BubbleUPnPServer-installer-user[.]exe

resource
BubbleUPnPServer-installer-user.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

BubbleUPnPServer-installer-user.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 1c6abf57b91409becdd64cf7e95b60659b379ca943aaffa81830b9336ce4373f
MD5 5a782e8bc273ab1935d0f557b08ddb9d
SHA1 69f5715a285039a052878a92dd228a3ae60aabf7
SHA512 52852c4cb533902262747f9f59a148ae172a21297fd11cf40a2f92ba4948f3774e2913b9de199c36956b53eaac3af01ebfb151e67a83ce288c339c7bc5ae2d8e
SSDEEP 49152:wwhogrxKrdT/Dt4WEpox/E2HHEMEkOg+LOQVX4GG:nhog9KNt4NoJp9bF3YXA
TLSH
T160A533B2B2E10B7AC3DECE7D4941D26A8D94199C400513070BAE7CB75DBEB4BB88D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 4c9e804ce1a391f8e603b7b9c732a6529c1e81be4d12f125c8562ea9d49095c2
MD5 583c38fb0f5af5fe584d9a9b01d6a3e7
SHA1 84dedf7064bb740614f8661793f429f5ee950d86
SHA512 298dac48f75b5d597474fe22e9d69782629c02ebc855f4df91d470edac47ccfb8fe407a1a504fa4a5c94c523c6f03b7b755105b852f25a12d778f2a42313143b
SSDEEP 192:Tg1E8f7JvEeXUUZn7ZkZ85leVlN0sfCm8:Tg1E87ZEYn7Zl4zNhO
TLSH
T174122FA93BAD043022284CFF48D594FADF31F3995F28316D0E74865AE58E3909F09CA7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsExec.dll

IMPHASH 8abe046ef411de4d3e6e831b6b1ee264
SHA256 3b15c6e4ca42036d7424f93ea0806a2d35220d65faaf2bd2479a54258f631b55
MD5 428c3a07fba184367a5085e46e4a790b
SHA1 f2de6cd4ec99ab784d18914a21de9d919a450089
SHA512 b34e1266e949d7cc5cdb7a809c3ca42652a1bb1ec72d83218604cb01b3118bbb42bfcaebc6134c4e6eb43fb566539414a49c1a0cd23a6c84da7c1c4b56ba2ab6
SSDEEP 96:L7GUeYNrwgcrEzyKwZxW4JxNABWweYkZleOe4I9d0qqyVgNr32E:XGgrwgcrEzylQBHkZwd0qJVgNy
TLSH
T1E1D1E93D76C33DB3C54ACA753C65292F0FB8D8261B540211AB5716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
TLSH
T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/wget.exe

IMPHASH b65f235fd9a8aff2db2ecbd7d01ba701
SHA256 1908c52cc8b3f573c719451874b0cce62c89d965d733f403fc0e8f67480434fd
MD5 f8247397ae65792524d949c825969391
SHA1 18a870960334be784abd9e3aab9329040b49fbea
SHA512 8b15bf18410afd05fb96f5b3bdb5ec8cc9852cced051e39568d5ed268ff65766bfb8ce01dc03a1bf0027a9b0c104dfd3c259a9e51f82c8667b9dea828aa936a0
SSDEEP 98304:DcKXMEGWw52DblQteLTTzQs6MGsdgOYrqX4SP+J4jTnSPCPv1EDaZgHlHuj2Dtg6:gmMEGWw52D+teLTTzQs6MGsdgOYrqX4p
TLSH
T1F3264884EACB80F6EE1B08B19487F37F0B316E12D870CDA7EA847909F973A51951935D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

42:9f:e8:cf:8a:0f:e1:16:0d:aa:99:ae:2a:17:6c:86:aa:a6:58:58:44:59:be:7a:b8:d9:57:69:8c:bb:b0:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Jernej Simončič,O=Jernej Simončič,POSTALCODE=1000,STREET=Herbersteinova 29,L=Ljubljana,ST=-,C=SI

Chains

Apr 23, 2019

CN=Jernej Simončič,O=Jernej Simončič,POSTALCODE=1000,STREET=Herbersteinova 29,L=Ljubljana,ST=-,C=SI

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Digest

a9:d1:ff:c6:a8:da:b5:96:bb:22:a7:98:9f:93:9c:14:70:53:fd:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Jernej Simončič,O=Jernej Simončič,POSTALCODE=1000,STREET=Herbersteinova 29,L=Ljubljana,ST=-,C=SI

Chains

Apr 23, 2019

CN=Jernej Simončič,O=Jernej Simončič,POSTALCODE=1000,STREET=Herbersteinova 29,L=Ljubljana,ST=-,C=SI

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=Jernej Simončič,O=Jernej Simončič,POSTALCODE=1000,STREET=Herbersteinova 29,L=Ljubljana,ST=-,C=SI

Serial Number

77:71:45:5b:05:17:ad:b7:7e:cc:60:1c:24:f2:a9:73

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 25, 2016 - Mar 25, 2021

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 31, 2015 - Jul 9, 2019

Minor OS version

0

Major OS version

4

Entry point

5232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptDestroyKey CryptEnumProvidersW CryptExportKey CryptGenRandom CryptGetProvParam CryptGetUserKey CryptReleaseContext CryptSetHashParam CryptSignHashW DeregisterEventSource RegCloseKey RegOpenKeyExA RegQueryValueExA RegisterEventSourceW ReportEventW

crypt32

CertCloseStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

kernel32

CloseHandle ConvertFiberToThread ConvertThreadToFiber CreateDirectoryA CreateEventA CreateFiber CreateFileA CreateFileMappingA CreateFileW CreatePipe CreateProcessA CreateSemaphoreW CreateThread DeleteCriticalSection DeleteFiber DeleteFileA DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsA FindClose FindFirstFileA FindFirstFileW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FormatMessageA FormatMessageW FreeLibrary GetACP GetCPInfo GetCommandLineA GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetFileAttributesA GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetHandleInformation GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeInfo GetNumberOfConsoleInputEvents GetPriorityClass GetProcAddress GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetThreadLocale GetTickCount GetVersion GetVolumeInformationW InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx IsValidCodePage LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree LockFileEx MapViewOfFile MultiByteToWideChar OpenFileMappingA PeekConsoleInputA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleA ReadConsoleW ReadFile ReleaseSemaphore ResetEvent ResumeThread SetConsoleCtrlHandler SetConsoleMode SetConsoleTitleA SetEndOfFile SetEnvironmentVariableA SetEvent SetFilePointer SetFilePointerEx SetFileTime SetLastError SetThreadPriority SetUnhandledExceptionFilter Sleep SleepEx SwitchToFiber SystemTimeToFileTime TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

___mb_cur_max_func __doserrno __getmainargs __initenv __lconv_init __p___argv __p__acmdln __p__fmode __pioinfo __set_app_type __setusermatherr _amsg_exit _cexit _chmod _close _environ _errno _exit _filelengthi64 _fileno _get_osfhandle _getch _initterm _iob _isctype _lock _lseeki64 _mkdir _onexit _open_osfhandle _pipe _putenv _setmaxstdio _setmode _vsnwprintf _strdup _stricmp _strnicmp _sys_errlist _sys_nerr _telli64 _unlock _vsnprintf _wfopen _wopen _write abort atoi bsearch calloc clearerr clock exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free fseek fsetpos ftell fwprintf fwrite getc getenv isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper iswctype isxdigit localeconv malloc memchr memcmp memcpy memmove memset localtime gmtime _getmaxstdio _getmbcp perror putc puts qsort raise rand realloc rename rewind setbuf setlocale setvbuf signal sprintf srand sscanf strcat strchr strcmp strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtok strtol strtoul tmpfile tolower toupper towlower towupper ungetc vfprintf time wcscat wcscmp wcscpy wcslen wcsstr wcstombs _stat _snwprintf _fstat _write _unlink _strdup _setmode _read _putenv _open _mkdir _lseek _isatty _getpid _getcwd _fileno _fdopen _dup2 _dup _close _chmod _chdir _access _stricmp

ole32

CoCreateInstance CoInitializeEx CoUninitialize

shell32

SHGetSpecialFolderPathA

user32

DispatchMessageA GetProcessWindowStation GetUserObjectInformationW MessageBoxA MessageBoxW MsgWaitForMultipleObjects PeekMessageA TranslateMessage

ws2_32

WSAAddressToStringA WSACleanup WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSASetLastError WSASocketA WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname getnameinfo getpeername getsockname getsockopt htonl htons inet_addr inet_pton ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

/4

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

BubbleUPnPServer.ico

SHA256 595e2ca4cd8ce8a1ee405655172480750b7554af4aaa9e113d731d8f11d793f8
MD5 a25346143f429a8c164a6da48d569d86
SHA1 c8e327631aa280a1e6628942f728387345362e99
SHA512 10afbdcab85682d2f63060f51aa08cd83e98263ecfae2b89ca7152d0ece0b1f41131a5198ba270fa438cc113bd45440f229e341c408d73042f9062147a8f8b69
SSDEEP 6144:Q+wD3zpZjKS4pRFJlccgOH4qsxHENcfLQIExBbVq5kJtuGaVWCl7XKMzTgu2lb5C:Q+wrzpZjKS4pRFJlccgOH4qQENcfLQId
TLSH
T11554E086E1C8B1CFD20319F81CDC7EB1532D9C5A97843D1A7D78308FB91BA86687962D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

LICENCE.txt

SHA256 ceb8ba5042568cd04e7c47f4e4416278bbbd1e63fe30124b0646fc90614843ba
MD5 180a940c4a6b41778c6f4867a49e8fb4
SHA1 404a85a1ae1e02b039e4f72b1bdf1ac8f43434db
SHA512 37ef1d982817b2371efc2d33f60d6b85d734e53c2fe4ff6f98237b50b61883023281c46c504dcb3769f425ae01adfe7cb9b08799fb7ea31c72671ce7b8ed161a
SSDEEP 96:RQUSCcyT2QPfRrnj0nACSAg65VO4Uxk5E3CsadPcsdJHqgbcM3vi3qjrgH:RFWyRPfpj0nACxg6jO4gk5ESsadUsdJ8
TLSH
T17991F539B86E135207F047B91B05EA4FC64FA5BB650A1B98F15D90897F3141D31FF628
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninstall.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 30e633d2913d4f3a8f3afb0beddb38cc9d7aaea02b9d91d72f9cd9e28ffb9505
MD5 13bd84999d2f967a6638e6ba800467ad
SHA1 e86d2db9edce31162b377244065963d4606fe5e3
SHA512 9af94e07a646aece244af0fb6e359b9d7e392258aa03e2cd4800c6da01dc7e616d1baa48c15774e2fe8491ce22c3fc3f5cb2432f4f0e5a8b64289c3124ad3a01
SSDEEP 1536:MKJAES3bS2L6KbuVfmMk0DCwcjgdLeAyNLcHRIB6c8CkC5w8TKw76:vJ2S2L6KbqDCwcjceAZio2kCfWu6
TLSH
T19C63CF0777C188F7D5E646B00EBBABBAFB77D50042119B438B945F7F292024B9E19253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 738dc9bb91549f627cf1953c2000e1d6
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentDirectoryA MultiByteToWideChar SetCurrentDirectoryA GetPrivateProfileStringA GetPrivateProfileIntA GetModuleHandleA lstrcmpiA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalAlloc GlobalUnlock GlobalLock

user32

GetDlgCtrlID CloseClipboard GetClipboardData MapWindowPoints LoadCursorA GetClientRect SetWindowRgn LoadIconA GetWindowLongA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow SetCursor PtInRect EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA EnableMenuItem DrawTextA GetSystemMenu OpenClipboard LoadImageA

gdi32

SetTextColor DeleteObject CombineRgn CreateRectRgn GetDIBits SelectObject CreateCompatibleDC GetObjectA

shell32

SHGetPathFromIDListA ShellExecuteA SHBrowseForFolderA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 4c9e804ce1a391f8e603b7b9c732a6529c1e81be4d12f125c8562ea9d49095c2
MD5 583c38fb0f5af5fe584d9a9b01d6a3e7
SHA1 84dedf7064bb740614f8661793f429f5ee950d86
SHA512 298dac48f75b5d597474fe22e9d69782629c02ebc855f4df91d470edac47ccfb8fe407a1a504fa4a5c94c523c6f03b7b755105b852f25a12d778f2a42313143b
SSDEEP 192:Tg1E8f7JvEeXUUZn7ZkZ85leVlN0sfCm8:Tg1E87ZEYn7Zl4zNhO
TLSH
T174122FA93BAD043022284CFF48D594FADF31F3995F28316D0E74865AE58E3909F09CA7
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

BubbleUPnPServer-installer-user.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsisunz.dll

kernel32

user32

generic

$TEMP/wget.exe

advapi32

crypt32

kernel32

msvcrt

ole32

shell32

user32

ws2_32

generic

BubbleUPnPServer.ico

LICENCE.txt

uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp