338bbd1498c437d52338ba8a5270bbcbf1c4904cf8bf6f88b0d7a88abaeedd58

resource	yara_rule
static1/unpack001/$PLUGINSDIR/33LAWallPaper.exe	upx

resource
unpack001/$PLUGINSDIR/33LAWallPaper.exe
unpack002/out.upx
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/SkinBtn.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/WndProc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$RESOURCES/Themes/°/Shell/NormalColor/en-US/shellstyle.dll.mui
unpack001/$RESOURCES/Themes/°/Shell/NormalColor/shellstyle.dll
unpack001/$RESOURCES/Themes/°/en-US/°.msstyles.mui
unpack001/$RESOURCES/Themes/°/°.msstyles

resource
338bbd1498c437d52338ba8a5270bbcbf1c4904cf8bf6f88b0d7a88abaeedd58
unpack001/$PLUGINSDIR/processwork.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 338bbd1498c437d52338ba8a5270bbcbf1c4904cf8bf6f88b0d7a88abaeedd58
MD5 4046d2dac86d4efe138b6cea6daecffd
SHA1 233d7fcf8c4948a922a4fb6a73e4314b183ca2d2
SHA512 92437ba5705d38d06fdf479c8bc3fa1f89cf5dbe1bc3fea3423c18f0a7aa4638c2cc08956d8e4acf818b43c62cfbda9b209cc752b63c1c68a3898dfde2711a35
SSDEEP 98304:7mbs55pEdql6u4nrTXr52F8pd6gQScuiG9mKui9ehA2kla:7N5pv+12OMJqe+2kla
TLSH
T19636338532C8C8F1F532A2340D76EABCB6ED8EE9050C9BF21558BB8F9E71950176185F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c2:96:07:a9:22:a4:81:03:f2:cc:ef:4c:5f:76:aa:03:ba:dc:6b:41

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Chains

Jan 17, 2014

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Serial Number

40:a2:33:9c:3d:cb:1e:fe:79:1f:4d:37:bf:5b:7a:2b

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 29, 2012 - Oct 29, 2014

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/1.bmp

SHA256 6dc43bcbd3cda606a947bb74088e1cf8b63da5f68c53acf47c09e63aa1faee31
MD5 1924545004339a7323ae25899e6b506e
SHA1 d851e64532c99da8866644de5bad7182f34274f7
SHA512 0d0821b0b12643b409d617bc13bc87d86e4da5082f8fc09df04b1abea13164bf83407b5c7276b8f3be5b55b1b4f2ee2646b18dd76cd04c144be94c97dd448fef
SSDEEP 6144:4BcwJG77gmmNGN5smfS0vOw38bTTXRMdBIlpfCnA85PYDW:4BcwJG7rNqm602w38bT7iklp4dPT
TLSH
T15AC4396785100016F9326FB63C6A1EE52E3BBF4D674DB6CA0E287DBD5EB30D4A41819C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/2.bmp

SHA256 3760d142e90dd955f9ff165c9404489d6ddfc8b1fb75f3160ed5dc5496ea6fc7
MD5 df54dbbc16032e6330a4ede4b1744e74
SHA1 6b662115a16c2830d6609957d5cce686e9045a8b
SHA512 eaf78f33f03660725a9a89eabe0174695f5aa47675e59e5adcc6cc60cb885b2ca9d70d1f377fa69db117bd6b0fcbb7463391b1922d6627179cec35774c22a812
SSDEEP 6144:50OdG5UtM3dkwXZmLoXMCt1Lk+6rlUaF14dIlpfCnA85PYDW:50OdG5UqXZmUcCtRR6rlTFuulp4dPT
TLSH
T16FC44C7749100026E9056BA63C3A5DE92E3FBF0E6A1DB24F0E207DBE0EF35E5981D159
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/3.bmp

SHA256 a789e5b7d67bdb6789360f11ab8ea2c6a9fedf05602ef485d5734cd24f19ef08
MD5 6b559565349d7ad27e4e5c731ce28b03
SHA1 a0681c0279649ff9072e693ba1280ffa98036ee5
SHA512 f39c13d9538b9cfccab31badbf3139c3e84de9d718f37d446dfc2119e228d7a1be07c8b52101a2e0cd576c59a86a5c0c0cd0c4f481034cccf1d3cc58d0420d37
SSDEEP 6144:UAuGv+hM3dkwXZmLoXMCt1Lk+6rVGL4dIlpfCnA85PYDW:UAuGv+eXZmUcCtRR6rMEulp4dPT
TLSH
T1DDC46E3749100125E90567A2393E5DD52E7FBF0D6ACA724F2E20BEBE0EF35E5A81911C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/33LAWallPaper.exe

SHA256 bdd5abba3ac696f44a2e9e15d2e47df5cb8bf4c9c257dfaf0fe49a626d8cd5b8
MD5 551e678b2635cc23332054e2a1ba5f85
SHA1 eeda38f67f5fcf1184df918fba80d2e0a5ee697a
SHA512 7fa71c0eb9e3feb3a3bba5facec4786cd8e2b46e75f2cb1a67e9aece608670d993a00d387eeccc7f7d24cb78f741b3b9f9abed69b90831ce5b0c26921035b20a
SSDEEP 49152:Xcuy+qGhTXH17IB7VCKGBSb3Komhfeh3YHDPwJxWED:XcuiG9mKui9ehA2k0
TLSH
T1F9B533C9D384C3B4F41D4A78693D67BDDBAC049B4718837254097223668A1B06FFECAB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

232704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 de1a13346a7a01e5510237df43b8f004c925d98da2f01b30177613d687a107ed
MD5 f1df23cde4d90fc37c02dcd88803f52a
SHA1 cf3030ffc25eb9528ff97a3d70f1c511d851432d
SHA512 ef7a0c46ebec6aef82cef0c90a14b118dcc1dafddc919c075b960f8fc9859da777e9d4a84a89a9f0631215de25c4221dacbf6644d810ef2f0bb6bcb0ab68ae40
SSDEEP 3072:pYiTpXEq7ndNiDDdwcwqKSncs4lzBzJ2VIxpPTsdbrS:pYsrnLiDDKTs4l9J2VkTsF
TLSH
T1E9245C497AD4C479D0D38439B0CD2BC381B9CFBC09148DA71280BA6B7EFEBC5AA4955D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

76434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/4.bmp

SHA256 4630b2380292c44365ef210cfe11821fff137fc94739160862c3a40274f85548
MD5 956927f1d95283d7e53e36c4c4d3d75f
SHA1 df1a9cfb02f164f04e73e9a285c33f29ceabcefa
SHA512 55f9726e96d36af68aa4e82f28fb95d730c0b12d93a1532f533b0314b9be71fabacd0f3488e3df62ad55720159b4fee69bd5bf6f56978b835e3cac4733b85f5b
SSDEEP 6144:H0OdG5UtM3dkwXZmLoXMCt1Lk+6r+PxlD4dIlpfCnA85PYDW:H0OdG5UqXZmUcCtRR6r+Jlculp4dPT
TLSH
T13EC45D3749100016E9056BA63C3A5CE92E3FBF0D6A8DB24F2E207DBE0EF35E5981D159
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/5.bmp

SHA256 92be8fc1fc2f0140be73aef2be39001c2d299e341cffe7f369ffcd7e7cd95883
MD5 fe8d2046e04ef00294990fbc55ed2434
SHA1 0085b3b168961be47bba2eb614b2e29464a71d20
SHA512 53c3982eebb4aaa61c44264243e361a378272f7c33e5375b29f4ac104fa5f353ce182943d56f2587b2cd6e3676c16aad8ba11eb89d6a396a4a517703ef2a2164
SSDEEP 6144:aWbI/cGndlaFd1wxqJI5YLk+6ruCpBn0h4dIlpfCnA85PYDW:aZ/cGnRxqJI2R6ruABn0yulp4dPr
TLSH
T1F3C47F3789104115E9065B62387E5DE92E3FBF0D6A8D724F2D24BABE0AF35E5E80D11C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/BrandingURL.dll

IMPHASH 135de77644e2add2fd9dd8176740e7e0
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
TLSH
T13B81203B37F219F3C2314BBB18836ADB7A6E80200365405B547B1A6BB442CA7CD29743
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
MD5 254f13dfd61c5b7d2119eb2550491e1d
SHA1 5083f6804ee3475f3698ab9e68611b0128e22fd6
SHA512 fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
SSDEEP 192:t5ZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRYgsfA:fBo/680dCI5adOjFOg9//p27uNw2bo
TLSH
T101624C15AA2009F6C751127470E73BBE2BB34E72471481C39BE35A5FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SkinBtn.dll

IMPHASH baf2d405231cd43dae48df474a521d01
SHA256 ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
MD5 e4ec95271ff1bcebab49bdfed6817a22
SHA1 2c03e97f4773aea80ecdb98a1482e5896fe4677b
SHA512 771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
SSDEEP 48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
TLSH
T1E691B6BF33C48EF5E056017B1E9319935B9E49715379912F942329866B60DABCA3C703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5021

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/WndProc.dll

IMPHASH b3f659d7637a91b4fec12ff9b930080d
SHA256 e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
MD5 f0cb331dd4bd92a6ebce45e7cd1cf5ef
SHA1 b66ea0c10b08750295f2dc7c170b370402393214
SHA512 7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
TLSH
T1E951207317E005E2F4142BBD285B6BD7633BC27437A5C3DB816A49072A045EBBCB8756
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/close.bmp

SHA256 b8db8f94ebe9da0d454eb5af513df9502bf809cf18a61c4ede340ce9e49b5b68
MD5 791107d66faffd4b593ae55da423aed6
SHA1 50b10c5c1a38914375aefd019ce0cf79a63f64b5
SHA512 061e9891af0fbd46da38e3066c8a9d2dafef22f48da440e1c27c15d0d45ed78e139098f4832047b6a522b819369fe3cbceacbcdc7707a0013bd611a0095b5799
SSDEEP 384:ZtKzP4281MHgsbGKzP4281MHgsbgdWr6MX+HRwd/kEcG4V1iMZnUgREKzP4281MF:CvGDsbTvGDsbDrZXo2crpLRlvGDsb
TLSH
T1276219B3E8C562026052687B2BF2E6F36047266483950C3D8E7CBB1E55753E9FA42C5F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/default.bmp

SHA256 f9f02c665331b3cc4ad0b1c199c25d5aee5076c220f8079ea9e64ba614f38eb7
MD5 32d387e059bf97ddf862fbae9d1b34e0
SHA1 6be2c0175916db96bcd5821de0cc2ccfd2f31045
SHA512 3e9d25e5ab0caa133825d6728a9db20104bb391793b6087e2533483906e5bba06a486dafe60ac063787a859c3e9cd1b4d4a5ab4a5bd809dbcbb432569a7fde2e
TLSH
T13751C648C756C322FC9FAC75F2434D55351180629B25EB7B0512B5B3F5833C28D051EE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/minimize.bmp

SHA256 0dc4b98ca6acd90fdc4336afcfd4caebc250c38b3c674cbb42c0ab9a203b08e1
MD5 aa1f8ca96626028946be3db5a8e4be9e
SHA1 f1b35647afeebf1a0b2b79e06be2ba703ccc2c1e
SHA512 fd0b33fae72c0cec83b7429ec8fd354b41671d5dc7a942fd2b5a46238d534a3fc826c227e4e5ab86c8f7527c2ecdb05efea24b9b2d1fc9ab584977d823a1bd02
SSDEEP 192:6KUisO6HSfwXteTRM7hMPQjBYRlwX4e6KM7hebja5iX/pxKLJp1MHhqfDG7kYvFJ:6KnKHS7RMwGYRLKMea5im97M+D7YvPjb
TLSH
T1C0321A539022B5BA083AD6A3359E6BD78D0D1DBD51FA19C4EE8ABD0D00F34E5F221C6D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 3d0060c5c9400a487dbefe4ac132dd96b07d3a4ba3badab46a7410a667c93457
MD5 ab73c0c2a23f913eabdc4cb24b75cbad
SHA1 6569d2863d54c88dcf57c843fc310f6d9571a41e
SHA512 99d287b5152944f64edc7ce8f3ebcd294699e54a5b42ac7a88e27dff8a68278a5429f4d299802ee7ddbe290f1e3b6a372a5f3bb4ecb1a3c32e384bca3ccdb2b8
SSDEEP 96:EBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4MndY7ndS27gA:E6n+0SAfRE+/8ZYxldqn420
TLSH
T19012F9675A4041B3E9A3223D306A2E3F877C9325D0927C03C677AE562BF031A7D3A394
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/onekey2.bmp

SHA256 4c3d4948bcc3673772458a3dde671fb1e6e8b46e1f0123bb9f9c1d600e0fa2fd
MD5 63a057c8e2f1e9663812650042d4624e
SHA1 2f93a7377f11601295406410b236c8fc93351b5c
SHA512 55ffb5f24bbc97dcc9e8d9bae91cf7e17ef777e5eed7d215553374e3778f7cceb1135bbcb8ec09699991bfa15ae3cbe3498f8b3875c20f9604a9e18f1ddc4194
SSDEEP 192:NCIVLp1PHHGeQiIMfffffnGBBBIOlTwaQg/YMFp1PHHGeQiIMfffffM:NCMp1PHHGeQiIbUBTMFp1PHHGeQiIZ
TLSH
T185235D61571AEF07D3C65D7C883CFAD8298E2446DEE3F8A0596EE83D743F095241B20A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/processwork.dll

SHA256 635870051d2d0dbfaf6e6cefd7c75ffb014ec17f2b35bdd54cdbd5ae5cc6e34c
MD5 184b8f6eabfacfdf15d73ce1c43b5d82
SHA1 146d0fa40647c32da52cff2fb75d0ead09e74bb7
SHA512 d3acc06d642e0f02b03a2b3e9b8bc96707afa1ae331d66834785a017763727baa086b5adb679526357a55712609780c42d565c3496c24834665f7623005a972e
SSDEEP 3072:9/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzs:N94yj9c55CDorNqot43ndqQpzjIKWZ
TLSH
T196344B36E1C0CC76D5672B7CCC49E3D8556EBA302E2898867BE91E8C9B7D391351C287
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

05:cb:43:b4:ac:e4:98:33:80:6b:d6:e3:ab:3a:1e:fe:6a:5d:e5:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Chains

Jan 5, 2014

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=梅州市永航网络科技有限公司,O=梅州市永航网络科技有限公司,L=meizhou,ST=guangdong,C=CN

Serial Number

40:a2:33:9c:3d:cb:1e:fe:79:1f:4d:37:bf:5b:7a:2b

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 29, 2012 - Oct 29, 2014

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Minor OS version

0

Major OS version

4

Entry point

208948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

200KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

147B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

47B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$RESOURCES/Themes/°.theme

SHA256 e9c4d4a29b5fc12c64ac062d819a890c35a449cf3f70cf0858bf88e25aa05a69
MD5 20349507031f93efa6af35b1ddbcf253
SHA1 9eee856c605e11ec64febf6a22ae5061db5c39d4
SHA512 e062e98d8bf51bbb4e44e8dd5d909d04b8493323eb2029a21dcb87c3b21e8637a17b2b7be5b7ec76d37bd5300d3f30fdeec62e03912ee7c3882ad39dd68d3a08
TLSH
T147415AA1FA0DC526E5A11119A284F40FE15CB33CDA79FA04ACD01939FBD668573BAC74
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$RESOURCES/Themes/°/Shell/NormalColor/en-US/shellstyle.dll.mui

SHA256 a38bcfda2b5ce1d8186ec845675ceddefc887e9c2905e2bf339a3b7d7831835f
MD5 2dc89df65dc20224e2c53d1d9d86141c
SHA1 23bf88f8b3cd94fc1e50dc4437f9e8a054b83e61
SHA512 a6ccc7c74c1614e3b6659aec02980b361433434b819c85584c3ddba487ba1e0436f041f8a0e8ecd600b88e407e50e43f147c4546929877d2eed45ce80cb4e577
SSDEEP 1536:aXXo21vTvg1K896wMe2CnFyCdKPFpeDDD9g+ZZC4JGo:aX5cKgwe26sC4+S4f
TLSH
T1FCC3BF8DA441056AD00F0B7B2D6BDD02862BFA8453996F0CEEFD424F9A34E117C7676B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$RESOURCES/Themes/°/Shell/NormalColor/shellstyle.dll

SHA256 e674efd4d607ab3be565221a2e9b713dc349b7fb118685230e82c8d4de9f0add
MD5 181f47ef986b538abd84368e7a8dff69
SHA1 73a165c872250f1ce4e9b41d11b9e7c0b8107dae
SHA512 fcf0021b9be88cb0cefde9629d2a22910dcc9bd5fd9b20e553f8e8048c49cb52da7b3d47f8b70cd59cac8e77adad7f154bb61085c97ceb5f26d2b3fa60ad8271
SSDEEP 6144:V9EKEHEWEYErEVEXEJT3TbTZ/cb9cChIJ:i/cb9cV
TLSH
T142745F91B3439D17F79CC0B8A0F08B33C9B838B7B3578DA528A971A9F7A41781B55943
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$RESOURCES/Themes/°/cursor/AppStarting.ani

SHA256 04387da40dfa4c0cefc550f4ac47a6ae595defd925a8a106a55ebb7506b2f251
MD5 16a9f4d1586626e5faba62ba00441a5e
SHA1 bc29ef8f2a5f3505faf7b89929fd4dffec7fce36
SHA512 4d8224afd08d931f24d00eea274fb68f4c8079312a9932298d80e424823bba4ee0106c8c64d7ae2c917bf965b4a190c6b32aee4551888697322b2300be0d25c0
SSDEEP 768:zqUnYzpwkH3587IRRdcdx5iPzxJmiZYlkkn:zqvlwkX587I6dx5i7PJZokkn
TLSH
T163735279E7260179C906133BC9B947C633719C08D46E6EE3752938623DBA6E87C4D8BC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/Arrow.cur

SHA256 de43c48a77ca98ecb82371d86c83318a5575da58006e9b437abc9910368a3ed2
MD5 74ee4d839b87f8c07e4a00d9356a2f2c
SHA1 77f9679a4f548ad8b5123a00c01fefe4bbb42540
SHA512 03d507a2f599d27dbdb9d39b6aaa0652a8e7cc730b8ac6d39bfce9d31dcb5c18b425b06c4c9b99c8d09433890e5ec623ad10afa0e844a045a95f2cdd3d60d957
SSDEEP 24:zu1LsrglmtQevZYde5ZJb63T1ZQFXsGA6rVP:ILsrgllCb6pmceP
TLSH
T1519112ABD6891B06C42155B3DA91234813784C80BE1B0F775ED87C5239B67E2BF090D4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/Crosshair.cur

SHA256 14c3aa66ad38eac34835b70040461dccb02d759486df4d6a43547ac4c7ea8890
MD5 d6ac8b7a88152367d0f4e6566792bed6
SHA1 0bbe44f38ef0a63fd3c505e2bf605c49550ffa85
SHA512 4ccc302e719d0a8ec800456d4fb79260667265257346290f78ac2fd357c5ea5680e36d90972cf84dc51eacd78bc2aa25e0c7d5660359a2261969fa33643aa7fb
SSDEEP 12:y/+9K+AKKCVcpAaXEnv8k1chEbqvMnPl6pViXjii1B:79KuKCVYAAyVwvcj11B
TLSH
T10A9159D2BE80018FD00046B1A48C2557E7E84C41D0E234E33BF57D0CF4B4668D4116C8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/Hand.cur

SHA256 8b6a3b91da5f7f206773c412afeef4b1a6f01b164702cfe28f1b6a35f135282d
MD5 18c2e2250039b8f726f3041f7bf51edb
SHA1 1b8681b98936f18088acde6ec6084236faf0b326
SHA512 ad42505f7d4f89e50a66f063fcf413a2d7ae9b0e4b8c0c84e8be4e9e2c31a4e9861be7b5dcaf2401694d1341bb6ec149cf89f6f2acffc4239350b6812c33e8b0
SSDEEP 24:dnlR2d04YtmB1vGT7P3wUSFa7lZNsNm2TSYlohc/CCjcuYcOGixlwQwK:n/toVGH3CFa7liSyzfY4wwK
TLSH
T1CB91AA92672D6D3DC8490B3F826B87042338CD41E8874B5B3695B8BB7EBD5905C8A1BC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/Help.cur

SHA256 27cac7c845927fb56bbea7b3cf368dd2dbd0f88e4869d8df2fecae0967a99e0d
MD5 6510a3b2b630758118f2668def54e079
SHA1 a3aa2acbb37737cdab12950f3e50f156e74659c5
SHA512 9c90d63896b1a2ea95169a38ad041c59c4373e694ab9ebebc58c347f00c50f6a8a6e5d130ba6a8f4473a6eae5b9e52eadbc9d894fd3b17967a01d08c20694cc6
SSDEEP 24:zMq6rp0zcRw1UELJAMKZY7T1rAqN2Y+yFByfpXeyLNwDpqBzn8yvOuTA4kFcGyA:wquEcRw1U5MpS7YNFBMNLNmpqBHWuTAd
TLSH
T1B2912F35F2681B50C6D029709CABC3B8A6644DC4DCB20B4219E83CA7B97F7907419CBD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/IBeam.cur

SHA256 827b6df9db80a5388a4c6cba34bc50783066c5e26ab212cf77af715d759918f3
MD5 0c9ba82e0f67727aac4eda4eb664d843
SHA1 eed87da14a89cf2152674b3ae6d4f973f47b6b50
SHA512 394d020f53b2fbf92d99f6f21a9c5fb7d032196104a764a9d8fc04293cf2c125b8be39bc72917e575a056d8d3472222f29de2d886fcf46d40a016f5da4dc9490
SSDEEP 24:sT66YlqarY6NtzfwfjHG6F6raILTC2SYa:VZltzIfjHaaILTC5Ya
TLSH
T17991B14AAB535F9AC9130BB1C4EB8A8077319C15DE530F0762287DA5F8F72C1692519D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/NWPen.cur

SHA256 893a91c24d806f40406d2eca5bce10f9c98a97041ae1c0faa0ec5fc74f50292f
MD5 01881e014b1a8487b4f1ebc10fa0a952
SHA1 83b6515344452dd0516124d74fe84f24629c518a
SHA512 b7847d21ba7b9c4ac3e2f792cdc48aad3d07c2c32d49f6225445adc7ed38cd741450ee6c2a4c1d0d94ad9282efa6c144930c2c21f22156624d8ebc4e9a4c80c2
SSDEEP 24:LqA20lID+yobofBWEnqCXvtZmQdodGnxL/fLUnGCZZ:2McSbofBpnqCXvjVKMnx3g1Z
TLSH
T1EC918B70E342F660C81A0AF641D7C3887356DDA8D20A239B04A6B94D7E72B6F6C478B4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/No.cur

SHA256 c199fe2dae1717731345faeb9824899889bfaa7475d0cb85bbcc184605f9f2dc
MD5 a2b50c1cc62e7708a5ff8448ca43a553
SHA1 34712aec7e2a1adf9870a272e23b4058951b3f7c
SHA512 52713fdafc145dcf4a01f8abc9bce5fc527858eeb64f943d8cd74bf18443eddba0839b7423fc9c3bbbbc4407d926edc9e1b4540a0d8517f968bcc6477896bc15
SSDEEP 48:jlynQ8bGJW7arG2b//LuJx3JxIDI/jxFTSQqKKrnMM:jiQ8bGP627Q3rjFM
TLSH
T1DF91B8A6970C9F41F9009870C29D83BC26284F005DA71A421874FDEB7D35B466D2A5ED
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/SizeAll.cur

SHA256 8f97aee8a97b4a836169d110876b46dc61e99b0b30dac9bdf5926347dcfc82d8
MD5 4d6d9f047deb3e8e9faf30b68b6f6dcb
SHA1 45b846d1d6438e0afae2032907c603bc28d2470c
SHA512 387dc52e36d81104094b409ba4e194286cb9c043c53664bc9e318d099ad731a2096bb6621ee8d1f77c7ceb1bfdfd74c2a7a542421975fca52a2d4ef3a247fd21
SSDEEP 48:Arl6ExtfeEky0AOVJ00lGzvTFYOR+2mtGrr/:ArxkEkrV5GzZYzGrD
TLSH
T1FE91A52EDF6D480BC94C9BB8407929A433704D8BA801E7673E2874F37D1EA702E1456A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/SizeNESW.cur

SHA256 d43d2a4148c095bdddfaaa428a8e06c9ac133a08b55444e831994295979cb952
MD5 9f7d7fe15d7a517c3dc1c71b410024f5
SHA1 bd909855efcff0519b4c61413d9744a847c4ba4a
SHA512 161a9b05353cb2e86edd9a96d7cd8316b6c498972eb8f844713544a91feadec29e8f2b848ff1e823201a268b7a0de339582e8d0010c64fca03ebaa749c0830a2
SSDEEP 12:y/yl2Xzf/2CJGdmTnknIITdKyD3iNQi/Xlt3KTxVAug9ioS:ZYXzH2CJymThkkUyNllV7b0oS
TLSH
T15E91DCCE2B249003C4080A7FF560C6E4E0F41F89FAB20FC3A6783D1439B0242E806018
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/SizeNS.cur

SHA256 790285e51d400e86bb924aa35882546250421bcbb58eebdd5a5d0775a98f5dd0
MD5 3f0ac7c4362c4a04fb93718840963946
SHA1 d1b16a6660f52be02079acdde649d7b4c7a0e55d
SHA512 9b00be38f07e6cd64c11d8e3e983b5c869212883e2eb48136862c9e5a7a669cbfb7b463ad468800c18833086dd553b998db7bf3a7f5ea22253a6aaf16e62efc5
SSDEEP 12:y/PpewEm1gaUyOoV2YY3srtkDf5edLQPxeP22yXqcdTLXS0:ipvE9X/VYhtkDf5eGPxeP229cdvi0
TLSH
T1149183D5F748714BEC444F7AD429201A37281E01DAB2E28B401E3E23B6372D06D8F857
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/SizeNWSE.cur

SHA256 056b6cc81545527259cdd4e0db88ec7114d96109928a23e3aca3188e98426769
MD5 0549e2b405dedc5e7e68e9a29e086825
SHA1 0dda4cbe009d13e226693a842b1471dc6488eb21
SHA512 e4a24068099389a38b22f909c2cb6abf60851cab6e5f1d374b8166836535d091adcd460d42db82e022cc57e1609c7b1170cfbbb7fae926c0b436d157db10dc7c
SSDEEP 24:ZY0cNtdNfRvwO3s//sLCxnf7KbKGX789b5d4:81vwO3sz7KOGrObE
TLSH
T16B911088BBA16C07C418ACB6E582C691D6F84F8EEEB60A0313787D4B7671AD1AC14000
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/SizeWE.cur

SHA256 7965511b8add2fa0ed0d860db324aca19393af8e2aef9931b9a045c4c697c302
MD5 4f939e6e4b2218815ea81ecf6599a557
SHA1 6cb86db2c481ba33d2f9a93c7b5850d597188280
SHA512 a5feb864d8188f2a75a94340ec6f95cf55a7af76fd95addf1e31c326e242cd56ec4a587c557916831488c543f51424835aa4a009de4a2c9ea77aa4ad0cf228a0
SSDEEP 12:y/u2UqjEHFVhLvosEb8+r3+jBr0+pqVFwWStu6EtlcwI1Od7klJkEs/N:qUqjSDhjosyTr3AR0+i526cR1CklCEMN
TLSH
T18791F4FCA34E085ADD8D0DF054C0A94A5F3C5E109122561FD52DF8743C775C63D029C5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/UpArrow.cur

SHA256 967015d5078adf1ff9c5d5a0c1db68c25b969f0f13f04bc2079318fb2ec31d6f
MD5 2f0b917544377c10f7709d001464899b
SHA1 dcafab72b222b6403ca56d13290396420b481079
SHA512 f1382295ff2e07dd2cb5be09a1c5347bb0a8f0dcd2f8eac03cc306b4e868b57f428d4a1375cd05872b7cdd1c11469d25b153c06b7a0679af5370568b6723217a
SSDEEP 12:y/F3nagtCklllllllmnljfvEM1ZPja8QbEuLTvwQCCfksI:M3n95lllllllQlbXr+8nuLTvwQCukr
TLSH
T16391719BB381155FC9990BB643E60BA437248C982B87811B11E6BFB7FD716402D0711C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/cursor/Wait.ani

SHA256 5be504e9cda982ce8f6c67b3388e7df8e8579022241d496db31c230e7c612e8a
MD5 9a992cb13609c97dca0f9bfafe2e4de9
SHA1 b00202fd025140049cfee56b012ed18eee2839c1
SHA512 cce3a3af01ffb50c33aea0d8620ffb6bea83dede86879d617b48b9c759f8ed6f3fef7d58b584feaa8087c750d06e01702d7c4a57fd1ecd568a1aff088ce72c7b
SSDEEP 384:JEEFIiDXzHJr7dOLecjva9Uv8JVAm6e/s:PFIiDDHJrhQecjvWzDA1Us
TLSH
T19A732A76F718E5AFC80F4B37806802D932398CDD656BBA533635BC697EBEB146C05880
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/en-US/°.msstyles.mui

SHA256 b879b3a8662e8f50809e6d1488fb97504ee896f146bd7c12c05968a3ee4df71b
MD5 01e1a7d92b2c6826f8fe5d9dae1cd207
SHA1 33686039fc7dcb015b6fef57fe0b37114aa07c9e
SHA512 ecd10ffe9e2e2dc946b66434d75dc81b516d4202b30a03f4e3ef0aafeecef38082852cc0fb7e60773dc5237aeaf52d15c6490064ba803f018e88b63cdac5ef5a
TLSH
T1A6816B11E3F91664F0F25A786EF64623A1BAF8269B3CD64E0580171C3C70240D823B6F
MD5 SHA1 SHA512 TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

6

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

$RESOURCES/Themes/°/ico/1.ico

SHA256 310da79ae50628a6134faff553e8b9413fb8efca07de5cc84f3b7b53f5601596
MD5 639c3568434a79a61c02ad350d46dfbd
SHA1 42cc10febfd90eb1d76bb741f3bdbcd7a76a8c45
SHA512 8bb27e986bef9bc2a5dc8490e09b43ff24ca7d5049d59c3078d173f59b245a16e09651218ea393c446c13dfb44e4e8a339230fcfdcbb656cab3b0cd25a9e8d06
SSDEEP 192:jZD3pNWhK1zQ+yev5hgdmerw2YwZFGtV3GZix6x2LtRGXAR:jZbpd1zQO5xBwZUtgg6x2LtgXAR
TLSH
T15562E76A1F46DC62F6A051F4E412EB3D9BB8BC52153EDA02B5F00C2BFC9C7A65C69003
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/ico/2.ico

SHA256 c0193385aa438f57a18664d5c8aa1e9d5b29c5dc87a9eb289d0740bef0298bfe
MD5 6faf1ac7fa3ab5431bd8c3b07abd1139
SHA1 7df6f471eaa463f901b43a0d328aaf1dba4503ac
SHA512 ebb173f09f90a7e703b4de640279b2cb89b9b913f003edcfebd7c1a871a156a7be9e4c58985846062a5ffa2fdbc9194f000248c0a954e238729ca783a268abfe
SSDEEP 192:j97Fqc1OojjZ/O6RPV3eJNpulvHk95jqQ6:jNFqcbnZ/1eFutU5jqD
TLSH
T1E56293962F48D922EAE431B5AF16D37D0F10EC4F551A5743A9F43C2FF0EC8A3642A612
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/ico/3.ico

SHA256 e26ef3a88ac53d49fd6312b0a3e9a77428d582458f6a8c02a1e323ffc0db234a
MD5 5052f278f69a2e816526ed0a44687c5b
SHA1 8fc2b8fc3c170e528d06a48a27f3e571a480a0f4
SHA512 a1d7df0b8640c8a49e7ed9256039654f51b8737622e28248b7cb5755f60692d50d0c90a42797536afa75b85a9e89bd6a058c4629945373b2a8b39218a12bf243
SSDEEP 384:jGd1+47tmfeJprAQK3uq9uAAAAAAAAwla0EC3Wo7F:vfeJprA59FlaaF
TLSH
T123629EAC2F242508C2821871F593978977BEDC526D4A023346DA3BDB7F766A1D9052FC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/ico/4.ico

SHA256 347e55302229b0f424c70b4b22c780d3eef775bcd06de0e38a61be1a0dd35ee0
MD5 ea2c865bc7e68bba81a50199d2866c61
SHA1 6ad38cba69d704c6f2acd8548d7b84f6a56ebe39
SHA512 5d807d7eaaf9bebe3cacad65cf4b0bbe258c20f3dae112504e9390ef40d475cbe4b619581a60004b92f687631f8ea95a30171a4a9f80231cc89981789efeb7be
SSDEEP 96:jYacGcHh8Tg5A46PJW9D04j9Qp5WgSpjIdKHqptLTyOPU79R/:jY7h8T66PkQp5Wgcj6Qq/TXPUxR/
TLSH
T16562F8279B9FAC62D0D420F5E3D1D8EF9F309D085AE61F0228E43EAB774C6B1655609C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/ico/5.ico

SHA256 1472e5d29880f7f8dc198b8899b5f11c43e5ded100c6f23a2e67ca020f9f277d
MD5 91f82160786965304eb45016118aa9ff
SHA1 91e064e4eaac36c62afec8cf0dc238556a28d7c3
SHA512 2cd2173adaf5bbf25e56264cfa0b9c7be9257697d5186d5ef3d84010f501c87ad7f642003847bd88a35fd52be9f79d0c2410a7ceb1c5a77f337c69f7c94143a9
SSDEEP 96:j+9q999kGtTJofSAxtLh+6vfVatMwWepJGGSOuRhBTOv2S8ZnzTMKGvUQe+/:jTty/FFvfXCCRhNO+VnzTMKGcQe+/
TLSH
T11D621B8B5389D311EB8077B8D9E5D4DA3D3A9E1509FA44924CD02DEF7EAC331082517C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/°.jpg

SHA256 b2bf8b1d872048c43449d97d8637f3d6f5e22f5ad5f74127e5ad9c772588501b
MD5 63f721a8194739de4047c5d6e1279bfb
SHA1 d21e8a358de8a52e8e11c313b0d3b14892ae7b1b
SHA512 ef5c5ce25bc7ef679985f4a6efe977fe5d8e9ab75a1fec10d8f75df33e443d85b7a6df74c30f1f57c2466ddd0dcef8bf0f10371e66937d4f578087777731d2cd
SSDEEP 12288:h+EDO4QUQS8hSW+EkWf2MeZIW8okCEDuy8v2N/zba9NRQ3QWg25:IEDzQPhUEkQeZfHy8v2eR1T25
TLSH
T15EE4CD6628A712EEA79DC25F92D9FCCF718E735BEC608739A343A5C7105106E2DC910E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$RESOURCES/Themes/°/°.msstyles

SHA256 a0e1defab382361d8f7d3634fcd6ebdac628c744058668ecfdf23bca2eb4c10f
MD5 e3861a94f45c8effe68ce32fc57aee81
SHA1 9d3ee11397f8176bbf73551d64bb27942f42f35b
SHA512 a8bb5e6ee400154efebd5a0cff25a9ebba86c340ae3f0f230820f68db7f32e2e274267b7950a72a18df5ed9d8a06f0eb15cbf76d1b8073dd23da860dab743894
SSDEEP 49152:x1DoDpDpDYHD/WPgTFOWPgTFxWPgTF6Qa1DJM:zEFFIDPUP7PAJJM
TLSH
T10ED5F1D7E784387DC58A0B3F40672A40B6B7E84B3B535B0B6E59E81E2D253C8D991B43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$WINDIR/33la.ico

SHA256 1031912434bbfaeb0474150a57c76b66447c30d4361ebf658a1fc3d3a163cfdb
MD5 2d30387abe7e1d45ac654ad9e6361891
SHA1 9379fdb79894b76ffa65d6d28979d00cad551ca0
SHA512 afcf548d969bdb141ce9de9fcc5b892ef95dd516eb83a31ada4fed87b03fcac8a7d2c92d29eed1c356a00a6bd7fb564b969f22b5c057ef9770d7ed79d8f589d3
SSDEEP 96:9mjzx/xa5br3E1FbHD0t5SJd+fnkVbrk4pSG9FeWtEkEfUqpuOSdZ9+:TRr3EnD5+0btpD6oEIO6Z9+
TLSH
T1351208417640753EE9968A30E0F274A10FFACF62459BBDDD1008BDD6A7329BA8F5141F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninst.exe.nsis

SHA256 ab9d60a366514d6314bc1b7abf5633cf08b6619b107f8cd2f608fe28fc7f618b
MD5 8dd2d93cc0236e2cec397b996213e8b5
SHA1 c132883b144e32cbf61dee1e55ebda8aa99ca81c
SHA512 b58a2424dee800721a3d0f9e20587889f3e8765ac078925841cbebef0edc14c5cf2d8a01ea02b2a437776ce9d10b01dd08092a42e4972e6fd5832185b967c70e
SSDEEP 192:wS1QUPQAzS0pbMYfb7zg2o7+GMRRBN285I2ui1g0G3+CoeC:EUHzsYbvPGy9qxi1g00+H
TLSH
T11CF1BFBFC6642638854DEF105466347416AAA7892D0F2C444A73EA5DFC2C337144AAAD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer