jaffacakes118_not-a-virus[.]AdWare[.]Win32[.]DealPly[.]cfk[.]6fbbe07144086075c53b04c8d505b907

resource	yara_rule
static1/unpack002/$PLUGINSDIR/nsRandom.dll	acprotect
static1/unpack002/$PLUGINSDIR/version.dll	acprotect
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect

resource	yara_rule
static1/unpack002/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack002/$PLUGINSDIR/version.dll	upx
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx

resource
jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.6fbbe07144086075c53b04c8d505b907
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/nsRandom.dll
unpack003/out.upx
unpack002/$PLUGINSDIR/nsisdt.dll
unpack002/$PLUGINSDIR/registry.dll
unpack002/$PLUGINSDIR/version.dll
unpack004/out.upx
unpack006/$PLUGINSDIR/KillProcDLL.dll
unpack006/$PLUGINSDIR/Math.dll
unpack006/$PLUGINSDIR/NSISdl.dll
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/inetc.dll
unpack006/$PLUGINSDIR/jsonparser.dll
unpack006/$PLUGINSDIR/md5dll.dll
unpack006/$PLUGINSDIR/nsisunz.dll
unpack006/$PLUGINSDIR/sqlwrap.dll
unpack006/$PLUGINSDIR/timepro.dll
unpack007/$PLUGINSDIR/InstallOptions.dll
unpack007/$PLUGINSDIR/KillProcDLL.dll
unpack007/$PLUGINSDIR/System.dll
unpack007/$PLUGINSDIR/UserInfo.dll
unpack007/$PLUGINSDIR/md5dll.dll
unpack008/$PLUGINSDIR/ExtractDLLEx.dll
unpack008/$PLUGINSDIR/InetLoad.dll
unpack008/$PLUGINSDIR/NSISdl.dll
unpack008/$PLUGINSDIR/Processes.dll
unpack008/$PLUGINSDIR/System.dll
unpack008/$PLUGINSDIR/UserInfo.dll
unpack008/$PLUGINSDIR/chrmPref.dll
unpack008/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll

resource
unpack001/$LOCALAPPDATA/dealply.exe
unpack002/DealPlyIE.dll
unpack002/vn-zugo.exe
unpack006/$PLUGINSDIR/nshist.dll
unpack006/$R0/AskSearchAsst.exe
unpack001/$LOCALAPPDATA/facemoods.exe
unpack008/$_34_/extensions/[email protected]/components/FFHst.dll
unpack008/bh/facemoods.dll
unpack008/facemoodsApp.dll
unpack008/facemoodsEng.dll
unpack008/facemoodsTlbr.dll
unpack008/facemoodssrv.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$LOCALAPPDATA/dealply.exe	nsis_installer_1
static1/unpack001/$LOCALAPPDATA/dealply.exe	nsis_installer_2
static1/unpack002/vn-zugo.exe	nsis_installer_1
static1/unpack002/vn-zugo.exe	nsis_installer_2
static1/unpack006/$R0/AskSearchAsst.exe	nsis_installer_1
static1/unpack006/$R0/AskSearchAsst.exe	nsis_installer_2
static1/unpack001/$LOCALAPPDATA/facemoods.exe	nsis_installer_1
static1/unpack001/$LOCALAPPDATA/facemoods.exe	nsis_installer_2

jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.6fbbe07144086075c53b04c8d505b907

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 42027f43c985a233cd17fa11800e4510d4399bcf6d19ddd43ec07656cec8fff0
MD5 6fbbe07144086075c53b04c8d505b907
SHA1 d4aca0a42db343d3c1e14ecdfddd84c8d35936d2
SHA512 ef4551f0b10e057af49b0c4386505b3d889221c9cbc5dfb24c4816411b0e4418414de5d77e3844a2dc4640b499e6f41f2e06e42b80913e75a6b0695dd759ea01
SSDEEP 49152:FCnGlLFDOpX0F9aPm6sOyQr8qHg6Gbul/V71b1dzYfjA:FOGzDOuGP9sOypugTO7F1dzf
TLSH
T11CB5336295C8C9B3C59202B9D652C6BFB736D9CD11012606ABE33F7E236F911E75A330
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/bloson.bmp

SHA256 03884e865dcc74b4b90f92a430388fe6cdfa3d53e4dbf7c6d9b1d9a40eb8eef8
MD5 9d76cbb404f76d227b2015d08fb90de9
SHA1 cc2d925128f1fec7ffb8f760e7615eaf7665f23b
SHA512 e3bbcef8e95019ff434a33818ade93fb399d12051d849377c152e13ddcd63c66bff95bba71b44c083b3b891d51a5b20d241444257ea5913550a122c790a1200d
SSDEEP 192:FnqmELNjT5191NYICn76GGhKPOzHdfU4tgOy1pBbhG7w7vcUdZPZTFy:FnqmELNjT51DGICn761hhlaZbHzTFy
TLSH
T11AC293829B8416A8A8ADDE64422BDDF8C3F17FA77E19FA868C01704767F35D43493903
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/dealply.bmp

SHA256 0f84e3d4cf457f6601c12f52ea349e803ce12730de38657651b80e6cdcb6d098
MD5 622892e1bfd696d8964c75977e538674
SHA1 fd78c36c6aee910b534d075781869eac5e96564e
SHA512 0504546af904ba9074143173e498c51977c9913733689d1a8d22357e957b4311a62b177c180150f1b8a51986e4669935973f25f3840e39710fe3c167938206a4
SSDEEP 1536:uOPffSTfV5jJcuowkQU2+breKc2ANFDPIsjt:OLYct
TLSH
T15373FC362B7DCC41B6921CA46496FB8428772E7C3C68FD0892AC374D66757660C0F9AF
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/dealply.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 8854c7a980c5489d1dd6bec436369c14d1264e2f04e3d46a5d78ac9a875629c6
MD5 caaca3d3783173998fbb157fdd07a846
SHA1 92e8b1d702c8b8411a33f9497f8bfba72628522d
SHA512 d77915dc3b7f3182a64625f778e921716dbe0226fb90a425c685fd95c07696872b46b199b42835b77ed1eb6bf602fc4f8e2f0de2f1b8e25b00d07e8c33c8aec8
SSDEEP 24576:tKkd4HgrpbPhyiE4gIMcXFKW3O+GxodwJz:QBHgrpbcizcc15LGxo2x
TLSH
T17B15236712C09877C592B8F0D19AC2BE9FB97EA62A04540F77313F6E0A35583CD5963C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

da:cc:5d:e2:39:53:70:6f:9a:76:ba:5e:6d:a8:d2:6d:33:65:43:12

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Chains

Nov 6, 2011

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Serial Number

62:38:e7:e7:5d:4e:91:3e:ac:a7:a1:a3:f8:1b:cc:27

Issuer

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2011 - Jul 6, 2012

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
TLSH
T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 5e5303e06d8457a10b294fafa628e115b403569703a1ae80c416916c5ed9b08b
MD5 501650d47110eec0b72b7d73b41478f7
SHA1 eaec655c4a6d175cf152a8d533b1cf611e445c01
SHA512 0615b3d50d57f3248f66cb2532fb43c494e5c9e97d1ea288bcd74d935cf0baa9f7fea5479418a34fc3532f7fbc0692376183c36bcd31dfe84ced42da853af7d6
SSDEEP 768:oCeqBQGwr4MINuUFp6dgUL5f9sC63x2mM6TyTFIK:PeqBQgMgNbASPtTyTSK
TLSH
T120033917F6E2C030F831CBB46C38A124EA3B3D703DA4157BA7B5595D9CA56826CD83A7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

33064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

73B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsisdt.dll

IMPHASH aa911a57ef69e33e93666ad699a8d7be
SHA256 2261027077f23c8dba6b72af28862832aaa059740d0f5634b46cabb14326dd10
MD5 df4795dfabe3bc9278a73d496cc4b40d
SHA1 2648ded47e29ecf3e1a1cc20c631e83caf566897
SHA512 013d9712c3d699a7f41ab3e55931c9abb421fb2eda3542da5a4831ad2f073a1b0643120cc78147db0bfcd01df98ade3045ecb2f1e252fff1dc40be845e5ae303
SSDEEP 24:etGSyYi61xyMmuEwv61OVXOwr+t5blXgO8ELnD3TPrHjf7Xz5CY1aeBEW58q6TvK:6y2xyNuEwWwU5blmPeB958xTvT7L/
TLSH
T143C16366BB1848F2C0AC4D73126E586283BDE00C25ECE05D9FC10C266CA99567FB8A4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

52B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

576B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

144B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

76B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

$PLUGINSDIR/registry.dll

IMPHASH 421a02aae559045e04759aae146087eb
SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
MD5 2b7007ed0262ca02ef69d8990815cbeb
SHA1 2eabe4f755213666dbbbde024a5235ddde02b47f
SHA512 aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
SSDEEP 384:W2mvyNjH3rPnAZ4wu2QbnC7qB7PnrvScaeYA4CIDEge/QqL2AQ:/75w/OfrzB4CUxuQfA
TLSH
T1FCB26B82B1D1E973D09F0479AB993F15E3EFAD507670EC5300667AC732A0AA2C769713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/version.dll

SHA256 3eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
MD5 ebc5bb904cdac1c67ada3fa733229966
SHA1 3c6abfa0ddef7f3289f38326077a5041389b15d2
SHA512 fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
SSDEEP 96:nPtMckE1e91BopVyXwUhn3f1I0vOKeoqO4d8QvS9:n1MMuOUhdI0c04yV9
TLSH
T115C14DD52E7C5673E2F1433742CF8B983632909000B81A5B5779425ABD8A3E1416B77C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

44528

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

out.upx

SHA256 12a0c008b207d7e546e8f7a4030b25a999d745dc15a174b4d305763a4df6ab12
MD5 aa05c546875238a55566cc34e4ab55be
SHA1 8a8e0b2343036a9ed24bb8480edd4c262808e2e4
SHA512 52d1f35ae2e810f6c4ddb1f0b4a0889c658d1bdac33cf69b6700a1d4f94d9b040900b52513fc66916094198f003ef94be299e115346b28778fa545b31a6cdad7
SSDEEP 192:nro24pvm8S8dNr0Q+7y5cdFx8Jf/DHFKSr9C:SPnV1Z55JHDHrk
TLSH
T1F1120A01BD92E872C35588FA8CAFC284317F31026EA565127DDB1BDD4C2EB61F71E406
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

454B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome.manifest

SHA256 d1d2db094e371eb1a203435b32baae4dcf7c95145f41bc65f1104da5ca9e90e3
MD5 0f9020f034afe587a42a2ddf8c094b15
SHA1 5c5d2780ceef746aaf641097bae792aa44e433f9
SHA512 385fd7fec234dcf32cd6fc0c4be4d801c4c2100d849bb9b0e3c72e6733d0fa383aff063e7689a29967e6d5d88b8f8a2abe578f92e0530ea523aed7558a1face9
TLSH
T1A4C048B6130FA3DD7BA5CFC18002341B3EA0A690E4C95012B5AA128EA1C23C259CCB9A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/dealply.xul

SHA256 2bc803a5a32f11c013db0bd1c2496e33654337d02e07e9be6852549ddd1e2b86
MD5 de8164cf47bc29313ced645b3b48d34a
SHA1 9d92140eddac2ece093a4191f70f42c0e5ee133d
SHA512 8cb071ffcc846551d54c9a7ebe8e7f303a01064cf3bd658bdcd804f1799f55e4e5b326e326289a4b6150959668a8994d92321d82f54cd48b0e886f74e35b9a8f
TLSH
T1FCF0ACEB386AC234DD80184AF071C5A8EA71B3275391D4A4B2DCC977A009FE117683D4
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/images/dealplyIcon32.png

SHA256 c53217537e9e14f8ecf9f3a61d59ab8d128f174d95baa495558315e62e881455
MD5 3304097d8169f75d04f8005cdb063f2b
SHA1 4dcc87b3164689c4996754c124ad6ec735c0eb5b
SHA512 7343047a4dc43afe65b0852d1e3a2a502c653bb105ac2a759f013c38979b837487a135dbc2bb0dd08a4b985d8398d40001f4cb3352f2064d156b138a307f63a2
TLSH
T164312BB9B8C75CED84A12098C1D2E93C14A307694F5B73365D0F5EBA3A715045CA2CFC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js

SHA256 4fb8d38e19a950ea24098dfded5f46bee24581a0ddd20e759bd76c40c358a653
MD5 0539649dfb977fcb9a6f9818524ee150
SHA1 5754dda1453246119b3c130b70a7c61a90c9ee0c
SHA512 4cca23a2ee74bac095e217aa5151368f230a08119f51f5a0561c5b03d6ad47132e131cf82dc05709527de6b0a8bcd9c7c5087230749af0aa52d3ce8c5dcb134c
TLSH
T12FB01100CE8B2B8000388A03CA088003EBA2A2F0B2E8B02022C808038203AAAC0CB082
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/install.rdf

SHA256 ac5239adb54737ac818d99f8d288cfb8bd2363d257536900d54bd2baf9051cf8
MD5 8041603a9efc126ec49ccea94351b524
SHA1 169a36baeb32017a49fe84561429781507c4c434
SHA512 071822031edde566323688f5272fde73a7caffe5622bbe66f109997f3e07d094dd6a9f310d58fdb7f23c5722e4622673b85c823fd177d78a1c4a6a03efea9b35
TLSH
T10111970689C2E99061B3CB427C705906FB3023ABA0419084F98D5C078FBC2DB41EB7CA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DealPly.crx

SHA256 6920c76aa400e8ebddf112ffd953b01e857716f9bacda66a9edf6aa3f8049c7a
MD5 90064c48c6aa33e8dd9c20c3fbfabf6d
SHA1 1ab7c2bbbd8877b84d0c9c96904b7cf24a0f3898
SHA512 0a1ab4c04f099165cc2e856db46c3a13a5dfd8b595eb30a6d3e7e30a05639c586f3ce9fe113a52e2fac993398f270b55ed9f6f9f274fa8333aecc5907753cef9
SSDEEP 384:rAromIiaK6E6PN73lC5ujCOFltGjP43M9BGGfKPd9:spI1K61tEYCOlGD4CBGeyd9
TLSH
T1FC72D0E3BC23C9E7CC230BB406DDE3451D372B649565119F0F9A21223B6439873B6326
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

background.html

SHA256 67cb79577f26d6632168145a2b7b4d3ad6b46247f0244a9f6f25b45fceaeddc3
MD5 b283e8f75dcc4349e1d88e72358ea3b8
SHA1 b017c920e90daeae106ad152ecfb42a1d8d203a7
SHA512 c714233bc1d7ae252695d7b56213523525beb4b8e198b11377213647418a76824e89c49dd75b82beb0fa205646ca458ba7f14d42fc350d6836a6921aa9524402
TLSH
T16F2195CCC7CD061350E41468C8A700C4527DB7B23B988CBA3CAAC02A68BC26B825C3B6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

images/dealplyIcon128.png

SHA256 4071fb493e583287253c24266737b0c9cfb05e902330c9f57e98285c052cc8fd
MD5 f7350f4155953a7ede975bf821aaba58
SHA1 c849540d01f85896723f3bce088a5c947835ef92
SHA512 d5d09621f71fec395c789dd1f0f61d0dcf72e42d99fd81e80af6cb6fc8924d6f36797087d01827cbc4c9a0987541ba098d1d9cc21fa2d61d091ca5bbf39433fc
SSDEEP 192:enmIR0L0doD6Uh2HS6pPN0C+U3lC5ujBJCOFltUDet4tJv4IcbioM9B5:emIiaK6E6PN73lC5ujCOFltGjP43M9B5
TLSH
T1BD32BFD3BC33CDE58C1947840ACAF3282E3779B6553E45AB0ED25122072926D72B4627
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

images/dealplyIcon16.png

SHA256 44ea4d30db57a2936662ecb00d65caa10f7fd120d996efb1962ba58d0e4e0fa2
MD5 9b1ca93a2afa70e7b8ea9c6535972d85
SHA1 12448019c4569e9919e5ddd67f6d7427e4957fe5
SHA512 f1752e557df1d3621ad2321829e07d1a629ccaa6ba546718d7debe8386611bcc45966e9670cb835b4a7113461c126459bf8ac4f6bd195da709efa77f0f86b92d
TLSH
T10B1196A1E0C4E71E9C47259804DCFC409D22035D0C26840C5FAB824BE8CDB58B8A6714
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

images/dealplyIcon48.png

SHA256 2aa2b44abab7be57ba055e92520cda66ff5e09f1d835cb0a9c0caacd3809b56c
MD5 ca3b59c0dcb621f53d8f8394b57554c1
SHA1 e98dd9c034e4dcd01c6f60d3bfff863ebdea78da
SHA512 dd5e0f764ace8ded76725de3994d41786ce2f46ff40fbc8f53256f46d9d44585a8f32621da2e2502569953bae2406c577fd629bc35d0d400fd5d245c40b719fd
TLSH
T107516D297E798177F0B3EC08526585CA086B3D41D6D123B50A0A2E3D7BE419103C7BB5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

manifest.json

SHA256 70b60225d998fc640562c0938f36809896c931d017f36dcba0e25f0650b7c12e
MD5 5792f0de07821bb62c2f791c61f21904
SHA1 0b68d0bbca2363ae19d2d453bfe2823091f626a5
SHA512 11f128e18ccabf2a9b122b20738096baba6d2cfffdf7869de88252ea78be2b15de3e75aee3b06733703a0657c644a7c7b05b0ecbe949f957cd09abee998fa16f
TLSH
T185F0A6DB9460D2E720A89A6839F42E43FA0243AF60C08C1B737DE044CF7A0674476388
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

DealPlyIE.dll

IMPHASH d126535b29e8ab83a18011d1747e9751
SHA256 c28c50700c5560d834b058e0ca816e1ccd003e77fb58777f55cd4b9d015f9013
MD5 53905cd4461961f341c0b41d4d0ec02b
SHA1 aa9d6284707f25a4ad35336ed6c131ac56f175aa
SHA512 84da2711dbeed65043150ed5afc23a6482ebb13e080a2e311f687ede136751c5f6e5fbeb947c0380e8b29ac64cb5741226a8ec23d69cd340ed8070fd48177248
SSDEEP 1536:FXEdWDidDMsRs/sbOyDsxbU3Q+HUWY9f5YJ+/W5P:F0iX/AyS3HHi9f5YJ+yP
TLSH
T18F837B217AD0C032C0AA59305979C6602F7DB931DFF4C88B7F1A066D5E617D0B63A3AB
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

bc:68:ed:11:18:c5:a6:b9:c6:5d:da:bb:2d:a9:f9:60:7b:ea:24:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Chains

Aug 9, 2011

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

73:57:8c:71:6d:b3:95:53:13:7d:f3:09:73:18:ab:fe

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 27, 2011 - May 30, 2020

Subject

CN=DealPly Technologies Ltd,O=DealPly Technologies Ltd,POSTALCODE=69104,STREET=13 Barth St.,L=Tel Aviv,ST=Israel,C=IL

Serial Number

62:38:e7:e7:5d:4e:91:3e:ac:a7:a1:a3:f8:1b:cc:27

Issuer

CN=COMODO Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 7, 2011 - Jul 6, 2012

Minor OS version

0

Major OS version

5

Entry point

9461

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\WebVolcano\dealply\dealdo.ie\output\DealPlyIE.pdb

kernel32

DisableThreadLibraryCalls GetModuleFileNameW GetSystemTime IsBadWritePtr InterlockedDecrement InterlockedIncrement FlushFileBuffers CloseHandle GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle GetModuleFileNameA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetLastError HeapFree HeapAlloc RaiseException GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep ExitProcess SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LoadLibraryA LeaveCriticalSection EnterCriticalSection GetLocaleInfoA VirtualAlloc HeapReAlloc RtlUnwind HeapSize SetFilePointer GetConsoleCP GetConsoleMode MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA

advapi32

RegQueryValueExW RegSetValueExW RegDeleteKeyW RegCreateKeyExW RegCloseKey RegOpenKeyExW

oleaut32

VariantClear SysAllocString VariantInit

icon.ico

SHA256 e174c37a6546f3561fea64030a69d3be67fbddaf55a1a5f84be2d1a8e1106d2d
MD5 d6aa5d65f6d4cf289e76c8f36fd2e974
SHA1 2cf343e4f01da2c3ca5a82ef8c0540847a3b7564
SHA512 5d854473a551590e3e3631d89e0d5ede8cf8fd82127f1894125dc72b0a3b48bd31124ead9899118df05e01abc5f35c9982aacdacdd68917b98e668b542155740
SSDEEP 96:OeczySceNgWKoxsfhtHx0Xw92mWE0FqCDnYPStxnDGvgXfUD9eNvJnH4Bc0C3vU2:OHF9nxSeY2jEMqInY9kyeNBYBk3+x0
TLSH
T18C623FA23092D020D59436F6E921C8DA16563E25A80C2A8B30BC3F5F4B772A3DDB756C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

uninst.exe.nsis

SHA256 4ce623d67bdb8a7403bef9d0c2daf503f5aec2e86e7a74eeafde76c60a7e3d88
MD5 5926970c21d90c720657fcd4282fc033
SHA1 aa3ae56b6293a0168455ce21a70dfbd769c2072c
SHA512 6e5dacde913f61e5f4a39ab4fc6ee0b11c5bbfe7eaa2c32af2988c574a5f93612245dd9aee665942add6579e089c468addfdf13f703097155f10d4fa02cc4d7d
SSDEEP 768:ElaHJLinHLnzFpdcwGu27hdpE2jNFw8NzFzRj9rVXEq9N0HqgzHSNOY7:El2iHNcbu27LK2pFw8NRDVXES8qcy4k
TLSH
T10FE2F26365ACF89B53D3D442C9C14214BA559E316D3EF8BAEBAAA6613F36C121C4C3D0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

vn-zugo.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 a2efbc9b9a4d99cf60bd3e3b631dbe6116f31c15ccefc9f28ba3c95404afd63f
MD5 6ee75d20b907780781e90fa97897b8ed
SHA1 03c0ce29326ceef11b237c91ca0922f3dc6ac0b4
SHA512 36eb2dc03ec76756a92aca72b3827105344b4ee2b179b4abf9432828505ee6d151df6959b2280d4086952ebefa4b273f83ab25ae1e2299bb4c3ef859483f1e08
SSDEEP 12288:CU1qWMBibgTEX4MXAoQu7uIpKfHB/mY+oCIPR08gu+8uRj2d4Gp57m63OM0u:CIqWeibgoIaUCoh+/ZyudGp5/3JB
TLSH
T139F42343BBC090A3F08F5B31DACBD939EA7ADD1046484523B3D7AD9BB8F2F422914559
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

01:39:64:b1:ba:69:31:dc:37:56:b3:94:68:48:ee:d7:5a:03:59:42

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Chains

Oct 25, 2011

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 3113e12e0486a5a5251713b60422a7d6
SHA256 8f62633831a326174f05e89503e42a493aa834fa6d7ba7138d9d57ac5873512d
MD5 de2b06d8abcd4a1d3330e415ce638a6a
SHA1 2f1bf738915b288530dedb861f4ea4f60069a91f
SHA512 8dbc0edb71d6acc327418270b33d5627d7940ce406e54152af9f6c8f6d90c7239aa647a0e1f4769d0aa8bd3e38d60643e6356ff7a5ccf7dc44c5617f72277b70
SSDEEP 96:J1szPlsFYmIGExrjwIqiwZePAYyU76b+4d:Juztr+8wzg7xN4
TLSH
T1AB928232038452F3E0C4033331C676C7AAFB5468A3AF085F9A43566918912ABED7CB43
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5530

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Math.dll

IMPHASH c1eddc2d743572429fa0b1a79b7ac0fe
SHA256 0598f7d83db44929b7170c1285457b52b4281185f63ced102e709bf065f10d67
MD5 b140459077c7c39be4bef249c2f84535
SHA1 c56498241c2ddafb01961596da16d08d1b11cd35
SHA512 fbcb19a951d96a216d73b6b3e005338bbb6e11332c6cc8c3f179ccd420b4db0e5682dc4245bd120dcb67bc70960eab368e74c68c7c165a485a12a7d0d8a00328
SSDEEP 1536:0P43WZ4Ql60gam+2MwRmPeqFVHbQH0ZZ1Iet:0wU609VMH0T/t
TLSH
T184639E3375D540F2D19E40B514A55F2BDF7DA6248BE24DD34F6628CAAE20EE1A233707
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17950

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 4c4d85eb9725fc7fade03467990e3dd9671c29a7870c97e69babc2cb3c9adef9
MD5 2f94245152dbd233e248909f9c01c578
SHA1 ab4e5879c001b36a2f9ff214946599fd015edda9
SHA512 f92830de27d6663be5e0df9e32cd88732bc7ee93b14c1ded65258c325d22436400801aff1124f40400c6c3b3c16e71deb08436714716f3888d13a8a6b6a32231
SSDEEP 384:vBCwUYeQ8geEQyhUtXlcgCHe8DSMk8/UhU7ya4L+0Ac9khYLMkIX0+GvRgbJ1:owUEpet1cgCHe8DNN/UhUua4L
TLSH
T11D9219016F6625F7D7F649327428331386AEAE71246064836BE72ECE186A647FB35703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/jsonparser.dll

IMPHASH 9477ce594d6aa3189ce13a8753710458
SHA256 7affb86cc94deba6b61a7e85337264ef8e19ef6b8a83904e22bafecbc4e1bed2
MD5 2067be2244a8a8d6d6229537076a4830
SHA1 15a27838b7d791d19d4e1e2566b3eb94938c08e9
SHA512 42a2afd0dc4f0128231fbbf3b428a29bc20ca55f0f36ed02056666b8b6bb5116b409142fd5609528fc323b9987681494803dff492824bc322b94d08d370603a2
SSDEEP 384:/iPnzsAzMhAEDKha6zmoh7ja939CH9aR5M+SKseGIJGVHHCldw9t+:/iPYAzMhAEsVj0NNHseGIgHiUt+
TLSH
T13BE24C07679405B2E65A21F332A02F3B8FBD6891B8906133CBA35E640E37761E77944F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17751

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/md5dll.dll

IMPHASH e57536e0d3500471d52df7cea0d65a39
SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
MD5 a7d710e78711d5ab90e4792763241754
SHA1 f31cecd926c5d497aba163a17b75975ec34beb13
SHA512 f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
SSDEEP 96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
TLSH
T145F1E722A3E8135DF1AB0F71AEE371625B357D656B23E12D1B00024B54707E9DC3271A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nshist.dll

IMPHASH 5f100c36811a4c587bc08276d7725e60
SHA256 77f38240d729758f04fbd6ac00dc638e99ba27c42fa48200c99f51449e245343
MD5 56bf72527ae93d35cd8f8778ad29902b
SHA1 3248a7ca75a3c2e715a13b455ccc5d45e04cf9b9
SHA512 c8ea0445bb83bb67dffa85b167fcc9b6ea874493442db5707e939ee0f2864a0d464ee605de486febffc27b60cd3c35a91302f226f6c4f13186119687a7e6000e
SSDEEP 384:Rb8/5X+ZjXpv4jNfoOZdd5P79dHwvwXTnxsEVRhCSkX4vJtgJ4LxvI5PMC3vlhw:ecOBxTTBdHwvwXtsQRhCX4vG4RIKKw
TLSH
T1D8036D9357C204F0E60D19B4B0B5F73BA97A63181B9182D3A727DEE51C672E1E63C24B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

fc:90:9d:2e:fd:0c:8e:c0:8e:57:6c:72:c4:76:c7:2f:00:37:e6:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Chains

Sep 20, 2011

CN=Zugo Ltd,O=Zugo Ltd,POSTALCODE=JE4 9NU,STREET=37 Broad St.+STREET=1st Floor+STREET=PO Box 36,L=St Helier,ST=Jersey,C=JE

Minor OS version

0

Major OS version

4

Entry point

19891

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
TLSH
T188038EA392C146FBC5F8843931DA6E1D6A9EFC301BC16103CB2DBDA52D153967A642CF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/sqlwrap.dll

IMPHASH fdc6ee00ab15ae25a28615ceaa6f4284
SHA256 35fd84a44cbbeda4ee7a7e40554c656a21506346862aa7af99ce74930522b20c
MD5 56bb18722f8e42a53d7d4ea6a09e520a
SHA1 7ccc0fa410cafec0a790e0c611087e1f61e8d7eb
SHA512 cee572a6ce1d1551da3e4efe7c5fa7a76ad4eeaccc583d856a350f24d2a3f9e8dc39fe885ce9aa9a696a24dda960ed920fdfbd97d7a3e7d327c1b0fb34ce691c
SSDEEP 96:2zCgCtUTDB8h8+rTjT90eB/DlAvSioMRwLCVD4B9:QCgft07ivOLCVDW9
TLSH
T14492E737B28305F1F3D02EB7356160E52BA7E02587A45427CF935A862C71D13FAB9A0B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/timepro.dll

IMPHASH 2187c9e78816febf7a90a23c7c7d6940
SHA256 c1ed8c398108dc56fbb6fd6797c3c9df59447e2a2f198b72a45058124971b09c
MD5 009dbbdd1ef470dd752c2b73835da3e7
SHA1 f97da6556b24302df8201a092eaa32a80d49064b
SHA512 dbffa0eb830b292e5550eb3f3cfce90f881282652afb0463672ece7eb0946c34a8f75c4852f77b1db3604f0f346d0ed9d9babbad40b41de109e9f5119d555ec5
SSDEEP 48:iPDeRFIHpvCelHXKvDRnEungRnEYngia6JsRhdt3Ft5GoO1JqN1:kfhlRKdnEungRnEYngia5X3Ft5GF1J
TLSH
T1AA92846B52B619F4E04D4B334BA354E766BBB43083B4211B4E9E2786152135FEB6C453
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5317

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$R0/AskSearchAsst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 6e314a62cb2e33d5d5df9720ad8c0b5b466c2cc4a6fd12eeb5b633b8c72df3ba
MD5 28387db3bfa8ed7f1ba742b02b0c09d8
SHA1 517e2757282999db9cf823c2d7dedfa07342d5ad
SHA512 b6ea8554e6c8c614fe065e9915cfe0a8832b2f55bc30906f2ad8151911c70fbc37f8e6f456897c0409e28f10338bbc545f529feb91b54821dd867f5c749b7767
SSDEEP 1536:upgpHzb9dZVX9fHMvG0D3XJjAyASrBYt/nPl1wuK+J/K4Xhf6tW1svQf93wpoebw:0gXdZt9P6D3XJT/tOt27dW1sIxm9bw
TLSH
T1A8B3BE4773C0CCA6D9910E3549AAE3BAD77AADC50D66050723743F6FFDB22938E05249
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

0e:16:5a:d7:ea:fe:05:11:f9:20:a5:3c:93:ef:0d:b6:3a:30:f3:03

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Chains

Jan 19, 2010

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Ask.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Distribution,O=Ask.com,L=Oakland,ST=California,C=US

Serial Number

28:6f:8a:30:e2:ea:c6:96:5b:93:6f:82:6a:05:30:5d

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 17, 2008 - Jun 17, 2011

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
TLSH
T172622A11778888F3DB92013EB4533707AF9D5126B4929ED2CA271FC66D2B09D3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
TLSH
T10881C5436B102FBBC0880630358E7D1E64FA49A8536E00BFD786A98E3DD62D4F170367
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 7d099352c82612ab27ddfd7310c1aa049b58128fb04ea6ea55816a40a6f6487b
MD5 1e8e11f465afdabe97f529705786b368
SHA1 ea42bed65df6618c5f5648567d81f3935e70a2a0
SHA512 16566a8c1738e26962139aae893629098dc759e4ac87df3e8eb9819df4e0e422421836bb1e4240377e00fb2f4408ce40f40eee413d0f6dd2f3a4e27a52d49a0b
TLSH
T1FB81857B93E50DF3D0A447BB00D71CE70226DC701769411E8D472A8924E672BFE2EB16
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/md5dll.dll

IMPHASH e57536e0d3500471d52df7cea0d65a39
SHA256 9b05dd603f13c196f3f21c43f48834208fed2294f7090fcd1334931014611fb2
MD5 a7d710e78711d5ab90e4792763241754
SHA1 f31cecd926c5d497aba163a17b75975ec34beb13
SHA512 f0ca2d6f9a8aeac84ef8b051154a041adffc46e3e9aced142e9c7bf5f7272b047e1db421d38cb2d9182d7442bee3dd806618b019ec042a23ae0e71671d2943c0
SSDEEP 96:YV2qpbvYSflug0Dvxn6GuKM9sh1gdrN9+oB7FT9WibOoBZcko5N/:Yt5lugRK8hlvbwkKV
TLSH
T145F1E722A3E8135DF1AB0F71AEE371625B357D656B23E12D1B00024B54707E9DC3271A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$_30_/searchplugins/ask.uk.xml

SHA256 ec49ea4d9aed428087d2e981715569649f49c0f7c191afbe3b611e0604f01889
MD5 e413d406eed738d72031878548022205
SHA1 7e530237857bfa78f3119e115ca3ff77fa79518a
SHA512 0409c058c7155e3241e37e26ab495420780c9051073110015fa712b2c253104ded0263c5a6fa57b84f9c659e4aabc1f022abe94cd92a1e833a1d1544ecd320ed
TLSH
T1B831072C4953DC1ACC3A053195E4D3C0AE38D69C69C03145F798A92BBC007CD28AD78E
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$R0/AskSearchAsst.ini

SHA256 e28cfebe18147a1ed846bfec1092f62ee191f2c6ce9f3795715ddc6f1fd2c30a
MD5 049aab81565f4118ff1843eb17989243
SHA1 2ba361f66370aa143596bf7a865bdfaac8ff8a36
SHA512 24892a98e6e114d9daa4e20b2ee2b36790888acabc4a4fb6e23d1554563c9d3e843f88462be029f0db568cb2f8397534d8df795b21873f0c1dc1c390f4586a40
TLSH
T1ADD0A762102B541F9077338034F108C05FD51CB25B13E02E6559A3912B0ACA9260A134
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$R0/ask.ico

SHA256 be31079e9eada076773dae275fb84ff7c113fac6bf11b6fc59b8a4fafa6e9f12
MD5 896b97c92f6c3215195eaf19eb71ce7e
SHA1 ef41f894b3ecd1e7225371cc5c4e532f43660f26
SHA512 1115c6bf1fca5a6a44b00afd21651710df9665e6811d9ccd55e546dbc18d4b333f76e076a417f0e123c7a46e09412e7b570a65ba85302e8618f6ee127f00db23
SSDEEP 192:8OE/xSAoOXN0VE/hOaAY8viZo/Ao+i2EzpPdxucJTNkA4MGtx4ip+w83:Z4XNTr0iaIo+ap9v7GTz+wo
TLSH
T164B292073388CC94D5A15ABCDE8AD7F9535C9C428C26568772B03F7FFABA9530C0A649
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$R0/bing-zugo.xml

SHA256 40af6e45352dbc8f0dc87d52870988f0fb4d240587160887823381d002a5b74b
MD5 c93afb79e9f45aad1cd4a6ebdea3e15b
SHA1 eb7f611b61a5f87a8a518156e61c8cbf6c789e06
SHA512 24863251cc1742c7b49d472528493cb84d1435043d28afceead6b38592c5a53f61880c181a7cb4e143905375f45876ebf2381dc6c42c18e0f886df498ba4821f
TLSH
T16F31B1F16CEAB4167BA90CC148ACA45C5F21019B56468609B4C77433DFCC1E1FC9ED68
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$R0/yahoo-zugo.xml

SHA256 4f06e80535e5d4be2a48989f053e8b22eeaa96d5cd53d2b361d29e1fe42de168
MD5 c77a4c9fb3064e0a4d2e3635f109e1f2
SHA1 8e80512c31989873dbce93df50c19bd9987891b0
SHA512 3b9a3ae430f012fd293a1864f262abda1b44fdb72a750d4a00dad50dae6b2d91c6622aaa0237143ee7b645479b7ea4c3adca261444dd9f391424ab848691b857
TLSH
T12F112FB498B5EC2207B589130EE0A88CCD301B8FC35095AAF9D40F605F5CA46EC6FA3C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$LOCALAPPDATA/facemoods.bmp

SHA256 e75df95db9abd6dce1694d7cb123de6b934606e2c0a09944b962d566ebf74147
MD5 6015991f47dafeb69223ab1bbce46321
SHA1 58b2a90385be4bd340839e58e56c7025f73a4c06
SHA512 de6918527c364506cce4a62e3ab3ad8b7ab9170fd66b4bdc6526b74e5cbb70cd995ed103520aa00f68960d78fc90cd415ac156070cc253044dec75bb2fb45d95
SSDEEP 1536:FqsfJCIOZZstUtDHYhGSb5eAIkPjLr/q5Z1v:MICzYfuHR
TLSH
T19F7360920883C6A8B6762B30D7212D49C2776EF96EBBA17E6804F1E6DF73CC51674350
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/facemoods.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 065812a7db221fdbda974d2c9e9d3a26507d17fcb433cae77d78a21c843a8bf8
MD5 5f856a489cc99dff30713f9fdab715df
SHA1 7037878b2db6d2a611613c21c693458d3cfc4fc9
SHA512 6e01128d4ff6a0aab186ddd6beaefc6756ec8b4c84ef13a0acb786166b9de6711cc7e622135dcb1fb62b2bd8cbd56a2e0bd31e14c5a94b9805908cd3a13d8226
SSDEEP 24576:R30p4dk4yO1bzppgJLo01dvXjyoLTkyXN3VOBj7mEsLS:up4tNCLbdzLTpXDOR7ELS
TLSH
T1BB4522869876D463CBD1C3BA88B2C66FDB31CD4452825EC61ADEF9761E72E02DB31170
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

71:13:03:ad:0f:c9:3a:18:e5:c3:ad:15:7e:38:ab:74:1e:8d:63:5f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Nov 6, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/Local Storage/chrome-extension_ihflimipbcaljfnojhhknppphnnciiif_0.localstorage

SHA256 2af3e0f282942a6a94d441acd9fe930fe2401fbdfbc67a1e44f490fe914afe7d
MD5 97471c285c1afe9b7a2604b573ea4dcc
SHA1 722841633891847a5636d0ef48799e3b0e431c91
SHA512 eb33ef015ac8ff79fc13dcc0bb62629d0c32fef36b7997f01117616c403864bf3419d0d8d5aa0b16939b26e86f831bcacf60da42a239b6d199880ce958da4374
TLSH
T18551269278DA6128E977B6B9BFF8D094BF4271B2BE36CC0D025611CA4C023527FA1735
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ExtractDLLEx.dll

IMPHASH bab48790663c56c456d63bc3e045f161
SHA256 73acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
MD5 ba4063f437abb349aa9120e9c320c467
SHA1 b045d785f6041e25d6be031ae2af4d4504e87b12
SHA512 48a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
SSDEEP 96:lyEPmi/06iLbX8SIP59L1MmqPbgkk/eWKCHGojGYYIF/ggiomsTeZUzI:lyEPmymbMbPZOz+/eWJmoUItiopTeZ
TLSH
T1F7F1B63699C08D75E1510CF067E6B31EDBBAC0F8AB160637A79D08C56C453EABF11257
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
TLSH
T1AD824C92AF8065F3E336993DB09923635FA9BB716480AC4757730F8CA522705EE38347
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Processes.dll

IMPHASH eaa5f91829171a65db414b9e64ec9548
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
TLSH
T1F3438D147650C073D10A6534506AC3B15E7E7D3226F9C58BBF9A0B7D8F612E2F23A39A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

7219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
TLSH
T1E181857B92E50DF3D0A447BB00D71CE70226DC701769411E89472A8924E572BFE2EB06
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/chrmPref.dll

IMPHASH 93bde92aa23094d5545e87c4d138f2ba
SHA256 a87ec5894c667c5eb22201172792027a525a375a9e6468aa4612ccf6875b1112
MD5 e02590b95a6be07cea5c5f3daf66e775
SHA1 28b6350c43d3804f69faa5f48cab70e229dd182a
SHA512 30e3abdeb2fa3c2e1bdc94e1e2b9f7fa9c85ff3d10198166e99e66a92a0ae4d62871a621eab069b1dfe2a99a7a4d457a494d91c811f1bd93c51f120f5ff692b5
SSDEEP 3072:0DNlF2bX2rBTxNwIjCRMOwt+kG2Dkq150yurKNN535xzFHcu:0DNlF24BmXH2f50L4ji
TLSH
T1E2F39E12B2A2C172DB8F11BD0CB92B096BBAE5944FF04ED7AB241E4D9A353D15C37247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

58477

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalFree lstrcpyA SetEnvironmentVariableA InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA RaiseException InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA WideCharToMultiByte MultiByteToWideChar GetLastError GetProcAddress GetCurrentThreadId WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA FreeLibrary LoadLibraryA CreateFileA InterlockedIncrement InterlockedDecrement GetProcessHeap GetLocaleInfoW IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID ReadFile ExitProcess RtlUnwind HeapFree HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue GetModuleHandleA LeaveCriticalSection EnterCriticalSection SetUnhandledExceptionFilter GetOEMCP GetCPInfo HeapDestroy HeapCreate VirtualFree HeapReAlloc IsBadWritePtr WriteFile FlushFileBuffers SetFilePointer TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW UnhandledExceptionFilter IsBadReadPtr IsBadCodePtr LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA TranslateMessage

$PLUGINSDIR/modern-header.bmp

SHA256 9ca35a9dbdd4d596bcb7a3344fb0d7e7a8adbcb8fd11122484abbd5b53d8eb20
MD5 6ca928e60a9a3bf068f2380bdc9b44d8
SHA1 a03b5daf578a5ed7248c99e8e6a8814f4756782b
SHA512 fbc5e1397df6e24027fe6cea61c35c8e2874421ddf7ba1868972eb0a2a6d935087c78b2a424c2a1584e4444964f11ba2ee11ef67beff6c52e64fd1ba71b226c0
SSDEEP 768:O0m/4YIIIyI2IRQICIyIdIKIgIwI+AG9kAUIJ6XI3IJIFIHIrIYIDIpIAIAIAIc:O0zYIIIyI2ImICIyIdIKIgIwI1G9V6Xa
TLSH
T1BEC2C7F8D770D40ED6E46A5C292E3E84B8A0EC4F39817088993D76675CB28B1E81FD5D
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/Mozilla Firefox/searchplugins/fcmdSrch.xml

SHA256 ecf12f08b7aba181eba8de39fc16ea02ae9d8fbe1a082672681287fa8919012d
MD5 7ae4c660f70d7ae92e9899c676d66c6d
SHA1 cb4b1f481a92324f410f1675c4f5452dc5a66b3b
SHA512 b02f3835db16f32005892632529487a1b04bc5d778b046da59b88355634b23f7086953b2dd3ffaa79df19eed3d83b5473b61b0e3cd895685c17ae8ceafe01221
TLSH
T14A4178381A27AD1F17A3883234B0A145DCF6064FDA44F5A5F9C11C2BF544BC698E62BD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_34_/extensions/[email protected]/chrome.manifest

SHA256 43ab7764aaa9c7edc9eaec626832bbfda1dad0a234a49227c6611c34880aef57
MD5 edfe1d268ee42f8e4cb0ea2d57a88c2d
SHA1 8e3c934c51c319697030132eefdd1f55b6457fad
SHA512 0d4706f2662bbe2d882adabe99a5baa53f0b0b10cff1331bb06e88715e43d385232726b1ba4f8fcdb2e36276bad20aa7d625378b09c801084f1f8be0e662ab8d
TLSH
T158C09239A72F02883F2EE888A0B070607EA881048996E023B0CD408CF6C030146CC334
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_34_/extensions/[email protected]/components/FFHst.dll

IMPHASH 42265262b1570e7f94a9fb42ce88043e
SHA256 73f1c3bed7c14088ad837cf6468aecbdf37f8e9ca86faeb4fc7e5d79af071e09
MD5 4d858f32da07588f97a992cd083334ca
SHA1 75572a0793acb41e977c8ae0adc290f5b23da946
SHA512 37bb7b0ce98c2e345ce5508af2d7dbb30a85a2ce90d55887318105d71a88965445c2d1e7d7c129c400fd38435ea01bc72fac93e75770f01a8a114ad35e279fb4
SSDEEP 6144:XyWoZ5OaHK/HHWAV4/yZj8sNkWS4P7voGfk:if5zHK/NVpwsNkWSAoGs
TLSH
T1B3847D23B3D2C5B5C58D017959BE6F4E17B8EE844F208AC3D7943E4BAF322D25936285
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

75:57:ed:00:83:5c:35:87:44:61:68:0e:da:cb:dd:0b:e6:25:24:46

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

62073

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetMemoryManager NS_CStringContainerInit2 NS_StringContainerInit2 NS_CStringGetMutableData NS_CStringGetData NS_StringCopy NS_CStringContainerInit NS_CStringCopy NS_CStringContainerFinish NS_CStringCloneData NS_CStringToUTF16 NS_StringSetDataRange NS_CStringSetDataRange NS_Alloc NS_GetServiceManager NS_GetComponentManager NS_UTF16ToCString NS_StringGetMutableData NS_StringContainerFinish NS_StringContainerInit NS_StringGetData NS_StringSetData

kernel32

InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale GetVersionExA MultiByteToWideChar WideCharToMultiByte GetLastError lstrlenW lstrlenA GetVersion lstrcmpiA lstrcmpiW CompareStringA CompareStringW GetEnvironmentVariableA GetEnvironmentVariableW GetStringTypeExA GetStringTypeExW CreateFileA InitializeCriticalSection DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA DeleteFileA CloseHandle GetCurrentProcess FreeLibrary GetProcAddress LoadLibraryA GetFileSize CreateThread SetThreadPriority ResumeThread Sleep TerminateThread FindClose FindNextFileA FindFirstFileA RaiseException GetCommandLineA ReadFile SetEnvironmentVariableA WaitForMultipleObjects CreateEventA CreateMutexA CreateSemaphoreA PulseEvent ResetEvent GetLocaleInfoW GetTimeZoneInformation SetConsoleCtrlHandler IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetStringTypeW SetEvent ReleaseMutex ReleaseSemaphore WaitForSingleObject FileTimeToSystemTime InterlockedDecrement SetEndOfFile GetStringTypeA LCMapStringW LCMapStringA FlushFileBuffers SetFilePointer IsBadCodePtr IsBadReadPtr CreateDirectoryA GetCPInfo GetOEMCP SetStdHandle WriteFile GetTempFileNameA MoveFileExA GetTempPathA EnterCriticalSection LeaveCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap LocalFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind ExitProcess GetCurrentThreadId UnhandledExceptionFilter DuplicateHandle FatalAppExitA HeapCreate VirtualFree IsBadWritePtr GetModuleHandleA TerminateProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameA SetUnhandledExceptionFilter TlsAlloc SetLastError GetCurrentThread TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

CharLowerA PostThreadMessageA GetMessageA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA CharLowerW CharUpperA CharUpperW UnregisterClassA

advapi32

RegOpenKeyExA RegCloseKey OpenProcessToken RegQueryValueExA

shell32

SHGetSpecialFolderPathA SHGetFolderPathA

ole32

CoTaskMemFree StringFromGUID2 GetRunningObjectTable CreateItemMoniker OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString

oleaut32

VariantClear VariantCopy GetErrorInfo VariantChangeType SetErrorInfo BstrFromVector VarBstrCat SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen DispCallFunc VarBstrCmp CreateErrorInfo VariantInit SysStringByteLen

nspr4

PR_sscanf PR_AtomicIncrement PR_AtomicDecrement

shlwapi

PathRemoveFileSpecA PathRenameExtensionA PathFindExtensionA PathCanonicalizeA PathAddBackslashA PathFindFileNameA StrStrW StrToIntExA

Name

.text

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

48KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_34_/extensions/[email protected]/components/FFHst.xpt

SHA256 5ca47fcca69bbe5538dbe464b57793aa0cd43410bedbc5a5ec34f52a3d6b683f
MD5 7b5b54d8cdf80a11234a81fed704647b
SHA1 6174bd947e18056633b74551c4b330b824022058
SHA512 64102bf7911dd3e5a38ff9bf86231faf9c4f957d7a77fc706fd1f709738ac30b6a715aa1ddb0f4dd3691a70be85e103912cb00a8d0e3ee4d8a87a3f1ac11df6d
TLSH
T1F5F0C0E6DB715952D8304B7E94172F0543C207F0C61542194BD8FF288E7305AFBC84D5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_34_/extensions/[email protected]/facemoods.jar

SHA256 0b206703b286d945e5903caa43ed7b4be2c85d92b48919e376ea4bf1856b674a
MD5 35da6847680198d8cd54ed025657c1a4
SHA1 3b1ad576de71152f3096d709ea828855e08280c7
SHA512 ba9629577bc191b726e56e423acb48446e8ef2513cfbab247d5ed7501ad73f5093952e0bdb98202264cfb02aa7d65ce808896038a9a924b0fec47020edf30c9f
SSDEEP 768:bx635O0ft5QuOUg+gojzo0s7xcey9T9os4aObu:P2t5QGbjzIO/oMF
TLSH
T1EAF2F1F1F0C719ACFE238B3E9C3C6802F2A961BB8918F155959552FEFCE4B149AC1450
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/facemoods.css

SHA256 ff33aa2b11164eed3dd5faf5bb07135cf30b87716c7edb6e6dd57e999bfe8376
MD5 1f378d2823131ebc4ca52591a3550306
SHA1 fdbf6f788c5c13511a9128b7f76a560aec165bbe
SHA512 38e832be660ea6a7bf62f38a1b69ee3c2d9bc71a13c5a1f9227e191e1b47b59098e1953126b56f95e74c1ce0ef2f2b59853693ce19bf6b72a86a179feb195840
TLSH
T15A511F332AA7344CF12FD145A8796A9C7B1BC007AD1F4E1A79A83D2CD7C52E6256171C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/facemoods.xul

SHA256 87308004d025e2a5c31a8b88c2430dcfb846b4ab08a71eaec98b97170ea41d1c
MD5 5f6549a7206671e4b1ec31b7d19f1c73
SHA1 9d5583ded41b79ba4b42f9c1d84aa23136de9e2f
SHA512 a53b2ec39ff6487786b7995b2ce494d775ce8f47f56ab2800caf8537eafa63c1d6fb3c7407a7a1662889ce85c11b9ce8473354f063e39b093c4e761c799728e8
TLSH
T17671B785E5FFD42D223268C5A4F1B574ADA5E133CE00C8C5B8BC6A90ABCDEC61A511BC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/imgs/arwDwn.gif

SHA256 09d5f001629c8f26137e88cf7a0f7636e6c17d0d75abff9fd3ac106a85571617
MD5 2aa11fa4dcf0f03a0c8fb08170272566
SHA1 9e304d6bd0b0183a54baa2821772aa9f72ef149f
SHA512 8ee3d2e19a20ae5a2d84eed2c722d4bafe9ccc67eb7a061723f660178564945d5938584614f2bbdf5c90b2c78eddd3368196828a2992935f3a688db46f624080
TLSH
T12390024CC5A44A11C045773A455653111364875433986B07543563256C593317217240
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/imgs/facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
TLSH
T188817C2B5DB454AF3DCABA500CED4506A36A293C8E522A38A0E295ED1DF1E57A35F060
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/imgs/pref.jpg

SHA256 ab3399db35e9b42ab47b09f0a51c67b53d43f97d30f248b3042149a07ed5d504
MD5 8e13e2ebfe19e34aa34740aca5d4cb28
SHA1 23be684b0e1d653b056b4f8ef16418f58f39833e
SHA512 baf8fff280b1c88d19ac1fb5b83f9ba9ed025ccbaf3732b73604b9f1c33cd50b45cc5fc87ee5e7dec809b6e577be5140e8723996b44106e6d0c09abac1f12118
SSDEEP 384:s1ndjYSIVuiwK1ndjYSIVCnXP/EZyn/Qb0qM2sAF63WbUhSWxH6gwbhD57z016y0:s1lmApK1lmQmDsAloYtZbhxFlXWnkb
TLSH
T11FD2AE55A3D7AE32E8C0297ED099D5C29721CB88E97362433C5DAA82BF703CB591C573
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/imgs/search.png

SHA256 d7233956f9c2915306281a7e5f03b81af05add35737ee58d7a1088ed06e50af2
MD5 db16cf66110b470e05c94713568f68f0
SHA1 05c592716c053946681c725f4255322310cb851a
SHA512 bcd57eed0db752dc5868988b3f03b7bdc8e4a213b8df9787fda5387fbb8d2074fe0f48432ccf8ed24af86ad3879a1b2b0c8a75dd1e7fe814b96b5c48c07eb0b0
TLSH
T12611B6B0E0AA9E0AE61187B4A798583677D311FE0A29815A190E88881E31B20F08A981
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/mtstart.js

SHA256 9ce029c379fa6709794e48fed80a981fbaf5baf69ca842fca1bf9e796f40cd5b
MD5 9978cfa2a984e8c46eb7701ef27735ce
SHA1 ac622df5ba595f6d1ae7e88541c62462b5176fb0
SHA512 8d18218313b7bc21517556049452da3e887e531b357804a26d6ab31d6ea2467ae858889ecec7ba42607e197c0c54b4d13143c0fa42264299e050fd8f394d524a
SSDEEP 192:YoBWK2dgQbyHafCl3HdHmJTC6axF8CPyjdSgpVbJzTgSCevXmIXHdbKi7p:YoHQGaKl3HcJTbR5RgS9mIXHtF
TLSH
T18422212D5DEB20708523F07D4F8F2254B56A4457086EDD487E6DC2908F6473909EAFFA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/prefLoader.js

SHA256 542b9822100d6d18f43312dc798b0dccc1a5326750c5687de2c775c2d3129213
MD5 bf06e3e9873338fafb57fca1d1f2c92b
SHA1 7fa1107fb960809be8f38a6aacb0031a47cd7a09
SHA512 f50d1b8b22dcb102d5ca318b791c2f29cf4d4b24716f84cb4efe1688ae214d65ade2dc32567fc68fd3f8de2e3abb61ebcda703e615f2be3efbc53d305809b003
TLSH
T1B741E09CD6EB2C109062A25D1C0F20E4D8FA38679133445C3BF5C160BF98AD545FADBA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/preferences.xul

SHA256 8c8ea8500f2db6ceb7d1380ddfcff2ab880a03005b6c828cc5f32eba6fbb22f3
MD5 030273c1c6a64d21030cef66cce08235
SHA1 0560817783bdfb1d039ff05968aa372e5681397c
SHA512 6be19dbc6fa143aa2a9e0ff8c6180ee38ccef279c7c43667bf9438cecf0ace02fe14abce09e6a01e812d8d4cc85ffc58ef32a602b89640656c3cef61d9cb8b19
SSDEEP 96:PSK+p08ouSUdUFvc2+Db5MoknwUpHtf60a1YZCBddL7m:op0RGalV6kFiHYZCBd9m
TLSH
T16191B519C7AF8D5128309044B9E2CF9364F1625BA370DADC35EFC814F746E9908530E7
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

content/tmplt.js

SHA256 cca94fab70df6e53ac189d41e112425482712e87b67e09abffcc7494caa0bbd5
MD5 63e3e1967199054335ed1a8ecdd24901
SHA1 386daff20cab67c044d2e5b9f63c97be05d2d98f
SHA512 029a8d6f231f3d082ade80aa85de9d57aaa1e4f1a812bc0b541dd03667bf2a8325251b8c34b8580cbcb571ec2cf7884d47e667b27bfc52d4448ea3b8653077b0
SSDEEP 192:dxT17sFA/oRQwGPV4UlbLQzJSc7LK8Jt8ZaG5:vpUAgG59xlbQccv8
TLSH
T163E18589F77D9712536220B8A5CE75C9873C80356F8588A67CDC97902B7081C83BEEF8
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$_34_/extensions/[email protected]/install.rdf

SHA256 c2543ebbd797df0c4ef70cf0ab74150fa97e9cbd6d180c3ff34747ab4e35efb1
MD5 d6977d18d103e1fd91c3f964970bac2e
SHA1 b3e9689f55793cb3bd08fcc43de1c15c49d93e4d
SHA512 c2fb5da3d19c0da254cabc9d470a09631be5f88a841db5366e1ab9eadca77def60c38d56ab08308a537d7cf6b8035f90076c611b0cdb294bff3fdba09f87852d
TLSH
T1D011AA2AC51BBF6217DAEA503870580955F707BBD843D081ECE69C0CEF8C18A56A6763
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

bh/facemoods.dll

IMPHASH 44f4d3d27a95aa836b9d7cbf6a70fcc2
SHA256 b52d250a3cc40ffd3da353fc02a2b8f5c93ce7341b071228c8401a780c56313b
MD5 d0813204b590d8e8b98627fd75610e9d
SHA1 8d465e41bd3a156d6c3b12a562473193b9878a7d
SHA512 698698aacdf240812c5ab76cff7d5b4313c552b7df276cb3a63f56e13ac8400477bb01c6b93bfd7ef191bdf834db62afc34d42db239c4108b2eb9f36a18297a6
SSDEEP 3072:XPDSnuDyl0Gk5SMir25KeUpSDeVWwUz+JS4v5r95paU5paJu8cr2:fDzg0GRkKkwE4Vw7JuD2
TLSH
T1AD447D2277E5C579C24E12754C7B5F2E2279EF445F604AC3A6187F4E6E323D2483A2CA
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7e:3c:b1:8d:65:9a:9e:15:44:d2:f4:f3:b6:95:85:de:2f:68:c6:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

110596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escort.pdb

sensapi

IsNetworkAlive

kernel32

WideCharToMultiByte MultiByteToWideChar lstrlenW EnterCriticalSection LeaveCriticalSection GetLastError lstrlenA lstrcmpiA lstrcpynA lstrcpyA GetModuleFileNameA lstrcatA IsDBCSLeadByte InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryExA GetModuleHandleA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc lstrcpyW GetCurrentThreadId GetTickCount FindResourceExA GetProcAddress LoadLibraryA WaitForSingleObject ReleaseMutex CloseHandle CreateMutexA LoadResource GetCurrentProcessId QueryPerformanceCounter IsBadReadPtr GetCommandLineA FindResourceA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LockResource FlushFileBuffers SetStdHandle SetFilePointer IsBadCodePtr GetStringTypeW GetStringTypeA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange SetUnhandledExceptionFilter LocalFree HeapSize HeapReAlloc SetHandleCount LCMapStringW LCMapStringA GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError HeapDestroy VirtualFree IsBadWritePtr TlsAlloc HeapCreate

user32

EnumWindows DefWindowProcA RegisterClassExA UnregisterClassA CharNextA GetParent GetFocus GetWindowRect SetWindowLongA GetClientRect ShowWindow GetClassInfoExA wsprintfA LoadCursorA CharLowerBuffA MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA SetWindowsHookExA CallNextHookEx UnhookWindowsHookEx FindWindowExA EnumChildWindows GetClassNameA GetWindowTextA CreateWindowExA GetWindowTextW GetWindowThreadProcessId SendMessageA SetWindowPos IsWindow CallWindowProcA GetWindowLongA MoveWindow

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegCloseKey

shell32

SHGetFileInfoA

ole32

CreateItemMoniker CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance StringFromCLSID OleRun CLSIDFromString GetRunningObjectTable CLSIDFromProgID

oleaut32

VarUI4FromStr SysStringLen VariantClear LoadRegTypeLi VariantInit SysAllocStringByteLen SysStringByteLen DispCallFunc VarBstrCmp SysAllocStringLen SysFreeString RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

StrStrIW SHDeleteKeyA SHDeleteValueA PathFindExtensionA

facemoods.crx

SHA256 cc45a7785adf370466c050f324dc9cbb675ba6db452137acf91df3c8938bf977
MD5 c950d4862ff0dcff908a8934b28702e8
SHA1 910e844373c425ae105362e12007ed48ff6c18bd
SHA512 f159b788b79918240b7e9639affa24b0cccb340a9c53be7c59ed885617966ea8034c4e909cc19813ce240d1871b1bdd0c7dd9299791a7e554953e0fc2ac18730
SSDEEP 768:fqAW3YRsRdUby35PlH6ROtBxowFxA2JAQlwNnVwFDFYa9E5Tt:fqjoY2ePa2J3anVA+v
TLSH
T1A0E2F157E6E120EBEB7331336F8F215275350524DAD24CFE6086537EE99345AA3220BB
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

facemoods.png

SHA256 ea94c117ec1aa8077cb5582ed7600c661ef4adbea1d5e39ae31a308eb0f028b7
MD5 ad000bbce06733694151384b614c94d7
SHA1 7d2c7e141479e4ed9f8eaa8454ca15ed27438762
SHA512 c605c5742f70f08500898add2d0eafadc3381a9b4d125d0b6a5abf8ff64a7ec50ab2d901533df82c0c7f978b354dc0cddb198c8a5fcdae4f3994a00d801c5ce2
TLSH
T188817C2B5DB454AF3DCABA500CED4506A36A293C8E522A38A0E295ED1DF1E57A35F060
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

facemoodsApp.dll

IMPHASH 54c66c30640ceaf09d0e7010ae8bba2a
SHA256 baf97779f0d58566e68e114a1fff1d926d25067c555d6c5ecc6708a452df7648
MD5 582b370e077dd9412daa10e8b7ac9015
SHA1 538a2aa698b3f41a1f0d0bcd195021946b4786a5
SHA512 f7d5b884300ca9f6de5df799e823a6bf630c83f75e4ed031dd3082b712c9f771e9378702ddc4a7ef9621141f1787c5db53768f2ba04b1f340fc59d6dfbdf0e30
SSDEEP 6144:jZTa9MWQh27pYg7Gg1uLJk352ADl81q3uF7EVfc:NTaqvh27pugwLJ2llU6u
TLSH
T19C745D12B7E6C1B4DB8E02745C7A9F0E1179AE845F91CAC3A3583F5E6F331D26436289
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

36:1d:6f:d6:eb:70:ac:b0:5d:6e:0e:88:e6:e3:dc:82:8b:2d:f3:53

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

164632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortApp.pdb

iphlpapi

GetAdaptersInfo

kernel32

DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceA FindResourceExA lstrlenA lstrcmpiA lstrlenW lstrcpyA GetModuleHandleA GetModuleFileNameA LeaveCriticalSection InterlockedIncrement EnterCriticalSection InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA CompareStringA CompareStringW GetEnvironmentVariableA GetCurrentThreadId LoadLibraryA FreeLibrary GetProcAddress FileTimeToSystemTime SetEnvironmentVariableA DeleteFileA GetVolumeInformationA WaitForSingleObject GetTickCount ReleaseMutex SetEvent ResetEvent CloseHandle RaiseException CreateEventA InitializeCriticalSection CreateThread CreateFileA ReadFile WriteFile SetFilePointer GetFileSize VirtualProtect VirtualQuery IsBadReadPtr GetCurrentProcess SetFileTime SystemTimeToFileTime GetSystemTime MoveFileExA FileTimeToLocalFileTime GetFileTime GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTempFileNameA GetTempPathA CreateDirectoryA FindFirstFileA FindNextFileA FindClose FlushFileBuffers SetStdHandle WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange Sleep GetLastError SetUnhandledExceptionFilter CreateMutexA GetCPInfo GetOEMCP GetCommandLineA GetSystemTimeAsFileTime IsBadCodePtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemInfo VirtualAlloc RtlUnwind ExitProcess LocalFree GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings TerminateProcess

user32

CharNextA KillTimer SetTimer DispatchMessageA TranslateMessage PeekMessageA GetParent MsgWaitForMultipleObjects

advapi32

RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA ord165 SHGetSpecialFolderPathA

ole32

CoTaskMemFree OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize StringFromCLSID

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayCreate SafeArrayDestroy GetErrorInfo SysAllocStringLen SysAllocString SysFreeString SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit VariantClear VariantCopy VarBstrCmp DispCallFunc RegisterTypeLi UnRegisterTypeLi LoadRegTypeLi LoadTypeLi VariantChangeType VarUI4FromStr VarBstrCat

shlwapi

StrToIntExA StrStrW PathRenameExtensionA PathFindNextComponentA PathIsURLW PathAppendA PathFileExistsW StrCmpIW PathFindExtensionA SHSetValueA SHGetValueA PathFindFileNameA

facemoodsEng.dll

IMPHASH 8b24b5fee3a50d84bb40a6cbf9737945
SHA256 7de1b95a08372d216e24078ad54f27783a6d04b88cac51f35deb8373cfe19c1b
MD5 45300e499ccca60e2a6869170eca9966
SHA1 fd9e5c83ff7337560e3f7f4ad9573934023b351b
SHA512 5733c6648f7ec897c8ca6f311b03d6b244ecd5865bdc4d1b79ba7edadefb38d88bc51297ee05973586dbec64b9c8a6f4817e17d84f2108443a991b6dc87bbc73
SSDEEP 6144:7LAZ7H7AcAV7PdAZckYFZboqfYCKNpPrnvxJYr7KU10:gZ7H7AcAVwcproqwCKNpjnXUK
TLSH
T122A45B11F7A6C1B1C64D01746C7BAF5F2679DE885B144BC3E3183F9E6E322D2583628A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

79:80:a0:09:0b:3c:6b:a1:0b:3b:eb:5a:14:31:66:ee:d6:d5:58:e0

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

227318

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escortEng.pdb

kernel32

CompareStringA CompareStringW GetEnvironmentVariableA SizeofResource LockResource LoadResource FindResourceA FindResourceExA CloseHandle WaitForSingleObject FlushInstructionCache GetCurrentProcess HeapAlloc GetProcessHeap GetCurrentThreadId CreateFileA CreateThread HeapFree GetTickCount MulDiv GlobalUnlock GlobalLock GlobalAlloc lstrcmpA GetProcAddress LoadLibraryA GetDateFormatA FileTimeToSystemTime SetEnvironmentVariableA FileTimeToLocalFileTime WriteFile GetFileTime Sleep ReleaseMutex SetEvent ResetEvent CreateMutexA CreateEventA MapViewOfFile CreateFileMappingA OpenFileMappingA GetFileSize UnmapViewOfFile ReadFile SetFilePointer FreeLibrary WideCharToMultiByte HeapDestroy HeapReAlloc HeapSize MultiByteToWideChar lstrcpynA InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange CreateDirectoryA FlushFileBuffers SetStdHandle GetLocaleInfoW IsBadCodePtr IsBadReadPtr IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetTimeZoneInformation UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount GetOEMCP SetUnhandledExceptionFilter TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCPInfo LCMapStringW LCMapStringA GetTimeFormatA GetCommandLineA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess LocalFree GetModuleHandleA lstrcmpiA InterlockedDecrement InterlockedIncrement lstrcatA GetModuleFileNameA lstrlenA lstrcpyA IsDBCSLeadByte GetLastError LeaveCriticalSection EnterCriticalSection DeleteCriticalSection lstrlenW

user32

CreateAcceleratorTableA ScreenToClient UnregisterClassA CharNextA CharNextW SetWindowLongA PostMessageA GetClassInfoExA wsprintfA LoadCursorA CreateWindowExA RegisterClassExA DestroyWindow IsWindow IsWindowVisible SetTimer IsChild GetWindow GetParent DefWindowProcA GetWindowLongA CallWindowProcA SetWindowTextA GetWindowRect MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA FindWindowExA EnumChildWindows GetWindowThreadProcessId EnumWindows SystemParametersInfoA InflateRect SetForegroundWindow GetWindowTextLengthA GetWindowTextA AnimateWindow GetCursorPos OffsetRect ShowWindow MoveWindow RegisterWindowMessageA SendMessageTimeoutA GetCaretBlinkTime GetFocus GetClassNameA SetWindowPos RedrawWindow GetDlgItem SendMessageA SetFocus BeginPaint EndPaint DestroyAcceleratorTable GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor UpdateLayeredWindow CharLowerBuffA GetClientRect

gdi32

GetDeviceCaps OffsetViewportOrgEx CreateSolidBrush GetStockObject BitBlt CreateCompatibleBitmap CreateDIBSection DeleteObject SelectObject DeleteDC CreateCompatibleDC GetObjectA

advapi32

RegCloseKey RegOpenKeyExA RegQueryInfoKeyA RegCreateKeyExA RegSetValueExA RegEnumKeyExA RegQueryValueExA RegEnumValueW RegDeleteKeyA

shell32

SHGetFileInfoA SHGetSpecialFolderPathW

ole32

CoTaskMemFree StringFromCLSID StringFromGUID2 CoCreateInstance OleRun CreateItemMoniker CoInitialize CoUninitialize CLSIDFromProgID CLSIDFromString CoTaskMemAlloc OleLockRunning CreateStreamOnHGlobal CoGetClassObject OleInitialize OleUninitialize GetRunningObjectTable

oleaut32

SafeArrayUnlock SafeArrayLock SafeArrayGetDim GetErrorInfo SafeArrayGetUBound SafeArrayGetLBound VarBstrCat OleCreateFontIndirect VariantCopy DispCallFunc LoadRegTypeLi VarUI4FromStr VariantInit SysAllocStringLen VarBstrCmp RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString VariantClear SysStringByteLen SysAllocStringByteLen SysStringLen SafeArrayDestroy SafeArrayCopy SysFreeString

shlwapi

SHDeleteValueA SHGetValueA StrToIntExA SHSetValueA StrCmpIW PathFindExtensionA

gdiplus

GdiplusShutdown

ws2_32

WSAStartup WSACleanup getaddrinfo freeaddrinfo

facemoodsTlbr.dll

IMPHASH c5bd7ceec8c30d0cd7560ee6100655d6
SHA256 9e935e603e75690b3d56c748b2a435fa41fc3bb52508692c847b07acaeef45b1
MD5 0fb336ccb1fe21397098026df36fd914
SHA1 3fa3c67b6f4721a7d77cd478bd9b10a0377520fc
SHA512 28ccfcb2326812ff06ac097fe94fb117c3487c4aff8e5fd8b9e1eb8e51a57097eaab353239d6279b052abe7751e96e3aeccfb15ba1bca4305cd91ee7c6bd9b22
SSDEEP 3072:QJSxWnSCeKgNAO3HFubEz9Ev6U04Ws55h5paU5paEMlJ:QSxgaUbb674WE07N
TLSH
T15E246B127BA5C5B0C18E117C48769F6D237BEE569FE40AC76B143F5B6E312D10C3A28A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9d:ea:86:7b:90:3e:02:11:14:5d:8c:48:88:7a:af:5d:71:e7:86:77

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Apr 14, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

76049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\dvlp\bin\facemoods\escorTlbr.pdb

kernel32

GetModuleFileNameA GetCurrentThreadId InterlockedIncrement InterlockedDecrement lstrcpynA IsDBCSLeadByte lstrcatA HeapFree GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpA WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA GetModuleHandleA lstrcpyA lstrlenW lstrcmpiA lstrlenA SetStdHandle SetFilePointer IsBadCodePtr IsBadReadPtr GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA LoadLibraryA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetCPInfo GetOEMCP TerminateProcess GetProcAddress IsBadWritePtr VirtualFree HeapCreate GetCurrentProcessId QueryPerformanceCounter GetCommandLineA VirtualQuery GetProcessHeap HeapAlloc GetCurrentProcess FlushInstructionCache FindResourceExA FindResourceA LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetLastError WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InterlockedExchange InitializeCriticalSection RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetSystemInfo VirtualAlloc VirtualProtect GetSystemTimeAsFileTime RtlUnwind ExitProcess LocalFree HeapSize HeapReAlloc HeapDestroy GetACP FlushFileBuffers

user32

CreateAcceleratorTableA GetClassNameA SetWindowPos RedrawWindow GetDlgItem SetFocus GetFocus IsChild PeekMessageA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture GetSysColor MsgWaitForMultipleObjects GetWindowTextLengthA GetWindowTextA SetWindowTextA DispatchMessageA ScreenToClient GetCursorPos SendMessageA GetParent GetWindow GetWindowRect CallWindowProcA GetWindowLongA DefWindowProcA IsWindow RegisterClassExA CharNextA CreateWindowExA GetClientRect LoadCursorA wsprintfA GetClassInfoExA ShowWindow SetWindowLongA IsWindowVisible TranslateMessage DestroyWindow UnregisterClassA DestroyAcceleratorTable RegisterWindowMessageA

gdi32

GetStockObject GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject DeleteObject SetViewportOrgEx CreateSolidBrush GetObjectA

advapi32

RegOpenKeyExA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegCreateKeyExA RegCloseKey RegDeleteKeyA

shell32

SHGetFileInfoA

ole32

CreateItemMoniker GetRunningObjectTable CoTaskMemFree StringFromCLSID OleRun CoCreateInstance StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoTaskMemAlloc OleLockRunning CLSIDFromProgID CLSIDFromString CoGetClassObject

oleaut32

SysFreeString SysAllocString VariantClear VarUI4FromStr LoadRegTypeLi LoadTypeLi SysStringLen SysAllocStringByteLen SysStringByteLen VariantInit UnRegisterTypeLi RegisterTypeLi SysAllocStringLen DispCallFunc OleCreateFontIndirect

shlwapi

PathFindExtensionA

facemoodssrv.exe

IMPHASH 5bb76c9b862d3d66ddbf9ae1fa74b496
SHA256 856b3b38f679af08a54656a9e820702602e832ffae2e66c8c903891140a7ba23
MD5 e83686c5f2273f8a7561897dd5f4e570
SHA1 b46c493e729674c1f02ae94d32c476e5b5077625
SHA512 f6147079dd8ef60b5c9a470df2cdd435c0813b9eb28999a660c54a74fa63ef05f4c665016363cc3489240235c36a8af9c0472306b0fd18cfcb49c3059513909e
SSDEEP 6144:OuugnYauQVYW6jPF0bVNjkKKAoY9Si5MGUIKT:OuFYauQVxVNjlJf5Ux
TLSH
T1E2742943B7B285B3CB8582320C7A9B5F1B25EE441F514EC3629C7B2EED312D19B36265
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

f6:32:d9:41:0f:c5:f1:76:65:7a:6e:cd:f8:d5:61:6d:77:53:2d:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Chains

Sep 5, 2011

CN=Volonet Ltd,O=Volonet Ltd,POSTALCODE=67778,STREET=hazfira 19,L=Tel-Aviv,ST=Israel,C=IL

Minor OS version

0

Major OS version

4

Entry point

145035

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\dvlp\bin\facemoods\esrv.pdb

sensapi

IsNetworkAlive

kernel32

FileTimeToSystemTime FileTimeToLocalFileTime InterlockedDecrement GetFileTime WaitForSingleObject lstrlenA InterlockedIncrement lstrcmpiA lstrcpyA GetModuleHandleA GetModuleFileNameA lstrcpynA IsDBCSLeadByte LeaveCriticalSection EnterCriticalSection GetCurrentThreadId Sleep CreateThread CreateEventA lstrcatA SetEvent ExitProcess GetTickCount FreeLibrary LoadLibraryExA GetCommandLineA FlushInstructionCache GetCurrentProcess HeapFree GetProcessHeap HeapAlloc CompareStringA CompareStringW GetEnvironmentVariableA GetProcAddress LoadLibraryA SetFilePointer CreateDirectoryA GetTempPathA MoveFileExA GetTempFileNameA SetEnvironmentVariableA GlobalUnlock GlobalLock GlobalAlloc CreateFileA lstrcmpA ReleaseMutex ResetEvent CreateMutexA MultiByteToWideChar lstrlenW WideCharToMultiByte CloseHandle FlushFileBuffers SetStdHandle IsBadCodePtr IsBadReadPtr LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle GetCPInfo GetOEMCP TerminateProcess TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetTimeZoneInformation SetUnhandledExceptionFilter GetCurrentProcessId QueryPerformanceCounter IsBadWritePtr VirtualFree HeapCreate GetSystemTimeAsFileTime GetStartupInfoA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect GetDateFormatA GetTimeFormatA RtlUnwind LocalFree HeapSize HeapReAlloc HeapDestroy FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange WriteFile MulDiv

user32

SetWindowPos MsgWaitForMultipleObjects PeekMessageA GetWindowTextLengthA GetWindowTextA ShowWindow CharUpperA LoadIconA CharNextA SendMessageA UnregisterClassA DestroyWindow PostThreadMessageA DefWindowProcA LoadCursorA SetWindowTextA GetWindow SetWindowLongA IsWindow GetClassInfoExA CreateAcceleratorTableA GetParent GetClassNameA RedrawWindow DestroyAcceleratorTable GetDlgItem SetFocus GetFocus IsChild GetWindowLongA BeginPaint EndPaint GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC GetClientRect FillRect SetCapture ReleaseCapture GetSysColor GetMessageA DispatchMessageA TranslateMessage KillTimer RegisterWindowMessageA PostQuitMessage CreateWindowExA RegisterClassExA CallWindowProcA wsprintfA

gdi32

SelectObject DeleteObject CreateCompatibleDC BitBlt GetDeviceCaps GetObjectA GetStockObject CreateSolidBrush CreateCompatibleBitmap DeleteDC

advapi32

RegDeleteKeyA RegQueryInfoKeyA RegDeleteValueA RegEnumKeyExA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegCloseKey

shell32

ord165 SHGetSpecialFolderPathA Shell_NotifyIconA SHGetFileInfoA ShellExecuteExA SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal OleLockRunning OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString CoTaskMemFree StringFromCLSID CoRevokeClassObject CoRegisterClassObject CoTaskMemAlloc CoCreateGuid CoTaskMemRealloc CoInitialize CoUninitialize StringFromGUID2 CoInitializeEx OleUninitialize OleInitialize CoGetClassObject

oleaut32

SysStringByteLen RegisterTypeLi DispCallFunc VarBstrCat OleCreateFontIndirect GetErrorInfo SysFreeString UnRegisterTypeLi VariantChangeType LoadTypeLi LoadRegTypeLi VarUI4FromStr SysAllocString SysAllocStringByteLen SafeArrayCopy SafeArrayDestroy SysAllocStringLen VariantCopy VariantClear SafeArrayUnlock SafeArrayLock VariantInit SafeArrayGetDim SafeArrayGetUBound SafeArrayGetLBound VarBstrCmp SysStringLen

shlwapi

PathFindFileNameA StrStrW PathFindExtensionA PathIsURLW StrToIntW SHGetValueA PathRenameExtensionA PathAppendA

uninstall.exe.nsis

SHA256 1726c56d80afe7d18c4a46e10a3b52de14ce9353659e5805034ad855a40299c2
MD5 bf1634fbcdbd45094bc2c137e43c029b
SHA1 d85ca3d3c113d96a73829f0d832f1498b431017e
SHA512 368ba7543286e4e492d69914ac5e64ae6bf68d9292411cb2bcafb85b38cc821996e14336d9166a9b97c9caedfc8a0b6db9acd6cfda23909bdf259f0e1702e1ff
SSDEEP 1536:Vw4I3JGjef21W4CBrtlp6bUi4VhYJfQfa:esiO1Yrtfm4VOP
TLSH
T1EC430260A56F4FD1C98712F5DC07D4EEA93742FF618803798B8EE272FB9A8039715684
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral1.bmp

SHA256 e9be711645adceef7a7f55ad9b573cf67910c885ebf63024928656823079512b
MD5 09fbaede48cfedb759e640bed10d5dbf
SHA1 e1c0a5a77042595beae53955cad72143aac61045
SHA512 aeb67c0ccfea4b5c09dcbb398be9e863c3c35eb3f9cb8c8eb666e8d69fd00ac6195024e443333ce5645a04b00c38c17182533d9f8ba7312ff446f1be5cba0d28
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLe:mAiUHnoQkU6KCrdD
TLSH
T1481409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral2.bmp

SHA256 ca2a72e55aa5249a9c47983f7a03dcad7509b68adcf109b7913d26c9cf2fd353
MD5 d0d2b5814833b7412a66c89e8b75021d
SHA1 9b6c821d9078aa1054f522d3669686a1f7792b37
SHA512 04e1ae6a68ac73ef37bbe799e95ee6f218b846f129ee29fb7c6f24ea2134074dc88fc038fe67b47e49d7ce0675abb61c697eb54c6d67ac4b88984fefbefef141
SSDEEP 192:tLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLT:CcAiUHnoQkU6KCrdD
TLSH
T1121409922A46FF43F3D5D822E876F56986A13C4F5BE39475A078BD98B2BC770500A343
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$LOCALAPPDATA/lateral3.bmp

SHA256 6b9ca40f2943ce7ca4585cf1d0dda3cef8c96b305a6eb1f4df2686bf10c842ec
MD5 e1ce13e6f1ed1f339f8595ccf9d0198e
SHA1 666997a9f8786074193c6cb2160c2ef3962d3ecc
SHA512 6eb991deee612f18635d84d9d889388e4c8f9d9cd7021bd05a1dce480d067733d7da77c2da96c536ac39abc826188123fabdf3a21ee7da515d2d01a9f97c18f7
SSDEEP 192:mWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW2:RGjOTJthkj6K2rQe
TLSH
T1571409922A46FF43F3D5D822E876F56986A13C4F5FE39475A078BD99B2BC770100A243
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH e886a412cdaf11998a8eeffda508e913
SHA256 983859570099b941c19d5eb9755eda19dd21f63e8ccad70f6e93f055c329d341
MD5 1efbbf5a54eb145a1a422046fd8dfb2c
SHA1 ec4efd0a95bb72fd4cf47423647e33e5a3fddf26
SHA512 7fdeba8c961f3507162eb59fb8b9b934812d449cc85c924f61722a099618d771fed91cfb3944e10479280b73648a9a5cbb23482d7b7f8bfb130f23e8fd6c15fb
SSDEEP 384:XErRo4TdlKCdUk6qz46qu2vPqUcnlSHmkuPJOiya4fF0Ac9khYLMkIX0+GvBgK3M:XiRoW7Kc5bBq1qNlSHmkuPJOJa4f4CD
TLSH
T1E0B2A59AD600B977E3E6253072910F4247BDBF723060744BEA63277D58B52E6FA38243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17793

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA DestroyWindow KillTimer UpdateWindow RedrawWindow DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpAddRequestHeadersA HttpOpenRequestA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
TLSH
T1D3D13941ABEC226AF7BB09306BB143365076B8A0EFBAD7BE04A4014E29611400C71F39
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 ecedfdae5316b8a8529c71949cc1e0e53a3e4cbc9552ab3301ec961404185220
MD5 b94ce22e857bffbbff032d747653b3b0
SHA1 fd7ee723aefb384db149bf92a36603cfb70f4d98
SHA512 cd89199ed395ebf873712d4a41e74a8271834e8104e67adb833c8c5884d081b9b65c49d2fa902d4a15eb14dba42246486ebfd33ddf80f4ed1add6b8891b49733
SSDEEP 384:l121P4+YUzC3vygNWiWnBz+bYhDJi+u7KrEOn4VhzytFC+D:DttH/lW1Bz3Dk+x63Ga+D
TLSH
T1D9D3A2C11A44FE87F3C5C923F966BDB58AD1794F6FE38974B0ACBAC8629D9702104187
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
TLSH
T17F12F8675A4041B3E9A3223D306A3E3F8B7C9325D0927C03C677AE566AB031A7D3A354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsRandom.dll

SHA256 db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
MD5 ab467b8dfaa660a0f0e5b26e28af5735
SHA1 596abd2c31eaff3479edf2069db1c155b59ce74d
SHA512 7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
SSDEEP 384:LCHDPMs4GdtyO5roguusMxUXiO3wOw95euooP2UgKbd9BvNtf:LCHD6Gh87MKXil/5r2U3z
TLSH
T1A3A2E1AFFA7A8B72C21162394365DDF861D08DDD01EE1E479A2EC226ACBD0400D7221B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

68128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_not-a-virus.AdWare.Win32.DealPly.cfk.6fbbe07144086075c53b04c8d505b907

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$LOCALAPPDATA/bloson.bmp

$LOCALAPPDATA/dealply.bmp

$LOCALAPPDATA/dealply.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsRandom.dll

generic

out.upx

generic

$PLUGINSDIR/nsisdt.dll

kernel32

crtdll

generic

$PLUGINSDIR/registry.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/version.dll

generic

out.upx

generic

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome.manifest

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/dealply.xul

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/chrome/content/images/dealplyIcon32.png

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/defaults/preferences/defaults.js

$_0_/extensions/{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}/install.rdf

DealPly.crx

background.html

images/dealplyIcon128.png

images/dealplyIcon16.png

images/dealplyIcon48.png

manifest.json

DealPlyIE.dll

PE Signature issue

kernel32