Sai 2 - 64bits - Chico Tutorial[.]zip

resource
unpack001/sai2.exe

Sai 2 - 64bits - Chico Tutorial.zip

SHA256 72e7c20ac6ce8a27cccd08b2dfcba1721b7b9975e1c0692587f510c2498bd12c
MD5 1f79c0693d7ec94069bbcfd5434bfb08
SHA1 32a8229d9969177801af00cd9a304e8512fbdde7
SHA512 b4af78b6c8dcdae1fb43309c17543c54298a30099a00356e3373efde056a28861a85b7a713442ed973c53e376de488e5acd88524327c87d4081ad6582b1c6522
SSDEEP 49152:tp2BkudXaeUlhZxgofamR9pHGcn4tDqRSbHH3iuSbHH3SCCNcpvfzhEVU/:ArXaeURqBmd5n4tWRq3rq3Xnz2VC
TLSH
T131C53329626CFBA190E23CC1647A3632F5F3DA9D236EFAD545C07D2245F270A63E7940
MD5 SHA1 SHA512 SSDEEP TLSH

blotmap/ɂ݁mCY.bmp

SHA256 75b412bc911f85b71ab0f74648fca9d8a7b0f88bd2eb65cd9f941cc1ca87fa42
MD5 7e313e2d7a64656ef7101d180efc2da8
SHA1 db826e9474a163042679c667b6f51d382b09d9e8
SHA512 e6b01b1d0b2b2209ca58129b72936086aa7ca1de5a000ea645d82aab02e07c69581f4493c5c66c6e4904b94111c494d31290768ec6427de7f00ebdf787bdca38
SSDEEP 1536:HvOYAaAJWndc6tmZQ4ynFVZV+NrVclruBVRV7LbWETwwhSa:OfJWnDtJ4CnQOlSj7LiETwwhSa
TLSH
T1D253029781E12C3FCCC8827135D41396FAD6E4AFB6A7095A932BE0154EBE8D94DCDC42
MD5 SHA1 SHA512 SSDEEP TLSH

blotmap/ɂ.bmp

SHA256 3a50c1123d38839112e6efdba622098138f895eeca65a13923eaa00ef5903fb1
MD5 b953210f80206d395f79bdfc480b08ba
SHA1 f7ca426380a6c30c1bc1d75dd4b448298d64023f
SHA512 fc0d6e82d492009253f906b7de82859319725d843d984ad468967703c26adc0e8bd2054f696fcc53fdccb3c74266658584f08d039605097aec5837fd233c9fdf
SSDEEP 1536:Hqwi74oFET4vYtJ9rsQ/dVk0OAAJMneZCWk72O5w:K5RE7zs4CAAuW
TLSH
T1CE53F156E3FCEC505C2F9DC6DF898989DA28A2213B5250D21232071DD1EE5A3D7BB5F0
MD5 SHA1 SHA512 SSDEEP TLSH

bristle/ەM.bmp

SHA256 027c4b9e37a606152c90ccb5b5b0cbfeb384521ba148cbce76c35057cbd6aa30
MD5 94b664c148da3349be48d952364b8470
SHA1 392911d0e7d9ce22564b0d841da5146d17483858
SHA512 90ea80c72a6d2d89020603c2d85e42625b91dba18f20aece87551d60ad5665c1c09d9a1ac665f3ec392fa3920c0cb0666d8d1e410e2fec58823a112d70e51ee4
SSDEEP 48:hMiI11fJEGCtiQd7uc6WgCsiaVp8YOIiV:hbYfJEGPmQBBiaVvOp
TLSH
T18E427E41B010D2646A0BB51B1DBEDBBC7860FC95AEE024E734B57B4F24713669071BC6
MD5 SHA1 SHA512 SSDEEP TLSH

bristle/M.bmp

SHA256 dc9dc48da8eaa9f627dc5285b4700b88d827aa26a36fcf9f36a559ab9f28a650
MD5 a762568944134e7537eb748da8776815
SHA1 f90c2c83a06005c0925130d229681adc95cc966f
SHA512 832bdd390cb6cee903ff127dbe54b84772a43da23928c85c4859f85f912c1fe4276c3a5f4b33e39296e282b65d42356e592ab1d33260ec2e92636adc3015558c
SSDEEP 48:hMiI11wOLGC9iTDFN568gC3C4nMXQKIiV:hbYwOLGPtaniC4nEp
TLSH
T18442D341B01092646A0BF51B1DBEEBAC7960FC95AEE024F734B67B4F24713669031FCA
MD5 SHA1 SHA512 SSDEEP TLSH

brushtex/LoX.bmp

SHA256 56fd2208ac9082c2500b155f5dfd312b3289c53b2e5ae259d6b30e50982a5d76
MD5 77abf38ceb44ff0d9f32f1a28106cf40
SHA1 4384db29026828c4f7497d11a462cf9395646923
SHA512 e3bd4c4fbf7728f389d41dcfa35d4785e77c4ea8323ed48e398a9f5706083b59c26239687308634a3e15117ebb4e78a2f433db967e013205ae3e5c04b9ba497a
SSDEEP 6144:XzbVhha7RgCzZoLQFYq9+pkzXrudzbVhha7RgCzZoLQFYq9+pkzXru5:XzqgIoLQFYq5udzqgIoLQFYq5u5
TLSH
T1D04401692ABFD0A5048914D40CDDA2A0698DA017F627DEF71D3123F8E1E2DBF4AC1B74
MD5 SHA1 SHA512 SSDEEP TLSH

brushtex/p.bmp

SHA256 6cfc0e01583bfd0a1b1598bb954077acd3502bc5c24524132e3a17dac129137c
MD5 3e940d47505ae20ae27a3023c1e4c5f0
SHA1 54d857a1756f7d86beab7fdb1b136e8cd579eeac
SHA512 4e54e9be69330ca2b35871a898ac7cc6d90c3c5b9f1b0f67b796ec3b2e0a50fe7e2633523fb3d096b0733f806f6ea7f9b380b5ebdc7f5c2d11ad2a8054d4618b
SSDEEP 6144:9tLBKai7LLme60hsGPE5L9FUONQdY3X6Zfpv:wai72D0hsQkFUNEX4pv
TLSH
T1744402F6DB52CADD3D4258F6BD18BC727D53027CF0DA8721618A476B70A18AC468C2F2
MD5 SHA1 SHA512 SSDEEP TLSH

history.txt

SHA256 7535f155e5f304ce0b81c5aa71c4c76d2dc68f7002a7f7b32acafdf7acd03cc4
MD5 7886e4b6cbbaa976dfb07aa084330cd9
SHA1 1a73aa12d46c7914019e8b6a7539f133f4983182
SHA512 94bd043da4f7346bee7c1661670dc033afc4c0c6e548bd3ce069210c84bb394735698829afbbdb095ed844d2700777176ca5559c89e3f64a1fc23edfa0b38dcc
SSDEEP 768:QWmO6e7PuGkAMKwmIdOrupnafstmzjZY9FeicF8AceTqkrPx:QWyK8krQaQmzCvcF82Xrp
TLSH
T157933D6CEFDBA8295E21D1974C88B9D9F3529C6BECA23736241DF02524541CEE94CCBC
MD5 SHA1 SHA512 SSDEEP TLSH

papertex/LoX.bmp

SHA256 56fd2208ac9082c2500b155f5dfd312b3289c53b2e5ae259d6b30e50982a5d76
MD5 77abf38ceb44ff0d9f32f1a28106cf40
SHA1 4384db29026828c4f7497d11a462cf9395646923
SHA512 e3bd4c4fbf7728f389d41dcfa35d4785e77c4ea8323ed48e398a9f5706083b59c26239687308634a3e15117ebb4e78a2f433db967e013205ae3e5c04b9ba497a
SSDEEP 6144:XzbVhha7RgCzZoLQFYq9+pkzXrudzbVhha7RgCzZoLQFYq9+pkzXru5:XzqgIoLQFYq5udzqgIoLQFYq5u5
TLSH
T1D04401692ABFD0A5048914D40CDDA2A0698DA017F627DEF71D3123F8E1E2DBF4AC1B74
MD5 SHA1 SHA512 SSDEEP TLSH

papertex/p.bmp

SHA256 6cfc0e01583bfd0a1b1598bb954077acd3502bc5c24524132e3a17dac129137c
MD5 3e940d47505ae20ae27a3023c1e4c5f0
SHA1 54d857a1756f7d86beab7fdb1b136e8cd579eeac
SHA512 4e54e9be69330ca2b35871a898ac7cc6d90c3c5b9f1b0f67b796ec3b2e0a50fe7e2633523fb3d096b0733f806f6ea7f9b380b5ebdc7f5c2d11ad2a8054d4618b
SSDEEP 6144:9tLBKai7LLme60hsGPE5L9FUONQdY3X6Zfpv:wai72D0hsQkFUNEX4pv
TLSH
T1744402F6DB52CADD3D4258F6BD18BC727D53027CF0DA8721618A476B70A18AC468C2F2
MD5 SHA1 SHA512 SSDEEP TLSH

papertex/ʂP.bmp

SHA256 43a13ec4f54eff7aaa77ab2a7a292cdbe58dbccdc6d37d95a1ad1528787c7559
MD5 eb4116fcc59605182e8c76f4bb496958
SHA1 aca13dfd68436c4bf62c13901723f067e2b681a6
SHA512 9279e02fbf2f437a450fccf5b03524eee4eed33c6e0d09cca4eee3015fb4f0ae714d11c12f13dd414031263282df8aecb4eaa7196674193d2d94c6c77c583dc6
SSDEEP 6144:JEiKyTU+zvgvE6ZZ1yqB/8mByfNbL7lcP91ZlKzQuUL38Rl6dfQ:JowYvhRUbfNvpS9NxuULMRwd4
TLSH
T1704423DA40AF32C2C486BF1B7AD094E2E97D612921C8B719239C1E00B3D7DFD5A6C576
MD5 SHA1 SHA512 SSDEEP TLSH

papertex/ʂQ.bmp

SHA256 7ac03b1f36bd2a0fc257f6a2302f62a97b1098130100e5a7613fa86e1849a499
MD5 9dd71181ba3d048b1a3bcce15c2c3871
SHA1 0c49b850b83910efcf0127cb364777e419afa8b2
SHA512 df4b23d5280b2c0bfe28ffebb688ccb4124ab51f3db1081934553d72d1755c163d70f8dcca132cd33ccb68df3e62f70d674586c5dded782dca8082b0687544bf
SSDEEP 6144:O10L7Y5/adMbaDOWgyGAIVWCHef4BBrvIDatYDRw22Bva:Od5/adsaaOGAiHefe7IOtn22Ra
TLSH
T1FC4423A4C9199AC66780C72A143DE4DA5F20CACD6E84FD092F2C998BBC7B573D71970C
MD5 SHA1 SHA512 SSDEEP TLSH

sai2.exe

IMPHASH b08b0d83797230475501c8da03b1a89c
SHA256 094e678f603f7691fe41adfcd89671f11dfb33a87c6dea33c3508a5294f69ec4
MD5 7345cf11d4d5109f5d4ac5956106daba
SHA1 8369b1236a5aaf7f4e70f656bd84295374a8c468
SHA512 6bfe1a39eeb751b83356389d1743349ea96ea1b0a25d462f16c79a02cd535b8c1d2802dd32d5312fa5a73c190060d26cf27172b43cda1a21bed15d90a1b305ef
SSDEEP 49152:IumPoVCPkgn9r7EbbHbsvnl4he0vCS7YjHLnLTkEaA:Iua/ySMtA
TLSH
T1D9466041A25898D6E42FA030D264A7BE6A303C49435195C72F7ABF566BF3381BC39F74
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

1902348

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\MyProjects\SYSTEMAX\sai2\bin64\sai2.pdb

kernel32

GetFileSizeEx DeleteFileW CreateFileW UnmapViewOfFile CreateFileMappingW MapViewOfFile FileTimeToSystemTime GetFileAttributesW CompareFileTime CompareStringW ReleaseSemaphore LocalAlloc LocalFree FileTimeToLocalFileTime Sleep GlobalAlloc GlobalFree SwitchToThread GetPrivateProfileStringW GlobalLock GlobalUnlock WaitForSingleObject lstrlenA CreateFileA ReadFile GetConsoleOutputCP WriteConsoleA SetStdHandle GetLocaleInfoW EnterCriticalSection LeaveCriticalSection SetEvent GetTickCount GetCurrentThreadId CreateMutexW GetLastError GetCurrentThread SetThreadPriority GetConsoleMode GetConsoleCP LoadLibraryA HeapReAlloc HeapSize GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA SetFilePointerEx WriteFile FlushFileBuffers SystemTimeToFileTime GetSystemTime WideCharToMultiByte MultiByteToWideChar WriteConsoleW GetProcAddress CloseHandle GetDiskFreeSpaceExW GetUserDefaultLCID GetFileType SetHandleCount SetThreadAffinityMask ResetEvent GetProcessAffinityMask GetCurrentProcess WaitForMultipleObjects RaiseException GetModuleFileNameW GetCommandLineW GlobalMemoryStatusEx RtlVirtualUnwind RtlLookupFunctionEntry VirtualQuery FreeLibrary InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetFilePointer GetFileSize FormatMessageW LoadLibraryW Module32NextW Module32FirstW CreateToolhelp32Snapshot GetCurrentProcessId RtlCaptureContext GetModuleHandleW DeviceIoControl VirtualAlloc SetFileTime VirtualFree SetEndOfFile FlushViewOfFile MoveFileW CreateDirectoryW RemoveDirectoryW FindFirstFileW FindClose FindNextFileW GetEnvironmentVariableW QueryPerformanceCounter CreateEventW CreateSemaphoreW GetVersionExW GetCPInfo GetSystemInfo DebugBreak GetSystemTimeAsFileTime RtlUnwindEx HeapFree GetCommandLineA GetStartupInfoA HeapAlloc VirtualProtect ExitThread CreateThread EncodePointer DecodePointer FlsGetValue FlsSetValue FlsFree SetLastError FlsAlloc GetACP GetOEMCP IsValidCodePage LCMapStringA LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapSetInformation HeapCreate RtlPcToFileHeader ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

DestroyIcon LoadCursorW SetWindowPlacement GetWindowDC GetWindowPlacement GetKeyState MessageBoxW DefWindowProcW SetWindowLongPtrW GetSystemMenu MoveWindow SystemParametersInfoW GetWindowRect AdjustWindowRectEx CreateWindowExW GetSystemMetrics DrawTextW FillRect GetWindowLongPtrW GetMessageW EnableWindow RegisterClassExW GetSysColor RedrawWindow MapWindowPoints SetLayeredWindowAttributes FrameRect GetClientRect GetPropW SetPropW CreatePopupMenu SetMenuInfo CreateMenu GetScrollPos SetScrollInfo SetScrollRange SetScrollPos GetMenuItemInfoW GetMenuItemCount EnableMenuItem CheckMenuItem ClientToScreen SetWindowRgn GetMonitorInfoW MonitorFromRect IsZoomed GetNextDlgTabItem IsChild GetWindowTextW SetWindowTextW GetWindowLongW SetWindowLongW DrawIconEx GetWindowThreadProcessId GetCursorPos WindowFromPoint ScreenToClient MonitorFromWindow EnumChildWindows GetClassLongPtrW PostThreadMessageW WaitMessage LoadIconW DeferWindowPos EndDeferWindowPos BeginDeferWindowPos SetParent SendInput mouse_event GetDlgItem ShowCaret SetCaretPos CreateCaret DestroyCaret HideCaret GetAncestor ScrollWindowEx SetCapture ReleaseCapture GetDC ReleaseDC DestroyMenu SetCursor SetWindowPos MessageBeep GetParent SetActiveWindow BeginPaint EndPaint RegisterClipboardFormatW EmptyClipboard GetClipboardData IsClipboardFormatAvailable DeleteMenu AppendMenuW InsertMenuItemW GetCapture GetFocus GetAsyncKeyState KillTimer EnumThreadWindows UpdateWindow PostMessageW MsgWaitForMultipleObjects SendMessageW SetFocus PeekMessageW TranslateMessage DispatchMessageW OpenClipboard CloseClipboard SetClipboardData IsIconic ShowWindow ReplyMessage SetForegroundWindow GetMenuInfo DestroyWindow PostQuitMessage SetTimer IsWindowEnabled ChildWindowFromPointEx

gdi32

CreateRectRgn BitBlt ExtSelectClipRgn OffsetClipRgn SelectClipRgn GetDeviceCaps DeleteDC DeleteObject SelectObject CreateSolidBrush SetDIBitsToDevice CreateDIBSection CreateCompatibleBitmap SetTextColor CreateCompatibleDC ExtTextOutW CreateRectRgnIndirect ExtCreateRegion CombineRgn GetRegionData GetTextMetricsW CreateFontIndirectW GetCharacterPlacementW GetStockObject RectVisible CreateDIBitmap EnumFontFamiliesExW SetBkMode GetCurrentObject SetBkColor GetTextExtentExPointW GetTextExtentPoint32W GetGlyphOutlineW

comdlg32

GetOpenFileNameW GetSaveFileNameW

shell32

CommandLineToArgvW DragAcceptFiles DragFinish SHGetDesktopFolder SHGetSpecialFolderLocation SHGetDataFromIDListW ord21 SHGetSettings SHFileOperationW SHGetFileInfoW DragQueryFileW SHGetSpecialFolderPathW

ole32

OleDuplicateData RegisterDragDrop RevokeDragDrop OleUninitialize OleInitialize CoTaskMemFree StringFromIID CoCreateInstance CoTaskMemAlloc DoDragDrop ReleaseStgMedium

imm32

ImmNotifyIME ImmGetCompositionStringW ImmGetContext ImmSetCompositionFontW ImmSetCompositionWindow ImmReleaseContext ImmAssociateContext ImmAssociateContextEx

comctl32

ImageList_GetIconSize ImageList_GetIcon

shlwapi

StrRetToBufW PathCanonicalizeW PathIsRelativeW

rpcrt4

UuidCreate

advapi32

FreeSid RegQueryValueExW RegCloseKey EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken RegOpenKeyExW

oleaut32

SysFreeString SysAllocString

Name

.text

Size

2.1MB

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.code

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

508KB

Virtual Size

508KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

30KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

102KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.shared

Size

512B

Virtual Size

8B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.appskin

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.srclibs

Size

358KB

Virtual Size

358KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

sai2.ini

SHA256 17dc3c768c8b392940eba75640118129ff51bd430938180221d781558a7a784c
MD5 3c35b3f651ab0e2beae2d44908348a86
SHA1 76dd7b39b2b4a214b30026d7ed1ad66abfb727db
SHA512 e04315c8bef4d95ea144939d38dea8a712b074dc932146be24f0a4275196013bcad44461955ef71c1d23851752a3ade519ea6e514b08524086d18811d4af72ef
TLSH
T16E3139D624E0916D62EAFF59A7A3A1B0276AF864127D4CE132CDC48980E29117207FF7
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer