TH-9800 Eng 2[.]0[.]7[.]exe

resource
TH-9800 Eng 2.0.7.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/PL2303.exe
unpack001/Program.exe
unpack001/uninst.exe

resource
unpack001/$SYSDIR/Msflxgrd.ocx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

TH-9800 Eng 2.0.7.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 4b8223d2da1ab38567d19add629d8f5212fe36f6663996e60832ac427e511cdd
MD5 f110f4cf704aba96b4cc59fde2365d00
SHA1 ef6e42fedc062a939d92187b5f78d323f5ee6156
SHA512 ff24457569b415c399cdaaf7b371e1bdb578e0a5bc3722bc3a188c72f4a9609ffa251edf2ce124b1f20a1a097ac882600e66f65f033a0ab5e4c299b7066cbd1a
SSDEEP 49152:oi/LXpqEpmPyzVTAi5P4oN+AEIrFoTyyWrM6qKKchqWysRitDlQ7R:XbpZpm0q0zkHUBl7Rj9
TLSH
T104C533207FC4EC4BF3742B75A9975835ACB266807B25927307185F3BF4B22A3492B725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$SYSDIR/Msflxgrd.ocx

IMPHASH 11eea53ea81b7d299e5a61db777d2725
SHA256 36464966fbf46136ce0746c8cf419ca31360f81f06744e10d066441bc0ad5538
MD5 3f7a98d7be824143c7c88fc447e944ac
SHA1 d2b8e15b4b1c54670d3723d3d7468256a44de386
SHA512 45141b841ef87b99be8d9afceaaad0e9b281ff5d04dd34f630e0800c3260e1cc6e7f5b872b2a04ed2a4c4e2e8122e135ba23342f07e635b515d0a8f039317a5e
SSDEEP 6144:Kr+yiDlar6B3McDdhnN4R86DIqMQYe0SwXlktCfh1jRM:KrpuBznN4RZIH5XlkQdm
TLSH
T130443A42F3E581A6E0B736306A7623B15EBABC56AD39D54F1304364C2D32E64EE35336
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

69:b4:c9:f0:3d:b6:34:76:f6:2c:da:b9:dd:53:f5:44:18:5c:e0:ea

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 10, 2004

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 10, 2000 - Nov 12, 2005

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:7d:a7:00:00:00:00:00:48

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 25, 2003 - Jan 25, 2005

Minor OS version

0

Major OS version

4

Entry point

5128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

VirtualAlloc GetStringTypeA GetStringTypeW GlobalFree LCMapStringA LCMapStringW GlobalLock GlobalSize GetVersionExA WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetOEMCP GetACP GetCPInfo VirtualFree HeapCreate HeapDestroy GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetCurrentProcess TerminateProcess ExitProcess GetCommandLineA GetFileAttributesA GetVersion DisableThreadLibraryCalls FindResourceA LoadResource LockResource GetLastError GetProcAddress GetLocaleInfoA LoadLibraryA GetWindowsDirectoryA HeapReAlloc GetModuleFileNameA InterlockedDecrement MultiByteToWideChar GetProfileStringA FreeLibrary DeleteCriticalSection InitializeCriticalSection lstrcmpiA lstrcpynA InterlockedIncrement GlobalUnlock GlobalAlloc lstrcmpA HeapAlloc lstrcatA HeapFree WideCharToMultiByte lstrlenW lstrcpyA lstrlenA MulDiv GetProcessHeap LeaveCriticalSection EnterCriticalSection lstrcpyW IsDBCSLeadByte InterlockedExchange

user32

GetDlgItemInt IsDlgButtonChecked RegisterWindowMessageA PeekMessageA SetFocus GetFocus GetSysColor GetSystemMetrics FillRect PeekMessageW PostMessageW SetWindowPos GetDlgItem SendDlgItemMessageA InvalidateRect GetActiveWindow DialogBoxParamA EndDialog GetWindowRect SetDlgItemInt MoveWindow SetDlgItemTextA GetDlgItemTextA GetClipboardFormatNameA MapWindowPoints SetCursorPos RegisterClipboardFormatA UnregisterClassA CreateDialogIndirectParamA IsChild IsWindowEnabled GetNextDlgTabItem IsDialogMessageA WinHelpA ShowWindow SetWindowRgn IntersectRect EqualRect GetParent ClientToScreen GetWindow BeginPaint EndPaint SendMessageA MessageBeep wsprintfA DestroyWindow GetWindowLongA SetWindowLongA DrawTextA DrawTextExA CheckDlgButton ReleaseCapture KillTimer DrawFocusRect SetTimer SetCapture SetCursor DefWindowProcA EnableWindow GetCursorPos ScreenToClient PtInRect PostMessageA DrawEdge FrameRect InflateRect LoadCursorA RegisterClassA GetDC ReleaseDC CharNextA GetKeyState SetRect UpdateWindow IsWindow GetScrollRange ScrollWindow OffsetRect SetScrollRange GetClientRect SetScrollPos CreateWindowExA IsWindowVisible LoadStringA MessageBoxA SetParent

ole32

CreateOleAdviseHolder ReleaseStgMedium DoDragDrop RegisterDragDrop RevokeDragDrop CoCreateInstance OleLoadFromStream OleSaveToStream CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc

advapi32

RegEnumKeyExA RegQueryValueA RegOpenKeyA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegCreateKeyExA RegSetValueExA RegCloseKey

oleaut32

SafeArrayCopy SafeArrayPutElement SafeArrayGetElement SafeArrayCreate SafeArrayDestroy SafeArrayGetLBound SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData VariantCopyInd VariantCopy LoadTypeLibEx UnRegisterTypeLi RegisterTypeLi CreateErrorInfo SetErrorInfo LoadTypeLi LoadRegTypeLi OleCreatePropertyFrame VariantClear SysAllocString GetErrorInfo SysAllocStringLen SysStringLen VariantInit VariantChangeType OleCreatePictureIndirect SysFreeString OleTranslateColor SafeArrayRedim OleCreateFontIndirect

gdi32

SetViewportOrgEx GetWindowExtEx GetViewportExtEx LPtoDP SetWindowOrgEx GetNearestColor CreatePalette GetBitmapBits CreateDIBitmap SelectPalette RealizePalette GetDIBits GetPaletteEntries CopyEnhMetaFileA CopyMetaFileA CreateDCA CreatePen DeleteObject CreateSolidBrush SelectObject GetObjectA DeleteDC StretchBlt GetStockObject CreateCompatibleBitmap CreateCompatibleDC GetDeviceCaps GetTextMetricsA RestoreDC ExcludeClipRect SaveDC LineTo MoveToEx SetTextColor SetBkMode GetCurrentPositionEx SetViewportExtEx SetWindowExtEx DPtoLP SetMapMode GetTextColor CreateBitmap EnumFontFamiliesExA GetTextExtentPoint32A CreateFontIndirectA CreateRectRgnIndirect

Default.dat

SHA256 89660eed0500e02e6a478d32a3e0fa890eea062d92956b83bfaeab260866ea23
MD5 e9bf9c020c1b917de0d5cfc8b4c9951e
SHA1 529199a82fb778430acb5bee30a24c459be5fd1f
SHA512 8c75568442f56fc91f24ea8692ba0901c82c1322c5b8e3029ce058dd07bd1bc99f5ddcd6d0d928bbc5a7393655d8ba065f25680e8465fc973c0327b8d1a471fe
SSDEEP 96:U1WVrdxxkk0iLMMMMMMMMMMMMMM9pjjPcwSOQGHJMMMMMMMMMMMMMMh:U1WVssPcw46
TLSH
T14C6336257A5CC76EF45150B5AC43A1CC6CBD6EC0ACD090CFE6883F4EF47A85E4AE8290
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Logo.ico

SHA256 ea4eb518b9685b053037b9996b936b79c5edc0f9fc2f0899fb851f10a941efdc
MD5 b4e862f810aea61408efdb06540a7ecf
SHA1 bdc843155179b08346d4d614c7699e30d05cb042
SHA512 e30aac374a289011d49a66f8fd049b6e38dffcb9acd0ac5c0ffff5584b15c3293e44e044c297651eb5961138d180da81fab4035126e87b97b8598a0cd954cdbb
SSDEEP 48:Ddd6w+aNMNXMAH8yiYlgifkkKeemGoum74r9VVgb5ObEpCSZoNl:Pd+aqN8O8PEVzumMrveb5OPS6X
TLSH
T1B691A7BB9750CDFEE2426970E363535657F2DC80141E8284B5E2F9A5AA3C2935BF40A3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

PL2303.exe

IMPHASH 8f244019e52c417786599750d44c515a
SHA256 eb626a166f99624c12981cc5a18737af79be0441e1a4a196b587749e9e97bea2
MD5 cc91df1e443c98642a05db93cf4e35b7
SHA1 7480b372788aff4d2306cfa3e7d3193a5f055268
SHA512 4bcc8cd54bb5530c6c9bae77fbc23f21fb90ae23c74b9f1a479b9a94b08c8599a09e9b50db2b86afa9d22b65e30743f2fcc040c531e4d68ac8780b375e1e147e
SSDEEP 49152:c5jjOui0/5LKqLhtbx/p/noQOhtm683DfNbCWYBiCKhSOoSvbJ/50ZS:cZjOp0hKqLhbpPojhM683795BKe/0S
TLSH
T16EE5E002BBEA816EF2B74A70E97B07B15BB5BC969E31811F7384B91C1C306A1D531B17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

139412

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

kernel32

LoadLibraryExA QueryPerformanceFrequency CreateEventA ReadFile CompareStringA CompareStringW GlobalSize SizeofResource FreeResource SearchPathA FindNextFileA GetTempFileNameA GetExitCodeProcess TerminateProcess OpenProcess GetLocalTime InitializeCriticalSection GetCurrentProcessId GetVersion LeaveCriticalSection EnterCriticalSection GetCurrentThread VirtualQuery VirtualProtect UnmapViewOfFile GetShortPathNameA MapViewOfFile CreateFileMappingA SetEvent ResetEvent QueryPerformanceCounter SystemTimeToFileTime lstrcmpA MoveFileExA GetDiskFreeSpaceA GetSystemDirectoryA GetSystemInfo IsBadReadPtr GetProcAddress GetModuleHandleA GetModuleFileNameA lstrcpyA lstrlenA Sleep CloseHandle CreateProcessA lstrlenW WideCharToMultiByte MultiByteToWideChar RemoveDirectoryA DeleteFileA ResumeThread SetThreadContext MulDiv GetPrivateProfileStringA GetPrivateProfileSectionNamesA SetEndOfFile FlushFileBuffers SetStdHandle IsBadCodePtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter GetStringTypeW GetStringTypeA SetUnhandledExceptionFilter HeapSize IsBadWritePtr HeapReAlloc VirtualAlloc VirtualFree HeapCreate HeapDestroy GetEnvironmentVariableA LCMapStringW LCMapStringA GetOEMCP GetACP GetCPInfo TlsGetValue TlsAlloc CreateDirectoryA FindFirstFileA FindClose lstrcmpiA lstrcpynA WriteFile GetDriveTypeA SetFilePointer GetFileAttributesA ReleaseMutex GetPrivateProfileIntA lstrcatA LoadLibraryA GetSystemDefaultLangID CreateMutexA FreeLibrary SetErrorMode GetTickCount FindResourceExA FindResourceA LoadResource LockResource GetWindowsDirectoryA InterlockedDecrement LocalFree InterlockedIncrement FormatMessageA GetTempPathA GetVersionExA CreateFileA GlobalFree GlobalAlloc GlobalLock GlobalUnlock GetLastError SetLastError WaitForSingleObject ExitProcess GetCurrentProcess DuplicateHandle GetThreadContext VirtualProtectEx WriteProcessMemory FlushInstructionCache TlsSetValue GetCurrentThreadId GetCommandLineA GetStartupInfoA RaiseException HeapAlloc HeapFree RtlUnwind DeleteCriticalSection InterlockedExchange GetFileSize

user32

SetWindowLongA SetWindowTextA SendMessageA GetDlgItem wsprintfA WaitForInputIdle CharUpperA MessageBoxA DialogBoxIndirectParamA SetDlgItemTextA MsgWaitForMultipleObjects CharLowerBuffA SetFocus BeginPaint EndPaint LoadStringA FillRect ScreenToClient GetWindowTextLengthA GetWindowTextA GetWindowPlacement SendDlgItemMessageA GetMessageA DefWindowProcA GetParent GetWindow SystemParametersInfoA MapWindowPoints SetWindowPos GetPropA EnableMenuItem SetPropA RemovePropA ShowWindow IsWindow GetSysColor LoadImageA CreateDialogParamA GetDC ReleaseDC SetActiveWindow PeekMessageA IsDialogMessageA TranslateMessage DispatchMessageA DestroyWindow CreateDialogIndirectParamA SetForegroundWindow GetDesktopWindow GetClientRect EnableWindow IsWindowEnabled GetWindowDC UpdateWindow InvalidateRect DrawIcon MapDialogRect GetClassNameA CallWindowProcA DrawFocusRect InflateRect DrawTextA CopyRect EnumChildWindows CreateWindowExA RegisterClassExA IntersectRect GetDlgItemTextA GetWindowLongA GetWindowRect MoveWindow EndDialog LoadIconA

gdi32

CreateCompatibleBitmap CreateDCA GetStockObject GetTextExtentPoint32A CreatePatternBrush DeleteMetaFile SetMetaFileBitsEx SetStretchBltMode SelectClipRgn SetPixel PatBlt PlayMetaFile StretchBlt CreateBitmap SetViewportExtEx SetViewportOrgEx SetWindowExtEx SetWindowOrgEx CreateDIBitmap SaveDC SetBkMode SetTextColor TextOutA RestoreDC GetTextExtentPointA CreateFontIndirectA SetBkColor CreateRectRgn DeleteObject CreateSolidBrush GetDIBColorTable GetSystemPaletteEntries CreatePalette CreateHalftonePalette GetDeviceCaps GetObjectA CreateCompatibleDC UnrealizeObject SelectPalette RealizePalette SelectObject BitBlt DeleteDC SetMapMode

advapi32

RegCloseKey RegQueryValueA RegQueryValueExA RegOpenKeyExA RegDeleteKeyA RegEnumKeyExA RegEnumKeyA RegOpenKeyA FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken

shell32

SHGetPathFromIDListA SHGetMalloc ShellExecuteExA SHGetSpecialFolderLocation

ole32

CoInitialize CoUninitialize

oleaut32

SysFreeString SysAllocString SysAllocStringLen SysReAllocStringLen SysStringLen GetErrorInfo VariantClear VariantChangeType

lz32

LZOpenFileA LZCopy LZClose

rpcrt4

RpcStringFreeA UuidCreate UuidToStringA

Program.exe

IMPHASH 426dc4f2173a2e98d897070d5c617e0a
SHA256 e8bf5d5be8b33ac92c2ac10fea2f4351a0dde6300a6a6564edba26a726ef3640
MD5 6bdd0bf2fb6e755034ff8cf92083e822
SHA1 747dfc1f8c2654408161447ab2645138ec5409ad
SHA512 50654cfd2d8292af47568ca9a71cc3fccf222b20d96a922de983c927e366ea6e3aa991f1ba2ec120d1a45d3ee7aaff3b5df11dfd0b666ac44a4dbe9374435424
SSDEEP 24576:Xk6nbo9ZFd8XOlGanfQcOwcWUZu0EENW9dq:X9YZFd8XOlGanfQ0cWUZu0DNW9dq
TLSH
T11A354A24E655D81BE9A114B7DDBD08EC60182F201B2956CFA3C83FBD92761F32D36726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

459700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord4340 ord4347 ord4889 ord4531 ord4545 ord4543 ord4526 ord4529 ord4524 ord4963 ord4960 ord4108 ord6054 ord5240 ord3748 ord1725 ord5260 ord2091 ord4432 ord3719 ord3610 ord2411 ord2023 ord4218 ord2578 ord4398 ord3582 ord656 ord793 ord616 ord4241 ord3874 ord860 ord4508 ord5953 ord3095 ord3089 ord2864 ord3547 ord3092 ord5951 ord5281 ord4720 ord1841 ord364 ord784 ord2587 ord4406 ord3394 ord3729 ord804 ord5981 ord4299 ord2086 ord6880 ord6785 ord6197 ord1175 ord6215 ord5037 ord2575 ord4396 ord3574 ord609 ord940 ord6453 ord540 ord535 ord2763 ord858 ord2642 ord1858 ord4245 ord5101 ord2101 ord2723 ord2390 ord3059 ord5100 ord4467 ord4303 ord3351 ord5012 ord976 ord5472 ord3403 ord2879 ord2878 ord4152 ord4077 ord5237 ord2382 ord5283 ord2649 ord1665 ord4436 ord2445 ord4427 ord401 ord674 ord5254 ord3663 ord3573 ord3626 ord1641 ord2414 ord4275 ord1783 ord2938 ord2135 ord818 ord6874 ord859 ord2859 ord2688 ord4224 ord2379 ord536 ord4129 ord922 ord4204 ord2614 ord3619 ord1871 ord3693 ord4133 ord4297 ord5788 ord2860 ord472 ord2754 ord1567 ord283 ord268 ord5875 ord1168 ord4277 ord6241 ord2080 ord613 ord5678 ord3317 ord5789 ord5736 ord289 ord3797 ord541 ord801 ord6883 ord6143 ord3811 ord6741 ord6508 ord6921 ord6613 ord6767 ord1949 ord5821 ord3662 ord812 ord2841 ord1200 ord1205 ord1176 ord414 ord559 ord713 ord2809 ord2970 ord1270 ord1232 ord4287 ord6144 ord2971 ord5759 ord6192 ord5756 ord6186 ord4330 ord6189 ord6021 ord6172 ord5873 ord5794 ord5579 ord5571 ord6061 ord5864 ord3596 ord3571 ord755 ord640 ord6194 ord5785 ord1640 ord323 ord470 ord5053 ord6458 ord2652 ord1669 ord1706 ord430 ord786 ord2461 ord3318 ord5572 ord6389 ord2915 ord941 ord519 ord6311 ord6283 ord6282 ord2784 ord2764 ord4171 ord5445 ord703 ord404 ord3216 ord4042 ord2504 ord5903 ord5510 ord1652 ord429 ord4083 ord1829 ord3754 ord3752 ord6128 ord2634 ord6141 ord2233 ord4045 ord4160 ord2107 ord6605 ord763 ord2450 ord483 ord2527 ord482 ord4333 ord5076 ord3810 ord2096 ord384 ord5440 ord6383 ord5450 ord6394 ord4544 ord3274 ord4622 ord3579 ord439 ord736 ord5495 ord5685 ord4226 ord5683 ord6648 ord6662 ord2089 ord816 ord562 ord4671 ord1859 ord4246 ord3869 ord2127 ord2391 ord5102 ord5105 ord4468 ord3350 ord975 ord2880 ord4153 ord2383 ord5284 ord4437 ord4428 ord3398 ord3733 ord796 ord810 ord554 ord529 ord402 ord807 ord926 ord6069 ord2011 ord6067 ord5871 ord4000 ord2123 ord2494 ord2627 ord2626 ord6000 ord2117 ord4163 ord6625 ord4457 ord5255 ord6209 ord3303 ord3914 ord2884 ord765 ord665 ord924 ord1979 ord5442 ord5186 ord354 ord3499 ord3177 ord2515 ord355 ord6385 ord3949 ord4413 ord4278 ord986 ord520 ord1842 ord5933 ord4034 ord5104 ord642 ord4500 ord4772 ord4995 ord2087 ord4458 ord6154 ord2530 ord4364 ord4056 ord5471 ord4121 ord2389 ord5082 ord1709 ord1712 ord6053 ord5234 ord6369 ord5279 ord5248 ord2444 ord3598 ord327 ord4235 ord6379 ord939 ord1821 ord4611 ord4609 ord4485 ord3471 ord2002 ord5729 ord5502 ord3446 ord3195 ord985 ord648 ord334 ord1199 ord3495 ord1236 ord1152 ord3698 ord3054 ord3425 ord3880 ord6734 ord1105 ord4615 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord4079 ord4698 ord5307 ord5289 ord5714 ord3738 ord561 ord815 ord4159 ord6117 ord2621 ord1134 ord2725 ord1825 ord4238 ord4696 ord3058 ord3065 ord6336 ord2510 ord2542 ord5243 ord5740 ord1746 ord5577 ord3172 ord5653 ord4420 ord2399 ord4387 ord3454 ord3198 ord6080 ord6175 ord4623 ord4426 ord338 ord652 ord4823 ord2740 ord2801 ord4953 ord4216 ord4858 ord4614 ord4613 ord2535 ord2405 ord2380 ord2567 ord2243 ord1803 ord298 ord620 ord4230 ord1233 ord4454 ord1864 ord3701 ord772 ord500 ord5153 ord4284 ord1865 ord2714 ord4023 ord2569 ord5655 ord5787 ord3220 ord2767 ord5860 ord6142 ord3986 ord3521 ord6402 ord3097 ord3742 ord2152 ord1945 ord4341 ord4349 ord4723 ord4890 ord4964 ord4961 ord1726 ord560 ord813 ord4273 ord4533 ord4892 ord4370 ord4899 ord4588 ord4589 ord823 ord4710 ord537 ord6199 ord2818 ord800 ord4234 ord2302 ord825 ord324 ord567 ord641 ord795 ord3721 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord3402 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5290 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1776 ord4078 ord6055 ord3597 ord4425 ord5280 ord1775 ord6052 ord2514 ord4998 ord4853 ord4376 ord2814 ord5265 ord1576

msvcrt

_callnewh _stricmp malloc _setmbcp __CxxFrameHandler atoi isalnum toupper strtod _ftol atof isprint sscanf _mbscmp _CIpow _CIcos _purecall strtoul _mbsrchr _strdup free isdigit __dllonexit _onexit _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

kernel32

CloseHandle CreateFileA GetVersionExA GlobalReAlloc GlobalUnlock GlobalLock GlobalSize MulDiv FreeLibrary LoadLibraryA GetWindowsDirectoryA WritePrivateProfileStringA GetPrivateProfileStringA LocalFree FormatMessageA GetLastError lstrcpyA lstrcpynA ReadFile WriteFile PurgeComm Sleep SetCommState GetCommState SetCommTimeouts SetupComm CreateDirectoryA GetFileAttributesA GetModuleFileNameA QueryPerformanceFrequency QueryPerformanceCounter GetTickCount GetStartupInfoA GetProcAddress GetModuleHandleA

user32

UpdateWindow IsChild GetSysColorBrush EndDeferWindowPos BeginDeferWindowPos GetMessagePos GetWindowLongA GetClassLongA GetDCEx wsprintfA GetDoubleClickTime WindowFromPoint IsClipboardFormatAvailable GrayStringA TabbedTextOutA GetCursorPos ScreenToClient KillTimer IntersectRect GetWindow DefWindowProcA GetCapture DispatchMessageA OffsetRect IsRectEmpty PtInRect InvalidateRect DrawFrameControl GetSystemMetrics LoadCursorA SetCursor FillRect FrameRect DrawEdge InflateRect DrawTextA ReleaseDC SystemParametersInfoA GetKeyState PostMessageA IsWindowVisible GetDC SetRect GetClassInfoA CopyIcon RedrawWindow GetSysColor GetFocus GetParent ReleaseCapture SetCapture ClipCursor SetTimer TranslateMessage InvertRect GetDlgCtrlID IsWindow CopyRect GetClientRect GetWindowRect SendMessageA EnableWindow ClientToScreen

gdi32

PatBlt GetTextColor EnumFontFamiliesA GetTextMetricsA CreateFontA StartDocA StartPage EndPage EndDoc AbortDoc GetObjectA CreatePen Escape ExtTextOutA TextOutA RectVisible PtVisible CreateCompatibleDC CreateCompatibleBitmap GetBkColor BitBlt GetCurrentObject GetTextExtentPoint32A CreateFontIndirectA GetDeviceCaps CreateSolidBrush

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

ShellExecuteA

comctl32

ImageList_Draw ImageList_GetImageInfo ImageList_AddMasked

oleaut32

VarDecDiv VarDecFromR8 VarDecMul VarR8FromDec

msvcp60

?nothrow@std@@3Unothrow_t@1@B

Program.ini

SHA256 b406a4664769378c8ff049f889bc058a0107fedb75b5622754045cd471d58912
MD5 8b09b18f412cfa489291e009357f223e
SHA1 e30d511d249fa8cbe368cf83b8118944eb8f67cd
SHA512 cd0c6a1762da67196ae7a62d8727b25eb8747522deec8b39aff03243782f97edc4c64b7c8feb52f7d86d75dbb95380343000f3f452c2787c497e336c90171561
TLSH
T1E3D0A79B22640112A8237B50C3A49935A327FC6D5C3DBB1861D9860DB2E0501340B7FF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2ebd537a6734b06b26ad7570a1082de044f8a7e68d79b9e72d79bf5caacedfaa
MD5 b55b43261e63bf3eed8e048b2c5151ed
SHA1 18356be569a63e7af2f3f3036ef769493a269932
SHA512 fab18f0cee1b4323047ed5afe8f14b85ae7bb69428bada59d731c9513694253a37c995ac9ac1b32b04251125c865c148e482c761dbc839bf25c82b2a9dd0f8be
SSDEEP 768:WhMZ0dF4ZFvQbn+eePu3cIQGCGbiC4k42M3wJJLCP8nn3gYRNBbUFtWsQc14bBCR:WyZMSZFvknTePMZd4k4kJJAYRN6QcI0R
TLSH
T1A1439D1233C0CCABE96D127254BB8B3563F6EE00275112AB17187F7FED26252592BB47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

TH-9800 Eng 2.0.7.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$SYSDIR/Msflxgrd.ocx

PE Signature issue

kernel32

user32

ole32

advapi32

oleaut32

gdi32

generic

Default.dat

Logo.ico

PL2303.exe

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

lz32

rpcrt4

generic

Program.exe

mfc42

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

oleaut32

msvcp60

generic

Program.ini

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic