71336088e81908ae0361386bd3c2572d3391438dae94c349863c7c90b8f1774a

resource
71336088e81908ae0361386bd3c2572d3391438dae94c349863c7c90b8f1774a

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/.data	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 71336088e81908ae0361386bd3c2572d3391438dae94c349863c7c90b8f1774a
MD5 7a8611a1ea75ba218c016020bc1e07bf
SHA1 4817a12e9afda34ace470adf2de831fdec9eaea0
SHA512 7fb59f16e01eeedf3f884b1073ed5b9e789215f8a6373e345a8b4f6dd995bab0959dae4dbbcdf19da62f9a4e9fe89a39c8d6d09111f31ed9ff99c76840278cb5
SSDEEP 12288:m9quqlGs8yl+eN0FOLI0Gd3TWLZtVUn7b+:mnkblrN0FF0GJTsqX+
TLSH
T10AB423291AD36D7BC3420AB323B6DF6397B4C725137617A347803D6D48BB193AB2471A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

.data

SHA256 97773fd68ac3aebb9795c59dc00c5dbc0c992ce0c3c2ef90bfff27eb1cd72b3d
MD5 7922d4ce117d7d5b3ac2cffe4b0b5e4f
SHA1 4e56bb1994226ae0285c7adee470777262de2c99
SHA512 3e64d43144ed740a982f3c75d41c0a65b3ac1879a6783ea0efa3d101fdaf8407090387275e67934e7b81dd307c161360fe72d3e68d471b0835b249424e5fc33b
TLSH
T1C911528B77510825E36143F8189F163A4D452288EAE0B92708BA1CE520A78473E6F019
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rdata

SHA256 576cdd5bc72421d008c86f056d0727c54cc8b3ec0961e5d0462af48278543d51
MD5 dc77f8a1e6985a4361c55642680ddb4f
SHA1 3d397ee25b2dd83ab741c67375880151cae94ed8
SHA512 24a96101a9aa268f5cddf58a5cea87c2ffbe0bd1e1b11c3408cdfb2cd3b5fd8eb36b739b5de796e8fb5bd118917e2eca4ba72502d6c64007e87c37e3381aee09
SSDEEP 96:Jdvisf5WoxO8HaomsMhdvis92a18fDD0Uw0UcsAGlk4xbSO7sfBxJk:3hEoxyopwh9j1igUtGRxbRsfBxJ
TLSH
T149B1B56729DA1DFFC0D7573522B3FF6A4C6BD490802E060415E8A68B5FBA14B81793F2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

.rsrc/0/version.txt

SHA256 e6ccf444503a5de7a53c7e83cd216f02e6b84bd7a460304023daef1120c8a443
MD5 22a6bb379617b76ac9c5584cfd196b8d
SHA1 a495c9624924193195c39031c563ad6b2e09577a
SHA512 4e11f9507ef8a2f690161dbf02b99ecb3e6f40c5b048162d429e3e7a7b5be8b9b4e7d5106703b40bd0d1f9a4739db69a8187e5e0b63e58c0bfea11a9a5febe82
TLSH
T10C216D0B91FB3599A1A7A98D4EDACC3243937914053D925E98DC7E4D4FD34042511BF7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/105

SHA256 425b8270f7ca42a927eae6bea468acf414a3e4b58b5ba2c56aaae4d1b2c11014
MD5 386770584473e271f23dced36427f4ff
SHA1 d14ce95f784b35e4e3ebee535476ebcd3e380c19
SHA512 e7bd459dc14642e2222477a05694db86e526c90333a6e0e711c91a8d5893036c09a27f75855d2b416f3da4ecb59e7a466d82b7cb7abdd56f6dabb040da34c1f3
TLSH
T168F046585B44C82AE01C4B7883E2C3E77133F01016005A03FF89B3869850E9CFC2DA42
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/106

SHA256 4a55bd714f5d50cd8eabba10e57f0618f1842717dcfa582d73a917b1933cd1d4
MD5 fa83652660409e90e0db9731ad2adb17
SHA1 0a8f0af67723c87fe26ccf676b8e19ec6357b4dc
SHA512 d97885f9c2846a042ec3c0d01a756d22fda7a989d55cd61efbc945abcdcfd74ca0284c745cf8bebf2d2fab82718f7b57ab0b701f67d2319ca6b5f55bce663c07
TLSH
T118D0800987D0C068F4704C34643BC5672914F5420C1471CFBDD583BB0824D00EF76241
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/DIALOG/111

SHA256 18466509968c3c0bf92ba410fea075def2b257a5a799a113cbc60f13e75f4b01
MD5 5dfa289639a3bcc0497da8db163f01fe
SHA1 6e2c6ea1e2594b66f563fb589276642c127e875f
SHA512 e281e9122569c837f11bdde960f4cf3f6000e82eea6288c5337d9e5c69c078989d1d4d8a1956cac0b6a4506250f406e77576a96ae6772e77d472a01640d42314
TLSH
T12DD012553AE6C50CF5B52DB1BEB2E2D71331F810D530C66F6AC0220D00F5900C919B86
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/GROUP_ICON/103

SHA256 4bc23683b3be25e29a3e40a1323c4af1ce0de55ecb9d45fdd37013b56b4ddd5c
MD5 5a2d9f21e50dee919dd25858464ed2a4
SHA1 040f0a55cf22bce760de500b3169cb4a5bf179ec
SHA512 c73c082344a71c8411a2bd47137fa25dcc40f2b205f7f27d07cd9c66807e7341a502ac57035d3f490a550ead5ff7a77cbbbd2d298a26b4e49e729fbba738d5fe
TLSH
T1C7A002010B584444C1A58F3004470335C425E07510B1370A046E08E87C226344EB5464
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/1.ico

SHA256 659555e7c1f4bb56203465ce99775e4ed633a35d3e07bd4914b67328098932e4
MD5 f2641e3733be2febc247df131b443415
SHA1 bf9240e7dfccf07f53ce2b4a7bf7b627c6f628f1
SHA512 ab4b22c42737b4a67c5a0ab025ae0f57400171a9768cbfb7a95f14ea4f18c97903cce5bcd409f4f63b67d9149adf113c63012fab050fb3722d4c49dca27c487c
TLSH
T1E1414842EB23B38BC08E0A3000A34212BE2CB300791313332F0A3A7ECAB20833B90184
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/2.ico

SHA256 7ecfc955fa0b12494c4d092c395c359bb5d38225965aa8d145a15eafaa7335e7
MD5 b24669ab6875ce3238a426bc7e61fb2d
SHA1 cd821f204a73af7b03ae815bc1b2b8c9fabb9f3e
SHA512 42806d07b16efb3476a5aba3a4d63c6ee1daf9281dff4878cd3d84e69fd20621b78839e81ad234a987afa20fc3aa48902b880265b6ed06dd9c0c6165ae49f3bb
TLSH
T13421C903BF4C88C6C0080E3000369708A300902C4F801303217CBD79ECE03C72C533C0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/3.ico

SHA256 56972c4944402c3ade1fd1784a9e9916b2d1230ad15e20c154148ae181299d90
MD5 8ab62b6b7d5ad3cacb7cc43ea3369690
SHA1 defbcd0fbc1b5f4c16fa91777c11b13f079ba21a
SHA512 1276cdcc8aaa972958c10874bd505ae4d17d475d0923895468384c4631b13f0f1bfcd6c35a895da4b0ba892e1f7459ad9cb001e5c4c2a2386d7599e7a1be0376
TLSH
T1920128221FFF48C7EC003336B61247762AA9DC880B1422CB1AD378491B782C7DDB5992
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/ICON/4.ico

SHA256 0164c12395253c50d7ba6ca33084caece46aa8b53b67c97797df68c6563a5713
MD5 7a069f6104d962a7061f05416f612df9
SHA1 c76f97e43d3f64fd4a3c4373465977036abc5b6b
SHA512 8d808cd2aa365f3d9d7791549addac04de0210c919e8283ac5e5ad7c7c0a114f2ab36484330bcdf153f396cbce41622ba88d9df6874b7d9815b49e0ebbc68528
TLSH
T101E0C9C12CF94814D5050170A8139FFC0A50DF0648F11A8F23B3AD4FAEB0207E479651
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/1033/MANIFEST/1

SHA256 cb24fe30879e7b0870fb61f7c16bdb8c4fa9a2a8c2d945bd3ea8dd889e93c0ff
MD5 18a65b0356650472e36d75deef2173b5
SHA1 ad8ae2a67c7258efa638901ff609cc6561b96b4f
SHA512 c3f42c6e59b34d81c5714ab4897988ad6776dec047dcb2736869a7280aa0a78845c70b76a57e71dc3f6edfa23723fafad522eafea10019c1b2ac7a3b52a6cf56
TLSH
T103111481C054E926E71202E33E75F55C15BEA32B04CC46EDC4C2997EA74B7CA87421A1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.text

SHA256 c6c2b4f41d6598b94106de36b422dd84534fd9a11d84b2b6a47b3be49524c750
MD5 856b32eb77dfd6fb67f21d6543272da5
SHA1 6597c511c2ee72f68f5246460f0683dae16dcade
SHA512 ab63000ac3d79ebc7f89635d65cd81e60160d5f208b2b87016413cd021116a5420ffc1eddfec7e6c1906654946fb739f90cd041a53cc2b92ebb3f23919fd51b5
SSDEEP 384:EHUv8rd7c7ISpH2+bQ2dUWn5DXCfg5hf0A1JMWmtqK8/dEwrVt3gpCjlfGBxpOZb:EHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJY
TLSH
T156B29E5EB9C0DAB3DE92497106BA737DF3FBC3CD02522D478B282F7935515A38A0914A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

[0]

SHA256 0ed0ca2fc9aa8600c9da3bce93805f7a7f7102b694f15af88e7661199f4ff74b
MD5 66974a992409a1dc0c95a35fa7599b41
SHA1 b22048bc7e75396babb28aaf721e9e029ed0bfd8
SHA512 ac1a46b6c7832007809c1a74de99b968760bff7bb0d67b3e659700c204c7ba8d59b69d1cc220c5519700328ee2f8fb7559c187d61945f9a4cc40a30853478e03
SSDEEP 12288:IquqlGs8yl+eN0FOLI0Gd3TWLZtVUn7b+:YkblrN0FF0GJTsqX+
TLSH
T1FFB423B819127E7D03450AF7A3B9DE8301D0CA3666B956F39380349908FF6657728F2E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer