0385b2cb41b302115f307a23a9b860dd709554414b1ae108bbf306f899815b17

resource
0385b2cb41b302115f307a23a9b860dd709554414b1ae108bbf306f899815b17

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/.data	nsis_installer_2

IMPHASH ced282d9b261d1462772017fe2f6972b
SHA256 0385b2cb41b302115f307a23a9b860dd709554414b1ae108bbf306f899815b17
MD5 25313776a2712358713e1d4f22f92972
SHA1 c2c6df61004d266375bd10d2c6f908f6396a9b44
SHA512 53b9621142334ca1e6aedcf7ed6ed6d933a100114851e00c223cf5cad8192f78862f182e27301f6665da24462f42f631a1735075d56ffa7b5c0bc1561cc83cae
SSDEEP 786432:eu+0WVEJrLuVRKbTJbMH0IzR2Ni+Zne04Emp2ubo539L384:eT0RuVRKbTJQH0aR2NlZmRbotN
TLSH
T1A187339ED14201F2E66057F63A28ED14824395FB72E1A34116B9E47B1CA9C363EDC87F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExA RegEnumKeyA RegQueryValueExA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken SetFileSecurityA RegOpenKeyExA RegEnumValueA

shell32

SHGetFileInfoA SHFileOperationA SHGetPathFromIDListA ShellExecuteExA SHGetSpecialFolderLocation SHBrowseForFolderA

ole32

IIDFromString OleInitialize OleUninitialize CoCreateInstance CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

SetClipboardData CharPrevA CallWindowProcA PeekMessageA DispatchMessageA MessageBoxIndirectA GetDlgItemTextA SetDlgItemTextA GetSystemMetrics CreatePopupMenu AppendMenuA TrackPopupMenu FillRect EmptyClipboard LoadCursorA GetMessagePos CheckDlgButton GetSysColor SetCursor GetWindowLongA SetClassLongA SetWindowPos IsWindowEnabled GetWindowRect GetSystemMenu EnableMenuItem RegisterClassA ScreenToClient EndDialog GetClassInfoA SystemParametersInfoA CreateWindowExA ExitWindowsEx DialogBoxParamA CharNextA SetTimer DestroyWindow CreateDialogParamA SetForegroundWindow SetWindowTextA PostQuitMessage SendMessageTimeoutA ShowWindow wsprintfA GetDlgItem FindWindowExA IsWindow GetDC SetWindowLongA LoadImageA InvalidateRect ReleaseDC EnableWindow BeginPaint SendMessageA DefWindowProcA DrawTextA GetClientRect EndPaint IsWindowVisible CloseClipboard OpenClipboard

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectA CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetProcAddress GetSystemDirectoryA WideCharToMultiByte MoveFileExA ReadFile GetTempFileNameA WriteFile RemoveDirectoryA CreateProcessA CreateFileA GetLastError CreateThread CreateDirectoryA GlobalUnlock GetDiskFreeSpaceA GlobalLock SetErrorMode GetVersion lstrcpynA GetCommandLineA GetTempPathA lstrlenA SetEnvironmentVariableA ExitProcess GetWindowsDirectoryA GetCurrentProcess GetModuleFileNameA CopyFileA GetTickCount Sleep GetFileSize GetFileAttributesA SetCurrentDirectoryA SetFileAttributesA GetFullPathNameA GetShortPathNameA MoveFileA CompareFileTime SetFileTime SearchPathA lstrcmpiA lstrcmpA CloseHandle GlobalFree GlobalAlloc ExpandEnvironmentStringsA LoadLibraryExA FreeLibrary lstrcpyA lstrcatA FindClose MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA SetFilePointer GetModuleHandleA FindNextFileA FindFirstFileA DeleteFileA MulDiv

.data

SHA256 eefc550e3dcbf08f3a45d7bf56cd1f2d97a3c85a8f219c8ce9a398f0c78b2dfe
MD5 599a2f85a30bf72bff5e1c2e854c43ee
SHA1 aa1f5737ec607d682ca66abf0359157cde44ad08
SHA512 f949f1b2b22e25c6cf38f1077b9b614cf313097d85ef94fe051303d1938284cf3f95f0fb73b17ae4ab63c5ac55b8eb08b6ff88e0410fa03c4ecb1948acf1e0fd
TLSH
T13D31904BB3F159F9E28207F40D56AE3B0DC36BCD99E0D4220CA5148E113B90A2B7E1B9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rdata

SHA256 e57e06f0a1440e2bc802fdb52f8f75ca76a1ac6925d92603ffaac204917446e9
MD5 b8e42f3d3b81b0e2a4080ab31bc2d1f4
SHA1 e0cbe654ca1eb634ed5c80fd7d25a956207641f2
SHA512 b77b92b29190f740a6308714a49bd001ede7c7a7d0b93bb6340265829301de07f75668b90b80f60faa179412afa85e7ec517a93ec7fe7687b3af00838dbdad3b
SSDEEP 96:EfNE2eR5WoxB8HUfNE2mI8ujKCsAGlkHbSOaHO18fQ0UaZZ6G:EfNPe6oxffNPmI8uuUGCbUu1iUCZ
TLSH
T1B5B1841B54B80DDBC1956B34A0792E1FCDF4C41A306F271536C8F6AAFE59006866B3E2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

.rsrc/DIALOG/102

SHA256 09b17373dd40b89a1f1b428f387837db95bc729f40d7189dd3774495c34067b6
MD5 737dd1e8146ef8d56dac24dbc1957838
SHA1 15658c461b9fae98eb87e6ad4cbba100bbb51f1d
SHA512 24295ba53c781d9ac9e10ef55e990f973c323546d5b315891b59141f075a9ecda7cd27a52be365ddf8a92e6d2a906f242aa2fc6540c149070c48d53cac851293
TLSH
T159C0127411C9C5B1CC844432E78ACB43D7337802854DBBC3FAC803374D02F085C10105
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/DIALOG/103

SHA256 b98ac97ffc283bc465d34958c79f8a31480c0f98eb44c5e23977bee9ba52b703
MD5 888fbcc92ebd6174786b32d45350005a
SHA1 ba4959d06247a07012fbca926691e2e709c7aa8f
SHA512 95605f7b09b8e2a593a069945899b8324c8af825b1b320e8783a4e9c0fec9798b4887e5f10768ae3c79ecba06b49b13492a6af44b8f8472b24ced28e5e379b09
TLSH
T135D08C0943C2DFA1D0044C3902EECBD32B3630415A19A987FC08AB637420630FC520E8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/DIALOG/105

SHA256 349420ba5b5de0b0081e96a686c826e0f409f2f3413f2e9fb7e6f71cb544c325
MD5 c0c4f9be63c9d286b8d1265977ac9d86
SHA1 f9c0d915ded3ea188f342d0e5341e67701eed813
SHA512 c68d19d71f58221e6ed433d4733b2a8ba4d2411557a824c506de162def8b3a3913d1e2840576d81afe5afc0b1e6767d79b7df51d165d0d7cb87d60841daf1024
TLSH
T114F0B6595B04C826E01D4B7983E2C3D37633B0241A456A53FF8D63969950E9CFC2DA42
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/DIALOG/106

SHA256 1a39a3aabdee2aa68c507c55ff37c38722b05b7f8bde66185a2462792381d8cd
MD5 8c69d2c81dd2d9050d0fa94df90ff16b
SHA1 cd71d904da747d7141e5abdde9363f7e240b26bd
SHA512 c07f491b5728a24aea2669ae0680801a1c3bc89ca9c9272b33609abcaf1f85005346ef3f7f997a314bf465ca0d4d6a05074ee4071324c77472bcbf083d58e77d
TLSH
T10BD08C0D83D0C0B0F0B00C39903AC5832A29B5824C0976CBBCDA83BB0C24E00FD72200
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/DIALOG/111

SHA256 a10617b39293152a65ad5c91ca4f35135845c7b785e3a582e58f6c8229045b85
MD5 2497a44fff8b76b5129662b60a617c85
SHA1 f73bd7c9caa4c1f7a0e4840d69b0accdc6d167a0
SHA512 894e1d89007a8236dbf9042f6791143ab4c0502f914ab99304024adb73214cadbb253cc24fd6cf85e59b71de13237c855f991c60390a87760661d82c0fea1cb4
TLSH
T16CD0800539D6C908E1F52DB1E5B1E3D71332F420D530C76F76C0121D04D55008C14F45
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/GROUP_ICON/103

SHA256 fed46e06346fb8f64b14c18408a82caf955929ac0e65151630539dc5bd194584
MD5 e624f041c921d299a6da3a8c5f48f989
SHA1 ffa07c86ac3dac45398ee07b26610dfb5c99d8ea
SHA512 67e0f898f0fdfc20871764af8cd456154f7f4b6c3051199b27c543f9ed64d4778d1a757e1a99b762d00c32fb241befc4c22349d670b2a4098c8131bf7b8e50a7
TLSH
T1B9B01201530C5609C2EC0F34004E0772C018C00442B23503011F01646D031201A34E40
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/1.ico

SHA256 3a0f348ce6aca8d5fceb011f6785dbf9137b7ba5e791d91be40b54782ea0985e
MD5 d190929df64634a558211a3137ae56b0
SHA1 9ab6a1d7a5c7fb1e1de92a6b89f753e4fe1da362
SHA512 91b47b4f26194a1f4ae1978411ac334bb03b5a74c447337be3791a6ff21d52a32e966c28fa400565a93f891f3cdbd6bd47c3454b70777bbaa5771c6b3051d548
SSDEEP 96:lGF6kKh6BG1hZ+sDFshtE8Sn2aeMAIzYKL6Tu:lI6kKh6M1hZ+0FAE8Sn2arNL6S
TLSH
T1C4915C630106C1F5D3549A31BA1B80D11EA71D7EC6B50F961247FB2F6A1713C5C6BE38
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

.rsrc/ICON/2.ico

SHA256 186e76f5ae14a0be6becc8c48b2f5ee53add7006b09fd71ca6418b3e2c1e780b
MD5 6dadffd01add9970cacb9432af50acfe
SHA1 1ed6948a9acabffc25dfc6c236860da0f33a4170
SHA512 30c3b4e0e69499bffe177df41707c7b188f4c6fc51187f6ac2d63fbe32de84b8f8a223a20f525082fb40aa3e20732d3b82939d1c171095988157ccdd3da717e4
TLSH
T142710B18DBC8D911DA797730DC608FF64163DC90A669F7A31BA5BD178E325B1D09142C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/3.ico

SHA256 52183cc668a2f101f6d4c1d3a53169b5ee5b2444ed7c9c971c6f095a0577cb47
MD5 bb3829a122926ed97f4cf18fdcbe05e1
SHA1 bfbf0bc58429a9c6b9905aaedc0609fa99ecb1da
SHA512 7001697413fa09a493c27238a3e571e8e21250ba606e44b5e28676d3771b43f6d624f82586a62b76ac4a4e07f313cfe489c4702f5b69803136a40a76dbb4ecab
TLSH
T12241E810F34F865EC94A0D7481BBAB7D3E158D620041A6A24F86ED7BDCA05AADFA10E0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/4.ico

SHA256 e386e855c6cefabd45f84423f445fd2d70d93b2ed58b4430d69f072fbab63753
MD5 ab14e2e52f13afd8553aaf5c986b228d
SHA1 878e38472c69491b92d61a06d8b9f689e6eea059
SHA512 17990d07763aff8d06f26efe23ee921ab97c2ba106d5268cdbfce297cd0c76621736af14adc4e1517e2e016a93790c2561ed4e60946c5c1636d4a568677e9442
TLSH
T15C2175CBF681DD54EBD15B37C8434398198B8E661200CE00AAB1516FCE28284197BD09
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/5.ico

SHA256 167722b9ee817156659cb975fe00dc6f2278d7db3368d93bb95cd8af4e07bf8c
MD5 6cf11b3461a9c6ad2515731a3f3e48dd
SHA1 00a34c86db669a0d1521d50c1905e1c68268d7dd
SHA512 9c806d0c76b91edb605881a1381f9fd02cc2fb2e7357f1f662d9babdbea9a34867bd3030f910ac3fa6094243ffed146ca3d7ebd38061e633c60bda6a2b35ff6b
TLSH
T14721C8F7F0913CB0E06DE1B4F05622833EC40D03006ADA0639B8C68A28AD358563BB7D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/6.ico

SHA256 be755396704842b3552c6b6af6ca1b2e0bc0c327f0ca2809d31edd2f5d0e3657
MD5 fec4603c388bb6da770370ace7921f75
SHA1 62099f6e5892db17d315bcb0fab781d22caca8e5
SHA512 f394b55dc0ee2aef6c34780a2e602816ef1d62a40b36f8ae9dd7b918ee99fc723890bcfa3a568d7a3af4cfc24dd171295c46a3eff18f778d625ebdf37e947c98
TLSH
T1FA013125B202E799F53E16330E3A57A940E5680CCC20D076DAE9EE3F3C702420C28CCC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/ICON/7.ico

SHA256 85b28184a94e7ae8bece135b25f182556fb0a35343e27ac596a0521ead13dceb
MD5 f13816d2113d5b27b30d1191c07dd77b
SHA1 f40f616d7f47bd5959f8e03a4f18323366dc83ba
SHA512 96d01bd619f83940ebff18b3eefa5c4b5887d567c1d670efb708cfc83d6c9048cdf96a2b3ecbf8cf09e4cc66529c3986ab061f88698e6969b3cce1a886510262
TLSH
T199E042CA3024C456CA6C20FE8C0BD6FC19005C124660EDE722B1BE2F6C30114FF114D8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.rsrc/MANIFEST/1

SHA256 c61ef607960c462d54bca335339a4a38f3ef307afc977463fddc6aced3f096b1
MD5 75b45d5a8944a038532a6066258ac4f4
SHA1 5d61146f92cdf5495a48f7367d829e3f51b38aaf
SHA512 70bcfc5d44828457fffdba6820c4134dc2a8d937013ef216329a8e6ed5635f340f47b78588018092cb2c013ef71e909859b1622eba5142ca93b2e6018e845b5f
TLSH
T183114281D428E566E71202E73FB8F549157EA33B08CC47EDC4C19B7DB202A8B87221A1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

.text

SHA256 b7bd0795251a2cdc950dc4cc1e0789678829a2531e5f5c449cd1adee82f02fe0
MD5 83acff9b8bf5b52f9975f8acdcabf744
SHA1 4f8d8de1682bb187a9c3e3b5984947b692e275d0
SHA512 6bbdfd8ba5a7108f9b83119666f2ecd7032aab044691c1574f0813f71eecbba71aae5caaf8e9cca1590c05447d81cadd6dbd5eeaeb588e111a6809646b449c7a
SSDEEP 768:rsmG6ZXDU8J1+cp68XHu/zwvW9DTGBKYMnd:gBkTL+cpRX4tToxMnd
TLSH
T1C9B28D793690D4B3CBB706B00E7A62A5FFEAD31011A15A8B77304FC47667AE2950F583
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

[0]

SHA256 ada7f3c46989b91f53387d28891ece26e25847ac6ac0e01a5c54d60d011e0ff6
MD5 da31c373e3a06c1c6ed5c47bd260fae6
SHA1 bd4c289c58705369473b0035d8b7263f5e0e1309
SHA512 85706cec2567e56797ffd0412435e6677b56285b2d98fcbc3f22ac4ac9476b1c6fc0159e7e9921d18a0dc55179376ab83903e9b197737e6cc00e35371abffe56
SSDEEP 786432:3u+0WVEJrLuVRKbTJbMH0IzR2Ni+Zne04Emp2ubo539L384:3T0RuVRKbTJQH0aR2NlZmRbotN
TLSH
T1DF87339ED14601F2F560A7C63628ED14820395FB72E1A35116BAE47B1CA9C363EDC87F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer