0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950

resource
0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/ShutdownAllow.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 0d151bae1e6f8fcf295a20cac617c4acab4389046cc76441411ab60be0397950
MD5 567d5d84f375eada19479e946b6727be
SHA1 c7b466da4edc3adf61d16e950a16dd936262199e
SHA512 2c0de1452738d14a00ace51a6d3748ed0fa60358b6b530847184230514fdf4f1219ccd45cccdc5a89883a328172c2739a9b4f5af802e4b5c721620e560bd7172
SSDEEP 3072:vQIURTXJPeoh+YSZ158zIrTTU2KgXaU+eak9:vsxhhSPZo2vek9
TLSH
T16CC3C04D29CD6C73D6734E712BB2CB6AE2B6EE700D61522B1713FB7A38722526900257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallationType

SHA256 1eb020fbe221fe60ab62c5a5f1d88a97c89b85956d740785106e1dda7cecfea8
MD5 ee3663d13d9acac8b223fb48fa9297f5
SHA1 055fdb890aaaa327e45c66772912d4e83a5a5376
SHA512 2255286a74357b0de929596436612c0457285ac87d72a455d255f14fc05912baa5130fa3f34f610516c687f27c31f16449fe924466ea23345276b0ef4f183d73
TLSH
T16F01DCC99044D7B58830E21E243F78A233E12D388B193CA8FAF41483E74DDF9589D287
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ShutdownAllow.dll

IMPHASH e02f5133b7e45d844941aaceef0cff82
SHA256 c6518731ae740494bdd87c53a43086be7f0ce125f728b2860a014235cd56134e
MD5 db401847c04d665a6f83dcafdd6ac23d
SHA1 bdbdcf5baaedd62d8d3f471693ef99d1fea60d7a
SHA512 c204bcd55d87cabfcdb79ca2230ae0e89425f2c7e67b46d3a04937440cdfbbe3d9cafa5e52a8ab5d4539a3af4710ce44624476fa42602edb23cb549aa77ecd71
TLSH
T1CE51F197D79596B5E25103BC46D7015877FD472723C7811FBB4D012A7B90E886CD3760
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

4252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/header-install.bmp

SHA256 727ce2a910cccc5b4a25d4d099acbefc2d01ca6630b4c6b1977c428567c27e9b
MD5 bd3a6cbb0861a62d84832fbb16dababf
SHA1 0fd0d234ab146b9fa7f9b6694c9f4cec3dec6591
SHA512 79fcb6db34723ba4417b59b6575f40afeddabef57b841d9816c1ac1431dba55231e72bb3c27bf479a8e534dff7ea1c81386a6539c3a5f3cc0e23002e33bba12b
SSDEEP 192:eWS+GCazRa/yqYLYqHbMb3n4Ijic0dXVjU89/X+qTNnase1J0powWd:eWrGDUNYLYpT4iifjU89jnaZ70powWd
TLSH
T1EEC2C2E2438C0E55C8557C676828DAF67E98BDE71718BBDD8C88F4921B314EE230CDA5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/inetc.dll

IMPHASH 1dd454ac5c9407d14ae23ee8e8cd4203
SHA256 0537e86a8940e8c516330c1e646bf46cb62d79fc5a9add557c5050b40fa9f346
MD5 eff1d9f80967c384e8d25c5a6369af1f
SHA1 1bad344a6f8a991e2017d79113e1e54f0dde32b8
SHA512 cc824bcf581182c072df0e59c4d5af73fd5768215e18585e94d15617cda224763b62bd36a24510766e1bd651da05f024e6b6b9b0eaf3b6371f119c508a5a1e18
SSDEEP 384:uucP6dFG0upnGsV5Zrf/d5Yg7MJ9/fxCSULpiT3ioyAkVZ0Ac9khYLMkIX0+GTQZ:u96/5GV5xf/dFQfISNT3jyAOsS
TLSH
T1A6B24A845E1824B7E7791D71B4E67F338B6BEB90355A404BE73363DC6CA4202B92B213
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

15695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcr90

_onexit _lock __dllonexit _unlock __clean_type_info_names_internal _crt_debugger_hook __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _initterm _decode_pointer _encoded_null free _malloc_crt _encode_pointer strlen strtoul strtol strchr memset _mbsstr _mbsrchr _mbschr strrchr _except_handler4_common

wininet

InternetReadFile InternetWriteFile HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA

comctl32

ord17

kernel32

GetFileSize lstrcatA GetTickCount SetFilePointer CloseHandle DeleteFileA GetLastError CreateFileA ReadFile WriteFile lstrlenA GlobalAlloc lstrcpynA lstrcpyA GlobalFree lstrcmpA SleepEx GetProcAddress LoadLibraryA MulDiv GetModuleHandleA TerminateThread WaitForSingleObject CreateThread InterlockedExchange GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep lstrcmpiA

user32

GetWindowLongA FindWindowExA CreateDialogParamA EnableWindow IsWindowVisible IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA RedrawWindow KillTimer DestroyWindow UpdateWindow LoadIconA SetTimer GetWindowRect GetClientRect SystemParametersInfoA SetWindowPos SetDlgItemTextA wsprintfA IsWindow MessageBoxA GetParent ShowWindow SetWindowLongA SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA

$PLUGINSDIR/modern-header.bmp

SHA256 727ce2a910cccc5b4a25d4d099acbefc2d01ca6630b4c6b1977c428567c27e9b
MD5 bd3a6cbb0861a62d84832fbb16dababf
SHA1 0fd0d234ab146b9fa7f9b6694c9f4cec3dec6591
SHA512 79fcb6db34723ba4417b59b6575f40afeddabef57b841d9816c1ac1431dba55231e72bb3c27bf479a8e534dff7ea1c81386a6539c3a5f3cc0e23002e33bba12b
SSDEEP 192:eWS+GCazRa/yqYLYqHbMb3n4Ijic0dXVjU89/X+qTNnase1J0powWd:eWrGDUNYLYpT4iifjU89jnaZ70powWd
TLSH
T1EEC2C2E2438C0E55C8557C676828DAF67E98BDE71718BBDD8C88F4921B314EE230CDA5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer