FLiNG_Trainer_c10[.]exe

resource
analyses/260719/260719-php32adw2z/static1/unpack001/$PLUGINSDIR/uires/image/un_logo.svg

resource	yara_rule
sample	upx

resource
unpack001/$PLUGINSDIR/BgWorker.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsInstall.dll
unpack001/out.upx

FLiNG_Trainer_c10.exe

SHA256 26f95a443f43b0dfde765fd5664ee7e9921e1bd875792f06372a503bfdc67cc7
MD5 9a19118b624be06f1defc3a4e17e3930
SHA1 a67c87ed412e00f629cbf15b806d08fff22daca7
SHA512 81b96242ff8b1ad6b05e4a89d260f159b3d6bef4d9ba5966df649f7daf13ce49a9f1f4b2692e60329c6159b3bcc834cbe1b1771987e392064a55c82b1e6daf5e
SSDEEP 49152:ACSHpdWFvOzGqefoLcJmkjbWRtYy8Ztcjh7hXxpFReCjf0JUSthi/:pkONOzGqncJljEYyGtcBhhpFI9O
TLSH
T13ED511E23614CBC6E4930134D0EEFF68D9506DF916D4CA9AF15239EA99313938F5E318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

Digest

62:7d:ee:a7:dd:75:54:eb:06:d6:e4:6e:88:b6:2b:9c:81:a8:a8:2e:a8:cc:c7:21:59:1f:c9:29:41:f5:65:65

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91340100MA2URKTP9L,CN=合肥坤博信息科技有限公司,O=合肥坤博信息科技有限公司,L=合肥市,ST=安徽省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e59088e882a5e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5ae89e5bebde79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 3, 2026

SERIALNUMBER=91340100MA2URKTP9L,CN=合肥坤博信息科技有限公司,O=合肥坤博信息科技有限公司,L=合肥市,ST=安徽省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e59088e882a5e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5ae89e5bebde79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=91340100MA2URKTP9L,CN=合肥坤博信息科技有限公司,O=合肥坤博信息科技有限公司,L=合肥市,ST=安徽省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e59088e882a5e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5ae89e5bebde79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Serial Number

0a:6a:3d:f2:94:58:6f:62:8d:db:18:01:bb:fa:a7:40

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 6, 2025 - Feb 7, 2027

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

515184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/BgWorker.dll

IMPHASH db2755f409b81c4dbfc04f648cfb80b9
SHA256 50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 33ec04738007e665059cf40bc0f0c22b
SHA1 4196759a922e333d9b17bda5369f14c33cd5e3bc
SHA512 2318b01f0c2f2f021a618ca3e6e5c24a94df5d00154766b77160203b8b0a177c8581c7b688ffe69be93a69bc7fd06b8a589844d42447f5060fb4bcf94d8a9aef
TLSH
T1C351B72E612C0BFFC2963C34BC96795B1B6FC060A39A6328813FC5853C141B4233DB2A
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/config.ini

SHA256 4716d9f7afa9b9e1e8513aa11da153b3cf2e33154fd11d7ef87666f546ad3cae
MD5 eb80c364997040164c51c7e7fe9b77cb
SHA1 21954956a5a94b75d2c47c8c95581600cd624165
SHA512 c1c0a0555c4f4a140ad967009150a28f1a40d95a3670088ac9b0578c64fd71ce9d8a67808a7cdb66c693e17a198e844fc841131a0fd1aaa02e541d8adc17730e
TLSH
T1BFF05CD3664689E883C0518C3195134A3CC390AF8880D587F1F0A6405BB8B5A4BFC905
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsInstall.dll

IMPHASH e7443b57c81efa36423b00ddff4fb404
SHA256 1a45794f2a20b18d66e652a577b0280a72e07499521ce85d502dd513910a2f64
MD5 49e4160d5808277265d3e1790e9bef3d
SHA1 27786aef31f724a2ea20dd646b485137ecfeb41e
SHA512 58245c5bdba89f93d46a7040c1c2db77a98f68c0e7a90f5b020d2c565e1fa88a7dc7254b1c33a396c95dc7eb5b02bcf54803d8f06af790e31bfe5f174b8343d1
SSDEEP 98304:iXvqDr1o/ggP+uSwbmCKtUaHiBmyRNaL68zX:iqDmCwbmCOCBmkA68
TLSH
T13346BF11FB829471E5EF01B996BF67BE8A7D9920033485C783D429B9DE305D07B3638A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

3277571

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\HMB\Desktop\pending\gamemodifier\nsispackage\vsbuild\Release\nsInstall.pdb

kernel32

GetFullPathNameW FreeResource GetLocalTime GetVersionExA UnmapViewOfFile MapViewOfFile WriteConsoleW SetEndOfFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA FindFirstFileExW SetStdHandle GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber GetConsoleOutputCP SetConsoleCtrlHandler SetFilePointerEx GetFileInformationByHandle GetDriveTypeW GetFileAttributesExW FreeLibraryAndExitThread ResumeThread ExitThread LoadLibraryExW InterlockedFlushSList InterlockedPushEntrySList RtlUnwind InitializeSListHead GetStartupInfoW IsDebuggerPresent IsBadReadPtr MoveFileW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo CompareStringEx GetLocaleInfoEx LCMapStringEx EncodePointer CreateSymbolicLinkW GetFileInformationByHandleEx CloseThreadpoolWait SetThreadpoolWait CreateThreadpoolWait CloseThreadpoolTimer WaitForThreadpoolTimerCallbacks SetThreadpoolTimer CreateThreadpoolTimer CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns GetTickCount64 GetCurrentProcessorNumber FlushProcessWriteBuffers CreateSemaphoreExW CreateEventExW InitOnceExecuteOnce FlsFree FlsSetValue FlsGetValue FlsAlloc SetFileInformationByHandle SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable LocalFree GetStringTypeW FormatMessageA TryEnterCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock GetNativeSystemInfo SwitchToThread FlushInstructionCache HeapCreate MulDiv GlobalLock ConvertThreadToFiber GlobalUnlock ConvertFiberToThread GetCurrentProcessId GetModuleHandleExW CreateFiber DeleteFiber SwitchToFiber TlsFree TlsSetValue TlsGetValue TlsAlloc GetCurrentThreadId InitializeCriticalSectionAndSpinCount ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetEnvironmentVariableW GetSystemTime VerifyVersionInfoA VerSetConditionMask WaitForMultipleObjects PeekNamedPipe GetFileType GetEnvironmentVariableA GetSystemTimeAsFileTime CompareFileTime WaitForSingleObjectEx LoadLibraryA GetModuleHandleA GetSystemDirectoryA QueryPerformanceFrequency SleepEx QueryPerformanceCounter FormatMessageW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime SetFileTime lstrlenA GetCurrentThread SetConsoleTextAttribute GetTickCount GetStdHandle WTSGetActiveConsoleSessionId CreateProcessW CreateProcessA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx GetFileAttributesA CreateSemaphoreW CreateEventW ReleaseSemaphore ResetEvent SetEvent InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetVersionExW VirtualFree VirtualAlloc AreFileApisANSI SetFileAttributesW CreateDirectoryW WriteFile SetFilePointer ReadFile GetFileSize CreateFileW CreateFileA SetLastError MultiByteToWideChar MoveFileExW IsProcessorFeaturePresent MoveFileExA MoveFileA CopyFileW lstrcpyW lstrcpynW GlobalFree CreateFileMappingA GlobalAlloc GetModuleFileNameW GetModuleFileNameA FindResourceExW OpenProcess CreateThread GetExitCodeProcess GetCurrentProcess CloseHandle OutputDebugStringW GetTempPathW RemoveDirectoryA GetFileAttributesW FindNextFileW FindNextFileA FindFirstFileW FindFirstFileA FindClose DeleteFileW DeleteFileA GetCurrentDirectoryW SetCurrentDirectoryW WideCharToMultiByte LoadLibraryW FindResourceW SizeofResource LockResource LoadResource GetProcAddress GetModuleHandleW FreeLibrary GetExitCodeThread ExitProcess Sleep WaitForSingleObject OutputDebugStringA GetTempPathA GetCommandLineW DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError RaiseException TerminateProcess DecodePointer

user32

PostMessageW SendMessageW CopyRect UnregisterClassW PostQuitMessage InsertMenuW AppendMenuW DeleteMenu TrackPopupMenu CheckMenuItem DestroyMenu CreatePopupMenu ShowWindow SetWindowPos IsIconic GetKeyState GetDC ReleaseDC SetWindowTextW GetWindowRect GetCursorPos LoadIconW CreateIconFromResourceEx MonitorFromRect MessageBoxW GetShellWindow GetWindowThreadProcessId wsprintfW GetProcessWindowStation GetUserObjectInformationW DrawTextW FillRect InvertRect InflateRect OffsetRect DrawIconEx GetIconInfo LoadCursorW DestroyCursor IsWindow DestroyWindow SetTimer KillTimer SetCursor SetRect IntersectRect UnionRect IsRectEmpty EqualRect PtInRect CharNextW DestroyIcon SetFocus GetFocus GetWindowLongW DefWindowProcW CallWindowProcW RegisterClassExW CreateWindowExW GetDlgItem GetForegroundWindow MsgWaitForMultipleObjects UpdateLayeredWindow MapVirtualKeyA CharLowerBuffW SystemParametersInfoA IsWindowVisible GetWindowPlacement GetSystemMetrics EnableMenuItem ClientToScreen PeekMessageW DispatchMessageW TranslateMessage GetMessageW LoadImageW CreateIconFromResource LoadBitmapW GetSysColor SetMenuContextHelpId SetForegroundWindow GetMenuItemInfoW IsMenu GetDesktopWindow SetActiveWindow IsWindowEnabled EnableWindow GetClassNameW ScreenToClient SetCaretPos HideCaret GetCaretBlinkTime CreateCaret GetActiveWindow InvalidateRect EndPaint BeginPaint UpdateWindow ReleaseCapture GetClientRect SetMenuInfo GetMenuInfo MapWindowPoints SetWindowLongW SetCapture GetParent GetWindow MonitorFromWindow GetMonitorInfoW TrackMouseEvent AnimateWindow SetLayeredWindowAttributes IsZoomed GetCapture GetMenuItemCount

gdi32

Rectangle RectInRegion PtInRegion Pie OffsetRgn IntersectClipRect GetTextExtentPoint32W GetTextColor GetStockObject GetRgnBox GetClipRgn GetClipBox ExcludeClipRect Ellipse RestoreDC DeleteDC CreateSolidBrush CreateRoundRectRgn CreateRectRgnIndirect CreateRectRgn CreatePatternBrush CreatePen CreateFontIndirectW CreateEllipticRgnIndirect CreateCompatibleDC CreateCompatibleBitmap CombineRgn BitBlt Arc GetDeviceCaps RoundRect SaveDC ExtSelectClipRgn SelectObject SetBkMode SetGraphicsMode SetRectRgn SetROP2 SetTextColor GetWorldTransform SetWorldTransform CreateDIBSection ExtCreatePen GetObjectW Polyline SetViewportOrgEx EnumFontsW CreateBitmap GetDCOrgEx StretchBlt GetCurrentObject DeleteObject GetViewportOrgEx

shell32

ShellExecuteExW SHGetPathFromIDListW SHCreateDirectoryExW SHBrowseForFolderW ord47 ShellExecuteExA SHGetFileInfoW SHChangeNotify SHGetFolderPathW SHGetSpecialFolderLocation SHFileOperationW ShellExecuteW SHGetFolderPathA SHCreateDirectoryExA

ole32

CoCreateInstance CoTaskMemFree CoInitialize CoCreateGuid CoInitializeEx CoUninitialize OleInitialize OleUninitialize CreateStreamOnHGlobal

oleaut32

SysAllocString SysFreeString VariantClear

advapi32

InitializeSecurityDescriptor ImpersonateLoggedOnUser GetSecurityDescriptorDacl GetSecurityDescriptorControl GetLengthSid GetFileSecurityW GetAclInformation GetAce FreeSid EqualSid CheckTokenMembership AllocateAndInitializeSid AddAce AddAccessAllowedAce RegQueryValueExW RegQueryInfoKeyW RegOpenKeyExW ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetKeyValueA RegQueryValueExA RegOpenKeyExA RegCreateKeyA RegCloseKey CreateProcessWithTokenW DuplicateTokenEx OpenProcessToken RevertToSelf SetFileSecurityW SetSecurityDescriptorDacl LookupAccountNameW GetUserNameW RegCreateKeyExW RegDeleteKeyW RegEnumKeyExW RegSetValueExW CryptAcquireContextA CryptReleaseContext CryptGetHashParam CryptGenRandom CryptCreateHash CryptHashData CryptDestroyHash DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW InitializeAcl

shlwapi

PathRemoveExtensionW PathFindExtensionW PathIsDirectoryA PathIsRelativeW PathCombineW PathRemoveFileSpecW StrStrIA StrToIntExW PathAppendA PathFileExistsA PathAddBackslashW PathAppendW PathFileExistsW PathFindFileNameA PathFindFileNameW PathIsDirectoryW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoW

wtsapi32

WTSQueryUserToken

dbghelp

SymInitialize SymFromAddr SymCleanup SymGetLineFromAddr SymGetModuleBase StackWalk SymFunctionTableAccess

ws2_32

setsockopt accept closesocket recv send socket WSAGetLastError inet_pton __WSAFDIsSet select WSASetLastError bind connect getpeername getsockname getsockopt htons ntohs WSAIoctl WSAStartup WSACleanup ntohl htonl listen ioctlsocket getaddrinfo WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect freeaddrinfo recvfrom sendto gethostbyname getnameinfo shutdown gethostname

crypt32

CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringA CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage PFXImportCertStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

wldap32

ord26 ord22 ord41 ord50 ord32 ord60 ord211 ord46 ord143 ord27 ord35 ord79 ord30 ord301 ord200 ord45 ord33

iphlpapi

GetAdaptersInfo

bcrypt

BCryptGenRandom

gdiplus

GdipGetImageHeight GdipImageGetFrameCount GdipImageSelectActiveFrame GdipGetPropertyItemSize GdipGetPropertyItem GdipCreateBitmapFromStream GdipGetImageGraphicsContext GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFileICM GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdipDeleteGraphics GdipGraphicsClear GdipDrawImageRectI GdipGetImageEncodersSize GdipGetImageEncoders GdipSaveImageToFile GdipDisposeImage GdipCloneImage GdipGetImageWidth GdiplusShutdown GdipAlloc GdiplusStartup GdipFree GdipCreateBitmapFromFile

msimg32

GradientFill AlphaBlend

imm32

ImmGetContext ImmReleaseContext ImmAssociateContext

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

901KB

Virtual Size

900KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

180KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/uires/image/banner.png

SHA256 9216297505275118bb1ff24ff4cd39b5019e94f0109a643bf43211cacff86e10
MD5 400a1bc986d2338f28b81b1952b8c0c9
SHA1 50645d53eb9330dc1553ab43ddde5b00cdf4a40d
SHA512 b02d5ef2d1c498d2c38c7423286715e16200c40083ceb4e7317910a2643d494abbc86356c8934951ade49b970d2809b434cc53b394c672eca1de1df6fa3a8c76
SSDEEP 384:EHlEUcFLG/makLAEpcBM9o0nsY/+19iMK5TjWjZgtLE5fJEZREbXKYC1w8Uw7Rgv:E7c9gSAE6t0D++D5on8AC1wTw74
TLSH
T1DFB2D0972C77F04B1A4F2E7677C5C6BBE40A356329F32789238D954F8C85EB2111254E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/bkimg.png

SHA256 c036301f55e2c8811d19e18d88dc623a3d986250df19a0b8abb94173b0e13be3
MD5 5dedf7cc75c9288c1b72caf57b6ac986
SHA1 b57ee8b261d8fa5fd9c85bcc19a5a4690aebdb13
SHA512 5b14027feabf43170ebc5e4807e3773fffab3d982bcc051e74e6e6ffd67dd5e5d7915846946e8db5316d0c174f793c800bf9d22df360efacb951e30ef586b6fb
SSDEEP 6144:5FdXvYO+egFGAh8fDJHGuSvq8dKyswydlSn6bZaB25AnLkxM7:5FNYBtgAhITWq8d8wySOaBOcYxO
TLSH
T129642371CF890D94D0E1DBE129DB95886F802613C8D82B16CEBE9917AE237B5F1B705C
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/checkbox.png

SHA256 b107bb3d73f8ddd4fb2a8249de4cbde78d3ff5af402f38d12a1e436101d7cb4b
MD5 85fc9ec156ede34f7f7ad908b2bbd81d
SHA1 02fe12f5b853ad30597847050cfa8fbbd5cb4463
SHA512 0c2818624df5a595fb4d052617cdace2406b5b806f940eaa9e9547d3fbe0605053a44856c50e2a04720859f55bd14eb23e3dfe5f6960d1627b22d911896fd428
TLSH
T120D02BCA6754C97AD80C483902772D20645B519A336331161D5630989265DA166DA272
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/close.svg

SHA256 2499f8650cc8fda9cc16c41ba2f6afe53e685b19cf89ebf65924a1cd207aba95
MD5 1a9a3c0b6b4e5a37350a3d814625b21a
SHA1 85ca4f255206a4bd2ecd680180e99cd0d23a8a81
SHA512 3c5e4a069de98d971f92fbfb32b02b48e92e012f618f28e10d61ac13157d04cacae6138390b30fdba1d11b4a947c07a0b5ab5f810eeee8a9217772f0fcd38abf
TLSH
T1E1D02B6DA38A4D3CB7324610FB2930F4D0BB41D3020D5195E4203033A02628E6CB37EC
MD5 SHA1 SHA512 TLSH

svg

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/custom#150.png

SHA256 20bafe351e8f53d3f455a8e51d8d9acf1656166d2414c5ef1027c7b52e5c20c2
MD5 122c7b3117f9b598ab3ea6a0fdc99562
SHA1 742b38b2f0ee2ba86665e8e01e60fd68a9d3fdfb
SHA512 64c51fc94b04aa2da69f87ecef534e4aab0487c8c91bf3898ba52e19b60ae8954002d46210d036c56a819d91f6abc36fd9eecb0aaa5519f7ee9bc2330821a2eb
TLSH
T16CE0E7D167066CB8DC89D973DB833C9BD8F3C195C447105D4031C4191F6030485C00F2
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/custom#200.png

SHA256 6e8d99766f3cdf3bd3e750cc174a33b875db32d62e2728193439242220bf8378
MD5 7a482bc59ef7d4b96891cbe446cc8955
SHA1 a1234bba827dcaca8182fe25935fcd45d5eb4546
SHA512 fc209319b3a1e2733dd817f5752eb2717b1ac9f0de532c511a9dc6386265b21c49d3fdb943da27f890092c4535d16d239a7cd90bacc9c75a3a65562e0db792b4
TLSH
T1EBF0CC3D0752C0E14597399701B7C91937DCCD30D5B820822C6E7CD162A7E01B3C15E7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/custom.png

SHA256 547b6eab7805ce5807e9a3b14d1a1830bf0bc21c4e77d2e63cbe42a6d81aaa83
MD5 4d3a611f0ed95bff868ae6da0746069e
SHA1 82a5477b56b0c4b83f2352634e3c30bbc07cf68e
SHA512 91b3c3b582d3c6e96721fa17082046647f7ef88f4ebddcc4a6a70ced177feed7e0aa41f6c14799bf87e6f08a5339723491e1ad10127c684969a783258134f232
TLSH
T156D0A767F3952C3DE58E8627422851C1DA6042892290EA09696B087C296998D84646FA
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/ic_install_failure#150.png

SHA256 b5935d78a758157f140ce90262276684061242e4d710f430f97fc0748f850562
MD5 52fb129f7de77b3a561ae3edc2ed4736
SHA1 14b28b3481ecbcb1d8419ab8947c17366af69bbe
SHA512 b947c5a70ca7a4a2d5887e7426549241f379df77c13a9a3ae18d10749a3ab050666d4c23efeb21aca487efa364ebf5c5e2229e6aac91306e6fb4b1d82ab8a273
TLSH
T11A512B26D6776D75ABCD3760BF146E08A03549B8B5D506D753ACC29EC255382398C820
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/ic_install_failure#200.png

SHA256 be5af0600da787071492ef32f20c6be64d6e22ec617ba31dfd1806bb748d82f0
MD5 ee10d3a2c61fbf8b65d747be7703b903
SHA1 68535bea2bca4ad9e6d8aadcb249d4769cb0cf9a
SHA512 623080aaef9fb9e4185916e99795de05b1f94ae5c4ae2720b09709a1a8a0d03e121a2d84a8a73f476ca725041147d87116fc0cbfd7d078920ecaaec59fb178c1
SSDEEP 96:FFmGg7cRmHgLrEpiXkPcp6tjOGZNtUXJniHUnG1Vmy6UkG1:mGgIaMqihp65d6YUG1Bf
TLSH
T1F5815C48A8061F5BA18A29D67A4E5CD94EDB060E83FD8E2B10DDAE3A39A15142D363C1
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/ic_install_failure.png

SHA256 5f9c674beef425ebd99bb3e5a711289533e994a32313339999808b9e0cb0ffa5
MD5 c4d5b55eaac69ca515f8e3a3feef224c
SHA1 2701976595daa66179a7649077f305b69f8c9a5f
SHA512 0e167fdf61dcf5e5926613f22b3a961d21397b6f0863f33acc9f68bc9cce1c52daeec2b6c552e19383cc2c3d6bd5d945eee49053e1b0d783c6a70bb8f254e5c3
TLSH
T1FF312DD3A2910DABF1CC452A52E812399F5D71C53D071338EA99855FD733C648C493E1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/img_waiting.png

SHA256 be1241ea31b09518052efa152cafd35b85e19276dba0ae28245de27b9a0f6ec6
MD5 b20fd24fc48e8612dd8d0e0c67abef70
SHA1 9f7d4da26dfa2e82fccd4dde6454e69c8f188505
SHA512 9772dad53f663db6b6127d1a54a213de123650f9841fb03e1180c0870f53ef2a8bd4ece624be76e87ae0938e8e97db469ffcb3a5e949b04650f30b563e730dc6
SSDEEP 192:WLltxpSs1KnzVWcxDN6WdFJ14u9OwOsIpkNWFU1wUATMUx+f+FNRWRXSxdwGT589:WnxExDdtvWLFU1eswRWR8kYc79
TLSH
T1C062CFAB09A3E5AE327B5C3B516533532D29C6740832754DA1CBD168B9B2E42850687F
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/minimize.svg

SHA256 0467b76595bc7567c13320e3ddaf514a1ad6be9a5ea9d609d91e4c4a647f83c2
MD5 080b45cd7815ad67d5701e7f8f222956
SHA1 be2911b6ec4814fff228808bb08015914249704f
SHA512 a793d80ddf7306cee3921866d74742656c92917629d39103acbbc62e60a38f1b6554dd66ec1b27ff0ab10876995ec135a6dc870a29fbe63f086ccdd0eb717572
TLSH
T16FC08078B08ADD04D7108514516854D67057E087565C0064F540323BF0A76C7ADF113D
MD5 SHA1 SHA512 TLSH

svg

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/msg_excl.ico

SHA256 0989ea289998ab75aec1b1ff64d96a8e11a29a605ae8736b8708cc1b11f3268f
MD5 e9cea909d73423d7f55aadb8b65395c7
SHA1 e6b3748061b7cb47a57246742701440f0c196325
SHA512 ae8f13f33f2be9b4f8776014fb3af4aae27b527c56f26649dac2f658108cdc8b05367fa1364e99f6aaef99943ea22cadf5754446c8a47336d5971678a82328b4
SSDEEP 24:su05M0kXbVE5zwh6fQo+XqluRO+0LbqkaMr3UtWUNw/:muvE1BjlwO+SrMW8w/
TLSH
T12891DF15B2362FD5C4F14A3444168E86EB11FE5F402BCF273779BE8A2DF1271AB4A101
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/msg_info.ico

SHA256 857bd8dc0eeeca1a444cfc9d7b5b780aa3fef161b783828648cdbb48eb76a428
MD5 2ae6e5fc2a61f1c4ecd46cc271f0e1bd
SHA1 017faaa53b89bbf05cfa7629df89673cc7717674
SHA512 4a0dfaa42e459f87a5dc411dbc82a6479fa0b82fd8b5516c259b8b2ef8aadd3484699219c89c757666356efd1b4b70aae9acba3333d5e6147ad6d5c3f5a4eca6
SSDEEP 48:u8DSZR/eLHEbCV26sA9kwwVYNHGwwfHH54b:HDSZR/eLkMp9kwwVYNHpd
TLSH
T17DB1D2092391D95DC4117DF8E068ACF6368A5D128D501E62C13B3E2F2A38533CE7AE7E
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/msg_ques.ico

SHA256 8290767ff02f09be6267f03122e791141c95ed6414c7a224e868d60eade2b1b1
MD5 83230fd3b02660a9c88ca60f07dddd5a
SHA1 e311c43c0129dd458e91dbc969762f383f9594e7
SHA512 cd903f654c760f985d679d28bf4d5b7c8a7c9757cdfd10aaa21c3b66c097d80c9cc1695d425cf40a899117d8e6640164e9ece3a544afb78e5a53888e5d290b5e
SSDEEP 24:suu0OvC9O5HGVmaHqGbEESHq0TKlWZO72ugqPqYHXYYvC9lvUUtWUNw/:Gvedm2quH/72u3C4tvezW8w/
TLSH
T10A91D456AA20C25DC41EAC34D0B65F747BD40CE2ED102979E5067C972B7A0B2F532CF6
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/pathpg.png

SHA256 5d9c9872a8dd4d55b13265455e8a44d5533cd61def040e9854a331c7e518de6b
MD5 ee80b122a7a78df61522784d006d6d1e
SHA1 55e89c2e827ee5452c811b3245c0886526533b20
SHA512 82a767dccdb07a2514d3a4918e06f80cd83963e5075d82fdd7536097446825b97baa60280f2061c25fc8f037d9310ce1835024dbcbf09c8f44ecaf6ad3174934
TLSH
T1F0012851634862ADF40D755F4742A713C97F17F75237682D66BFC0B1176D4858680EC1
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/prog_bar.png

SHA256 3f40dd9c0f9f537af89e586fe5ab444ee31363b16dc3e550ba2b6c0c66987ad8
MD5 a5e7cc907076a0faedd58c07be9b51d4
SHA1 b5cb775d8f84504c8bc1b277f3c805092615dbe1
SHA512 f3ab080ac32de9a3e8d036984b921d6f173e8e2436abbdefe030a90dbbff8ebaa6174ec384e37b7ec9698883af979e4aefb97cc58fb0980cd2131a5bb1dc9a99
TLSH
T1F6E07DD2F8888D29D22D87BDD1E70748D43F75E59042B57F5E04C1305DA1070DC39282
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/prog_bkgnd.png

SHA256 d210f0afcfca471087756355e5aaae701943adaeae9ed015e2f78e6e648cff66
MD5 c9e1012bf8d1d32358bfe5a9333a66b1
SHA1 7b6db6e759f7806bc67e76844189dddeb4c2e39e
SHA512 c524c9f5e0ed43ed6ee20ce92909948f2cfe044038f4affde6e020c8c0cf928013c9cf84303ea6eac96178cc9422366a7470c44c87b1a22a6d317faddd162620
TLSH
T19EC02BE3CA405C6CEA4D1436111F0110902B1DEB0410980C2C24E41804A84E80A81203
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/scroll.png

SHA256 1db068065aa68b60a4c48ff06eff0231db074a5efa3f905daff7cf7108ca4a68
MD5 290b7010558cd82f957a98614c9e0097
SHA1 f90fa0fde9b804f105d2ac2557c8586b570bf1ef
SHA512 6fdba4c37cd4ecee91fe45b80c3c19ae58e830f3a0fc0153b6575ab66dfcad87bbb0825113b5e9b90e3f5c90a3a3f3f026dae8e7c364c9dbd1c4e9313770e4d9
TLSH
T1C331D70EFA513801B44DAA0028EC0C22CE394CC0DE94A5296849C4AA17B47FC90A59D7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/selpath.png

SHA256 3d8a0ed1b0238d7d5498efae9cb1529cb608f05605de8d0a2d46bdab0d46e273
MD5 c072455093bca8c20c230e6339a43cc1
SHA1 9197abdee2f4666e996023a7a7a5ac9827122cfd
SHA512 ccb038a91000a06ee37b2d508092777e50e57c7f39ed8606fbf41e504a203a9e57f97da19c34aeb0498ce9a149ea966ede3e4f9aef8df03a9be60694b06c2324
TLSH
T1A1F041D219A9E83E4A87E02D5A0B0462402A8BFB365B371879B9051A92258DE8963042
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_bg2.svg

SHA256 440432926addb5458d62355303d5431c4caa47e3fd7e1eeaf0f8bb08126631d8
MD5 8edba98ae74a0151037e9ad025f9b58a
SHA1 e6cd22478a2860ae07b775719c8ed43e280947cd
SHA512 98a50707b40e61d44383bb20a7249c5eaff3ab34e901a15972b9e95d8e06d05b25fcdf296e7a06bb530e3306d5ec576807e3a59318f69d6d690009317918850e
TLSH
T1D3E026A4EE8C20008131828DAEF8881AF313A05B12750C48BD91673B2F309C13CED3BD
MD5 SHA1 SHA512 TLSH

svg

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_chk0.svg

SHA256 6ebd19423872345b8632f9f2f48c5dd9299f956616245385656d72535853a3a8
MD5 54ad1db327071a8ec6481ed2ce4e1234
SHA1 287377f3d97f242255820800f58eea5f44648d91
SHA512 71a1996b627786b5c97ee73a247f58b256e60c3884229f2b7a87893d49c4822f0797f615fef52503cb7e116fa3eb60acdc629d8d3cf5ac75939b367e5553a8d9
TLSH
T136014C5861DB44240121C916E3F4E6D4DA2DE14346862069F68D3117AF31CA907AB35D
MD5 SHA1 SHA512 TLSH

svg polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_chk1.svg

SHA256 b44f35fc7ead2014ef293f7d9423b5c884a07fedd6779d91f8a56f49de4cd72b
MD5 26f3989465946cfdde11dd92ee5d4362
SHA1 3b73f670964def26a019d6103ac7f35725bfed76
SHA512 9d410b78d13280b46770aaaadac4eabd56e9f9f582718e7d7a07b8d03a1fd0b8eb732e5620d3ec408a7841f2f578cd4d5c0761c23384fad3d7c93096f5ea07e7
TLSH
T1DA31A294A4EB40194037C656E3F4D6A5FE6E928392C64478F28D321B7F318ED4BDF245
MD5 SHA1 SHA512 TLSH

svg polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_logo.svg

SHA256 1df8b17469ac1e43fc5d71086a2f143372406d58aa52a2db8437fbdcdaf483a1
MD5 f1b31b9eaee50c13137e6c2886b2f1d3
SHA1 61dcfd45936e81fffbd69a7b7a21d4cedd91aa80
SHA512 ce11bc7e3e89314e9398fb05360f636354681c2ce8ba684d0d993eedd049450f7157d2bfa65277b1912b5949672895c37e521d9fffbbad8a76dda31ee944d2df
SSDEEP 768:egpMaQyYKgXxbjhUvFDTGRAvNSagCnIge64LVa1VlcsKM:eg/5Exbj0GRzaLZlncy
TLSH
T14EF2E172F9915BB4188523B8E2672A6CCA235EEF548125DCF24D5BC407A3C989E1F4CA
MD5 SHA1 SHA512 SSDEEP TLSH

svg polyglot

Suspicious SVG script tag

svg javascript
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_memo.svg

SHA256 79cf5bc5c567884eae49a28e893d8d30cc9655aba1e0336ea9bd38d2625547dc
MD5 e4c260f1bb78038d23c8068419bbb563
SHA1 50604b3c3b403b7e3cb0f6af6955e4c4792a1735
SHA512 c9d74316ef8282ac5581ff1b642fc1177d60f688988f69f7f249eaa895f5d651dd2b3a01f1b963b3d3276c2ff30e79a62b3519da88fac99a0a34fe0d8a4743a7
SSDEEP 96:bdCCTp7w/qyPojDOX+U0ZiSTNhV+h+gybZ0OgsdbdJuLO:skp7SPoi+U0ESxhV+hNs0NsXJ5
TLSH
T192A1E7EC42CE12FFF2B1E700E2990642E665346716856048BA2F56473B328F8056FDA0
MD5 SHA1 SHA512 SSDEEP TLSH

svg polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_memo_text.svg

SHA256 ecf7538f1e96a96ec8aa0d4a8151aefa732779902a65535020d2edbeff2e91f7
MD5 6494e6aa76d11b410c265dd508c930ec
SHA1 784152e4f25f55f51d2d79372c32b635fd58ee34
SHA512 a371f30ff54048453766787bafa53a5a331d248af9c8e7c9155d2d2746b99fdcd0b59996d72a0208a957e57232eb9ca1da2fef59169a9cef680480e97ad5d27c
TLSH
T108019C4C45D698148230C926F3E866C6E5BC51830BC54CA8F39E6317AF32EAD079F309
MD5 SHA1 SHA512 TLSH

svg polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_sep.svg

SHA256 f0b7b00d8e0810e45b13e17c46210e1384b13d145a6e2bcb748810043e4425ef
MD5 aa272934f34e3562b5dd698f239847dc
SHA1 76d44b4d300b9c7672b317ccb478ca974fc82d8e
SHA512 527e18ce1df4406ff5bacaad6e98926c3b79358be02d6f6a65efe09f393f4cbf3b5b0f3da8f0db54aa2cccf31e6272ed36c7755778100c3c3cdc6a06c0a2eb05
TLSH
T1A9D0133D458CD83E963157565A68E4E4111F5053C34D2196AD41343A74455D32C3F5BD
MD5 SHA1 SHA512 TLSH

svg

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/image/un_title.svg

SHA256 14a87147324e99a61a6bc43e0500a0091e5684066901cbff4553243094317ab4
MD5 f4aac0784e1579614fb125b837f26858
SHA1 72f5829c98353611f64494d34320561e5a61088e
SHA512 cd534e10469f1d335731e936a138277f19f312d8cbdea202f0f518708de17dca942da0e5627e7b9cf0f7bb040a42578544f2f31686a6e756ed8f1a87ee549a34
TLSH
T14A019C5845D598219132C529F3FDB7A6F67DA1C709814CA4B5CE2023DB31DA6139B388
MD5 SHA1 SHA512 TLSH

svg polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/uires.idx

SHA256 bef417c0dad02b87c5ad1bdab3c600fc4879324b0c9512ca3892cb350c53bea3
MD5 37e285bef014c6fb8d55552b3b31b68f
SHA1 e0a498b15cdb13fc7706c7f8076b4bf18d48cd1a
SHA512 b20c8b5c12c2eff1d745f5eeedf0d1e0d5cb934b6da27abc5fbdc8d323bde74d899b4dbb3e4a9b0c21121a423c96267a8ab9d841235b5159ea3a1428e2bcef00
TLSH
T1B481C52455C05D5289ACC2783F7B2869E952CAEF592DB721729B3C3ECE6744220BB4C7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/dlg_dotnet.xml

SHA256 f915b76a42cc49dccffb0befedef52786aaf23cb7946453e071809642403ffae
MD5 17e0d8a4ef85f9c1580568f935967305
SHA1 9925650fdded9f8ff48e906908de8873e69c6a4a
SHA512 7bf3cfbc20ca255245b4e184c5998c4c76b5074f75aff00cf674f1e2ec0a60ce985cdf94b2fb3692f7b5ee74bacdbee66d81ddf7a71d8ee61117d2a9d6fd5354
TLSH
T12FF0C006FDD08E1006B30A540BF2C99667C4F0AB0146B4787E6E65238F5D6868D07278
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/dlg_main.xml

SHA256 b12f96ba19a92caf06f5fc2f0f6d8bdd70fbda43ad5661bbe8cc197b52466c99
MD5 7a47de3ec451345da4945fb8dbd7b0e9
SHA1 4e04155eb898cf07eeb8bc4340ec67295ef62650
SHA512 c329bc7bf5a21b3470d9887a73963633a84f52a9d7427cb5354e55e0c977479430a18bd42446ca9557fa682de481152b35908efb452179e3e7b9e5bbff194962
TLSH
T108316C2295EC5E30557307B83BF94D85EFE4209B0B206421B86D3753CF35D99A84BB38
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/dlg_sel_channel.xml

SHA256 7f5a759ca335e3303d8cb2c54577b6bff0122586ab6270b6e894d4f89ccb5a9c
MD5 15d479083a1283f0b77f59523f874f48
SHA1 88e507459444b2ddd923f50847cd7d3b80c41acb
SHA512 8e11a4adcdc29dd07dd7bc34f3cddfa6b670fd496ae4fa1f385fef4ae024a42c1a1d24da046221cbbe0dd11183f635898658a30489cbb4b11918904d637d783b
TLSH
T1F051AA025DE82D509133C6A53FA5FD83FBE6D4966601B6A0B23D6A435F35E43D80B2B4
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/dlg_showlicense.xml

SHA256 00c0188e616048f770fcdcc558033c82f22431b9c8aeb62399d8a0ed4de56c38
MD5 5b0dda8994b9fcf75600b6d428033b72
SHA1 b5294c8af6d77ca1d64da44fdc31d6c41f5bce7b
SHA512 2bb4118ecdc81f3b5b96bd7181ae7b3b0314d3aeef9db105dd4a36a997754939fc5ce7e38a239ca2cac9607502669c418003e310efac4d38514a85ff47059a34
TLSH
T1A8316212CAD89F16D7725D58AB95F148EAF2A1CB0184CEB0F48D940B6F57CA3C403236
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/dlg_waiting.xml

SHA256 d9a2e5a69554c3df029b183e18ced9916a90b8eb8fd29c979e6ae8e808acf9ec
MD5 9515be07e084154b85e0fdcee331d4f5
SHA1 6f51a72caaac2fcc4b6bb7ba085190b9a599040e
SHA512 8c573995b9c68520d05e07b2409fd391236a81c5fcb77094e882278d3f09fb4528b64c621e7f0f58267e52ee5f0d7e72648a4e70a76e89ab3f26a9ccbc5df01f
TLSH
T17EE05502B9E00E154333447826BAE186AFE9E08A070AAA70F468562B2F48817CC1B238
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/init.xml

SHA256 5e22f56f319bf5af3228c484fade0beb03f6e476fc25b46f6d8dd66e145989c7
MD5 7c851fcc35094b990cbb9978485860a6
SHA1 af91fe5a7cf49a1ae23982881717c78de4061c9b
SHA512 292ed92ad163c366701a152eddbdb2716374e782e5d7ee4980484ab7cf37957d356a4bd41fa8a96d30acb4d7662f124fb5f5cae80cc18a2e535a309e959b5ed5
SSDEEP 48:3bn47PKSH8CML26AC/h79jNMa0TXTMPult/QRq2+TlZfoA5izOpwlIYfZubqHHgK:L4mUMSBZLP5KvQmaE1XFMk5UbCiKN
TLSH
T14A812080D9DDCE1A4F7249974A905B2FD2A8D0D3402C2D1874EDB957BFB388200BF36A
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/menu_tray.xml

SHA256 64d65fd832522a3987f11f1f0eb148e256c8eb9c0a168d516fc8c120bd463bcc
MD5 b54257cc327c17a9485f8b655408c38f
SHA1 b1eb993313a12348d2071612f1d8b9781010f580
SHA512 2398202f711c67fb015af922fe655531b51476bcd5a6e99635f865154e47714444befb8cc8ef48c5d94943d2e812544328602df098d06ae74277e50452a1acc5
TLSH
T109F0C8383DF89E626339722137CED00072D4A88ECFCA481031AD04CE46A3554557377E
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/msgbox.xml

SHA256 f003e3c0e1e0abf6756e7c6a6d25815990af1f3010d3053a3608077bf624d4e7
MD5 a5b2377b20194cabe8ea2a454a47cee4
SHA1 646c44fb570f731083a430d9d216c59570a75403
SHA512 505c4a59bd85f5110e680e552ef172fda042f2414906cc08eb954f9f0c31d57b85cb359da784b68549a9820538eff23d37cfd8e99f8d5f1b856c3419b9c0d6a8
TLSH
T1F741BF9098D45F124373805C5B9ED68AFFF2A597C548351DB9ACA3A34FB1D2AC84B122
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_agreement.xml

SHA256 4a1c8b300ffcadfe35a780c387ac55ff68fbd81e5c0aa15fecf025ad4e1946d5
MD5 4ea787d2303f77bf0af627480e2726d9
SHA1 6d8912ead60877019d03c29494e40e63510e6abd
SHA512 b6a9a2a71a35ccc9b95f1cce90660eb02c3b7a9e95a829d795c30954700b6b216f1051a9b90cc04fcfe3033a150e61483d829cf0e624f3ce5d8e1c0f00f9e25f
TLSH
T189F09E10F0F82C3E83F7443C1A05D61033AD73A345491A057459ABF647609F86D47271
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_choose.xml

SHA256 164415ca6452bc489bff48bae16cb54c76fe83ad72311ee08fb61415168b99ce
MD5 dc8cd7fbbbb5077298cd1cc3ad934529
SHA1 c3d5612af3737bd169cfda39a3125b7ec2dae1dc
SHA512 bd0e813925fb45f6aed7d2827156b6eb4f28a5cfd5e961586140b18ba2c847a8da1105f87f88dde626ec8bcef193582ca99a00cf5429998f487c053b39752cb4
TLSH
T1BAF027014AE86C2280B3811417D5E9C5EBF476CF0511A568BE2E2BA32F3AC8349875A0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_fail.xml

SHA256 b4b3d719e607128b59c3a9f2b5b96e82b04146195e6e7807abb74434bdec25b0
MD5 a02f8ecd65c2d9579c31910797d3be29
SHA1 65e1b8e68b51f73d2a5bac80805323212e3bb7f5
SHA512 0348748424acbd226caa48eaf58366b67c1e71880f42cf412e95760a62a71f9d2a7f708d78dc2a87b5ad996e05e22fdd1e038f342415101061834017853545ba
TLSH
T198F0460259E85D62A5B3C268AE23E8C3FAF971DA0600FE64B56D5AC70F268534947322
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_finish.xml

SHA256 1e14889331c960d2738f1a659ba18812d6ab5db7bbac5758eb4de7c8028d2b7f
MD5 69ccb2c2001f364004e97a2691f99e94
SHA1 71f69dfd9093cff647ee1b807b12ab60f0af1cb1
SHA512 5cab9d33a1df46710935886d9de7f4b6f764021269a8b8ecbe579b4859f0d798c8929fbb2c47a48721ff15e9f6740a117b5359cd00e36c84f2d571cf1fe7b962
TLSH
T1A5F08B0245E89D219273822C5E62DD8692F8B1930204FEA8B09819E3CF15864851F331
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_installing.xml

SHA256 8402e938c903c9b50b6138691c6905d65787f2e922f7d809d0a6408deba063d0
MD5 a46c5d146d96ff7e0c62aae1fd3e2a1b
SHA1 283940dd691efeb030b1abe57bf891265a10d190
SHA512 7ebca226a35ce0e1c070bc438e7bbc82c38181f7d7ba6184ee92f89cdc9afd9991bd4e272d21bbf627fef9e08be030a8b66bbc9573c9a6bb5d32bc89968cd415
TLSH
T127F07811C9E84E248933C86817C2E6525FFCE18E1114DE88B59CE5979F14F5B4D03251
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_unstallchoose.xml

SHA256 58398bc4204ccadb89ac60b00bfeb0dd1cb86589971e11f1f8b17932d3c0a0eb
MD5 f13fb8cf22d59c6b2bbdb603427405bb
SHA1 4bf10c1c431b2a6b3559e321cc67618a18240474
SHA512 d2b4092779eab54e7026d88759b54a182905ec8b0fc723b25654c85cb39f9cac55184facf9f26cad272c54194c30ea832c4fb2043a3bdea38c36730f278d7998
TLSH
T1F171BC02CD9CDE10ADB349582FE3E98686F0A0D7160A6EF8F5DC6553AFA1D93C44B136
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_unstallfinish.xml

SHA256 dae8233efb98b82dbeee3fe584363fec235197cb93e26da4997e1b84a1543fd1
MD5 88e77b2fc42c8feec0133ac20ca7a862
SHA1 019a6e3bdc41b4dfb082786728bd8dd0fa1db789
SHA512 13f872ed8d10887487d9397f5b10d8ddd4b25c272981c16f51ec40eefad84e83b3061f61aec7c8713289fb33c145db600cc0fc3b2cee91e633b6fc9ab20c1fa7
TLSH
T172F04C0689D88E10D272C1647B11E987E6F5F0D32500FF78B55808C74F558975D4B320
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_unstalling.xml

SHA256 71a25fa0fa5313e555d302ebff43bf74f665222ed17b44ce5690f41da3422cea
MD5 78256186f29bf446491301482cd972d5
SHA1 c1ddfc4d4fd22683071eeb41e89b78eb9d4ea3cd
SHA512 f5014e125844d209a260340b34f63fae6600889828a6035f1bb948949de800764e84b3b7dc25e9551b1c573ed9bffc8b3b9d823a05c02eda1ac12adb36d75f1b
TLSH
T1E8F04C02D9EC4D258533C86813C1D6125FFCE58F0114DA48F95CE6578F24F574D03261
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_unstallstart.xml

SHA256 a80a0a50dc4b464d23d5ac1367b9c249d9b0e52e5f8b079050ec5133b8763fdd
MD5 046924f08dc33570fabd68e0453d3922
SHA1 0097f3de665a6fee825b0f14825eb4df97476028
SHA512 e5fbcefed97a10abc58684a00a26f090b7dc1362be65c97000da8f359b7c0ccf4b90d7146a89c7cb00d7f1ac8edaaef9185188d6ecbc00219b7fbe02d1c4b978
TLSH
T1384111525DF88F122573C54D7792D882D2F8B1EB0A01ED60F86E76739F0AB51D44B239
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/uires/xml/page_welcome.xml

SHA256 19fab57ebaedfa67ab0a73751347ddff7f1747f181414e5a95f25e59dedcfe6a
MD5 e8dcd4c1f4c15a812e90505de38b88af
SHA1 8cc6eef9ee445fa182761e26bed357e44f67d178
SHA512 5238227988931b95908fda439be8564957a3a05a0043cb673d1e1790045cc05058cb40a3e36796785e5a80970e9235cac3e275bcdc3751c40691205ee089911c
TLSH
T18341E30369E86E320533C9187FC6D982DAF5B1EB0549E924F59DE57B5F2CA934807131
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 12db8c1d8c15b60b4b1dbd2f79989621f344fd1a2b4b6a50169a7d0ab18558bc
MD5 cbe459394e0127d288a6d1eda385ac3e
SHA1 ebf49b90ce4d101bb70e2c9af564d71663b5d5a1
SHA512 d38aadf3517a92273f215f22e956fd4c3cf9e84c922f805bac6440616a2bcfde8183b3dbe42f4629ded23edd2ca4cd67e065edbf7216f22f5aff96203095aaaa
SSDEEP 1536:/+4amoyvoQ/MZF6uP3IA7HFpGM7jnojBGAfQyTWjbblP0Ybtve8BaeNdpgsYcQ:/+KtvoZ36uPb7HFpGBBrCbWQtG8EZCQ
TLSH
T1984415B23354C7D6D4A2027188AEFFA5D960ADF426D4C64AF2503EDAAA71343EF0D315
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13655

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

FLiNG_Trainer_c10.exe

generic

$PLUGINSDIR/BgWorker.dll

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/config.ini

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsInstall.dll

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

shlwapi

version

wtsapi32

dbghelp

ws2_32

crypt32

wldap32

iphlpapi

bcrypt

gdiplus

msimg32

imm32

generic

$PLUGINSDIR/uires/image/banner.png

$PLUGINSDIR/uires/image/bkimg.png

$PLUGINSDIR/uires/image/checkbox.png

$PLUGINSDIR/uires/image/close.svg

$PLUGINSDIR/uires/image/custom#150.png

$PLUGINSDIR/uires/image/custom#200.png

$PLUGINSDIR/uires/image/custom.png

$PLUGINSDIR/uires/image/ic_install_failure#150.png

$PLUGINSDIR/uires/image/ic_install_failure#200.png

$PLUGINSDIR/uires/image/ic_install_failure.png

$PLUGINSDIR/uires/image/img_waiting.png

$PLUGINSDIR/uires/image/minimize.svg

$PLUGINSDIR/uires/image/msg_excl.ico

$PLUGINSDIR/uires/image/msg_info.ico

$PLUGINSDIR/uires/image/msg_ques.ico

$PLUGINSDIR/uires/image/pathpg.png

$PLUGINSDIR/uires/image/prog_bar.png

$PLUGINSDIR/uires/image/prog_bkgnd.png

$PLUGINSDIR/uires/image/scroll.png

$PLUGINSDIR/uires/image/selpath.png

$PLUGINSDIR/uires/image/un_bg2.svg

$PLUGINSDIR/uires/image/un_chk0.svg

$PLUGINSDIR/uires/image/un_chk1.svg

$PLUGINSDIR/uires/image/un_logo.svg

$PLUGINSDIR/uires/image/un_memo.svg

$PLUGINSDIR/uires/image/un_memo_text.svg

$PLUGINSDIR/uires/image/un_sep.svg

$PLUGINSDIR/uires/image/un_title.svg

$PLUGINSDIR/uires/uires.idx

$PLUGINSDIR/uires/xml/dlg_dotnet.xml

$PLUGINSDIR/uires/xml/dlg_main.xml

$PLUGINSDIR/uires/xml/dlg_sel_channel.xml

$PLUGINSDIR/uires/xml/dlg_showlicense.xml

$PLUGINSDIR/uires/xml/dlg_waiting.xml

$PLUGINSDIR/uires/xml/init.xml

$PLUGINSDIR/uires/xml/menu_tray.xml

$PLUGINSDIR/uires/xml/msgbox.xml