Voicemod_Pro_setup[.]exe

Resubmissions

04/08/2026, 00:58

260804-bbndzaej8t8

04/08/2026, 00:54

260804-a9c58aej7s8

Sharing

Copy URL Twitter E-mail

General

Target
Voicemod_Pro_setup.exe
Size 28.1MB
Sample260804-bbndzaej8t
SHA256 fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b
MD5 2428f87e2be4c9c09b5a23edc039e21c
SHA1 5341e4328a7d884f597455a91007b78e9e6aa632
SHA512 f7ca263ad4d74d521263569f10fba8c365c73391c9a3186638bae280fe0a85d1d19d690057d529d0a8ed85899159ee1723472bee065a67a1563f06892ab77bec
SSDEEP 786432:nmw5oSyduo4PCO1P1GCjYbtmt+E6RTQa/Ik:nrqGKO1ovb2nWMa/h
TLSH
T19657330293B7E0EBDCD1FF3B1B7AA41C95D05CC842C7A1E0A5E34F98BF25B1A55061A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 2 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
Voicemod_Pro_setup.exe
unpack001/setup.exe

Unsigned PE 12 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/SteupX.exe
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/StartMenu.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll
unpack002/riskguard-pro.exe

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Voicemod_Pro_setup.exe
unpack001/setup.exe

File Explorer

Voicemod_Pro_setup.exe

.exe 28.1MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 29KB
SteupX.exe

.exe 9.6MB
VC_redist.x64.exe

.exe 24.2MB
setup.exe

.exe 2.7MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 32KB
riskguard-pro.exe

.exe 11.1MB
uninstall.exe.nsis

23KB

Voicemod_Pro_setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 fb2f4bc078c9a87b4a85bdca339a4019410c811777b480f6c357094eec5b483b
MD5 2428f87e2be4c9c09b5a23edc039e21c
SHA1 5341e4328a7d884f597455a91007b78e9e6aa632
SHA512 f7ca263ad4d74d521263569f10fba8c365c73391c9a3186638bae280fe0a85d1d19d690057d529d0a8ed85899159ee1723472bee065a67a1563f06892ab77bec
SSDEEP 786432:nmw5oSyduo4PCO1P1GCjYbtmt+E6RTQa/Ik:nrqGKO1ovb2nWMa/h
TLSH
T19657330293B7E0EBDCD1FF3B1B7AA41C95D05CC842C7A1E0A5E34F98BF25B1A55061A9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

d5:e0:8f:d8:a2:ed:36:59:8d:2c:bf:ed:7d:21:38:d4:59:81:4d:b5:ff:b4:4f:0f:9c:cb:eb:ff:b9:c3:b3:24

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=11171354,CN=ELH Palkehituse LLC,O=ELH Palkehituse LLC,STREET=Palkmaja,L=Valgjärve,ST=Põlva,C=EE,1.2.840.113549.1.9.1=#0c1b70616c6b656869746973656440616c6b65686974697365642e6565,1.3.6.1.4.1.311.60.2.1.3=#13024545,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 10, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

7a:3d:a1:7e:80:bd:53:6b:f7:34:17:30

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jun 13, 2026

Timespan

Jun 9, 2026 - Jun 10, 2027

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

SteupX.exe

IMPHASH 3a3b28f9c55c0421c52c4f3b2fc84fe0
SHA256 6698bc6495e96b8a6654e96369d6ab54a64b3da5d7bfde56f164c10c2afca24d
MD5 7a64a333a55e69890cf627d4391df36d
SHA1 8e66eeaa6b472e8a0fb75bce7e1a67112021bd6c
SHA512 9eacc9b4d88bbd95bf318ebfec6518f1a460678da0769b9939a21ce461c328f7ebec0eb366a88bd77c7ca959d796a05a5df032369c6308f9b3981753db0752fd
SSDEEP 98304:17mM6rFGPKI/kC88D6BS0W/32wo+GPp+kc5AZP/wuBm6:1KbFK5x8hBhnh4AV/wuU6
TLSH
T19DA62920BB5A99ADC45AC47083464A726E3170CB0B35B9FF45D486792FBAAF41F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6154200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Setup.pdb

ntdll

NtReadFile NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError NtWriteFile NtCreateFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

user32

GetAncestor DestroyWindow ReleaseCapture GetForegroundWindow GetWindowLongW PostMessageW DispatchMessageA GetMessageA GetCursorPos CreateIcon ToUnicodeEx GetKeyboardLayout GetRawInputData PostQuitMessage AppendMenuW CreateMenu TranslateAcceleratorW SetMenuItemInfoW VkKeyScanW MapVirtualKeyExW GetKeyState GetAsyncKeyState GetKeyboardState IsProcessDPIAware GetDC CreateAcceleratorTableW IsIconic SetForegroundWindow GetActiveWindow GetWindowTextW RegisterTouchWindow SetWindowTextW SetMenu MonitorFromRect GetSystemMetrics SystemParametersInfoA IsWindowVisible AdjustWindowRectEx IsWindow GetWindowRect MonitorFromPoint GetMessageW TranslateMessage EnumDisplayMonitors DispatchMessageW CreateWindowExW SetCursorPos TrackMouseEvent PeekMessageW GetTouchInputInfo PostThreadMessageW DefWindowProcW FlashWindowEx CheckMenuItem GetWindowLongPtrW SetWindowDisplayAffinity GetMenu ShowCursor ClipCursor GetClipCursor EnableMenuItem GetSystemMenu ShowWindow SetWindowLongW SendMessageW DestroyIcon DestroyAcceleratorTable SetCapture SetWindowLongPtrW MsgWaitForMultipleObjectsEx RegisterRawInputDevices RegisterClassExW RegisterWindowMessageA GetClientRect InvalidateRgn EnumChildWindows SetWindowPos RedrawWindow GetWindowTextLengthW ClientToScreen SendInput GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW MapVirtualKeyW GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow SetCursor LoadCursorW CloseTouchInputHandle ScreenToClient

kernel32

WideCharToMultiByte CreateThread GetTempPathW WriteConsoleW MultiByteToWideChar GetConsoleOutputCP CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFullPathNameW ReadFileEx CreateNamedPipeW ExitProcess SetEnvironmentVariableW CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW DeleteFileW FindFirstFileExW CreateDirectoryW GetFileAttributesW GetModuleFileNameW GetLastError OutputDebugStringA OutputDebugStringW GetProcAddress LoadLibraryExW LoadLibraryW LCIDToLocaleName FreeLibrary GetEnvironmentVariableW GetFileInformationByHandleEx WaitForSingleObjectEx FindClose GetProcessHeap HeapAlloc HeapFree WaitForSingleObject FindNextFileW FormatMessageW ReleaseMutex Sleep GetModuleHandleA HeapReAlloc GetSystemTimePreciseAsFileTime QueryPerformanceFrequency GetUserDefaultUILanguage lstrlenW TerminateProcess GetExitCodeProcess RtlVirtualUnwind ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetDiskFreeSpaceExW VirtualProtect CloseHandle GetCurrentThreadId SleepConditionVariableSRW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent CreateMutexA LoadLibraryA UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer SleepEx WriteFileEx DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue CreateFileW TlsFree GetConsoleMode GetCurrentProcessId GetStdHandle DuplicateHandle GetCurrentProcess SetFileInformationByHandle SetHandleInformation GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError RtlLookupFunctionEntry RtlCaptureContext GetSystemInfo QueryPerformanceCounter SetWaitableTimer CreateWaitableTimerExW SwitchToThread GetCurrentThread PostQueuedCompletionStatus CreateIoCompletionPort GetQueuedCompletionStatusEx SetThreadStackGuarantee AddVectoredExceptionHandler CompareStringOrdinal FreeEnvironmentStringsW SetFileCompletionNotificationModes GetFileInformationByHandle

gdi32

GetDeviceCaps CreateRectRgn DeleteObject

dwmapi

DwmEnableBlurBehindWindow

ole32

CoInitializeEx CoTaskMemFree CreateStreamOnHGlobal CoUninitialize CoCreateInstance RevokeDragDrop CoTaskMemAlloc RegisterDragDrop OleInitialize

advapi32

SystemFunction036 RegCloseKey EventUnregister RegGetValueW RegQueryValueExW RegOpenKeyExW EventWriteTransfer EventSetInformation EventRegister

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass

shell32

SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHGetKnownFolderPath

ws2_32

closesocket WSAStartup WSACleanup WSAGetLastError setsockopt select getaddrinfo getsockname getpeername freeaddrinfo getsockopt WSASocketW bind connect ioctlsocket shutdown recv WSARecv send WSASend WSAIoctl

bcrypt

BCryptGenRandom

uxtheme

SetWindowTheme

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

secur32

EncryptMessage DecryptMessage InitializeSecurityContextW AcceptSecurityContext ApplyControlToken QueryContextAttributesW DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA FreeContextBuffer

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertCloseStore CertOpenStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateStore CertGetCertificateChain

api-ms-win-crt-math-l1-1-0

floor pow trunc round __setusermatherr

api-ms-win-crt-string-l1-1-0

wcsncmp wcslen _wcsicmp strlen strcmp strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _exit _c_exit exit _seh_filter_exe __p___argv _set_app_type _initialize_onexit_table _register_onexit_function _initterm_e _initterm _crt_atexit _get_initial_narrow_environment _cexit abort _initialize_narrow_environment __p___argc terminate _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh calloc free

VC_redist.x64.exe

IMPHASH e277f1464e7729ad9df5ec047611738a
SHA256 5d9999036f2b3a930f83b7fe3e2186b12e79ae7c007d538f52e3582e986a37c3
MD5 810499fc266b73d33d71a8d1e3291ad3
SHA1 91a09963703189274e995ded25b94e165545f126
SHA512 bcf5975977941e30d9e157645ae07b9a0861fbdd98386a0ccecc633100e8e2760366f9c7fb54192b252108dfef708f6cbaa11e812d5036f44466d9d37cf14acd
SSDEEP 393216:HyxUp3vyODNkHm6IYf+jbG8+qkfgaJxaw1pJWpw3PQlXp1lBrKOLllRmR0j9:HyWp3tZkHm6IYfpXh1a+3Pkp1ltlR9B
TLSH
T164473363A564803BD7A20437E926EA147D7CB224235189FBE6CCEC5D3B390C353BB665
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

67:a6:ff:c1:ca:c9:73:40:82:3b:56:98:d5:32:9d:71:aa:da:58:18:2c:76:f1:c8:51:79:1d:71:72:42:9b:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Aug 16, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:03:ae:2d:35:51:c8:53:8f:55:1d:00:00:00:00:03:ae

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 16, 2023 - Nov 14, 2024

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:2AD4-4B92-FA01,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:de:9e:48:9e:96:9f:28:44:3d:00:01:00:00:01:de

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 12, 2023 - Jan 10, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

197349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\36\s\wix\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW CloseEventLog OpenEventLogW ReportEventW ConvertStringSecurityDescriptorToSecurityDescriptorW CreateWellKnownSid InitializeAcl DecryptFileW SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorOwner SetSecurityDescriptorGroup SetSecurityDescriptorDacl InitializeSecurityDescriptor GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

PeekMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage GetMessageW TranslateMessage MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW

oleaut32

VariantInit SysAllocString VariantClear SysFreeString

gdi32

DeleteDC DeleteObject SelectObject StretchBlt GetObjectW CreateCompatibleDC

shell32

CommandLineToArgvW SHGetFolderPathW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoInitializeSecurity CLSIDFromProgID

kernel32

GetFileType GetStdHandle EncodePointer InitializeCriticalSectionAndSpinCount SetLastError RtlUnwind CreateFileW CloseHandle ExitProcess CreateFileA SetFilePointer WriteFile GetLastError GetCurrentProcessId GetSystemDirectoryW LoadLibraryW lstrlenA HeapSetInformation GetModuleHandleW GetProcAddress LocalFree SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetTempFileNameW RemoveDirectoryW SetFileAttributesW GetTempPathW MoveFileExW FormatMessageW lstrlenW MultiByteToWideChar IsValidCodePage LCMapStringW ExpandEnvironmentStringsW GetFileSizeEx GetFullPathNameW ReadFile SetFilePointerEx SetFileTime Sleep GlobalAlloc GlobalFree CopyFileW GetLocalTime GetModuleFileNameW CompareStringW HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FreeLibrary InitializeCriticalSection DeleteCriticalSection ReleaseMutex GetCurrentProcess FindFirstFileExW TlsAlloc TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask GetVolumePathNameW EnterCriticalSection LeaveCriticalSection GetSystemTime GetWindowsDirectoryW GetNativeSystemInfo GetSystemWow64DirectoryW GetModuleHandleExW GetComputerNameW VerifyVersionInfoW GetDateFormatW GetUserDefaultUILanguage GetUserDefaultLangID GetSystemDefaultLangID GetStringTypeW DuplicateHandle LoadLibraryExW CreateEventW ProcessIdToSessionId ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitForSingleObject GetProcessId OpenProcess CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects LocalFileTimeToFileTime SetEndOfFile ResetEvent DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW CreateMutexW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetThreadLocale GetStartupInfoW IsDebuggerPresent GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode DecodePointer WriteConsoleW GetModuleHandleA VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GetCurrentThreadId WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo RaiseException GetTimeZoneInformation

rpcrt4

UuidCreate

setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 e02289b832c8e696864258d297748a13b719a4a87459f555dbd362cb53f898fe
MD5 e1fcae5e0b020c1f205c5f2348f9395a
SHA1 cf1a69b970a5d719518566248d1bf4fe9d00eb9c
SHA512 6a05050d996c80ca4aeb09217836134c16c2c038be9154fa673f581f8c43d6f641589ec748aade6330711f23fc4213e9d89cd1f2f40309defa62cb49a161f763
SSDEEP 49152:HVlT4xA/kfz/5gA5Isr9Kcj39WT/wxsHT/UASIBJzG+f4D0DJ:H/T5/mWAO49Kcj3sw1Aj/40l
TLSH
T114D533545EE8E0E3DD244732FE15BA207B8BAE761858560B1325E9E41E332F58B3F6C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

1d:73:8a:37:d8:d0:e0:44:30:5e:3d:eb:1d:40:d4:b2:5d:75:77:27:3d:e0:2c:92:db:4e:f8:63:b4:6b:2e:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=AAD-5839,CN=GANPATI ESTATES LLP,O=GANPATI ESTATES LLP,L=Jaipur,ST=Rajasthan,C=IN,1.2.840.113549.1.9.1=#0c166b6973616e7679617331323640676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.2=#130952616a61737468616e,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jan 20, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

1a:68:e8:ae:fb:db:d2:b9:72:f8:d6:bd

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Jun 10, 2026

Timespan

Jun 12, 2025 - Jun 13, 2026

Subject

CN=Globalsign TSA for CodeSign1 - R6,O=GlobalSign nv-sa,C=BE

Serial Number

01:00:0b:20:05:b3:94:07:62:db:3e:36:79:94:9b:a9

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 11, 2025 - Dec 10, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 f3e9b0d43b66fa6b05d2fa4de4547517a3ec0bc0b14de3c349d817465bbf7ab4
MD5 6ebdde247cad8468575f1f2a4d7ae2a2
SHA1 d0c502f45df55c0465c9406088ff016c2e7e6817
SHA512 0b9edf145badd750c115597cb7a11d8f60768396444cb3d449a45afad7c930ea37f31b3aaa37b2fe4902f1ef6679756f3364f37ebe13d1a7e9b5d0340bac5c5a
SSDEEP 768:6vVnRZHrPT4n4d/CryKDuIcrFKpnp0jdhK7R+qV:6vV3Hrc4EJBcZtXIV
TLSH
T1C9E2394CFDC52EBAE2DF05390409557F466FC8081B14DAABD3712E92D5E23326EE522E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4245

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

riskguard-pro.exe

IMPHASH 6c195ece5ef46382a8903488c50a9261
SHA256 3697ad4d5a887a81f825ccdf9e3dbe3c55a58c62802a31c894f7baad1a020ec3
MD5 d77d0ad3ad0eb56afa5dd2b8fdca9a72
SHA1 8267b9f760c1483ec33d5a2f2f492db7c364fec3
SHA512 0e6caed09ca89ed9ae3f89ddf2c9baac3d8240b2846fb2f597cf3aea0ae7fabccc4c4a2d7bb9a330d7282ac627826b56728cf8dda9a819beb6437cfde9138887
SSDEEP 98304:XSHJ1IrGY4jlzlG1FKr1+n3GeN1JvsNN94BIWjJ6nRMFjzsvG:JGYWlzsQ06WBzMG
TLSH
T130C619217B5A99ACD05BC4748257467A6D7130CB0B35B9FF08A462782F6ABF41F3831B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8008672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

riskguard_pro.pdb

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey RegGetValueW EventUnregister EventRegister EventSetInformation EventWriteTransfer

ntdll

RtlNtStatusToDosError NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlGetVersion

kernel32

UnmapViewOfFile WaitForSingleObject OutputDebugStringA HeapFree HeapCreate RaiseException SleepConditionVariableSRW lstrlenW HeapSize IsProcessorFeaturePresent IsDebuggerPresent MultiByteToWideChar FormatMessageW OutputDebugStringW FlushViewOfFile LoadLibraryA RtlPcToFileHeader GetModuleHandleW WaitForSingleObjectEx HeapReAlloc GetUserDefaultUILanguage GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy LCIDToLocaleName LocalFree EncodePointer TlsAlloc TlsGetValue TlsSetValue GetCurrentProcessId TlsFree GetCurrentThreadId UnhandledExceptionFilter FindNextFileW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext TerminateProcess GetSystemTimePreciseAsFileTime WriteFileEx GetProcessHeap FreeLibrary WideCharToMultiByte CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP GetStdHandle GetSystemTimeAsFileTime QueryPerformanceFrequency SleepEx ReadFileEx ExitProcess SetEnvironmentVariableW FindClose FindFirstFileExW GetFinalPathNameByHandleW SwitchToThread GetFileInformationByHandleEx DeviceIoControl GetSystemTime FormatMessageA CreateDirectoryW GetCommandLineW GetEnvironmentStringsW GetCurrentDirectoryW SetLastError GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetModuleFileNameW LoadLibraryExW MapViewOfFile SetUnhandledExceptionFilter InitializeSListHead RtlUnwindEx GetModuleHandleA GetTickCount DuplicateHandle SetFileInformationByHandle ReleaseMutex CreateMutexA GetCurrentProcess GetEnvironmentVariableW Sleep GetLastError GetProcAddress CloseHandle DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection ReadFile WriteFile UnlockFileEx CreateMutexW CreateFileW WakeAllConditionVariable CreateFileA LockFileEx ReleaseSRWLockExclusive InitializeCriticalSectionAndSpinCount HeapValidate SystemTimeToFileTime CreateFileMappingW QueryPerformanceCounter LoadLibraryExA GetConsoleMode WriteConsoleW AcquireSRWLockExclusive FlushFileBuffers GetFileSize UnlockFile DeleteFileW DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetFileAttributesW GetTempPathW SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW AreFileApisANSI GetFileInformationByHandle

user32

CreateAcceleratorTableW DestroyAcceleratorTable TrackPopupMenu DrawTextW GetWindowDC OffsetRect DrawIconEx PostQuitMessage GetMenuBarInfo DrawMenuBar SetMenu GetMenuItemInfoW CreateIcon GetAsyncKeyState GetKeyboardState SetWindowLongW EnableMenuItem DestroyWindow TranslateAcceleratorW MapVirtualKeyW GetMessageW TranslateMessage DispatchMessageW PostMessageW PostThreadMessageW RedrawWindow GetSystemMenu MapVirtualKeyExW ToUnicodeEx GetKeyState SystemParametersInfoA SetPropW DefWindowProcW GetKeyboardLayout FlashWindowEx ChangeDisplaySettingsExW GetMenu ShowCursor ClipCursor GetClipCursor IsWindowVisible GetRawInputData PeekMessageW MonitorFromPoint SetWindowTextW GetWindowTextW GetWindowTextLengthW SetWindowDisplayAffinity SendInput SetForegroundWindow DestroyIcon SetWindowPlacement RegisterRawInputDevices ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx GetWindowPlacement SetWindowPos InvalidateRgn LoadCursorW SetCursor RegisterWindowMessageA SetParent MapWindowPoints GetWindow SetFocus ShowWindow ReleaseDC EnableWindow IsWindowEnabled GetWindowRect SetWindowLongPtrW GetParent GetWindowLongPtrW FindWindowExW SetWindowRgn RegisterClassExW IsProcessDPIAware GetDC CreateWindowExW GetMessageA DispatchMessageA EnumChildWindows AppendMenuW SetMenuItemInfoW CreateMenu CreatePopupMenu RemoveMenu GetForegroundWindow CheckMenuItem RegisterTouchWindow IsWindow AdjustWindowRectEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos DestroyMenu GetUpdateRect ValidateRect GetMonitorInfoW MonitorFromWindow GetCursorPos GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect MonitorFromRect ClientToScreen GetClientRect GetWindowLongW ScreenToClient IsIconic SendMessageW AdjustWindowRect InsertMenuW EnumDisplayMonitors

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

ole32

CoInitialize CoCreateFreeThreadedMarshaler CoUninitialize CoTaskMemFree OleInitialize CoCreateInstance CoTaskMemAlloc CoInitializeEx RegisterDragDrop RevokeDragDrop

shlwapi

SHCreateMemStream

gdi32

DeleteDC CreateSolidBrush CreateCompatibleDC DeleteObject SelectObject CreateDIBSection BitBlt GetDeviceCaps CreateRectRgn SetBkMode SetTextColor CombineRgn

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

shell32

SHOpenFolderAndSelectItems ShellExecuteExW SHGetKnownFolderPath ILFree DragQueryFileW DragFinish SHCreateItemFromParsingName SHAppBarMessage ShellExecuteW ILCreateFromPathW

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo

api-ms-win-crt-math-l1-1-0

roundf pow round log floor __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

strlen wcsncmp wcslen strcspn strcpy_s wcscmp strncmp strspn strcmp _wcsicmp

api-ms-win-crt-heap-l1-1-0

_msize realloc free _callnewh malloc calloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e _get_initial_narrow_environment _endthreadex exit _beginthreadex _initialize_narrow_environment __p___argc _configure_narrow_argv __p___argv abort _set_app_type terminate _crt_atexit _cexit _c_exit _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _seh_filter_exe _exit

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

7.8MB

Virtual Size

7.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

25KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

433KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.taubndl

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Voicemod_Pro_setup.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

generic

SteupX.exe

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

user32

kernel32

gdi32

dwmapi

ole32

advapi32

comctl32

shell32

ws2_32

bcrypt

uxtheme

oleaut32

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

VC_redist.x64.exe

advapi32

user32

oleaut32

gdi32

shell32