INNORIX-Agent[.]exe

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/newadvsplash.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/$PLUGINSDIR/nsisFirewall.dll
unpack001/$PLUGINSDIR/nsislog.dll
unpack001/$PLUGINSDIR/time.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

INNORIX-Agent.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 6d6832a752a60fe0a5b24444cbc4a1bb6da1a81323d8df9af0df46571f10e943
MD5 d2277d44827f5de7971581b25aa5a5f6
SHA1 f9375d0e6af34ac4e472d2a1afbe71cd7c93d0a0
SHA512 889ab9e744a0a0183f4ff90c45cbe1c9999da5dadd290cb88160dfa76217b81a9adaccc30f24a6d20dd7b4974c10604ba1495192c81cf20909e5c4880c59bced
SSDEEP 196608:nxKRtPDQJqqK1s+TTvBPboDZtYtVE9U82HpYqtOENtvw7zsM313Nr:BJqd1FTD1QrYtl5xOENtzM3zr
TLSH
T1E4B633672313EA81C9C6E07E12C4AD7D21B6B252C558DD4E3F982B9C0DF9963F902D78
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

e7:bc:a9:07:63:8d:1d:89:ca:e1:48:47:a0:89:d6:b3:cd:28:24:ae:6c:90:14:1c:65:0d:19:f4:0a:fe:20:14

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Chains

Apr 2, 2025

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Serial Number

0e:e9:c7:7a:4d:ff:22:cb:0c:2d:20:f3:fc:58:06:5a

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 20, 2024 - Nov 19, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 478f3d2e6e4f7acb08e915a22a3e49033bc00eb0e5139d5008ca427d2d3dee4e
MD5 b66e186190c780830d5adf4c8097afb4
SHA1 86128d6ebde1cd6c162ba27dcc3e4677c643d6c8
SHA512 ccad3d538a8916d4dede9e2aa5cab57fade5b6b117c91a6db009a005d1edb84a272726c8157dacc2016a6cf9f003eadf08621c451aa9ea21256dcc5ca4e3e73d
SSDEEP 192:A4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjnK72dwF7dBOne:5n3T5KdHCMRD/R1cOnrjn+BO
TLSH
T132622B55738488F3DBD2003E785237079B9A5565B4929ED2CA275FC66C7B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/SimpleSC.dll

SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
MD5 d63975ce28f801f236c4aca5af726961
SHA1 3d93ad9816d3b3dba1e63dfcbfa3bd05f787a8c9
SHA512 8357e1955560bf0c42a8f4091550c87c19b4939bf1e6a53a54173d1c163b133b9c517014af6f7614eddc0c9bbf93b3b987c4977b024b10b05b3dc4eb20141810
SSDEEP 1536:i/qXv1si+Xsp9MNptZ8KMT6+nMA4fx+kmA:Bv1EXZnLMT5M3x+km
TLSH
T153533913B5C008B7E0318EFCAC26A314A12BBA613D7E6C1AB5DD1DCE8D2D6C75C1A597
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

52320

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

950B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/innorixas-splash.jpg

SHA256 1ded59b3015590b45150a956476266742de0066f74bf6d313cd7289fff008f3c
MD5 df801e9c13f1da03087fc0f7429dc988
SHA1 35833257bf655e72ad6b56eab9759a05a2a2c268
SHA512 903770353b16df6f64ee37d2d02a0dd6fdfc99f11b8a550fe4e8f44094d2bc7ff42d62f1f878df72171f57a0cf47242b25fbb0437afb605298b11f9164210918
SSDEEP 1536:JENQpxbClWvJViKwqA+eL+2uAq6rE/102W3v2Tyy7+giu7Qqu0DHtN4Uq/HJ:KNOFiXWeL+irg102Wf0yy1iAtumHTCHJ
TLSH
T1F19302122F56B10EE628FC43CBD7394CC8ABC524D383A5CB92C5C55AE19ADE1631A6E1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/newadvsplash.dll

IMPHASH 2e363db44011ed76701ec6ce62db36f5
SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
MD5 7ee14dff57fb6e6c644b318d16768f4c
SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
TLSH
T1A002E839618096F3D26F15F45882AB1D4BFAE074239290324F73A1EA6DC0297FDB6347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 46f8b6973f33717335c0f6d8087de67b
SHA256 3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9
MD5 b648c78981c02c434d6a04d4422a6198
SHA1 74d99eed1eae76c7f43454c01cdb7030e5772fc2
SHA512 219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2
SSDEEP 96:U7GUxNkO6GR0t9GKKr1Zd8NHYVVHp4dEeY3kRnHdMqqyVgNN3e:mXhHR0aTQN4gRHdMqJVgNE
TLSH
T128D1F97675E22EB3C54ACA353C527A2B57F8C8111B9401549B978BD238C5EF3EA29282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH a49b0342971aa199fc6349725b90146d
SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
MD5 faa7f034b38e729a983965c04cc70fc1
SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
TLSH
T10E91D77693D440B2D186093255A31AA31BEDC536035B590EAF835E937F90DFBECB9322
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisFirewall.dll

IMPHASH 1a4c99175e8891c64634680f4f238d51
SHA256 2e204ee4f1d12b4ca35c8205cea0cabe354f2e79a471863cfb76a7cee83cf107
MD5 69f2e8c6fd141e9e720b2c4c366a8154
SHA1 a6279d93a102b6d7608dced32a36ddcd3e51994c
SHA512 bf23a5f3ce98e6a1c04fe8ae6b6f385483ceed62470cd109017c97f37c23adbf0203bfb43d09b007c6925aeb5da9617f33bc5c478618f00cc91da83a48cacaf2
SSDEEP 96:KCQjg8aCpUcmloiwmXaYY8NVxIYn69TEdUc1ND0RrXQAcuAtoFrJxalMu2k:KCQPeip58NjMNWND0RrXYuAWkM
TLSH
T14DF1D73076E181B2D32F02F45F4B539EA5B5B630BBE041336B53570D2DB068DE96AB22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7175

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsislog.dll

SHA256 271d539fe130276189e0a32b8a0bc9f08f2d92f7e17f85d88726735f14ea6144
MD5 e47100b70748fc790ffe6299cdf7ef2d
SHA1 ad2a9cd5f7c39121926b7c131816e7ba85aeead2
SHA512 88452a9aeff453e7979df9240ab396cbc0c5d00efecda97df1e46f2ba1e9b5bfd990921e85d503beb4b35a1de7681390ba124eeeaf896f250717892ced133e93
SSDEEP 768:wCpqFQLwm2VQRIsW6z66P9dmnKyAPKoaQtt34Zt4DtV4U0Kx8xkS:XpqFQiVUfDzXmmb6mJVN0KWxN
TLSH
T1BF137C17A6E19472ECB1CBF81D38A320BA3F7C703D64927957A8199E8C643C25C98377
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

66B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/time.dll

IMPHASH 52d8e191fc300dee721dd8473cf053f5
SHA256 700cf2c2ae144ad688a33d2df320b415425749e1ee87b9ae61edcb42650a1390
MD5 8676721a04a174016e5d3f3c554302f1
SHA1 5f230d048560e70bfcb05aace39ad349bc8ff0aa
SHA512 aa54460dbfe691ece82080df64af98eaf66374060bbf85d8e48e17ec0ab296489a9822c6e8020d5809481e90b1fec9f0558559a0f096ab0452502f7a404a2d0e
SSDEEP 192:FMGPLjEMXjEMY6X+o5lo2kCK2nKhgOezjEVLmupUH0YBMfVkKlm:FBvBz/Y6Pls2Khx7pm080Q
TLSH
T143627D23B1E1D8BBC0CA06742FC6331721A56FBDD3D0EE076AD77C875A705975928161
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8012

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ca.crt

SHA256 3d5948994e5d9ffb5367fdd6466ad7d734a7d45275126a8fac4478d93cddcfb8
MD5 15252889e5d99a2ac60734b4f1c7148a
SHA1 adcb02d0367c24df48755cf375e7efd566f9ab43
SHA512 1ccc761d6932fa20f79c14cffb4ff8b0779f3dc161bfa93cc70f6dbb101af1b6ab775c3f7cdcd41d7f640b49f73d98a93bc32f7694fdf6d4f443e821db4ba892
TLSH
T12421A7E95AF03D9E24B6B92CF0310BC9A92424B7DF46E82A86601899C648710D1FD4CF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

innorix.pem

SHA256 562b4bf1094935979a9d10c38a7609516a4fa108809875f6fd53b7d134b75a05
MD5 45cbe8df9229eea1cb05bd566c2a827e
SHA1 1fed13d9affe8e843a61ee8c1c98d2ce62325e09
SHA512 a88d67381f8217f75aeaeeb4eae372659edfa19d26eddcb0cfc8f05ae2deb61d9162caa7071f2bc07eb120f07617ec5aef8f79569f1b6c2df344e5a1903ad4a9
TLSH
T108515C541B49DC9D68CFF6E816E33318C9A5AD952B1643418D913017C9EA11D42EEC15
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

innorixam.exe

IMPHASH 54ccf195a57202ec22ce79b82911382f
SHA256 00947ee184215932683d20f2e086c76ecf1a76f4616dd17f1489058d8586d27f
MD5 a8f0aac0c896acd5f70ae726ba2971ff
SHA1 a24dceda87dd19e168a852cf83e593d074e062f8
SHA512 c510c41c746f92d3b2a22b2ab3706b7e6f2bbc332ec20457dfcf348859a380a03506e7fb4710b32328d564be01b5f695817d2887fc7a8e69c4c0553a63a8b8eb
SSDEEP 12288:KqQhVZnevuAHtxuJhM9CjXUCKyoKsScTOiAFampeRgKT9El48fj4+tBRh2ysl6m:KqR8jECboBTvQwel4Ujzj46m
TLSH
T1A105C0113AB2C075D492C1798E79E72A20BEBC714B614EC777C82A0D2EF15C2E736766
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

07:15:8d:e7:35:43:67:25:16:59:73:97:bd:8f:41:0b:96:79:6e:5e:ca:31:25:9a:ea:d6:41:c8:21:b4:d2:01

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Chains

Apr 2, 2025

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Serial Number

0e:e9:c7:7a:4d:ff:22:cb:0c:2d:20:f3:fc:58:06:5a

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 20, 2024 - Nov 19, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

225000

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\project\innogmp9\trunk\InnoiotMonitor\Release\innorixam.pdb

kernel32

Process32NextW GetModuleHandleA CreateToolhelp32Snapshot DeleteCriticalSection TlsAlloc CloseHandle TlsFree GetCurrentProcess GetVersionExW GetSystemInfo GetModuleHandleW GetConsoleWindow FormatMessageW LocalFree DecodePointer LockResource Process32FirstW EnterCriticalSection HeapSize GetProcAddress GetLastError InterlockedExchange RaiseException LeaveCriticalSection HeapDestroy Sleep SetEvent HeapFree CreateEventA HeapAlloc GetProcessHeap GetTickCount SizeofResource InitializeCriticalSectionAndSpinCount WideCharToMultiByte InterlockedDecrement InterlockedIncrement LoadResource FindResourceW FindResourceExW GetModuleFileNameW HeapReAlloc DeviceIoControl GetFileAttributesW GetCurrentDirectoryW MultiByteToWideChar GetStringTypeW EncodePointer IsDebuggerPresent OutputDebugStringW FormatMessageA ResetEvent ReleaseSemaphore WaitForSingleObjectEx WaitForMultipleObjectsEx OpenEventA SetWaitableTimer GetCurrentProcessId GetCurrentThreadId ResumeThread TlsGetValue TlsSetValue GetSystemTimeAsFileTime CreateWaitableTimerA SystemTimeToFileTime GetStdHandle GetFileType GetModuleHandleExW WriteConsoleW RtlUnwind DuplicateHandle CreateProcessA IsProcessorFeaturePresent GetCommandLineW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError TerminateProcess GetStartupInfoW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW CreateThread ExitThread LoadLibraryExW ExitProcess AreFileApisANSI WriteFile IsValidCodePage GetACP GetOEMCP WaitForSingleObject GetExitCodeProcess CreatePipe QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetTimeZoneInformation GetFileAttributesExW ReadConsoleW SetStdHandle SetEnvironmentVariableA CreateFileW SetEndOfFile

advapi32

ControlService SetServiceStatus StartServiceW ChangeServiceConfig2W OpenServiceW OpenSCManagerW DeleteService CloseServiceHandle CreateServiceW RegCloseKey RegOpenKeyExW RegQueryValueExW RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

ws2_32

WSAStartup WSACleanup

Name

.text

Size

354KB

Virtual Size

353KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

77KB

Virtual Size

77KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

311KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

innorixas.conf

SHA256 84deac6cf7580e40dc86380261f8fc6599b1238816a0dd34ddf562658142f0c9
MD5 62231b49a299ff9c4b5d1a5616b683d9
SHA1 01b0981c9f99a47786904621bc39bd2efcfbff74
SHA512 a4044a44beaf07a236b0b562b073c3b09d0427e0976cd5532e44b7d1a32dd9673af8789f84bac505aa2de47a3671d22a9ba0d996a7ac7cbb71867ec18adab178
MD5 SHA1 SHA512

NSIS installer

installer

innorixas.exe

IMPHASH 13d0eed718cb8f26cfe0dab8208f3c28
SHA256 d8342126d7bd959813895f522ba6885dd6918069b09297a8bc1e101bc0681cf1
MD5 910145271fd5cb579cb98b57366b6f29
SHA1 e67e71eda73e407fc14ca6d603279dc3ef6ff09d
SHA512 334bd63bb6f921e1929250f7b261f9e3fec17947c1a0f706648512ca363f38660d9d50efcd9c3676a91bbdcd9e6a24787c3876a283f85481f0385fc761675c0e
SSDEEP 393216:5QGpMbWvhZZb9T/qrHu1eoATC3wTRmGbEuc:5QHbI/hZkmAc
TLSH
T17C076D0DEB9441F5C0B6C1BC8A574683E1B2B8A74B3067E709B916350E776E0AF3EE51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

43:90:c6:05:66:ed:c6:4b:23:d3:4a:eb:91:aa:d5:80:ab:10:e1:35:60:39:2e:2d:76:7c:17:b0:43:23:29:dc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Chains

Apr 2, 2025

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Serial Number

0e:e9:c7:7a:4d:ff:22:cb:0c:2d:20:f3:fc:58:06:5a

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 20, 2024 - Nov 19, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6732316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\project\innogmp9\trunk\innoiot\build\vc\x64\Release\innorixas.pdb

kernel32

CreateDirectoryW FindFirstFileW SetHandleInformation SetLastError EnterCriticalSection FindNextFileW GetCurrentProcess TerminateProcess WaitForMultipleObjects SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetFullPathNameA CreateMutexW FindClose WaitForSingleObject GetFileAttributesW ReleaseMutex DuplicateHandle CreateEventW MultiByteToWideChar Sleep GetLastError GetFileAttributesExW SetEvent GetCurrentThread PulseEvent CloseHandle WideCharToMultiByte CreateProcessA WaitForSingleObjectEx CreateEventA ReleaseSemaphore GetModuleHandleA GetProcAddress CreateSemaphoreA GetTickCount GetSystemTimeAsFileTime HeapFree HeapAlloc GetProcessHeap WaitForMultipleObjectsEx ReadFile WriteFile SetFilePointer CreateFileW CreateFileA OpenProcess CreateToolhelp32Snapshot ProcessIdToSessionId FormatMessageW Process32NextW LocalFree WTSGetActiveConsoleSessionId ReadDirectoryChangesW SleepEx InitializeCriticalSectionAndSpinCount SizeofResource SetDefaultDllDirectories GetModuleFileNameW HeapSize LockResource HeapReAlloc RaiseException FindResourceExW LoadResource FindResourceW DecodePointer HeapDestroy DeleteCriticalSection WritePrivateProfileStringW GetCurrentThreadId GetSystemDirectoryW DeleteFileW GetLocalTime GetCurrentProcessId FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter GetVersionExW GetSystemInfo GetModuleHandleW GetConsoleWindow LocalAlloc QueryPerformanceCounter GetFileTime GlobalFree QueryPerformanceFrequency GetThreadTimes ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx LoadLibraryW MoveFileExW CompareFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe VerSetConditionMask VerifyVersionInfoW SetConsoleMode GetEnvironmentVariableW ReadConsoleA GetConsoleMode ReadConsoleW TlsSetValue TlsAlloc TlsGetValue TlsFree GetModuleHandleExW RtlVirtualUnwind DeleteFiber SwitchToFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryA SystemTimeToFileTime GetSystemTime AreFileApisANSI TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetEndOfFile UnlockFileEx GetTempPathW UnmapViewOfFile HeapValidate GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile DeleteFileA HeapCompact UnlockFile LockFileEx GetFileSize FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers RtlUnwind GetLogicalDriveStringsW CreateTimerQueue UnregisterWaitEx QueryDepthSList VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW EncodePointer SwitchToThread CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenEventA SetWaitableTimer ResumeThread GetLogicalProcessorInformation CreateWaitableTimerA IsValidCodePage IsDBCSLeadByteEx GetLocaleInfoA EnumSystemLocalesA FoldStringW GetDateFormatW GetTimeFormatW GetCurrencyFormatW SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW RemoveDirectoryW SetFilePointerEx DeviceIoControl GetWindowsDirectoryW CopyFileW SetErrorMode ExitProcess GetProcessAffinityMask GetACP GetNativeSystemInfo GetLongPathNameW GetTempFileNameW GetCommandLineW CreatePipe GetExitCodeProcess CreateThread IsBadReadPtr IsBadStringPtrA ExpandEnvironmentStringsW GlobalAlloc GlobalUnlock GlobalLock MulDiv FreeConsole AttachConsole WriteConsoleA WriteConsoleW FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetConsoleCursorPosition ReadConsoleOutputCharacterA GlobalSize GlobalHandle GetStringTypeExW GetUserDefaultLCID RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader SetStdHandle ExitThread FreeLibraryAndExitThread GetConsoleCP GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetCommandLineA GetTimeZoneInformation IsValidLocale EnumSystemLocalesW FindFirstFileExW GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW SignalObjectAndWait GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualAlloc VirtualFree InterlockedPopEntrySList

winspool.drv

DocumentPropertiesW GetPrinterW OpenPrinterW ClosePrinter

Name

.text

Size

11.1MB

Virtual Size

11.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

589KB

Virtual Size

816KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

891KB

Virtual Size

891KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

innorixst.exe

IMPHASH 6592c3589fe8f4168c7d8967929da91e
SHA256 cffc4ecaa8256c9e2d3dd7655b17ef7577b61632df7ee85b7498fcee3ec35b73
MD5 09dab3d1ab13b164841f4e928fe8c342
SHA1 8183b040820fbfe43b22b8f82b7ab49a06cc5ac9
SHA512 9eb7a64e8a8f428532184357aaa417250439fd13a800cd01498b6a3803867dcc82014a77bf44aac43efa68d1202fe3ecfb817ef9ba659e65ad0660b9e53b4c40
SSDEEP 196608:LP1V1oHbaNq9pwvQWqbJHtPbC7ujoBOccRkSU90F2oH:LNoHbD9pwvQ9bnPbDjISUZoH
TLSH
T124076D0DAB9441E6C0B7C1BC8A474797E2F2BC964B3067EB0575233A1E376D05F3A662
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

6b:1e:79:aa:e9:13:47:41:8e:98:6d:a4:9a:ec:1e:d1:7d:d9:0c:67:5e:1c:cc:53:9e:82:e5:57:83:11:6f:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Chains

Apr 2, 2025

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Serial Number

07:84:3d:ad:01:c1:15:c2:74:ee:41:a7:28:22:46:79

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 23, 2022 - Jun 22, 2032

Subject

CN=INNORIX,O=INNORIX,L=Jongno District,ST=Seoul,C=KR

Serial Number

0e:e9:c7:7a:4d:ff:22:cb:0c:2d:20:f3:fc:58:06:5a

Issuer

CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1,O=EnVers Group SIA,C=LV

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Nov 20, 2024 - Nov 19, 2025

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

6

Entry point

6206228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\project\innogmp9\trunk\innoiot\build\vc\x64\Release\innorixst.pdb

kernel32

CreateDirectoryW FindFirstFileW SetHandleInformation SetLastError EnterCriticalSection FindNextFileW GetCurrentProcess TerminateProcess WaitForMultipleObjects SetThreadPriority LeaveCriticalSection InitializeCriticalSection GetFullPathNameA CreateMutexW FindClose WaitForSingleObject GetFileAttributesW ReleaseMutex DuplicateHandle CreateEventW MultiByteToWideChar Sleep GetLastError GetFileAttributesExW SetEvent GetCurrentThread PulseEvent CloseHandle WideCharToMultiByte CreateProcessA WaitForSingleObjectEx CreateEventA ReleaseSemaphore CreateSemaphoreA GetSystemTimeAsFileTime WaitForMultipleObjectsEx ReadFile WriteFile SetFilePointer CreateFileW CreateFileA GetModuleHandleA GetProcAddress GetTickCount HeapFree HeapAlloc GetProcessHeap WritePrivateProfileStringW GetModuleFileNameW GetCurrentThreadId GetSystemDirectoryW DeleteFileW GetLocalTime GetCurrentProcessId FreeLibrary LoadLibraryExW SetUnhandledExceptionFilter LoadLibraryW GetVersionExW FormatMessageW OutputDebugStringW GlobalLock LocalFree SetDefaultDllDirectories LocalAlloc GetModuleHandleW QueryPerformanceCounter GetFileTime GlobalFree QueryPerformanceFrequency GetThreadTimes ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx DeleteCriticalSection MoveFileExW CompareFileTime GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe SleepEx VerSetConditionMask VerifyVersionInfoW SetConsoleMode GetEnvironmentVariableW ReadConsoleA GetConsoleMode ReadConsoleW TlsSetValue InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsFree GetModuleHandleExW RtlVirtualUnwind DeleteFiber SwitchToFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber LoadLibraryA SystemTimeToFileTime GetSystemTime AreFileApisANSI TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetEndOfFile UnlockFileEx GetTempPathW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile DeleteFileA HeapReAlloc RaiseException GetSystemInfo HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize FormatMessageA CreateFileMappingW MapViewOfFile FlushFileBuffers GetLogicalDriveStringsW CreateTimerQueue UnregisterWaitEx QueryDepthSList VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter IsProcessorFeaturePresent ResetEvent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStringTypeW EncodePointer DecodePointer SwitchToThread CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo OpenEventA SetWaitableTimer ResumeThread GetLogicalProcessorInformation CreateWaitableTimerA IsValidCodePage IsDBCSLeadByteEx GetLocaleInfoA EnumSystemLocalesA FoldStringW GetDateFormatW GetTimeFormatW GetCurrencyFormatW SetCurrentDirectoryW GetCurrentDirectoryW GetDiskFreeSpaceExW GetFileInformationByHandle RemoveDirectoryW SetFilePointerEx DeviceIoControl GetWindowsDirectoryW CopyFileW SetErrorMode GetLongPathNameW GetTempFileNameW ExitProcess GetProcessAffinityMask ExpandEnvironmentStringsW GetACP GetNativeSystemInfo LoadResource LockResource SizeofResource FindResourceW GetProfileStringW GetCommandLineW CreatePipe GetExitCodeProcess CreateThread CreateProcessW IsBadReadPtr IsBadStringPtrA GetFileSizeEx MulDiv GlobalAlloc GlobalUnlock FreeConsole AttachConsole WriteConsoleA WriteConsoleW FillConsoleOutputCharacterW GetConsoleScreenBufferInfo SetConsoleCursorPosition ReadConsoleOutputCharacterA GlobalSize GlobalHandle GetStringTypeExW GetUserDefaultLCID RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList RtlPcToFileHeader SetStdHandle ExitThread FreeLibraryAndExitThread GetConsoleOutputCP GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetConsoleCtrlHandler GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree IsValidLocale EnumSystemLocalesW FindFirstFileExW GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SignalObjectAndWait GetThreadPriority CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait VirtualAlloc VirtualFree InterlockedPopEntrySList RtlUnwind

winspool.drv

DocumentPropertiesW GetPrinterW OpenPrinterW ClosePrinter

Name

.text

Size

10.6MB

Virtual Size

10.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

497KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

795KB

Virtual Size

795KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

386KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

property.conf

SHA256 f248d284a53970af9d2fe64df226651f8b217b55f7198f3e45a7e66594a19f37
MD5 392ee6c636b21d9dda55c91997c73488
SHA1 a82cbd80b881621f3d80dda591d6ca74e572d385
SHA512 4f2034c4e394dd5d6f242feb8dced3748672b6632215fbf1bd2c381fe6eb4ff1c6dca86046f9d709b41a77449aa7af58b2bed16f45579ae142180c94d94ea425
MD5 SHA1 SHA512

NSIS installer

installer

resource/License

SHA256 15dd873db0494610806a46fb77febfb7edae1fdb31bd20fc1cae215793c59e53
MD5 abc65354a7c391359b349ef35c4b7a02
SHA1 be57c4a3089170e438fcb8afa1449e7b72afd2df
SHA512 d31faa2facc4b95d47a9a25157ad382708630f135337b9be0bab7c57bde0576cf935612fa8d3dd8dca1eea4c415df470b53a1ae61af82abe08c874a38ab45429
SSDEEP 768:U3SZGHo5zWsdyC7hC+l4s/qzIx3r3oE6I07xsIttJuEXGLUb/q1GH:U3SZKizb5hCY4s/qzIx8t9tJ1GLo/qAH
TLSH
T1DBE2E85FBF45037215F2C3606A5DA8C9F21FA12D7B6B1A44382DD1081727A68D2FFD98
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

resource/Thumbs.db

SHA256 d204a462bba736c98215d79d470416993b19dbf2380b43554f6da68a7e7dbc39
MD5 f7d31f2522644f26449bc3ef4e920496
SHA1 45afeaf5f8f87fccf2c47913ca3c73d86cad0d8a
SHA512 f39322530dcfdcfebc600150ebb964d5d9cd5943a412c99ce6b9adf7a1b1b51b7f85bcb3bfc15bd2fcad80a25a1302572295350320d6a8b9711985782ce02cfa
SSDEEP 384:No4QyILTmRoHqyfrAMJMZEQUQiIQqBX8rwN9:No4nI2CHqyfsMl/QlNP
TLSH
T18C629E3B99909F03D8D6C379FD85EC8CB75B0C8A29A35BD674A672DC7BB49011B06908
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

resource/qqo.ico

SHA256 352ab83c3382ef60f4958e5e2cf09e7817997a48cfa2932a64fe07ac7ae7e597
MD5 3f9c2ec9973b136e93e84556db249dc4
SHA1 e6ad9a5571a942a9ccc17946bf78a4268a7392f6
SHA512 6e784e1e044f62148a2e1a7df0b0ca9a00090a12d8c0025ca7bd71a3c5873ac1111751cc8b214bfaad6cfa47183b0bc2a6475306d42095027ba516200b637a89
SSDEEP 6144:5ya3TGIWJ9mZlr6KScaXnMf1F7E+tBRh2ysS/Se:9KT9El68fj4+tBRh2ys4
TLSH
T1F064D0222A2B5281D994E13DD347F03B31BB382BC4D4DD617F46BA580EF3591E88E96D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninstall.exe.nsis

SHA256 fe78d4be96720fea3f3a4b9fd44ae36492bbc3954720bc5c5a89d75d99e67901
MD5 a1222ad95eb53effcd74be4f5dc92d97
SHA1 3b023a63b673c9ca652727a914e694a5569db054
SHA512 5afe152282a5edfb683b330bd8e2ae5817f94136cdeeeea3a8f3c786346ee898f281f9664832bd580923f2b55c86dd723c638b4530eef7dd8c669b30a05551b2
SSDEEP 192:Ou9ko2PYqBmsQDtu4Y19JsjJNCi7FfipJzZQ:tqY4QDtu4qYfCi7ZF
TLSH
T12FF1AF902DB8D73926BD5D60E03A2580F52C2DF959EE817264BE301019672EEE153DFD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

INNORIX-Agent.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/SimpleSC.dll

generic

$PLUGINSDIR/innorixas-splash.jpg

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/newadvsplash.dll

kernel32

user32

gdi32

winmm

oleaut32

msvcrt

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic

$PLUGINSDIR/nsisFirewall.dll

kernel32

user32

ole32

oleaut32

msvcrt

generic

$PLUGINSDIR/nsislog.dll

generic

$PLUGINSDIR/time.dll

kernel32

user32

generic

ca.crt

innorix.pem

innorixam.exe

kernel32

advapi32

ws2_32

generic

innorixas.conf

innorixas.exe

kernel32

winspool.drv

generic

innorixst.exe

kernel32

winspool.drv

generic

property.conf

resource/License

resource/Thumbs.db

resource/qqo.ico

uninstall.exe.nsis