jaffacakes118_not-a-virus[.]Downloader[.]Win32[.]DownloAdmin[.]hrvk[.]c0114a3dca0da2316699056a984897e5

resource	yara_rule
sample	upx

resource
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/CustomBrandingURL.dll
unpack001/$PLUGINSDIR/CustomNSISdl.dll
unpack001/$PLUGINSDIR/CustomnsWeb.dll
unpack001/$PLUGINSDIR/FloatingProgress.dll
unpack001/$PLUGINSDIR/LuaBridge.dll
unpack001/$PLUGINSDIR/LuaSocket/mime/core.dll
unpack001/$PLUGINSDIR/LuaSocket/socket/core.dll
unpack001/$PLUGINSDIR/LuaXml_lib.dll
unpack001/$PLUGINSDIR/NotifyIcon.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/custominetc.dll
unpack001/$PLUGINSDIR/lua51.dll
unpack001/$PLUGINSDIR/luacom.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis7z.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/$PLUGINSDIR/un.package.exe
unpack001/out.upx

resource
jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.c0114a3dca0da2316699056a984897e5

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.c0114a3dca0da2316699056a984897e5

SHA256 dcb40aa2d8b77ae5feec8ef66288e70a685c4f40dfe94a294f0e341f70f3274a
MD5 c0114a3dca0da2316699056a984897e5
SHA1 a1394fc3056e43ebe534bf25e013fbeb4b1fb287
SHA512 787d512043d57af24535dad03f223e0098b0b64c00f3ab2080bfd70cd8f38809f24b673239a5446c3060db281b3ed5c862df2a7685d1862bdee500bd0189666d
SSDEEP 24576:fdSNu2lc2/5kP2J4+sJ4sEL1jjs+THx3IIxa2ON:fshx5k84+yDEL1jjtTH54jN
TLSH
T16C050241390CA4D2EA5D423ABC1F9E568AC17D7EAB8056EF71A5F3DF30F22B64227011
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

56:5b:7c:4f:86:99:ac:a2:1b:67:c3:ec:ae:b8:65:6f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Download Admin,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Download Admin,L=San Francisco,ST=California,C=US

Chains

Jan 1, 0001

Subject

CN=Download Admin,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Download Admin,L=San Francisco,ST=California,C=US

Serial Number

29:52:9b:0d:18:5f:85:25:a9:2a:86:6d:4a:38:da:3a

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 3, 2010 - May 29, 2013

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Minor OS version

0

Major OS version

4

Entry point

4156368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/AdvancedTests.lua

SHA256 80951dcdab7dc7b8b21c949809b061157a62ed242eb0b6f752f32531cccfe6d9
MD5 01e04c6e40e25adf47d65429e60441fe
SHA1 93bbd24d33fe3aaa418a41577b2e87bc3dbbe214
SHA512 3657bc5487768a8c71ab5058b7ed67a58006ec71ba80d8425f69737b4209b326b2ebc2fea84d3a4f50a1486e6b4426084d858339cc25828e13f12a7fc8564d42
TLSH
T1C55113C756C66E301AF1D2C89996108EE650510B0A2D425EFA9D42C43F7676CB1FA2F9
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/BrowserControl.lua

SHA256 f91397b5af21804734082c7b09cb5ea30da784b4657418216bb6c2ae4e25eba8
MD5 96c3b81968e0ec27f02ee3137bf4f1c6
SHA1 e410860a03f1e05c2f704a1a39989bd46406b25d
SHA512 af06edce6920caf1e1d90250aff753be4fc4cb128dafabb51048f610ac99f93f0f5d84adf85756dd7be3b0947c96ade2bd0724c1218776e6a312b98db93b0b8c
TLSH
T1CB6186942C0FF8B84D71A262674FDC58F277015F0149A24870E255C42DB03EE66EFAEE
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/ButtonEvent.dll

IMPHASH 0ece15e7d9bb35972aec701f46192460
SHA256 5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2
MD5 fad9d09fc0267e8513b8628e767b2604
SHA1 bea76a7621c07b30ed90bedef4d608a5b9e15300
SHA512 b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805
TLSH
T1EF81523B97A026F1C640273B53D71E629B3BD1302316B02D8DD32D0CA93055BEC29743
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomBrandingURL.dll

IMPHASH 82f18b0f522c05f362fb12db10cdf296
SHA256 2c33db8babc38e9c824d025b594626dfeee67c5319dc93396239899647f87156
MD5 e4c1b74859c17671ffe1c0602fd56b44
SHA1 15ae7d83122a1dc14d79e6c0a2e6565a9ffc12d1
SHA512 9dda77eaa71371d3e1d068d3740435b5aa3f198818e46ae31e19cab8b084bb131e088241abf1a0f7f78179745a1665a9bf500f97ee25cafc7f85c5a1c234a925
SSDEEP 48:SMq1qEwUNRYDeKPTeKp4GN8C8hgIV2f4ag5pmy8WywlhQ7sp9CSC2bH:hq1q/QPKSKp4m80i2QGpvwLXLCtGH
TLSH
T1A7B1FA3A73C645F3D73302326A631967BBB945120352901FD6AB17E9F790D2BC801763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CustomNSISdl.dll

IMPHASH e8a575fc69c67b8f92ba9e9cb62af0bf
SHA256 dcee4695192b17a77ca40f63234298fa02326bde2a2a34bab373ac5cc2fc5f48
MD5 bb81b9946ffc1e50b7a052cd00ac2690
SHA1 0deb5a4c1effa39d22e89199dbb1e6695246848f
SHA512 9c1e9fcac43aa41cf6db56557a7d720db52013b78e048ffa821e608868c2bc97d30aa9087047a5faaaed39655759da0d6fd6097f273c30ce51b0f0963c8a739c
SSDEEP 384:kBrBOvI88qsfnZsFTyQ0mipmycAC/hZAOT8pA40PIL1lBlE:kBrmB8qsfnZeTyQ0mZ7h26g1d
TLSH
T10B13B321D211F03FF4F3297A53EF176AA46852B8270624C734D8EA9ABBD45DBBD31106
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

69997

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Programming\MonotoneHome\WorkingDir\Employers\Franco\TightRope-BundleManager\Custom\Customnsisdl\Debug\CustomNSISdl.pdb

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/CustomnsWeb.dll

IMPHASH 199dbccca3cc8b8a2cf04186d02f4abf
SHA256 39fefafc4ede6838061b804a44b0416ed4929c3c3ff9e64b1e0956186734094f
MD5 f705fa42cb1edf73153cfe6bef657387
SHA1 24462c7b144ecb7778ca7a93b9e1dd62464ea81a
SHA512 d993d37b53b60a009021154e5032965c29789fbb8d7b0907dc0877f36abe5d7456a33a8e3111158ee82fd306d24d3aeabe81be776ca5d2f09b8413ff437aa936
SSDEEP 384:Rl9jSW3OJO9zbkU3UjVzU2QSvA5q/8Bigip:RHjxOJO95mVzjQCAU/S
TLSH
T10913D99CAC06862AF8B2417E46B8D527726EDD14B314BEF7205C1D126DAF1F329B1CD2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

70127

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Programming\MonotoneHome\BM-Experimental\Employers\Franco\TightRope-BundleManager\Custom\Nsweb\Debug\nsWeb.pdb

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Events.lua

SHA256 895e6439e002183542b13720976a8e8166718560149f876141bd1827e4238642
MD5 5a7269de2a693363b32d3f9e008c53b6
SHA1 7c4a71a0671933f815046672277dc0e9443503e4
SHA512 306db56fac8c717f8c42056d56d10465f2c2be803135e46549b46747ae34635e027782950e13bd4b511b02254f517a041a4a7d80afc0f9bf49b8e9aba157bb9b
TLSH
T15411C08D3144EBA551A65B698F3F3806C23440D356BC1B9978D89F411F7227C80EBFA9
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/FloatingProgress.dll

IMPHASH 1806d0504ce03d24690879c2a67010a6
SHA256 5caf7bccc7fb43e43a50676a2466803cfb531f6416c6cb797750513770da6e18
MD5 15bddd79574770cdbab1a9c13832d344
SHA1 dd63bf21db7049ba9773d0d06dbbb2d9b1ae914e
SHA512 52f29c250a2426f43b67577ed5efe17992fa9ccb361cd1ad6ec19a60b02e2b7ee1c5a8131a29e37f84636d30916d6d2018ac769483861d1da3b0a1f4c91eb87b
SSDEEP 48:SBn9+qyt9ofRgODb/ZfKVT60l/5Lh4VzQqO3rwBRbN5:g2k+O3/PIhIc10BJN
TLSH
T1B191863263E0CCF6F47A1673195328E5A3B5A53027A8560F5A9F42CA6505C4BED7C723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/GuiInit.lua

SHA256 db891bd456faae03612ed19ce50095b666ed9c386ad35c20fa2d8a7434dc5e68
MD5 44879782a55b78d19f276043f07262dc
SHA1 ac89be828dff110297db3bce418b8e380592eaad
SHA512 8554127a9c7cb357f99353d3ecf8d8493ac1025fa1c4b6bb711fa042609910b7d086447f98d6bde676b1f8bad841c56605acfe1547d3951df7a8cdb5083294b8
SSDEEP 768:sYoHyuV2IsI8kzmTxMokkhj5fM9j+Vs5+YyIx:fwyupBRzmTF09j+nYJx
TLSH
T13DF2B54B72C16A723EF2836A5E8F1895F62144130636A578B6DC42C43F7525CA2F37FA
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/IntegratedOffer-Truste.html

SHA256 8ff0e2ef8d8f772602ee4961bc5fd5fe0cff2dc2da550e537f3cb7112665224a
MD5 ea4501376a82bbf5e1eaa3ac87e33f04
SHA1 f54364a23230c6da027701cf801e233530fde116
SHA512 96494df75e25f4e625dcacaf51bfa956b44068edc5a72311cb7a5f405a171c67bec3cd596f643fbfbd36d0cf4c733e108394f738769e288c525f73bd9e36f4b9
SSDEEP 96:dsEkV5dynO/34r5kGk1wqJqt49JOnQlVewEe399xkEEl93s5SzZCBskp:v65InW34kGka8a4OqnHrxbEl93fMBN
TLSH
T1C8222F5488D406159033A296DFB14B4EEE628147C347A6083BFCAB939FB7D49C847BE9
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/IntegratedOffer.lua

SHA256 9b8414fd2a53b5e0be91c347927544fdc30ae766b47f839a38217c580e77ecd2
MD5 74e67115fb06882f3f9bb9f39ed94068
SHA1 ee97bf08a1e35b7271c45429d7ab8799f5f88f1e
SHA512 81ebd625433ec42ecdb50c3465d6fcbef04bd2366e1054d5968b1cc5147488cc0b0b31b499650130e8720a8bfbf9f6cf12c248c93b238b4c47f35a4490c40ff1
SSDEEP 192:z4qYE7EmEm8EySHXR3GIEOaIvONqLpbje+LjqTwiMOgDIBFVf:jnnJL2wi88F
TLSH
T18212B765351AE930AD73AE617B4BE900F8A2615322BA8211754F9DC01FF016D92EF6FC
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaBridge.dll

IMPHASH 0d5dea19c779dc8386a6849bf7064ab2
SHA256 959c090aa0c41925dbeafbbd455cd766f8d3b8d62ad47b8f8a0116ad542efe79
MD5 8e11ed4d0b151add7e69bdd36bdfe349
SHA1 6cddd66e26a3a2d98b32f5db6f39e6a32f9b3807
SHA512 4eeac9ce126c87b068d412b72c8c6c73ba5160b39f9f302aa5c16014cbc9d5c4dbbfb0881c65736c85131266f18b5f5814bdff0de5e602b91b9972802b8c0fcc
SSDEEP 192:i7eFv+UTmEZbZIPlKt5tswGZQu1PQrnWVwxlhgzNpkfnT:iOvHTXZbStWu/lPQr7lOzNCT
TLSH
T1F742F801632104B1DF9501B1B077BF128AFA780172C3585A9F5E66893D63B96DF3B78B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9140

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

z:\Programming\GitHome\populardownloads\Employers\Franco\TightRope-BundleManager\Custom\LuaBridge\Release\LuaBridge.pdb

$PLUGINSDIR/LuaSocket/lua/ltn12.lua

SHA256 b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
MD5 e440044afe6c761507a996b5b45ab0f9
SHA1 ef772c758fd5d6098b41375f35ac26f3963cc306
SHA512 8a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
SSDEEP 192:PYfxR7f6v6kObk2D0P9+INoAlEEvKbMEMuWKlrSDrGXJ5GPYbo8+b2uP0XJUMwsr:PN6kObkyar5libMv+sCorbrMwsDiDK
TLSH
T1B002BB8A3D86F1B569F2DA99984B6401F1668853827A0164FC1C94D43F3026DF3FEFB8
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/mime.lua

SHA256 e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
MD5 4bfdaaab9014fe129bc6388fd5687c8f
SHA1 2c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
SHA512 3a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
TLSH
T1CB51E260BDC3B4E1E4E3E856D19F5814F0692817103512A1BC4D16971B7357AE2FF6F8
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket.lua

SHA256 15fd138a169cae80fecf4c797b33a257d587ed446f02ecf3ef913e307a22f96d
MD5 74dbe1060e91112e1c21ef9870b4a587
SHA1 86afb6aecb0a8387ffa5dead1cc9808332f94310
SHA512 73218ebb2ad27d3402173054be997089549698d9112acb4b1c9fe044689a40ceda3df00304d336d2034e61c04832f52d971509240414838841d40f53fc0c3723
SSDEEP 96:LGvAOKAXAHPAF8AHnAHqUNaewVMw7MlvMncAlMNAA/:GWaoP3onoqBJVv7Yv7Qz0
TLSH
T1D781668DBDA3F265BAF3E694998B2005F176845312781106F85C80A17F7251DE3FEBA8
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket/ftp.lua

SHA256 26167d7c0f511cca7691ca5ad6ebf85b4427b94ef12e110ba1da75f023db8acd
MD5 4f83a72dc82a78cad6eb7edbe7d2f152
SHA1 486dd564c3b2ac467e3eabfad806308f14fabb5f
SHA512 a5ca1c8955a450a727950d91b720895db55f425f2531bc2d2d17034363961ed52b6cc086289f966ac3c27b056452ab5126ec7d9bb34cf5a92fdf0f725f40781d
SSDEEP 192:GsooRaLonJfMxBs6gZO2zMAcTcGZqx6iOaBqzw58GkJ1YtWKpUM7+C26a8RqN:GsRaLonJYszU2zncTHZ7iOaBRkfYtppO
TLSH
T16A12ED4AAC87C69165B3C562944B6803F31F5113966C160739BC87E2BF3092E36FEEA4
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket/http.lua

SHA256 d10fbef2fe8aa983fc6950772c6bec4dc4f909f24ab64732c14b3e5f3318700c
MD5 7bd12178adca19b584ed1320fdae1e81
SHA1 839753d73984bda68047585bbc36f9344f51c34d
SHA512 634428c0e7dc62e7c44f60586c0ab0cedb8b55d9e7f2432f7f681aa58e0a8a444168d104d25c51b7839c06817f83f52a7baa4a0e45df6db283d6d5aa0d5e424e
SSDEEP 384:x7/thyc+f7zLajrZhVoaOt2yyViz/vcvwkD:F/thyc+f7zyoaOt2yqiz/avD
TLSH
T194421147BD83B060F9F2C255E9871A06F26A902354291095F8BC42DE3F711ACD3FDBA8
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket/smtp.lua

SHA256 04a2bcc6eb8be03803f7ea4c9aa32e6f70f97fdb6b3bc5ecc5e990cc9932ac90
MD5 29a883b6fb47f87609d0a5b1973aa45b
SHA1 6a36815a72d6d7e6c9ac987461e195d17ff979db
SHA512 c5c648445ea950d58affbacc8b299f26e80b55c4027195cdc055e7d2ee7e3593a59cb36fba8b8dbb8861603d5a03d9867065052b6a3bfd18590a8bd9dd96aac5
SSDEEP 192:hsbQbmId+aSnZwS/UjGf1MT+IsZDOD4GuuJQwDTaBrW:MH8jk1MTrsZDODhuuJIi
TLSH
T1FD02014E9C82B16414B3C5A6D44B3847E21B5103492D1156B1BC86E7EFB05ADF2EFEBC
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket/tp.lua

SHA256 343afa62f69c7c140fbbf02b4ba2f7b2f711b6201bb6671c67a3744394084269
MD5 2cad406e591cade482c7f16f39c21481
SHA1 84a3ab88ff7a9102c2c6d21bdb6eede6862167a4
SHA512 ecc98991c25036b54f2bb71b3229e4bc8fb401e55db0e5f9c958c2a7b00b40fc9ae2d7e45002d4f2a03cec85535785c42ab6d20476fe095a76444d143493b145
TLSH
T1A271CB867C43F6A4A9F2C665A55B950AF1BD4513012C0085BC8CC1F6BF312ACA3FE7B8
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/lua/socket/url.lua

SHA256 269526c11dbb25b1b4b13eec4e7577e15de33ca18afa70a2be5f373b771bd1ab
MD5 8fb662c362da002b833793ea7794fdaf
SHA1 7afaf1ad22c95690cbb3f55226b617121efc20eb
SHA512 b0b766ac2b5cff879009ad9f74295f7ab0bf8b0628b8aece5597243e0fa96f4a85361728fd8a08eea7d2629dfc5e5d8b6aebca432075ad74c131ad3161a475c7
SSDEEP 192:zF/d/WjwnQdkUDv7wIECAAA4HaHjCRBxj6AqyQUh/T1htnSDiKbn:zfWjwXUDv7uCAx4HaD+Bxj6AqK/TTsiY
TLSH
T14422FE2C3D82E222EAF1E7538EBF0985F118916311691528B5CC14D53F3692CB6FFA75
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaSocket/mime/core.dll

IMPHASH fe8e49b45d854066bc51a41f61066908
SHA256 a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
MD5 4a4845ba1666907f708c9c10a31ec227
SHA1 1ebf626adc84147e5114885ce779f92d6eb68f3a
SHA512 d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
SSDEEP 768:Hk1jtHTV0IuugoXCodH5LjciB9snJ1hTgZNno42L:HkhtHTeroXR3aL0toV
TLSH
T112339F22789340B3C6E8827851B45F2F99BEB5110BD158D38FB8754E7F219E2E13B70A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LuaSocket/socket/core.dll

IMPHASH f7bb4b78321004f93f7e54fe50af1981
SHA256 bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
MD5 4bf7db111acfa7c28ad36606107b3322
SHA1 6f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA512 0a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
SSDEEP 768:4pOz0XSP1hSt5+5lKfZyDy3TygCk749NRAa1YwqJlfp8iB9jDEu/s5RPOothtlRp:wOws14t5CeTygmNRA0IVh05IoN3
TLSH
T151839D3631A145B7E5E6447131690B37EB7D79301AE188D38FA449CA6D309F2EA3738B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

18344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep GetSystemTimeAsFileTime CloseHandle FlushFileBuffers ReadFile RtlUnwind SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA LoadLibraryA HeapReAlloc VirtualAlloc GetOEMCP GetACP GetCPInfo InitializeCriticalSection MultiByteToWideChar HeapAlloc LeaveCriticalSection EnterCriticalSection SetFilePointer InterlockedIncrement InterlockedDecrement WriteFile HeapFree VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA GetModuleFileNameA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetLastError TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue GetCurrentThreadId GetCurrentProcess TerminateProcess ExitProcess GetModuleHandleA GetProcAddress GetVersion GetCommandLineA

lua51

lua_pushlstring lua_newuserdata lua_call luaL_checknumber luaL_checkinteger luaL_openlib lua_settable lua_insert lua_pcall luaL_optlstring luaL_buffinit luaL_addlstring luaL_pushresult lua_pushvalue lua_replace lua_gettop luaL_checklstring lua_pushnil luaL_optnumber lua_isnumber lua_tonumber lua_pushnumber luaL_checkudata lua_rawget lua_setmetatable luaL_argerror lua_typename luaL_typerror lua_toboolean lua_getfield lua_pushboolean lua_getmetatable lua_gettable lua_type lua_isstring lua_error lua_touserdata lua_tolstring lua_pushfstring luaL_newmetatable lua_pushstring lua_createtable lua_rawset lua_pushcclosure lua_settop luaL_prepbuffer

ws2_32

getpeername ntohs htons htonl setsockopt gethostname inet_ntoa gethostbyname gethostbyaddr ioctlsocket recvfrom recv sendto send accept listen bind connect getsockopt socket shutdown closesocket select WSAGetLastError __WSAFDIsSet WSAStartup WSACleanup getsockname

$PLUGINSDIR/LuaXml.lua

SHA256 6345b8a47f378416cbd31e543410fa5b03c914219ded2a51c2d3c858f281d6cd
MD5 a34eed4e795d1a7f8f26af91994b2785
SHA1 d950dbd4147b86e246fc19afbc12592aa0ee55b6
SHA512 0d3d92c6b5053469a2edfff0050672ff847135e5d1d08fb7b353df9690f8edcc32f443733bd0d70061f572e3f220769a64a0820918e4b51cf99d8bed30b4f3e1
TLSH
T17181CB55268572B6BFF1E731A80F9812D1774827161601B17A9CC0F23F64548A1FBFBE
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/LuaXml_lib.dll

IMPHASH 0e4b7cfc82eb1d2e2840274f1659b95a
SHA256 90f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
MD5 7292b642bd958aeb7fd7cfd19e45b068
SHA1 19a800620d041634abae5b5d096cb0e87ce4c188
SHA512 bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
SSDEEP 192:YK/pDHjlL5Fv4k0CSigGpV8pVqVyoyhXnX1:N/L5FqCjpV8pVswXnX
TLSH
T19332D78B763238A6D81D253A218D5B70C73D701618DBD06ACF65CC599C3A1B8FE6D14F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

84B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

440B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/NotifyIcon.dll

IMPHASH e043e246d8abcbb9de2ad82c6e18cd88
SHA256 d2b04b5b33877521f6f140148521f219e25d2de753ff20954f90dcee55d1a647
MD5 9ab83d7ef9bd55db63ceb33840431cd5
SHA1 548c54c8b9d683f32b2f1bd8b3f374fc14691fd4
SHA512 5fbceba72421834d5b888818b1fea5f88c518ad871539a3ff1422d4a3e3d6bb945dca1da0839158c446e54cdc5c916e1ca17283b44135d2078bb1188ae142545
SSDEEP 48:aFV2n5RPl5A9+DyhKqfCdGMfMGMoTtmZE+dlpn6sT6lQQAsjRz:s05RP72BCdjUGM4R+dHn6tV
TLSH
T167B16033B2D595B3E36E063AA0D3295BA0758320A3D1045B8E631FD2B691E37DD64F12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5940

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
MD5 7e3c808299aa2c405dffa864471ddb7f
SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
TLSH
T1A7225D6547A041F3DD60823C08A73D275BA97B148EB54ED3CF9314429E2D6A6ACBC336
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/__localxml.xml

SHA256 edd9792867e5f17e36f61537849e59fb661fbeed8a460a13fd20c5a094babc65
MD5 59e46fec9b5ceb9a32ac8c05fa3ef112
SHA1 da52f8ca6504958cf481f46effcb5df262ab0c11
SHA512 6886d186e9c5d3af00bef2464064b6fa22f386d3a842544e72347c577b393d117734118506479d05d8c8fd725875bb7d1d13ac93ef57a588205064c757d11ddb
TLSH
T1A8411388FDC17179A5B1517F7D5746D5E4D3EAE249498EB8B9860B1F21CB0482313325
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/custominetc.dll

IMPHASH cb0a607a2c9593bb9c969e6ca75c2b88
SHA256 3c0d6c3ee0784b2f10093a927335382f67050156136991f0ae05fa4484bab8f4
MD5 81e20eb6c3a6002a805265ca751c7217
SHA1 db0e645b6d22b77b4117fb5612a0bf83c613c199
SHA512 ae6b594bd6cb42913484b5c5282757a9e8f52e76647bf3ef49555c2080540be683079f7994050a7baa45f7a2f57441fcd23353f351476f2891912ec5d2bfc2cf
SSDEEP 384:96WBKKhxKPJeXt0OxyfWB9VTZVWav3ARHKpK/V3STMvDya4m0Ac9khYLMkIX0+Gg:99nKPZfUZVzv3ARHKwhSYvWa4uL
TLSH
T159A21A019E9615B3D7F51C36746D37138AAEAE71246154836BF71FCE2C2A243FA34B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14715

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strtol _onexit __dllonexit _adjust_fdiv malloc _initterm free atoi _mbsrchr strtoul memset _mbsstr _mbschr strlen

kernel32

DeleteFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GetFileSize GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatA

user32

MessageBoxA GetParent ShowWindow SetWindowLongA GetWindowLongA IsWindow SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SetWindowTextA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetOpenUrlA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/definitions.lua

SHA256 e2d0e6bcd2d6cb69a6d9e84d80f9cb182fb0b6db5592d8b304ad6eb98590c35c
MD5 840fd3d93db939b1e4b504d8fe587ed1
SHA1 98f0dd4aca7765c158bcd1fe1d11bbee5e1e586e
SHA512 570ae6db31df726b8fe9aff35e553ad669d4c25deabce424b865b96597933225ab644a7e2944b8507e2d5a0b0e04396025ce711cba9beac7bc5844c435ab76a1
SSDEEP 96:dfT/fHcmaXreYxXXxLjKZPghh/pEdnVmPx:dL/fHcdeMhPf0VmZ
TLSH
T1FA91B61711D3B2B8F7124423B25F1AD7DAC0106387B56869B3ED80640F94D6F53F98AE
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/extension.tlb

SHA256 439a861617df97c0c509d12c9e297d8637898ed325b668029d206bc932283bfc
MD5 483994c053219403e88527fe0fe582c9
SHA1 77296a61059405d7f53bd8c663973d0816f38a5d
SHA512 84a70409a86326fc05dc9d26e5d1f02ab345cf4f0525f09bdb5fbd8ae7d5f03360f1201e50e335dcfbf8e03ac082ec882e340c275a59e40737fcca4fa92d58d4
TLSH
T1AB315593F384C6A2C45D46314C8BD2E857F0BC158E12AE873699BB6E0D307CC6B194B4
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/json.lua

SHA256 2f2f0f1ee1a5aa077baa531b6ca78a8292ac9b13cc00b9b74eb78b046b16a9c2
MD5 40e6400711737821d2f1e8adc950741b
SHA1 fa88a96c6e43c7eda904a1832f36ce422067202b
SHA512 7dee28dfcf7ef028b061259e2608692bf0bbc87f8bff349da42a57e55ff04b1927cd201c850c2bfd41f94089e7b8d96a607277be6769e487ed2eec069aba4b37
SSDEEP 384:KLCjxQC4dhpVTijbgrgCqtSjgykxPEvyf9jYU51BAKfac6Lc6sdXB:sCePdhrTij3CqtSjzkhRYU51BAKfac68
TLSH
T1D2828261FD8FB2611CA2D262D57B4251D51CE020123821D5F8CEE1F2AB51B7CA1FFAB9
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/lua51.dll

IMPHASH 0b930a47b5846bb154dc0be3d35f00ab
SHA256 2a4f510a75453fb49ceb2823756bdbcbfe1a026dcd27a76260229386776ddaad
MD5 bbc9ac3211f07e45510861ae429996c3
SHA1 0a0d7ea99c959cd4add3deb05e500af5fdf98510
SHA512 f3a4a726ffd7869d277e9ee09a833cc27e10f117c52dd2a2efcc96cf9280730f10dcb704ea78a6d6f16ac2d2db1b94ad6025dfabaf83fdaaca4f5fbb0db1e756
SSDEEP 3072:+RyHKGrwG4F9FBtzYyEqRi/0L/AZ4g3qq:+RGXrHOHAYi/7L3q
TLSH
T1A3C35C47F682C0B1F48125FA18A263B7CE3D5BF790B3D7179B91D861C866221F51A3CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

94577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_error luaL_findtable luaL_getmetafield luaL_gsub luaL_loadbuffer luaL_loadfile luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_prepbuffer luaL_pushresult luaL_ref luaL_register luaL_typerror luaL_unref luaL_where lua_atpanic lua_call lua_checkstack lua_close lua_concat lua_cpcall lua_createtable lua_dump lua_equal lua_error lua_gc lua_getallocf lua_getfenv lua_getfield lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_lessthan lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_objlen lua_pcall lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawset lua_rawseti lua_remove lua_replace lua_resume lua_setallocf lua_setfenv lua_setfield lua_sethook lua_setlevel lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_status lua_toboolean lua_tocfunction lua_tointeger lua_tolstring lua_tonumber lua_topointer lua_tothread lua_touserdata lua_type lua_typename lua_xmove lua_yield luaopen_base luaopen_debug luaopen_io luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

$PLUGINSDIR/luacom.dll

IMPHASH 148172081107200e70753e16a32c0c9a
SHA256 9dd5218bc2d12f4d07e268bc6ec01d6eefde4b99a07246d0a96d18477d331b5b
MD5 ed7f7857933b38e5d10daf828e79af19
SHA1 7f1445f87f7e2256efc33ef56da20c3b23a1e0f9
SHA512 ceaf9597d4cb725c4ec8b7af8d1090b38df102b52ca7606a24e9a094fc81f450f93ad22770c905db9115e271fa5fa4f5731caa7b1875e204edb10fb691741715
SSDEEP 6144:sdCVNGq2AcLGcmiuarKjKekqqBVq2Zq++++o++++++qjZfl8++O+yW+s+W+hZa+u:wCVT2nqciarKjKekqqBVq2Zq++++o+++
TLSH
T1D4546E11FA80CE33FAEB01B54676817D2A28EA611740A5C7B7C465698F363E17F3134B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

21536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Programming\OpenSource\luaCom\mak.vs2005\Release\luacom.dll.pdb

shlwapi

SHDeleteKeyA

lua51

luaL_optlstring lua_pushvalue lua_pushstring luaL_argerror lua_pushcclosure lua_settable lua_gettable lua_createtable lua_toboolean lua_settop lua_gettop lua_next lua_tonumber lua_pushnil lua_type lua_pushboolean lua_rawseti lua_isuserdata lua_tointeger lua_rawgeti lua_pushlstring lua_objlen lua_pushnumber lua_pushlightuserdata lua_topointer lua_newuserdata lua_insert lua_setmetatable lua_equal lua_checkstack lua_getmetatable luaL_register lua_close luaL_openlibs luaL_loadfile lua_pcall lua_setfield luaL_newstate lua_touserdata luaL_ref luaL_unref lua_error luaL_loadbuffer lua_getfield luaL_checknumber lua_remove lua_rawget lua_call luaL_checktype lua_rawset luaL_checklstring lua_tolstring

kernel32

GetConsoleOutputCP WriteConsoleA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA CloseHandle GetStartupInfoA GetFileType SetHandleCount RtlUnwind HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP RaiseException GetStdHandle WriteFile ExitProcess Sleep WriteConsoleW GetCurrentDirectoryA IsBadWritePtr lstrlenW FatalAppExitA DebugBreak lstrcpyW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetLastError LocalFree ExpandEnvironmentStringsA GetProcAddress LoadLibraryA SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleHandleW IsValidCodePage GetOEMCP GetACP InterlockedDecrement InterlockedIncrement GetCPInfo HeapReAlloc VirtualAlloc DeleteCriticalSection VirtualFree HeapDestroy HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess SetStdHandle CreateFileA ReadFile SetEndOfFile GetProcessHeap WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesA CompareStringA CompareStringW SetEnvironmentVariableA HeapFree GetModuleFileNameA GetModuleHandleA LeaveCriticalSection EnterCriticalSection GetCommandLineA GetCurrentThreadId HeapAlloc

user32

wsprintfA TranslateMessage WinHelpA GetMessageA RegisterClassA CallWindowProcA MapWindowPoints IsWindowVisible EqualRect GetActiveWindow ShowWindow SetWindowPos DefWindowProcA CreateWindowExA GetWindowLongA MessageBoxA IntersectRect SetWindowRgn GetWindowRect DispatchMessageA GetClientRect SetFocus OffsetRect

gdi32

SetViewportOrgEx SetWindowExtEx DeleteObject CreateRectRgnIndirect SetMapMode SetViewportExtEx SetWindowOrgEx

advapi32

RegQueryValueA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

ole32

CoCreateInstance CreateBindCtx MkParseDisplayName CLSIDFromProgID StringFromCLSID CLSIDFromString CoTaskMemFree CoRevokeClassObject CoRegisterClassObject OleInitialize OleUninitialize StringFromIID CoLockObjectExternal CoTaskMemAlloc CreateOleAdviseHolder OleRegGetUserType ProgIDFromCLSID

oleaut32

LoadTypeLibEx SafeArrayAccessData SysAllocStringLen DispGetIDsOfNames SafeArrayPutElement SafeArrayUnaccessData SafeArrayGetElement VariantChangeType SafeArrayGetDim SystemTimeToVariantTime SafeArrayCreate SafeArrayDestroy VariantCopy GetActiveObject UnRegisterTypeLi SysFreeString LoadRegTypeLi SysStringLen VariantClear VariantInit LHashValOfNameSys VariantCopyInd SafeArrayCreateVector VariantTimeToSystemTime

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis7z.dll

IMPHASH 4c04c20a976733bf789fead96eb58701
SHA256 cb195d62df55a939e238063c13c792237501f2297386c11229b1558eea9ddfbb
MD5 692479f7c07a64a6a632148e382f0e22
SHA1 cd14982a8e048ae98860db52f042850b63f9f40f
SHA512 7ed81c13ea6d3b5fbed778ff0f2b3361399826296711ec7dc019432ecd79a72e7d6e78d5fab144600ec55b46a56c11ff99f0860855522750883d7693ca885809
SSDEEP 3072:shuC5kBdKlB5Rkg0rQHWjfxTKYaE51GiCySqEMRRQRkM8CQme+5xuPFK:Qq7WHIrLjfxdXREJ/8CgK
TLSH
T17FF3AE2236D0C239D20B2536CE56EB62637DB660CE61D58B3F894F1D9F32581DF29706
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

93148

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetLastError WideCharToMultiByte MultiByteToWideChar LoadLibraryA AreFileApisANSI GetModuleFileNameA SetLastError CreateFileW SetFileTime CloseHandle SetFileAttributesA RemoveDirectoryA MoveFileA SetFileAttributesW RemoveDirectoryW MoveFileW CreateDirectoryA CreateDirectoryW DeleteFileA DeleteFileW GetFullPathNameA lstrlenA GetFullPathNameW FindClose FindFirstFileA FindFirstFileW CreateFileA GetFileSize SetFilePointer ReadFile WriteFile SetEndOfFile GetProcAddress GetCurrentProcess GetSystemInfo GetStdHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects DeleteCriticalSection VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection CreateEventA ResetEvent SetFileApisToOEM GetVersionExA GlobalFree lstrcpyA lstrcpynA GlobalAlloc RaiseException LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLocaleInfoA WriteConsoleW HeapAlloc HeapFree GetSystemTimeAsFileTime ExitThread GetCurrentThreadId CreateThread GetCommandLineA HeapReAlloc HeapCreate HeapDestroy GetModuleHandleW Sleep ExitProcess TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetConsoleCP GetConsoleMode FlushFileBuffers FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle WriteConsoleA GetConsoleOutputCP VirtualQuery

user32

GetDlgItem FindWindowExA SetWindowTextA wsprintfA CharUpperW CharUpperA SendMessageA

oleaut32

VariantCopy VariantClear SysAllocString

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
TLSH
T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/res/common.css

SHA256 9a110c6977aea3ddb3fc38e59efbd89f0f13e086ca0bc61f4de86c2015a741bb
MD5 0fed415d7de81f84954bd4e264e61e4c
SHA1 a3d6f75a5ca50b3800593fbcd1d667db31e98698
SHA512 15fcf206ce21cdef8177b6f4e254dca38b39bc3eab0ba43b342f7f7c70529f387ac8d4984f673146cbc5ca73392563c820f98aede01d507a7e3a9241a15088a6
TLSH
T1EC315A22CD05084A70B29B34EB63685DFF17045BE757036A7BF6B968CF3065A4818FC8
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/res/common.js

SHA256 992ed0ef6af03e38ae89ab86230348a860177da34fbcc3143f949a5a97028172
MD5 2a2e23e5f79e3ac88cc8862110d836e3
SHA1 7fad083b3ba5d73bcd64513ef77a10073e307ba5
SHA512 2e3f1744759344baf1dcbd537a12df6bdd0d1945db33867eb4c640aebb0c7d5ffecb197f41246eb6e95e42d8d585ff30c7aa0d93cff58650b07250c9dc5439bd
SSDEEP 192:HmcCGJiIy7QTR27u/GRmkOqK7yMqybSIGlzs7notrtVjH6feKty:G2zRLumtnboo7mH6g
TLSH
T1CA62635CA9412B78B9B123788F5F1414EEA245570A11DB44B8EEC7402FFC95183ABEEF
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/res/jquery.js

SHA256 69a78538c3b8b841bd898d85140986bd87d41f7771c7cb9d45909ce00183783e
MD5 7021191c5dd70e95a9c026be6b9c05d5
SHA1 32cd16fd318795d8aee5dc3bda30afb705a6679d
SHA512 0e6e0e057dc726d9833dad245a5cb17caaf799c0aa8ad1f9b21baedc41dcc126d624b1430e32645ee3f308105836fa7879cc1bb71da3c1813aab40a795785dff
SSDEEP 3072:KgQWO242xfq+50dFhPGXVKDhA4kO9J3A7zUMpZXwFh++l7XKDtxp/Lq8LakxOAd9:HhomMFhPMKDqO9JQ7zPZgFh++Ytxp/LP
TLSH
T18CF394D8334F416F86A2336AA43F615DFA7CD5B2420591BDB5CD986824A081843FAFFD
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/10-28-2010-SKIN.zip

SHA256 bcae45178eff112c2de87b14961f4cdf464c9da4712dcf6627a97899da0c0b6c
MD5 b48806efd01bdc6465a48eb9712abcbb
SHA1 83af2944eee41cc7dcc4f682c41240ec00a94d79
SHA512 edafe60a7e00c92cb3d02c6407e93eb2272a487bf2c02823a67b957a591928a8f40aa2b2a789975fa6d018683c77dc937078bac300cf83cf8aa76cf9359ce01f
SSDEEP 384:OTIoCfrxeHHR20J4oanzTpi5ruw9H2qjDSbArCKJSY0yuK0/ofUtqGt:OUfr0PBYArx9H2qfSc+K6B/oBGt
TLSH
T1E4B2D0E8F610881CD7EDC4F296D75522A9FF06354BE782E7118B6879F2FA46180B83C5
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

accept_button.png

SHA256 34e467c2857cacf610a3aa55c0ee6bca0d74b5cf26f6826abdcfb3b7b9863e32
MD5 f38db7d0ce184eceddd7de9809f73cc6
SHA1 efea9643f3105c8dcd52f1748708da80c23f787d
SHA512 65a9cb281404795c0b261681f7f732f3d320cb161d17267205c1574b288f545438cc18728ce0dfe12aa980ac0e3598b1f52ea72a7fcd42bce25c7475b168204b
TLSH
T1FC413AEA92490C0CFF9553C144F55408A033525E99ABB2E6BCD284E9B3EC5A0C0E1FEE
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

back_button.png

SHA256 f883ae60af9a7d2c98b9802549bd05b27e21aa0d3014829e8520f841bd39124e
MD5 9dc457eb5062e884b148839926c00165
SHA1 3ab2cc5da71725112193968352d76fd4c6f0b7ca
SHA512 8020b2bd4d5c6f84e77a34632c1e54bdbd24a18bc5bddde92bd1bedfacd520a026b96f96dd15bfb4bcb4e821729ec51a39c2b9f484929ee6941cb766d1ea9ac0
TLSH
T187413C81BC70C8A117BD85EF864D15B3879BFCDD467FCBB682155140482645140BDD03
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

cancel_button.png

SHA256 c9f68c484ab2f36280f1b5873cc7d94270fe1b377bcea76c934cf92159b537e7
MD5 fa5edd3277d1a64986cd87f459e4c653
SHA1 2892cccdf40c7d1cb4b7b20b3dad9b5b9211e39d
SHA512 51170abe385014d64f1c0a437e5504aa0d1ba70b80c96c06345b95ba315f9812a39322bef79b2a810ef59a729ee6eb1ab936cb2a5032495d1bae939d2a48fc28
TLSH
T1074129F8A9A0685E41E95571ECB7CB92D85B0A1F98DE323E4F3B30819B395FC04197C0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

decline_button.png

SHA256 b91982aeb15bf2e47b2a0ebcbef21f98f1729924b7e00f1d3e4a92bc5e7b046f
MD5 824283b153194f25bc4fc13f8ff3d9fd
SHA1 663079695b22dfff8f1be26895404f81028a2d8a
SHA512 92dfc6886b1e7e91f92057e6751cc517b6ef90d9faa861ddffb112b0ffcbc9c5113d6cfbfb0c7089cafbcf66df31610d3adc6945b906ab4c14e147819e2e26b6
TLSH
T147413961E726D2742CDEE9813B270FA1F91F879E87E104D2708E24F47913D9885D0BD0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

noimage.png

SHA256 0a07fccc6737c0fcecec2593123c9ddbdb3cd355c4ae9c90c64c7cecd04c56a6
MD5 2c964c345617980c6b81de4395a634cc
SHA1 5434bfc556cfd6b3b65f9dc72a04e183f9f4aeeb
SHA512 d4d3f8ca186cc7938b6f7916577c35b6e8e102f3dc87479707e0d7149d0c445e678baad58914671b68aae844d94affbf9f4502e64e86bae8b0feb5449ccaf3f9
TLSH
T11411B9DA5298436FD82DE35A93316EC35C33DC251038C826420CC07FF75670460F5058
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

vlcmediaplayer-128x128.png

SHA256 567751ed24fddd40ef241de1ec51c285d707a8f49f157a0f8f42c6db08e3c891
MD5 fae1089d09dc4643b336332e0a81489a
SHA1 45b2ffa31ad966aa1337d8d675ee7888f6d28b8e
SHA512 362bc745a415cc7fe4cc5df675e2ba744badd5e3ab401d91234f0cb62c2d1210f9735255deff498c4316d2111cff18856511ca3da2977e639cdc846986c0fa91
SSDEEP 192:5UoaniATpiY2yv8/H1NvcpnuygnIJuH2qjRpSUsx/JivrCds3:moanzTpi5ruw9H2qjDSbArCK3
TLSH
T13132C098BE2A594D736EFCE2CF9370674FFE71300B5282D80185982ED07606685702DB
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

winclose_button.png

SHA256 2cfcef01b952aefd15b335d3ab666aefe7767ae0c38703aba0a20b8434dee5aa
MD5 769d48272aa52d14f420532d62155e2a
SHA1 0ffb90f7ce0263f07279f8c745768f7da6528b4c
SHA512 fc72933268e800f723afa66cc15a93822189c433b014d74e9e2a924bf3a9687bff1cf40278b26f42fa47c17336be7044849c46b6deabb79cee05ee6c13862259
TLSH
T1EB21AAC5D002B91ED6949689219F5934A95ECCC40613CABB18FD5E2A37C5582DF3C3EC
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

winmin_button.png

SHA256 ead08cc8d9499b5d1bea1d96cbeef06c19b905c7f9c4c66900045996dac5cd48
MD5 26f9757a4966fb79d67da03d560c1a05
SHA1 e42bef8cbade36999f212ae1be60cc9d1cfa1491
SHA512 da4d50c44095b8832b3e97c406925c7861283038f128ff639faec16dfe3789ad9bb5f6d0719e6ade213f097797a880dfb5ca48dd659f2e08d5eccd40a27566ad
TLSH
T16B01CADC2550417B5DBF179723450C12A4014FE0466BE1670A139C2FA7F0631F5FC729
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DALogo.jpg

SHA256 d6a2501b3480a0a76baacbf6b7e9c3e1b21842babace99c6acddb545a3586d45
MD5 e88cdb9d5b9717e26a190a8c65f1d5e3
SHA1 a62ec1eb0f5b78493a7a76ede658250b28364614
SHA512 bc31d52afb16488673118d641b465d9262d3672af1355ac4493b0151f3f6cb30eae40fe9bbbf5ff0fcb329c9ecf654d649dbfe44a9567f84f8cd77385bd56170
SSDEEP 96:5rlIZgaZTsF4n5SLtmrnYcKIT0Qv/ubw6YdCdVqf+o6sac5j1hww25QmFwn:JGd9l5MtJIhiwRnf+Tsp0D57Sn
TLSH
T12FB17CD102F900DFF97A7D3C068D49802739B766B7C26ABC89A347C109D48E9F82D2D8
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DALogo2.gif

SHA256 549a37a696742dd4d0aae0d5495aef9ec77c9cae0de3648f4e77396dc8c03157
MD5 036c827b171e170030f7fb742d38c1e7
SHA1 1a4096e9d3f6fb859040c1038b87c3a57d4c0dcc
SHA512 9e768d22512a9bbe47117d107d6891ac5508e99f57908f59d7787f9c9b64f49952caecc7c5cdaba1929bc94b39b999256d6d38e85b706ac04dc2e21eb985f6ed
TLSH
T1A3716CB9C2B6C24DE7B9D23D0C5A93DC34165356313F0685A876ED8F3A0C0CDE899B90
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_accept_button.png

SHA256 34e467c2857cacf610a3aa55c0ee6bca0d74b5cf26f6826abdcfb3b7b9863e32
MD5 f38db7d0ce184eceddd7de9809f73cc6
SHA1 efea9643f3105c8dcd52f1748708da80c23f787d
SHA512 65a9cb281404795c0b261681f7f732f3d320cb161d17267205c1574b288f545438cc18728ce0dfe12aa980ac0e3598b1f52ea72a7fcd42bce25c7475b168204b
TLSH
T1FC413AEA92490C0CFF9553C144F55408A033525E99ABB2E6BCD284E9B3EC5A0C0E1FEE
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_back_button.png

SHA256 f883ae60af9a7d2c98b9802549bd05b27e21aa0d3014829e8520f841bd39124e
MD5 9dc457eb5062e884b148839926c00165
SHA1 3ab2cc5da71725112193968352d76fd4c6f0b7ca
SHA512 8020b2bd4d5c6f84e77a34632c1e54bdbd24a18bc5bddde92bd1bedfacd520a026b96f96dd15bfb4bcb4e821729ec51a39c2b9f484929ee6941cb766d1ea9ac0
TLSH
T187413C81BC70C8A117BD85EF864D15B3879BFCDD467FCBB682155140482645140BDD03
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_cancel_button.png

SHA256 c9f68c484ab2f36280f1b5873cc7d94270fe1b377bcea76c934cf92159b537e7
MD5 fa5edd3277d1a64986cd87f459e4c653
SHA1 2892cccdf40c7d1cb4b7b20b3dad9b5b9211e39d
SHA512 51170abe385014d64f1c0a437e5504aa0d1ba70b80c96c06345b95ba315f9812a39322bef79b2a810ef59a729ee6eb1ab936cb2a5032495d1bae939d2a48fc28
TLSH
T1074129F8A9A0685E41E95571ECB7CB92D85B0A1F98DE323E4F3B30819B395FC04197C0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_decline_button.png

SHA256 b91982aeb15bf2e47b2a0ebcbef21f98f1729924b7e00f1d3e4a92bc5e7b046f
MD5 824283b153194f25bc4fc13f8ff3d9fd
SHA1 663079695b22dfff8f1be26895404f81028a2d8a
SHA512 92dfc6886b1e7e91f92057e6751cc517b6ef90d9faa861ddffb112b0ffcbc9c5113d6cfbfb0c7089cafbcf66df31610d3adc6945b906ab4c14e147819e2e26b6
TLSH
T147413961E726D2742CDEE9813B270FA1F91F879E87E104D2708E24F47913D9885D0BD0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_winclose_button.png

SHA256 2cfcef01b952aefd15b335d3ab666aefe7767ae0c38703aba0a20b8434dee5aa
MD5 769d48272aa52d14f420532d62155e2a
SHA1 0ffb90f7ce0263f07279f8c745768f7da6528b4c
SHA512 fc72933268e800f723afa66cc15a93822189c433b014d74e9e2a924bf3a9687bff1cf40278b26f42fa47c17336be7044849c46b6deabb79cee05ee6c13862259
TLSH
T1EB21AAC5D002B91ED6949689219F5934A95ECCC40613CABB18FD5E2A37C5582DF3C3EC
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/DEFAULT_winmin_button.png

SHA256 ead08cc8d9499b5d1bea1d96cbeef06c19b905c7f9c4c66900045996dac5cd48
MD5 26f9757a4966fb79d67da03d560c1a05
SHA1 e42bef8cbade36999f212ae1be60cc9d1cfa1491
SHA512 da4d50c44095b8832b3e97c406925c7861283038f128ff639faec16dfe3789ad9bb5f6d0719e6ade213f097797a880dfb5ca48dd659f2e08d5eccd40a27566ad
TLSH
T16B01CADC2550417B5DBF179723450C12A4014FE0466BE1670A139C2FA7F0631F5FC729
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/Thumbs.db

SHA256 02a99d2a0e6815c354bd2da4786841a1480a4a8fb00c6ff52311d30cc2744843
MD5 efe206f99929c91315b21e5aeb02a8e4
SHA1 8a9214d0db588ead67601806a921ec19047567f3
SHA512 c1ff487c47c4f1b0eb07529a65f1e10027321e06bdef23563c849c869e4b0ae0f0989e21d6dca1750c69dd54f39eab79d442e583c37034247537d3d2346c84e3
SSDEEP 1536:nOVUSiseM17jG/tuCg6gMGK+OUozS6FhFBLFs9x4xsOKC1S3igSzm:IUmzG/tuDRFYZwB
TLSH
T1A6537B1A7B4213D2FC2786FA89355D96D2EDFE427B90274F3AE07796D270BD09408A1C
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/accept.gif

SHA256 e56ecda9ec16a8142e5cbf22c7e9e3e1c686f909b7c5902018d058bfec33936d
MD5 185ff813c6522ae9ac85febccfdd6d81
SHA1 b7aebcff189436037c0a01e4dd80c32f08a66ef3
SHA512 bca327d576fe6e1134b6da7cb9874f09906e03610150c7478583b3dcc5330e817ed77fbd2c507882ce66da14b0e80f0be9e3ca15eba17877215a3b24d5d555ef
TLSH
T1FD715CC4007BCCEBD9224B3CC51D4054FE259DC2E5A6462CCD6E939D26E39AA734A6C3
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/accept_button.png

SHA256 34e467c2857cacf610a3aa55c0ee6bca0d74b5cf26f6826abdcfb3b7b9863e32
MD5 f38db7d0ce184eceddd7de9809f73cc6
SHA1 efea9643f3105c8dcd52f1748708da80c23f787d
SHA512 65a9cb281404795c0b261681f7f732f3d320cb161d17267205c1574b288f545438cc18728ce0dfe12aa980ac0e3598b1f52ea72a7fcd42bce25c7475b168204b
TLSH
T1FC413AEA92490C0CFF9553C144F55408A033525E99ABB2E6BCD284E9B3EC5A0C0E1FEE
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/back.gif

SHA256 46d1f5000d596e4f535ec0f68e7f81bfc557ebb397b0df3d69e75a861cb337b1
MD5 d09ec3a084744b8692f59291b98667b6
SHA1 c8a074fbdf30b8c45b17fc2e27840006fe0f1184
SHA512 ce04e211ec71d2f14a67401b27692b110ce3b62d953da1a7f6dc578be0c5ff7232a7de7cba0c488ca4eb65b4f9ebbe5ca60ad2fa147d85d2720c49a6a5221d27
TLSH
T1E5615DDB4197C15BE80BDEF27C7C43127465CCFA09E9A61806B2A22653AFE48522589D
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/back_button.png

SHA256 f883ae60af9a7d2c98b9802549bd05b27e21aa0d3014829e8520f841bd39124e
MD5 9dc457eb5062e884b148839926c00165
SHA1 3ab2cc5da71725112193968352d76fd4c6f0b7ca
SHA512 8020b2bd4d5c6f84e77a34632c1e54bdbd24a18bc5bddde92bd1bedfacd520a026b96f96dd15bfb4bcb4e821729ec51a39c2b9f484929ee6941cb766d1ea9ac0
TLSH
T187413C81BC70C8A117BD85EF864D15B3879BFCDD467FCBB682155140482645140BDD03
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/bg.gif

SHA256 d0f172ee213631fbe5c19326d5667f9c965b91d76c10598ba30a91070023f44c
MD5 f0abc2f362bfbb732acd49ec47fb90ab
SHA1 efa16a84da83e14fbdfb7699f2fde70f06f08bb2
SHA512 3dec6f73d3e05a51e6ec787c28e23ac58295cf8a74ff1177eee76adc7c8dfa50ef9f341ef8e64f67933dd7c5aaddf1436db6e593df8a5f57b2557c25ca347916
SSDEEP 384:K1g8ENvu+JxohRsRAo3dAKtGn0jU3mIWUWE/:K9E1u+sRYAo3rtGLJIW
TLSH
T16142CF8530A798F7D49426FCA9CC82CCB16185257485F637562ABCF6D21E71FE09D901
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/cancel.css

SHA256 d854553c0688e36279818d0d2732ddbe035917fb240b8a887aae3935725a901d
MD5 28b650736721266f3983f0caab126ce4
SHA1 ab6354540eaf882ffc15336b5b897a4cc7857714
SHA512 91d998acb0a72509863aae169373ca5ebc66d43f597a41823bf1e40e9492303c37f4c303d614e048cb35c419feb7c7b1a1bf310332ac00972bd3460c46ad45c5
TLSH
T194F0ACB7D78813FB3F0E0410E2ADA68AA518943D933395F1307D90A41651D71B0FBAC6
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/cancel.gif

SHA256 65b52af53c65de809e00a74a279e2f092169884ac196f91a2636f07eb0d3d816
MD5 03fd5552ccc7cff7ef7e42d6b8852316
SHA1 17007c433b07ce287156fb9e84386c2ff5dbdf34
SHA512 a6e43c8f39f31192c11f0bc88e679b9e3773ecd93e642c8c641bf0f4fa9e4d18dbce4443c8ed2a917732ca411e5ae8624fd4f07d99ca73e82d2ea3e65429713f
TLSH
T1A1718FE0C43C5C18E133C6B46CD5281E7E39D439DA34A2FE57C2D5052B496AD97B0B67
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/cancel_button.png

SHA256 c9f68c484ab2f36280f1b5873cc7d94270fe1b377bcea76c934cf92159b537e7
MD5 fa5edd3277d1a64986cd87f459e4c653
SHA1 2892cccdf40c7d1cb4b7b20b3dad9b5b9211e39d
SHA512 51170abe385014d64f1c0a437e5504aa0d1ba70b80c96c06345b95ba315f9812a39322bef79b2a810ef59a729ee6eb1ab936cb2a5032495d1bae939d2a48fc28
TLSH
T1074129F8A9A0685E41E95571ECB7CB92D85B0A1F98DE323E4F3B30819B395FC04197C0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/close.gif

SHA256 cc50699f372f99feeccedaa304f2103fcc38ff3978d6dffa2ca3f68c9be951f9
MD5 8c8d77294718dcd86f2f89c77d5e8574
SHA1 8a608be77c090b4bcd28dd89727ba8d5bb2038e8
SHA512 faae62c7f7fb9dd67d20176bc8d6bd1caefd55739f96b0e3909b5dc6bfaa73bab4d7f3f5dea3a904eb4da81fa294266496a6f868dc52a31a81cf72679c87533d
TLSH
T137F0DC071830F166F990517AC8C841A2BB469B716B2EC019EC7A18A9802C58A3B166C4
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/decline.gif

SHA256 0c47fc062958fae099ce543807b4b87953db66abb5d42bf16fdb40a49669f8e7
MD5 09c122cb0e0a9a36f9879df979ad8bbc
SHA1 0c0f7e666bcc0389a65607e2e8f668291722b6cc
SHA512 9134d66ccfa57fe4f2ac1190d1362167047a0887c8d652e169e2d8b5e73c92cc0707aa21cf766bde6a97f0f6853478847a4fbb2d41aa7732bb8d5e59faf38a7f
TLSH
T174717FD11F4FAE19D29A0970BB45750EE52179D3B0C508267C961F0AE03FF971676D0E
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/decline_button.png

SHA256 b91982aeb15bf2e47b2a0ebcbef21f98f1729924b7e00f1d3e4a92bc5e7b046f
MD5 824283b153194f25bc4fc13f8ff3d9fd
SHA1 663079695b22dfff8f1be26895404f81028a2d8a
SHA512 92dfc6886b1e7e91f92057e6751cc517b6ef90d9faa861ddffb112b0ffcbc9c5113d6cfbfb0c7089cafbcf66df31610d3adc6945b906ab4c14e147819e2e26b6
TLSH
T147413961E726D2742CDEE9813B270FA1F91F879E87E104D2708E24F47913D9885D0BD0
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/footerBG.gif

SHA256 37ad19d4988c18f69cfffdc066af2ae41f87a3b282d82be40f499b7eecf275f3
MD5 176bea7309f1263711bb5b6f2dac2d13
SHA1 8ab43b943f56d591b50643c599823b771b3a67bc
SHA512 e2e9e84831bcc6ff1fa16b16629a00973255b513c1ed43052531ad194b53372ad5c047926230632aa2f63e9df05f32e4754ae1c8d42eca76472e8b64cef9df29
TLSH
T170C022A3802A2302CA288B30A88380A0E8AB202C03BB082A883B00C2E200B80088A020
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/headerBG.gif

SHA256 06d14477697e3f0a3841cf5018a261fccbc275056ce39949adebe795fb7db143
MD5 d68ceec1f2a0d767354df6f6715f9950
SHA1 ea0920c07a160c5d7d0bc7bedc13bf63b7129d58
SHA512 74f8982ba87b0f68c1be4d1a46a225489a019f2f10cae4d573712b1449902f0ccd2d37041c24cb19c54943cb5722c0f61d111a378286364ff3d12cf3fbfef0b7
TLSH
T1E9E07D0254602B60DA109E3D882F42C454BB79E691E06277C1AD8E9D8A18304470B044
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/mod.css

SHA256 7354f86041f2654052af1b8906036b81886e1629a8fd994bfb0bf223473dad92
MD5 99b56703cccbe831c6ffb97565006a77
SHA1 7b806898d1260c94b0f568e7029c33a97a368e33
SHA512 8e128232665b3290184efbb20c741d4318ed71a152df89a97c87264b4d559a21a32a3a9d2b063558c32193694afa39f8eb60016629c866cd4059ddff79c437a7
TLSH
T19E719D18D611161D3472E724AF93528AFA3240ABD357152C7FDCA390CF7A01D8966FEA
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/noimage.png

SHA256 0a07fccc6737c0fcecec2593123c9ddbdb3cd355c4ae9c90c64c7cecd04c56a6
MD5 2c964c345617980c6b81de4395a634cc
SHA1 5434bfc556cfd6b3b65f9dc72a04e183f9f4aeeb
SHA512 d4d3f8ca186cc7938b6f7916577c35b6e8e102f3dc87479707e0d7149d0c445e678baad58914671b68aae844d94affbf9f4502e64e86bae8b0feb5449ccaf3f9
TLSH
T11411B9DA5298436FD82DE35A93316EC35C33DC251038C826420CC07FF75670460F5058
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/offers.css

SHA256 c66266d63e98ec02a03ccc6232a7d587ce5e160ba59e5396ed254a943293c4c1
MD5 9f4581dce61dfcd0ee5cf003c1b5cc29
SHA1 5779658a9789189b0d9ce22f87b1d5626884fc04
SHA512 c137c3b06871161538c4d724ea657b5ce9f55a21ea8cb3cdc3518806deddc9a4630290a821d4c6f3392c91a4a70536c2b721594b583b27f0b6eeb3e70b44e916
TLSH
T11951BF80E7D637BB66670126B37FA584EB1988A4C573EB7CB07E9150C7A147032724DB
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/progress.css

SHA256 fdd42fc22ad4c290956933c26659f52d4cbcaa733b0515aeb353c7e6d58c237c
MD5 9a2ac1affc15e0c63d5095f0bf9cecea
SHA1 4e5a6fd5a394117d8d3fc10188c7704702e1c29b
SHA512 b1f2abcc62a1c191ff60b49c803a598c6d2a730248122065efc54379a06dbd4ee44d37a5374c2a487ebf08b67fb7518b80dbf28fd16537e66e8cbc73614e868c
TLSH
T105410F56CBD413FB7D471A21E3EC8A812A1C4069C227D7F8AC7FA124C302E6099B76C7
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/truste.gif

SHA256 cbe77187f019cf5164d0ea469a64f16cdabdad604dd88323ed025ec2fadaa458
MD5 723efa186a033a6de5c063a222cabe11
SHA1 64e2b5aa5ec232d35cf06a61587f438eaa7e402c
SHA512 4048d5d89b91e355dc1335de65f02d4d6164389829448789c2db011e0863bec65bb12a8e78a3cd669cd7e7be17066e926b43f7e35af21fc4c81007cc67c8acda
TLSH
T178414C5651992F5208C4CFE6F1504E34742CBBA27DB43E1017EE653979CE1C9B1D6E44
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/vlcmediaplayer-128x128.png

SHA256 567751ed24fddd40ef241de1ec51c285d707a8f49f157a0f8f42c6db08e3c891
MD5 fae1089d09dc4643b336332e0a81489a
SHA1 45b2ffa31ad966aa1337d8d675ee7888f6d28b8e
SHA512 362bc745a415cc7fe4cc5df675e2ba744badd5e3ab401d91234f0cb62c2d1210f9735255deff498c4316d2111cff18856511ca3da2977e639cdc846986c0fa91
SSDEEP 192:5UoaniATpiY2yv8/H1NvcpnuygnIJuH2qjRpSUsx/JivrCds3:moanzTpi5ruw9H2qjDSbArCK3
TLSH
T13132C098BE2A594D736EFCE2CF9370674FFE71300B5282D80185982ED07606685702DB
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/winclose_button.png

SHA256 2cfcef01b952aefd15b335d3ab666aefe7767ae0c38703aba0a20b8434dee5aa
MD5 769d48272aa52d14f420532d62155e2a
SHA1 0ffb90f7ce0263f07279f8c745768f7da6528b4c
SHA512 fc72933268e800f723afa66cc15a93822189c433b014d74e9e2a924bf3a9687bff1cf40278b26f42fa47c17336be7044849c46b6deabb79cee05ee6c13862259
TLSH
T1EB21AAC5D002B91ED6949689219F5934A95ECCC40613CABB18FD5E2A37C5582DF3C3EC
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/skin/winmin_button.png

SHA256 ead08cc8d9499b5d1bea1d96cbeef06c19b905c7f9c4c66900045996dac5cd48
MD5 26f9757a4966fb79d67da03d560c1a05
SHA1 e42bef8cbade36999f212ae1be60cc9d1cfa1491
SHA512 da4d50c44095b8832b3e97c406925c7861283038f128ff639faec16dfe3789ad9bb5f6d0719e6ade213f097797a880dfb5ca48dd659f2e08d5eccd40a27566ad
TLSH
T16B01CADC2550417B5DBF179723450C12A4014FE0466BE1670A139C2FA7F0631F5FC729
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/un.package.exe

IMPHASH 35b698a6fd5038f719a27b089cb1f48e
SHA256 a4da8c6f38d7e573ffbf04e753ea4cb0fa6a174df054aff57edcb73e3e252fce
MD5 5694e7daf20c47c8d5e73d4a838c2ee6
SHA1 43814f29584ff23c2ca6f78aad733dde536afd56
SHA512 ccbb140a677356e1b34e65cb7a25c36145c40db37f538ed821664c676c1378efaf82fdd4b762dd54cb93b00c23e267fc717d8e0730d06924b5226b44cd4c03bc
TLSH
T1C881B4027AE5F43BE19822FF93ABCCD1E7256061235458EF04F3608B0F525E33C29041
MD5 SHA1 SHA512 TLSH

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Z:\Programming\GitHome\master\Employers\Franco\TightRope-BundleManager\Custom\Scramble\Release\Scramble.pdb

$PLUGINSDIR/utils.lua

SHA256 57c0c5fb5521d4b16be42251f17cc5c6bd6fb2d7b8c4c4ca309ea5010a31a9c6
MD5 5c5179ad112ea82fff7d447ffddfaf31
SHA1 1da547960363aeb2059dd2745f84186f47ffdecd
SHA512 4d72d47cb132bc1ed4076adac9d7c152199b7effe6ae2c5d6a2ad22453400a27c8c2089dba863ac4527cfc2d58c30e33c2526682ec512ae697f5d53104162d4f
TLSH
T18031BCD97341BA609AF1C3B2F44F0820D40265422D7A50B8FA5C15F52F74A7DD2B5F68
MD5 SHA1 SHA512 TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

out.upx

SHA256 ab58ef3c18256a3468edcaec8b2b079db9df4abbd9c95f88201777425f1ac54d
MD5 bf69ff87bfe6dfc945cac5e1a46db3c8
SHA1 6b305dd902b4c0c027d7a9802c31cc15c4ddf3a9
SHA512 f4d88158729fbd9c7864fedeb2572c43d77da7e00bdcef164fffb9fefb432772b2c8dbe0272a49846b795e54663984e7f7d018ee295344cda74875f6c88ecb34
SSDEEP 3072:8oPyys54Mvu2u6RloJ4VlF30VVe3HJFkQf1:8zkd2u6Rlo2PFqit
TLSH
T1A2247E053E4CA4E2E7698136AC1F5E6786C57D79AB8067DF27E5F3AF20B21A1413F012
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.Downloader.Win32.DownloAdmin.hrvk.c0114a3dca0da2316699056a984897e5

PE Signature issue

generic

$PLUGINSDIR/AdvancedTests.lua

$PLUGINSDIR/BrowserControl.lua

$PLUGINSDIR/ButtonEvent.dll

kernel32

user32

generic

$PLUGINSDIR/CustomBrandingURL.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/CustomNSISdl.dll

ws2_32

kernel32

user32

advapi32

generic

$PLUGINSDIR/CustomnsWeb.dll

wininet

urlmon

kernel32

user32

ole32

oleaut32

generic

$PLUGINSDIR/Events.lua

$PLUGINSDIR/FloatingProgress.dll

kernel32

user32

generic

$PLUGINSDIR/GuiInit.lua

$PLUGINSDIR/IntegratedOffer-Truste.html

$PLUGINSDIR/IntegratedOffer.lua

$PLUGINSDIR/LuaBridge.dll

lua51

advapi32

kernel32

user32

generic

$PLUGINSDIR/LuaSocket/lua/ltn12.lua

$PLUGINSDIR/LuaSocket/lua/mime.lua

$PLUGINSDIR/LuaSocket/lua/socket.lua

$PLUGINSDIR/LuaSocket/lua/socket/ftp.lua

$PLUGINSDIR/LuaSocket/lua/socket/http.lua

$PLUGINSDIR/LuaSocket/lua/socket/smtp.lua

$PLUGINSDIR/LuaSocket/lua/socket/tp.lua

$PLUGINSDIR/LuaSocket/lua/socket/url.lua

$PLUGINSDIR/LuaSocket/mime/core.dll

lua51

kernel32

generic

$PLUGINSDIR/LuaSocket/socket/core.dll

kernel32

lua51

ws2_32

generic

$PLUGINSDIR/LuaXml.lua

$PLUGINSDIR/LuaXml_lib.dll

kernel32

msvcrt

lua51

generic

$PLUGINSDIR/NotifyIcon.dll

shell32

kernel32

user32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32