VOS3000V2[.]1[.]6[.]0[.]exe

resource
VOS3000V2.1.6.0.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/V2.1.6.0/bin/vos3000client.exe
unpack001/uninst.exe
unpack002/$PLUGINSDIR/LangDLL.dll

resource
unpack001/$TEMP/jre-7u5-windows-i586.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

VOS3000V2.1.6.0.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 4e647b04241b944d165a971e526820de139da3f21539cd656e37dfced9c933c2
MD5 ec654d9b6e874a90887147167e92ccd5
SHA1 ce753875de014b7f1a34ae3de915c83425bba92f
SHA512 22ac7e0a9980d8d270c59ff6b9ccb30463a414ac1a7ac336ca499f9f9efe56914bbe57f132ac01519302413b4b1ea6874082935c46cc1111f5e74a4153fc32c9
SSDEEP 786432:mAk9hHAusBb24vLOgjNA1TICaCF76RI7IxbKSn2JErDynlUGfU3XL6Fm+:m3+3bxTvjrCB6RcvSeErAIb6X
TLSH
T153A733CD0C14AC7FF773687571DB3ED2441646401A9689C1F6A28B9F8520CF3AAABD78
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
MD5 8d5a5529462a9ba1ac068ee0502578c7
SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
TLSH
T134622A55738488F3DBE2003E785237079B995565B492AED2CE275FCA687B08D7EB2303
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008
MD5 77ff758c10c66937de6d86c388aa431c
SHA1 14bd5628eaf8a12b55cd38f9560c839cb21ce77a
SHA512 319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda
SSDEEP 48:im18EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J0of5dwe:F12pl9NLBAZuYtR0rd
TLSH
T197C18537A3C106F5E6944233265363C35713A9707766804FCB6712BA1A208B7ED6EB83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$TEMP/jre-7u5-windows-i586.exe

IMPHASH fad9fb2c90d2c700ae8e1bc2780e8c81
SHA256 9a0eb162c6ae2b7b191fb5402985b8ffa53132774c33b78967edc47d245e9a0c
MD5 528e15cdb4fa3f9d9bb26c7e2de476cb
SHA1 504d94c7cc1617b44af8d81de6fd83120b04dfa5
SHA512 8fcf03fa1e0cdb6a27949c97b41063233e47fe3ca7a394fd5db3a87ddfb33ef67dd0679b72357422ad4beb328a69c4f5ff4aefcdd352907980f43ee294693ba8
SSDEEP 393216:uK9j2ZaQ4A+VfDpRr4lnk+SD9THvY8LACOxidr/47R8gRe5Le6e:uK9KZj4A0Knk+SD1P9lInGLbe
TLSH
T153272211F680B132E46607354DB6DB59427BBEA46B3161CB32C973AA9FF13C31935AC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

21:04:d7:a9:b5:2c:4c:e0:3f:ee:42:bd:86:e8:8e:aa:75:fa:00:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Oracle America\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Chains

Jun 27, 2012

CN=Oracle America\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=Oracle America\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Serial Number

5e:f1:dc:1e:fb:1e:46:b5:de:80:ed:e1:76:2a:55:a7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2010 - Jul 6, 2013

Minor OS version

1

Major OS version

5

Entry point

96384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ord17

kernel32

GetCommandLineA GetThreadLocale GetVersionExA LoadLibraryA GetSystemDirectoryA SetDllDirectoryA GetShortPathNameA GetWindowsDirectoryA GetEnvironmentVariableA ReadFile CreateEventA GetNativeSystemInfo SetFilePointer GetTempPathA GetTickCount GetCurrentProcessId GetUserDefaultUILanguage ExitProcess LocalFree LocalAlloc FormatMessageA TerminateProcess OpenProcess GetFileAttributesA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA GetFileSize MoveFileExA Process32Next Process32First CreateToolhelp32Snapshot GetLocaleInfoA InterlockedExchange ResetEvent CreateThread SetEnvironmentVariableA CompareStringW CreateFileW FlushFileBuffers WriteConsoleW SetStdHandle LCMapStringW GetConsoleMode GetConsoleCP QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetTimeZoneInformation GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo Sleep LoadLibraryW HeapSize HeapReAlloc TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleFileNameW GetStdHandle HeapCreate GetStartupInfoW HeapSetInformation GetSystemTimeAsFileTime EncodePointer DecodePointer RtlUnwind VirtualQuery GetSystemInfo GetModuleHandleW VirtualProtect InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange MultiByteToWideChar RaiseException EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceW GetProcAddress GetModuleHandleA WaitForSingleObject FlushInstructionCache GetCurrentProcess GlobalAlloc lstrcpynA CreateDirectoryA GlobalHandle GlobalFree LoadLibraryExA FreeLibrary SetLastError GlobalLock GlobalUnlock GetModuleFileNameA MulDiv IsDBCSLeadByte GetCurrentThreadId InterlockedDecrement InterlockedIncrement lstrlenW WideCharToMultiByte DeleteFileA CreateProcessA GetExitCodeProcess lstrlenA lstrcatA CreateFileA WriteFile CloseHandle lstrcmpA lstrcpyA lstrcmpiA FindResourceA

user32

SetForegroundWindow SetCursor PtInRect GetWindowRect GetCursorPos IsDlgButtonChecked EndDialog DispatchMessageA DispatchMessageW TranslateMessage GetMessageA GetMessageW IsWindowUnicode MsgWaitForMultipleObjectsEx SetWindowLongA GetWindowLongA DestroyWindow wsprintfA LoadStringA CharNextA ShowWindow LoadBitmapA GetDlgCtrlID SetWindowContextHelpId MapDialogRect IsWindowVisible GetSystemMenu LoadImageA EnableMenuItem PeekMessageA DefWindowProcA GetSysColor MoveWindow SetWindowPos GetClientRect ClientToScreen ScreenToClient GetDC ReleaseDC InvalidateRect InvalidateRgn RedrawWindow SetCapture IsChild GetParent GetDlgItem GetClassNameA ReleaseCapture FillRect CallWindowProcA EndPaint BeginPaint DestroyAcceleratorTable SetFocus GetWindow UnregisterClassA GetFocus GetDesktopWindow SendMessageA IsWindow GetClassInfoExA LoadCursorA RegisterClassExA CreateWindowExA CreateAcceleratorTableA SetWindowTextA GetWindowTextA CheckDlgButton EnableWindow EnumWindows GetWindowThreadProcessId PostMessageA MessageBoxA GetActiveWindow CreateDialogIndirectParamA DialogBoxIndirectParamA RegisterWindowMessageA GetWindowTextLengthA

gdi32

CreateDIBSection SetDIBColorTable SetBkMode StretchBlt SetTextColor SaveDC SetGraphicsMode ModifyWorldTransform SetViewportOrgEx SetWindowOrgEx DPtoLP CreateFontIndirectA RestoreDC GetStockObject GetObjectA CreateSolidBrush BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteObject DeleteDC GetDeviceCaps

advapi32

CryptGetHashParam RegCloseKey RegOpenCurrentUser RegQueryInfoKeyA RegOpenKeyA CryptAcquireContextA CryptCreateHash CryptReleaseContext CryptHashData RegOpenKeyExA CryptDestroyHash RegEnumKeyA RegEnumKeyExA RegQueryInfoKeyW RegSetValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryValueExA

shell32

SHGetFolderPathA SHGetFolderLocation SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA

ole32

CoTaskMemAlloc OleUninitialize OleInitialize CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning StringFromGUID2 CoTaskMemFree CoCreateInstance CoTaskMemRealloc

oleaut32

LoadRegTypeLi OleCreateFontIndirect VariantClear VariantInit VarUI4FromStr SysAllocString SysFreeString SysAllocStringLen SysStringLen LoadTypeLi

urlmon

URLDownloadToFileA

version

GetFileVersionInfoA VerQueryValueA

wininet

InternetCloseHandle InternetReadFile HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetCrackUrlA InternetOpenA InternetErrorDlg InternetConnectA

gdiplus

GdipDeleteGraphics GdipGetImagePixelFormat GdipFree GdipDisposeImage GdipGetImageWidth GdipGetImageHeight GdipGetImagePaletteSize GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipBitmapLockBits GdipBitmapUnlockBits GdiplusStartup GdiplusShutdown GdipGetImageGraphicsContext GdipDrawImageI GdipCloneImage GdipAlloc GdipGetImagePalette

V2.1.6.0/bin/vos3000client.config

SHA256 c0f1a0562cdf1497520e8a9a4f70034c2fef333981e51dc06debe7b4054b4d9e
MD5 7bbf34e80adfe6f878582c3665efdfe0
SHA1 eb3bdb6b2522d487c6a92ebb14653f40b4c0d9ca
SHA512 3b115b807807326f45ecc09ea34bf2b5b8c1cc9e3e12030958c73ec01a9932a504289ca8f08e97d04a52f190813506e3162ee67321544ffdb824b62576faa08a
MD5 SHA1 SHA512

NSIS installer

installer

V2.1.6.0/bin/vos3000client.exe

IMPHASH f341d49419d1563992c18e6af5fefe18
SHA256 ff2d5a444b4d2c842661d1d22b7a8aee51ee1e9e6770f2a27956390e187485c0
MD5 f780ae02a973132f4f5a44c2d89820df
SHA1 39d07afa8554f6a2a97ffd704fe32bb46b55de09
SHA512 2e1935db4b6e005544427463eda33ad868d1f9eccccee49543df8a82f59fb163378e7963b3a9407d63055315c8f4c259a539dd2d41644ee446aaab925f761bee
SSDEEP 786432:+N1BG+lK0Pw2BtLUMIQpSHV8EzzAz3+EHYgTBcYNs:GKYzBtLHIISHWEAz3vHJTBxs
TLSH
T129571239E68C3C11E433717181E2185638BD9868F3F656626ABCB6A7DE32C095F73B14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

109616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetCurrentDirectoryA lstrlenA CloseHandle GetExitCodeThread SetThreadPriority GetCurrentThread SetEvent Sleep CreateEventA ReadFile GetFileSize CreateFileA GetCurrentDirectoryA UnmapViewOfFile MapViewOfFile CreateFileMappingA GetVersionExA GetCurrentProcess SetStdHandle SetFilePointer CreateProcessA DuplicateHandle CreatePipe GetStdHandle WriteFile GetExitCodeProcess OpenProcess WaitForMultipleObjects PulseEvent GetCommandLineA GetVersion ExitProcess HeapFree HeapReAlloc HeapAlloc RtlUnwind InterlockedDecrement InterlockedIncrement MultiByteToWideChar WideCharToMultiByte TerminateProcess SetConsoleCtrlHandler GetTimeZoneInformation GetSystemTime GetLocalTime CreateThread GetCurrentThreadId TlsSetValue TlsGetValue ExitThread RaiseException ResumeThread FindFirstFileA FindNextFileA FindClose FileTimeToSystemTime GetProcAddress GetFileType UnhandledExceptionFilter FreeEnvironmentStringsA GetFullPathNameA GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStartupInfoA TlsAlloc SetLastError GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr HeapSize LCMapStringA LCMapStringW GetCPInfo IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID SetUnhandledExceptionFilter GetACP GetOEMCP IsBadReadPtr IsBadCodePtr GetStringTypeA GetStringTypeW CompareStringA CompareStringW SetEnvironmentVariableA FlushFileBuffers GetLocaleInfoW SetEndOfFile SetEnvironmentVariableW SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime GetCurrentProcessId MoveFileA DeleteFileA SetVolumeLabelA GetDriveTypeA GetFileAttributesA SetFileAttributesA GetDiskFreeSpaceA CreateMutexA WaitForSingleObject FreeLibrary EnterCriticalSection GetModuleHandleA FindResourceA SizeofResource LoadResource LockResource LeaveCriticalSection DeleteCriticalSection ReleaseMutex GetLastError FormatMessageA LocalFree SetErrorMode FreeEnvironmentStringsW LoadLibraryA InitializeCriticalSection FileTimeToLocalFileTime GetModuleFileNameA

user32

CreatePopupMenu GetCursorPos SetForegroundWindow TrackPopupMenu InsertMenuItemA KillTimer SetTimer GetClassInfoA LoadCursorA RegisterClassA GetSystemMetrics CreateWindowExA ShowWindow DestroyMenu GetClientRect BeginPaint EndPaint PostQuitMessage PostMessageA DefWindowProcA GetMessageA TranslateMessage DispatchMessageA LoadBitmapA MessageBoxA LoadImageA DestroyIcon UpdateWindow

gdi32

BitBlt DeleteDC DeleteObject SelectObject CreateCompatibleDC GetObjectA

advapi32

DeregisterEventSource ReportEventW RegCloseKey RegCreateKeyExA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegDeleteValueA GetTokenInformation OpenProcessToken RegisterEventSourceW

comctl32

InitCommonControlsEx

shell32

Shell_NotifyIconA

V2.1.6.0/etc/client.conf

SHA256 ce26cfe64abbebb0153efa32ad12faf6286053fd3bed1aefbf4b46a12949601c
MD5 cc821b91cad49e952babf76b5fedd3b3
SHA1 b34eda640100c528bc5b4bcc2fc16ca12ffa93d4
SHA512 832eba7eecbe1646148ad6d0d954aebf20312d15200d12b1dcbf7a8b9f94a2d8c20a83bdf1769c430145d6cb5db2fa2f19e18100413ed93b80b63c6e2fd189f3
TLSH
T19EC02B13522B0304C23DD083002338401409B0C0B52C803EC0647341B4C29077F8C5CB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

V2.1.6.0/etc/clientcommon.conf

SHA256 0f36b705f19869164ea25281e8e1edc4036bcb2958721ad9f51e4477b5cd0ecb
MD5 f976122e82539bb8e9182fe8b552f1e1
SHA1 57b466b720eedbd31f1956dce4b3898b279f5721
SHA512 dc8e0a190f44a0609feba0044661b273f6039808bd6908779d8d5d5eaf0b8736922ce344ebd4b7fed2d9b99dbd391b6bf3440d665046fc6903cf29cd59e680bb
MD5 SHA1 SHA512

NSIS installer

installer

uninst.exe

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 e4ea0adcecbddedbb6645443811ac1673099cd4d245142ad56cadf73676eebdc
MD5 54a805778f591ac29abccefc9acbcd17
SHA1 cc3001f7962324608522fffb8358b123619c418e
SHA512 3958e20180cb32ad3454b747bbb4888b6985b92345b345af86482d38e95bd0917bc3193a1b1b2cd62ea85e38a0d6dc2de59106fb5ae7d8787f1d604e421edb09
SSDEEP 1536:7BWx2gmwLOuYL12EawcKocJgdLeAyNxAeK/:7BynOpL12riocJceAoK/
TLSH
T19433AE1633C0CCB7C5AA07B19ABBDBB6E7B6E6000110A69767A05F7F69316C6DE06143
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/LangDLL.dll

IMPHASH 274b99a815ba574d8c9e1712916d8b30
SHA256 6a033e367714ec0d13fca0589c165bdbf4d1dac459fa7ec7415815223fa3c008
MD5 77ff758c10c66937de6d86c388aa431c
SHA1 14bd5628eaf8a12b55cd38f9560c839cb21ce77a
SHA512 319837951be276a179ead69efcd24bd7566061abc7997ea782af50bd4b0d69e5ec1a6e4cdeb2825bafedf87edf03380396b7bcf58682b6a3a824c8dc4b966bda
SSDEEP 48:im18EhqneMPUptuMMNvimk2BAZuMTRCpYEvJdUJvR0J0of5dwe:F12pl9NLBAZuYtR0rd
TLSH
T197C18537A3C106F5E6944233265363C35713A9707766804FCB6712BA1A208B7ED6EB83
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5582

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

VOS3000V2.1.6.0.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$TEMP/jre-7u5-windows-i586.exe

PE Signature issue

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

urlmon

version

wininet

gdiplus

generic

V2.1.6.0/bin/vos3000client.config

V2.1.6.0/bin/vos3000client.exe

kernel32

user32

gdi32

advapi32

comctl32

shell32

generic

V2.1.6.0/etc/client.conf

V2.1.6.0/etc/clientcommon.conf

uninst.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic