Setup[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/Banner.dll
unpack001/$PLUGINSDIR/GraphicalInstaller.dll
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll

Setup.exe

IMPHASH 56a78d55f3f7af51443e58e0ce2fb5f6
SHA256 a7439ad10f8374bd27dded63d74f44d35d884093d6f78b44707fad66ebdc8a43
MD5 47046d79884fe1e14545b55408e6c0ae
SHA1 90c6e22b07012c6d9a73b99d215439f61dcf7127
SHA512 5163303d424ba6a3f4719e01a28de82ee809f2c56386011c4397374d2531102c28a5dbcd27e869d8bfc4b84307af642ac57d570931e9f55ec82609dca4fae1db
SSDEEP 6144:3bE/HUG2OWmmldovHY6av4TVeO7+FU1FKLJBOFg45n734:3blO+d4YxgTVeO7+F+KnIg4b
TLSH
T11E2402017660DCC3D8E387727A3E973A99BDC27E52746E871304AB2D2E522116B5FB0D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

7d:50:ba:7d:60:28:58:2e:ae:39:37:26:1d:21:77:43:99:a3:0a:a8:f0:cf:b1:d0:be:ba:b1:5b:9c:e3:01:c6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Chains

Apr 24, 2025

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=515636181,CN=FAST CORPORATION LTD,O=FAST CORPORATION LTD,L=Ra'anana,C=IL,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494c

Serial Number

06:62:d4:4f:a2:c6:b6:3c:c2:1a:f9:d4:95:a1:b4:62

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 19, 2024 - Feb 14, 2026

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW CreateFileW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/Banner.dll

IMPHASH 767a5b32183c6c4ff645882480adc9a6
SHA256 39e3108e0a4ccfb9fe4d8caf4fb40baa39bdd797f3a4c1fa886086226e00f465
MD5 a1b9bdee9fc87d11676605bd79037646
SHA1 8d6879f63048eb93b9657d0b78f534869d1fff64
SHA512 cd65d18eca885807c7c810286cebef75555d13889a4847bb30dc1a08d8948893899cc411728097641a8c07a8dcc59e1c1efa0e860e93dada871d5b7acc61b1e5
TLSH
T15981523BB2E04EF7E562023300831BD3259BA9146768461A4E6791ED764A997D53CB02
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/GraphicalInstaller.dll

IMPHASH ab542e8d71bef99219876cdf6d2bf4e1
SHA256 b3f434cffaec74b744edfeb916cd54b2fd0404319178c674e46f6bc65c6e56cd
MD5 6ff9aa6c53a5035789f57fa3339267a0
SHA1 dc7603910c8ff0ffb9364cb5e5e2b6afe6f6e72b
SHA512 981064b4bf3d2cae0afb1baebce2c0f7379eacec8d64c85293754a4c43f74a33fd07a2a6cb949504b9d8662600f3ac24512eae7e3143c1242f679c7473074d02
SSDEEP 1536:v2JZgqik14o+q5qbCfKIJPcFytROki+GNjFcspf8U5JsIyjWpk6:+JiCjt5qbOjJUFytRr6jFR8U5JsFqpz
TLSH
T124B35B15F2409838E0DBC13D46B5A2F1C9DFBDA287D058E73729AB657B726C09930B87
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

67112

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

uxtheme

CloseThemeData DrawThemeBackground OpenThemeData

comctl32

ord410 ord413

kernel32

GetStringTypeW LCMapStringW IsValidCodePage GetOEMCP GetCPInfo InterlockedDecrement GetCurrentThreadId InterlockedIncrement TlsSetValue TlsGetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetStdHandle ExitProcess Sleep LocalAlloc GetProcAddress GetVersionExW LoadLibraryW FreeLibrary LocalFree DeleteFileW CloseHandle lstrcmpiW GetLastError GlobalUnlock lstrlenW CreateFileW GetFileAttributesW FormatMessageW WriteFile GlobalLock lstrcpyW GlobalFree MultiByteToWideChar lstrcpynW WideCharToMultiByte GlobalAlloc GetACP DecodePointer EncodePointer GetModuleFileNameW SetUnhandledExceptionFilter GetVersion GetModuleHandleW HeapAlloc GetProcessHeap HeapFree MulDiv SetLastError VirtualProtect FlushInstructionCache GetCurrentProcess VirtualQuery RaiseException IsDebuggerPresent RtlUnwind TerminateProcess UnhandledExceptionFilter IsProcessorFeaturePresent

user32

FillRect DrawTextA GetFocus IsWindowEnabled PtInRect GetWindowTextA GetAsyncKeyState SetWindowLongA GetWindowLongA GetWindowTextW IsWindowUnicode GetSysColor GetCursorPos LoadBitmapW CallWindowProcA DrawFrameControl EndPaint SetWindowRgn RemovePropW ScreenToClient GetWindowRect LoadImageW PostMessageW DrawTextW GetParent TrackMouseEvent GetClientRect BeginPaint GetClassLongW SetPropW GetDC DrawFocusRect InvalidateRect GetWindowLongW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW SetWindowPos EnumChildWindows FindWindowExW GetDlgItemTextW SendMessageW EnableScrollBar GetScrollInfo GetScrollPos GetScrollRange SetScrollInfo SetScrollPos SetScrollRange ShowScrollBar CreateWindowExW GetSysColorBrush DrawEdge GetSystemMetrics GetWindowDC CopyRect MapWindowPoints OffsetRect SetRect FrameRect InflateRect WindowFromDC SetCapture SetTimer KillTimer ReleaseCapture GetMessagePos SetCursor IsWindowVisible GetPropW CallWindowProcW wsprintfW

gdi32

CreatePatternBrush IntersectClipRect PlayEnhMetaFile SetWindowOrgEx CreateSolidBrush CreateDIBSection GetCurrentObject CreateBitmap GetTextColor BitBlt SetTextColor DeleteDC GetDeviceCaps StretchBlt GetDIBits CreateDCW SetBkMode DeleteObject SelectObject SelectClipRgn CreateCompatibleDC CombineRgn CreateCompatibleBitmap RealizePalette SelectPalette GetObjectW SetStretchBltMode CreateRectRgn SetBrushOrgEx PatBlt UnrealizeObject SetBkColor ExtTextOutW GetPixel GetStockObject

shell32

SHGetMalloc SHBrowseForFolderW SHGetPathFromIDListW

$PLUGINSDIR/Math.dll

IMPHASH 82274a6f12e4098899c6a675f5ce59d0
SHA256 8d9a23dd2004b68c0d2e64e6c6ad330d0c648bffe2b9f619a1e9760ef978207a
MD5 85428cf1f140e5023f4c9d179b704702
SHA1 1b51213ddbaedfffb7e7f098f172f1d4e5c9efba
SHA512 dfe7f9f3030485caf30ec631424120030c3985df778993342a371bf1724fa84aa885b4e466c6f6b356d99cc24e564b9c702c7bcdd33052172e0794c2fdecce59
SSDEEP 1536:GUZ9QC7V7IGMp2ZmtSX5p9IeJXlSM2tS:T97WSth5lwt
TLSH
T174639D2276E480F2D09E81B125955F1B9B7CA63087E64DD35F622C86AE30EE1F237707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18251

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/background.ole

SHA256 3ba4ecc6a8013cbebeca713e2b9354e00c1c746e16e32238c3a275647796c3d2
MD5 641995dca6e3100e845e78e5474a66b9
SHA1 721729d82041e064e8ff305cccf5b2564cd3bd30
SHA512 33959f4aafb494bbc12919c581b6d10064b4ebad752bc81d6caca3e5633d5d7deff2ffc78af4d0c97ae16f1cf944d1bc2177bc59be9b196da35b3c947d48da5f
SSDEEP 384:rL5rXzTlMoTfntrAmBTmAqPfIRB4JiSrWcbQ3aNrUn2Dk6:r48fOfIMJiCO3aNrl
TLSH
T10DA208178D0D8E83A668D3A8BF035EAC7B5A7A5CED123AFF45211EC93F245061C4E527
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/background_small.ole

SHA256 6b6725f2d798af2665949f4dc798c2fd1a0f8532b8f476c585ac24b64baf6969
MD5 e750a9502809c0b97224053ea8a2fb50
SHA1 970580150f8cf3427e6a8e7b0f2594131025c778
SHA512 6a24630fe45acb513b489182c2bb8335df11c264a7b1d233b736e4e2d83db9adfc7aa912fec36ce688817b3a8436c71ec472196d17ab4606564da46c44b7cf73
TLSH
T1C031B81A1B021F60C8D280BA5C53C356AF8EA68D7AC3231F1A7751A3F900BF5990CA2C
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/button.bmp

SHA256 cc5ec3ba7f3bcdcdffd8154e62f8a52a1c9e98306edbf1453d2f515a8a438797
MD5 bfcf1f0f62115a68fb836bf28aa9c183
SHA1 9e30c7f08cfebd79d8637eea8c2675f06885a75f
SHA512 9891ebb390ef38e116da4c50c8ab23a56d7261305fcd0cb2ab00c294dd5b7c9b5b317c34fde38fa9e85e9bd382b3cc62cc9a99d92bac04ab41c01f27f87aaa6f
SSDEEP 12:9tIfCi8VCCCCCCCCCCCCCCCCCCCCCGNKaUTkOUszTl:foCi8zAa7S
TLSH
T1E912FDABA36E44D0C403E4B8A81F5D74DAF7D9A5212A05D4BE72CF3F5D79E209136423
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/fast_background1-inner.jpg

SHA256 6b6725f2d798af2665949f4dc798c2fd1a0f8532b8f476c585ac24b64baf6969
MD5 e750a9502809c0b97224053ea8a2fb50
SHA1 970580150f8cf3427e6a8e7b0f2594131025c778
SHA512 6a24630fe45acb513b489182c2bb8335df11c264a7b1d233b736e4e2d83db9adfc7aa912fec36ce688817b3a8436c71ec472196d17ab4606564da46c44b7cf73
TLSH
T1C031B81A1B021F60C8D280BA5C53C356AF8EA68D7AC3231F1A7751A3F900BF5990CA2C
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/fast_background1.jpg

SHA256 3ba4ecc6a8013cbebeca713e2b9354e00c1c746e16e32238c3a275647796c3d2
MD5 641995dca6e3100e845e78e5474a66b9
SHA1 721729d82041e064e8ff305cccf5b2564cd3bd30
SHA512 33959f4aafb494bbc12919c581b6d10064b4ebad752bc81d6caca3e5633d5d7deff2ffc78af4d0c97ae16f1cf944d1bc2177bc59be9b196da35b3c947d48da5f
SSDEEP 384:rL5rXzTlMoTfntrAmBTmAqPfIRB4JiSrWcbQ3aNrUn2Dk6:r48fOfIMJiCO3aNrl
TLSH
T10DA208178D0D8E83A668D3A8BF035EAC7B5A7A5CED123AFF45211EC93F245061C4E527
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/fast_background2-inner.jpg

SHA256 6b6725f2d798af2665949f4dc798c2fd1a0f8532b8f476c585ac24b64baf6969
MD5 e750a9502809c0b97224053ea8a2fb50
SHA1 970580150f8cf3427e6a8e7b0f2594131025c778
SHA512 6a24630fe45acb513b489182c2bb8335df11c264a7b1d233b736e4e2d83db9adfc7aa912fec36ce688817b3a8436c71ec472196d17ab4606564da46c44b7cf73
TLSH
T1C031B81A1B021F60C8D280BA5C53C356AF8EA68D7AC3231F1A7751A3F900BF5990CA2C
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/fast_background2.jpg

SHA256 a6dfcffa07df1ac46881e977801ce6c465ac7e9427bec164208f34446f098a3a
MD5 6760e84e617164f959e76298be77701b
SHA1 558896858de762c3c731572117f0209c021a8311
SHA512 5c8cb1d3fe9f84dee4958837e3b42b3734a2ae86e32dbb67baff6602c85fa6ddfdd39345ad24e2d90b38c693f024b6f2709e82135b90f42cf2fcd1f59dc49480
SSDEEP 24:dDcIhpKyo0XxDuLHeOWXG4OZ7DAJuLHenX3OzrBLsE5RnhCtOJS7/b8a5iFunD/B:1cduERADE5RnkMq/Jmu9
TLSH
T130E16C17DE011D8398B9C3BE7F038EBE5B8CBE40A1123BD316B04E50B3308969D5B158
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/inetc.dll

IMPHASH a6901edc54b2da8c27f3fbfe82670720
SHA256 a793929232afb78b1c5b2f45d82094098bcf01523159fad1032147d8d5f9c4df
MD5 a35cdc9cf1d17216c0ab8c5282488ead
SHA1 ed8e8091a924343ad8791d85e2733c14839f0d36
SHA512 0f15b00d0bf2aabd194302e599d69962147b4b3ef99e5a5f8d5797a7a56fd75dd9db0a667cfba9c758e6f0dab9ced126a9b43948935fe37fc31d96278a842bdf
SSDEEP 384:njt65uI9oYzcCaHjl9Cb4I1f0AGhrHXoREnRxtIpH/u0abJ2v2DW9O9tk8ZwkpwD:noHtNQoRSIwTJB6Q/kPyBp6
TLSH
T17903E7419BE8456BF7F61638B0B99A53896D7C304769C8DB87134F8918A23C7EE34323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\zak\Downloads\Inetc\Unicode\Plugins\inetc.pdb

wininet

FtpOpenFileW InternetErrorDlg HttpQueryInfoW HttpEndRequestW HttpSendRequestExW HttpSendRequestW HttpAddRequestHeadersW HttpAddRequestHeadersA HttpOpenRequestW FtpCreateDirectoryW InternetCrackUrlW InternetGetLastResponseInfoW InternetSetOptionW InternetQueryOptionW InternetWriteFile InternetSetFilePointer InternetReadFile InternetConnectW InternetCloseHandle InternetOpenW

comctl32

ord17

kernel32

GlobalAlloc WideCharToMultiByte MultiByteToWideChar lstrlenW lstrlenA lstrcatW lstrcpyW lstrcpynW lstrcmpW GlobalFree LocalFree LocalAlloc LoadLibraryA GetProcAddress GetModuleHandleW GetTickCount TerminateThread CreateThread SleepEx MulDiv lstrcmpiW CreateFileA CreateFileW DeleteFileW GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError WaitForSingleObject

user32

SetDlgItemTextW SendDlgItemMessageW SetTimer KillTimer EnableWindow UpdateWindow RedrawWindow SetWindowTextW GetWindowTextW GetClientRect IsWindowVisible GetWindowRect MessageBoxW GetWindowLongW SetWindowLongW GetParent FindWindowExW LoadIconW IsDialogMessageW SystemParametersInfoW GetDlgItem wsprintfA wsprintfW GetMessageW TranslateMessage DispatchMessageW SendMessageW PostMessageW IsWindow DestroyWindow ShowWindow SetWindowPos CreateDialogParamW

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

IMPHASH 674631b5b86309caa1d0df66c91a50f2
SHA256 64b3efdf3de54e338d4db96b549a7bdb7237bb88a82a0a63aef570327a78a6fb
MD5 f4d89d9a2a3e2f164aea3e93864905c9
SHA1 4d4e05ee5e4e77a0631a3dd064c171ba2e227d4a
SHA512 dbda3fe7ca22c23d2d0f2a5d9d415a96112e2965081582c7a42c139a55c5d861a27f0bd919504de4f82c59cf7d1b97f95ed5a55e87d574635afdb7eb2d8cadf2
SSDEEP 384:n7U5CiIZ1ZC2RvhrTfldNuwQ5pk+BISivMyyOgqCoRUj+OvHxOuofnykhVQJrTU:YoZ1ZnhrTfldqk7Yyy94RxOcVQJrT
TLSH
T1D4B21746A6B054F4F57B55BAB4322E232E7EBD08286095EFC73319196860913BB3D333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

11845

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/Banner.dll

kernel32

user32

generic

$PLUGINSDIR/GraphicalInstaller.dll

uxtheme

comctl32

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/Math.dll

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/background.ole

$PLUGINSDIR/background_small.ole

$PLUGINSDIR/button.bmp

$PLUGINSDIR/fast_background1-inner.jpg

$PLUGINSDIR/fast_background1.jpg

$PLUGINSDIR/fast_background2-inner.jpg

$PLUGINSDIR/fast_background2.jpg

$PLUGINSDIR/inetc.dll

wininet

comctl32

kernel32

user32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsJSON.dll

wininet

kernel32

user32

generic