jaffacakes118_Trojan-Dropper[.]Win32[.]Agent[.]oijx[.]51c31f9911c5a75a7087f939eeb78ed5

resource
jaffacakes118_Trojan-Dropper.Win32.Agent.oijx.51c31f9911c5a75a7087f939eeb78ed5
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack001/WombatBHO.dll
unpack001/WombatBHOx64.dll
unpack001/updater_setup.exe
unpack003/$PLUGINSDIR/nsProcess.dll
unpack003/Uninstall.exe
unpack004/$PLUGINSDIR/nsProcess.dll
unpack003/WombatUpdater.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2
static1/unpack001/updater_setup.exe	nsis_installer_1
static1/unpack001/updater_setup.exe	nsis_installer_2
static1/unpack003/Uninstall.exe	nsis_installer_1
static1/unpack003/Uninstall.exe	nsis_installer_2

jaffacakes118_Trojan-Dropper.Win32.Agent.oijx.51c31f9911c5a75a7087f939eeb78ed5

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 ddd8e6084c48d2727bdbc6237b50dad5307a1092f456b461bd7d98a8d4870688
MD5 51c31f9911c5a75a7087f939eeb78ed5
SHA1 bb5c133a412ed38a4bb73e28ac57768e3bc36ae6
SHA512 140230d5ffba1b961735800d782ee3afc0d1aed7441b91cfc5e98de42b1220af51fa7f7a2c20235295703b2e4a196b83e40f53ed60b5d5e33fd34b3a1bbc477c
SSDEEP 12288:78DMwg1uNREw2SPQbBm4FnkXaMxkTp5wvLnppLiqsy82:NuNOxYOnkXVkTpyjXwV2
TLSH
T1E1C4AE52A10A4043F62B36F03B5F496512A02EB46C8C266E21B17F1529F235BED7FF5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
TLSH
T1B0524BA597CCCBBFC7511537B98A273257E993303924615FD9631FC92922853A93B302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1d195e0b6b402ad6aea1167e1e183d8b8f89d617efad14b3675cc5dec98d1009
MD5 3aaa886ce0e9e0510c34ad9354ec1d32
SHA1 2bda2a582053b9e3541f0b041fa44a7c072efb03
SHA512 3436ba3e13ba3a630ead16ecf910a7c0dc4c8e3b48e68d3a043032a70ebc7f445ca021ade87e7482b39a31e0b8dcfb51b3675181b5dbe3ddbc7afa87fa38beca
SSDEEP 3072:+gXdZt9P6D3XJoaKkjrDMf08Ug0q2Qr//gc0rkYKnvvwIGBOOG:+e346anDMf08Ug1uNAL
TLSH
T1AAE32E52A00B4043F53B3AF02B4F496412A02EB56C8C266E61B57F1529F235BDD7EFAD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 55a6a096df3564193c302728985d6bda
SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
MD5 431e5b960aa15af5d153bae6ba6b7e87
SHA1 e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA512 f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
SSDEEP 192:vIARvmFvcukSWn8EAKVZ8148Dj33RZgqWVWYuOUEjRuFzEun0J:v2mukSe8EA88pRZAVWYuO3cFznny
TLSH
T1B0524BA597CCCBBFC7511537B98A273257E993303924615FD9631FC92922853A93B302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateProcessA GlobalAlloc lstrlenA GetVersionExA SetLastError GetProcAddress lstrcmpiA GetCurrentThreadId GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId GetLastError DuplicateHandle SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetModuleHandleA GetExitCodeThread CreateThread CreateFileMappingA CreateEventA MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA SetEvent LoadLibraryA

user32

DialogBoxParamA CharNextA CallNextHookEx SetForegroundWindow IsWindowVisible GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx GetClientRect FindWindowExA LoadIconA CreateDialogParamA GetWindowLongA SendMessageW MessageBoxA EndDialog SetWindowLongA DestroyWindow EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA LoadImageA

advapi32

GetUserNameA OpenSCManagerA CloseServiceHandle EqualSid GetTokenInformation OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

WombatBHO.dll

IMPHASH d23c9e4c374ec34378e1b4e91a8c4427
SHA256 436bc384a77569d15d8b4e0a83ad08c8d403ad3293d228d8bae2e86a32c7ce8e
MD5 3486b4c9fe57ce355133ad15035f3881
SHA1 5e2cc050b3b488d77e2963f5d5b6a4b1d983780b
SHA512 afc76ec21aa8660ab3a5c8288c4adf17cf48fb5bfbf777c56aff8bbd838efb062538d5a1a51a2193be582fe7d3140662dda3a431c459e512429186eb546314ea
SSDEEP 3072:TxTdzSxOuydBeOimAkiML6LfCnlt6EvrCGxQArBQ3qOs:tTdzSkeOzcMLIfWlFvrCGxQYQaR
TLSH
T13E045C113A43C63AD39B123289BA9B16256DBB210B6781C73B9C6E7D5F706C27E35307
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

72087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\work\all\addons\framework\wombat2.0\src\cpp\ie_bho\Release\WombatBHO.pdb

kernel32

RemoveDirectoryW FindClose FindNextFileW FindFirstFileW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrlenW EnterCriticalSection LeaveCriticalSection lstrcmpiW GetModuleFileNameW MultiByteToWideChar LoadLibraryExW SetThreadLocale GetThreadLocale OutputDebugStringW FlushInstructionCache GetCurrentProcess LoadLibraryW SetLastError TerminateProcess SetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeLibrary CreateDirectoryW DeleteFileW GetFileSize WriteFile ReadFile CloseHandle GetModuleHandleW GetProcAddress CreateFileW GetLastError FindResourceExW FindResourceW LoadResource LockResource GetCurrentThreadId SizeofResource WideCharToMultiByte FreeEnvironmentStringsW SetEndOfFile LCMapStringW GetModuleFileNameA WriteConsoleW GetStringTypeW SetFilePointer GetStartupInfoW GetFileType SetHandleCount HeapCreate ExitProcess Sleep TlsFree TlsSetValue TlsGetValue TlsAlloc IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle GetCommandLineA RtlUnwind EncodePointer DecodePointer HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList FlushFileBuffers

user32

CallWindowProcW GetWindowLongW CreateWindowExW UnregisterClassA DefWindowProcW DestroyWindow LoadCursorW GetClassInfoExW IsWindow KillTimer SetTimer SetWindowLongW MessageBoxW CharNextW RegisterClassExW

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW CryptCreateHash CryptDestroyKey CryptGetHashParam CryptHashData CryptDestroyHash CryptAcquireContextW CryptReleaseContext RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CLSIDFromProgID CoInitialize CoUninitialize CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoTaskMemFree StringFromGUID2

oleaut32

VariantInit VariantClear SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen VariantChangeType LoadRegTypeLi DispCallFunc VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysStringLen VariantCopy

shlwapi

PathRemoveFileSpecW PathAddBackslashW PathStripPathW PathFileExistsW

WombatBHOx64.dll

IMPHASH d1c890e2ebcb5a7dce74d55f2aa3345d
SHA256 480c913d4504b718c5437834ef4529e936065ae7b2799ac8fa76027e17967482
MD5 e4eef89add1ab6b1a9faf397ca4246d0
SHA1 6df6e9c8eb4279cf60572e78236238695ef47630
SHA512 d3849346b3f9275bc47e02810720e03cf62d181bab470b4aa568a8f74d952b419317f20b3cf1baf4e640375e921c47c9b4e0cf2116689997c864c2dc9c554683
SSDEEP 3072:z5vLjozpWCCM8N+AhXzjATBjOZ2iTnZtN7tI0/vf2tQDbwYU4fmLIn:zmpIM1IgtjOZXTnD5tI0Xu1YJmLI
TLSH
T173244A1673A840B5E4A79139C9978B85F6B378420B3183CF226453BEAF3BBD56D39311
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

2

Major OS version

5

Entry point

79012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\work\all\addons\framework\wombat2.0\src\cpp\ie_bho\Release\WombatBHOx64.pdb

kernel32

RemoveDirectoryW FindClose FindNextFileW FindFirstFileW RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrlenW EnterCriticalSection LeaveCriticalSection lstrcmpiW GetModuleFileNameW MultiByteToWideChar LoadLibraryExW SetThreadLocale GetThreadLocale OutputDebugStringW FlushInstructionCache GetCurrentProcess GetCurrentThreadId LoadLibraryW TerminateProcess SetStdHandle IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeLibrary CreateDirectoryW DeleteFileW GetFileSize WriteFile ReadFile CloseHandle GetModuleHandleW GetProcAddress CreateFileW GetLastError FindResourceExW FindResourceW LoadResource LockResource SetLastError SizeofResource FreeEnvironmentStringsW GetModuleFileNameA SetEndOfFile LCMapStringW WriteConsoleW GetStringTypeW SetFilePointer GetStartupInfoW GetFileType SetHandleCount HeapCreate GetVersion HeapSetInformation ExitProcess Sleep FlsAlloc FlsFree FlsGetValue RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle GetCommandLineA FlsSetValue HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedPushEntrySList VirtualFree VirtualAlloc InterlockedPopEntrySList DecodePointer EncodePointer RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx FlushFileBuffers

user32

GetWindowLongPtrW CallWindowProcW CreateWindowExW UnregisterClassA RegisterClassExW DefWindowProcW DestroyWindow LoadCursorW GetClassInfoExW IsWindow KillTimer SetTimer MessageBoxW CharNextW SetWindowLongPtrW

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW CryptCreateHash CryptDestroyKey CryptGetHashParam CryptHashData CryptDestroyHash CryptAcquireContextW CryptReleaseContext RegQueryValueExW

shell32

SHGetFolderPathW

ole32

CLSIDFromProgID StringFromGUID2 CoInitialize CoUninitialize CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoTaskMemFree

oleaut32

VariantInit VariantClear SysAllocString SysFreeString SysStringByteLen SysAllocStringByteLen VariantChangeType LoadRegTypeLi DispCallFunc VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysStringLen VariantCopy

shlwapi

PathRemoveFileSpecW PathAddBackslashW PathStripPathW PathFileExistsW

adlesse_disabler.js

SHA256 7754609ddc35dfbc6f8458f8fb830d3a9d3c031ad6fe64bf27433196c1e30c2b
MD5 14284aabc3816a3daf44c1f1776202b9
SHA1 2fb1fe4d06a16e9c49d567d927c4447a37e0ffb9
SHA512 7c4a5130484aac9585e3bafa48fce7953c08205aa7690e8204ce570036a6037ec6125e61b5281dd28f1fa877fe06e6e645c4b1d43059bbfae122fb1a5d26d078
TLSH
T12F5130F17692B5B08ADF11BDA32B9407B67C48D7788EA1709002CCE83C3CC958266F99
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

cached_http_request.js

SHA256 7740c36edc047f02de7b1102f97da27d3498e703007d2319ef09f5d466519fa6
MD5 fbe5fc46464747eae76387483cc233bf
SHA1 858f997654508b671400db3e66459ae4bdb3ef81
SHA512 5651bae7568dfff9ca4db8d3b54226e0bccc962e07641f7ebd1c4542428b5adffd02938f76be831cb17c91d7fdee266beb96065001d27e99da88dae6f0eb6671
TLSH
T13F01EF452791306CE806145DE819BA00213DD1C8350FC477E029E9A7CC6420A9608B8E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

config.xml

SHA256 248fc619de96284d41ee089eda6f48cd706433436954f7654d8b97c81a56ec5a
MD5 e1f10a7b3189436667b48ed04b748820
SHA1 9dcfeff23e815930af7510c0f24f985ab832b581
SHA512 88944612801df24f24880c316f7381a97d44612c2fe2f7687e562e1c7539511ca7aed200d5a810df0358ec16de2af3cdaff1b1b03dcebc9201223c50d06ca785
TLSH
T19D21B3C17F2AE7921D05BCD57271E21D271C9D4133B3E84A28EA8C6B5A807ECBD42D9C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

extension_info.json

SHA256 7403da7f9f0abdcba64845a18053dc3751ebd685ae1a9cd3c65ca5b29bae22de
MD5 578ca729b3ad01b842e34ae83f9715b3
SHA1 2243aa12e00500cec96df5bb1022c2dc618c87a5
SHA512 1c51851bc5029d1b36dcb9c540506028be22c974d640be20100b680678dcaff2f1ea9ba4327a76c06bfb6981ea4804415b86c6f48dbe0ff6005bb8412a9deddd
TLSH
T13911EF284E075C271FF2AECAA3B94E85A2224ED181A04C3930CF445D379C3ED24C5B0D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

fastesttube.js

SHA256 dfa68a1a12f86a15cb4094eed5e292fddc5843b2a2793aeeca0f8d1416bd6e5e
MD5 4c1b85511958cf187a8802e2d4935935
SHA1 9fa37228a9d3b01220d129042393f30930a712bc
SHA512 6862281d86c304ea66c859faaa4e440556c2e3cd5fc57ef328cd71b0017be7674d0f9a2d5d7f4f0469168e07a7a1c78fb68f933f21ee2f3dd9846b0450ef882a
SSDEEP 384:vgsahs7MlIysFW21TQURQ3oobU0I3JC54A41p1BTIif1Dh:vgzTKg21TQUq3oobU84A4xBTIkh
TLSH
T1A46239F7B18319384BDA36A8200B1844B63A49DB5DCA4570C84ADDB568BCFD910BFFD9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

icons/icon100.png

SHA256 642d834a6d77151f80872c349a42f850c073d76f1960ec40c938fac558e407b5
MD5 6403388eeb606b002405229009b6af4d
SHA1 d5ac245a24f5efd49d812a638448e26a6d89ae30
SHA512 92f5b9aac7adfb5f57bce028962f7f21386795fbcdffe3522f97d17553fd0038c3e596b00370968833136b8ad512226fffebf944d066bc3077c8be34a1a972c7
SSDEEP 192:6ScuHKVHitqKOXXZ69/I7erJpcensoXCGMXHbROPsYfwN3HfoqGOQg2Boq8JxwfC:1cuttqNX49/IWpDSZ0FCPLGJd8rwjGFX
TLSH
T1BA42BFBA469B264292AF8BFE72418E6A52930B617857487F85218C2745DFD0102BBF24
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

icons/icon128.ico

SHA256 f3a3f60801812a3f4c92e954a03d7fff7cd251f9b866af1b806c8da874fe7dbe
MD5 23f377d7679c63c0515ff2b6e4a11979
SHA1 039b3ab5ea1cb3bc29fddb6b6df5157ac428c472
SHA512 487ab1089845227ac50bcdca31e47d8dc02cf6f75040ab3177cb06d7876b5f8a706f1aae46e1dd8122921a0fc7dd9fb4bc739f36d34a132022ebde2ab11e2830
SSDEEP 3072:VXnvvwvc0rkY/aKkjrDMf08Ug0q2Qr//:qk+anDMf08Ug
TLSH
T133A32352A00B5043F63B3AF02B4F496402602EB56C8C266D60B57F1569F236BED7EF6D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

icons/icon128.png

SHA256 d0642e072cca73a147dd1b92da2613646ca6151321c192aea1146a5f70f93872
MD5 f1f0b2a27966f76285ca911456cfe455
SHA1 5ee23cf6ab549317bf67da6869fb5a0dcdcc0bc0
SHA512 d6ca6c10f9c61873be355f2efd9d12c2f73fd309d060eca233459ad6dc0a0263d7dcbe299c7ef989fc3093dba1cfcca136ed64b960b554735f967c96c7dc1d05
SSDEEP 384:fBzOGcQl02tl3oT+lQ5hY/0k2VPLiD8dVC:wGX0crki/0k2VTiZ
TLSH
T14262D0E8EB1084F5957605FBAE8DE7C52A94F10EE8FF2D430CCC85A6610194DA287F9C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

icons/icon32.png

SHA256 4227574d3aee4cf6f27735cfd56bc68cb5f2a788d40fb09ae961e25d0621581d
MD5 483a826c5568275fd5b046f0d5c09570
SHA1 8be5a8c5e3d10ff30686c9e7d6ca41a30b904073
SHA512 9fa028d7607ebbb3807971f2a0a1becf8bb522312e88e178fbb385661b9efaa7e303ecc47b4e87ba4a058d9e64445c23dcc3a12ddb80888bace42cc3b10bdf54
TLSH
T147415C9008E037B6DBD0E7B300672122DC5FD381A91C5D9418124B7F6F53498C78469F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

icons/icon48.png

SHA256 1977eefe7cdc8a3242d4b166b65ec2e8877b9a74f97955ee0c59be84750f31d4
MD5 329680936d8c608fd1433ca0585439c2
SHA1 3f92b5d0fd1d1fce58898a631f96331a57462590
SHA512 21f098c815d90838c6bb30d4a10374a3d7f737a4b3b6b30bf4aa2d1d12ea4416e046b2072c681e682934ee92a4fbdfe4b959fd887e868e988baef54c743d655b
SSDEEP 96:cS0NpwjYijGn1h214qSdAR6yK0CFlCiz28u:cS0n2qnC14gUyK0COizFu
TLSH
T114815C9FC25CDCAB2E2572997EEF2864FB13F181FA7AA48815D25C48402888E314599B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

includes/frame2frame_messaging.js

SHA256 ad64efad1dd64d00a89addd194009125a320e4dda74245d5456501d468581fe4
MD5 0f207199f72a59bd04d3f27dc86f0910
SHA1 a7208c646838862f45e21fbb7ab1056c9946931d
SHA512 dd3bc5eb09afc40d84c47368b2a7e11ab587e7616a718b7e274766d532b5dc05dc2b2ca6632b71962e74f36839284bf971f9967aa22d095b18689274e0096223
TLSH
T1825131DA7390AE3441F6E22FB12FB308E53E9584B80C5044B259CDCEBFA5E8B1162F54
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

includes/frames_communicator_content.js

SHA256 54fcec46d06b08e3824c804799a6921ec29701bbc3ade9b2b790649631996d7a
MD5 1fac31173c08a7219e022b910429ff6f
SHA1 5537487aa9f446dde5cdb66ac235823c8bfe964e
SHA512 d58a29e5a9b048160252ade18b7216a1e3182aa25359941c89469b343ffc570a017f497a8cafab36509438c55582074bf0519139485055a82c8c4a8e473f3221
SSDEEP 96:vPn9GRn+9hwcaLwEFALMBkAy/PZu3Z1hlkYBAskV:vPnuGm8uAukAy/QZ7lSsg
TLSH
T151A173CD12B46D7F91A2B1A9603B220B703E58467E06A8C0767D8DCC5FF8B562117FAC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

includes/greasemonkey_client.js

SHA256 49c874ebee1841cb1c172f542936cfc4da5525519d3a7c2e15029e59285b3452
MD5 9b73b063ce88a56bcd42ea8838b6e229
SHA1 4921a53bfcf2b0f8d746e30a08302d0bddac7a77
SHA512 e1f5e0f092fcc44f080752743f6b9d513ce54211ca2ba244a5a5ccf9e895cd06199a36c0b6c653f8a8d00551277d515f10fb9dbeec73b8a70a53230f9c1f9e4f
SSDEEP 192:s5O+X0vYUyggg+GBJZRCFxoS02ewtPy1BOnTjp8gmaC:s5O6pN02gBOHp8gg
TLSH
T1EF3285DA7AA5712142023378953F1007702E54E4BC2B8468BA3C9DEC9FF9D4C5E96F1D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

inject.js

SHA256 62a889d941f78b14f40ee7a08064f634fb31ee43347248905b387694f45b6d99
MD5 9598ae41f90f316db4dc14dfefd65c5f
SHA1 b929c321ec7dde5a581515b92da5bb787ec70e24
SHA512 ead253421bf9f5cefb133a6c59a1a15a0b9da8e9cf3e4ce06e5c79aee2ae52514fec1f67e2b8a4393ae1f33514c582e3846aa8a0e35147282ec16d19f09ce412
TLSH
T17BF044BFDA68F4F81A59AAEE2864C02DFC5AF0582883C4B094CDCC187460FAA8052643
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

main.js

SHA256 e1395c7952f9d228226927e1003f09b435e6ef2b8977880b7919c38d7275b4e5
MD5 1e9a4e0cd4b948b9ce00d571d5c213b2
SHA1 52670fdb4c9da4befc3c0d23c1a70c366aaaadba
SHA512 939cbdb3314ca93eba68463ecd7131c6d26411c0085461e070fe76656acedf9cf37eaef75794463aeed3dfbd874b134c4e008c1fad52c1497c12f57ce2bf5b09
TLSH
T18411B14DBB9110B34CBF20A6D63B4014A71E517F1D93C0726039CD6C45D4809712AD75
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

page-context-inject.js

SHA256 9442687ccff22e53ac3b79517cc2b3bcea59e0f061a0275618c5d7e4c5c732d4
MD5 608cbe1f288c2102843d67434cdbf968
SHA1 e7e01cb65bcb2f7aaadb3143e20da0efeb04e242
SHA512 85182209d6c3f24ae5dc3aa97c417fc403d1afd27b72c3f9de52061cc8449a05d48a4226978a60c255e532c7e6e88bb88c1ce79a260966cae3f5b5229fd60cfd
SSDEEP 96:2QyPATFrznp66jwCXw862p3VLqLmWRZLYBE4XxCa7k0sHIY3Y1BAZ:23ATFvp66g86+ELmAcJZhCZ
TLSH
T1D091036BB5F2B022578AA8F4953B104E733E65AC590D439CF692DCDF3D2C806523AB74
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

script_loader.js

SHA256 ccc990f56bf05b8b74d265dbc2b8aa6cd8dd326e12ab108c5553f617859ef1e7
MD5 859fc481688afd9827f406a9a6f11fc3
SHA1 035881dd311081d57b754f0a0f4b3ee00749c85b
SHA512 669d2d9051cd674e7ffc9e6bc7629bdc3c8838a171119b294acf04101f7f1453a4e726de632ee304fd523be1c8b05ad4a44692e893d005e9e1279b6edf878d64
TLSH
T1046171CA2FA4C470195E109B583FF416502D01DA616BC4B4A8B9ACED98DCF89F965F3C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

statistics.js

SHA256 70aadad806cfa4705eb7f29f45e6da851d91b1e47041ec45881422798fe7e99d
MD5 329239bc8afd7209cf0ad31db91e28ad
SHA1 deffad32185013f98cba9bf1c57af6205ceda213
SHA512 3ddb2374d8f120e99c32d87760a253464d14e7930c3e4c10db74b95720d813e5111a99d22b325a497a1489458cda92d196de2b97fa838f69086396a7432a8d6b
TLSH
T1FC21DFC0B3C798748CDA2074989E541C527E52D5B877C078197D8D8BECF8D466726B2D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

stop_autoplay.js

SHA256 69540621d08db61682b5a223c48eef715e7f524d845bfa47138b2bc0fa45f41c
MD5 bec5ef7cf41e111f65ebc59eef7d69fc
SHA1 a364e1c900aae910878207d3bc0d30c2b8528627
SHA512 3a505f24dd41a83a30b4f0db6ae29e6246394b43f22169ffabb5a4efe583af3dadad902a3ee54e8f589aac8eca7ee702e3daec8c359718b4b5fdd85c10b6978f
TLSH
T1C6E068DEF9C6F421C6D230BA643F810AB1EA6AD41D048010EB024A803A2850D90B3BC8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

updater_setup.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 75266aacccab9c722bc982c64dd5217fceacfcb0d75c75aaff5295d713a5bba3
MD5 9acdf33f116ba267791fdf8d1a73be4f
SHA1 80dd4ed5c9723f652307521455184551cf19fd3d
SHA512 41c2d2e3e229bb5e113ee15485055e4afab0234361c6a1f2401f5149773c6708ac379a2ac509fbe0f41aa33c972f1dc8713ccfd2baf27408e341d04f2249d2da
SSDEEP 1536:KpgpHzb9dZVX9fHMvG0D3XJbC1OaayanHRLc1R8uyNkgOn/IHo5a5:IgXdZt9P6D3XJbC14xLGuuWkgOyo+
TLSH
T12773E16965C08DBBE5D10B7605BABF7BE77F85580712390B87A83F1F3D2244388181C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 cd315617ac170104b7f75e8f194086e30124dda7444ed586237d99aef5bdfeb2
MD5 15b9983bd546c98ef6984457996f5f6b
SHA1 e6fffac86f4c649da6b7074ae5a1f7459a65a00a
SHA512 769b429e657b49ca06c13597836f38eb32129ae3d1af437da336a6f602bd84f268222ae99bb8d2817ba591627c4e88be1a6ede5b46fa3cc2818ee1bbd3b5a277
SSDEEP 768:KHJd0TpH2+bQ2dUWVX9Hfv1JMWmtLEJOyuBxG0D3mjfS3XJ1JRnSCVo9fam:KpgpHzb9dZVX9fHMvG0D3XJICVo5am
TLSH
T15BF29F1B6AC09DBBD6D3063106B7B77EEBBBC2C902525A074B782F7E3D61543C915281
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
MD5 05450face243b3a7472407b999b03a72
SHA1 ffd88af2e338ae606c444390f7eaaf5f4aef2cd9
SHA512 f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b
TLSH
T12881947683E424F1C08F0D33B02A04DB6B76C9321326850D9B536F82A9A5AFBE03C311
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

WombatUpdater.exe

IMPHASH 86e31eea33bf316ed7df270b0b66ee8c
SHA256 87b33383aa0ffc3a9b3db0c8cd312e62e166a441110b05ed825da402626b5236
MD5 0f500f2d1b2408b0e78194dcc4c95041
SHA1 e7c48b02b3854a6a4aa4840b7f42494e8058313f
SHA512 94322cd5de0cee08caf67b968f230e998e26a14d8cd8dac631bfc65e14051262bd37a353f49c42846b3480d07989dd35371d5d919940c28d5f30ac860f2ee667
SSDEEP 768:1dRYglkbZTvcQ6G3TsA1Z8LhlkkF5UyvKfEYKEomZjshZ5fkgKBh+4ED1/nwOe7N:zR1Kt6IINAfEYj8Z5fkzYvSzYUkk
TLSH
T164736C113DD6C071E55255368CB8DA62566EBF221B3B90CB3BD80A2B6FB01C16F39367
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

25615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\AdlesseTrunk11\framework\wombat2.0\src\cpp\updater\Release\WombatUpdater.pdb

kernel32

WaitForSingleObject RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleFileNameW Sleep CreateThread CreateEventW GetCurrentThreadId SetEvent GetCommandLineW CloseHandle MultiByteToWideChar GetTempPathW GetTempFileNameW WriteConsoleW LCMapStringW GetStringTypeW GetLocalTime lstrlenW GetModuleHandleW GetProcAddress FindResourceExW FindResourceW LoadResource LockResource TerminateProcess SizeofResource CreateFileW FlushFileBuffers GetConsoleMode GetConsoleCP WideCharToMultiByte SetStdHandle LoadLibraryW IsValidCodePage GetOEMCP GetACP GetCPInfo GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WriteFile SetFilePointer GetFileType HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection RtlUnwind EncodePointer DecodePointer GetSystemTimeAsFileTime HeapSetInformation GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess IsProcessorFeaturePresent HeapCreate SetHandleCount GetStdHandle

user32

PostThreadMessageW GetMessageW CharUpperW TranslateMessage CharNextW DispatchMessageW

advapi32

RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegQueryValueExW RegCloseKey RegCreateKeyExW RegQueryInfoKeyW

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitialize CoUninitialize CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoAddRefServerProcess CoReleaseServerProcess

oleaut32

SysAllocString UnRegisterTypeLi SysFreeString SysStringLen SysStringByteLen SysAllocStringByteLen VariantClear RegisterTypeLi LoadTypeLi

urlmon

URLDownloadToFileW

wombat/_locales/en/messages.json

SHA256 c217f10f190294902300236dd82949a65b6c0f4594e7cf22de1a826b8319fc9d
MD5 da216c779eb975c18116614ec99d2c5e
SHA1 7aa44dc8c791a952f9135d76582202805a277b50
SHA512 092ca5af3f54513696e344c296b384daa0f7f1872d3aef12100c3e59f10b213a69a86482600d2f0f68c40ec46966a0a8b8487c685598a207a306c8fd4f3d339f
SSDEEP 96:Ypbp69aiH271wBJPdPSqGe8+himpGpL9fv6dq6R/LDwH5BnDbDz2ipzA:RaiHdDdzGuh3pGpL9fv6dqUuFzA
TLSH
T153E14D0B6AC92CDF20DE46D17572A9F04DA30BD4C3AD68FB6C4C6B0CA29D94341A7776
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

wombat/_locales/ru/messages.json

SHA256 ab2b95f7e6fc2d2db65c3944777860e9d747a55ef7ea4428fec28140706b654a
MD5 b720bbe3d9a4d3fd56a899bb348e31aa
SHA1 b0a9fa62f5933fa45330d4888cbec5d416a62dfd
SHA512 cf5a6c23b12e23af37e588ff2176cf0fa1001bc192bac3d1d52ff92491c4fe23706f1896f46d777ff1bc326020323c31a1e9f9f6f2e6185407ef5fd5efa983ed
SSDEEP 192:vX9jN3Z1kJDpd79pMUbU1WnwswUNsmTFs:vX1NbvF9WLTK
TLSH
T1B0029E131ACA34DF208A6146F930BD982CB70BFDBB5D76FA1C542E6E71ED501416B32A
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

wombat/browser.js

SHA256 f87afbdfa615228fb94924efac5c835d71eafc307affc1d90fedabf68553f2f6
MD5 122a0d792ee2fc22ca5d7d4062ca961c
SHA1 531c1e92e27fb49d1469842c75d9ce2f4907cdf1
SHA512 f9c2f426e0d628c8a1922871dc21cbbdf0f5e04f76c64bd8bd27cfc7f03b1ef85c5ec128251d1b7aa89c4c07bc483801f9958c9083224fe110a06a6c8e900938
TLSH
T170113BA06FA5E93045699861A36FB301165E80C6E4421816603D8DDDBDF4E4701FDEDA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/button.js

SHA256 13f70344843e7c21cce2f2be609ffde735f985c407d8720e2b20247df2923bbf
MD5 23b91643ad8999193115ed40e94a5c03
SHA1 06837cb746d1269915fcea03bc98796065029807
SHA512 e80e98ecd16eef442ccef8f64febf9e9a855053046d7929aa61e4e641a027b302987163322533bed41e501eca8c39463b10f589a7e40c1e215c9a3c60924f885
TLSH
T138017BC5F3902A3502E6B15F892F1200581D11666DB228286294DCC7ACEDE4803DBF6B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/console.js

SHA256 0b4c5bb6dada7221d515e36b5c8d3e896f36f1bc2cc11c5d697e00cd521cb94f
MD5 38b953e18d166a5aba889f05b4cd628d
SHA1 b85441662e9df17f104aaf322e5c25b238247a2d
SHA512 b6c126db3044988ebd51e3984f2939d3f264f32853f28459f1598f05563eb1f864b7e38a0fa016b169351f40a653e615ae5c358aa8e65989007052ac0c39dfcd
TLSH
T1B0C08CC30ED81130428F2013880F0A01242EE988DA1374A020184C7C89F0C40230AD89
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/content_messages_loader.js

SHA256 a8c92ab77e70e9db3e242fcad63eea0a86046d5971766270b1b2ad6b3180dc94
MD5 8617e3f956be83efffb0f36eaec9d833
SHA1 0be49e9a114c7b90cd606be74155ab953df4a8c6
SHA512 3b8c593da5c0adb2c3e6b41e8e332df58f602ed5a0a2265dfa573f4503b23c83085d118ac3f79314e9d48235f28d5b122af58ec0e3b7187c260790a58eea10ad
TLSH
T1F4D0A7BED73D8910256780F2859F705DEC5C25823556E07042440CAC14DCB751172E8F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/content_scripts_at_start_loader.js

SHA256 4a17c4f55b554fca5991e9b090949b1f24e85b4b98a715c492a896ebfda6e8a9
MD5 68b6807272ce9d4da4128021d38785a8
SHA1 5148220bc9178ff1c092b8aa435836d092eeeea2
SHA512 c1ac4b4da4d89a04ddd422f34f507b02f9be834e342714957383e69c076a879499018718b15d4ef1eb7efe180eece8487e27c0edb2b11856273908c2b0187ca3
TLSH
T1B0D022B68B08C8704297D097CFAF62AA889C32836CE1D0B084D60C8C00C8F331140BD2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/event_listener.js

SHA256 44e43f71c59db94702188bc0885f8c69c0010fb7f16dd5ef95457bdfa2bf8c31
MD5 62fe5aa61fce61047e0e598d695bd202
SHA1 24934ef0b5edfad0cf447c8076ce7af25f6fa960
SHA512 c4fc9c88ec23ee500ebee5e540094b46443d87d4b36bac42f8274ffd05c1cf3eb35518a4ad9641aea5e43cbdd0a9db2aba4c852b5608f867044bff61ef905af1
TLSH
T14721CE5D9385063501F1D30F3E0C7786215CCFD1A81861C9928DEEEE2D97C8D20BCA24
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/frames_communicator_background.js

SHA256 ccc3b1bd9d397b6d13a18b99eacbce617855b9056098f4d61ec4eca29f37fac6
MD5 2a9a2d450b5c0046b47525f9a8834e95
SHA1 a96ea4a204e23d136723aa7cc04f9e6fec439d3a
SHA512 2133686582fbb01f3f017d2bf28077b414cfa8afbbfa8cf6e3b69c39ce66e7cb89bfc538a4baaa774309962075971e06865b36b693d832e58f41cc2e378cc8be
TLSH
T12731A14863B6343F5023F5FB403B0556616AEC95B60B1CD87D59ACCC4F145096249F38
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/greasemonkey.js

SHA256 360d0c5062da60f9c49096c5d1bc22fe76389a16f28e819e3e2199e8e5434e18
MD5 81d60afa8fda72cfd56195c6e22bb81d
SHA1 ac01526a12b67eb4002f5c0142302fcd18421305
SHA512 acc7a2838aa8226f879085b8d3941b3c1de2ab0294402081fbee2a50f040f04d7788688e493b55b7e8f5a5e7f3e331830685e8111bd6442afe1cfc9961f78673
TLSH
T10F517280EDB9A861816920558C3F448E616F7D937A0D8068B2B0CCDE98F0BDC559BDFC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/greasemonkey_init.js

SHA256 d2503c6cca3d67419c070b34f680b0402911353ceac7169ad7e93971b4808429
MD5 d7c5123ef2aa9d3e019e0e47df29b34f
SHA1 e564e196d2a6bbfa35c7a00e2ed6c36fef74fab3
SHA512 43973cf2d45943fd1fee1af874e55a641fe4107f3b3567fb17c1131a682174a06fa3557ccf348b08573601157d048403b0f089a4d21fdf1461b19998a74ece28
TLSH
T14CC012ACB72D39B2097751A5A33FB6046E6D31C4AA831420047D5CDD16B5C05C64EDCD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/i18n.js

SHA256 8c690da5b2cc12900823767e57a2f96cfe3fc6438293f502ef59bd124d2f0e28
MD5 4ed1a9fe37becc81606370d450ee96fd
SHA1 f9960bb2dd9e845cd4c66eab7faef5cae7e6c642
SHA512 703a1d8f41c7ce037eb96787d81c8c2f75fae83b5da669507124c45e4de2092dce7582b85c67ffbc6d0ec179cc6668df2f556e7f1f35ca35f9ef1cde84cd5ca8
TLSH
T1E051398DA783143B801F20501D6B101B50274B9C600BBFAC74BBC8DE9B9DA9E5AD3FB4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/init.js

SHA256 3e690ec3087e057059a3964efd893af3e4673a462a99c598b0df79e4c3062752
MD5 e3365db76e3f8d2c12a9e4e780f80394
SHA1 aac709756f0e2c40544806c16252947e5f416400
SHA512 c110748001ef1c812a117cad641dd05afc196ddd71c89bf0b240db55e4659d2dac94754eb6f4d889cbc2bbaef4b93984bc26e188ac2b1d1b5feb5309028efc01
MD5 SHA1 SHA512

NSIS installer

installer

wombat/io.js

SHA256 83e5247473b0950218d17f5dc5387939d4458c1d42b40cc9f5a3a26b04bb8780
MD5 f79f2f99420a69fc6b87c949d5a8a117
SHA1 17567ccfc2375a1006512074a87eacaef0b10782
SHA512 dc55355038b9cdc00648b6e610d37af8c95ecdfa80b2dbceac04917f74e96bb3e398ff79d006312c160008dfd1191208413fea509e38f51afa68f6c773f64741
TLSH
T14EC08C276098D28406FE9021C69F212B3B3D80EAA813032040808C8DACF0B391562DCC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/json.js

SHA256 12f62602ddf1d274b17e659ccd228728d37fa6366c09e1e549b0c4bdaea83ef1
MD5 8cd61e6f3c279646cf8e0a2f1c386635
SHA1 e10d082be78c90d5ae128932b439a2a93f20832a
SHA512 452422538c3d9dea8521f3134211b015063c0b14028088c992a2f5d5c03f957295c2b4282fa454e8807bf86d84af0417973b517bdf260fc1bf33ddef425619c2
TLSH
T1AB5162CE3470B402D9B72551105B084FB1BC9FE8D4EC94E8ABD5E9F129F541E0A72F15
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/messages.js

SHA256 820b289b3d5b82a5ee88f5f2f70b570a45c73992c05ba104b3fed7c1b27da8c2
MD5 04505e3a65ab01bce2b4bf1ac672c22c
SHA1 acb3101099ff843749a881ac04d8563acda190b0
SHA512 9bba2a27fad8e88f716ac1fc57ec69ef525fc0bda56dddef3fae87623e3b8957928ffa3b0cb232fbaae88b4d094d5fa07b55903ee7eb136409d4caae7e2c6c9b
TLSH
T15F115CCA6BA07D3D00AB9637B22A3201523D60CAD0066871D17CCDCFAFF4DD62266F58
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/messages_bgClient.js

SHA256 89a31f754737bdc684bceea4e510367f549c22adc65cd7155e52e0aefba348aa
MD5 e5cc57575a73cf77e2671330a7df46d0
SHA1 bf2900fbd86dc12abe1f2e2d18a8e28cddf2c94b
SHA512 4927985cc55fe5c83406cbcf2003bacfe98f5e8a5b821c32697a1b94adc470a27853fc4b650815e8696d1538af5ba225e92755147fb8c51132ac390e423cc042
TLSH
T16CE06567A7202C7C155BB325B206B104ED2E24C854077062DE1C8DCE97F0F8B6306FA8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/network.js

SHA256 6e7731ffbc489076ae6c345d3c3cc092d52487a83752a453155999d40f53cdbc
MD5 39e0fc46047423b826472e4e0e6e981b
SHA1 ba5b9762bf337d2df0ba1fc65779fcff32ec6615
SHA512 0747c9329a7b0c5a1cb8621fd8c3004705eea30c98ca7b1955f480e3a34bf97364d00bbdd6889090f5657f7cf3efd16f758f846755927a02bb6e11d4a6f2082e
TLSH
T1A5412F4B6600D0AA475A61E4CB0E5941B12A94AD3507D4B5B330DDFE8CE4A9E244EFAF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/storage.js

SHA256 f4803eb1b1625feb1fdae01cfe9431c404fb4e0348762317c1631d7b44b28d36
MD5 c23ed66704a6d2353689d1ffce66b5b1
SHA1 7c5ec635c1ae61f56928ecfe41c9eb9dce2c9b39
SHA512 cee76277a0420e1cc1b84b436be54d02394851198bddd1c65b0f2baafc65180966af5bb1a2222a249006e932c67398c17288a30eb946c51eee714adb24be6fbb
TLSH
T1EE113A845BC4103C50EA30146D0E202E6CAE56C5AC0BC8A4DB794DCEF9D8DD7D1A3E5F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/system.js

SHA256 2da7e16e265c03b349aca641472b0aa2de67b866ae48095b91df9e7cd46b4a04
MD5 eb8834b3d258bd846557f421e1f6dd9f
SHA1 60bbb9f10d454b3185b916da3540c2378597349c
SHA512 2a2b9638f647459980bf304a3cbcd69b620978acb857dddad12d1852fbdf352c551f3ab4c6cebb1b3652709f000d239aca60fa8b9c45c53df473d054a65d0028
TLSH
T1AD2141F877A224B590CA3801847F0103502E0AD96E27C8EAAA00DD6CF5F4F8C3315DA8
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/timer.js

SHA256 c4ef41f229a34de0ccac578f7e4185ae3af41b409758c7b7ddf12d3e2bfe5ac4
MD5 c6faebd19d6a1d246e850c487a056168
SHA1 8bc748bdab7e8304e0d2ad3fb55f2d858476b76c
SHA512 9760ce50549a7e824f2b861728ae017bbe4a31eeae155cf94c436503e245d170a553820dd25d0a9515aa5d367122c14f4797218ed26bcdc357517703ce2be94a
TLSH
T179E0E54D26A6A09713913920023B4003A26E6BE760021A78A5228DC1FDF9E136123FBC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

wombat/wombat.js

SHA256 ed41dafd6565c953b3c1b636aa6750f4ef784d8eb76d1b8a1de82fe2e3f806cd
MD5 21f9e8bcd87b0b42060e0c68770820d4
SHA1 c437d11f159dab59433b3a8626b527cfb8ff105b
SHA512 c3e390d9a0322eebbe263da6bfae83781f80b2e326d369ad9c36c05e5eea7c8d31ab468af48c58a8f9df90f38744b35e76f31baa05a20d85f7cc9d48fcb46a4b
TLSH
T1805143CC77A4E07441A3B2A59C2F310B923D6D94749AE8A09288DCED6DF4F4D355EF08
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

youtube_ad_remover.js

SHA256 6816ee173ae25177610e67fe4578ae3722f7e2bf8e7e2a55b5f5ada977990eaa
MD5 7deb608d2f4e57ced0537e2c2fab99e8
SHA1 ac93a40903d099f5efb613cc3f8ed466b9f48c68
SHA512 f7ed077f9c116c95d843663ffe929292d5ef20658a5eaf1d646ef2125756dcfe3f634d659f50ff1d469c81d988fafffebd1c053fdcb451da9c80870ef07b18d2
TLSH
T1CD31ACAAB5D2F0E4CB4961FD743A510EB52DA488344FC974D14ACDEA3CACC059217BA9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-Dropper.Win32.Agent.oijx.51c31f9911c5a75a7087f939eeb78ed5

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsProcess.dll

kernel32

generic

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

WombatBHO.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic

WombatBHOx64.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic

adlesse_disabler.js