jaffacakes118_not-a-virus[.]AdWare[.]Win32[.]Relevant[.]c[.]e4df0485808b756e3fce3fa072a4d879

resource
jaffacakes118_not-a-virus.AdWare.Win32.Relevant.c.e4df0485808b756e3fce3fa072a4d879
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/Math.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/FlashGame.exe
unpack001/uninst.exe
unpack002/$PLUGINSDIR/KillProcDLL.dll
unpack001/update.exe

resource
unpack001/MSINET.OCX
unpack001/crinstaller.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

jaffacakes118_not-a-virus.AdWare.Win32.Relevant.c.e4df0485808b756e3fce3fa072a4d879

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 2acd02a5276c6b2e416fbe56a44fe2b7a9ed4b1bdb0be176efa960e3b50a15bb
MD5 e4df0485808b756e3fce3fa072a4d879
SHA1 b25cde3ca1e7226615895cb9571d32d02c77dd2c
SHA512 531c2b3ae5557d8246323940c608f0c467295344969e896010e8b5cc096d4f167923dbc80e22239caaed9ee891c4920b64f89ef8e3c650dc8fb963712578fd1f
SSDEEP 12288:RMzFYMrrdZ2qxoKkQ0LYHSgtg/fXrOVhIJhzIcuPo:RMzFRrrmqxtiYHSgmDOVhIJhzI5Po
TLSH
T114B423C676E0C2F6C05204375D738759B3BBABAD3F1172671F25BF2D9A31042A825D8A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 54cf1572ed47f614b0ffb886c99fc5725f454ef7ff919fbb2fd13d1cbe270560
MD5 9eb6cecdd0df9fe32027fcdb51c625af
SHA1 52b5b054ff6e7325c3087822901ea2f2c4f9572a
SHA512 864742ec6f74f94057b54cd9b09707c0125ac8db4844fa80af201e8b72a811bb68276c993e75bce67e5ece4f83644572edbdee5e963634c5a37839615faea97a
SSDEEP 1536:LP43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:LwU609VMH0T/t
TLSH
T192639E3375D540F2D19E40B114A55F2BDF7DA6248BE24DD34F6628CAAE20EE1A23370B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

FlashGame.exe

IMPHASH fdbdc596f4a1ecdcbb9995a727a6de06
SHA256 c229f53f74cce12d0601b8679d42fc20df91bf036c754d7b68bec945e8c092b2
MD5 64591be7fa1e2f8834a84a81bd84e10e
SHA1 6b3bf51ac06650f3b518cbd2323724c892d222e6
SHA512 c660e0988449e821ee83ffe234f3d260b299a0a9ee1395ccc8e46cca7ebcdb1e993947ae5fcc4315a53bf85f30e59c2a4b0189b5b72f2fd753a93a29e8fb1b23
SSDEEP 3072:C9AV2QWx5rsV7KLMbDIVwVsl9wOztzSM/cPOz/H43mL7QL5bJk1x4UjVcHWl6HG+:I57HYyY9Y2Y/Ygt0mJKmEGNDd0mE
TLSH
T11B649E23AE948141E06284B1783593BA2F563D32E4519E0B77C2BE196A31ED3FCF571B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarTstGt __vbaVarSub __vbaStrI2 _CIcos _adj_fptan __vbaVarMove __vbaVarVargNofree __vbaAryMove __vbaFreeVar __vbaLenBstr __vbaLateIdCall __vbaStrVarMove __vbaFreeVarList __vbaEnd _adj_fdiv_m64 __vbaVarIndexStore __vbaNextEachVar __vbaFreeObjList __vbaLineInputVar _adj_fprem1 ord626 ord519 __vbaVarCmpNe __vbaStrCat __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaAryDestruct __vbaForEachCollObj __vbaVarForInit __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i ord598 __vbaVarIndexLoad ord520 __vbaFpR8 __vbaBoolVarNull __vbaVarTstLt _CIsin __vbaVarCmpGt __vbaNextEachCollObj __vbaChkstk __vbaFileClose EVENT_SINK_AddRef __vbaStrCmp __vbaPutOwner3 __vbaVarTstEq __vbaI2I4 __vbaObjVar DllFunctionCall __vbaVarOr __vbaStrR4 _adj_fpatan __vbaLateIdCallLd EVENT_SINK_Release __vbaNew ord600 _CIsqrt __vbaVarAnd EVENT_SINK_QueryInterface __vbaExceptHandler ord711 ord712 __vbaPrintFile _adj_fprem _adj_fdivr_m64 __vbaI2Str ord608 ord531 __vbaFPException __vbaInStrVar __vbaStrVarVal __vbaVarCat __vbaI2Var ord645 _CIlog __vbaErrorOverflow __vbaFileOpen ord648 __vbaVar2Vec __vbaNew2 _adj_fdiv_m32i _adj_fdivr_m32i __vbaVarSetObj __vbaStrCopy __vbaI4Str __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord100 __vbaVarTstNe ord579 __vbaVarSetVar __vbaVarCmpEq __vbaLateMemCall __vbaVarAdd __vbaVarDup __vbaStrToAnsi __vbaVarMod __vbaVarLateMemCallLd __vbaVarCopy __vbaVarSetObjAddref _CIatan __vbaCastObj __vbaStrMove __vbaForEachVar _allmul __vbaLateIdSt _CItan __vbaAryUnlock __vbaFPInt __vbaVarForNext _CIexp __vbaFreeObj __vbaFreeStr ord581

MSINET.OCX

IMPHASH 96286284ff8e040938ba779778d1542e
SHA256 73da54b69911bdd08ea8bbbd508f815ef7cfa59c4684d75c1c602252ec88ee31
MD5 7bec181a21753498b6bd001c42a42722
SHA1 3249f233657dc66632c0539c47895bfcee5770cc
SHA512 d671e25ae5e02a55f444d253f0e4a42af6a5362d9759fb243ad6d2c333976ab3e98669621ec0850ad915ee06acbe8e70d77b084128fc275462223f4f5ab401bc
SSDEEP 3072:i4QYXpLZaH+kCp1RCaSCF/6UMiySQYPfrj:i4rBfL1RCaSC0ej
TLSH
T1E3B33802B7E2417FF7A627346AF65BA95EF77D153C26984F9300328D5A32B40DA24327
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

2f:46:b1:b6:11:28:7d:70:73:30:59:e1:8c:1f:eb:8a

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

4860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

wininet

FtpSetCurrentDirectoryA FtpCreateDirectoryA InternetCrackUrlA InternetSetOptionA InternetCreateUrlA InternetSetStatusCallback InternetOpenA InternetGetLastResponseInfoA InternetCloseHandle InternetFindNextFileA FtpDeleteFileA FtpGetFileA FtpPutFileA FtpRenameFileA InternetReadFile InternetConnectA FtpGetCurrentDirectoryA FtpRemoveDirectoryA FtpFindFirstFileA HttpQueryInfoA HttpOpenRequestA HttpSendRequestA InternetOpenUrlA

kernel32

LeaveCriticalSection DeleteCriticalSection FreeLibrary HeapFree WideCharToMultiByte lstrlenW HeapAlloc InitializeCriticalSection EnterCriticalSection GetProcessHeap CloseHandle LocalFree FormatMessageA SetEvent CreateEventA GetLastError MultiByteToWideChar lstrcatA lstrcpyA lstrlenA ResetEvent SetLastError lstrcpynA WaitForSingleObject WaitForMultipleObjects GetTickCount IsBadWritePtr DisableThreadLibraryCalls GetVersion GetFileAttributesA GetModuleFileNameA GetWindowsDirectoryA LoadLibraryA GetLocaleInfoA GetProcAddress InterlockedIncrement InterlockedDecrement HeapReAlloc lstrcmpiA LockResource LoadResource FindResourceA lstrcmpA

user32

SetDlgItemInt SendDlgItemMessageA GetMessageA PostQuitMessage GetDlgItemInt GetDlgItemTextA SendMessageA ReleaseDC GetDC CharNextA SetDlgItemTextA SetWindowPos SetWindowLongA SetParent EndPaint GetClientRect BeginPaint GetWindowLongA SetFocus MoveWindow GetWindow GetActiveWindow GetWindowRect IsWindowVisible TranslateMessage OffsetRect EqualRect IntersectRect DispatchMessageA GetWindowThreadProcessId PtInRect WinHelpA IsDialogMessageA GetNextDlgTabItem IsWindowEnabled GetDlgItem IsChild GetKeyState CreateDialogIndirectParamA MessageBoxA MessageBeep SetTimer PeekMessageA MsgWaitForMultipleObjects PostMessageA GetParent ClientToScreen CreateWindowExA EndDialog LoadIconA DrawEdge DrawIcon LoadCursorA RegisterClassA DestroyIcon KillTimer DestroyWindow GetSystemMetrics LoadStringA wsprintfA DialogBoxParamA SetWindowRgn ShowWindow DefWindowProcA PostThreadMessageA UnregisterClassA

ole32

CoUninitialize CoTaskMemAlloc CoInitialize CoTaskMemFree CoCreateInstance CreateOleAdviseHolder

advapi32

RegEnumKeyExA RegQueryValueExA RegQueryValueA RegDeleteValueA RegDeleteKeyA RegOpenKeyA RegCloseKey RegOpenKeyExA RegCreateKeyExA RegSetValueExA

oleaut32

OleCreatePropertyFrame RegisterTypeLi LoadTypeLi UnRegisterTypeLi LoadTypeLibEx SafeArrayCreate SetErrorInfo CreateErrorInfo GetErrorInfo LoadRegTypeLi SysStringLen SysAllocStringLen SysFreeString VariantInit VariantClear VariantChangeType SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetDim SafeArrayRedim SafeArrayDestroy VariantChangeTypeEx SysAllocString

gdi32

GetWindowExtEx SetViewportOrgEx LPtoDP DeleteDC SetWindowExtEx SetMapMode SetViewportExtEx GetViewportExtEx SetWindowOrgEx CreateDCA GetDeviceCaps CreateRectRgnIndirect

blank.htm

SHA256 9cdc337c5bed9f6e5c070a3b9e7234d096e16de76340c6f7a4f6ca31592cdb63
MD5 73d08eb75396e0bd4b26151737759f08
SHA1 e848c2150d1fd756e68d565d6edb96346d6d4c93
SHA512 4273435363d822861c8348df8726495ed995a4c2630a58d6ebbfa880bafb7b97ca9c50bdef9c81f22f7bf10ba8b8e9a99a6e07000ec9f0292a71c947d02c4952
TLSH
T15DF05C7726871C07B1A91F7059E2A7957232B843D1C4042C50452C7FE4DF242D197324
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

crinstaller.exe

IMPHASH 1a05f326eaa74878fdf8183271d9c333
SHA256 d5c7cd198041708927456c1713eb1dba92a2ad32e158236103e9f59ba13d51cb
MD5 cfbb48e8780d1e4a81ae942e51e65c73
SHA1 d84ce929c09e373ff2b0b567cf39148485c268b5
SHA512 fb65bee0171cde56d7a6ec593cfe104d900e41365eaf2dc394b9f2c7ba2e464ec7775be69ec8a5ccbad7db9e630cb2750f200bbf6798397ca78ff240131649f6
SSDEEP 6144:cqoa/iHXWk0qeOh2wPrYohOR9QUrIxX/FVqc7g87R0rnKo85/kpx:cACXFpLhFPr9hOR9QcIxX/fqc7g8KrKk
TLSH
T176747C03B380F436C67315311F9F6B7AB7B9B6740A355403A7981A1DABB19D2E33235A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

46:47:65:b1:c3:a6:e5:05:f0:29:41:12:0a:3a:4c:f1

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Voicefive Networks\, Inc.,OU=Secure Application Development,O=Voicefive Networks\, Inc.,L=Chicago,ST=Illinois,C=US

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

4

Entry point

213256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\src\Client\BundleInstall\SmallStandalone\BundleInstall.pdb

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

wininet

InternetCloseHandle InternetReadFile HttpOpenRequestA InternetConnectA InternetOpenA InternetGetConnectedState HttpQueryInfoA HttpSendRequestA

comctl32

ord17

wsock32

listen setsockopt closesocket shutdown bind gethostbyname htons socket accept send WSAGetLastError __WSAFDIsSet select recv WSASetLastError WSAStartup ioctlsocket connect

kernel32

GetStartupInfoA GetCurrentProcess GetSystemDirectoryA InitializeCriticalSection DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrlenW GetModuleFileNameA WideCharToMultiByte GetSystemTimeAsFileTime Sleep CreateDirectoryA RemoveDirectoryA SetEvent OpenEventA GetVolumeInformationA GetVersionExA GetUserDefaultLangID GetWindowsDirectoryA SetFileAttributesA GetFileAttributesA WriteFile GetTempPathA WritePrivateProfileStringA FreeLibrary GetProcAddress LoadLibraryA WaitForSingleObject CreateProcessA lstrcmpiA ReadFile CompareFileTime GetTimeZoneInformation GetDiskFreeSpaceExA GetDiskFreeSpaceA GetLastError FindClose FindNextFileA FindFirstFileA HeapFree HeapAlloc GetProcessHeap GetLocalTime OutputDebugStringA EnterCriticalSection LeaveCriticalSection CopyFileA SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetEndOfFile SetConsoleCtrlHandler IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA IsValidCodePage IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemInfo VirtualProtect VirtualQuery GetOEMCP GetACP GetEnvironmentStringsW FreeEnvironmentStringsW CloseHandle DeleteFileA GetTickCount GetTempFileNameA GetModuleHandleA CreateFileA HeapSize SetStdHandle GetFileType SetHandleCount GetStdHandle HeapDestroy HeapCreate FileTimeToLocalFileTime GetFileInformationByHandle MoveFileExA PeekNamedPipe GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter IsBadWritePtr VirtualAlloc TerminateProcess HeapReAlloc SetUnhandledExceptionFilter TlsGetValue TlsSetValue TlsFree GetCurrentThread SetLastError FindFirstFileW DeleteFileW FindNextFileW LocalFree LocalAlloc OpenProcess WaitForMultipleObjects ResetEvent ReleaseMutex ReleaseSemaphore CreateEventA CreateMutexA OpenMutexA CreateSemaphoreA QueryPerformanceFrequency QueryPerformanceCounter SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetDateFormatA GetTimeFormatA UnmapViewOfFile GetComputerNameA GetCurrentProcessId MapViewOfFile CreateFileMappingA GetVersion GetShortPathNameA WritePrivateProfileSectionA GetPrivateProfileSectionA FormatMessageA GetModuleFileNameW LoadLibraryExA Process32Next Process32First CreateToolhelp32Snapshot SetFilePointer InterlockedExchange MultiByteToWideChar lstrlenA ExitProcess RtlUnwind RaiseException FlushFileBuffers SetFileTime LocalFileTimeToFileTime ExitThread GetCurrentThreadId CreateThread GetCommandLineA LCMapStringA LCMapStringW GetCPInfo FatalAppExitA TlsAlloc VirtualFree

user32

DispatchMessageA GetSystemMetrics LoadImageA ExitWindowsEx SetForegroundWindow KillTimer GetClientRect SetWindowTextA PostMessageA SetWindowPos LoadStringA PostQuitMessage GetDesktopWindow GetWindowRect MoveWindow DestroyWindow DefWindowProcA CreateWindowExA ShowWindow UpdateWindow LoadIconA LoadCursorA RegisterClassExA GetMessageA TranslateAcceleratorA TranslateMessage GetDC ReleaseDC LoadMenuA

advapi32

AllocateAndInitializeSid EqualSid FreeSid RegOpenKeyExA RegDeleteValueA RegCreateKeyA RegSetValueExA RegQueryValueExA RegOpenKeyA SetSecurityInfo SetFileSecurityA IsValidSid RegEnumKeyA RegEnumValueA GetSidSubAuthorityCount GetSidSubAuthority SetTokenInformation RegEnumKeyExA SetSecurityDescriptorOwner SetSecurityDescriptorGroup RegCreateKeyExA RegDeleteKeyA InitializeSecurityDescriptor GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl RegSetKeySecurity RegSaveKeyA RegFlushKey AdjustTokenPrivileges LookupPrivilegeValueA RegCloseKey OpenProcessToken DuplicateTokenEx CreateProcessAsUserA GetTokenInformation

ole32

OleInitialize CoTaskMemFree StringFromGUID2 OleRun CoCreateInstance

oleaut32

CreateErrorInfo VariantClear VariantInit SysFreeString LoadTypeLi DispGetIDsOfNames VariantChangeType SysAllocString GetErrorInfo SetErrorInfo

shlwapi

SHCopyKeyA

gdi32

GetDeviceCaps

shell32

SHGetSpecialFolderPathA

data/db.mdb

SHA256 89229a53feadd10abae4acd8b1636c15e0b5880d99e281f55eaeaa9d26dabab6
MD5 ae7fa6d3c1f3399182353f13fd2e646e
SHA1 9f6fa647d98ebbc8fb9b90a7a37c3ae336c94b93
SHA512 622d7f37c89151e744ad88401385e8017475d3bed8a47728d43f2d3bf740e97c0e42cf76ba605319d2a757fc9eead7f4951437fc6e79e97484e71c94a5f19744
SSDEEP 192:cxI3WJ29BEEcppVEeLx9kvb64GwDAa2xZmTAgbarE+7F32eFZkjFZkLH:B9BXcHVEeLx9kj64caIiAzj7F32eMu
TLSH
T148C3A882B6D48111DAE10B325AE7E7891631FC1C5D3D8B1B2DA0FF1EAC756D39A10AE1
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/Thumbs.db

SHA256 c9be29eb0837b67ee7bf17e0c7a755546a4f01cb1b2f75ccc1384674bc3f7bc9
MD5 157d06972e829e6cf04f13ea4ac5dd62
SHA1 71e9b4a7034338ddafa48880d96ea6deb533f884
SHA512 46b9a081b611f746ac6bc00025d8c7ddc2891b5c15da194bf2da371cc4027266c43b065e0d41d9607ffdf0337d7f1513c3f7eefe4fb01d7ab556e5eb3cf3c798
SSDEEP 768:H/IdtnBlHT0v6pvae2JgYPlM4I/PtT5W9lL:H/IdtBBT0vEva9JgYPi4EtT5W9lL
TLSH
T1A6C2B72A7B4297D0FC3686F699165D96D1EDEE827CD0270B39E077E9C630EC8D448A4C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/bar_no.gif

SHA256 4ad25c5bc3a30f4d4b235bb89eed556d3373c97a73761046ada0e5636f1ac0f9
MD5 7afdecd11999abb5162a2dcd4d181807
SHA1 8cf997bc2d9aca7365cef8a6837b655c4d6e95f0
SHA512 a6b7dab9cffcb9323ec98c234701f4d9140aea4c25dd4223fffa36739266ed1713b1b2a0daccbf96e2fd264661b8987c59d59e30c193f00ad50d6ddd21570c7a
TLSH
T1BA01864937FA8050FE48E8359B96C5F4691636D322DC273C3062D259DEA5165EC290A5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/bar_yes.gif

SHA256 70ffc55d9e0b8656aabc94a1afedf1a8957afb9fb25428e2d865bc0574083a72
MD5 c05fa16ee1299769c3dbb7159e5f53d5
SHA1 825e56220c39962da505632bb03203581835a18f
SHA512 e83b95f614523823b6aaa82a69f60f4ea528352984f7190e218d95e271e34fc2f2d62dbf2ca3fad899c2913f037f5f109f97a389e32c047327d1d496601298ab
TLSH
T11731B81E640E02D3E9E0F7B436E302A036B354275C6DEB3D8468B65D8BB595D6171523
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/bg.gif

SHA256 41dafbc0e77af71f42c8dd1aa16367dd107780d9c6c2deefa8773c3dffd57541
MD5 808746c73ba2edb8d732e4bb5312f8de
SHA1 7f430e815de520538ec0c8cf6655b76a2db5b533
SHA512 ad3af9217a2cb7487366b55531f472727cb684808b444606eff9ce05868f9406afb3ae8831e9584f55952859f8758490f42481832a3dbee0d1f7dc43a146af56
SSDEEP 384:qjb0YnJV8CstF7xqUSTlO7gXaBxg+/YObMLWaz16:Qw+JV85t9xq/lCXBxy7B6
TLSH
T1F672D04259C513EEB87B8761927D6FDE8E9C3CB936017C096D3250B684C7221F3A7674
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/bg_about.gif

SHA256 c7f8d6b16218d78117778544e0ca68d43074bd009fc828d63a9845d8aa573033
MD5 3f2482610a79af7b7e97c9d00953f30e
SHA1 ca5383c899e3ada699d365889b588609c79a082b
SHA512 9df08fe5dd0d52ded6a52c573fe2eeafb7cb59ce720df1a154ef7f7f31ee5a22d380c9be785847156bd49c8fcda10632e1f8ab399f7ba87d615e8d996287cac5
SSDEEP 384:Anlke0PMlxQMmDB/TVbPzs1cq8Np6MRPiXwv23WVwZPEp:AlmM3QDDZIc5N5NiXwwWuQ
TLSH
T17B82D0C16CCFC41590B1C8F8B22731679A86BA4B043C144BBE52FA0356669EE7D85FB8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/bg_fav.gif

SHA256 49e7bb0bf6d2da3e77e0f7da7f1fef47652445188357fd5887f7d62ba1e5beb1
MD5 b8100ce6dc835eb31c0f5d05f581473d
SHA1 750f1b386dee842e1acfc1758d78b64d6b1eaec0
SHA512 9975d56ac25081a44f568f0f817624ba9b6661551c170eee00b929cdd949656e3eebc394535164b1c222372a21c4cc8902a31aabbef91c72c3868b05bcd4b1aa
TLSH
T14FC08C45ED040FD2EA88B6B0A14A5484AA0DE284AF85AFB2286281C82A6669300529B0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/bg_game_pic.gif

SHA256 d0766608d889ce95ce38b74e3d1c9803f086621915f6ee63a927f4ec3f96e945
MD5 abdcdbe58ba30012de97144738251e3e
SHA1 2fe1803cf1652376c68be0c9c0bc0115dee3714d
SHA512 a3236ac9ab65892d4c96d405f8e77b02738ae3e8293b5699e08454f9f24f4f196071245f5697378887cd86494f7ff9210b7544ec47d1a34e4842a889fa392a5b
TLSH
T116E0F87B23B2A84BF3100430FAB1A8E0124D0BBF16002E8E62860688AC2AB812892484
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_clear.gif

SHA256 d684caa988aa12f478c6df5cc75b612b399b3f3ea5a1fc37da0026d3ccf7c5ef
MD5 d927b7ca3c6b422de2e6627002380043
SHA1 aa2f4a1eee42d0d2a17e5b85266b3be3e4949b01
SHA512 f0fec264845d497120cbdd63bdd9c74f47da6e0e34b6d8b822935edb32c6ee14a745e7f33adeeeab0a0683e0a516c2d029e11304e61d271df614009285aab547
TLSH
T175C08085F4CCB245E34866375CC780C4F391D0961FC80D5154D7FF886814490015BF0C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_close_mouseout.gif

SHA256 615ad8f7926b34bd14e66f41d9756f5c8b294e4921a62fd4d189702de230c60f
MD5 6baf0f8f9e45dc876bc58583b2c4e484
SHA1 59f9c22f34d346509a086e0c509cfb0d527f8225
SHA512 bdcefb4f46dc33984917635220570b1d070014ba47e0cd1fe6dbff53b928b7030c92447b62f8e385799844869f6446db67b166e7b9e25703cd3f6392d29e173d
TLSH
T16901B7147CE00D30DDCA24354374C6B31830CC2099D21FBBF41C7387C00A562425324A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_close_mouseout_1.gif

SHA256 1f5df21404b1d371acf9d9a638c2f3f8dff68d428a7aad08dd7169d9d231ce25
MD5 f9ce9fdd90ffa40760f22f077c65701f
SHA1 a070849fb0d7460bdfd02e4ab90d47a2f78ab726
SHA512 117619e1b269a1517ba4c2155c8b2dc065a9f89861bfa0da88d87860ea705ce0e1221488f1ea1f3151d4db65dd1b1f3e2d18bd93cf832750cd951ff0f2fb28f8
TLSH
T1C0014136ADAB8E70D5806C35C275C6468430D920C5D9D7FBB5B2C7A6D305B93812249C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_close_mouseover.gif

SHA256 3f8e8a04f362ebb744b9e0ad66eef7673aa2cac27a450ae66606c9b1cd31721a
MD5 4a03d8b6259a518b4cf21e44d5881c2c
SHA1 c539c8bef0e58312c64b42f716a84a3e0eff4be5
SHA512 69b736074c1b449d04d336cc18c825be31f3f1336665d7c824a9707839871171349505381e634c4ca5a814f914252b815e2faac026a08061322fb20f97cec3c3
TLSH
T1D1E07D22B090C9DCD438A1788AC56F5346417B6D7CC2366758D7C21DC9CCDF57250D56
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_close_mouseover_1.gif

SHA256 959611f4a9f328c380e8c836d88fccea6cb28c070d436e4cbe3e2c3c1c8e2ba3
MD5 550ba57a85fb16d41e390ad882f1d936
SHA1 4bc0aa3093e2f8491f42182f7ffe58cee45a4416
SHA512 bf3de40d09ce0aa4244a08671c06750b495b092c388324044be7ca6d4ea48e459b50eb0d1817ee0101d7aa695c7641146852b2c5ad3a275484ba603e1e612d87
TLSH
T136E07D21A468EB56D168E0305B959E4688885FE83C902D26D497971EC5959F22622601
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_mix_mouseout.gif

SHA256 f5c9b909a2c6757532a28597fb2ac01886e615d100861015248ebbc53df1fec8
MD5 80775cff798a3191ef67c5d86a392686
SHA1 53f24f0ae5c3731b67430521733e082f22946edf
SHA512 00c6bdf5607c61ee98a4c7254145818f38668a3e4ae8ab49a443783e40263ed1ff8d605104cd9d865b805e25473d280fb719409e3fdbe506d495241d9cb65d61
TLSH
T1A3E0C06A38D04C32C4C2677F95608E8A10A378D2099849B9124C870D7236D235880242
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_mix_mouseover.gif

SHA256 3f356cd9137b509327cb21460c5e11e978f41fad075b2a77282f649d8c870ae6
MD5 822f0635fc0a2b2f86af0ebd7682f797
SHA1 4f56f1b5ffb3fe683061debe77568bd1a6062c88
SHA512 d6249e47ae64f559202f4be4acb1a190f383bbc5c5013e03bef95fee80292c9de38e92cf702112a1756db64073554659581fb16ffacdd35676d6d73741d6b7b8
TLSH
T183B012ABF5F8E025E40D36B90C0482D816F42B1E37F76230726666AE6D1B0228392B11
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_page_next.gif

SHA256 fd578a6e5a740e4d99fdb24f2b393497d074f842e862743905153e64e17d5186
MD5 7c3642a09ad83aa21feea2dc7c5c5e47
SHA1 b78c53f9a54f61d1ef5969539df61a5b7b04e4cf
SHA512 8d77a8f0f3e884e017507b6e9d5e4e41162001e731fe4e03863850a2fbbfcd69571895c8c46cfd4f39a116aff3694166df995044276882c3c3e3e0466838f5db
TLSH
T118C08070FD48F904D3669D3A0B77C4C477D0D113FB490E5221073E6DE414871501550D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_page_pre.gif

SHA256 344d4e18baabb426b8ab5812e0a8c73e95a5391e723603491edd9667880232a9
MD5 983b49cfa0405396bbc9c04cca26f274
SHA1 fe374a74a3ce728c50e4b3fff2dda5efeb76f4ef
SHA512 26be4db9391bea24a89834e6bd99967ef6e7a1267e04e286a099cc5752f8ef103b25aa33b8231bef7177dd20dd60d0bab29cf5fdd020647d36789869a050aa4a
TLSH
T1B6C022A1BC14B5C0D02484BF141A80A0B381CC009B080C02ACA7364C6828C56001A528
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_play_close.gif

SHA256 6793f1aa37eb2b111c5768ed6e68245e62f699f7d7f341f40be56a5a02f90de5
MD5 9b08885eec5e48acf9df70367d00d11b
SHA1 c9739b30f73d0698314a04fe09d51a68029dc52d
SHA512 beaba3cc8cc4af8a4192c774de446fb186656635bec0e524ba1310937dfa45139cbbc920acb314104ad0232913d706080fddf7842fb976688ec73e4ee3795daf
TLSH
T17AB02232BFCCC03FC00803BC2C8B00802A28E30803C0030E0BBE202EE00B820283C230
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_play_max.gif

SHA256 576ed0d197ecebb07c2ae9fcf4ec9f075bac5284625ac1bf5948260408408285
MD5 059f0755d1ba48a55819dc38f51a8a8c
SHA1 173570bc146cdc52212745c6af3238beab83b5ed
SHA512 447c2af9a1c8a490f41e38a040688a57129139c17454d21a074245b3546d42944a82995ef9b2bbcbe54bfbf9e9ca3ecae73a9650d09085a48c35da44a85ac938
TLSH
T1A9A0021ABFC49179D4BD97742DCD92E0A718CB54CACC078F013E218F576B565502E934
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_play_mix.gif

SHA256 1e92da2b7bc466828838c2fbbae6522171a2de142ccae7671196349bd6353849
MD5 d92a6c5c4418c80b540f90dc19506be8
SHA1 69f8f27df7d1bb111bbd99897067898c71760816
SHA512 f69d23fa6e971a35537af1f5be43f60d66e77bf2b0081f2d15827c4056a047ca01091ea4ea1dbc100727a7e23f1514d48459faad6fd3f49d5491a122c25d2461
TLSH
T19EA0024FFEC7A870D96955381DCD52C0F9189B4425C9578D173FB86F625B061077FA20
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_play_normal.gif

SHA256 5da01d3194e30f51521961dcdbb74a4c2fc0b281593f7a90a8a9daecba696d9a
MD5 d4bd99a54bcebdb761721db1611e5e2d
SHA1 98ccd7ff91ed00e6030c8b33271264804894d69c
SHA512 27ae5e02f597433a05c1d394e880a13cf1afc3c41313d813102be6753fd69cab7e1d3afa24a5e68489f80303f8dd5b28d9989d55f8e108f110fb713b7f69c89c
TLSH
T1F7B012017E8080B0C355203C094E76405709410407C12349011B300D6007474001C056
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_search.gif

SHA256 257efad0a5a605735c8c1e147eee60a07b82c1f3dbb032da8c7cae7858f36768
MD5 2974a31d46a58410660fd6e9fbb7a037
SHA1 9bd047e511eda70ce44aa227c1ef415c738eef61
SHA512 4aa6a3bab41772af8e552a5369a4ad9730ad9588b16dae7d153dc325a7f076947ed01d49cf934aaacab3a1c09175d864a3035c151e83de9705e22b7515cf9f2c
TLSH
T11AC0C00CF50CF44EC214D87CDB4DC5C2B0B1D8403F4808A515171A6840841020A62007
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_search_mouseout.gif

SHA256 f366c11a956bf75187a95a1e97798b632599e3423a702b59093282a3eae758d1
MD5 d52b7198e8423d0b597a59a191a8d101
SHA1 96f9a65c92330c43eb08bd70d464ab0c5700ef3d
SHA512 d4dae2b98eac4de9b21bfc21fc24af30e9190912044eabc6e42ada0323efb6a28efc662d39612668d68c1a66181ea6c40db41641be33b25a470819ec9c934d77
TLSH
T11511964AB27986F9DB5980FE5C09819682FB6634996A0646D3703E30328403B806A7A2
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/btn_search_mouseover.gif

SHA256 03e423db4e182d8be2fd305d5713f5d2ab446c6fe381614bf5af4ee74d78c5ba
MD5 9c9319924778a1b4e8752f7a8833565c
SHA1 5c46f2c412d7d0c8aa3593e4fe97ca930d637087
SHA512 2589f0c6bea63f561d58d3a6f76e0a13ccdcfd5963797d45ed9521d191edc3d6ff37ed149cba06386bbc210cf8c3256ee74c0f55db4cee608e7a2b9ad5400262
TLSH
T17E012501B3B9B0CEF529217B490DD1D588777478E8E1014552646D5A32494BED62D5D1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/function.js

SHA256 6213779ba677c3ab06ea4db1debdb133ee5c814ecf65968a195c3d092898119d
MD5 1386bea911c00fa8a63d76158c62654a
SHA1 4bb86c17002ba7edc6702b40e635d1eaa3c506c1
SHA512 cb5e67f979831d9cb6f4e1492cae1ecff1839a36eef87f6d277fcc2a84a411fbd533ba99cb4e63641b1604e6becae69911c7bee5a6d11b8261ada3d3d7f8fca8
TLSH
T1DEF090D6B003D5D428F8249DC77BFBD47A3325A081D4204A9209CE2DFDF2713CA191D4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/logo_18.gif

SHA256 060bb396b48590f409d612dbd3c3a28daf47338b91801ea90d416f5cdf90c34b
MD5 9b2a427730cf983b36cc18fc3d8c11a0
SHA1 b212e1fa544709e80b9a52f9d429db4dec85d731
SHA512 c1c380f230a4ccada95bbabbc2cebaa6998a280a976c6a3f852b7064c800e721f9bf6df64a2a4cab9f01ac825350685516cd7b299b21b1a2b226f15d3b161269
TLSH
T11C11621ABC4FE402D1F73AB0DCA053AF3B6D33CC43929308446C269E90294289116C1E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/main.css

SHA256 af8d28319d8976c27b5b1ec42d95128515e6f9ea60dc01f32cb8088ed322b857
MD5 1e86664efd2aa75153eefd00953a3ae2
SHA1 161aa3ae66a6cad65999b4aab62b32ad9daa44f3
SHA512 58130c3a9cdcd45a909aa9a4b7287491450465260792581ac9dfc8f173e584974bf211bf2d7b0d4d08940b4ea4c8a29c3a79a1a9988078aa59faaa0755ea06ad
TLSH
T12B4164248616305ED02FE25368276558BB3BD5CEED832B7C6E7C2D79C10D543122336A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/uninst.ico

SHA256 27db46fffd8b82aba4f9068d78b00e61be33ebb84fa62b9b8d098cde1e34e0cb
MD5 46b000f4202ce14b5b4434d3267cd761
SHA1 60f3f1db252af8813abbf6dc966fd96dff3b10f7
SHA512 ff87cf429d0170f95c5d27c7593eab5f086459f4a456ab05a4fdc6fabef0bb9d7f735f21511fdb556eebe18ce512abd2eb38a31387b93a7620c3a01d751273d9
SSDEEP 384:wFW21J0LihnZaZ8iaRwluhl1U8P34YWKYnY9zfelaeq:+5hngZ8zR51f3iOSaeq
TLSH
T149824A8A324DB5D8D83EC231A053595413357E3341853C6EB3E276AB8DE25B26274E6E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/update.ico

SHA256 35cccc079a90b7b3618b3a19295219f7cfe041ec632468a7b2e2e003dbf97efe
MD5 49bf6d82c10e62fe5bf74d84bbdcfafa
SHA1 cb2577d85734aba487ca126b6623a5363276e7c7
SHA512 b508b7ff729669c4b4f82c5ffa97fc1c9e521b550ba884c1ed0dec15521db641cb31812ccdb57b30738fe14eeac3723c241f04499e6f580e1079e03d41abc471
SSDEEP 192:7mybZeHSR22NgAAsBPiyMnavwppfOTRKetOZkedqYvJgAdDhl3nNZ90ZVkj:rbwi22JSvaSWTkOGnMCHd1FX9p
TLSH
T15552AE8177265D77D8298EB6802353442E5CDC38A62C9BC1997ABDFB3EF12C071540F8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/youxi123.ico

SHA256 3a4e39db8683432a9ae0b4d5c2b42bd66fc1d05ed31a5fa168a344eb3661fc6a
MD5 9f1a189bfc42e9a8264eb46d0ebfbf09
SHA1 2e63984f565d3db49357d31fe09dd05dcb628fe7
SHA512 5f810e1d25baa87c9c19d480d0ea6a2e555584f1e9b8dea9aadea6183c4900ba62af8e5ec81314cd3106a29fc817d400310cb604f9640f61f837846eb5e67f12
SSDEEP 192:0XICBz7JIBbMIDHmqjSg/bLdT9JlcEJGjoD2eGKKxOaDgnDiKYmezarcbd4BH:Sh7fIDGGdpvc4mNeGdsaDgDif+cbd4t
TLSH
T1BEA22956BA60C9C4C4505870CC2BDEBC062ABE53D4F5284327907F1F7F76666A01EA5E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

play.htm

SHA256 f35fbab800dfdd8a19171d8c393b0de36c890d112b8b6857858e243647d94768
MD5 c3f4d11a1db263328a5a6cb0cecd82d0
SHA1 233094b23953236b701281af0f41d02a3f0a708b
SHA512 0f94ac38ff35e7c0ddeb7b3bc34b12b1b0c2e1f53f3657011102adda78a5239aa0d6c5e935a9933b6bc8d589c349bcca9aa7f8a7e4994d7f24758e91dea5f815
TLSH
T1163102D275439C48547825E9CB7AF38472766411C0C850099494AD3FF8F539BDB1E2D8
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

right.htm

SHA256 f13e5bd1fe3b3a1dd06a4601058054c94cdf0afcda15b089183f07dc37355c57
MD5 cdf3fd9d91c99c5839f799ebd503967c
SHA1 c0d6e2d53851f2a86c9ba72941aecc37c7878d6e
SHA512 4d3faf00d0b4e36501aa7ac5d0dda57683729f295c6da376b1e94f38703319808cad9a0549f450372b0c32fe9ba64b08b8ecfe95dcfd958689e5cd6e6774b445
TLSH
T12E11DCF2DBC29D1AA0375574E589B780EA7164C3C1880114740D246BAFF9645CB47A74
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 097dc74cd5b5fd1a82ef5d751ca7a8c33af05d1652b68767263f86fb97fda4f0
MD5 cb6cfd9678fbddaafd364739a702ca93
SHA1 66716466f6f7b551477f3ab88a997d404fad909f
SHA512 b606c0a8e608760b5c91907245832b384b5038ac9c509517529943707f20b0d0064e9f779b2735a5ecf0fe1df7152d406aad81031d85f77508d5b1a2fecc6d95
SSDEEP 1536:syZMSZFvknTePMZd4k4kJJvgdLeAyN1YNQvs1eP/w4R:rZMJnTeM4cJJvceAviP/wu
TLSH
T13F53CF0A37C088F3D69A02B106BBCB7AF3BAE74017105A6767655FBF3D322829D19153
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 815c88741b87a0210c457b00b57bf9c6
SHA256 ae2f1658656e554f37e6eac896475a3862841a18ffc6fad2754e2d3525770729
MD5 83142eac84475f4ca889c73f10d9c179
SHA1 dbe43c0de8ef881466bd74861b2e5b17598b5ce8
SHA512 1c66eab21f0c9e0b99ecc3844516a6978f52e0c7f489405a427532ecbe78947c37dac5b4c8b722cc8bc1edfb74ba4824519d56099e587e754e5c668701e83bd1
SSDEEP 384:3rYz6grZodORNWATt4TBmlk5ooyzFh7BukAUdJoUtSOSR:3QggDWATWNCFh7BNddJoxO+
TLSH
T126E26B21789406F3E69D553275D56F27562F6A5116F18883CF3399EA2C322F8B83B307
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6871

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

update.exe

IMPHASH 46c940610d0ba3bbdf99b49880b4e2ba
SHA256 a340b98733597c8f0d475dfdf644e23e5f7e65586529191b973c944f1fef318b
MD5 431598d487c6b550be6755e98b5916c6
SHA1 b9ca3dcef56f3d3cf0b35a3ca834ad37974cf810
SHA512 003262e64073e06889b750cafbbd9f7b1d6578e75375911f4854491b5dffa88301d08756af2ddf48d5d8642c381ae13d6cc596e56437ce901ac256be5b17bf78
SSDEEP 768:qID22jtvGnvHBX3lmM3QDDZIc5N5NiXwwWu+tpfYsjxVmODKAXhGnvH6xuD22:x22EvhX3lmLp7YopVmAKAX8vJ22
TLSH
T1ED63AE427B5E8877D5288FF1403303951A16FC3429188E476E5ABE6B2D756C3B9E027F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4988

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ver.txt

SHA256 494e5924f3cb8c8ca9eb6e93414a6e5ce53a109734cd5487e15f2c719673c809
MD5 76f9a82f6ea2d91e4f1e086d279e7d52
SHA1 22386db8d9aea04d03699a091430427460933471
SHA512 cf9efc6f4e49d24668eec4d5941de49ec72d13cdc4209e767581c2adf8628e93f0b16ce9ae71cd9ac610ab237af8e32ff118603c5f270defd51d12331cbb5392
MD5 SHA1 SHA512

NSIS installer

installer

СϷ.htm

SHA256 c383cf8fa50772e8bf385e95f267eeb23815a77003f3611d16a5c74b7c318b21
MD5 c9c4e0f9096334729f7077d587c7ac76
SHA1 89bd1f3a387dec8443c848662c440ad98aea1345
SHA512 6dcbe4062efe65fe05f19c55a2059eef99e8d32bbf7ed1280b1dd92b2d2c72464a413d56a48271f2230eb5ddf05af9fff2a5ba32e3fa571b51e5792f532e6594
TLSH
T1F7A0124C0004310430BBEC486FF200C1006B5A4384505CC1C016D4040468C0150891E4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.AdWare.Win32.Relevant.c.e4df0485808b756e3fce3fa072a4d879

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/Math.dll

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

FlashGame.exe

msvbvm60

generic

MSINET.OCX

PE Signature issue

wininet

kernel32

user32

ole32

advapi32

oleaut32

gdi32

generic

blank.htm

crinstaller.exe

PE Signature issue

version

wininet

comctl32

wsock32

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

gdi32

shell32

generic

data/db.mdb

images/Thumbs.db

images/bar_no.gif

images/bar_yes.gif

images/bg.gif

images/bg_about.gif

images/bg_fav.gif

images/bg_game_pic.gif

images/btn_clear.gif

images/btn_close_mouseout.gif

images/btn_close_mouseout_1.gif

images/btn_close_mouseover.gif

images/btn_close_mouseover_1.gif

images/btn_mix_mouseout.gif

images/btn_mix_mouseover.gif

images/btn_page_next.gif

images/btn_page_pre.gif

images/btn_play_close.gif