a8859ff9270a725116c8ffbaf934d5d44d786642f99b5c3a26564ce6c9d45f4b

resource
a8859ff9270a725116c8ffbaf934d5d44d786642f99b5c3a26564ce6c9d45f4b
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/UserInfo.dll
unpack001/bin/log-panther.exe
unpack001/log-panther.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 a8859ff9270a725116c8ffbaf934d5d44d786642f99b5c3a26564ce6c9d45f4b
MD5 d36e41062b9e5fec485401fd72336026
SHA1 8593ccb2eb72908fa114fbe61e190921788fcac5
SHA512 4fcdd7a2070c114fcb436d4a8f92435214b608a31e42a75902146503ccabcccacd3d1cc1d26aefe437221aec8392dcf8f7979065b89d0e26c9bf453f8a4b59a4
SSDEEP 12288:mXRavGpqzkKrEsIr+AFDusStXqtXqXcnGJRZWssBP5aUQzG:mXRavYSkKosIr+Zs/67RIpBh9z
TLSH
T104E4220AB380C45AE47A1A305AFBDAF36676F451A2300F87FF14D3AF9522905DE1EE45
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 b2091205e225fc07daf1101218c64ce62a4690cacac9c3d0644d12e93e4c213c
MD5 d095b082b7c5ba4665d40d9c5042af6d
SHA1 2220277304af105ca6c56219f56f04e894b28d27
SHA512 61fb5cf84028437d8a63d0fda53d9fe0f521d8fe04e96853a5b7a22050c4c4fb5528ff0cdbb3ae6bc74a5033563fc417fc7537e4778227c9fd6633ae844c47d9
SSDEEP 192:EyGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTr11929WtshLAzgSrX8:EyNt+4t7uJalUnGesY7Lt8nCr/Yosa
TLSH
T163624D1137D598B3E2E62A797EF377138FA5F722A4429E0BC7332E4638565806D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/NSIS.InstallOptions.ini

SHA256 20f4b5ca77627854eec3c9a2fbb47f45a71ebf262c1a2856fa807363e2da62bd
MD5 d6cb6e84099a2c5f3cbf1e949e6e685b
SHA1 3287c9bfb4c0b85db0239a400b9b7df1843357c5
SHA512 d14bbb0cfa0ee9d88ace1af4216146061ce2555d6028ad4493c8ade4b08eaa186c734e7bfaaecc9cfdd8962a09d4a98fd609a0d6dfdcef69f86575ae88ec53ae
TLSH
T15601F744540A8325E230D22115BFA2E4BBD02D3E254129E4B3D908C38F85EEB59AE0F0
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855
MD5 a8c86996c4230c2209f5927f21321377
SHA1 45ce0ab93cb6a3a594e54878cce05df724024393
SHA512 69ee73496b916777936b0dddd2cc4a4f916e393f7d0b167cba77a4a239ee1e3f645d9b90dee1627c42a23eb6c3403e4d086546b9f78b3a2e4999c8f92f6a3bc3
SSDEEP 96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
TLSH
T154F1C776F3D20673F9AB427428632F231B2AF521576581A6490316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
MD5 d458b8251443536e4a334147e0170e95
SHA1 ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA512 6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
TLSH
T18D8173BB93E00CF3D0A44BB740A71CE362B5DD201B62001F4A478EA92590B67EE7E715
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
TLSH
T1D312A8869D83DC42EC4F7F71E3E6A05320E0690A052FBAD56F3634D6E65F88B672410B
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

CascadiaMono.ttf

SHA256 1e79e42f8d0c221e5b15f63342079e8b96f3f9ec219701db74922ac7ca457db2
MD5 7c0ad62d7f1a72770d20714fae72a747
SHA1 c1d801a0c210b24b55756420b43e78e1b485a61d
SHA512 5642747bd2ef4fb638e1361a1037cb5236ef5c4bd4e7f8d31bb24d98e8337f2aae84630e4e3b913ec2b72e20111bd1d50baebd817e494480c25e9fa35957fd5f
SSDEEP 3072:Rgr/oRtHoRrZbqE1OZtHBnA1J0evmzSuhzn/zAMoa/K/jWdiJ7kXYckjHjHWd0ay:hS0u+PzSEUMoUdiZHjHjzhp+jxYHxP
TLSH
T1BC64709FF22BC9949C16957506492B3E492A332CCB7F1BBEBDDE0E38D4463600D24B65
MD5 SHA1 SHA512 SSDEEP TLSH

Uninstall.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 acc5fd369ea36f26a9c4152b9e51d23d4dd53143b53548f985d217ad658d49f7
MD5 a8e842d43a0c8af4415d400a16c17bc4
SHA1 97f9fce2b6b402d280fb824c8e7790aee59bdd7d
SHA512 679fca06778dc90e2783902d8374306793bfbd5c69c5869f9ac3082ae3712da503f82a8ec7bdf494cda09b2bd5ea38f05983cf0006d4a64fb53a82e44ae5f49b
SSDEEP 1536:mX+rXNP8VKosfkZVH1ru+gdLeAyNxYWW9Nq91upSeI6JNJsjX3LS4lkKpOKyFz4e:mXK9qKo9bH1ru+ceAjpSezWL3GNHFce
TLSH
T1C6B3AE0573D0C4A6D4790A308EFBC7E33BB7F41125184B9BBB84675FB862A41ED1A687
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13564

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/UserInfo.dll

IMPHASH 68e847ed6763e00454edac87b3abd95a
SHA256 4913d4cccf84cd0534069107cff3e8e2f427160cad841547db9019310ac86cc7
MD5 d458b8251443536e4a334147e0170e95
SHA1 ba8d4d580f1bc0bb2eaa8b9b02ee9e91b8b50fc3
SHA512 6ff523a74c3670b8b5cd92f62dcc6ea50b65a5d0d6e67ee1079bdb8a623b27dd10b9036a41aa8ec928200c85323c1a1f3b5c0948b59c0671de183617b65a96b1
TLSH
T18D8173BB93E00CF3D0A44BB740A71CE362B5DD201B62001F4A478EA92590B67EE7E715
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
TLSH
T1D312A8869D83DC42EC4F7F71E3E6A05320E0690A052FBAD56F3634D6E65F88B672410B
MD5 SHA1 SHA512 SSDEEP TLSH

bin/log-panther.exe

IMPHASH a147ef0ee1f901d1aef237355f44465a
SHA256 d50a96cd8f5e706effafe7c400d44b19b630b796039fbbc0882fdfca9014f153
MD5 c1d2278e6336ffb18e1222a70b354ff4
SHA1 fc40523967cb39106e83c610277045570dd9d2e8
SHA512 96ad07e1f42caba1f19587d808a866197ead928e5d6be4f4c91ef02ea8176d7ce4a3da5b967887082c01575787b35d038f3c991d1cf63106bf46ce85826ece2a
SSDEEP 12288:VuSnWUvWJCbLsw0wAjh0YR4oKTXtC3MjuHTofgnqoi54S8:V1nWsWcwwzI9ZKXtRjuHT8gnqz5b8
TLSH
T1FE158C54A3B505EBC92B4033C1CAB527E937744C27D365EB37D40A983F66AF04AB9B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

407912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateThread CreateProcessA GetModuleHandleW SetThreadExecutionState VerSetConditionMask FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW SetEndOfFile HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType TerminateProcess LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess RtlPcToFileHeader LoadLibraryExW InitializeCriticalSectionAndSpinCount RaiseException EncodePointer SetLastError RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess WaitForSingleObject DeleteCriticalSection InitializeCriticalSection CreatePipe GetLastError CloseHandle PeekNamedPipe ReadFile GetModuleHandleA Sleep LeaveCriticalSection EnterCriticalSection WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryA GetProcAddress FreeLibrary

user32

GetRawInputDeviceInfoA GetRawInputDeviceList EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW RemovePropW GetPropW SetPropW SetForegroundWindow GetSystemMetrics ReleaseCapture UnregisterDeviceNotification MapVirtualKeyW GetKeyState GetActiveWindow SetFocus IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent GetIconInfo LoadIconA ReleaseDC GetDC EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrA GetWindowLongPtrA SetWindowLongA GetWindowLongA CallWindowProcA GetMessageExtraInfo SetCapture

gdi32

DeleteDC CreateDCW CreateDIBSection CreateRectRgn CreateBitmap GetDeviceCaps GetDIBits DeleteObject ChoosePixelFormat DescribePixelFormat SetPixelFormat SwapBuffers GetObjectA SetDeviceGammaRamp

shell32

DragAcceptFiles DragFinish DragQueryPoint DragQueryFileW

comdlg32

GetSaveFileNameA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

545KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

log-panther.exe

IMPHASH a147ef0ee1f901d1aef237355f44465a
SHA256 d50a96cd8f5e706effafe7c400d44b19b630b796039fbbc0882fdfca9014f153
MD5 c1d2278e6336ffb18e1222a70b354ff4
SHA1 fc40523967cb39106e83c610277045570dd9d2e8
SHA512 96ad07e1f42caba1f19587d808a866197ead928e5d6be4f4c91ef02ea8176d7ce4a3da5b967887082c01575787b35d038f3c991d1cf63106bf46ce85826ece2a
SSDEEP 12288:VuSnWUvWJCbLsw0wAjh0YR4oKTXtC3MjuHTofgnqoi54S8:V1nWsWcwwzI9ZKXtRjuHT8gnqz5b8
TLSH
T1FE158C54A3B505EBC92B4033C1CAB527E937744C27D365EB37D40A983F66AF04AB9B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

407912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateThread CreateProcessA GetModuleHandleW SetThreadExecutionState VerSetConditionMask FormatMessageW QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW SetEndOfFile HeapSize CreateFileW GetStringTypeW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileSizeEx SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType TerminateProcess LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc WriteFile GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess RtlPcToFileHeader LoadLibraryExW InitializeCriticalSectionAndSpinCount RaiseException EncodePointer SetLastError RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetExitCodeProcess WaitForSingleObject DeleteCriticalSection InitializeCriticalSection CreatePipe GetLastError CloseHandle PeekNamedPipe ReadFile GetModuleHandleA Sleep LeaveCriticalSection EnterCriticalSection WideCharToMultiByte MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc LoadLibraryA GetProcAddress FreeLibrary

user32

GetRawInputDeviceInfoA GetRawInputDeviceList EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect LoadImageW DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect SetRect ClipCursor WindowFromPoint ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW RemovePropW GetPropW SetPropW SetForegroundWindow GetSystemMetrics ReleaseCapture UnregisterDeviceNotification MapVirtualKeyW GetKeyState GetActiveWindow SetFocus IsZoomed BringWindowToTop IsIconic IsWindowVisible SetWindowPlacement GetWindowPlacement SetWindowPos SetLayeredWindowAttributes GetLayeredWindowAttributes ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW SendMessageW GetMessageTime PeekMessageW DispatchMessageW TranslateMessage TrackMouseEvent GetIconInfo LoadIconA ReleaseDC GetDC EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrA GetWindowLongPtrA SetWindowLongA GetWindowLongA CallWindowProcA GetMessageExtraInfo SetCapture

gdi32

DeleteDC CreateDCW CreateDIBSection CreateRectRgn CreateBitmap GetDeviceCaps GetDIBits DeleteObject ChoosePixelFormat DescribePixelFormat SetPixelFormat SwapBuffers GetObjectA SetDeviceGammaRamp

shell32

DragAcceptFiles DragFinish DragQueryPoint DragQueryFileW

comdlg32

GetSaveFileNameA

imm32

ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow ImmGetContext

Name

.text

Size

545KB

Virtual Size

545KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

253KB

Virtual Size

253KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer