jaffacakes118__2ab56410a4009f953335448e5464c97d

resource	yara_rule
static1/unpack001/$PROGRAMFILES/Intel/RIZukU.exe	upx
static1/unpack001/$PROGRAMFILES/Windows Media Player/qoue.exe	upx

resource
jaffacakes118__2ab56410a4009f953335448e5464c97d
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PROGRAMFILES/Funshion Online/Funshion/m
unpack001/$PROGRAMFILES/Intel/RIZukU.exe
unpack002/out.upx
unpack001/$PROGRAMFILES/Windows Media Player/qoue.exe
unpack003/out.upx
unpack001/Hash-MD5֤.exe
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PROGRAMFILES/Funshion Online/Funshion/m	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 10edde210eefd23e8e0d6a35d063c1d08b56ff40a93a03cf8031e86e48858f5d
MD5 2ab56410a4009f953335448e5464c97d
SHA1 18579ef528f4a01441928d32827c5b6f6d121015
SHA512 36ee634ddd9ff2d4d0ad50582da997d0abc5f80a410ec947fa2beb11603446eb0da1bb753fbfa2c599ffb679f8673760f29488f740c6b8175ce8965f03daa512
SSDEEP 3072:4ZMJnTeM4cJJxtSJcfTS7gig+jyxDYvGw79/bBOuNQkIE94Sm3oG:UeTeM/rSJki/jyRYu2/bckIRSkL
TLSH
T1F4F3026176C888FBE9AA43B166F7F62BF2FA6740131021535B70AFAF3C30147991E651
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PROGRAMFILES/Funshion Online/Funshion/m

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 90e72a0fa616838b90c965623ece3f2a73e1af308e16ae7ae252e7b1e48523ae
MD5 2086d23ca74f007a5426a4316b7347a9
SHA1 d368983f7c59a7130e78541dd899e63f0cf02e03
SHA512 b6c4041524ed529687e5b0548c1f6a9601cd01aacc294827deca203b48fad9742daa6e1c0587fe1523e846827f1e65fab51b790d31554cbd1fdac71ca8be427d
SSDEEP 1536:WyZMSZFvknTePMZd4k4kJJM4Romu/G7HVtbVt+gTXBUZ0r/UxVzef6i0lixG/HLt:xZMJnTeM4cJJM45TjVhDOZnxVayrrdZJ
TLSH
T195A3E12233C0C8B3DED505B29AB74BB9A3B7DA081350A9171F350F7F2E31187A91A1D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PROGRAMFILES/Intel/RIZukU.exe

SHA256 487074ddb2b5b892b568cbaaa8b6349af983405f66404347d99c20e3e4adf7b6
MD5 5efe54ee4f3778e7750df60186a099d1
SHA1 1bdb4b9ce2be480e78d886b7cccef781e59de40f
SHA512 387caeae75d72fc71160ada3371ae73101af531aa44a7b17ed6e000340f3b08f182661d9e42436aba16667d95327e524058f2bbca48c7dc658e731c3b63d6667
SSDEEP 192:SezFy0JIZgAtxlw/OQoP1hscuLhBifFSIfqb9D:FzU0CZgAtbwN81hscuitb4D
TLSH
T1A8328D51A7B75016CCE285385B73861B9834BC724E2FA68E1E143E2D6C707E0E93D3B2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

30928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 a458b5316a7d60e70d36718f048e5afefd4532c3b2f9500cd06f02a73401f659
MD5 215f79ddc8f62be2ae9057a9c81efa9f
SHA1 2d75b33e79f90ea7f7d8d006e08d17048ee2797b
SHA512 c79e01024e47d9332241584e14350388d08e948b6ff09b6cfd0ea9f698dc54b74b090be4c631fb34c146cad9b49fcdb31cfa91805b77d6ac19ced1a59ba8dcb1
SSDEEP 192:SJYUvqtvmglIhSsBJKzeIofAlN+GPKoqjD4LgwuMbAq9D:+YTlIlBJyeX4lB0EL5uMbA2D
TLSH
T1C4B22A8A56811590CFD1CA38877F2A7B5B36BC65153EC66B1F60FE282835231EC3629D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PROGRAMFILES/Windows Media Player/qoue.exe

SHA256 b53902563544a6f013600d5d5d92d2ba0d05c86e91b28936dda820dc772b39e9
MD5 34e232ba20124c720efbdd661cc67cd3
SHA1 7436834ad99c811c05748726e4a5ad08bb7d1836
SHA512 0d80e925fc7cf52a32aa4d2c5fc8d3e7f6e422198595974e48cd88376e9a09d748aacd38ad9331b2630911bbe3cb644d72c83b88c1f51944d9ebc545a20d44e5
SSDEEP 384:i55CBZYz3rDIs1jvEoIILAPBjFtwvcXCbUd57:ifgZQbMs1qIQFFNy
TLSH
T14142B09B3B4C4E62FB8AC37E0F0B53299B7F10E9E7D59028FEAC02A52C466741234545
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

43456

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 ed2745fef9fbb8a2350668ba7303db79400de42fef4155980fdcf20debc74fca
MD5 e8edd4c956be9e966e078952dbbd2988
SHA1 6449e3211f2d7cd10cd96d44f1b9930fed0e0a86
SHA512 d6163f58812d302a6368345bc71c409ed8f9da9917ccd8aeeef4c318ca5f645cb0c86de534f692c14c73dc9e550bcfc10af0b8d67f2d75b4b330c2a2c78bad19
SSDEEP 192:i6PDZIUDyxvR9ppxfSAZVEXrRrQX0a9gB3W0C6cyPeOfQccKqmQqJq9rE84Kpj3m:i6VGVjZ+x2AC92eOIccKqmXALLyS
TLSH
T116F25C27B8C64133C986827158F0CB175B3F73131EA5C45BDB906A8A3E329E5593E38B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Hash-MD5֤.exe

IMPHASH 91c8172effccd3ed565854517f1bf6fd
SHA256 33f9ff6f0ef8204500383a70ac2cd3381ad3fd1e94f99d8b8b75ba196a443d65
MD5 1adbcff9fda7150c2c41ec27a779e41d
SHA1 532dc17c67a6de676340c6695df59860229ef820
SHA512 a056897d5e1717e881d61eec66edab81a17bc6ae8dcaee07f5637eeeb7fc842b62c0508f0b34e9315bfd3872fb40b2296e7697b8a12af9d23ee5fccba7089ff4
SSDEEP 384:Zgaq3bc4ivsSLzwG27W6k2TzFtwX7ryFsoqN1XA8E3wH4MZd9R41PJxBSUefD:qaq3bc4ivsMwUBLrZncBxBSb
TLSH
T1E6D21A896BD71A91FB631F7E0267E92F8311EAB40B24D2D3BB528F8289302D15C752D5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

21292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\MSDev\Projects\Hash\Release\Hash.pdb

kernel32

WaitForSingleObject SetEvent CreateEventA SetThreadPriority CloseHandle ResumeThread CreateFileA GetFileSize lstrcpynA GlobalLock GetTimeFormatA FormatMessageA GetDateFormatA WriteFile lstrlenA GlobalAlloc GetFileAttributesA FileTimeToSystemTime ReadFile GlobalUnlock FindFirstFileA GetLastError FindClose FindNextFileA GetCurrentDirectoryA GetFileTime FileTimeToLocalFileTime LocalFree GetModuleHandleA GetUserDefaultLangID lstrcmpA GetStartupInfoA

user32

EnableWindow RegisterClassA CloseClipboard GetFocus LoadIconA wsprintfA SetFocus SetDlgItemTextA UnregisterClassA EmptyClipboard GetDlgItem EndDialog CheckDlgButton IsDlgButtonChecked GetClassInfoA PostMessageA OpenClipboard SetWindowTextA DialogBoxParamA SetClipboardData SendMessageA

comdlg32

GetSaveFileNameA GetOpenFileNameA

shell32

DragAcceptFiles DragQueryFileA

msvcrt

_makepath _controlfp _except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _splitpath _vsnprintf _snprintf _beginthreadex ??2@YAPAXI@Z memmove ??3@YAXPAX@Z

shlwapi

PathAddBackslashA

comctl32

InitCommonControlsEx

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 744f8847f96d6c1e1fcb0ef0cb6714d1fa287acf465c90a9643c3e3d5de5ab47
MD5 681f025c5d03e74b5d200300f2927a07
SHA1 336161a0e1b1593711fb097f495c9b4b4b88fbc2
SHA512 c4279036db2e8879755e19adfc3e0ad24632f69eac38c778285602e2586611633da567a078faf4cd07bbe1c216d42c9b14685d6f00f7c2f7e3ac0a36d917d456
SSDEEP 768:phMZ0dF4ZFvQbn+eePu3cIQGCGbiC4k42M3wJJdgM:pyZMSZFvknTePMZd4k4kJJdgM
TLSH
T1C6F27D5736D088B3D99706B117B7DB3BE7BB93001310625B6B645FBF3D22287A91D282
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer