jaffacakes118_1369f48ff4dc39f004d9beff71ca942f7fa4d41f41fecc5edce3ef5af15b4912[.]bin

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	acprotect

resource	yara_rule
static1/unpack001/$PLUGINSDIR/version.dll	upx

resource
jaffacakes118_1369f48ff4dc39f004d9beff71ca942f7fa4d41f41fecc5edce3ef5af15b4912.bin
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/CustomBrandingURL.dll
unpack001/$PLUGINSDIR/CustomNSISdl.dll
unpack001/$PLUGINSDIR/CustomnsWeb.dll
unpack001/$PLUGINSDIR/FloatingProgress.dll
unpack001/$PLUGINSDIR/LuaBridge.dll
unpack001/$PLUGINSDIR/LuaSocket/mime/core.dll
unpack001/$PLUGINSDIR/LuaSocket/socket/core.dll
unpack001/$PLUGINSDIR/LuaXml_lib.dll
unpack001/$PLUGINSDIR/NotifyIcon.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/custominetc.dll
unpack001/$PLUGINSDIR/lua51.dll
unpack001/$PLUGINSDIR/luacom.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/$PLUGINSDIR/un.package.exe
unpack001/$PLUGINSDIR/version.dll
unpack002/out.upx

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

jaffacakes118_1369f48ff4dc39f004d9beff71ca942f7fa4d41f41fecc5edce3ef5af15b4912.bin

SHA256 1369f48ff4dc39f004d9beff71ca942f7fa4d41f41fecc5edce3ef5af15b4912
MD5 829b72f5cd2ec51dcc0aa88ccec32e7c
SHA1 1c43a1caa8da31db71004cc575eb5506e073d1e8
SHA512 12268b42529493e86511caa60e8e14018629e74baaed67d9ae5651c43842d1ae4db9d9e96a95f3fbb8a19d56c94f05064b3b34766d59280c3a69469585fba458
SSDEEP 24576:Kp1FPrXF+CULnf9LrPPc8wmCPVDxgHEOn:KhrkCunf9LrPuVVmkOn
TLSH
T1BB1512167A4CE4C2DA2682369C1FEE664DC17D399B8066DF33E4B36F34B23A5561F042
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/AdvancedTests.lua

SHA256 2329efa4e2e55b1c1f904340e2ec25959251e0e06a46dfacd568967309f7df4e
MD5 638ecd65dbb781f69eced41a905152c7
SHA1 a91d68b67295db8fc761eb983904422e1efcb49f
SHA512 c912fae206a75ad8ab3c7b1ac3ebde826325ec2e8a1678798359b6223229d4340e644b4099a371fc12cbdf9920f4fc64d78a263767d0b6c9372e582f081e4e1f
TLSH
T18171238751C26E741AB2D1D89A8B0089E26051070F2D421EFA9D43903F7775CB6FB6F9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/BrowserControl.lua

SHA256 54b155de7bfeab7b6379f40826c6bfaf85b26b1198461d632ed60a13162e501e
MD5 936e57a91cf066c1aaaacce9242a2d1c
SHA1 951fbe7ddf1a5da5e3e506c1f757267ae0963645
SHA512 d33e1399db4665e074ecbb8f7c35175297e552af2fb17b324203df6e826fd2d4677078143769f97c0ad3131badaf7058294d4705e2e71929b1efdd86590b17ab
TLSH
T1B36175542C0FF8B84D71A1626B4FD859F277015F0159924870E216C42DB03EE76EFAEE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
MD5 fad9d09fc0267e8513b8628e767b2604
SHA1 bea76a7621c07b30ed90bedef4d608a5b9e15300
SHA512 b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
TLSH
T1EF81523B97A026F1C640273B53D71E629B3BD1302316B02D8DD32D0CA93055BEC29743
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomBrandingURL.dll

IMPHASH 82f18b0f522c05f362fb12db10cdf296
SHA256 2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
MD5 e4c1b74859c17671ffe1c0602fd56b44
SHA1 15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
SHA512 9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
SSDEEP 48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
TLSH
T1A7B1FA3A73C645F3D73302326A631967BBB945120352901FD6AB17E9F790D2BC801763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

5236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomNSISdl.dll

IMPHASH e8a575fc69c67b8f92ba9e9cb62af0bf
SHA256 dcee4695192b17a77ca40f63234298fa02326bde2a2a34bab373ac5cc2fc5f48
MD5 bb81b9946ffc1e50b7a052cd00ac2690
SHA1 0deb5a4c1effa39d22e89199dbb1e6695246848f
SHA512 9c1e9fcac43aa41cf6db56557a7d720db52013b78e048ffa821e608868c2bc97d30aa9087047a5faaaed39655759da0d6fd6097f273c30ce51b0f0963c8a739c
SSDEEP 384:kBrBOvI88qsfnZsFTyQ0mipmycAC/hZAOT8pA40PIL1lBlE:kBrmB8qsfnZeTyQ0mZ7h26g1d
TLSH
T10B13B321D211F03FF4F3297A53EF176AA46852B8270624C734D8EA9ABBD45DBBD31106
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

69997

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Programming\MonotoneHome\WorkingDir\Employers\Franco\TightRope-BundleManager\Custom\Customnsisdl\Debug\CustomNSISdl.pdb

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/CustomnsWeb.dll

IMPHASH 199dbccca3cc8b8a2cf04186d02f4abf
SHA256 39fefafc4ede6838061b804a44b0416ed4929c3c3ff9e64b1e0956186734094f
MD5 f705fa42cb1edf73153cfe6bef657387
SHA1 24462c7b144ecb7778ca7a93b9e1dd62464ea81a
SHA512 d993d37b53b60a009021154e5032965c29789fbb8d7b0907dc0877f36abe5d7456a33a8e3111158ee82fd306d24d3aeabe81be776ca5d2f09b8413ff437aa936
SSDEEP 384:Rl9jSW3OJO9zbkU3UjVzU2QSvA5q/8Bigip:RHjxOJO95mVzjQCAU/S
TLSH
T10913D99CAC06862AF8B2417E46B8D527726EDD14B314BEF7205C1D126DAF1F329B1CD2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

70127

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Programming\MonotoneHome\BM-Experimental\Employers\Franco\TightRope-BundleManager\Custom\Nsweb\Debug\nsWeb.pdb

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Events.lua

SHA256 895e6439e002183542b13720976a8e8166718560149f876141bd1827e4238642
MD5 5a7269de2a693363b32d3f9e008c53b6
SHA1 7c4a71a0671933f815046672277dc0e9443503e4
SHA512 306db56fac8c717f8c42056d56d10465f2c2be803135e46549b46747ae34635e027782950e13bd4b511b02254f517a041a4a7d80afc0f9bf49b8e9aba157bb9b
TLSH
T15411C08D3144EBA551A65B698F3F3806C23440D356BC1B9978D89F411F7227C80EBFA9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/FloatingProgress.dll

IMPHASH 1806d0504ce03d24690879c2a67010a6
SHA256 5caf7bccc7fb43e43a50676a2466803cfb531f6416c6cb797750513770da6e18
MD5 15bddd79574770cdbab1a9c13832d344
SHA1 dd63bf21db7049ba9773d0d06dbbb2d9b1ae914e
SHA512 52f29c250a2426f43b67577ed5efe17992fa9ccb361cd1ad6ec19a60b02e2b7ee1c5a8131a29e37f84636d30916d6d2018ac769483861d1da3b0a1f4c91eb87b
SSDEEP 48:SBn9+qyt9ofRgODb/ZfKVT60l/5Lh4VzQqO3rwBRbN5:g2k+O3/PIhIc10BJN
TLSH
T1B191863263E0CCF6F47A1673195328E5A3B5A53027A8560F5A9F42CA6505C4BED7C723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

4850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/GuiInit.lua

SHA256 fb5ba79ff4d1f26ea5e6694e96b116c22ec4d4891a4589eaf678553ef27b9bb0
MD5 1092b5a562b2c7efd2970f9f0fe749e3
SHA1 b644f37a985ff9ba9bbedd5d3afa4c3bc61885ba
SHA512 e21ed6d29e2d1958df5b663d31db178ea53811fdf5bc718346f2ed2f5adf07f23454fab8958bcae329b6820fcc01590eb5462de57a200e13672f282ecc76c847
SSDEEP 768:hyrQoaguQ2IsIsEq3qmTpMIkkR0Xa3b+HdXshnUNiSopNgTXZ:pxguCBRTmTH3b+MUYBpN+p
TLSH
T10E33945B72816A313EF2C26A9ECF1486EB2440630765A135B5DC42D43FB115CA2F6BFA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/IntegratedOffer-Pickle.html

SHA256 11c73ab6112a853e0930dc971f1fdf1be961a01132e5517c4069c7b31fb31d62
MD5 de86492c97e8d6a1fb60760c7a539a25
SHA1 848a17f2882e46f38164cc23ad7183fe670c5c77
SHA512 ed3cc509e8935f5a0edcf613de31f6bfaea988368ff9634ca8e2e888937aa2f2c37d97ba33eaa3a61a25882c9ee30a52aff216cb642403eb685dce9bb82daf08
SSDEEP 48:Z4YnnBZJOnQFFfG9mEDe9DR9vAyB/CTE5AeApzVLVoBskL7/C023xPb:HJOnQ3ewEe39v9dyE5jSzZCBsk4
TLSH
T137919A6098E84A3651B381859DF55F8BFE928203C70BAA1036EC1BD35FF7C05CC9B129
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

$PLUGINSDIR/IntegratedOffer.lua

SHA256 37a49ac0f2144e351f9afeddae2d4eac7a77628441ec74dd29a31fd094b62608
MD5 b0ba59dad1f309c93e36ec3fb568007b
SHA1 c908761a479c13f1e7889e5dff0e45d08886e889
SHA512 89db99771e663ffca69f5f51523bf548977739e649464680e9ff9fccaa9253adfd83a2b6e9c478ab032daafe51a2515a39f0c7199d8a0ffae423d77f1a0191ce
SSDEEP 192:zUqFE7EmEm8EySHXR3Ax/IEOaIvONqLpbme+LAxCqTwiMOgDIBFVf:CSxgnwLEwi88F
TLSH
T14222B755350AA970AC73AA617B4BE901F8A2615322798210798F8DD02FF016D93EF6FC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaBridge.dll

IMPHASH 4682694a7b56ff53baef1a0f1a91f5b0
SHA256 c26d867114a04c677ef9ac35d83c2d362c1fb9ff8d46abfb785d71a48cb9c309
MD5 9781b7bb06ea11ebce5dc9d57b3437a3
SHA1 604123977fffadebfefccae08df6b8e2e5dbab82
SHA512 666125abfb144665506e1085793656f31708211b940efca8188a5b20d57a058dcae10ec274a7614450f7b66854c9239c2838e61b3721c10482710a2008b681d7
SSDEEP 192:P4OMsEUVhX/Lk4qmpG1KN8v5Qu1Pbt91TVwxlXMmt9bwg6os4Ian:gJs1bvLbpYaYFPRKl8HgPIa
TLSH
T13F42D745A71004B1DE9540B17077AF128AFA790172C3185ADF5FBA893D62B929F3F34B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

9060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Programming\GitHome\master\Employers\Franco\TightRope-BundleManager\Custom\LuaBridge\Release\LuaBridge.pdb

$PLUGINSDIR/LuaSocket/lua/ltn12.lua

SHA256 b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
MD5 e440044afe6c761507a996b5b45ab0f9
SHA1 ef772c758fd5d6098b41375f35ac26f3963cc306
SHA512 8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
SSDEEP 192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
TLSH
T1B002BB8A3D86F1B569F2DA99984B6401F1668853827A0164FC1C94D43F3026DF3FEFB8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/mime.lua

SHA256 e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
MD5 4bfdaaab9014fe129bc6388fd5687c8f
SHA1 2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
SHA512 3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
TLSH
T1CB51E260BDC3B4E1E4E3E856D19F5814F0692817103512A1BC4D16971B7357AE2FF6F8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket.lua

SHA256 15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
MD5 74dbe1060e91112e1c21ef9870b4a587
SHA1 86afb6aecb0a8387ffa5dead1cc9808332f94310
SHA512 73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
SSDEEP 96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
TLSH
T1D781668DBDA3F265BAF3E694998B2005F176845312781106F85C80A17F7251DE3FEBA8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket/ftp.lua

SHA256 26167d7c0f511cca7691ca5ad6ebf85b4427b94ef12e110ba1da75f023db8acd
MD5 4f83a72dc82a78cad6eb7edbe7d2f152
SHA1 486dd564c3b2ac467e3eabfad806308f14fabb5f
SHA512 a5ca1c8955a450a727950d91b720895db55f425f2531bc2d2d17034363961ed52b6cc086289f966ac3c27b056452ab5126ec7d9bb34cf5a92fdf0f725f40781d
SSDEEP 192:GsooRaLonJfMxBs6gZO2zMAcTcGZqx6iOaBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7iOaBRkfYtppO
TLSH
T16A12ED4AAC87C69165B3C562944B6803F31F5113966C160739BC87E2BF3092E36FEEA4
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket/http.lua

SHA256 d10fbef2fe8aa983fc6950772c6bec4dc4f909f24ab64732c14b3e5f3318700c
MD5 7bd12178adca19b584ed1320fdae1e81
SHA1 839753d73984bda68047585bbc36f9344f51c34d
SHA512 634428c0e7dc62e7c44f60586c0ab0cedb8b55d9e7f2432f7f681aa58e0a8a444168d104d25c51b7839c06817f83f52a7baa4a0e45df6db283d6d5aa0d5e424e
SSDEEP 384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcvwkD:F/thyc+f7zyoaOt2yqiz/avD
TLSH
T194421147BD83B060F9F2C255E9871A06F26A902354291095F8BC42DE3F711ACD3FDBA8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket/smtp.lua

SHA256 04a2bcc6eb8be03803f7ea4c9aa32e6f70f97fdb6b3bc5ecc5e990cc9932ac90
MD5 29a883b6fb47f87609d0a5b1973aa45b
SHA1 6a36815a72d6d7e6c9ac987461e195d17ff979db
SHA512 c5c648445ea950d58affbacc8b299f26e80b55c4027195cdc055e7d2ee7e3593a59cb36fba8b8dbb8861603d5a03d9867065052b6a3bfd18590a8bd9dd96aac5
SSDEEP 192:hsbQbmId+aSnZwS/UjGf1MT+IsZDOD4GuuJQwDTaBrW:MH8jk1MTrsZDODhuuJIi
TLSH
T1FD02014E9C82B16414B3C5A6D44B3847E21B5103492D1156B1BC86E7EFB05ADF2EFEBC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket/tp.lua

SHA256 343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
MD5 2cad406e591cade482c7f16f39c21481
SHA1 84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
SHA512 ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
TLSH
T1A271CB867C43F6A4A9F2C665A55B950AF1BD4513012C0085BC8CC1F6BF312ACA3FE7B8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/lua/socket/url.lua

SHA256 269526c11dbb25b1b4b13eec4e7577e15de33ca18afa70a2be5f373b771bd1ab
MD5 8fb662c362da002b833793ea7794fdaf
SHA1 7afaf1ad22c95690cbb3f55226b617121efc20eb
SHA512 b0b766ac2b5cff879009ad9f74295f7ab0bf8b0628b8aece5597243e0fa96f4a85361728fd8a08eea7d2629dfc5e5d8b6aebca432075ad74c131ad3161a475c7
SSDEEP 192:zF/d/WjwnQdkUDv7wIECAAA4HaHjCRBxj6AqyQUh/T1htnSDiKbn:zfWjwXUDv7uCAx4HaD+Bxj6AqK/TTsiY
TLSH
T14422FE2C3D82E222EAF1E7538EBF0985F118916311691528B5CC14D53F3692CB6FFA75
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LuaSocket/mime/core.dll

IMPHASH fe8e49b45d854066bc51a41f61066908
SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
MD5 4a4845ba1666907f708c9c10a31ec227
SHA1 1ebf626adc84147e5114885ce779f92d6eb68f3a
SHA512 d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
SSDEEP 768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
TLSH
T112339F22789340B3C6E8827851B45F2F99BEB5110BD158D38FB8754E7F219E2E13B70A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LuaSocket/socket/core.dll

IMPHASH f7bb4b78321004f93f7e54fe50af1981
SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
MD5 4bf7db111acfa7c28ad36606107b3322
SHA1 6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA512 0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
SSDEEP 768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
TLSH
T151839D3631A145B7E5E6447131690B37EB7D79301AE188D38FA449CA6D309F2EA3738B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

18344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep GetSystemTimeAsFileTime CloseHandle FlushFileBuffers ReadFile RtlUnwind SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA LoadLibraryA HeapReAlloc VirtualAlloc GetOEMCP GetACP GetCPInfo InitializeCriticalSection MultiByteToWideChar HeapAlloc LeaveCriticalSection EnterCriticalSection SetFilePointer InterlockedIncrement InterlockedDecrement WriteFile HeapFree VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetLastError TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetCurrentThreadId GetCurrentProcess TerminateProcess ExitProcess GetModuleHandleA GetProcAddress GetVersion GetCommandLineA

lua51

lua_pushlstring lua_newuserdata lua_call luaL_checknumber luaL_checkinteger luaL_openlib lua_settable lua_insert lua_pcall luaL_optlstring luaL_buffinit luaL_addlstring luaL_pushresult lua_pushvalue lua_replace lua_gettop luaL_checklstring lua_pushnil luaL_optnumber lua_isnumber lua_tonumber lua_pushnumber luaL_checkudata lua_rawget lua_setmetatable luaL_argerror lua_typename luaL_typerror lua_toboolean lua_getfield lua_pushboolean lua_getmetatable lua_gettable lua_type lua_isstring lua_error lua_touserdata lua_tolstring lua_pushfstring luaL_newmetatable lua_pushstring lua_createtable lua_rawset lua_pushcclosure lua_settop luaL_prepbuffer

ws2_32

getpeername ntohs htons htonl setsockopt gethostname inet_ntoa gethostbyname gethostbyaddr ioctlsocket recvfrom recv sendto send accept listen bind connect getsockopt socket shutdown closesocket select WSAGetLastError __WSAFDIsSet WSAStartup WSACleanup getsockname

$PLUGINSDIR/LuaXml.lua

SHA256 6345b8a47f378416cbd31e543410fa5b03c914219ded2a51c2d3c858f281d6cd
MD5 a34eed4e795d1a7f8f26af91994b2785
SHA1 d950dbd4147b86e246fc19afbc12592aa0ee55b6
SHA512 0d3d92c6b5053469a2edfff0050672ff847135e5d1d08fb7b353df9690f8edcc32f443733bd0d70061f572e3f220769a64a0820918e4b51cf99d8bed30b4f3e1
TLSH
T17181CB55268572B6BFF1E731A80F9812D1774827161601B17A9CC0F23F64548A1FBFBE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/LuaXml_lib.dll

IMPHASH 0e4b7cfc82eb1d2e2840274f1659b95a
SHA256 90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
MD5 7292b642bd958aeb7fd7cfd19e45b068
SHA1 19a800620d041634abae5b5d096cb0e87ce4c188
SHA512 bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP 192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX
TLSH
T19332D78B763238A6D81D253A218D5B70C73D701618DBD06ACF65CC599C3A1B8FE6D14F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NotifyIcon.dll

IMPHASH e043e246d8abcbb9de2ad82c6e18cd88
SHA256 d2b04b5b33877521f6f140148521f219e25d2de753ff20954f90dcee55d1a647
MD5 9ab83d7ef9bd55db63ceb33840431cd5
SHA1 548c54c8b9d683f32b2f1bd8b3f374fc14691fd4
SHA512 5fbceba72421834d5b888818b1fea5f88c518ad871539a3ff1422d4a3e3d6bb945dca1da0839158c446e54cdc5c916e1ca17283b44135d2078bb1188ae142545
SSDEEP 48:aFV2n5RPl5A9+DyhKqfCdGMfMGMoTtmZE+dlpn6sT6lQQAsjRz:s05RP72BCdjUGM4R+dHn6tV
TLSH
T167B16033B2D595B3E36E063AA0D3295BA0758320A3D1045B8E631FD2B691E37DD64F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5940

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
MD5 7e3c808299aa2c405dffa864471ddb7f
SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
TLSH
T1A7225D6547A041F3DD60823C08A73D275BA97B148EB54ED3CF9314429E2D6A6ACBC336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/__localxml.xml

SHA256 c6ba77678ba2f3eb308c8324b5dfb108b679ee342b4891af77c4694979cabfaa
MD5 c2c5bf7fd03662cd59b36523b80c8252
SHA1 688629af7884e5b036504156abcdaf2516c1ba85
SHA512 c2fdd609a6b1c1b13fbada65b6c2311e4132e612d372a0ecb32026dfcb7482d6045ae461d09541530817f5564a940a12e3f16db767e8016c0c290c2970402e0b
TLSH
T114412488FDC07174A0F1917E79579AC5E8D3EAE1594D8EB8B9961B0F21C60482323735
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/custominetc.dll

IMPHASH cb0a607a2c9593bb9c969e6ca75c2b88
SHA256 3c0d6c3ee0784b2f10093a927335382f67050156136991f0ae05fa4484bab8f4
MD5 81e20eb6c3a6002a805265ca751c7217
SHA1 db0e645b6d22b77b4117fb5612a0bf83c613c199
SHA512 ae6b594bd6cb42913484b5c5282757a9e8f52e76647bf3ef49555c2080540be683079f7994050a7baa45f7a2f57441fcd23353f351476f2891912ec5d2bfc2cf
SSDEEP 384:96WBKKhxKPJeXt0OxyfWB9VTZVWav3ARHKpK/V3STMvDya4m0Ac9khYLMkIX0+Gg:99nKPZfUZVzv3ARHKwhSYvWa4uL
TLSH
T159A21A019E9615B3D7F51C36746D37138AAEAE71246154836BF71FCE2C2A243FA34B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strtol _onexit __dllonexit _adjust_fdiv malloc _initterm free atoi _mbsrchr strtoul memset _mbsstr _mbschr strlen

kernel32

DeleteFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatA

user32

MessageBoxA GetParent ShowWindow SetWindowLongA GetWindowLongA IsWindow SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SetWindowTextA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/definitions.lua

SHA256 e2d0e6bcd2d6cb69a6d9e84d80f9cb182fb0b6db5592d8b304ad6eb98590c35c
MD5 840fd3d93db939b1e4b504d8fe587ed1
SHA1 98f0dd4aca7765c158bcd1fe1d11bbee5e1e586e
SHA512 570ae6db31df726b8fe9aff35e553ad669d4c25deabce424b865b96597933225ab644a7e2944b8507e2d5a0b0e04396025ce711cba9beac7bc5844c435ab76a1
SSDEEP 96:dfT/fHcmaXreYxXXxLjKZPghh/pEdnVmPx:dL/fHcdeMhPf0VmZ
TLSH
T1FA91B61711D3B2B8F7124423B25F1AD7DAC0106387B56869B3ED80640F94D6F53F98AE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/extension.tlb

SHA256 439a861617df97c0c509d12c9e297d8637898ed325b668029d206bc932283bfc
MD5 483994c053219403e88527fe0fe582c9
SHA1 77296a61059405d7f53bd8c663973d0816f38a5d
SHA512 84a70409a86326fc05dc9d26e5d1f02ab345cf4f0525f09bdb5fbd8ae7d5f03360f1201e50e335dcfbf8e03ac082ec882e340c275a59e40737fcca4fa92d58d4
TLSH
T1AB315593F384C6A2C45D46314C8BD2E857F0BC158E12AE873699BB6E0D307CC6B194B4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/json.lua

SHA256 2f2f0f1ee1a5aa077baa531b6ca78a8292ac9b13cc00b9b74eb78b046b16a9c2
MD5 40e6400711737821d2f1e8adc950741b
SHA1 fa88a96c6e43c7eda904a1832f36ce422067202b
SHA512 7dee28dfcf7ef028b061259e2608692bf0bbc87f8bff349da42a57e55ff04b1927cd201c850c2bfd41f94089e7b8d96a607277be6769e487ed2eec069aba4b37
SSDEEP 384:KLCjxQC4dhpVTijbgrgCqtSjgykxPEvyf9jYU51BAKfac6Lc6sdXB:sCePdhrTij3CqtSjzkhRYU51BAKfac68
TLSH
T1D2828261FD8FB2611CA2D262D57B4251D51CE020123821D5F8CEE1F2AB51B7CA1FFAB9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/lua51.dll

IMPHASH 0b930a47b5846bb154dc0be3d35f00ab
SHA256 2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
MD5 bbc9ac3211f07e45510861ae429996c3
SHA1 0a0d7ea99c959cd4add3deb05e500af5fdf98510
SHA512 f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756
SSDEEP 3072:+RyHKGrwG4F9FBtzYyEqRi/0L/AZ4g3qq:+RGXrHOHAYi/7L3q
TLSH
T1A3C35C47F682C0B1F48125FA18A263B7CE3D5BF790B3D7179B91D861C866221F51A3CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

94577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadfile luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushresult luaL_ref luaL_register luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_lessthan lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlevel lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tolstring lua_tonumber lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_xmove lua_yield luaopen_base luaopen_debug luaopen_io luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

$PLUGINSDIR/luacom.dll

IMPHASH 148172081107200e70753e16a32c0c9a
SHA256 9dd5218bc2d12f4d07e268bc6ec01d6eefde4b99a07246d0a96d18477d331b5b
MD5 ed7f7857933b38e5d10daf828e79af19
SHA1 7f1445f87f7e2256efc33ef56da20c3b23a1e0f9
SHA512 ceaf9597d4cb725c4ec8b7af8d1090b38df102b52ca7606a24e9a094fc81f450f93ad22770c905db9115e271fa5fa4f5731caa7b1875e204edb10fb691741715
SSDEEP 6144:sdCVNGq2AcLGcmiuarKjKekqqBVq2Zq++++o++++++qjZfl8++O+yW+s+W+hZa+u:wCVT2nqciarKjKekqqBVq2Zq++++o+++
TLSH
T1D4546E11FA80CE33FAEB01B54676817D2A28EA611740A5C7B7C465698F363E17F3134B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

21536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Programming\OpenSource\luaCom\mak.vs2005\Release\luacom.dll.pdb

shlwapi

SHDeleteKeyA

lua51

luaL_optlstring lua_pushvalue lua_pushstring luaL_argerror lua_pushcclosure lua_settable lua_gettable lua_createtable lua_toboolean lua_settop lua_gettop lua_next lua_tonumber lua_pushnil lua_type lua_pushboolean lua_rawseti lua_isuserdata lua_tointeger lua_rawgeti lua_pushlstring lua_objlen lua_pushnumber lua_pushlightuserdata lua_topointer lua_newuserdata lua_insert lua_setmetatable lua_equal lua_checkstack lua_getmetatable luaL_register lua_close luaL_openlibs luaL_loadfile lua_pcall lua_setfield luaL_newstate lua_touserdata luaL_ref luaL_unref lua_error luaL_loadbuffer lua_getfield luaL_checknumber lua_remove lua_rawget lua_call luaL_checktype lua_rawset luaL_checklstring lua_tolstring

kernel32

GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CloseHandle GetStartupInfoA GetFileType SetHandleCount RtlUnwind HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP RaiseException GetStdHandle WriteFile ExitProcess Sleep WriteConsoleW GetCurrentDirectoryA IsBadWritePtr lstrlenW FatalAppExitA DebugBreak lstrcpyW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetLastError LocalFree ExpandEnvironmentStringsA GetProcAddress LoadLibraryA SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess SetStdHandle CreateFileA ReadFile SetEndOfFile GetProcessHeap WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesA CompareStringA CompareStringW SetEnvironmentVariableA HeapFree GetModuleFileNameA GetModuleHandleA LeaveCriticalSection EnterCriticalSection GetCommandLineA GetCurrentThreadId HeapAlloc

user32

wsprintfA TranslateMessage WinHelpA GetMessageA RegisterClassA CallWindowProcA MapWindowPoints IsWindowVisible EqualRect GetActiveWindow ShowWindow SetWindowPos DefWindowProcA CreateWindowExA GetWindowLongA MessageBoxA IntersectRect SetWindowRgn GetWindowRect DispatchMessageA GetClientRect SetFocus OffsetRect

gdi32

SetViewportOrgEx SetWindowExtEx DeleteObject CreateRectRgnIndirect SetMapMode SetViewportExtEx SetWindowOrgEx

advapi32

RegQueryValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

ole32

CoCreateInstance CreateBindCtx MkParseDisplayName CLSIDFromProgID StringFromCLSID CLSIDFromString CoTaskMemFree CoRevokeClassObject CoRegisterClassObject OleInitialize OleUninitialize StringFromIID CoLockObjectExternal CoTaskMemAlloc CreateOleAdviseHolder OleRegGetUserType ProgIDFromCLSID

oleaut32

LoadTypeLibEx SafeArrayAccessData SysAllocStringLen DispGetIDsOfNames SafeArrayPutElement SafeArrayUnaccessData SafeArrayGetElement VariantChangeType SafeArrayGetDim SystemTimeToVariantTime SafeArrayCreate SafeArrayDestroy VariantCopy GetActiveObject UnRegisterTypeLi SysFreeString LoadRegTypeLi SysStringLen VariantClear VariantInit LHashValOfNameSys VariantCopyInd SafeArrayCreateVector VariantTimeToSystemTime

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis7z.dll

IMPHASH 4c04c20a976733bf789fead96eb58701
SHA256 cb195d62df55a939e238063c13c792237501f2297386c11229b1558eea9ddfbb
MD5 692479f7c07a64a6a632148e382f0e22
SHA1 cd14982a8e048ae98860db52f042850b63f9f40f
SHA512 7ed81c13ea6d3b5fbed778ff0f2b3361399826296711ec7dc019432ecd79a72e7d6e78d5fab144600ec55b46a56c11ff99f0860855522750883d7693ca885809
SSDEEP 3072:shuC5kBdKlB5Rkg0rQHWjfxTKYaE51GiCySqEMRRQRkM8CQme+5xuPFK:Qq7WHIrLjfxdXREJ/8CgK
TLSH
T17FF3AE2236D0C239D20B2536CE56EB62637DB660CE61D58B3F894F1D9F32581DF29706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

93148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError WideCharToMultiByte MultiByteToWideChar LoadLibraryA AreFileApisANSI GetModuleFileNameA SetLastError CreateFileW SetFileTime CloseHandle SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW GetFullPathNameA lstrlenA GetFullPathNameW FindClose FindFirstFileA FindFirstFileW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetProcAddress GetCurrentProcess GetSystemInfo GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection CreateEventA ResetEvent SetFileApisToOEM GetVersionExA GlobalFree lstrcpyA lstrcpynA GlobalAlloc RaiseException LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW HeapAlloc HeapFree GetSystemTimeAsFileTime ExitThread GetCurrentThreadId CreateThread GetCommandLineA HeapReAlloc HeapCreate HeapDestroy GetModuleHandleW Sleep ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle WriteConsoleA GetConsoleOutputCP VirtualQuery

user32

GetDlgItem FindWindowExA SetWindowTextA wsprintfA CharUpperW CharUpperA SendMessageA

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
TLSH
T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/res/common.css

SHA256 9a110c6977aea3ddb3fc38e59efbd89f0f13e086ca0bc61f4de86c2015a741bb
MD5 0fed415d7de81f84954bd4e264e61e4c
SHA1 a3d6f75a5ca50b3800593fbcd1d667db31e98698
SHA512 15fcf206ce21cdef8177b6f4e254dca38b39bc3eab0ba43b342f7f7c70529f387ac8d4984f673146cbc5ca73392563c820f98aede01d507a7e3a9241a15088a6
TLSH
T1EC315A22CD05084A70B29B34EB63685DFF17045BE757036A7BF6B968CF3065A4818FC8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/res/common.js

SHA256 7ddbe3db3816a9df8322aa9989eb28b33df96cd57623ea6a211dd474c1ebb659
MD5 d786120074993692b611e095409d54c4
SHA1 1f9d87613e0145ce2ff77746740cd53eee031096
SHA512 ea1765957a7c8725e19d3f5bfc75f8920c0cd39f2dc5bafe18c7ecd759cfd044738c2e8857ceecabae0080162e8e8d378a78097b0e581d4512770d39dd97d192
SSDEEP 192:GERYJ2IuzeQTR2+Yu/GRmkOqKU02MqybSIGlzs7notrtIzlgH6feKt3:bUs3R7uvcnboo7V66x
TLSH
T13472745CA9412BA8B97223798F5F1414EEB245570A00DB44B8EDC7402FFCA5193ABDEF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/res/jquery.js

SHA256 69a78538c3b8b841bd898d85140986bd87d41f7771c7cb9d45909ce00183783e
MD5 7021191c5dd70e95a9c026be6b9c05d5
SHA1 32cd16fd318795d8aee5dc3bda30afb705a6679d
SHA512 0e6e0e057dc726d9833dad245a5cb17caaf799c0aa8ad1f9b21baedc41dcc126d624b1430e32645ee3f308105836fa7879cc1bb71da3c1813aab40a795785dff
SSDEEP 3072:KgQWO242xfq+50dFhPGXVKDhA4kO9J3A7zUMpZXwFh++l7XKDtxp/Lq8LakxOAd9:HhomMFhPMKDqO9JQ7zPZgFh++Ytxp/LP
TLSH
T18CF394D8334F416F86A2336AA43F615DFA7CD5B2420591BDB5CD986824A081843FAFFD
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/base.css

SHA256 ed783853e8e36a952de998cec033e9379c4e7a6a7bafb598d187210d0fb78b98
MD5 43d73454d915f70ea003a6d19e977152
SHA1 a4d3c9eb1e0750c448c793808094e9c6461b7efa
SHA512 b0f9e74d89f1b554ff79ddda3649b4d503a77a50c605ee23761e293728b0dba1b393bb46993db40e0bcafe8b829872fd0ad3127fe448a6d7bc917909ea6a54dc
SSDEEP 96:iv3nphWVfSG+gVA3sR8aCRf4lMX4Y8wllh6EbZGmnmSwq2kqT5:i2qGW3sR8fBlhZAXkW
TLSH
T189D15368C622120C7632E752BB529E59393480CBDB5727287FFC3254E34B95E1622FE9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/cancel.css

SHA256 d854553c0688e36279818d0d2732ddbe035917fb240b8a887aae3935725a901d
MD5 28b650736721266f3983f0caab126ce4
SHA1 ab6354540eaf882ffc15336b5b897a4cc7857714
SHA512 91d998acb0a72509863aae169373ca5ebc66d43f597a41823bf1e40e9492303c37f4c303d614e048cb35c419feb7c7b1a1bf310332ac00972bd3460c46ad45c5
TLSH
T194F0ACB7D78813FB3F0E0410E2ADA68AA518943D933395F1307D90A41651D71B0FBAC6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/accept.gif

SHA256 0366dc42eabdd79150dfef3af8c591457dcf468da4f3414b12e49768add8c505
MD5 a9bcfe2b77d2061111a5ab6bb2452217
SHA1 dc5643701036e981c9bef23fa0a70c2c7d70c023
SHA512 cd116695b9a2c490a9e2997128404c6339650bf22e02aa91b68453de7fc7608042542f2c2794c2330e9549457b90ac4a75b3b44fc0225e070a8cc7c66b5529ec
TLSH
T145313DF09330C7E5A472CA7B1512F3BC14C9F529C2974936AC4328CCC5DE6967113B41
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/background.css

SHA256 e0d0c15be147a0ad151162520322fdbfca85e1e91efd1f29f334be70444bf1ab
MD5 e5d7c59a634e230b16d6aad6834fef7e
SHA1 d2cbbdf1f4f47d13cb68adfa16f9586a1117734b
SHA512 fc320e6e3578d21844239d8a328370cdfcd9ec95be6b67633983aea0b3df71ab59d2c33c79a3182c473aae0f6c74a149fc02f3641c7c4a50bb3a28707c975539
TLSH
T196D05E84C3C2E33F32224636363FA60A295E04A5D6008F3E19373096D0648801073811
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/bg.gif

SHA256 965bb1b505b7ee92daf9187837d36a0a79b7d2452cd1906c4baa26d9bf979628
MD5 a84d0f38aab2d7009922ab2ba6e77391
SHA1 0eebcfb109c964d455d974b0bed28ff9b6fe753b
SHA512 8e3766ce249d5b9b6b457fbc453f2ce82bc28c2922262155970c551c3c467a827ebea7c911fe703c381467fe8bd529efb00bd2b1cbac43695ecfdf1cc8f4a179
SSDEEP 1536:eb/dnxlducRoVvges8MxBbPWrd6I2/EyBDbZ7LgYYT:mNxhREvgR3PykBh7Lgv
TLSH
T1B16301CE71DDA219472684B9977A1F65C2434B207E3A3C55E2CBF4E2F1023233B79868
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/cancel.gif

SHA256 d09aeaeeded2703e678b6c1a712506fb3fc7675e4040696b5dbe6173d415f6e0
MD5 1e947c177e31b14bdfada25f9ece1cfa
SHA1 6f0ef2fac33ac3787514108af971fc1142ab1c57
SHA512 24298135f688ec5edc1467fccb0a7bcc4520ebef1b7b6071ae587c920a12dcaf66a90f51246d429ca28a95e682be63bce84b28c20d709e51af9a5334f44fd114
TLSH
T11901885EEBDA7D03A0E1FDF1168D4D0AF507508F151D716EEAAC55E0605181752C852D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/close.gif

SHA256 703ece582de6f85ca2a0c92824d5238f3a39b19f01c51d1e15ae1581ac6f10e0
MD5 9e67ca58dec0a6cf45a74a6afa05a1be
SHA1 ee17a74fc87a1db16b5e0e904225de691485eac7
SHA512 973bb29c86857d3a533fcaae7f43743ec2776b05ebb69972cfc7901e777af87737d610a5a49d6d9fe1251e17d95a39f05f139365914dfea54a8768ea52e83fc4
TLSH
T19FE0F11C99A50169C1CC893775C267E1DAA4A23BB6E9C9D3B2277D3044FD6190443199
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/minimize.gif

SHA256 1f77942bba0dde8ca0c2365a8efd19187bfd56b981ebb738eb89e236616c808d
MD5 1c2e4a93015fbe78af950da4cd97bb88
SHA1 93488525d2456e69b6cafd605211552a4a406986
SHA512 780769f03b6d4cdafd9e9ef2fa93c7a8b20377f2952251735a3f00d446631b09031bd1630706655fd462e5b87c77368c5f085f2b8d83c5179fcc002069cec0bb
TLSH
T1A3E02B82923FF560E0CAF233C56F8B8B62B9A59547D2A25045730339214229B5C151C9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/ham/next.gif

SHA256 45845d627d66283891d52fd2ee8af305c842b2d133f1943960dc1d62d965641f
MD5 5760482fa9fccd3e77fbc2cf7ca1e834
SHA1 56ca024ddef698d6cb93912b96e1ee9cc5e2b1a8
SHA512 5d49e2957f5c07dc157eb1e0af329f1eed18d34d0abe288ee60adbcd034448f086e3eb5a219ca9c77f77bb1d582bd215a753c9c0dd3fe14453753dde0301d3a8
TLSH
T1AC2196DBE3A2EDDF3AF685AD2918D3C4C85D956A0048C65EB4EB3144564A0A7A0C748C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/headerBG.gif

SHA256 06d14477697e3f0a3841cf5018a261fccbc275056ce39949adebe795fb7db143
MD5 d68ceec1f2a0d767354df6f6715f9950
SHA1 ea0920c07a160c5d7d0bc7bedc13bf63b7129d58
SHA512 74f8982ba87b0f68c1be4d1a46a225489a019f2f10cae4d573712b1449902f0ccd2d37041c24cb19c54943cb5722c0f61d111a378286364ff3d12cf3fbfef0b7
TLSH
T1E9E07D0254602B60DA109E3D882F42C454BB79E691E06277C1AD8E9D8A18304470B044
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/accept.gif

SHA256 285795a0778c69371ea24b252a93d5e45c4fd17861428aa5ba0a7baae7d16f10
MD5 6d3fcd196340cc82eca2c1d60fccf138
SHA1 a40ceef15deaf258a3b1f4663da508bfd0820069
SHA512 774ddcbc7d6089d333f090573148413948c184ecac17b0ff41683102da6e3b91d2900d929acd932f034c5df114174e622949a6d7f70fed4f5b0481055c5143c5
TLSH
T182410940B17E8370EF1A627E3425DAA1C865A53B23ED437929C5FE5C64328A454F32D4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/background.css

SHA256 af154c28a3c75290adac2fba09ada97fe64b947a943b378cd01b08d0d1de7f4c
MD5 6300f0a74339ff61967d2ee2242bdfd4
SHA1 c53a7d760640aa6874face128857ba190893fbc5
SHA512 85cc255a93f5186f885b98e46bd602cdcd8aeed4326b6973ba50ac3a43c843e5c66269c7db5dfc7806c026365481c0de8861584025337d130700a0ddb36d16cd
TLSH
T1D9D01784C3C2E33B36728636377FE61A2A5E04E99A018F3E2A36619A906489055B3C52
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/bg.gif

SHA256 4afc8c589e5dd2aa291e1ad1fcb29de03e1c32caea928e8d077ba617631a1e4c
MD5 c14b66b0d0701471f5489b5e55632013
SHA1 5331dc3d6cf7bcebf25c817bec9f067f4b059f7b
SHA512 82513a3191e9bb8544d68214285a099965fde5691fa3918f872fbbe30a66bf37cf3bbfdde9d455997fd9e8a272babc7a600eaa3c2aab9333ae112069f749435b
SSDEEP 768:nVCalXxsHDckJ8zYouMpNI9RMo9P51rT51SdJVLv4/o0BJvYBSeAxz:nMalBsHDR39RMm3Bg9v+oUSnAxz
TLSH
T1AF030195F61B6512C1777E932673BA63D41380EA07D0F61982D0C8EC2FEA06F46066FE
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/cancel.gif

SHA256 52546ac2346a7dde17bbc670e380b91bf8cc584cb8798aff10f4785124c447df
MD5 bd735f8fac27aa3447629f34af51c99f
SHA1 03382554e207bbf7e93bfaa5b435903e0daa2609
SHA512 a64673621adf27432ec05b7a7a87e2778b0901265b74617ecf836fba62eb7b4edefedf3e1d5f1cd83a7e3b8475c7438e017049422b04e8d5f7017b09eca033d5
TLSH
T18221DA07874BC741214C8DB0C48499B6169E9F63773D16693B0A17799762AFB63623A0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/close.gif

SHA256 f6f2790ef62e0eab61d34f5412823c9a031204aaaa4c6fc652fb382f5acab9b8
MD5 cf7b0bba8b4c785301388be010140ff8
SHA1 7b82b4d9ea6bbed1f1297fd5bbaf13a52af59d9f
SHA512 9744853fd05f60bf55da138e69851484050ca793f1371ea1452b751b88417fba87ad01fab0f0e007ffedb8dd14c8c8ac397a6631bd8915671d915e6d1b11c6a7
TLSH
T100E0F115A8BC020AC644C93B3A65DE945E60E325C0AAC5F3B29B6A1111BE2010480C53
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/minimize.gif

SHA256 35fb4152184ccc53008b3e865d4c2a9b843a2774615e080e005d3c0e9e2dca40
MD5 cb0292792bbb29a1789da63e0961453c
SHA1 c50fa4a6c505a9dbc7f41218c3a49f3df170fb48
SHA512 42d6ebe105a3f61cd4e5bf9c67e9561cf35484f5911f015e123432b954bddb9bea913f278b43aa1f3e772f8ea3311e9feb5998c080c59645ea9adc5afb729d97
TLSH
T111E02B91E63DE390F4D27032BF6F8E6B736A3145AC523330626A027A326275F5526841
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/magoo/next.gif

SHA256 45845d627d66283891d52fd2ee8af305c842b2d133f1943960dc1d62d965641f
MD5 5760482fa9fccd3e77fbc2cf7ca1e834
SHA1 56ca024ddef698d6cb93912b96e1ee9cc5e2b1a8
SHA512 5d49e2957f5c07dc157eb1e0af329f1eed18d34d0abe288ee60adbcd034448f086e3eb5a219ca9c77f77bb1d582bd215a753c9c0dd3fe14453753dde0301d3a8
TLSH
T1AC2196DBE3A2EDDF3AF685AD2918D3C4C85D956A0048C65EB4EB3144564A0A7A0C748C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/mod.css

SHA256 87448dd8407c04cd81520064d4f88d367001dcd4c287b1bfb00b7645fcd6f2c6
MD5 071c5d8a7982cd39c4058cf43929468e
SHA1 9c0ab0ca5c30c95efa30d84d38b97b547a7caadf
SHA512 b7e84715b28caeb845ac3e4963c740ad6e7a442dc29b00ec98c017bc7e3d0be88052e56020cfcb8079b8083ab7040555a9b5e408805a98c7b8f15537b539abc0
TLSH
T13A719C18D611161D3472E724AF93128AFA3240ABD357152C7FDCA390CFBA0198966FEA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/offers.css

SHA256 3b5b914719416d8b2674a6a85a232b409a30b3493102de5881415880fed822e1
MD5 668eb5abab3e4510656654b6f9f354fe
SHA1 cf119ae19448a590908b7dbe722690951d8a1657
SHA512 e3df26283e6a3890f483c8439c20828173fb50d00692f5b5784d73eeac80f932fd905435ca729135a6f2062868bef1f565ec8872d3a31119e3e27bee93b59787
TLSH
T17451E080E7D637BB76670126B37FA584AA0988B4C573EBBCB07D9150C7A147032724DB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/accept.gif

SHA256 0366dc42eabdd79150dfef3af8c591457dcf468da4f3414b12e49768add8c505
MD5 a9bcfe2b77d2061111a5ab6bb2452217
SHA1 dc5643701036e981c9bef23fa0a70c2c7d70c023
SHA512 cd116695b9a2c490a9e2997128404c6339650bf22e02aa91b68453de7fc7608042542f2c2794c2330e9549457b90ac4a75b3b44fc0225e070a8cc7c66b5529ec
TLSH
T145313DF09330C7E5A472CA7B1512F3BC14C9F529C2974936AC4328CCC5DE6967113B41
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/background.css

SHA256 e0d0c15be147a0ad151162520322fdbfca85e1e91efd1f29f334be70444bf1ab
MD5 e5d7c59a634e230b16d6aad6834fef7e
SHA1 d2cbbdf1f4f47d13cb68adfa16f9586a1117734b
SHA512 fc320e6e3578d21844239d8a328370cdfcd9ec95be6b67633983aea0b3df71ab59d2c33c79a3182c473aae0f6c74a149fc02f3641c7c4a50bb3a28707c975539
TLSH
T196D05E84C3C2E33F32224636363FA60A295E04A5D6008F3E19373096D0648801073811
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/bg.gif

SHA256 257dd00ebf4a1bedfe68561046415ebb974ec0a24c06773c38bb921904a7efbd
MD5 040eea4a3780ce759082c797ce1f1391
SHA1 b13ebb63f323e4ac2c4e1f0bf845c54e99aa26ae
SHA512 af494502548d51b1d750478e0008727bd6d26e49fd2fe7706d2fa470a689213be55c7b5e6d704b1dba85035394c605b5db4d2ccf6a228b9ac45b3dc950c233fd
SSDEEP 768:Sk+CPFJ3M6a6tPqfi30TvqfIEkn+iWjD1FzkhQ4kHAFJgHEBAGj9LxgEsZmOh:Sk+4zbqfiUqQEkn+x1kOAFmHEBNj91sp
TLSH
T1AC13F20E5A9996CF8ED7B222C019C6E47A13D48B3F40F42A13942FCFB17AD5E5376502
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/cancel.gif

SHA256 d09aeaeeded2703e678b6c1a712506fb3fc7675e4040696b5dbe6173d415f6e0
MD5 1e947c177e31b14bdfada25f9ece1cfa
SHA1 6f0ef2fac33ac3787514108af971fc1142ab1c57
SHA512 24298135f688ec5edc1467fccb0a7bcc4520ebef1b7b6071ae587c920a12dcaf66a90f51246d429ca28a95e682be63bce84b28c20d709e51af9a5334f44fd114
TLSH
T11901885EEBDA7D03A0E1FDF1168D4D0AF507508F151D716EEAAC55E0605181752C852D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/close.gif

SHA256 703ece582de6f85ca2a0c92824d5238f3a39b19f01c51d1e15ae1581ac6f10e0
MD5 9e67ca58dec0a6cf45a74a6afa05a1be
SHA1 ee17a74fc87a1db16b5e0e904225de691485eac7
SHA512 973bb29c86857d3a533fcaae7f43743ec2776b05ebb69972cfc7901e777af87737d610a5a49d6d9fe1251e17d95a39f05f139365914dfea54a8768ea52e83fc4
TLSH
T19FE0F11C99A50169C1CC893775C267E1DAA4A23BB6E9C9D3B2277D3044FD6190443199
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/minimize.gif

SHA256 1f77942bba0dde8ca0c2365a8efd19187bfd56b981ebb738eb89e236616c808d
MD5 1c2e4a93015fbe78af950da4cd97bb88
SHA1 93488525d2456e69b6cafd605211552a4a406986
SHA512 780769f03b6d4cdafd9e9ef2fa93c7a8b20377f2952251735a3f00d446631b09031bd1630706655fd462e5b87c77368c5f085f2b8d83c5179fcc002069cec0bb
TLSH
T1A3E02B82923FF560E0CAF233C56F8B8B62B9A59547D2A25045730339214229B5C151C9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/pickle/next.gif

SHA256 45845d627d66283891d52fd2ee8af305c842b2d133f1943960dc1d62d965641f
MD5 5760482fa9fccd3e77fbc2cf7ca1e834
SHA1 56ca024ddef698d6cb93912b96e1ee9cc5e2b1a8
SHA512 5d49e2957f5c07dc157eb1e0af329f1eed18d34d0abe288ee60adbcd034448f086e3eb5a219ca9c77f77bb1d582bd215a753c9c0dd3fe14453753dde0301d3a8
TLSH
T1AC2196DBE3A2EDDF3AF685AD2918D3C4C85D956A0048C65EB4EB3144564A0A7A0C748C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/skin-kitara/progress.css

SHA256 fdd42fc22ad4c290956933c26659f52d4cbcaa733b0515aeb353c7e6d58c237c
MD5 9a2ac1affc15e0c63d5095f0bf9cecea
SHA1 4e5a6fd5a394117d8d3fc10188c7704702e1c29b
SHA512 b1f2abcc62a1c191ff60b49c803a598c6d2a730248122065efc54379a06dbd4ee44d37a5374c2a487ebf08b67fb7518b80dbf28fd16537e66e8cbc73614e868c
TLSH
T105410F56CBD413FB7D471A21E3EC8A812A1C4069C227D7F8AC7FA124C302E6099B76C7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/un.package.exe

IMPHASH 35b698a6fd5038f719a27b089cb1f48e
SHA256 a4da8c6f38d7e573ffbf04e753ea4cb0fa6a174df054aff57edcb73e3e252fce
MD5 5694e7daf20c47c8d5e73d4a838c2ee6
SHA1 43814f29584ff23c2ca6f78aad733dde536afd56
SHA512 ccbb140a677356e1b34e65cb7a25c36145c40db37f538ed821664c676c1378efaf82fdd4b762dd54cb93b00c23e267fc717d8e0730d06924b5226b44cd4c03bc
TLSH
T1C881B4027AE5F43BE19822FF93ABCCD1E7256061235458EF04F3608B0F525E33C29041
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

5472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\Programming\GitHome\master\Employers\Franco\TightRope-BundleManager\Custom\Scramble\Release\Scramble.pdb

$PLUGINSDIR/utils.lua

SHA256 57c0c5fb5521d4b16be42251f17cc5c6bd6fb2d7b8c4c4ca309ea5010a31a9c6
MD5 5c5179ad112ea82fff7d447ffddfaf31
SHA1 1da547960363aeb2059dd2745f84186f47ffdecd
SHA512 4d72d47cb132bc1ed4076adac9d7c152199b7effe6ae2c5d6a2ad22453400a27c8c2089dba863ac4527cfc2d58c30e33c2526682ec512ae697f5d53104162d4f
TLSH
T18031BCD97341BA609AF1C3B2F44F0820D40265422D7A50B8FA5C15F52F74A7DD2B5F68
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/version.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
TLSH
T115C14DD52E7C5673E2F1433742CF8B983632909000B81A5B5779425ABD8A3E1416B77C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
TLSH
T1F1120A01BD92E872C35588FA8CAFC284317F31026EA565127DDB1BDD4C2EB61F71E406
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_1369f48ff4dc39f004d9beff71ca942f7fa4d41f41fecc5edce3ef5af15b4912.bin

generic

$PLUGINSDIR/AdvancedTests.lua

$PLUGINSDIR/BrowserControl.lua

$PLUGINSDIR/ButtonEvent.dll

kernel32

user32

generic

$PLUGINSDIR/CustomBrandingURL.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/CustomNSISdl.dll

ws2_32

kernel32

user32

advapi32

generic

$PLUGINSDIR/CustomnsWeb.dll

wininet

urlmon

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/Events.lua

$PLUGINSDIR/FloatingProgress.dll

kernel32

user32

generic

$PLUGINSDIR/GuiInit.lua

$PLUGINSDIR/IntegratedOffer-Pickle.html

$PLUGINSDIR/IntegratedOffer.lua

$PLUGINSDIR/LuaBridge.dll

lua51

advapi32

kernel32

user32

generic

$PLUGINSDIR/LuaSocket/lua/ltn12.lua

$PLUGINSDIR/LuaSocket/lua/mime.lua

$PLUGINSDIR/LuaSocket/lua/socket.lua

$PLUGINSDIR/LuaSocket/lua/socket/ftp.lua

$PLUGINSDIR/LuaSocket/lua/socket/http.lua

$PLUGINSDIR/LuaSocket/lua/socket/smtp.lua

$PLUGINSDIR/LuaSocket/lua/socket/tp.lua

$PLUGINSDIR/LuaSocket/lua/socket/url.lua

$PLUGINSDIR/LuaSocket/mime/core.dll

lua51

kernel32

generic

$PLUGINSDIR/LuaSocket/socket/core.dll

kernel32

lua51

ws2_32

generic

$PLUGINSDIR/LuaXml.lua

$PLUGINSDIR/LuaXml_lib.dll

kernel32

msvcrt

lua51

generic

$PLUGINSDIR/NotifyIcon.dll

shell32

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic