CANdelaPersistors20 (1)[.]exe

resource	yara_rule
static1/unpack001/MSIChainer.exe	SmartAssembly

resource
unpack001/CANdelaPersistors20.msi

resource
unpack001/UpdatePersistorsInstalledLocalToApplication.exe

resource
unpack001/Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe
unpack001/Prerequisites/WindowsInstaller3_1/WindowsInstaller-KB893803-v2-x86.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

CANdelaPersistors20 (1).exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 a1a40f906bfa0649e655908076cfbe325175bde8c71926b02448443fac7d40af
MD5 a470024cab70d6a39e9e735ddeb42827
SHA1 fe6d4fd1a32df56a02f03f281a46fb34dd38165a
SHA512 d13a0de94c6909b8864d8d8cffb0460f86b44e650c35d477814efc93eb8731c29cc0e275984e8ec73817038ff25bbc79690b117ec419bd19f650aeddfb381397
SSDEEP 3145728:ahMUnkP6DsH4Ociz5tuvVOPc/EW3UCNs6OyictQ6TmBG3I:uMS1DsY/KuvIgjUvfctQ6T2G3I
TLSH
T14B4833C398DCAE7CCEAA397E43A27B5D8ED1242F107A6C76E598CDC0125453297F4B24
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

96:ff:78:3e:c2:4b:d6:5b:f7:73:a0:62:c9:4a:d8:6e:79:7d:19:e0:c9:eb:3d:22:89:be:f3:a4:fd:97:f9:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Chains

Nov 23, 2023

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Serial Number

02:d9:91:bd:4c:d8:39:77:63:df:d4:41:01:10:a6:ad

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2020 - Dec 6, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

CANdelaPersistors20.msi

SHA256 84b3fbc064e11e91db0f01fe4b754cb010460aac39a0a5ab70a7290697ea3888
MD5 75f6b1e1d0dbcf0fc34da6545abe584e
SHA1 0fffc0e76df7d14a70a94444b8fa94f58d2cb513
SHA512 2759c633b2744ff284942d689d199eea6954c440a8fe1c395f133690567eb7e2b9413fce080fa1dfcd58b78cea67985036836d797e8d1e5b3d8b8b60fb04fae6
SSDEEP 786432:LPgBbJVuIEj+kcZbGwRzofl3Q7VuNgs5CB9UMDjO3/:LoBlVua9EJQ7VuNgvB9v
TLSH
T1B6973383EDA2EB3EE85ED1BE48572B2E81418D3D4F506C2361B7B054A1F4769A9F430D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned MSI

Checks for missing Authenticode signature.
NSIS installer

installer

MSIChainer.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 7c9eac57ec52aaf47e50a4d99670364c38791a2cdaa3ffbefee65ab8d5688365
MD5 81bdb1550cbd6aa55d25a858096dff1a
SHA1 94fe5de83ed7510aa606d6359e96d37cfb8f030c
SHA512 cdc796cf9665518c1fcaa8d6be56554bc122b0c554e1a068985008fba2235d90a94afd71d7cb28a37fc8c26844541ae12d93ec3bb30ab4e5caedcd38b1937ca2
SSDEEP 3072:AFcBCXoLaebmt1uO3KzfbvF6UhopxY6whps6FbEKY9OTEmcSLhxnf+Ud:AqBCXoLagmt1J0fbhra0TEmdrf+Ud
TLSH
T1E6F3070033F84657E6FFAAF9A87112914BF57D476A39E7CD1D8650EE18B2B80C960363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

SmartAssembly .NET packer

Detects SmartAssembly .NET packer.
NSIS installer

installer

Digest

68:e2:64:3d:d9:d5:ba:07:4b:08:55:df:0f:9f:78:a9:d5:b6:30:b4:02:5f:ff:e6:48:a3:70:d2:7e:f6:bc:0d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Chains

Nov 20, 2023

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Serial Number

02:d9:91:bd:4c:d8:39:77:63:df:d4:41:01:10:a6:ad

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2020 - Dec 6, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

0

Major OS version

4

Entry point

168142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MSIChainer.ini

SHA256 ebf590c8cb9a351a42e354456e1312363468de7483d79f7130c3d41efb01f509
MD5 1d664cbdcc586e2e536ae0f0075f5d2a
SHA1 b7dc25ececad5cf43e3d1ca6746fb0b49be60734
SHA512 8dd5a88e83640ebcb8d29c97f964d5bdc8daa7de23c55cb10372f71d075efda69d56b1a64d0aa12c78b3917e81ed2ae7f5d77e90bc96ac2c013679b1c2026d0c
TLSH
T1DB110E0B8109707635F126F66E914F20B391E28BD153421470D708C8F307CEA93AEA3E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/Product.xml

SHA256 208875b4c861e819bd1718cff681b36f3b9ac6bfd26a365018c933b2545136ab
MD5 d8924a88cc27b7447a1d79ee05865806
SHA1 048987664cb25c0eaecf5de2fab7951a19457b10
SHA512 66be570bd9c629f1d8249ba2717f35cbb93fca4b231b28246b7fa6a3c1664bbd8609c00c003496ceb0c31c678e2884be07011bee75db449f3d533f72f0684b45
SSDEEP 96:2T0IN5Zffl5ZffYL4fyBYalF+wDloKQ6G+4aslhgM6GKYt:w5fVfvbK+wGKQ53gM3t
TLSH
T1ABB1B80962D09C3104310568E7BB9D9EEFE9821356354194B24F9D4F6FB381B22BF3A3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/cs/Eula.rtf

SHA256 c6147000fc34894c724c09cb69ffce75dd1263b69d063f75466d70b67b3c80dd
MD5 b02c48825414edca106c92182d32bc8a
SHA1 cf00219d69e3cff9777babece1ee9d8cdc776ac9
SHA512 b8afe051701189f60789d0340fd15e81491456284305b55c4582d0153a2c8cb25f1edd05f40b50893c7cbb80ec57ff635d764db5f56aa2e945cf29e9c550e9ba
TLSH
T179711F1A5935D68C23B7114E8B87430FAF8E3A5A9BBBF4D9B3DF149514A313CA0966C0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/cs/Package.xml

SHA256 6aeecdcc8277ac61b4adf04aab5f1ef9a921e2c151dd7eb2822e3cf48cefd590
MD5 12513988801fd8be63e5c50f0f2173d0
SHA1 250496b2aa23fe3ae3e4c0ae53f0d350a5b9911b
SHA512 c53a21dcb09745c418d9dec8b04eb1d3aad53e9156d0b543a5b040becaf645e28fe5309e7e59a0ea9b516e1432dcfcc1a1f8102431b593c0dc8e9549b8b59f79
TLSH
T1F581740E32D20A3105310518F5B59849EBAC8367763B85E4F69F6C0FBFB281728B7792
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/de/Eula.rtf

SHA256 a448fe5954ec68b7c395da387545c1664c3f4baade021e6157ec142997d93ca2
MD5 94190970fb79c7085de2e97ae4630b07
SHA1 272677f49985098ca0477d6a8c1e70e4bddb646c
SHA512 7a7ee485d20912fc533e83eae0f151dc142c2f01051735d1f9b20a7146154a04c8269fc9f71ac82e57925b566e07e716cded6db8b11026225ceaac209311531f
TLSH
T1AE61E616B8E3129947363BB80701A05BBB1F47FBEE49F666D2284550023BBF8445E888
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/de/Package.xml

SHA256 bf0be2c2c40c37de904b876b8a19a38699de13638976a144f7a2b681b9f4d9a0
MD5 4473db4bda4201ab543a6eb47fffce23
SHA1 c9aea013e8f4fd85038ac7ae004ca87789ccee18
SHA512 f5bb29a84df8580e2784db75f92f499366c2fec8bbd5b865931807345095ce7568ab9b40ea5d7fa53ba0cfccad3671b6d364161839f12b75a63d0dc9d65e32de
TLSH
T1E881860A21D14A320531192CF5B55C4AEB999367763B41E8F14F5C0FBFB282718B77A3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe

IMPHASH 02483cd76378259a50b7b66146b45f06
SHA256 65e064258f2e418816b304f646ff9e87af101e4c9552ab064bb74d281c38659f
MD5 251743dfd3fda414570524bac9e55381
SHA1 58da3d74db353aad03588cbb5cea8234166d8b99
SHA512 241ba3f82f37818407bc00909c160b653b45a1a3d156e043b87ba18a7819294716705c952c7b46516c4afd86e6f99bad23e7235b951a371ae6728107f19e5f23
SSDEEP 1572864:cAVBjIQSzQe3cf7xOCHKYrLn+XxdjrALIjOqWY99:VVBIbzQe3u7KYrCDS9299
TLSH
T179B733E571D48830CDA32ABA07D976B54FF66D6B1BBCA9EB7C8487E1910095293B1F00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

8e:85:82:d1:05:21:96:2f:45:f3:39:35:c3:8a:24:12:c4:f2:d4:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 19, 2010

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

2e:ab:11:dc:50:ff:5c:9d:cb:c0

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 22, 2007 - Aug 25, 2012

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:01:cf:3e:00:00:00:00:00:0f

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 7, 2009 - Mar 7, 2011

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 16, 2006 - Sep 15, 2019

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:a2:30:00:00:00:00:00:08

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 25, 2008 - Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

102854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

boxstub.pdb

advapi32

CryptGenRandom CryptReleaseContext DecryptFileW CryptAcquireContextA

kernel32

Sleep WaitForSingleObject GetExitCodeProcess CloseHandle SetFileAttributesW InitializeCriticalSection CreateEventA CreateThread DeleteCriticalSection EnterCriticalSection LeaveCriticalSection SetEvent GetCommandLineW CreateProcessW CompareStringW LocalFree QueryDosDeviceW GetLogicalDriveStringsW GetDiskFreeSpaceExW GetDriveTypeW CreateFileW DeviceIoControl SetErrorMode CreateDirectoryW RemoveDirectoryW MoveFileExW LoadLibraryW GetProcAddress GetSystemDirectoryW GetVersion GetLastError SetEnvironmentVariableW ExitThread GetTickCount GetEnvironmentVariableW GetModuleHandleW lstrlenW WaitForMultipleObjects ResetEvent GetSystemInfo FileTimeToSystemTime FileTimeToLocalFileTime FileTimeToDosDateTime SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime SetEndOfFile DuplicateHandle ReadFile SetFilePointerEx GlobalFree GlobalAlloc GetCommandLineA HeapSetInformation GetStartupInfoW SetUnhandledExceptionFilter ExitProcess WriteFile GetStdHandle GetModuleFileNameW GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent HeapFree GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc LCMapStringW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar GetStringTypeW HeapSize HeapReAlloc IsProcessorFeaturePresent SetStdHandle WriteConsoleW FlushFileBuffers CreateFileA GetLocalTime GetComputerNameW lstrlenA FormatMessageW GetSystemTime GetTimeZoneInformation SystemTimeToTzSpecificLocalTime DeleteFileW GetFileAttributesW FindFirstFileW FindNextFileW FindClose GetCurrentDirectoryW SetCurrentDirectoryW ExpandEnvironmentStringsW GetProcessHeap RaiseException

comctl32

ord17

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

shell32

CommandLineToArgvW SHBrowseForFolderW SHGetPathFromIDListW

shlwapi

PathRemoveExtensionW

user32

MessageBoxW GetTopWindow GetWindowThreadProcessId GetWindow SendMessageA PostMessageW SendMessageW DialogBoxParamA GetDlgItem SetWindowTextW EndDialog PostQuitMessage DialogBoxParamW SetWindowLongW GetWindowLongW LoadStringW CharUpperW

cabinet

ord22 ord23 ord20

oleaut32

SysAllocString VariantClear

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Prerequisites/DotNetFX40/en/Eula.rtf

SHA256 da3d6a6ac223744df01c920eae5f43e017f52350831c4f3f6bb38d78232ea3b4
MD5 b7129c4881f118fcb38f27cfb00cd36d
SHA1 148989b710205c6a67b3f960567f6daa98d75bda
SHA512 c0816d7676ddf0774eb9022bd305cdcdfef590be38e20c2d5584968bca78e10a14be375fa892593f11d04be2734a30b5c1d21814b88c31814c713e08546436e7
TLSH
T11F61427E828602D30AD601D53E51D09FFF1F23FA5DEAE466E0A89C0112B3B5DE0729E0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/en/Package.xml

SHA256 a98cedde60015a763800173a8bd1482ed2985ce4cb82a90192a3556250e0bb68
MD5 c15d701027f8d5713287110fe5cdbd96
SHA1 eba424ac6cc3aed506be61d01fbf924deb63c0b0
SHA512 ea2e660908cab6083d22e3504f93a26ff322ef582a91c8eec86a459181e6eed12182c3b8d16b85336f41ff2906b30b27d3c820bd4d4359aba45ac06513521138
TLSH
T1F021120961D10F310430587DB9945889939183BB36BB49F8F44B842F7B65C461E73BA6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/es/Eula.rtf

SHA256 aad96e7f4037e977997c630dec015ecf09cf73c1f5b73f84944e60b309eaab66
MD5 d40c65f632063e5cdfef104e324d0ad4
SHA1 49faba625badf413763bd913edb62510d3790e98
SHA512 6a948fa1602e517021c98861b0df12fcb707fbbebf094dde96d9e60cc7ded30b07c1bf6ca8541117a362b5eb8703d61051cf187083c91076e0ad235cf72b7237
TLSH
T1795171B95988974215BB02829F81C19FFB5D0BC25D4DD6D2E0DE590400B679CE06BFEC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/es/Package.xml

SHA256 c0f08961dca6775169796d09f4f79d4039148339ed3254af278b6120ada140a3
MD5 eeff93b41d8127d1bde7c31990af6e12
SHA1 0585f6ba4cab04649863c32d6066ff8dd0505c8c
SHA512 780ece4e515440ada711e52ec35a5a9279f1a0f033a60e8bb92b9320ff20ccbf59bc10aeb32d4e257406d088db6533efd401d3723afee380235cb467da4de3cd
TLSH
T1FB71770E21C15F3205301918B9B6584ADF9983677A3A46E4F15F6D0FBFF284768B73A2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/fr/Eula.rtf

SHA256 8880b979a4f8ecdd529241d9ae02583fecd21010ea1e255a1cbcd0c6fb2f75e9
MD5 e0da85db8b02a89a63601ea6b9ad7ff8
SHA1 5f91c397cf3fbf4475ff71339b2d69c45694130f
SHA512 c8f47154145507c89d9b599d725c3444a206ae2afac2aca4b2ea18980dec134a25fc539ce1fb2291af942dc1ca25ee2fff323fb17f43f5bf91157a30b19bcd17
TLSH
T1D271749E88D495DA0A5B10A15F02C22FAF6EC695EA4DCB60D0F99C42023246CF37F67C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/fr/Package.xml

SHA256 1be406646a516d57105311891723fffe368a68f58da0728b1816938ef424533f
MD5 9b2c6962a10f1f66c506fe9025a045fc
SHA1 1265d0d82928fe592495ef9b60a221b0ab30741b
SHA512 32c210a3bcff071137d18438d893f0a58ca4945a88d0159e0d3991bbf6ff3172ce31be64459a9390ac7ccbd77de250459de5bf5ccb200ba11989af0d788d5668
TLSH
T17181960A61D10F3204310969B4B1588ADBA98367763A45E4F18F6C0FBFB381725BB7E2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/it/Eula.rtf

SHA256 c405ab9949c10619742af1af153521ffd85c16821324c16233b025f982a98cad
MD5 6c9c19bfed724146512493f05cba4f0f
SHA1 de249075aac70d4661ed559fd64de9f33de43db5
SHA512 709a522477121ee32152dbe7f90ee4b597621761854b55a791c07c9521ffb899a21c0b84351a68ac3a583b43a91ac5164ef34259d153d21b47c404b4313893b3
TLSH
T11671A9375586118E0F9A13D99FB1C05EFB6E0AEDDD9ED8E1D0A41E0411BB74CF02D958
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/it/Package.xml

SHA256 d5048649b962b7104857c78634a430b897f3add07027f2aa7a1f13b5ade65148
MD5 dbb5560581c832e8835e4e6ad2bef9f9
SHA1 78ff471fb831c1fb88c62890f6334eed9f9d8633
SHA512 960df93fa0596a1e338d234a83d1492672cf21686fea773069e967366688d3f43e01d38a6ac62a32893b396928a263d2bc2ea2629bb94ccd044fac290edc1271
TLSH
T14581750A31D15A3205310518F5B5A84ADB9993A77A3A41E4F28F2D0FBFA3C0724B73A3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ja/Eula.rtf

SHA256 2abdc7246e95e420b4e66cc3c07acdb56ff390bcd524e0d8525d5bf345030a5a
MD5 75ce7d721bdb78f1020acf2b206b1859
SHA1 cc0418de8806811d21b19005bc5db0092767f340
SHA512 fafac863dc825fc0b104751fe62cda2c43048683f9d7e45659784206ea67f1aa98ea282afc2a3a4ba287d03f73b21ec1e2f8c02f5d036ce96caefd851a5389e5
SSDEEP 192:tEf13/qC2+PCsANROmuuU8EhZFJEj2VQoKOwyWAOxzpOh+uqaJgt2:tBtQoCnGDzhuqz2
TLSH
T1AC22692774B8F87C1AC4A6D99F66D4FD6ADF08064F77F103B94E6253081A15F87832A2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ja/Package.xml

SHA256 d477c8de45d9d12777d2fed555ceff23dd3a8ea3d99a244aacdf6ef53afeedf8
MD5 f7a03e1ae0e3bf73f62bc96febcec0c9
SHA1 216f4048793898d6f8309233bc48b2d7b9063311
SHA512 661397b4f55ff6f024d8a783d2fda0140931c01f10acbb9f0c7b0020988e2220390a70a205d47cb7daeb6313475af9a1b3594403f8bf3829b153d95d57c99fa1
TLSH
T1BD81751D61C1093204300415B5B9588AEB99CB57BA3B45E4F15FAC0F7FB2C4B99B7772
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ko/Eula.rtf

SHA256 2954edb51628942a37a9bf58da628932638c35ed61744892e42623fe4ccd06a0
MD5 a3b318528e286ec387e81934e5d3b081
SHA1 cedcc08d008e21c0e88eef8354dab8cff2ef51ad
SHA512 3544d9be654c859cde2b9cd8614c5abed89e488dfee2f51ab92a509873dc504942e375388d12379de9d29deede662667f8cc4bc6d2dcd50c5ac865ce6c44352d
SSDEEP 192:MUf0PVF4MjeKojIfE6wK+b/mIr4tIAcAIce5rD6O1IuonKZim+dfNAW6qUK84Zn+:aK0wB/Tr4TmckIuCm+TAWdUN/re2
TLSH
T19442D46170BCF64D44617C5EB6F600DF7BAD810F4CFAF2186B5F22BB8CAA18E914A541
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ko/Package.xml

SHA256 801cdca4bc64dec9007df2261480d4ca028238a444a6750b3c69249cec9bd470
MD5 f8f73edacbfbd2bbfc26bff50387be38
SHA1 c3783bf82416a1e570994692c027010bb9e3a073
SHA512 beb00d4af2ce07b54a30aca372576cd9392da5d74c0cd1d87e7f341086146c3dc8d4c39ec36dbb66b45eaf8c95a378c3f0367d0f3dce2a8f5b2fe3111e2fae52
TLSH
T1F481530A31C24A3205310919B9F6A889DB998367773B45D4F14F6D0FBFA2C1724B73A2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/pl/Eula.rtf

SHA256 4f2d6a8979c89592877555fe8f576d5f631132452afe86114d35e9531a1ca948
MD5 bb93b108d4be954133380f7709e7ba1e
SHA1 34376037b3c5879142796a2f524e5b3ea6097ed1
SHA512 69c60ef8c0e6a8f7a92ec9a9c94c99f6dde39477d8dee041abf7a164025d7ebfc9f0c7399ad8c9ed150861b00fc47f1f1cb40bb245aa87ed7904b1bae6a4271b
TLSH
T1E181745EED48E5CCF63226C5E2C3524E73CD8A865C26F2A8B31F2CA544B76582229572
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/pl/Package.xml

SHA256 2344759cf9008ff0cd45863437c2339b8777ecd999089db6f8def0d7806a4225
MD5 175c0bb4e820de512d2fd46c2956b6df
SHA1 4d76c6930ef758b6e882ab89e4c4f8fe29c40067
SHA512 eaf49cad965e75aac8476afa481a54cdc7072af392ae6e170a775a3a138461d9ad992d74a192cbf8d71ef3290aeb351ef07edeeb958c86457eaa78b5f03013c2
TLSH
T16B81740E21D24A3205300468F5B1984ADB998367763A45E4F19F6C0FAFB3C1728B73A3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/pt-BR/Eula.rtf

SHA256 0af1f04f416712387bf87c93fa846b4e8eb0ac25e284a2a3578c58e2724e2778
MD5 e43708161843a33d34d6fdf966d36397
SHA1 2e5c0450cebd9a737a90908eeddaae2d0b3e2940
SHA512 fb334d29bbbc2d19d20c5260c55bf83d9d6d242c6a8f04ac88f8280a63e6af32fb5d96703e43d39f6863d17b27d9e0e36cbab1099127e5fa281255a19ae39e0d
TLSH
T1E071313AA08DD14E1D1A24418FC3C08FF70F4289996EF4E5D79F28A859F672DA057398
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/pt-BR/Package.xml

SHA256 bd321e8ef3e4570007506d13b53a70ead5acb3c98fbfbbb0170d118c381771aa
MD5 77636d14760bd0587976849140a1f61b
SHA1 a2a60b99e70c744fc0b5fc175679e9014c31d383
SHA512 cffebaf47e8049510523f6a07d3899f5bda2ec61c7f8e146e344af3de5fc5a60edaf0551bce4247f944fbd79b7f904430b7b8fa57ea64f10e7cf03a3ce3b8c04
TLSH
T1C671450E22D14F3205310558B9B6584ADB998367763B45E4F15F6D0FBFB281724B73A3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ru/Eula.rtf

SHA256 59ad806664e3ce4a024452985c4602d5610126a16fc36ade018a9756accc92cc
MD5 2277852a45da18b12beec5fb6f08cdc9
SHA1 e564862d098bd111430c4208eaa1add5cd52a601
SHA512 ed9726d207479e4df494c6af17e64909ea6649ddd8bdc3e37229a73270b4a159b2b11c1add462871dd40a23033e6b3f8a26e3ea1fa6e3b7316153af13b316cd2
SSDEEP 768:3CR6rdlWFJv3zGz9tWQ2ni8UNo/8PZrS14Z:3CcrMeDZ
TLSH
T1203311B48419128AC2139A697F0BFC497E2AF91D98F45094B6ABC2FB553FD7CC163423
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/ru/Package.xml

SHA256 dd409fd923c4fd6c9acd6248371ae696c512eb17597c3ec48a221e258473467b
MD5 c38fa82c6e89289f2726f37d62b8530c
SHA1 827d2c26a17295ed5d931dec8ffc1e22ec7fcd16
SHA512 458a0e6256dd9d075d72bb1b01f5cf8e414de79eab295435617b980466e38138e1afbc8fac430759a1f9e810d14954a84b6b9e85e6656c64c7d26389bb0022fc
SSDEEP 96:KRvIE5ZffWYqnPq1YKQ6G+R4Ve6f3yjuIef3yf7B:iffqfKQieCqhm
TLSH
T1CF81561521C549720530141AEA796C0ADFAA82BB373A43E5F15E3D1F7FF38161877396
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/tr/Eula.rtf

SHA256 a8850f6dbf56b6c55d255e81b15a3d17196eee89ffbe41cdfca19205628c1a7b
MD5 d71a0d5b6cb13901cd35c036d395be59
SHA1 b0f83cf648c2e84119a32afd2e0ef409bb2047ce
SHA512 fe7c6e54014ad963f51850973f5ae5872fba9843f1c20973f5e875008064f870a5217c2c9ada3d92a3f1b2df6318d5137814943d6295e72cf27343df93b957e1
TLSH
T14581460E509DE6BD2226059E83E1019F6B8F441D2D77F1A8E7CF547318133D980B9AE8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/tr/Package.xml

SHA256 2c8827d9fc23a632db786f77a5ef3078f3d63b12f5b92ea1e5241d46f5f886c2
MD5 13ea79bbc2e962192f4ec5cc6e3ac7d3
SHA1 6731e9cfa375777e24767dddf21867883b4a3c81
SHA512 cd1d243ddd2cf312013a62b0c25636d274178624ce73e13ac2543137e355a38f119da05e827a0f8c23462c09c5cb3d16992ec83da47faf7d7221ec07a40e8b5e
TLSH
T15771750A21D14E3105341828F6F6584ADBD89367763A86E8F25F5C1FBFF281324B7392
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/zh-Hans/Eula.rtf

SHA256 c30a7597aa67e2847940e2c24f09b35c07b1ec759adbca7c8261141fc1ecca92
MD5 4288c2541843f75c348d825fc8b94153
SHA1 e0dd8ed7bdb3c941a589361ee764f49a3619c264
SHA512 7ba9991fe4eed625fe7bef96a1d3ae70cb7616aad034236d1a2b346a08b48280cb6c20d2b059da9953919b0265125fe56dc5f4cc619ac653b4c1164ed564b359
SSDEEP 96:M5DBmf0jLTCLLgLTCLLmDjxrDT2k9rkKp7aDKaXzaWZMa/O9wzy6n/MpDTKTGptk:EmfJXoQkRGDtXeWZv/O9XmOdZzQJWBBi
TLSH
T1EBC1F359A534B82C09D21A3FA21E959AFFAE861FCDFEA1038F6F12570C3756DC153482
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/zh-Hans/Package.xml

SHA256 2f7d72d6b8eedf44dd23730ce9fdc9e9f0a468f7a9a90d64d956457f656447ad
MD5 c4f8294aa95dafa1845fdaa1d5f94594
SHA1 c0c74c6ff8b904db006b130432371064be7205a6
SHA512 d3f91ff192a1077d825e249132eb9b5dfa090dea7d317c3f0efa6f03165a1b008f0a567d47439f9008d0f61fea125d52775b551722cab5bde0c873a234fb2f07
TLSH
T19B71650A21D14E3104310965F5B56859DB98C3A73B3A45E4F65F2C0FBFA3C1B28B7392
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/zh-Hant/Eula.rtf

SHA256 d7d3cfbe65fe62dfa343827811a8071ec54f68d72695c82bec9d9037d4b4d27a
MD5 6f2f198b6d2f11c0cbce4541900bf75c
SHA1 75ec16813d55aaf41d4d6e3c8d4948e548996d96
SHA512 b1f5b812182c7a8bf1c1a8d0f616b44b0896f2ac455afee56c44522b458a8638f5c18200a8fb23b56dc1471e5ab7c66be1be9b794e12ec06f44beea4d9d03d6f
SSDEEP 96:/R8NRf8TTVKTu4LuTu4LrzZD41raZM4HbegdxqKZJQ1/FSMZJujgzc/MpD1JzIf2:/R4Rfm2NBZMjOfro2n6CA2
TLSH
T1E4D125D97C78EB990A90590E8A1AE0D93EBD0067DD7BB026DD5F21534C6F09ED9C3890
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/DotNetFX40/zh-Hant/Package.xml

SHA256 08e9c44e59bf188aa6fe025d40dac45c7f6966c68c66a0628109a0966a2d7c90
MD5 ee94ef2fc389ab8d0187fe352c734353
SHA1 66ebc99235d5786a118669acd271314386a13010
SHA512 13ea68f4a9084fbc1d3ec063030cfdb0c09be5d2bce629c1f57148f2acbdac59b2be64a63730befcdd6fd024d94d969c08eea3e80c99b5e0ba269c5b865faefc
TLSH
T1E671650A61D10E3104310959F9B5584ADBA983A7363A45E4F64F6C0FBFF7C1728B77A2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/WindowsInstaller3_1/Product.xml

SHA256 3c7a555f739af17354f99b37de52713049fa418903ecb3906edd2fed2e823357
MD5 714155685531a92e60039a90d68a8338
SHA1 a21c049cc120f86ece8d08c1d4cd30d168676bf6
SHA512 15d051890c15328fcfd7181d53de0dba59ee6a08ecce761662f2626a14522e39c8a097dd5e32644f0e893a64532523abbc3f09f0924171a3e69ede71eeb78b65
TLSH
T19441334AA1E59C315171062E12BE5C4AEED8121704268A68F21D6E4F7FB389735F73B3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/WindowsInstaller3_1/WindowsInstaller-KB893803-v2-x86.exe

IMPHASH f676e16c67a815430fbcd6d520ece6e4
SHA256 69b61b2c00323cea3686315617d0f452e205dae10c47e02cbe1ea96fea38f582
MD5 342f79337765760ad4e392eb67d5ed2c
SHA1 8318455b36ba0a748307459279d46f2f4cdb5a0e
SHA512 70f32d415c70a97eecf0280ee9e6b10db8f367eecfedd92fca6155a7db19a776d2a96d5fcdbde847036f4d7cf2e69b1d6df6c073025582097f28c71f607b7e12
SSDEEP 49152:nKiC/rk62xWNol+5gOsLO66qJ6021cJjLtk4pWGNG5VGFPNqJyoTL:orZ23AbsK6Ro022JjL2WEiVqJZL
TLSH
T1FEC533450756A909E024017D9C832B9A3D67A4657F37AFB7A5CB042C6D38382FD2AF4F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

02:b7:21:1e:39:9a:28:2f:be:ca:b5:cc:b9:f9:79:df:cd:15:97:7f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 4, 2005

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 23, 2002 - Sep 25, 2011

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:05:87:58:00:03:00:00:00:5a

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 5, 2005 - Apr 5, 2006

Minor OS version

0

Major OS version

6

Entry point

24066

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

E:\PkgInstaller\base\ntsetup\SrvPack.Main\tools\sfxcab\sfxcab\objfre\i386\sfxcab.pdb

msvcrt

strncpy toupper sprintf strchr _strnicmp _stricmp strrchr _strcmpi strstr _strlwr _snprintf

advapi32

InitiateSystemShutdownA InitializeSecurityDescriptor InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl CryptAcquireContextA CryptGenRandom CryptReleaseContext AllocateAndInitializeSid OpenProcessToken GetTokenInformation GetLengthSid

kernel32

ExpandEnvironmentStringsA CreateProcessA GetExitCodeProcess GetFileSize CreateThread CreateEventA GetProcessHeap InitializeCriticalSectionAndSpinCount MoveFileA ReadFile SetFilePointer MoveFileExA RemoveDirectoryA GetLastError CreateDirectoryA GetTickCount SetErrorMode FreeLibrary GetProcAddress LoadLibraryA GetSystemDirectoryA CloseHandle DeviceIoControl CreateFileA GetDriveTypeA HeapFree FormatMessageA LeaveCriticalSection DeleteFileA EnterCriticalSection TerminateProcess WaitForMultipleObjects CreateEventW SetEvent Sleep SetEnvironmentVariableA GetEnvironmentVariableA WideCharToMultiByte HeapAlloc SetLastError WriteFile DosDateTimeToFileTime ExitProcess DeleteCriticalSection FlushFileBuffers GetVersionExA WaitForSingleObject OpenEventA GetCurrentProcess GetFileAttributesA GetCommandLineA GetModuleFileNameA FindClose FindNextFileA FindFirstFileA CopyFileA SetFileAttributesA SystemTimeToFileTime GetSystemTime GetDiskFreeSpaceA QueryDosDeviceA GetCurrentDirectoryA SetEndOfFile SetFileTime LocalFileTimeToFileTime

user32

ShowWindow SendDlgItemMessageA SendMessageA DialogBoxParamA MessageBoxA SetParent LoadStringA EndDialog

ntdll

NtOpenProcessToken NtAdjustPrivilegesToken NtClose NtShutdownSystem

comctl32

ord17

shell32

SHBrowseForFolderA SHGetPathFromIDListA

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

Prerequisites/WindowsInstaller3_1/en/Package.xml

SHA256 c8a91a0f8dad4a9f44183843cf2ac046b6396c3271216dd839eb6d339b711aaf
MD5 ef144a65c40e2f53178b4541cfa20191
SHA1 4c984f7d1f7acf30ae9de623a25aaeb80a36f11d
SHA512 c2597df922cafde936f66ed3cf1739b3230bae3b99fe61de413b181b75b66dd7e397d7a17e98071f79bddbed8d23a715d82617437fcc11af59a6c9d93cf01974
TLSH
T1B421334963A18F222630056D6DAB2C2ED52651BF317702F8F49F405B6F748571B33BE6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/WindowsInstaller3_1/en/eula.txt

SHA256 ee36cea54dadc1dadc92959d6068bcabad59f246f6f5b9ded6c839103ed42c3f
MD5 2daaecb685870abe0efe7ee5cf37138e
SHA1 c66839209e1c5f60ef5b3d2dfdbfa76da37840d3
SHA512 bcdb33cbb55335556a09a9e31137ed33f0a0faa1ca1308eaca83b54d46a165e858cbe7fb1d373232f21a1be17a523a9b4e918ce1c616fdca22662a244fd48728
SSDEEP 96:cnaLc6UeObVVUrkMEJamRq3rTvThTqTrBC/ZW5/B7Ve3CleGHf3PhLhODVDPMFtd:cheqkrqJ1q31Zw/BJL9ffhVHhbtVV
TLSH
T1CA81997FF24927F2314608A11BD92DC6FAA890FA79971D00107650DD1773928C7FB9E9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Prerequisites/vc12_cpp_redist_x86/en/package.xml

SHA256 6cddc5cb0d963ef7c459d2c5fff9532846ae1cc4b02c397f6c17074e9f514baa
MD5 47c89075fcfa7df9a7ea679c8faf0ad1
SHA1 10f21c4809d6311cefce24e4ec15635a01e3a95b
SHA512 aacc69609a382a8d02d3e6a329dcc97bc047e3594b5ca1e1f12d68e48e7353d32aeec419355f66fc7c005bfd979fb019dd96169ca5a2e409f49f99e3b3001734
TLSH
T1AE21EE2D90970B904430046A68D9181EC61142FF22FB0AF8F08E002BAB74DC75777FAF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/vc12_cpp_redist_x86/product.xml

SHA256 9939fe948324c05fb06f0734803b119bca5382241718ebf5852d9fa1264ddd8c
MD5 66466dd5ff6dedd3f49a8a2a1f975d2f
SHA1 ef308b6391d8ade1252468917808c292d98b5630
SHA512 f31951847583817098db6f0e93b1d951e5464a46e02eb002cc2fd92935c430b5efcac71ce788fba1ecf9a954e3bb6137eca71bc8ae2e58f049a8cb7a042ce826
TLSH
T18D31FE0692E64A322170053A76B79C4DEF90931712359A90B05E5D8F7FB2C6628EB3B6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Prerequisites/vc12_cpp_redist_x86/vcredist_x86.exe

IMPHASH dcbe94b8cc54b8e53867c61cc96811d6
SHA256 a22895e55b26202eae166838edbe2ea6aad00d7ea600c11f8a31ede5cbce2048
MD5 0fc525b6b7b96a87523daa7a0013c69d
SHA1 df7f0a73bfa077e483e51bfb97f5e2eceedfb6a3
SHA512 729251371ed208898430040fe48cabd286a5671bd7f472a30e9021b68f73b2d49d85a0879920232426b139520f7e21321ba92646985216bf2f733c64e014a71d
SSDEEP 98304:hQEKzHx15bWUuBrNatjJh2eNUrzKRL/RaIswn7aBOC5qZxVqFb2iExMc7FvxwGvf:WRDnuBotjJh2emr8L/YIsG7MOgqHG64
TLSH
T13566233296642033D6F10873F469E2217E3E721C2F1188BAD294DC5D3EA95DAA7F7352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

3f:c4:25:81:d5:e9:9a:60:b6:34:e2:5c:4c:27:94:7c:7d:b2:b0:62:45:49:72:9f:27:6e:3a:f5:b9:e7:7f:bd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 1, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

PE Signature issue

Digest

85:c8:56:1b:b1:ff:1a:0a:28:75:4d:7c:00:d4:94:b5:a4:ea:82:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 1, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 22, 2014 - Jul 22, 2015

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Apr 3, 2007 - Apr 3, 2021

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 24, 2013 - Dec 24, 2014

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:31C5-30BA-7C91,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:2b:72:aa:2e:f6:49:bb:ec:d7:00:00:00:00:00:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 27, 2013 - Jun 27, 2014

Minor OS version

1

Major OS version

5

Entry point

163358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\delivery\Dev\wix37\build\ship\x86\burn.pdb

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegDeleteValueW RegQueryValueExW GetUserNameW InitiateSystemShutdownExW CreateWellKnownSid InitializeAcl SetEntriesInAclW DecryptFileW ChangeServiceConfigW ControlService CloseServiceHandle QueryServiceStatus OpenServiceW OpenSCManagerW CryptAcquireContextW CryptCreateHash CryptHashData CryptGetHashParam CryptDestroyHash CryptReleaseContext RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetValueExW SetEntriesInAclA SetSecurityDescriptorGroup RegOpenKeyExW GetTokenInformation CheckTokenMembership AllocateAndInitializeSid FreeSid LookupAccountNameW SetNamedSecurityInfoW InitializeSecurityDescriptor SetSecurityDescriptorDacl SetSecurityDescriptorOwner QueryServiceConfigW

user32

GetMessageW PeekMessageW PostMessageW PostThreadMessageW PostQuitMessage SetWindowLongW DefWindowProcW UnregisterClassW DispatchMessageW TranslateMessage GetMonitorInfoW IsDialogMessageW MessageBoxW GetWindowLongW RegisterClassW IsWindow MsgWaitForMultipleObjects WaitForInputIdle LoadCursorW LoadBitmapW GetCursorPos MonitorFromPoint CreateWindowExW

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdi32

DeleteObject GetObjectW CreateCompatibleDC SelectObject DeleteDC StretchBlt

shell32

ShellExecuteExW SHGetFolderPathW CommandLineToArgvW

ole32

CoTaskMemFree CoInitializeSecurity CLSIDFromProgID CoCreateInstance CoInitialize StringFromGUID2 CoInitializeEx CoUninitialize

kernel32

ReadFile SetFilePointerEx CreateFileW GetCurrentProcessId GetProcessId WriteFile ConnectNamedPipe SetNamedPipeHandleState lstrlenW CompareStringW LocalFree CreateNamedPipeW WaitForSingleObject OpenProcess lstrlenA RemoveDirectoryW GetFileAttributesW ExpandEnvironmentStringsW LeaveCriticalSection EnterCriticalSection FreeLibrary GetProcAddress VerifyVersionInfoW VerSetConditionMask GetComputerNameW GetTempPathW GetSystemDirectoryW GetSystemWow64DirectoryW GetVolumePathNameW GetWindowsDirectoryW GetSystemDefaultLangID RtlUnwind GetDateFormatW GetSystemTime InterlockedExchange LoadLibraryW InterlockedCompareExchange GetExitCodeThread CreateThread SetEvent WaitForMultipleObjects CreateEventW ProcessIdToSessionId InterlockedIncrement InterlockedDecrement GetStringTypeW GetModuleHandleW FindClose FindNextFileW FindFirstFileW CreateProcessW SetCurrentDirectoryW GetCurrentDirectoryW GetExitCodeProcess DuplicateHandle SetThreadExecutionState CopyFileExW UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateMutexW SetEndOfFile ResetEvent SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CreateFileA CompareStringA GetSystemTimeAsFileTime VirtualFree VirtualAlloc DeleteFileW GetThreadLocale GetVersionExW GetCurrentThreadId TlsAlloc TlsSetValue ReleaseMutex GetLastError Sleep TlsGetValue CloseHandle DeleteCriticalSection GetTimeZoneInformation GetACP GetCPInfo RaiseException HeapAlloc HeapFree IsDebuggerPresent UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent SystemTimeToTzSpecificLocalTime SystemTimeToFileTime GlobalAlloc GlobalFree SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode TlsFree InitializeCriticalSection GetCurrentProcess HeapSetInformation GetOEMCP SetFileAttributesW IsValidCodePage HeapSize HeapReAlloc LCMapStringW MultiByteToWideChar SetStdHandle WriteConsoleW FlushFileBuffers GetLocalTime FormatMessageW GetTempFileNameW GetFullPathNameW CreateDirectoryW GetProcessHeap GetModuleHandleA GetFileSizeEx GetUserDefaultLangID GetTickCount QueryPerformanceCounter HeapCreate SetLastError EncodePointer GetFileType InitializeCriticalSectionAndSpinCount SetHandleCount GetEnvironmentStringsW MoveFileExW FreeEnvironmentStringsW GetModuleFileNameW GetStdHandle DecodePointer GetCommandLineW GetStartupInfoW SetUnhandledExceptionFilter ExitProcess CopyFileW

cabinet

ord23 ord22 ord20

crypt32

CryptHashPublicKeyInfo CertGetCertificateContextProperty

msi

ord116 ord17 ord125 ord171 ord8 ord115 ord118 ord205 ord45 ord137 ord141 ord238 ord190 ord88 ord90 ord173 ord111 ord70 ord169

rpcrt4

UuidCreate

wininet

InternetCrackUrlW HttpQueryInfoW InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetErrorDlg InternetReadFile HttpSendRequestW InternetSetOptionW InternetConnectW InternetOpenW

wintrust

CryptCATAdminCalcHashFromFileHandle WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Name

.text

Size

227KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Prerequisites/vc14_cpp_redist_x86/VC_redist.x86.exe

IMPHASH 1a5cdbf711fee14b077e599d13fddab2
SHA256 b7ae307237f869e09f7413691a2cd1944357b5cee28049c0a0d3430b47bb3edc
MD5 d3b594464f2312cde31af3f2aa516f9e
SHA1 15fe8e70c3c5582b70df173cd9b580331677735a
SHA512 ccb19250b90eb629c35a897aba6d0ab16402305d9ec16b97b902fc810cde5d215cf8149a273cc8f8cae5a4b0665b116c085fe3b01a3ab3860c44f20ca95d6e83
SSDEEP 393216:7/H+lptVYmfr7yBG/4tWp4uXK63Ntq+qS:7/upttD7yBG/cy4Aq+qS
TLSH
T164D63333B498843AD7F30533E964FA246E3DA128130089BBE6DCEC5E5B7415227FB656
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

52:61:7f:94:d1:79:d0:e6:e5:5c:43:ba:af:6f:fb:82:a6:64:a2:93:20:a5:8c:00:ba:11:cd:cf:00:70:ef:89

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jan 5, 2022

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

1

Major OS version

5

Entry point

188525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

C:\agent\_work\8\s\build\ship\x86\burn.pdb

advapi32

RegCloseKey RegOpenKeyExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW InitiateSystemShutdownExW GetUserNameW RegQueryValueExW RegDeleteValueW ConvertStringSecurityDescriptorToSecurityDescriptorW DecryptFileW CreateWellKnownSid InitializeAcl SetEntriesInAclW ChangeServiceConfigW CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatus SetNamedSecurityInfoW CheckTokenMembership AllocateAndInitializeSid SetEntriesInAclA SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorDacl InitializeSecurityDescriptor RegSetValueExW RegQueryInfoKeyW RegEnumValueW RegEnumKeyExW RegDeleteKeyW RegCreateKeyExW GetTokenInformation CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW QueryServiceConfigW

user32

GetMessageW PostMessageW IsWindow WaitForInputIdle PostQuitMessage PeekMessageW MsgWaitForMultipleObjects PostThreadMessageW GetMonitorInfoW MonitorFromPoint IsDialogMessageW LoadCursorW LoadBitmapW SetWindowLongW GetWindowLongW GetCursorPos MessageBoxW CreateWindowExW UnregisterClassW RegisterClassW DefWindowProcW DispatchMessageW TranslateMessage

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

gdi32

CreateCompatibleDC DeleteObject SelectObject StretchBlt GetObjectW DeleteDC

shell32

SHGetFolderPathW CommandLineToArgvW ShellExecuteExW

ole32

CoUninitialize CoInitializeEx CoInitialize StringFromGUID2 CoCreateInstance CoTaskMemFree CoInitializeSecurity CLSIDFromProgID

kernel32

GetCommandLineA GetCPInfo GetOEMCP CloseHandle CreateFileW GetProcAddress LocalFree HeapSetInformation GetLastError GetModuleHandleW FormatMessageW lstrlenA lstrlenW MultiByteToWideChar WideCharToMultiByte LCMapStringW Sleep GetLocalTime GetModuleFileNameW ExpandEnvironmentStringsW GetTempPathW GetTempFileNameW CreateDirectoryW GetFullPathNameW CompareStringW GetCurrentProcessId WriteFile SetFilePointer LoadLibraryW GetSystemDirectoryW CreateFileA HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap FindClose GetCommandLineW GetCurrentDirectoryW RemoveDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW FindFirstFileW FindNextFileW MoveFileExW GetCurrentProcess GetCurrentThreadId InitializeCriticalSection DeleteCriticalSection ReleaseMutex GetEnvironmentStringsW TlsGetValue TlsSetValue TlsFree CreateProcessW GetVersionExW VerSetConditionMask FreeLibrary EnterCriticalSection LeaveCriticalSection GetSystemTime GetNativeSystemInfo GetModuleHandleExW GetWindowsDirectoryW GetSystemWow64DirectoryW GetComputerNameW VerifyVersionInfoW GetVolumePathNameW GetDateFormatW GetSystemDefaultLangID GetUserDefaultLangID GetStringTypeW ReadFile SetFilePointerEx DuplicateHandle InterlockedExchange InterlockedCompareExchange CreateEventW ProcessIdToSessionId OpenProcess GetProcessId WaitForSingleObject ConnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW CreateThread GetExitCodeThread SetEvent WaitForMultipleObjects InterlockedIncrement InterlockedDecrement ResetEvent SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime CompareStringA GetExitCodeProcess SetThreadExecutionState CopyFileExW MapViewOfFile UnmapViewOfFile CreateMutexW CreateFileMappingW GetThreadLocale IsValidCodePage FreeEnvironmentStringsW TlsAlloc SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers DecodePointer WriteConsoleW GetModuleHandleA GlobalAlloc GlobalFree GetFileSizeEx CopyFileW VirtualAlloc VirtualFree SystemTimeToTzSpecificLocalTime GetTimeZoneInformation SystemTimeToFileTime GetSystemInfo VirtualProtect VirtualQuery SetCurrentDirectoryW FindFirstFileExW GetFileType GetACP ExitProcess GetStdHandle LoadLibraryExW InitializeCriticalSectionAndSpinCount UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind SetLastError LoadLibraryExA

rpcrt4

UuidCreate

Name

.text

Size

294KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

123KB

Virtual Size

122KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wixburn

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

UpdatePersistorsInstalledLocalToApplication.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 33eafdc63adad8ca65da1787cb92a472e3ec27ec50826061caad30ae0024bdb3
MD5 70438249103b0e89f1535ef1396affe7
SHA1 2b0478d480037c896b0356d144ec17be38d6a6ca
SHA512 7dc1a6be6d1dec294719d5c46b2b2c643955f93c6a988636b37dc2e5915c571c61c644d42b06878b3491c282847642c437943e79ec61c0821e8e60a4a187358d
SSDEEP 768:e+q93oETTfvzc4LnmzxHW85PPzYcHe+m:1qBn0z5PO+
TLSH
T18E2396ADADFC8277D5B5E5B98FE886A3B460D06B34109D3A69874246073390278C7E3D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

51014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dev\j\workspace\P\CS\Persistors\Release\Implementation\InstallApp\SetupCANdelaPersistors\UpdatePersistors\obj\x86\Release\UpdatePersistorsInstalledLocalToApplication.pdb

setup.exe

IMPHASH f08b6b36b9c71b1984c0909344f25b16
SHA256 43ea877eb1d694dd481c131a97c4ef817a43d0674efc656b9d65ec80fd3ba48d
MD5 7c9ecb5c0f52ee75c97033aac0f8c811
SHA1 13bc05aa2212906eabb9bba0538c0d203d575cbc
SHA512 54e8d875d9b5290965e2ec525349e3111d9f048c155fe811cfc2d840b8fdb6cfe6f199c182a187f52549e80435bd1a9b9b3d8db59c9c8e55a70d33671161c477
SSDEEP 3072:+Jkiir+E4CC5FrPxzHImYRNxbfMIJ5vFJLx/3lQ122rs:+tRE4CC39U5RN5fzJ5NDVQ4+s
TLSH
T1FD148C257281C033E5A725318DF5C7BA5A39B8131B75A8CF6BC40ABE4F256D2D73231A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

c6:89:b0:1d:a3:91:19:3d:fa:5e:51:83:fe:20:d3:b7:38:5d:14:54:7b:3a:43:3d:b1:8e:54:5d:84:6f:9b:9f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Chains

Nov 20, 2023

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=Vector Informatik GmbH,O=Vector Informatik GmbH,L=Stuttgart,C=DE

Serial Number

02:d9:91:bd:4c:d8:39:77:63:df:d4:41:01:10:a6:ad

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 8, 2020 - Dec 6, 2023

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

1

Major OS version

5

Entry point

59831

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dev\j\workspace\C\MSICH\Release\Implementation\Bin\Release\setup.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

GetExitCodeProcess CloseHandle GetLastError FormatMessageW LocalFree GetCurrentProcess Sleep VerSetConditionMask WaitForSingleObject GetCommandLineW CreateFileW SetStdHandle WriteConsoleW HeapReAlloc IsValidLocale CreateProcessW GetSystemDirectoryW GetTempPathW GetModuleFileNameW GetFileAttributesW SetEndOfFile GetProcessHeap CompareStringW VerifyVersionInfoW HeapSetInformation EnumSystemLocalesA GetLocaleInfoA InterlockedIncrement InterlockedDecrement WideCharToMultiByte InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetProcAddress GetModuleHandleW ExitProcess GetCPInfo HeapFree SetEnvironmentVariableA GetStartupInfoW RaiseException RtlUnwind HeapAlloc LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetTimeZoneInformation InitializeCriticalSectionAndSpinCount LoadLibraryW GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId WriteFile GetStdHandle SetHandleCount GetFileType GetConsoleCP GetConsoleMode IsProcessorFeaturePresent SetFilePointer ReadFile FlushFileBuffers HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId HeapSize GetACP GetOEMCP IsValidCodePage GetUserDefaultLCID

user32

MessageBoxW ExitWindowsEx WaitForInputIdle LoadCursorW SetCursor

advapi32

RegSetValueExW RegOpenKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegDeleteValueW

shell32

CommandLineToArgvW

Sharing

General

Malware Config

Signatures

File Explorer

CANdelaPersistors20 (1).exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

CANdelaPersistors20.msi

MSIChainer.exe

mscoree

dotnet

MSIChainer.ini

Prerequisites/DotNetFX40/Product.xml

Prerequisites/DotNetFX40/cs/Eula.rtf

Prerequisites/DotNetFX40/cs/Package.xml

Prerequisites/DotNetFX40/de/Eula.rtf

Prerequisites/DotNetFX40/de/Package.xml

Prerequisites/DotNetFX40/dotNetFx40_Full_x86_x64.exe

PE Signature issue

advapi32

kernel32

comctl32

rpcrt4

shell32

shlwapi

user32

cabinet

oleaut32

version

generic

Prerequisites/DotNetFX40/en/Eula.rtf

Prerequisites/DotNetFX40/en/Package.xml

Prerequisites/DotNetFX40/es/Eula.rtf

Prerequisites/DotNetFX40/es/Package.xml

Prerequisites/DotNetFX40/fr/Eula.rtf

Prerequisites/DotNetFX40/fr/Package.xml

Prerequisites/DotNetFX40/it/Eula.rtf

Prerequisites/DotNetFX40/it/Package.xml

Prerequisites/DotNetFX40/ja/Eula.rtf

Prerequisites/DotNetFX40/ja/Package.xml

Prerequisites/DotNetFX40/ko/Eula.rtf

Prerequisites/DotNetFX40/ko/Package.xml

Prerequisites/DotNetFX40/pl/Eula.rtf

Prerequisites/DotNetFX40/pl/Package.xml

Prerequisites/DotNetFX40/pt-BR/Eula.rtf

Prerequisites/DotNetFX40/pt-BR/Package.xml

Prerequisites/DotNetFX40/ru/Eula.rtf

Prerequisites/DotNetFX40/ru/Package.xml

Prerequisites/DotNetFX40/tr/Eula.rtf

Prerequisites/DotNetFX40/tr/Package.xml

Prerequisites/DotNetFX40/zh-Hans/Eula.rtf

Prerequisites/DotNetFX40/zh-Hans/Package.xml

Prerequisites/DotNetFX40/zh-Hant/Eula.rtf

Prerequisites/DotNetFX40/zh-Hant/Package.xml

Prerequisites/WindowsInstaller3_1/Product.xml

Prerequisites/WindowsInstaller3_1/WindowsInstaller-KB893803-v2-x86.exe

PE Signature issue

msvcrt

advapi32

kernel32

user32

ntdll

comctl32

shell32

version

generic

Prerequisites/WindowsInstaller3_1/en/Package.xml

Prerequisites/WindowsInstaller3_1/en/eula.txt

Prerequisites/vc12_cpp_redist_x86/en/package.xml

Prerequisites/vc12_cpp_redist_x86/product.xml

Prerequisites/vc12_cpp_redist_x86/vcredist_x86.exe

PE Signature issue