MiniBin-6[.]6[.]0[.]0-Setup[.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	upx

resource
MiniBin-6.6.0.0-Setup.exe
unpack001/$PLUGINSDIR/AccessControl.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/MiniBin.exe
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

MiniBin-6.6.0.0-Setup.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 5b4a0e1530237a6c13c483ab8852187f090ea386a8bdc59f58d0143e1d9cb57d
MD5 cc4346b199fccd38c7c4eded2da70e46
SHA1 69fc15d4be35a20fa9f85566f28ea29b45fbc088
SHA512 7a2abbf9e7241cfc48c7b7bd9f45df4191a2221f9060213363264e916ae61685805d6cea1e680acc1b5b1343f5715d87513ca6a7360114e61169e58677062901
SSDEEP 3072:R5TDpNFVbxDSXJFolx/h47i+67sYn7zKKsz7HYaY:R57TcfolXa0sA7WvzY
TLSH
T1D3A3E19576D398AFD59201B10976FBB5E376FAFC17215A432BC09F3B28712868F461C0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AccessControl.dll

SHA256 8a8f5bafc105186c85f14e017ab6da33ae8f88a9635e51756f90b6d95381d80d
MD5 9f1a88b953fd2a2c23b09703b253186c
SHA1 29d5a5a24e7f782a07e9f5d2ec1d1a6218fec737
SHA512 10b3a812c92b7324bddcd23adf923fcaec2532f31bdd9fbf17494fc33f99aa0a0a48b94f1fdd6599fa0189567626a90b324a1d132bf9cb8b00a6afc547e64018
SSDEEP 192:RmcLe8uWVNz5ZalBK/7rUlYg5q5LcywvX5:RJdNzMKXUlYg5qPq5
TLSH
T1E3029D8643A40179E8730BFC4FAD4C1A1B2EFFB0CBB1569D2158356F6820B1488B6F31
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

33616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 39b62bf74ace31d2d8041bf1748e3d83ad0b0b674dc7600b651164f748a38667
MD5 5173088bda257c4f549247031a21caab
SHA1 e6f3c1c3b1d5d53f6adb23cf9a264b8f5d0dc479
SHA512 01f14c768ba2f9f11c5e344ba44b75dafe486e7742ca8896e0a985d80b71192336e2472f7a2be17801fe0c753bd1eddc8494af53dc436ab727ed3d0fa3c7ae9f
SSDEEP 192:ThzPKgdc4SN+XIjjAZaK26N6dlJmclFcyw:ThzPM0/aAUF9
TLSH
T197629516AFF416FBE1A622B076D116338BADBA5400E15D674F564B892C10C86EFF9333
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
MD5 960a5c48e25cf2bca332e74e11d825c9
SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
TLSH
T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10027

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 93e8662fe9506df0e4dbea8b8421047cf99b79979be300a86898d3e9ceb1a358
MD5 a0b74ed88cbbb2fa4e92604433ca350b
SHA1 877864400bc0cef1aac1102e54fae4f72ad2e033
SHA512 0b08647af32c304640a4cc71cf2a4344a614f9eeca4fce447f20f507603800f1d128afb895d7df21615db76b64d4fc8a94ac0bfa33dd2ac71a8376357c5dede3
SSDEEP 96:tuTY/qwzKvjLWxzqiiI/p1H3S5P4vTGzAT3/t5/66UtgV8eeSYSP:tuk/qwzK3EAI/pp3WPiTGzy3/3vVleo
TLSH
T1E5A3A6839859A6FCD0A43E7D73E984164E999D8348D92194468C7DEF8C436C22CFF2AC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 38e7b5c3ee58b43a91f9679e94aabd09
SHA256 495bddc0be6e18e981db82fab9d1de55c7e269ab4ec3ff43035193bc017a307b
MD5 8ced0b79f7b9033d0795aab3be6d627c
SHA1 90c2043ffccd068f407c624c50ac7b795db1e132
SHA512 e38f63a342729f5ff6d0db607d7877b65c33ed19e2b5a97dd868ece8c2a3e829d4153624943444be2f0de885496161d54c1da9594bdc0a5a0bcc8b727e2facb0
SSDEEP 96:3Rp41CMj95rKhkfL5RkEdKkcxM2DjDf3GEEE9v5E9av+Yx4indY7ndS27gA:3RujesS4HREEK5MYxDdqn420
TLSH
T1FC12F9675A0010B3E9A36239316A2D3F8B7C9325D0A37C03C677AE562BF431A7D3A355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

MiniBin.exe

IMPHASH ce170e5e1d0979fd325ee3d11ce60317
SHA256 6cd155efe3591a5edcdd1cfd588de0fbd40ec98ead9fbeb52ee664e9bcfe6ff8
MD5 f4fa099a4249bf979d8f29d27a98c77b
SHA1 4b7590142130d967e5dd684893e599f16fe28848
SHA512 54526b4ded18701a9246d1c7c6e02b8b5b62f6f0316737196a0aeec3685c153b158a4965b13b479e0b5b32329a41d0261b50ac6f9e33bc71cfc68a10455e7c91
SSDEEP 768:Mvjz2xcF7z7S1/8K1aqQllhGp4mEn/AVfXPe7HEDYxSnpA4WhtTDIb9j:wX2xx/8K1wGOn4VfXPLk/2
TLSH
T111634C1272D18C75E0925A3458B5D7B52A7EFC132635098F6BE52BEF2E706C08E34367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

11505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileW DeleteFileW lstrlenW GetModuleFileNameW GetLastError CreateMutexW HeapReAlloc HeapAlloc HeapSize GetStringTypeW MultiByteToWideChar LCMapStringW WideCharToMultiByte GetLogicalDrives Sleep HeapFree LoadLibraryW EnterCriticalSection LeaveCriticalSection GetCurrentProcess TerminateProcess IsDebuggerPresent UnhandledExceptionFilter IsValidCodePage GetOEMCP GetACP lstrcpyW lstrcatW GetPrivateProfileStringW GetModuleHandleW GetPrivateProfileIntW RtlUnwind WritePrivateProfileStringW GetCPInfo RaiseException GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCommandLineW HeapSetInformation GetStartupInfoW EncodePointer DecodePointer IsProcessorFeaturePresent SetUnhandledExceptionFilter GetProcAddress ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate

user32

RegisterClassExW CreateWindowExW GetMessageW TranslateMessage DispatchMessageW RegisterWindowMessageW SetTimer KillTimer CreatePopupMenu InsertMenuItemW SetForegroundWindow GetCursorPos TrackPopupMenu PostMessageW DestroyMenu MessageBoxW DestroyIcon DestroyWindow PostQuitMessage DefWindowProcW GetDC ReleaseDC GetSysColorBrush DrawIconEx LoadImageW wsprintfW EnableMenuItem

gdi32

CreateCompatibleDC SelectObject DeleteDC CreateCompatibleBitmap

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW SHEmptyRecycleBinW SHQueryRecycleBinW Shell_NotifyIconW

shlwapi

StrFormatByteSizeW

changelog.txt

SHA256 ad88f6f48d8c3ca6ac1f2151c3e38b6b5d4297894816f51e96697b9c72a3c42f
MD5 67bd6309dba8687eac432d323f3c7ca7
SHA1 27020653a93abc32f0e8029a26a96562eee58af8
SHA512 6b293cd47127ba708b9eddbb2a3fe2e698556e1e528295898edede2abd0f679f3e51328c050743e0bec92d2ef587b21f03d58870201a5653827accf911c17d59
TLSH
T1B701D3ABB407715A62B74112A1157331D92C13D1CF183A7AF55D365C17FA051E04F55C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

license.txt

SHA256 a42fe98b5f56473b57ee605aec55f3d390d6ae79d0e51f0e912578fd8baa77e0
MD5 0ad19fdd70ff775ded34f7a3dfb61d7a
SHA1 32622b5064d70b3926da197f86e0cce23bb753b0
SHA512 5a181ae48c7ee6b546da980b6241910721ee7c6a06909441f2492a69968d8ef2fc695f125f074af91b36b489536a8d39047c6486de97d30919029f145759e80d
TLSH
T178E07D9CD6327B1339E3F543F87A7247B515962C204C26D0DA8CAE04D13C0746BF215D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

minibin-language.ini

SHA256 ee4e77da422e3df0b006293c8c991f42e23e0452e3fcc8c6dfedcb9eaeebeda7
MD5 1e7a32139a56c7746b5b40564035e125
SHA1 7efa541aea713165f5ad760c283e0532e24e3a92
SHA512 b9106abb4beea08b6fd47897026f0c091008e9083885ea32cfb94278c9aee3342c8021a33353d05e74935c3220e8e9255aa991df87606ca5193a011c9c2ecc31
TLSH
T16E11006277F80668B2F42FA0BE7C68245B36FCE21C1A90CC56C2204904E1E409DBA7B7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

minibin.ini

SHA256 3a47e3801c0fe41e4a210e521183be8500ab11c0badc9284b96523beef0e49d5
MD5 4a6f3f640023df556e6218990449b40e
SHA1 be50b904f6744ecd3dfe5ca4e062c36d3e7569be
SHA512 1cf80e0bd13080d30b0f341276cbdc21231d70288e1cb959108ab5aeb6382460295dc366c721b306d2701f9dd190b9c4b58e46f79e624fb553750f24b4c5b147
TLSH
T125E09A333BF90C24E4A26F98FABE58311F25FC542C1D94DD91C2515B89E2E408C663E7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

uninst.exe

IMPHASH e160ef8e55bb9d162da4e266afd9eef3
SHA256 fb259cdf9329a2a744b8f6d9a9e4ee030628ea44c998d65c382f468bd9cd43f2
MD5 4d6637ecac8635df0ef3435261863a58
SHA1 b67644fab32310b14ecad5f4dcbac29411f1cc32
SHA512 8da3ca41931deb7a286ab004348207da5412917b42fb8f858103ccac0aed71c24ac139a2d25aedab00a34dea93249cbc7713b0c7d385c7ab3af092328f7fa237
SSDEEP 768:GdA5YO6lMTQi60JfukE6574Kk7QxLJNbwj0D3S1fT3XJWdWiBKhR:R5TfrpNzRFZxLvUj0DSXJWwiBa
TLSH
T1EA036B5376D284BFD691057009B7E7B9E37ABEAC02264A473BD06F6F2D715838F05281
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12516

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA SearchPathA GetShortPathNameA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA Sleep CloseHandle LoadLibraryA lstrlenA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile lstrcpyA lstrcatA GetSystemDirectoryA GetVersion GetProcAddress GlobalAlloc CompareFileTime SetFileTime ExpandEnvironmentStringsA lstrcmpiA lstrcmpA WaitForSingleObject GlobalFree GetExitCodeProcess GetModuleHandleA SetErrorMode GetCommandLineA LoadLibraryExA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer WriteFile FindClose WritePrivateProfileStringA MultiByteToWideChar MulDiv GetPrivateProfileStringA FreeLibrary

user32

CreateWindowExA EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard GetDC SystemParametersInfoA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow CreateDialogParamA SetTimer GetDlgItem wsprintfA SetForegroundWindow ShowWindow IsWindow LoadImageA SetWindowLongA SetClipboardData EmptyClipboard OpenClipboard EndPaint PostQuitMessage FindWindowExA SendMessageTimeoutA SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegCloseKey RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegEnumValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

MiniBin-6.6.0.0-Setup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AccessControl.dll

generic

out.upx

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

MiniBin.exe

kernel32

user32

gdi32

comdlg32

shell32

shlwapi

generic

changelog.txt

license.txt

minibin-language.ini

minibin.ini

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic