sylteditor-1[.]1[.]5108[.]exe

resource
sylteditor-1.1.5108.exe
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/SYLTEditor.exe
unpack001/syltexport.exe
unpack001/syltimport.exe
unpack001/uninstall.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

sylteditor-1.1.5108.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 015ef96b7c7adbdebf5acdd0e164cbf56f1d4861c1f15f189d43576d909ccd13
MD5 6343f3b834025c92d13615811d611d25
SHA1 972c3a835fc66c0c1e8ccbcb7c91e579105842d7
SHA512 155997282dda6fe1d20309b0a81e2764de64807ed3ff06ba2690ad6794d43dc3660721a26c797c96c4171411960c6614717a97e8ee5fca3340f3511868b749de
SSDEEP 12288:E/kQA23YIO7x3r+OkGzzo+5eO7PyDgQecEl+WialSAoYVnGSu1:hQL9O7tKOkMo+M43EhiVn1u1
TLSH
T11CF43316A7C4D5C7D81306394D7B0361BB7EF843E6A93BB357823FA3095501B26892EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 0abe69e25e90a335939f7a73ae438ce3c925cb4ba945e51e47ca09cf62940f7f
MD5 c0afafb9c5d770ce3d3848c8df42c5bf
SHA1 87181391bf6afb27f38e20cd4a7541562b75d244
SHA512 4d4f671ce29bb7c8e133746d2a480bd2a209da1036d500204695b6d6656eb9a765eb715fd9feb65d9129eae17ec0b7d1da7b29c963da80124fd3fae389036a94
SSDEEP 24:SVlOq/XguMQ6SrzbKJXhitQidODzWfIlB/qpUQaD:XrQ6S7KR9idazZlNSCD
TLSH
T153F132152A33C33A8832013AE4460AFC35296C3CF74602B71629FDECB7FA3171949AD8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

SYLTEditor.exe

IMPHASH da60e499d5da40d6cf723b1e5beefbbe
SHA256 c43c097ec0f5a259d9991e6c87cec0441e3dc9c20be31fa7ee3612b79a926546
MD5 d5a11e317d3e8c6ba41992375e6c1734
SHA1 c0c3e1e8a7150aa9cdbdd923e5014c8cdd0ee699
SHA512 0ea1a3617e0937cd174c1675594420f6d97a501dea5e6fccf927d09decba69df2d0aabd7cd726740cd4a7c78a3f7accba0b9a9d6511e8170c89d3ac5b96a2f32
SSDEEP 24576:AXGvdqPUb3mo3a6ax28EXLy7JOhxnwNejo9kTKdjg+6iiMIsTkEolXq:+sMUKKwwo9kOdjKJsTYlXq
TLSH
T1D8857DA47BDBC1F6EA4621B90C369B0D457E76924B385AE7B35C2D0E0B227D07C36316
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

898975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Products\SyltEditor\bin\SYLTEditor.pdb

kernel32

HeapCreate LCMapStringW LCMapStringA SetHandleCount GetOEMCP IsDebuggerPresent SetFilePointer FlushFileBuffers GetConsoleCP SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime MoveFileW GetFullPathNameW DeleteFileW SetStdHandle HeapReAlloc RtlUnwind GetStartupInfoA GetCommandLineA CreateDirectoryW HeapAlloc HeapFree WriteConsoleW DeleteFileA MoveFileA VirtualFree VirtualAlloc GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetModuleHandleA LoadLibraryA InitializeCriticalSectionAndSpinCount GetCurrentDirectoryA GetDriveTypeA CreateFileA GetTimeFormatA GetDateFormatA WriteConsoleA GetConsoleOutputCP GetLocaleInfoA EnumSystemLocalesA GetStringTypeA GetStringTypeW CompareStringW SetEnvironmentVariableA SetEndOfFile CompareStringA MulDiv GetProcessHeap HeapSize GlobalFree GlobalSize GlobalAlloc GlobalUnlock GlobalLock LocalAlloc SetLastError GetCommandLineW SetErrorMode RaiseException ExpandEnvironmentStringsW FreeLibrary TerminateProcess SetEnvironmentVariableW GetModuleHandleW IsValidCodePage GetCPInfo GetCurrentProcessId GetEnvironmentVariableW GetThreadLocale GetTimeZoneInformation GetLocaleInfoW IsValidLocale GetUserDefaultLCID GetACP OutputDebugStringW GetStdHandle FormatMessageW LocalFree ExitProcess GetProcAddress TlsAlloc TlsSetValue TlsFree TlsGetValue InterlockedDecrement InterlockedIncrement LoadLibraryW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection GetCurrentProcess DuplicateHandle CreateProcessW CreateThread ResumeThread Sleep WaitForSingleObject GetExitCodeProcess SetNamedPipeHandleState PeekNamedPipe CreatePipe WriteFile ReadFile GetTempFileNameW FindFirstFileW FindClose GetTempPathW GetLastError MultiByteToWideChar WideCharToMultiByte GetVersionExW GetModuleFileNameW CreateFileW CloseHandle GetWindowsDirectoryW SetCurrentDirectoryW CopyFileW GetFileAttributesW GetConsoleMode GetFileType

user32

GetForegroundWindow GetMenuStringW DefMDIChildProcW TranslateMDISysAccel ChildWindowFromPoint DrawStateW DrawEdge UnionRect GetWindowDC TranslateAcceleratorW CreateAcceleratorTableW DestroyAcceleratorTable GetMessagePos MapWindowPoints DestroyCursor DrawIconEx DrawFrameControl GetWindowTextW GetClassNameW ValidateRect GetMessageW KillTimer SetTimer GetUpdateRect BeginPaint DrawIcon EndPaint SetMenu SetForegroundWindow OffsetRect ShowCursor CopyRect DrawTextW InsertMenuItemW GetSubMenu CreateMenu AppendMenuW InsertMenuW RemoveMenu DestroyMenu CreatePopupMenu SetMenuItemInfoW LoadImageW DestroyIcon LoadBitmapW LoadIconW SendMessageW DefWindowProcW DestroyWindow WaitForInputIdle GetDlgItem CreateDialogParamW ModifyMenuW CheckMenuRadioItem CheckMenuItem GetMenuState InflateRect GetUpdateRgn IsDialogMessageW TrackPopupMenu IsWindow PtInRect GetCapture UnregisterHotKey RegisterHotKey ChangeDisplaySettingsW EnumDisplaySettingsW RegisterClipboardFormatW SetClipboardData SetActiveWindow DrawFocusRect PostThreadMessageW MessageBoxW PeekMessageW CreateWindowExW MessageBeep RegisterClassW PostMessageW DdeFreeStringHandle DdeQueryStringW DdeUninitialize DdeFreeDataHandle SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetActiveWindow GetMenuItemCount GetMenuItemInfoW GetMessageTime GetWindow BeginDeferWindowPos EndDeferWindowPos InvalidateRect GetFocus IsWindowEnabled IsWindowVisible CallWindowProcW DeferWindowPos ClientToScreen ScreenToClient UpdateWindow RedrawWindow SetParent GetCursorPos WindowFromPoint GetParent ScrollWindow SetScrollInfo GetScrollInfo SetCursorPos ReleaseCapture SetCapture EnableWindow SetFocus FillRect GetAsyncKeyState VkKeyScanW DispatchMessageW TranslateMessage PostQuitMessage GetWindowTextLengthW HideCaret OpenClipboard IsClipboardFormatAvailable CloseClipboard keybd_event CreateDialogIndirectParamW MoveWindow SetWindowTextW FlashWindow SetWindowRgn GetClientRect GetMenu AdjustWindowRectEx GetSystemMenu EnableMenuItem DrawMenuBar GetWindowLongW SetWindowLongW GetDesktopWindow SetWindowPos IsIconic IsZoomed ShowWindow BringWindowToTop GetWindowRect CreateIconIndirect GetIconInfo GetSysColor SystemParametersInfoW GetSystemMetrics ReleaseDC GetDC UnregisterClassW GetKeyState LoadCursorW SetCursor DdePostAdvise DdeConnect DdeNameService DdeCreateStringHandleW DdeClientTransaction DdeDisconnect DdeInitializeW DdeGetLastError DdeCreateDataHandle DdeGetData DefFrameProcW

gdi32

PatBlt Ellipse SetBrushOrgEx MaskBlt StretchBlt StretchDIBits ExtCreatePen GetNearestPaletteIndex CreatePalette CreateDIBSection GetDIBits CreateDIBitmap GetDIBColorTable GetRgnBox EqualRgn PtInRegion RectInRegion CombineRgn RestoreDC SaveDC CreateRectRgnIndirect SetTextAlign CreateICW EnumFontFamiliesExW GetSystemPaletteEntries GetEnhMetaFileW GetTextColor DeleteEnhMetaFile RoundRect SetAbortProc EndDoc StartPage EndPage StartDocW CreateDCW GetBkColor SetMapMode SetViewportExtEx SetWindowExtEx SetViewportOrgEx SetWindowOrgEx GetTextExtentExPointW CreateFontIndirectW DeleteObject GetDeviceCaps GetObjectW GetStockObject GetPaletteEntries CreateCompatibleDC DeleteDC LineTo MoveToEx SetROP2 TextOutW PolyBezier Polyline SetPixel GetPixel ExtFloodFill ExtSelectClipRgn GetClipBox SetStretchBltMode Rectangle PolyPolygon SetPolyFillMode Polygon Pie Arc SelectClipRgn SelectObject BitBlt CreateCompatibleBitmap CreateBitmap SetBkColor SetTextColor SetBkMode OffsetRgn ExtCreateRegion GetRegionData GetTextMetricsW GdiFlush RealizePalette SelectPalette GetTextExtentPoint32W CreateRectRgn ExcludeClipRect CreatePen CreateSolidBrush CreateHatchBrush CopyEnhMetaFileW GetCharABCWidthsW CreatePatternBrush

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

shell32

ExtractIconW DragQueryFileW DragQueryPoint DragFinish DragAcceptFiles ShellExecuteExW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc ExtractIconExW

ole32

ReleaseStgMedium OleFlushClipboard OleIsCurrentClipboard OleSetClipboard RevokeDragDrop OleGetClipboard CoLockObjectExternal RegisterDragDrop OleInitialize OleUninitialize CoCreateInstance OleLockRunning OleRun OleSetContainedObject

oleaut32

SysAllocString SysStringLen SysFreeString SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate DosDateTimeToVariantTime VariantTimeToSystemTime

comdlg32

PrintDlgW ChooseFontW ChooseColorW GetSaveFileNameW GetOpenFileNameW CommDlgExtendedError PageSetupDlgW

comctl32

ord16 ImageList_GetImageCount ImageList_Create ImageList_GetIconSize CreateStatusWindowW ord17 ImageList_Destroy ImageList_ReplaceIcon ImageList_Add ImageList_EndDrag ImageList_DragMove ImageList_DragEnter ImageList_DragLeave ImageList_SetDragCursorImage ImageList_Draw ImageList_BeginDrag

sylteditor.pdf

SHA256 618198d4dee8bafb738ab4efe585f1886085f36d29f35d3b78c962bb980ee390
MD5 6a738ce3f341ed6ebbde411820dce086
SHA1 3276b0b797af974fc03d71f442cc9e77821fe1b3
SHA512 1da40d63010397b86c6bfbda8d0629c60c5d48d1f5213de8af7440f263676259d1e5f01c368aa1c4d79c1f7efd8dbf1580d58f005fd9bc60a2003bdd89b35680
SSDEEP 1536:HxNSmMtcUGbWcYU6lSPi7+noWFh8YvmiwjopsIwSKNGtY2OvCmOFeuT/wpqKls6h:stKqY6T4/8Sm9j5ZSMiOvjOFeu8pqaO8
TLSH
T158D39E6FF8D558CEE8D2866294B6355CC72DB3676BCD7482287C4F46A380845CB93AC3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Extracted URLs

file http://rKenSaundersofwww.MouseRunner.com
file http://www.compuphase.com

sylteditor.tips

SHA256 c58308d01dbef39d39fa7f689795687cf624a6bd1275a5918d45dc335167724a
MD5 b207280190277e151c23aa65faa42b00
SHA1 41254b4cc057fc20ce6ee5336f0bb43a33d73d0f
SHA512 a56f0f39d5436be5356f2a7720c840b478db280dd96540fff5371d6da8b0accdbb744c0357911a5df28018b09a8893d10ebec8b2b79ac627fc0489b65d78654f
TLSH
T17E61531BB782237207720003534DB7D6F73A957C37669A21E4585110719AC32D9BEEF4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

syltexport.exe

IMPHASH a5ac14ed519f5ae79b08765d4e217f76
SHA256 b4649f9b03f45b04276b645743843d970ebe208bc0feeb5fefe082dc5d3ffc54
MD5 77c71d8a0e9f8fa9bd82cb813e2e2d01
SHA1 2a61fbc8fbae51a6af689acf5489038fe9d552b4
SHA512 b79903ff2a50f8a3bb7d8e52e3c6fd87ec79be64e677033b7dc3fade84a83effab21152c4e4b814d937be8df0399f20c390eea25a01dc8b1b9fe3aa6608507a9
SSDEEP 768:iSe5SuKNJelD4qLORC9WH27xtcnaNOpUtNgCsmGP6IKZ:iSpuKNJ7wORC4SxCaNO2tNgNu
TLSH
T1D7234B2E1D60C276E09241F4101A7BBF2E32FE1170C4D4EBDB919E7AFAB1506E25935D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

11

Major OS version

1

Entry point

13616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE

PDB paths

syltimport.exe

IMPHASH c5a125a98240382963112d91332614b9
SHA256 ae3a24c830868704ce3a31382498a28be7a0b657b6515460f35da6478c689d8d
MD5 ce9d20364f8fdd33dc4f37d77d91add3
SHA1 a0f5fb833152cd4b0700bfac4602ff01943ead28
SHA512 69d0d8e6e365da7a3b3ec7acb06cf8467a05aeae7d86ab307888beaefbe853cfc813cff296d875ae9ff78f75daa9d8c9a0b451f6d869f5a3ce57701f9d717f04
SSDEEP 768:qbxTE88vY+3/fxAT6kNfyOb0k279mj+Dc7ZpnCYGEsQ15bIOHz/1g:t88vYa3xAGkNfyORS9LD0pnxGyztg
TLSH
T14C23491E1E60C272E1A111F41029B7BF2E32FE1171C8C5DBEB91AD7ABEB0102E25975D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

11

Major OS version

1

Entry point

13948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE

PDB paths

uninstall.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 26e781c48bdae3034da956aa56171c5066f6b2e9b03490545a15ba6f3a259d24
MD5 07cb213d60b9ba6ec892da11af35b84e
SHA1 2f99edbfbf939bdc6263f1b25d9e9c3b078a2970
SHA512 d323e6dac6196bce989c5cb1937044846abcf8f0c73d8d55432b8ff338fd9d06b9d0aa2f2ceeeadd54ca817e47a52c60cd82338860b94204b1e7c380ad946012
SSDEEP 768:h1cVhpQI2EQK0iPDh84nScF15GYbWjXO3XJKOx+2Mt5iL:PQpQ5EP0ijnRTXJnx725W
TLSH
T146037D5636C1C8BBE0560A701AB7D77BE7B6A3311F6206476F2C1FBE29111C399192C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/modern-header.bmp

SHA256 0abe69e25e90a335939f7a73ae438ce3c925cb4ba945e51e47ca09cf62940f7f
MD5 c0afafb9c5d770ce3d3848c8df42c5bf
SHA1 87181391bf6afb27f38e20cd4a7541562b75d244
SHA512 4d4f671ce29bb7c8e133746d2a480bd2a209da1036d500204695b6d6656eb9a765eb715fd9feb65d9129eae17ec0b7d1da7b29c963da80124fd3fae389036a94
SSDEEP 24:SVlOq/XguMQ6SrzbKJXhitQidODzWfIlB/qpUQaD:XrQ6S7KR9idazZlNSCD
TLSH
T153F132152A33C33A8832013AE4460AFC35296C3CF74602B71629FDECB7FA3171949AD8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

sylteditor-1.1.5108.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

SYLTEditor.exe

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

comdlg32

comctl32

generic

sylteditor.pdf

Extracted URLs

sylteditor.tips

syltexport.exe

user32

kernel32

generic

syltimport.exe

user32

kernel32

generic

uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/modern-header.bmp