CL-Eye-Driver-5[.]3[.]0[.]0341-Emuline[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/wdreg.exe

resource
CL-Eye-Driver-5.3.0.0341-Emuline.exe
unpack001/$PLUGINSDIR/CLEyeCleaner.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

CL-Eye-Driver-5.3.0.0341-Emuline.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 29cbd9d9bc6571d15d6a2b29dd2532fe6c7fb81d255778deb40f64dc79502bf5
MD5 64112c1df0d80d195d006da9c15bf710
SHA1 f0bfbc32171ecfb03614470b9c06ef34c07e66b0
SHA512 eefac2d69ece3ac07745a71c6e895200f1fb1b7c1f144ba44fcb658f9232bd613d894929bb81f24d86815eb09f87757b96277f7cd0aa40b1f092c366b54bc1c6
SSDEEP 98304:4cf1PgNuKGzp9kp2aqDNsmXWtKI/cdVo+J2v1I54UJV17j7MayZkxMCOaX:7xz3zApCXEtECd64eV1TyZkxJ
TLSH
T11B46332AEE8625C3D04764B4053A57F487E197D371A4600B0729FF2759BB23A1F63CB9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

25:ee:56:71:59:0f:ad:af:9c:4c:40:07:26:69:f4:d5:0a:d2:5d:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Chains

Dec 6, 2012

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Serial Number

36:21:61:5d:5d:c8:01:53:58:e6:e8:78:c5:41:ab:f0

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 2, 2012 - Jan 1, 2014

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/CLEyeCleaner.dll

IMPHASH a193370c5fd0819fd1d451cb076b0864
SHA256 b6cd1d3cf1c570888aba3eb54a51352fde7fc8e0dfe0e92c6e2b89f7f9acb7ff
MD5 cc59b63dfcc157dd8b964dcd2dbce1e5
SHA1 18b387086f3b18a93da1358d8ad3d8e2f3e226cd
SHA512 bda7c0ff5a95ee9e0764b2dd11b100ebc7d4c0477a22cc711cc6181c2d9c5f39d56e6c15eb99af6ec90a6b43cdaad62c9fbd0a1d1dfe1f1d03f56a1c12d52349
SSDEEP 1536:3d4bBq3zLknOF403QN8OomqMDBsgsDPmkpyU598o76mmj8:3d4bBczAnOVxmTZsDPvL38o76N8
TLSH
T17A836C21B790C076D88A2A308869C7735B7A79619FF4C4C37F9517B96F603C1AB3934A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

35:56:99:30:44:63:f0:6b:dd:95:3a:a9:c1:80:a7:09:19:70:cf:38

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Chains

Dec 6, 2012

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Code Laboratories\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Code Laboratories\, Inc.,L=Henderson,ST=Nevada,C=US

Serial Number

36:21:61:5d:5d:c8:01:53:58:e6:e8:78:c5:41:ab:f0

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 2, 2012 - Jan 1, 2014

Subject

Serial Number

61:19:93:e4:00:00:00:00:00:1c

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 22, 2011 - Feb 22, 2021

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

1

Major OS version

5

Entry point

13549

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteFileA CloseHandle FindNextFileA FindClose FindFirstFileA TerminateProcess GetSystemWindowsDirectoryA OpenProcess GetCurrentProcess lstrlenA CreateFileW GetProcessHeap SetEndOfFile GetCurrentThreadId DecodePointer GetCommandLineA RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer HeapAlloc GetLastError HeapFree IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar ReadFile TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError InterlockedDecrement GetProcAddress Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage GetModuleFileNameW CreateFileA SetStdHandle FlushFileBuffers HeapSize HeapReAlloc LoadLibraryW WriteConsoleW LCMapStringW GetStringTypeW

advapi32

InitializeSecurityDescriptor RegCloseKey AdjustTokenPrivileges RegOpenKeyA IsValidSecurityDescriptor RegSetKeySecurity FreeSid AddAccessAllowedAce SetSecurityDescriptorOwner AllocateAndInitializeSid InitializeAcl OpenProcessToken RegDeleteKeyA RegEnumKeyExA SetSecurityDescriptorDacl LookupPrivilegeValueA RegOpenKeyExA

psapi

EnumProcessModules GetModuleBaseNameA GetModuleInformation EnumProcesses GetModuleFileNameExA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ea407ba58ab565da56864c02be188d42f4c35e1124af85ac668601c7d9fe885c
MD5 bf0cac9a510a5c7c674734f70cc78eed
SHA1 3315de8307be3d0b02d1c939daeea71256b045b5
SHA512 2180de9fc2c0ce2301cd10f5b522e42b2db57894d597ec7f8f48eaa9146c722144c21481f34e4da1060197c21b25b50fe4732e42a542259cb8d41b4e34f62b08
SSDEEP 192:FChlOL8ZsdkLsnDIIaX1kE5xl4LLXhLZhQXkgmyWv5TGXjzCMb9pK0yzu5OY68Z7:FqOHUu5ktJU37c
TLSH
T1A7C28DB5F0B1D8318774E942FFF594AE7AABFE15344ADDE3A500B37869B6872680C101
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 8d40754ea0871fea52cf2d97c9cfef69d0828fce118b13b178310a9fd390f9bc
MD5 5f3567bf12b8c1ebb11696240b49a1f6
SHA1 f8082db4d83ccd587fe1db1a6bb6cecfb793b646
SHA512 eb784c1a91d9e72ece96db7656fc26f296c36f18656b8356a5091f8ac4f92a725738b64c354b8e35ae3a1d986c0b3a39a9b4bcbd1d649734080292ba84434b05
SSDEEP 768:7PP4Cu6o3BJeg3m4IBzaGhVmF3mIpVR2VoGEwUNg6KKIrs+ysufmhAGU/oZIy8Zd:mr
TLSH
T105E36BAFE50AFA0767D0C8E9C9655BB54E98FC8E176358786D6C389C953F3200A0D21F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH d83f71e61ee459ee63ca3e829966a9dc
SHA256 168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
MD5 acc2b699edfea5bf5aae45aba3a41e96
SHA1 d2accf4d494e43ceb2cff69abe4dd17147d29cc2
SHA512 e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
SSDEEP 96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
TLSH
T19BD1E73D75C33DB3C54ACA762C65292B0FB8C9261B5402119B6716C279D5AE3FE29382
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/wdreg.exe

IMPHASH 3b2217b486b207960f060b3666b50c27
SHA256 5957f8a0bea130c6c4d91af8c5d6879943dc76faf1ebb50a70e3bd285fc8d86e
MD5 d0047e39b0dfd11ec2a50e2a45c2d9be
SHA1 7dd0c7c4689aa4c70e3ffad86c2336d0785283b3
SHA512 4807e11cdff1f5fe78b7172cc0170de51fa97997f0096ef44e1c6d159df7e933889e64a368055cac5c57f5297478f1a035e0402818ccf33c540503f36305a64c
SSDEEP 3072:pDsy3Iz27vf6Uz4wtApVzVH8csZm5Z4GFQeLn04gQAL/iha8n:pDsy3K2jfewtApTH9sc5Z70n
TLSH
T14AE34959736151B6E463C17EC9838786EB32B4158B3113CF136A977A1F233D2BD3A621
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46840

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

lstrlenA CloseHandle ReadFile GetFileSize CreateFileA DeleteFileA GetWindowsDirectoryA DeviceIoControl LocalAlloc GetSystemInfo GetVersionExA GetCurrentProcess GetModuleHandleA Sleep LoadLibraryExA GetProcAddress FreeLibrary GetLastError FormatMessageA LocalFree GetFullPathNameA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapFree HeapAlloc RtlUnwindEx FlsSetValue FlsGetValue EnterCriticalSection LeaveCriticalSection GetCommandLineA GetVersionExW HeapSetInformation HeapCreate OutputDebugStringA GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP EncodePointer DecodePointer FlsFree SetLastError FlsAlloc WideCharToMultiByte LCMapStringW MultiByteToWideChar RaiseException RtlPcToFileHeader HeapReAlloc HeapSize SetHandleCount GetFileType GetStartupInfoW DeleteCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW SetFilePointer GetConsoleCP GetConsoleMode GetTimeZoneInformation InitializeCriticalSectionAndSpinCount LoadLibraryW GetStringTypeW VirtualProtect VirtualAlloc SetThreadStackGuarantee VirtualQuery FlushFileBuffers SetStdHandle WriteConsoleW CompareStringW SetEnvironmentVariableA SetEndOfFile GetProcessHeap CreateFileW ReadConsoleInputA SetConsoleMode

advapi32

DeleteService ControlService OpenServiceA CreateServiceA OpenSCManagerA CloseServiceHandle StartServiceA

Sharing

General

Malware Config

Signatures

File Explorer

CL-Eye-Driver-5.3.0.0341-Emuline.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/CLEyeCleaner.dll

PE Signature issue

kernel32

advapi32

psapi

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/wdreg.exe

kernel32

advapi32

generic