f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578

Sharing

Copy URL Twitter E-mail

General

Target
f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578
Size 5.8MB
Sample260830-yz43ysz1fs
SHA256 f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578
MD5 b5b4f6a3f0d61e8dc8d92b01f172b38d
SHA1 c414c004b90457b7a29ffb84ddcb80bf6c0e0770
SHA512 b40f1b6d236e457beb61a8eeea0fa3949cf236a695da26f086b65d5422ebd34efa8f28e7104491f40c1d95f5c6bcf312865ff6b5908b04365216925a566ee1bd
SSDEEP 98304:xhiINrA58j5mMYtYGs2Y8ZcXk7NLTIfbnZd8ubivMcZzThZn46i7YoLMjz:xhlrDoMaybScUNLcb/8CivMoHLn4LhLS
TLSH
T1F0563351A30B4363F93611BBA9367D62EC46A00DE5419F9DB7F6263DDCB71600B7CA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 12 IoCs

Checks for missing Authenticode signature.

resource
f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/804登陆器.exe
unpack001/_up_/resources/windows/x64/clinkAPI.dll
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578

.exe 5.8MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 29KB
804登陆器.exe

.exe 8.3MB
_up_/resources/windows/ClinkAPI.h

3KB
_up_/resources/windows/x64/clinkAPI.dll

.dll 1.1MB
_up_/resources/windows/x64/clinkAPI.lib

3KB
_up_/resources/windows/x86/clinkAPI.lib

3KB
uninstall.exe

.exe 74KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 29KB

f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578
MD5 b5b4f6a3f0d61e8dc8d92b01f172b38d
SHA1 c414c004b90457b7a29ffb84ddcb80bf6c0e0770
SHA512 b40f1b6d236e457beb61a8eeea0fa3949cf236a695da26f086b65d5422ebd34efa8f28e7104491f40c1d95f5c6bcf312865ff6b5908b04365216925a566ee1bd
SSDEEP 98304:xhiINrA58j5mMYtYGs2Y8ZcXk7NLTIfbnZd8ubivMcZzThZn46i7YoLMjz:xhlrDoMaybScUNLcb/8CivMoHLn4LhLS
TLSH
T1F0563351A30B4363F93611BBA9367D62EC46A00DE5419F9DB7F6263DDCB71600B7CA02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

804登陆器.exe

IMPHASH 4b9befb80503f6d8177907eda3b7f7c4
SHA256 cc8435fe71f67edf2111091dbd163f59cb7ded3baac0b84a15e15b8b3c049431
MD5 9d58a9d07307683800985088f2b33cdb
SHA1 acb0834ab8fe435f667c22d70d13e7c1031e428a
SHA512 0181375502eb9cedc7f4adf269f9c40b2b643942de978630dd23e83db2249e8f0c392dfb169ca88c2d6fda25066e89606903e70e39ef1c730598ce7b684749a7
SSDEEP 98304:FETKLMQX5RnWSo+bwAxtEkC6LpYczmsZlMVqfvYtPA4jLjMzkLHCHpCG0:qwwAx+6vhZ6U54PjMQHrG
TLSH
T1EE96C043FA9281E9C05EC474835AA233FB36B8890A2176FB67D44A313E76F605F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2860116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

launcher.pdb

kernel32

CreateThread GetFullPathNameW SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx ReadFileEx FlushFileBuffers CreateDirectoryW ExitProcess GetExitCodeProcess WaitForMultipleObjects GetOverlappedResult CreateEventW CancelIo ReadFile TerminateProcess GetSystemDirectoryW CreateProcessW HeapAlloc DuplicateHandle WriteConsoleW GetTempPathW RemoveDirectoryW DeleteFileW MoveFileExW CreateSymbolicLinkW CreateHardLinkW CreateWaitableTimerExW SetWaitableTimer GetConsoleOutputCP GetConsoleMode GetStdHandle ReleaseMutex FindNextFileW LoadLibraryW SetFilePointerEx SetFileAttributesW GetSystemInfo LoadLibraryA WaitForSingleObjectEx PostQueuedCompletionStatus ReleaseSRWLockExclusive AcquireSRWLockExclusive LoadLibraryExA WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue SleepEx TlsFree InitializeSListHead SetFileCompletionNotificationModes CreateIoCompletionPort UnhandledExceptionFilter GetQueuedCompletionStatusEx SetEnvironmentVariableW GetFinalPathNameByHandleW SetLastError SetUnhandledExceptionFilter ReadProcessMemory IsDebuggerPresent CheckRemoteDebuggerPresent RtlUnwindEx SetFileTime HeapReAlloc GetCurrentThread SetThreadStackGuarantee WaitForSingleObject CreateMutexA OpenThread GetModuleHandleW WriteFileEx GetFileAttributesW GetWindowsDirectoryW VirtualQueryEx GetProcessId GetCurrentProcessId GetSystemFirmwareTable SetPriorityClass QueryFullProcessImageNameW CreateFileW RtlPcToFileHeader RaiseException LoadLibraryExW FreeLibrary GetVolumeInformationW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentProcess Module32FirstW Module32NextW GetSystemTimePreciseAsFileTime Thread32First Thread32Next OpenProcess EncodePointer AddVectoredExceptionHandler FindClose lstrlenW SetThreadErrorMode GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetCommandLineW SwitchToThread SetHandleInformation HeapFree GetProcessHeap DeleteCriticalSection GetModuleHandleA Sleep OutputDebugStringW OutputDebugStringA LCIDToLocaleName GetUserDefaultUILanguage GetProcAddress CloseHandle GetModuleFileNameW GetLastError InitializeCriticalSectionAndSpinCount

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

WSASend WSAStartup WSACleanup shutdown getpeername WSASocketW getaddrinfo freeaddrinfo recv accept WSAIoctl WSADuplicateSocketW setsockopt ioctlsocket send getsockname listen bind WSAGetLastError closesocket connect getsockopt

bcrypt

BCryptGenRandom

advapi32

RegCloseKey RegEnumKeyExW RegQueryValueExW EventRegister EventSetInformation EventWriteTransfer SystemFunction036 RegOpenKeyExA RegGetValueW EventUnregister RegOpenKeyExW

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile NtReadFile NtOpenFile NtWriteFile NtCancelIoFileEx

crypt32

CertDuplicateCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext CertDuplicateStore CertDuplicateCertificateContext CertCloseStore

secur32

AcquireCredentialsHandleA QueryContextAttributesW FreeContextBuffer AcceptSecurityContext DeleteSecurityContext InitializeSecurityContextW ApplyControlToken DecryptMessage FreeCredentialsHandle EncryptMessage

oleaut32

SysFreeString SetErrorInfo SysStringLen GetErrorInfo

user32

SetWindowDisplayAffinity FlashWindowEx GetForegroundWindow SetCursorPos GetCursorPos GetAsyncKeyState GetKeyState TrackMouseEvent SetMenu ScreenToClient LoadCursorW SetCursor GetTouchInputInfo SetCapture CloseTouchInputHandle CreateAcceleratorTableW CreateMenu AppendMenuW VkKeyScanW GetMessageA DispatchMessageA CheckMenuItem SystemParametersInfoA GetWindowRect MonitorFromRect GetWindowLongPtrW AdjustWindowRectEx GetMenu GetWindowLongW SetWindowLongW SendMessageW EnableMenuItem GetSystemMenu InvalidateRgn SetWindowPos SetForegroundWindow PostQuitMessage ShowWindow RegisterWindowMessageA IsIconic SendInput SetWindowPlacement IsProcessDPIAware MonitorFromPoint GetDC CreateIcon SetWindowLongPtrW CreateWindowExW ReleaseCapture MessageBoxW GetWindowThreadProcessId GetClassNameW GetWindowTextW GetWindowDisplayAffinity IsWindowVisible EnumWindows EnumDisplayMonitors MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData PostMessageW MsgWaitForMultipleObjectsEx PeekMessageW PostThreadMessageW DestroyAcceleratorTable SetMenuItemInfoW ShowCursor DestroyWindow GetClientRect RedrawWindow RegisterRawInputDevices TranslateAcceleratorW DispatchMessageW TranslateMessage GetAncestor GetMessageW ClipCursor ChangeDisplaySettingsExW GetSystemMetrics GetClipCursor GetActiveWindow ClientToScreen SetWindowTextW GetWindowTextLengthW DefWindowProcW RegisterClassExW ToUnicodeEx GetKeyboardLayout GetKeyboardState MapVirtualKeyExW RegisterTouchWindow IsWindow GetMonitorInfoW DestroyIcon MonitorFromWindow EnumChildWindows GetWindowPlacement

psapi

GetDeviceDriverBaseNameW GetDeviceDriverFileNameW GetProcessMemoryInfo EnumDeviceDrivers

iphlpapi

GetAdaptersAddresses

comctl32

SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass DefSubclassProc

shell32

DragFinish SHGetKnownFolderPath ShellExecuteW DragQueryFileW SHAppBarMessage

ole32

RevokeDragDrop CoTaskMemFree RegisterDragDrop OleInitialize CoInitializeEx CoTaskMemAlloc CreateStreamOnHGlobal CoCreateInstance CoUninitialize

gdi32

CreateRectRgn GetDeviceCaps DeleteObject

uxtheme

SetWindowTheme

dwmapi

DwmEnableBlurBehindWindow

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow round trunc

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncmp wcslen _wcsicmp strlen strcmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

_initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _initterm_e exit _exit _crt_atexit __p___argc terminate __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe abort _set_app_type _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh calloc malloc free _set_new_mode

_up_/resources/windows/x64/clinkAPI.dll

IMPHASH daa91117988cbde5aab2eb2f18fafff6
SHA256 1fe430ba6f13e160f997669b2f899bb3ecc8c6fec839f73bcf9f5fd103f60f09
MD5 75ab37a8c78eca2d619a587d15c2c2a9
SHA1 1ef9a14a9a186c7853a9a2d48ae8b3c0e5b034b2
SHA512 b2d1f68bd940cd8c83603bcb2f1b3778687bda3146a7c555b1a6b958639be9ef948d08010ab39f1f8041143c3ef1e9e9e3605899d6b5b8313174aca3ec90b837
SSDEEP 12288:kRcNCFB+ilMae0bQolO7xj5ol9fpoaCUPn7TfBMhHKIsb:TNCHjlMae0bhszGr5nJSqz
TLSH
T12C35E94BEAB451E1C47AD039C553661AFCB134A587705BC79696AB0B2F33BF0A93E700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

531364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

WideCharToMultiByte GetEnvironmentVariableW GetFileAttributesA OpenProcess GetCurrentProcess CloseHandle CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GetCurrentProcessId TerminateProcess GetExitCodeProcess WaitForSingleObject GetLogicalDriveStringsW GetModuleFileNameW QueryDosDeviceW GetLocalTime MultiByteToWideChar CreatePipe CreateProcessW SetEnvironmentVariableA SetEndOfFile LoadLibraryW WriteConsoleW SetStdHandle CreateFileW GetCurrentDirectoryW GetFullPathNameW PeekNamedPipe GetFileInformationByHandle GetVersionExW GetSystemInfo DeleteCriticalSection Sleep FileTimeToLocalFileTime GetTimeZoneInformation UnregisterWaitEx QueryDepthSList LeaveCriticalSection EnterCriticalSection InitializeCriticalSection lstrcpyW lstrcmpA GetLastError LocalFree ReadFile LocalAlloc InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead ReleaseSemaphore VirtualProtect VirtualFree VirtualAlloc GetModuleHandleA FreeLibraryAndExitThread FreeLibrary GetThreadTimes OutputDebugStringW HeapReAlloc FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetModuleFileNameA CreateDirectoryW FindNextFileW GetFileAttributesExW SetFilePointerEx ReadConsoleW GetFileType GetStdHandle GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers GetDriveTypeW FindFirstFileExW GetOEMCP GetACP IsValidCodePage DeleteFileW GetProcessHeap DuplicateHandle GetCurrentThread GetCurrentThreadId EncodePointer DecodePointer GetSystemTimeAsFileTime GetStringTypeW HeapFree RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx IsDebuggerPresent IsProcessorFeaturePresent FindClose SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateProcessA GetCommandLineA GetCPInfo HeapAlloc RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetTickCount GetModuleHandleW GetProcAddress CreateSemaphoreW CreateThread ExitThread LoadLibraryExW CreateTimerQueue SetEvent WaitForSingleObjectEx SignalObjectAndWait SwitchToThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize

user32

CreateWindowExW DefWindowProcW LoadCursorW MessageBoxW DestroyWindow RegisterClassExW TranslateMessage GetMessageW GetSystemMetrics SendMessageW DispatchMessageW

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges

shell32

ShellExecuteExW

ole32

CoCreateGuid

crypt32

CertFindCertificateInStore CryptMsgClose CryptDecodeObject CertFreeCertificateContext CertGetNameStringW CryptMsgGetParam CertCloseStore CryptQueryObject

ws2_32

htonl recv WSACleanup send inet_addr htons inet_ntoa closesocket WSAGetLastError socket setsockopt recvfrom sendto ntohl gethostbyname WSAIoctl WSAAsyncSelect accept bind listen connect shutdown WSAStartup

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

wininet

InternetOpenW InternetOpenUrlW InternetReadFile

urlmon

URLDownloadToFileA

psapi

GetProcessImageFileNameW GetModuleFileNameExW EnumProcessModules

uninstall.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 0ce0ec7caf3e56181c37a703aba018aa708c62943b07b3283ee95fe317b1a8e0
MD5 f61f0080166d6260aba02a0feb11cdf7
SHA1 69f4eecc3da52a7a3082195211ddf8039dab923c
SHA512 f56181a8f6e6267b79296e14129a5247d91c037136d1a1ca86425793d69f8c1f6c05d92586b38b931d8c823ecc9ad0cdcb877115f0dd46219c2df4a57ed993ee
SSDEEP 1536:HmsAYBdTU9fEAIS2PEtuVgdLeAyNZyO+ErcVGH15q2E2kqAF:GfY/TU9fE9PEtuVceA7OpI8FA
TLSH
T16173CF057AA0C467D9F60B311E7B5BA67FF5F82210A497072B105B5EBD327429E0E363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Sharing

General

Malware Config

Signatures

File Explorer

f7f968edd59dc851af17cc275d1dbec9a2cf4ddf3936b10e478382e094689578

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

generic

804登陆器.exe

kernel32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

bcrypt

advapi32

ntdll

crypt32

secur32

oleaut32

user32

psapi

iphlpapi

comctl32

shell32

ole32

gdi32

uxtheme

dwmapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

_up_/resources/windows/ClinkAPI.h

_up_/resources/windows/x64/clinkAPI.dll

kernel32

user32

advapi32

shell32