e8f1aa43975b77dd3cb899d95d007116_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

e8f1aa43975b77dd3cb899d95d007116_JaffaCakes118
Size

511KB
MD5

e8f1aa43975b77dd3cb899d95d007116
SHA1

9ca934d558b8ecce923e90c42fdaa8e7a9253f39
SHA256

dd392dc79be8be88a60cfe7d4fb9b8e79680af93e3731450290e112f8de93728
SHA512

d70e8327f044229bb43c6a57745a3e39bcf7df76222c6beb0c9a8f8f97a4137804dec0900eb6f99977f99c1473ddee481bf42400c55d3e82f4a6151ac4428624
SSDEEP

12288:yKa8z8xxQr2uFHIe/fSx/WimzgBQHLdgNtOI:y/EwyrQe/fM/lmE0dStOI

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$TEMP/bdtmp/InstDll.dll
unpack002/baidubar.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/baiducb5.exe	nsis_installer_1

Files

e8f1aa43975b77dd3cb899d95d007116_JaffaCakes118
.rar
baiducb5.exe
.exe windows:4 windows x86 arch:x86

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28/07/2006, 00:00

Not After

12/08/2009, 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
CreateWindowExA
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetDlgItem
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
SetClipboardData
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PROGRAM_FILES/Baidu/bar/Buttons/custom.xml
.xml
$TEMP/bdtmp/InstDll.dll
.dll windows:4 windows x86 arch:x86

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
CreateFileA

msvcrt

_snprintf
__CxxFrameHandler
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit

shlwapi

SHDeleteKeyA
SHDeleteValueA
SHSetValueA

Exports

Exports

DelKey
DelValue
SetRegValue

Sections

.rdata
Size: 1024B - Virtual size: 785B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BaiduBar.dat
baidubar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

14dd304fe5b147e8ad61fe9c67382bce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CopyFileA
MoveFileExA
DeviceIoControl
SetFileAttributesA
GetACP
GetCurrentProcessId
lstrcmpA
GlobalFree
GlobalAlloc
LockResource
CompareStringA
GetFileAttributesA
SetFilePointer
WritePrivateProfileSectionA
GetPrivateProfileSectionA
SetErrorMode
GetEnvironmentVariableA
ReadProcessMemory
VirtualProtect
OpenProcess
RemoveDirectoryA
Process32First
CreateToolhelp32Snapshot
GetVolumeInformationA
TerminateThread
GetExitCodeThread
OpenMutexA
LocalFree
FormatMessageA
IsBadStringPtrW
FreeResource
TerminateProcess
GetExitCodeProcess
HeapFree
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetEvent
ResumeThread
CreateDirectoryA
WritePrivateProfileStringA
GetVersionExA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
GetTickCount
CreateFileA
CreateProcessA
WaitForSingleObject
CreateMutexA
GetTempFileNameA
ReleaseMutex
GlobalLock
GlobalUnlock
lstrcatA
lstrcpyA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
GetShortPathNameA
DisableThreadLibraryCalls
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
Sleep
lstrlenW
GetCurrentProcess
WriteProcessMemory
IsBadStringPtrA
CreateThread
WideCharToMultiByte
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
CloseHandle
WriteFile
InterlockedDecrement
MultiByteToWideChar
lstrcpyW
LoadLibraryA
GetModuleFileNameW
LoadLibraryW
OutputDebugStringA
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetLastError
SetLastError
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedIncrement
lstrlenA
Process32Next

user32

GetGUIThreadInfo
SetTimer
LoadBitmapA
GetWindowThreadProcessId
IsRectEmpty
ClientToScreen
InsertMenuA
DeleteMenu
GetMenuItemID
AdjustWindowRectEx
DestroyIcon
AdjustWindowRect
CheckMenuItem
EnableMenuItem
GetAsyncKeyState
GetSubMenu
GetClassNameA
EnumChildWindows
IsChild
UnhookWindowsHookEx
GetClientRect
DestroyWindow
GetFocus
SetFocus
SetWindowsHookExA
wsprintfA
LoadCursorA
RegisterClassExA
GetClassInfoExA
CreateWindowExA
GetActiveWindow
DialogBoxParamA
MoveWindow
KillTimer
EndDialog
LoadImageA
ShowWindow
SetWindowTextA
IsWindow
GetDlgItem
BeginPaint
SetWindowLongA
GetWindowLongA
SendMessageA
EndPaint
CharNextA
RedrawWindow
LoadStringA
IsWindowVisible
IsMenu
PostMessageA
CharLowerA
SetRect
UpdateWindow
DrawIconEx
LoadMenuA
DestroyMenu
MessageBoxA
CreatePopupMenu
AppendMenuA
GetMenuItemCount
EnableWindow
SetCursor
GetWindowTextA
GetWindowTextLengthA
SetRectEmpty
DefWindowProcA
ScreenToClient
GetCursorPos
ReleaseCapture
GetCapture
SetCapture
PtInRect
InvalidateRect
SetWindowPos
MapWindowPoints
SystemParametersInfoA
GetWindowRect
GetWindow
GetParent
FillRect
OffsetRect
DrawTextA
GetDC
DrawFocusRect
CallWindowProcA
ReleaseDC
DispatchMessageA
TranslateMessage
GetScrollInfo
SetScrollInfo
ScrollWindow
CallWindowProcW
IsWindowUnicode
SetWindowLongW
CharNextW
GetMenuItemRect
GetMessageA
PostThreadMessageA
GetDesktopWindow
CreateIconFromResourceEx
GetPropA
SetPropA
RemovePropA
FindWindowExA
InflateRect
CreateDialogParamA
SetDlgItemTextA
GetDlgItemTextA
CharUpperA
InsertMenuItemA
GetMenuState
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CopyImage
PeekMessageA
CallNextHookEx
DrawStateA
GetSystemMetrics
RegisterWindowMessageA
TrackPopupMenuEx
GetMessagePos
GetSysColorBrush
FrameRect
GetMenuItemInfoA
SetMenuItemInfoA
IsWindowEnabled
MessageBeep
GetTopWindow
MenuItemFromPoint
GetClassInfoA
GetDlgCtrlID
GetSysColor
GetWindowDC
GetMenuStringA
ModifyMenuA
WindowFromPoint
FindWindowA
LoadIconA
CopyRect
GetKeyState

gdi32

GetCurrentObject
ExcludeClipRect
GetClipBox
SetViewportOrgEx
GetDeviceCaps
DPtoLP
SaveDC
RestoreDC
CreateBitmap
GetTextColor
ExtTextOutA
Rectangle
BitBlt
CreateCompatibleBitmap
CreateSolidBrush
GetTextExtentPoint32A
GetPixel
TextOutA
CreateFontA
DeleteDC
SetTextColor
GetObjectA
CreateFontIndirectA
SetBkMode
SetBkColor
GetStockObject
CreatePen
SelectObject
MoveToEx
LineTo
CreateCompatibleDC
DeleteObject

advapi32

RegDeleteKeyA
GetUserNameA
RegSetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
EnumDependentServicesA
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
ChangeServiceConfigA
CloseServiceHandle
RegCreateKeyA
RegEnumKeyA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
DragQueryFileA
SHGetFileInfoA
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
SHGetSpecialFolderPathA

ole32

OleInitialize
CreateStreamOnHGlobal
GetHGlobalFromStream
OleUninitialize
CoCreateInstance
CoTaskMemAlloc
CoUninitialize
RegisterDragDrop
CoCreateGuid
StringFromGUID2
CoInitialize
ReleaseStgMedium
CoTaskMemRealloc
CoTaskMemFree
CoGetClassObject
RevokeDragDrop

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysStringByteLen
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
OleLoadPicture
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantChangeType
VariantInit
VariantCopy
SysAllocString
VariantClear
SysAllocStringLen
SysFreeString

shlwapi

PathRemoveFileSpecA
SHDeleteKeyA
PathFileExistsA
PathFindFileNameA
PathRemoveExtensionA
SHSetValueA
SHDeleteValueA
UrlUnescapeA
UrlEscapeA
StrRetToStrW
StrRetToStrA
PathIsDirectoryA
SHGetValueA
SHCopyKeyA
StrStrIA

oleacc

AccessibleObjectFromPoint

rpcrt4

UuidCreate

urlmon

CoInternetGetSession
URLDownloadToFileA

msimg32

TransparentBlt
AlphaBlend

msvcrt

_strcmpi
_stricmp
_wcsnicmp
_wcsupr
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_endthreadex
strncmp
_memicmp
_beginthread
_endthread
_local_unwind2
_strlwr
_mbspbrk
tolower
strncat
bsearch
qsort
_fullpath
fgets
printf
_vsnprintf
_CxxThrowException
_strnicmp
toupper
strstr
isxdigit
isalnum
_wstat
fputs
fseek
ftell
_mbsnbcmp
__RTDynamicCast
_ftol
strtod
atol
abs
fwrite
fread
_mbsnbcpy
_mbsicoll
sscanf
fopen
fprintf
fclose
_beginthreadex
calloc
localtime
atof
_snwprintf
wcsncpy
wcsstr
wcschr
_wcsicmp
iswdigit
swscanf
iswalpha
_mbstok
_mbsrchr
strcat
malloc
strcmp
wcscmp
memset
strncpy
strrchr
_stat
_snprintf
srand
rand
strcpy
strchr
_mbschr
_ismbcspace
_mbsnbicmp
memmove
memcmp
_except_handler3
free
realloc
_mbsicmp
_mbscmp
_purecall
time
atoi
_ismbcdigit
wcslen
sprintf
strlen
vsprintf
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
_mbsstr

wininet

InternetSetStatusCallback
FtpOpenFileA
InternetAttemptConnect
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
DeleteUrlCacheEntry
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
GetUrlCacheEntryInfoA
InternetQueryDataAvailable
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetSetFilePointer
HttpAddRequestHeadersA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetSetCookieA
InternetGetCookieA
InternetGetConnectedState
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindCloseUrlCache

setupapi

SetupIterateCabinetA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

iphlpapi

GetAdaptersInfo
GetNetworkParams

ws2_32

gethostname
gethostbyname

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Install
Uninstall

Sections

.text
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SOBARSH
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 228KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
img/imglist.bmp
img/logo.bmp
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 262KB

.ndata Size: - Virtual size: 272KB

.rsrc Size: 24KB - Virtual size: 28KB

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 494B

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

Imports

kernel32

msvcrt

shlwapi

Exports

Exports

Sections

.rdata Size: 1024B - Virtual size: 785B

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 164B

14dd304fe5b147e8ad61fe9c67382bce

Headers

File Characteristics

Imports

kernel32

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 262KB

.ndata
Size: - Virtual size: 272KB

.rsrc
Size: 24KB - Virtual size: 28KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.rdata
Size: 1024B - Virtual size: 785B

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 164B

.text
Size: 800KB - Virtual size: 799KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 68KB - Virtual size: 111KB

.idata
Size: 20KB - Virtual size: 16KB

.SOBARSH
Size: 4KB - Virtual size: 260B

.rsrc
Size: 228KB - Virtual size: 225KB

.reloc
Size: 60KB - Virtual size: 59KB