splicedd_1[.]0[.]0_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
splicedd_1.0.0_x64-setup.exe
Size 2.9MB
Sample261027-bdevlshw9t
SHA256 a1cc8c0d874efafa671d19443989a21e05c3d78e0a76de98b51c9aec5b7c0fc6
MD5 343df51f2b3709ad6ce87ec3ac500d60
SHA1 f9f19acf5a84841f946887767e280b4c4ef04c29
SHA512 7bfc5c5af0fb4f91371d01f4956c8c0afda072ef9cd6268c1325c6af4a978cc98d12f7544d34e333768be22ae73b32238d7f3eca5a65251086b459bbc40a3f5b
SSDEEP 49152:x3aH7wsGTh2jwubGT+GAzbsMSgmbwi4zctt/1k+3nJhEINJ0Fz38VRRis65X:xqHomweGyG2bjfsX4zc3tbDvgskF
TLSH
T128D5333489C49A87F237A130461EE9C5762607B3906EF6695BC2FDC63E3E221E56C6C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
splicedd_1.0.0_x64-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/splicedd.exe
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

splicedd_1.0.0_x64-setup.exe

.exe 2.9MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 28KB
splicedd.exe

.exe 9.5MB
uninstall.exe

.exe 73KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 28KB

splicedd_1.0.0_x64-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 a1cc8c0d874efafa671d19443989a21e05c3d78e0a76de98b51c9aec5b7c0fc6
MD5 343df51f2b3709ad6ce87ec3ac500d60
SHA1 f9f19acf5a84841f946887767e280b4c4ef04c29
SHA512 7bfc5c5af0fb4f91371d01f4956c8c0afda072ef9cd6268c1325c6af4a978cc98d12f7544d34e333768be22ae73b32238d7f3eca5a65251086b459bbc40a3f5b
SSDEEP 49152:x3aH7wsGTh2jwubGT+GAzbsMSgmbwi4zctt/1k+3nJhEINJ0Fz38VRRis65X:xqHomweGyG2bjfsX4zc3tbDvgskF
TLSH
T128D5333489C49A87F237A130461EE9C5762607B3906EF6695BC2FDC63E3E221E56C6C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 78c44bf8cc28f4ebbfe7d4b4aa3acf86
SHA256 2fe7953cd06cd9ab1d5e91834ecfe70bcf7a9ed6b2c40aebc21c98c6f96eb89c
MD5 a573dcf90cb9d9e30624eea14018980e
SHA1 01e48d6429b48b640230c6ce8f257c84758943aa
SHA512 823a79f1b1e6e64481f0c305e189d95b51528b6ce87a2330e2199a33ebfe074a6e39382c79cb28d89c89294205031f0519bff5aacd2334813a74d32529d2eaa7
SSDEEP 384:sq6F316ZZDGeN/b42AHrKLHxEojKCKpnbOMdjdhQD7bGh+qkzAGj:sq6Fl6ZICb3ercFKpnq0jdhK7W+q4
TLSH
T1E5D2F558FDC97EB6D7EF00B20809952E824FC8180B54CEEBA3A50E52D5A27731EE515F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

splicedd.exe

IMPHASH 2e0108d123e898969a896b54d3f0dfde
SHA256 d46577e74289fcd7389dae3056b6868953f37452fd12af0df6d56fea204cbf43
MD5 4f168c6f8c79e75f0b0525eafb947224
SHA1 9e6bb3231e6f88d90537d671352e967ef6dcc26e
SHA512 040a526ef1759a6c9b6c54921f68e96f45a9e61c0f8cec768768aded0474f78d4ce15f4e8a02211f89ca88565e83f0162a3942c0fdc3d41b6f09e78e5d472820
SSDEEP 98304:g3S2KnlfvFMcR76J/pJs0IeC4wU68Mg8IBegjCXdYgME3vLgzgYaXH64E59VC8U0:i9egjUYiyCzputEMJIjnP0U1cb
TLSH
T1E7A629217B4A99ADC05AC47082464B726A717CCB0F35BAFF458476783E7AAF41F3C258
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5810504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Code\splicedd\src-tauri\target\release\deps\splicedd.pdb

kernel32

CreateThread GetCurrentThread GetSystemTimeAsFileTime WriteConsoleW MultiByteToWideChar GetFullPathNameW ExitProcess CopyFileExW GetFinalPathNameByHandleW RemoveDirectoryW MoveFileExW DeleteFileW FindFirstFileW CreateDirectoryW GetFileInformationByHandleEx CreateFileW FindClose FindNextFileW ReleaseMutex GetUserDefaultUILanguage CreateMutexA WakeConditionVariable WakeAllConditionVariable TerminateProcess GetFileAttributesW GetModuleFileNameW OutputDebugStringA OutputDebugStringW LoadLibraryA lstrlenW TryAcquireSRWLockExclusive LoadLibraryExW WaitForSingleObject FormatMessageW GetEnvironmentVariableW GetCurrentProcessId GetLastError FreeLibrary Sleep GetModuleHandleA GetStdHandle SetFilePointerEx DuplicateHandle SetFileInformationByHandle GetProcAddress LoadLibraryExA GetCommandLineW HeapFree HeapAlloc GetProcessHeap HeapReAlloc LCIDToLocaleName CloseHandle GetCurrentThreadId GetTempPathW LoadLibraryW QueryPerformanceFrequency InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleHandleW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc SetEnvironmentVariableW TlsGetValue AcquireSRWLockExclusive TlsSetValue ReleaseSRWLockExclusive WaitForSingleObjectEx GetCurrentDirectoryW ReleaseSRWLockShared AcquireSRWLockShared SleepConditionVariableSRW GetSystemInfo SetLastError RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext QueryPerformanceCounter SetWaitableTimer CreateWaitableTimerExW SwitchToThread SetThreadStackGuarantee AddVectoredExceptionHandler SetHandleInformation GetConsoleMode GetFileInformationByHandle SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx PostQueuedCompletionStatus TlsFree

user32

GetRawInputData LoadCursorW PostQuitMessage AppendMenuW CreateMenu SetMenuItemInfoW VkKeyScanW GetAsyncKeyState GetKeyboardState CreateIcon ToUnicodeEx GetKeyState MapVirtualKeyExW SetWindowPos GetClientRect MonitorFromRect ClientToScreen GetSystemMenu ShowWindow SetWindowLongW SendMessageW DestroyAcceleratorTable InvalidateRgn GetKeyboardLayout CheckMenuItem EnableMenuItem SendInput SetForegroundWindow SetWindowDisplayAffinity GetWindowTextW GetWindowTextLengthW SetWindowTextW MonitorFromPoint EnumDisplayMonitors IsProcessDPIAware GetDC MonitorFromWindow ReleaseCapture GetMonitorInfoW SystemParametersInfoA GetWindowLongPtrW GetMessageA IsWindowVisible CreateAcceleratorTableW TrackMouseEvent DispatchMessageA GetTouchInputInfo ClipCursor GetClipCursor GetCursorPos ShowCursor ScreenToClient SetCursorPos AdjustWindowRectEx IsIconic SetMenu GetMenu GetWindowRect SetCapture SetWindowLongPtrW MsgWaitForMultipleObjectsEx RegisterRawInputDevices RegisterClassExW RegisterWindowMessageA GetWindowLongW EnumChildWindows PostMessageW GetActiveWindow CreateWindowExW DispatchMessageW TranslateMessage PeekMessageW GetUpdateRect PostThreadMessageW ValidateRect RedrawWindow DestroyWindow GetForegroundWindow IsWindow GetSystemMetrics CloseTouchInputHandle DestroyIcon RegisterTouchWindow SetWindowPlacement GetWindowPlacement ChangeDisplaySettingsExW FlashWindowEx DefWindowProcW TranslateAcceleratorW GetAncestor GetMessageW MapVirtualKeyW SetCursor

gdi32

GetObjectW DeleteObject CreateBitmap CreateRectRgn GetDeviceCaps

dwmapi

DwmEnableBlurBehindWindow

ole32

CreateStreamOnHGlobal CoUninitialize DoDragDrop CoInitializeEx CoTaskMemFree CoTaskMemAlloc RevokeDragDrop CoCreateInstance RegisterDragDrop OleInitialize

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass

shell32

SHGetKnownFolderPath DragFinish DragQueryFileW SHCreateItemFromParsingName ShellExecuteW SHCreateShellItemArrayFromIDLists SHAppBarMessage ILCreateFromPathW

windowscodecs

WICConvertBitmapSource

oleaut32

SysFreeString GetErrorInfo SetErrorInfo SysStringLen

uxtheme

SetWindowTheme

advapi32

EventWriteTransfer SystemFunction036 RegGetValueW RegCloseKey RegQueryValueExW EventSetInformation EventUnregister RegOpenKeyExW EventRegister

ntdll

NtReadFile NtWriteFile NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx

bcrypt

BCryptGenRandom

ws2_32

getaddrinfo closesocket freeaddrinfo getsockname getpeername WSASocketW bind connect ioctlsocket getsockopt shutdown WSACleanup WSAStartup recv send WSASend setsockopt WSAIoctl WSAGetLastError

secur32

ApplyControlToken FreeContextBuffer FreeCredentialsHandle AcquireCredentialsHandleA QueryContextAttributesW DeleteSecurityContext AcceptSecurityContext EncryptMessage DecryptMessage InitializeSecurityContextW

crypt32

CertDuplicateCertificateContext CertFreeCertificateContext CertVerifyCertificateChainPolicy CertDuplicateStore CertGetCertificateChain CertCloseStore CertOpenStore CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateCertificateChain CertFreeCertificateChain

api-ms-win-crt-math-l1-1-0

floor __setusermatherr pow round trunc

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp strcpy_s wcsncmp

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

__p___argc _seh_filter_exe _exit _set_app_type abort _initterm_e _initialize_narrow_environment terminate _crt_atexit _get_initial_narrow_environment _register_onexit_function exit _configure_narrow_argv _cexit __p___argv _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _initterm

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc _callnewh

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

304KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

76KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 71378ce7ca2b14f78cc0f4ccaa5b7f39fcc87b3750cca71f8dd019b27a90350a
MD5 33913f1b7c1604742b85da0689ade637
SHA1 949663f6e387b2ead411910a1d924f7aa00996b1
SHA512 36bec592e78376f975d1bad8bec44c08ec060d7006e4d15e12541947a0bc9731cc47851ac0c3ef23c1e270261b755b119b405166c600592126b4575835fd5ed5
SSDEEP 1536:HmsAYBdTU9fEAIS2PEtungdLeAyNx7XgykE+PU8H:GfY/TU9fE9PEtunceA6wykjH
TLSH
T1D473CE043BA0C4A7D9F607311E7E97AB7FF6E91214688B1723506B9E7972241DE0E363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 78c44bf8cc28f4ebbfe7d4b4aa3acf86
SHA256 2fe7953cd06cd9ab1d5e91834ecfe70bcf7a9ed6b2c40aebc21c98c6f96eb89c
MD5 a573dcf90cb9d9e30624eea14018980e
SHA1 01e48d6429b48b640230c6ce8f257c84758943aa
SHA512 823a79f1b1e6e64481f0c305e189d95b51528b6ce87a2330e2199a33ebfe074a6e39382c79cb28d89c89294205031f0519bff5aacd2334813a74d32529d2eaa7
SSDEEP 384:sq6F316ZZDGeN/b42AHrKLHxEojKCKpnbOMdjdhQD7bGh+qkzAGj:sq6Fl6ZICb3ercFKpnq0jdhK7W+q4
TLSH
T1E5D2F558FDC97EB6D7EF00B20809952E824FC8180B54CEEBA3A50E52D5A27731EE515F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4249

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

splicedd_1.0.0_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

generic

splicedd.exe

kernel32

user32

gdi32

dwmapi

ole32

comctl32

shell32

windowscodecs

oleaut32

uxtheme

advapi32

ntdll

bcrypt

ws2_32

secur32

crypt32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic

uninstall.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll