fa453f436091b7c22d7b988248e9bf10_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fa453f436091b7c22d7b988248e9bf10_JaffaCakes118
Size

5.2MB
MD5

fa453f436091b7c22d7b988248e9bf10
SHA1

c6d819c6ac737cb6449dab202affb8cdc8873e6a
SHA256

fde191fd8ad2de5e40a7a2b51fee5019dbc86fb6641e9041037797f5c2ca5253
SHA512

248a582c4b36966497596513f0bf0f2f17b20968df7956e815109335fee0dd017871cbf593b60029215201b906f616378e771dbb0ec71801f892d3e80c736f71
SSDEEP

98304:JqMWQ+ou5qCgoAp6/0h29DZh2bxZa+TdFrY2IkAasLLOQJ+aGKnuwDsrFF7tRwJx:JqMB+ou5q6A60h2wbG+hFE9+Q9eLFl3c

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
fa453f436091b7c22d7b988248e9bf10_JaffaCakes118
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Dexclock.exe
unpack001/uninstall.exe
unpack006/$PLUGINSDIR/LangDLL.dll
unpack006/$PLUGINSDIR/UAC.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

Files

fa453f436091b7c22d7b988248e9bf10_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Dexclock/Clocks/cheshire_kitten1680x1050.wcz
.zip
am.png
.png
bg.jpg
.jpg
clock.ini
day1.png
.png
day10.png
.png
day11.png
.png
day12.png
.png
day13.png
.png
day14.png
.png
day15.png
.png
day16.png
.png
day17.png
.png
day18.png
.png
day19.png
.png
day2.png
.png
day20.png
.png
day21.png
.png
day22.png
.png
day23.png
.png
day24.png
.png
day25.png
.png
day26.png
.png
day27.png
.png
day28.png
.png
day29.png
.png
day3.png
.png
day30.png
.png
day31.png
.png
day4.png
.png
day5.png
.png
day6.png
.png
day7.png
.png
day8.png
.png
day9.png
.png
hour0.png
.png
hour1.png
.png
hour10.png
.png
hour11.png
.png
hour12.png
.png
hour13.png
.png
hour14.png
.png
hour15.png
.png
hour16.png
.png
hour17.png
.png
hour18.png
.png
hour19.png
.png
hour2.png
.png
hour20.png
.png
hour21.png
.png
hour22.png
.png
hour23.png
.png
hour3.png
.png
hour4.png
.png
hour5.png
.png
hour6.png
.png
hour7.png
.png
hour8.png
.png
hour9.png
.png
minute0.png
.png
minute1.png
.png
minute10.png
.png
minute11.png
.png
minute12.png
.png
minute13.png
.png
minute14.png
.png
minute15.png
.png
minute16.png
.png
minute17.png
.png
minute18.png
.png
minute19.png
.png
minute2.png
.png
minute20.png
.png
minute21.png
.png
minute22.png
.png
minute23.png
.png
minute24.png
.png
minute25.png
.png
minute26.png
.png
minute27.png
.png
minute28.png
.png
minute29.png
.png
minute3.png
.png
minute30.png
.png
minute31.png
.png
minute32.png
.png
minute33.png
.png
minute34.png
.png
minute35.png
.png
minute36.png
.png
minute37.png
.png
minute38.png
.png
minute39.png
.png
minute4.png
.png
minute40.png
.png
minute41.png
.png
minute42.png
.png
minute43.png
.png
minute44.png
.png
minute45.png
.png
minute46.png
.png
minute47.png
.png
minute48.png
.png
minute49.png
.png
minute5.png
.png
minute50.png
.png
minute51.png
.png
minute52.png
.png
minute53.png
.png
minute54.png
.png
minute55.png
.png
minute56.png
.png
minute57.png
.png
minute58.png
.png
minute59.png
.png
minute6.png
.png
minute7.png
.png
minute8.png
.png
minute9.png
.png
month1.png
.png
month10.png
.png
month11.png
.png
month12.png
.png
month2.png
.png
month3.png
.png
month4.png
.png
month5.png
.png
month6.png
.png
month7.png
.png
month8.png
.png
month9.png
.png
pm.png
.png
preview100x75.jpg
.jpg
preview200x150.jpg
.jpg
weekday1.png
.png
weekday2.png
.png
weekday3.png
.png
weekday4.png
.png
weekday5.png
.png
weekday6.png
.png
weekday7.png
.png
$APPDATA/Dexclock/Clocks/kiwikiwi1600x1200.wcz
.zip
am.png
.png
bg.jpg
.jpg
clock.ini
day1.png
.png
day10.png
.png
day11.png
.png
day12.png
.png
day13.png
.png
day14.png
.png
day15.png
.png
day16.png
.png
day17.png
.png
day18.png
.png
day19.png
.png
day2.png
.png
day20.png
.png
day21.png
.png
day22.png
.png
day23.png
.png
day24.png
.png
day25.png
.png
day26.png
.png
day27.png
.png
day28.png
.png
day29.png
.png
day3.png
.png
day30.png
.png
day31.png
.png
day4.png
.png
day5.png
.png
day6.png
.png
day7.png
.png
day8.png
.png
day9.png
.png
hour0.png
.png
hour1.png
.png
hour10.png
.png
hour11.png
.png
hour12.png
.png
hour13.png
.png
hour14.png
.png
hour15.png
.png
hour16.png
.png
hour17.png
.png
hour18.png
.png
hour19.png
.png
hour2.png
.png
hour20.png
.png
hour21.png
.png
hour22.png
.png
hour23.png
.png
hour3.png
.png
hour4.png
.png
hour5.png
.png
hour6.png
.png
hour7.png
.png
hour8.png
.png
hour9.png
.png
minute0.png
.png
minute1.png
.png
minute10.png
.png
minute11.png
.png
minute12.png
.png
minute13.png
.png
minute14.png
.png
minute15.png
.png
minute16.png
.png
minute17.png
.png
minute18.png
.png
minute19.png
.png
minute2.png
.png
minute20.png
.png
minute21.png
.png
minute22.png
.png
minute23.png
.png
minute24.png
.png
minute25.png
.png
minute26.png
.png
minute27.png
.png
minute28.png
.png
minute29.png
.png
minute3.png
.png
minute30.png
.png
minute31.png
.png
minute32.png
.png
minute33.png
.png
minute34.png
.png
minute35.png
.png
minute36.png
.png
minute37.png
.png
minute38.png
.png
minute39.png
.png
minute4.png
.png
minute40.png
.png
minute41.png
.png
minute42.png
.png
minute43.png
.png
minute44.png
.png
minute45.png
.png
minute46.png
.png
minute47.png
.png
minute48.png
.png
minute49.png
.png
minute5.png
.png
minute50.png
.png
minute51.png
.png
minute52.png
.png
minute53.png
.png
minute54.png
.png
minute55.png
.png
minute56.png
.png
minute57.png
.png
minute58.png
.png
minute59.png
.png
minute6.png
.png
minute7.png
.png
minute8.png
.png
minute9.png
.png
month1.png
.png
month10.png
.png
month11.png
.png
month12.png
.png
month2.png
.png
month3.png
.png
month4.png
.png
month5.png
.png
month6.png
.png
month7.png
.png
month8.png
.png
month9.png
.png
pm.png
.png
preview100x75.jpg
.jpg
preview200x150.jpg
.jpg
weekday1.png
.png
weekday2.png
.png
weekday3.png
.png
weekday4.png
.png
weekday5.png
.png
weekday6.png
.png
weekday7.png
.png
$APPDATA/Dexclock/Clocks/lettereater1600x1200.wcz
.zip
am.png
.png
bg.jpg
.jpg
clock.ini
day1.png
.png
day10.png
.png
day11.png
.png
day12.png
.png
day13.png
.png
day14.png
.png
day15.png
.png
day16.png
.png
day17.png
.png
day18.png
.png
day19.png
.png
day2.png
.png
day20.png
.png
day21.png
.png
day22.png
.png
day23.png
.png
day24.png
.png
day25.png
.png
day26.png
.png
day27.png
.png
day28.png
.png
day29.png
.png
day3.png
.png
day30.png
.png
day31.png
.png
day4.png
.png
day5.png
.png
day6.png
.png
day7.png
.png
day8.png
.png
day9.png
.png
hour0.png
.png
hour1.png
.png
hour10.png
.png
hour11.png
.png
hour12.png
.png
hour13.png
.png
hour14.png
.png
hour15.png
.png
hour16.png
.png
hour17.png
.png
hour18.png
.png
hour19.png
.png
hour2.png
.png
hour20.png
.png
hour21.png
.png
hour22.png
.png
hour23.png
.png
hour3.png
.png
hour4.png
.png
hour5.png
.png
hour6.png
.png
hour7.png
.png
hour8.png
.png
hour9.png
.png
minute0.png
.png
minute1.png
.png
minute10.png
.png
minute11.png
.png
minute12.png
.png
minute13.png
.png
minute14.png
.png
minute15.png
.png
minute16.png
.png
minute17.png
.png
minute18.png
.png
minute19.png
.png
minute2.png
.png
minute20.png
.png
minute21.png
.png
minute22.png
.png
minute23.png
.png
minute24.png
.png
minute25.png
.png
minute26.png
.png
minute27.png
.png
minute28.png
.png
minute29.png
.png
minute3.png
.png
minute30.png
.png
minute31.png
.png
minute32.png
.png
minute33.png
.png
minute34.png
.png
minute35.png
.png
minute36.png
.png
minute37.png
.png
minute38.png
.png
minute39.png
.png
minute4.png
.png
minute40.png
.png
minute41.png
.png
minute42.png
.png
minute43.png
.png
minute44.png
.png
minute45.png
.png
minute46.png
.png
minute47.png
.png
minute48.png
.png
minute49.png
.png
minute5.png
.png
minute50.png
.png
minute51.png
.png
minute52.png
.png
minute53.png
.png
minute54.png
.png
minute55.png
.png
minute56.png
.png
minute57.png
.png
minute58.png
.png
minute59.png
.png
minute6.png
.png
minute7.png
.png
minute8.png
.png
minute9.png
.png
month1.png
.png
month10.png
.png
month11.png
.png
month12.png
.png
month2.png
.png
month3.png
.png
month4.png
.png
month5.png
.png
month6.png
.png
month7.png
.png
month8.png
.png
month9.png
.png
pm.png
.png
preview100x75.jpg
.jpg
preview200x150.jpg
.jpg
weekday1.png
.png
weekday2.png
.png
weekday3.png
.png
weekday4.png
.png
weekday5.png
.png
weekday6.png
.png
weekday7.png
.png
$APPDATA/Dexclock/Clocks/squares11680x1050.wcz
.zip
am.png
.png
bg.jpg
.jpg
clock.ini
day1.png
.png
day10.png
.png
day11.png
.png
day12.png
.png
day13.png
.png
day14.png
.png
day15.png
.png
day16.png
.png
day17.png
.png
day18.png
.png
day19.png
.png
day2.png
.png
day20.png
.png
day21.png
.png
day22.png
.png
day23.png
.png
day24.png
.png
day25.png
.png
day26.png
.png
day27.png
.png
day28.png
.png
day29.png
.png
day3.png
.png
day30.png
.png
day31.png
.png
day4.png
.png
day5.png
.png
day6.png
.png
day7.png
.png
day8.png
.png
day9.png
.png
hour0.png
.png
hour1.png
.png
hour10.png
.png
hour11.png
.png
hour12.png
.png
hour13.png
.png
hour14.png
.png
hour15.png
.png
hour16.png
.png
hour17.png
.png
hour18.png
.png
hour19.png
.png
hour2.png
.png
hour20.png
.png
hour21.png
.png
hour22.png
.png
hour23.png
.png
hour3.png
.png
hour4.png
.png
hour5.png
.png
hour6.png
.png
hour7.png
.png
hour8.png
.png
hour9.png
.png
minute0.png
.png
minute1.png
.png
minute10.png
.png
minute11.png
.png
minute12.png
.png
minute13.png
.png
minute14.png
.png
minute15.png
.png
minute16.png
.png
minute17.png
.png
minute18.png
.png
minute19.png
.png
minute2.png
.png
minute20.png
.png
minute21.png
.png
minute22.png
.png
minute23.png
.png
minute24.png
.png
minute25.png
.png
minute26.png
.png
minute27.png
.png
minute28.png
.png
minute29.png
.png
minute3.png
.png
minute30.png
.png
minute31.png
.png
minute32.png
.png
minute33.png
.png
minute34.png
.png
minute35.png
.png
minute36.png
.png
minute37.png
.png
minute38.png
.png
minute39.png
.png
minute4.png
.png
minute40.png
.png
minute41.png
.png
minute42.png
.png
minute43.png
.png
minute44.png
.png
minute45.png
.png
minute46.png
.png
minute47.png
.png
minute48.png
.png
minute49.png
.png
minute5.png
.png
minute50.png
.png
minute51.png
.png
minute52.png
.png
minute53.png
.png
minute54.png
.png
minute55.png
.png
minute56.png
.png
minute57.png
.png
minute58.png
.png
minute59.png
.png
minute6.png
.png
minute7.png
.png
minute8.png
.png
minute9.png
.png
month1.png
.png
month10.png
.png
month11.png
.png
month12.png
.png
month2.png
.png
month3.png
.png
month4.png
.png
month5.png
.png
month6.png
.png
month7.png
.png
month8.png
.png
month9.png
.png
pm.png
.png
preview100x75.jpg
.jpg
preview200x150.jpg
.jpg
weekday1.png
.png
weekday2.png
.png
weekday3.png
.png
weekday4.png
.png
weekday5.png
.png
weekday6.png
.png
weekday7.png
.png
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GetACP
lstrlenA
lstrcmpA
lstrcpynA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/OCSetupHlp.dll
.dll regsvr32 windows:5 windows x86 arch:x86

23bc068733931994f44febb1ad7e7e5e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:7d:6c:78:6d:7c:a9:02:80:6d:31:ac:8d:42:9b:5d:0c:79:61:cd
Signer

Actual PE Digest

fc:7d:6c:78:6d:7c:a9:02:80:6d:31:ac:8d:42:9b:5d:0c:79:61:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
GetTempPathW
DeleteFileW
WriteFile
ProcessIdToSessionId
SetLastError
HeapAlloc
GetProcessHeap
HeapFree
ExpandEnvironmentStringsW
CreateDirectoryW
WaitForSingleObject
FlushInstructionCache
GetCurrentThreadId
OutputDebugStringW
lstrcpynW
MulDiv
CreateMutexW
OpenMutexW
ReleaseMutex
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
GetShortPathNameW
SetFilePointer
CreateEventW
GlobalFree
ResumeThread
FreeResource
SetEvent
ResetEvent
GetTickCount
CreateProcessW
MoveFileExW
CreateFileW
GetFileAttributesW
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetErrorMode
CreateFileA
lstrlenA
WideCharToMultiByte
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
GetVersion
GetTempFileNameW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemInfo
GetVersionExW
FileTimeToSystemTime
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
GetCurrentProcess
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetThreadLocale
GetLastError
SetThreadLocale
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
GlobalUnlock
GlobalLock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
Sleep
CreateThread
FindResourceExW
FindResourceW
LoadResource
LockResource
GetCurrentDirectoryA
SizeofResource

psapi

GetProcessImageFileNameW
EnumProcesses

ws2_32

select
WSACleanup
WSAStartup
closesocket
WSAGetLastError
socket
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
__WSAFDIsSet
getaddrinfo
gethostname
ioctlsocket
freeaddrinfo

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

GetCursorPos
TrackPopupMenu
ReleaseCapture
DrawFocusRect
UnregisterClassA
GetCursor
SetCursor
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
IsWindow
DestroyWindow
PostQuitMessage
KillTimer
DestroyMenu
PeekMessageW
MsgWaitForMultipleObjects
NotifyWinEvent
FindWindowW
ScreenToClient
GetSysColor
GetUpdateRect
SetRect
GetAncestor
SetFocus
CreateDialogParamW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SetTimer
PostMessageW
GetWindowTextLengthW
GetWindowTextW
EnumChildWindows
EnumWindows
ShowWindow
GetDlgItem
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadIconW
SendMessageW
SetWindowTextW
GetClientRect
MoveWindow
SystemParametersInfoW
SetWindowsHookExW
DrawIconEx
GetIconInfo
SetMenuItemInfoW
IsWindowVisible
SetForegroundWindow
SetDlgItemTextW
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
LoadImageW
MessageBoxW
DrawTextW
MapWindowPoints
GetParent
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetDesktopWindow
CharNextW
FillRect
InvalidateRect
GetAsyncKeyState
PtInRect
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetWindowRect
EndPaint
BeginPaint
GetForegroundWindow
ReleaseDC
GetDC
GetSysColorBrush
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos

gdi32

GetStockObject
GetTextExtentPoint32W
GetObjectW
SetTextColor
CreatePatternBrush
CreateDIBSection
GetDeviceCaps
DeleteDC
DeleteObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GdiFlush
DPtoLP
BitBlt
SetViewportOrgEx
CreateSolidBrush
SetBkMode
CreateFontIndirectW

advapi32

OpenProcessToken
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
GetTokenInformation
DuplicateTokenEx
LookupAccountSidW
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
GetUserNameW
RegEnumKeyW

shell32

SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteW

ole32

CoInitializeSecurity
CoInitialize
CreateStreamOnHGlobal
CLSIDFromProgID
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
StringFromGUID2
CoTaskMemRealloc

oleaut32

LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysStringLen
VariantClear
SysAllocStringLen
VariantChangeType
LoadRegTypeLi
OleLoadPicture
SysAllocString
VariantInit

comctl32

InitCommonControlsEx

gdiplus

GdipCloneImage
GdipLoadImageFromFile
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImagePointRectI

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD402OpenCandy1
OCPRD402OpenCandy10
OCPRD402OpenCandy11
OCPRD402OpenCandy12
OCPRD402OpenCandy13
OCPRD402OpenCandy14
OCPRD402OpenCandy15
OCPRD402OpenCandy16
OCPRD402OpenCandy17
OCPRD402OpenCandy18
OCPRD402OpenCandy19
OCPRD402OpenCandy20
OCPRD402OpenCandy21
OCPRD402OpenCandy22
OCPRD402OpenCandy23
OCPRD402OpenCandy24
OCPRD402OpenCandy29
OCPRD402OpenCandy30
OCPRD402OpenCandy31
OCPRD402OpenCandy32
OCPRD402OpenCandy33
OCPRD402OpenCandy34
OCPRD402OpenCandy35
OCPRD402OpenCandy36
OCPRD402OpenCandy37
OCPRD402OpenCandy38
OCPRD402OpenCandy39
OCPRD402OpenCandy40
OCPRD402OpenCandy41
OCPRD402OpenCandy42
OCPRD402OpenCandy44
OCPRD402OpenCandy45
OCPRD402OpenCandy46
OCPRD402OpenCandy47
OCPRD402OpenCandy48
OCPRD402OpenCandy49
OCPRD402OpenCandy5
OCPRD402OpenCandy50
OCPRD402OpenCandy51
OCPRD402OpenCandy52
OCPRD402OpenCandy53
OCPRD402OpenCandy54
OCPRD402OpenCandy55
OCPRD402OpenCandy6
OCPRD402OpenCandy7
OCPRD402OpenCandy8
OCPRD402OpenCandy9
_OCPRD402OpenCandy25@12
_OCPRD402OpenCandy26@16
_OCPRD402OpenCandy27@16
_OCPRD402OpenCandy28@16
_OCPRD402OpenCandy2@16
_OCPRD402OpenCandy3@16
_OCPRD402OpenCandy43@16
_OCPRD402OpenCandy4@16

Sections

.text
Size: 529KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

2274cc1534607459cdd304a928601ef9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
GlobalAlloc
lstrlenA
lstrcpynA
GetVersionExA
lstrcmpiA
GetCurrentThreadId
LoadLibraryA
FreeLibrary
GetLastError
GetExitCodeProcess
WaitForSingleObject
DuplicateHandle
Sleep
GetCurrentProcessId
CreateThread
GetCommandLineA
OpenProcess
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
SetLastError
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA

user32

SendMessageW
DialogBoxParamA
CharNextA
UnhookWindowsHookEx
CallNextHookEx
GetClassNameA
SetWindowsHookExA
SendMessageTimeoutA
WaitForInputIdle
DefWindowProcA
PostMessageA
GetLastActivePopup
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
GetWindowTextA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
IsWindow
GetWindowThreadProcessId
MessageBoxA
SetWindowLongA
LoadImageA
DestroyWindow
GetWindowLongA
EnableWindow
ShowWindow
SetWindowTextA
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
EndDialog

advapi32

RegCloseKey
QueryServiceStatus
OpenServiceA
CloseServiceHandle
OpenSCManagerA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize
CoUninitialize

Exports

Exports

Exec
ExecCodeSegment
ExecWait
GetElevationType
GetOuterHwnd
GetShellFolderPath
IsAdmin
RunElevated
ShellExec
ShellExecWait
StackPush
SupportsUAC
Unload

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dexclock.exe
.exe windows:5 windows x86 arch:x86

04f62e2dae5587873bc5ee5aefc6eff2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Patrick\Desktop\dexclock\trunk\Release\Dexclock.pdb

Imports

gdiplus

GdipFree
GdipGetImageWidth
GdipSaveImageToFile
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectI
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipGetImageHeight
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFile
GdipDisposeImage
GdipAlloc

comctl32

ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
ImageList_Destroy

kernel32

GetLocaleInfoW
LoadLibraryA
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
MoveFileExW
WaitForSingleObject
SetEvent
CreateEventW
CloseHandle
DeleteFileW
CreateThread
GetCommandLineW
CopyFileW
GetVersionExW
GetFileAttributesW
GetModuleFileNameW
GetPrivateProfileSectionW
FindFirstFileW
GetPrivateProfileStringW
FindClose
FindNextFileW
GetPrivateProfileIntW
RemoveDirectoryW
WriteFile
WideCharToMultiByte
CreateFileW
GetConsoleCP
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetStringTypeA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
ExitProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetTimeZoneInformation
GetModuleFileNameA
GetStdHandle
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
CreateFileA
CompareStringA
FlushFileBuffers
CompareStringW
SetEnvironmentVariableA
ReadFile
SetEndOfFile
GetProcessHeap
SetFilePointer
GetModuleHandleA
LCMapStringA
LCMapStringW
GetCPInfo
RtlUnwind
RaiseException
GetStartupInfoW
HeapAlloc
HeapFree
GetProcAddress
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
GetStringTypeW

user32

GetMessageW
EnableWindow
IsIconic
GetWindowTextW
ShowWindow
CreateDialogParamW
IsWindow
GetDlgItemTextW
SetDlgItemTextW
DestroyWindow
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
UnregisterClassW
SetForegroundWindow
LoadCursorW
FindWindowW
InsertMenuItemW
TranslateMessage
GetCursorPos
CreatePopupMenu
CreateWindowExW
RegisterClassW
DestroyMenu
DefWindowProcW
DispatchMessageW
SendNotifyMessageW
SetTimer
SendMessageW
KillTimer
SystemParametersInfoW
PeekMessageW
PostThreadMessageW
LoadImageW
PostMessageW
IsWindowEnabled
GetDlgItem
SetWindowTextW

gdi32

GetStockObject
DeleteObject

advapi32

RegCloseKey
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

CommandLineToArgvW
ord165
ShellExecuteW
SHGetFolderPathW
Shell_NotifyIconW
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

CoTaskMemFree

Sections

.text
Size: 235KB - Virtual size: 234KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lang/de_de.ini
lang/en_us.ini
lang/hu_hu.ini
lang/ja_jp.ini
lang/ru_ru.ini
lang/tr_tr.ini
lang/zh_cn.ini
license.txt
lizenz.txt
uninstall.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 100KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GetACP
lstrlenA
lstrcmpA
lstrcpynA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

2274cc1534607459cdd304a928601ef9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateProcessA
GlobalAlloc
lstrlenA
lstrcpynA
GetVersionExA
lstrcmpiA
GetCurrentThreadId
LoadLibraryA
FreeLibrary
GetLastError
GetExitCodeProcess
WaitForSingleObject
DuplicateHandle
Sleep
GetCurrentProcessId
CreateThread
GetCommandLineA
OpenProcess
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
SetLastError
GetModuleFileNameA
GetPrivateProfileIntA
GetPrivateProfileStringA
GetProcAddress
GetModuleHandleA

user32

SendMessageW
DialogBoxParamA
CharNextA
UnhookWindowsHookEx
CallNextHookEx
GetClassNameA
SetWindowsHookExA
SendMessageTimeoutA
WaitForInputIdle
DefWindowProcA
PostMessageA
GetLastActivePopup
PostQuitMessage
SetForegroundWindow
DispatchMessageA
GetMessageA
CreateWindowExA
RegisterClassA
UnregisterClassA
GetWindowTextA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
IsWindow
GetWindowThreadProcessId
MessageBoxA
SetWindowLongA
LoadImageA
DestroyWindow
GetWindowLongA
EnableWindow
ShowWindow
SetWindowTextA
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
EndDialog

advapi32

RegCloseKey
QueryServiceStatus
OpenServiceA
CloseServiceHandle
OpenSCManagerA
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize
CoUninitialize

Exports

Exports

Exec
ExecCodeSegment
ExecWait
GetElevationType
GetOuterHwnd
GetShellFolderPath
IsAdmin
RunElevated
ShellExec
ShellExecWait
StackPush
SupportsUAC
Unload

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 100KB

.rsrc Size: 77KB - Virtual size: 76KB

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 320B

23bc068733931994f44febb1ad7e7e5e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fc:7d:6c:78:6d:7c:a9:02:80:6d:31:ac:8d:42:9b:5d:0c:79:61:cdSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

psapi

ws2_32

msimg32

shlwapi

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

gdiplus

version

urlmon

wininet

Exports

Exports

Sections

.text Size: 529KB - Virtual size: 528KB

.rdata Size: 167KB - Virtual size: 166KB

.data Size: 10KB - Virtual size: 21KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 100KB

.rsrc
Size: 77KB - Virtual size: 76KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 320B

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fc:7d:6c:78:6d:7c:a9:02:80:6d:31:ac:8d:42:9b:5d:0c:79:61:cd
Signer

.text
Size: 529KB - Virtual size: 528KB

.rdata
Size: 167KB - Virtual size: 166KB

.data
Size: 10KB - Virtual size: 21KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 32KB - Virtual size: 32KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 13KB - Virtual size: 12KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

.text
Size: 235KB - Virtual size: 234KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 16KB

.rsrc
Size: 108KB - Virtual size: 108KB

.reloc
Size: 15KB - Virtual size: 14KB