0361
SHA512 4aef15fa9ca9b7451cc955b407aea69a84a3bc72d1a987b63ffed747492e987c8e35923d98caede0d92422808e8b4527a821d3fd6585f7ba1cc2e61fa381df7a
SSDEEP 12288:zlSscEjiU9lXKw1YsNKaXDvAQtIsISPAewYLH0K4AFCGSFDEODpLlg:zlSscO9lawI4vjhIjOT4A+DTXg
TLSH
T1EEC42386595439DEC26003766A33DB536E22F2526EF00F9B1E946317FDA3FC3891B219
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

menuscreen.ogg

SHA256 463cbcc6291b68c30cc255475f1f1b72e8073fd89e93b5dd1953d346aa2a24de
MD5 5276d502ff5c05f00ae61b8563baacf3
SHA1 5d5085e0deef1dd9e49e17e25a089eccb99eb79b
SHA512 5582ff67d39b0c1c282c9d1367a0aa4345f86e5f3ca8c7ada6c76482d705cc704edfeafbc0784006f1f832dabc591a8e1388af19f14107e52c8312b2377ccd79
SSDEEP 12288:E312SDpx8Ek+IZrpKvOeBBY5MThY9OLMlQDtJm1fs8dqlJO6+e2/UIz2w3FCcTrP:S2Y+Ek+IZleO+S5Ym/lq+6VlJOF0A2eD
TLSH
T143E42388E90128CAD8C921F35E177F51337385854F01767A8F3AD92CADBED209A7725D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

middle.ogg

SHA256 6b9c0b7ac7e93501410d3074f53f03fd335bd59a296d39e4f45ec791e841779e
MD5 5541ca76a171ecfcc69ec67276bf1c5f
SHA1 271f12966de815af2bea6d0827def4f858121db4
SHA512 214cffdbc5005b3dd8d8b1a9b1911b2e9f3205a92c7d0f49f77631dd856c7dc55dfb0df3d4d0b8dd33332dce5a94fbc66b57d4a6120d5bb7c61b48f16f2d5acb
SSDEEP 6144:i89FjxJZ7Z19GHQg3qkCkKz124TUGKnZWDy0z1fBeWVqCSi9pMRYQ8/v3:fRFZ2HQl5kKzwTLchqCV9pMOv3
TLSH
T1417423AEFE881178C4C819BAFFBA83177F29C694B360511CDD2E452D9B4A6C785F520C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

mindelectric.ogg

SHA256 1349672576d58a7adbd4a7ee6c3d307453d42e23e8ac786290a2518e85e0838e
MD5 caa1ed7db8dff115543c9665a69fc485
SHA1 dafd4aba5a7bf5d7fb53d04aa6589fd24f7ad949
SHA512 8c5e874debb4cd67c7cea86fcb20d94a116ce8875a6b99107adeb7870608c9484e65e578c22203f031df6db276467679d81e17ec7de85a0d7d9ed4aeb3cdc598
SSDEEP 6144:IjcEJMSUtYjjdizx2omaneG228yWghHKyzwcFsQAQ/T/Qa9SKFUovY:IjiSUtYjjUzxfmaBEE/hFk6rRUKPY
TLSH
T1123412C19A53DF89B505D1F4C28F33B049B0859C0BADEAB9AD0F45BFD884F245E2568B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

murders.ogg

SHA256 db6e4e6e89eea45fd595cc8530e1ff3afb98ddb0bce52bd50f190eb46327a4a7
MD5 c545140805f6de1572ce9b741d914c5a
SHA1 94adbce4a623590916d0fe3e8ba263d312ab83dc
SHA512 4f0d5765cfca9237fe93c199591d6ffb0dbdd673a8b30d791032d0e1ca3dcc9962962cc8ff3f7a995ee80b0ca3ae5542604653985015113b3ce20c3daaa8f173
SSDEEP 24576:E3y1QN24kbaiBbrtBggPqNrAssxVInEtMJd1TOHYcuJKCZe+oH87B1l+ZNTQ6:ARN2qi1xB7q1s3yjv1TO4VQPHsPlYZQ6
TLSH
T1F46523D4594B9DF4D47A0673853B88337272B4E93AF8EB4AD331B0699DD1703808DAB6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

spacestation.ogg

SHA256 6c296e9a652bb74874d9619fced8f1a9693cffe7940b9d886d93e31593ee05c1
MD5 d3d46962cfdaa9ccfa859f5e80c2cab4
SHA1 a4cd293409db4ed394be14bc276015a4e3214c03
SHA512 9481ab29ba0ea7ebdb6e9dfccb7a2e63c60faefb308d53ab56cfa504188f9578cd3911fd2a3bac53b0280807d0c3e0007c96d496aa82f13959b6f265aaed1973
SSDEEP 12288:garNNrRfe1qZtlj49NHsITG49h/v7knx+M+hYJOGWJ5Qhr9nU:g2N7m1qSz1xv7knxL+0WJ5IRnU
TLSH
T119E423E28CC80EF5C9142133063FFE5D778BC6EF1B2A921697227DB45999D066C7809B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 621a64131ab2ca484f40c065b7ef905f1778359ae50ef566e4c308ecf2fdcd90
MD5 e7907299e76829137cb7b31e48c2f859
SHA1 ff12adcf30bd945447ebc94dd2aabd516eb64495
SHA512 7feb68158e06283c95b2427dcc2d8468085437376ba639a9a814102cab5d2a5fa68249cd7417e427866d75bec7a86dda65f46174fd4c6d11bec0bd418f03900f
SSDEEP 1536:ApgpHzb9dZVX9fHMvG0D3XJogVKKdGGGGGGNLeAyNnu5:WgXdZt9P6D3XJooGGGGGG1eAd5
TLSH
T10A43AE1736C289BBDAA606300DF7E7BEE7B6DEE4C9055A6357806F2F7CA1142CD00145
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Password

123

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

upper.ogg

SHA256 7d568a08f78d59170ac62624e518b44b30bb71266ade34ac3e3e42f0fe063386
MD5 d2a69cb5db0a203641d4f09266ff201b
SHA1 81246950ec2974ca731a2699722cf6e693bc46ae
SHA512 2f284d7c73d2aa05fbbfa9557c74353c1bffda8e4260e44157af4b7ef3f54473386f9fad11bac98d1ca606166ed7c43aac473e57503db600d5cfd01cc2b09bb9
SSDEEP 6144:dyXhFiNSa+QDkcOfmFuigUwvoPY/KTQ1nJub6Oo8evvtmTzkHIDsgA+JdEUMRK:EX/pQzOeF3gUOow/KgZ8eXLHIQr+JdR
TLSH
T1D8742381B8C32DD2D1CD78FED8436F95732A6170D3B4470AAB77032E0D5A396AA15B0E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

whiteball.ogg

SHA256 31239bf8849106b446a71cec905f4690a09ca0304ee27e406b65ecb38a1a56a0
MD5 ec8ef0036b0a587031296fb05db9237a
SHA1 25c44b79d71fd6c2b5b63b92fed3b57249a5d1ea
SHA512 c1c509859a432105c94df8b67f72cae2e7ad60b08bda596e127d6df790a5d6828339b7a5cd01f856648efce07caa788b04c071d551529e38279fdc4f4b3e2ba1
SSDEEP 24576:aKLmOghyLQP9ezzALNqTq4NBh78p6MYnSDDgINADeoxrHBlQB9JGbjEEQSRVKv1u:aiOqq+Vh/QcbA6I6BxxoYFriPtS
TLSH
T136953388EC0A0CA5E1952075CFBB6F07EB2795519FF267827B76701EEEA7781D683001
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

Labyrinth_WIN.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$TEMP/dxwebsetup.exe

PE Signature issue

advapi32

kernel32

gdi32

user32

comctl32

version

generic

D3DX9_43.dll

PE Signature issue

msvcrt

gdi32

kernel32

advapi32

generic

Labrynth_24.exe

wininet

d3dx9_43

dbghelp

winmm

ws2_32

gdiplus

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

generic

License.txt

bass.ogg

bassmid.ogg

bassmidupper.ogg

bassupper.ogg

data.win

dream_sweet.ogg

dreamsweet.ogg

menuscreen.ogg

middle.ogg

mindelectric.ogg

murders.ogg

spacestation.ogg

uninstall.exe

kernel32

user32

gdi32

shell32

advapi32