Bayonetta [CentralDeTraducoes[.]net[.]br][.]exe

resource	yara_rule
static1/unpack001/$PLUGINSDIR/Aero.dll	acprotect

resource	yara_rule
sample	upx
static1/unpack001/$PLUGINSDIR/Aero.dll	upx

resource
Bayonetta [CentralDeTraducoes.net.br].exe
unpack001/$PLUGINSDIR/Aero.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/Delay.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/WebCtrl.dll
unpack001/$PLUGINSDIR/newadvsplash.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

Bayonetta [CentralDeTraducoes.net.br].exe

SHA256 36447cefab0e6771ab580e69336ddb5a166622cc5b045a89a59f1adf180c147d
MD5 49d82196db151494a15bab960abb5e4c
SHA1 c1143abe951807a139974247332a254ece13a402
SHA512 39a515a44b3ebf2e1fe7e4148665f1ad272b285de3f477e5f646e166a3e23ec798413a3d620ea94ac25e8a11b66ff03ce362d8fb0820421a1b16f5e7b4796046
SSDEEP 3145728:1h+kgKKd9jX1gVkXaRiJaC52ASQ/fkcOansqHn0T3xg3T:DgKKd9nWcAzHcOSzH07Wj
TLSH
T19768332DC829F9C9C2292B702A9FF5B93C7700430592962F692FBDB77EA0446305D5F6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

259072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/Aero.dll

SHA256 ab864a3c247e9016414a4a8b26155942b7c3814cc99be6a59b86c456bd22c061
MD5 5c7408c25f1076eb96908e5bba521bb5
SHA1 46df8dfd93593360b9b6d2e4ab1892843246228d
SHA512 9eebf8378a0eab0ab66e70f20aea185392ce0de36e63a37c07ccd93a5d1d8fe95a2ed8c428c63d6aa8c0a5b424e53e412fdeb0e5be2ee57f9eceafa19e03062c
SSDEEP 96:+k+RX2Fg54iQrKWX09fODXCPbnV767ZJG:8X2FA4iyXNm7Ve7ZJ
TLSH
T1CDC1E806B7F95128E8F602379A754B06313EFC50CEBD4B9E194C2116A9B0058DA25F77
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

1

Major OS version

5

Entry point

31424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 ee34e62c1c4ba583e43f7e44f3280b8a796ada44c08351ee97ff1dda55f8a993
MD5 17645192f3db5768a215b912e7e2ba98
SHA1 bccc059e2bba3869838804e8dfce5aa545ae4390
SHA512 a3f223b0e10266ac8ff8b22e4a663d46bddbda73c4dd875922ad72f6e96e8f3d23d17d583e7e7280fb4bcab6cb1f85c851e7433a8ff9abb267e0ccacf047e8e7
SSDEEP 96:g/tjEzzMIFrCgN/fNxE+gGSxeB/J6E5BBGk767Z:INEzL9CeN2+pie/QE5BBde7Z
TLSH
T184024171A7E550B7F7B342F93A63861667B5A930A7A589EA4A336A0C3C70850FC34713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

7620

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Delay.dll

IMPHASH bb13ae3bcb238d1bf689a931b2a56cd6
SHA256 b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
MD5 4602d9a9ed82d646522ead08a58536a9
SHA1 b070bad90e13e85c97bd4e530ca7958c22e36a5a
SHA512 5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
SSDEEP 96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN
TLSH
T15EE1D63777C242E1E44F17B2279A23B35E347A10534485BBC6ABD8921E9322BCC76B47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

7131

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WebCtrl.dll

IMPHASH 38afb22849145136919da4ca045e0de8
SHA256 f7e1e03c140cc86bb7b259f1882b4b461128d70213e7f030360a9c76d6c51884
MD5 f134448c6531c16271d776cdc930cff8
SHA1 6fa6ae69ee46486b33b41f08719319aca5d0382f
SHA512 c83db0d30e51d5dba4fe4abab562fde9358f9970b32aef729f326f394e744698b936b134e8718afd9a2ac970daf287278b2685b77566c50f733f58897fd0c16d
SSDEEP 96:EPR9lrwXckwd7NLLd8e1+A39Lji7juoxiApV3ii:EPR99tZd8e133xjkuri
TLSH
T1FCC15273ABE189F0DA01A43E009625B7EAB5D81B47C180271E6BDD6B3D438ABF665341
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

4368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/desc.bmp

SHA256 11ecbf10cd6586de40b047d72d51f1108c17e601761cf2734c66def8d3a8b630
MD5 7a4a4c04f166ab6197f58c6041ce9863
SHA1 cddd6e92433a1fc5a18395b7c5b0737138b7c600
SHA512 b8ee1dca3e7ab8c410319f4fc26246cc7d5f8395a5ee0703e216982602f16f0bf4245cd790d1c1ff0f8ac24639e60f4a1fb1ef4e6463f0c3d7be5effc9a36d14
SSDEEP 6144:s+O+yc466MEtNR7TThL80IaubL8xQt3mH90+jtayn/1n:s+O+747MWNR75L80Ia6LFt3G9NtaynN
TLSH
T17D84080B6B9AE56DA679683A80C0452C9DDE90E8E5EF33F37B01223DF0C61588F9D754
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 b0b367e004107c1d276e1a9de9bc083fa62ba45b80dd490a50632c8770a65347
MD5 2052f8015cbfe88e18701e2bb1298e44
SHA1 08da564175eead03c5316c7197a41c3ddca40b26
SHA512 bedbb59b76a3154c5a70ea08a55120c94841436e048c409f7d94b026c8f016c97a0563e7e2687ce240819e0d6dde57ac6e4dcf401ccbeddcd146528cee06144c
SSDEEP 3072:IHsdgLIZ5pHHSzMq2o9iw6bE7kLk6CofgISPb6KFvgp9hWbUi/:IHsdgIpKMqRiZb9k7+gAKFvA9u/
TLSH
T12AE3027D8B93499AFD7526F2ECA1E3E049531D4CB2D88B21B22D70B42072199F9C5B35
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/newadvsplash.dll

IMPHASH 2e363db44011ed76701ec6ce62db36f5
SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
MD5 7ee14dff57fb6e6c644b318d16768f4c
SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
TLSH
T1A002E839618096F3D26F15F45882AB1D4BFAE074239290324F73A1EA6DC0297FDB6347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

6911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Password

centraldetraducoes.net.br

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/scroll.html

SHA256 4551598e592c11eeac6d77170028c5f42df3f58b2df443540e2864adb27ccec2
MD5 968c104d97546aa9315fccd02f22a4d2
SHA1 84274ad9bb02624e9f8eb49508fe4db05fb976d3
SHA512 aa91b1348941f7e16e4c74339fd95490a4427c4f44edf407786e93aaa91d66ca0a49c2a86ce87c459c4c409fbde22763fdd39dc7f2fa29b64a7a61224ce0df60
SSDEEP 192:I78T5eH8IniRcLGPUvm1ETK5o50NSZE+D4r43YnRY5zgkkS+UGYNs9o/QzHL6SvH:I78TvXojY5LAVF8N
TLSH
T13403F944F8905E577372A2DA7F20E8F05F6B9278C8090657F0E4F65A3883C69E76352B
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tg_logo.gif

SHA256 99616d738d6718fde19b8408310cf29383a12f315a8a86b521bb93ec5721fc92
MD5 c7d46a49e9967694f856b566cfcf5e1f
SHA1 80c17695f4d003070d35b99bd86adf0dabb4fc99
SHA512 26881525d78eb2f002c643508cddb7eb9429906d50cad3b2a93c459095fe41a0f52ad9b8f0b67d0e7427507e2a15b00f47926989847f00a038b679d6aba1d513
SSDEEP 384:bNNE3pK/+bmHtlcmmjDAzLLNsROum3xpKWWSgLs49yN1xSidK3mi1n:bg3rk3mPyNYax0WWT9ybxS8K33d
TLSH
T10EC2E1AA95AB0544D20A4A7347B1C122BC3CE02D063E46767FB771D76BD127DB1C5AD0
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_data/cred.html

SHA256 8f0fe53c0fa21cbceb46ad1226da9da1631362fc19ba6dfb3cd46d97cf85f393
MD5 6dfc6d8143b79dafc6e4ee7866bb74e2
SHA1 719719b1af2e51079802a8f1d1d496ebb168cfe2
SHA512 1e8291a934a10b5d7674e41d8465c8fd9251849937d852ffb9dc3a87a7c102418edb2087548c12928eaafd492a7b5d1e2c480c4866666859ff9f727cd4822cd2
SSDEEP 1536:3ql57mtSwwNMXRdBH3LS7UvjdBSZLS76SAdBSSuI:3w7K7M
TLSH
T10B339E44F4505E4773B2A2DA7F70A8F02F6B9278C8090697F0E5F2593883D69E76316B
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_data/legal.html

SHA256 81ef9aab1bac38764893718df361c4600aa7eb893e60d8d66ac855200d02ced3
MD5 b3626e3a94cb2d8c3fc3a253e1846173
SHA1 db38a16e524e1a957825f3b273729536ca3b6b40
SHA512 af3aa8f93cc2677c355c2cec51aa0292e7611db7614991f8cc98d61174e06cc489bb91913d8e1eddf1780ea00ca3f9868f585e40fae6b502cdfcd19fc367c929
SSDEEP 192:i78T5eH8IniRcLGPUvm1ETK5o50NSZE+D4r43YnRY5zgkkS+UGYNs9o/QzHL6Svv:i78TvX7jY5O5FnAjBRcVS5zW
TLSH
T10B131A44F8945E477372A2DA7F20E8F01B6B9278C8090697F0E5F65D3883C69E76316B
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_files/scroll.dflt.js

SHA256 fb295cf92b819f9e7d95b62495aeb15e12cd3291add18093c946184127411984
MD5 46903025390c7274e546ddcf50526cfa
SHA1 c8cf17d978275fbeb42e040bb0538d212ce28654
SHA512 94230f5826b8ce67e0b914687224387fe31187c59ecb20e6f1ad8189e6d3bea76de3c7f505b0c2373b2b5c37257e89a3db6d9c544b5b19cfd2c67995968f3ba2
TLSH
T10AC08CCB736D666944CAFAC09AF0CEB16908F93CC6C114AB39F0650875E049FAC76540
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_files/scroll.html

SHA256 1d55105e632396f76b046513f1805f8144b8d2dc2a0d75dd78b37cb771be705c
MD5 fa5e9eb978e1acd9cb8e6cbe2ba76510
SHA1 a08920b5c81bd559a859757f6555863b1b0b804d
SHA512 8a156d805f20029ce06e9a78922f21410c0a2b99ec6b9f7d8c26bbc69efefa221c8c9c3c7264a544405eaccac54c259ddeb77384b9ac826720d60ee5a3ef1757
SSDEEP 96:QD9KskjS+e0nOJOJ3nctYcoUV1FzTOKKInCBsHSM4imf2fy:89LkjS90nmm3U3PFPOCnHmf2fy
TLSH
T164A196311F81557A9109F32CBE3AC14CF4749329D883B806A87C98E05BD1EB95ABED7C
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_files/scroll.js

SHA256 83c74fe20d8cd134c900bc18231311a307fe9d40508bb0a4a3c008333f4755bb
MD5 451adb9f6bed8859cee8ffe17a356dc6
SHA1 7606b460525934d666b19c6159167016bfa4ecfa
SHA512 db4fde5819bef93f4c7709aaeee6ae79c87ae6d8283f408fd420847495ef618da5313b71e2da4afd6e3239b9d6e184856a8694ef201b3cc2d9de08074a6cfb2f
TLSH
T136F0DD46BA7C1606058E53B2F56C8515309EC3A7F622E6144E4A6E2419807FC4FE7F3A
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_files/scroll.tpl0.js

SHA256 d61df469c5484d3c20ad027e741321dd1921285142cc8acf73cf363d7798e310
MD5 39133e190f144254ac4a3ba40d8863a6
SHA1 adb69965c2f4b76b10d029761e5eaa60dee10a5f
SHA512 1c877ed7c7d76d858f79e1058181b4e77ccede55f782118f1c189dfd9d1a45e6c610154270f026c7c83fbbcd79e3fd96d3d12a3890508e9e420475a38157f36d
TLSH
T17211AF77338090742748A5A55979E550FB04C0BFC62A353AB9188C7C6481F6A94FBB26
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/tr_files/scroll0.css

SHA256 532b40642e87183ba650d1f719d86385425ccca5d46b21e1a206832e58b36fe9
MD5 c4b2510ae8a1ef4fa79c026bdacf1bc4
SHA1 9f770a9631995510ae09ebbfedd81c398682e800
SHA512 f49f0df5c736e3cc3e17ada2447ddd919f8b35b781f13a7d85d4910e61346c3b8876de79b2c184c836e25417846b60a823a1ce24f3904ad711426067b867866d
TLSH
T11DD0EB589682200A72B9DFF0F3222AD0CB19012EDB1E687834B0F53060020AC08F1A00
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$R0

SHA256 339213d60fb16c1ac4c1b1b1140bed2344bb7dcd672f67969b46429b7f17fd09
MD5 079b47dc80f47f257942aed3655b8d3b
SHA1 1e958c7184745c77d23ebbea0ac78c5804e922b2
SHA512 728682166f9cc5b847e9b92febe6946db03873483c1fcdb3d27a5febf373a2d1a4edbccc2d50a02d3b4e24f2ea323a7ebafd2b5b58ff3054106cd58ec14487a3
SSDEEP 96:Xb3+rWXmObWN4mU3fCAut7p6rVxDJJy9PPPzW0N:XzB2OKN4DfCAKorXVQPPPzRN
TLSH
T1119181CCBF66466FC4EB627585E2D37435B0CEC8BB064302A1BC56979D136A41DC62CB
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 2d3b71a0705db2d6e6d6019af2e1c103e77f1629acffd5ad5ff04dc36e9b8a2d
MD5 e8e0acef098a548e883274e9a35a7f3a
SHA1 4df3c3f39cf46d9e854d3e0579cf9fbc649c8d93
SHA512 7d0079013b4a85c00a65e56198874dff159e55327a873782a996ccab9ab8ec75845b5360e86221d59dac343f8b2772e7421063a0a0c2977f1f722fb2112753e3
SSDEEP 768:B1cVhpQI2EQK0iPDh84nScF15GYbp9mGO4xCfrkAygu:vQpQ5EP0ijnR3/xz
TLSH
T10E336D1E26C9D46BF4172A7106FAF739E3BAEF40293196579FD02FAF35243978910242
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

Bayonetta [CentralDeTraducoes.net.br].exe

generic

$PLUGINSDIR/Aero.dll

generic

out.upx

generic

$PLUGINSDIR/Delay.dll

kernel32

user32

msvcp60

msvcrt

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/WebCtrl.dll

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/desc.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/newadvsplash.dll

kernel32

user32

gdi32

winmm

oleaut32

msvcrt

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/scroll.html

$PLUGINSDIR/tg_logo.gif

$PLUGINSDIR/tr_data/cred.html

$PLUGINSDIR/tr_data/legal.html

$PLUGINSDIR/tr_files/scroll.dflt.js

$PLUGINSDIR/tr_files/scroll.html

$PLUGINSDIR/tr_files/scroll.js

$PLUGINSDIR/tr_files/scroll.tpl0.js

$PLUGINSDIR/tr_files/scroll0.css

$R0

out.upx

generic