fba6840b58ae87afe5cdac893bd78132_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fba6840b58ae87afe5cdac893bd78132_JaffaCakes118
Size

2.5MB
MD5

fba6840b58ae87afe5cdac893bd78132
SHA1

be121fe7295679d11f37197ba08dfa473c4de06b
SHA256

e7fd141dc7f12962b7c47d62d2dc05aaaa76a98ac1c4f7640151962ae2aa9e2a
SHA512

7160ada8f23bc0bd2f761c3e753c4ba160f15e77234700f70898c19f9fd0415e6b83d2a1a5e65af78ffc2921d46b59f3ca49b68450b1b3d1f3c7d196a956f515
SSDEEP

49152:iQgwQC7BlHUeKBizyi7k3eNlwg5bg2MzxQVDJxUmnt3E6mpqf5aBUc+VYuQ:jgwQMDVg4tIOLk24QVDPUPvqfcBUcLp

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
fba6840b58ae87afe5cdac893bd78132_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/WmiInspector.dll
unpack001/$SYSDIR/qq.exe
unpack001/Zuma.exe
unpack001/bass.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

fba6840b58ae87afe5cdac893bd78132_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dfb06052e74b26a42b0e490bd1c07959

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 252KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 288KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
MessageBoxA
CallWindowProcA
PostMessageA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/WmiInspector.dll
.dll windows:4 windows x86 arch:x86

35e8b490cb254ba4b70b06fe54a9dae6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

r:\123\release\WmiInspector.pdb

Imports

kernel32

lstrcpynA
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalFree
lstrcpyA
FlushFileBuffers
CloseHandle
CreateFileA
GetLastError
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
LocalFree
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
WriteFile
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

ole32

CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
VariantInit
SysAllocStringByteLen
VariantClear
SysStringLen
SysAllocString

Exports

Exports

AntiVirus
CPU
FireWall
FullOS
FullSQLVersion
OS
OSVersion
Request
Resolution
SQLVersion
ShortUserName
UserName
UserSID

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/163pan.ico
$SYSDIR/55277.ico
$SYSDIR/ff.ico
$SYSDIR/guaiguaiyu.ico
$SYSDIR/houdao.ico
$SYSDIR/pvz.ico
$SYSDIR/qq.exe
.exe windows:4 windows x86 arch:x86

57221ad2e18bf822f1d27864669e331d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\VC6Work\OpenURL\Release\OpenURL.pdb

Imports

shell32

ShellExecuteA

kernel32

HeapReAlloc
GetSystemInfo
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetStartupInfoA
GetCommandLineA
GetVersionExA
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
HeapSize
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/qq.ico
$SYSDIR/setup.ico
$SYSDIR/tao.ico
$SYSDIR/wagamm.ico
Fonts/Arial12Bold.txt
Fonts/Cancun10.txt
Fonts/Cancun12.txt
Fonts/Cancun13.txt
Fonts/Cancun8.txt
Fonts/CancunFloat14.gif
.gif
Fonts/CancunFloat14.txt
Fonts/NativeAlien48.gif
.gif
Fonts/NativeAlien48.txt
Fonts/NativeAlienExtended16.gif
.gif
Fonts/NativeAlienExtended16.txt
Fonts/NativeAlienExtended18.gif
.gif
Fonts/NativeAlienExtended18.txt
Fonts/_Arial12Bold.gif
.gif
Fonts/_Cancun10.gif
.gif
Fonts/_Cancun12.gif
.gif
Fonts/_Cancun13.gif
.gif
Fonts/_Cancun8.gif
.gif
Fonts/_CancunFAT8.gif
.gif
Fonts/_CancunFloat14.gif
.gif
Fonts/_CancunOUTLINE10.gif
.gif
Fonts/_NativeAlien48.gif
.gif
Fonts/_NativeAlienExtended16.gif
.gif
Fonts/_NativeAlienExtended18.gif
.gif
Images/COIN.gif
.gif
Images/DialogButton.jpg
.jpg
Images/EYEBLINK.gif
.gif
Images/Explosion.gif
.gif
Images/GauntBackButton.jpg
.jpg
Images/GauntDoor1.jpg
.jpg
Images/GauntDoor2.jpg
.jpg
Images/GauntDoor3.jpg
.jpg
Images/GauntDoor4.jpg
.jpg
Images/GauntEagleGem.gif
.gif
Images/GauntHighscore.gif
.gif
Images/GauntJaguarGem.gif
.gif
Images/GauntMainMenuButton.jpg
.jpg
Images/GauntNextButton.jpg
.jpg
Images/GauntPlayButton.jpg
.jpg
Images/GauntSUNGEM.gif
.gif
Images/GauntTitle.gif
.gif
Images/GodHead.gif
.gif
Images/Hole.gif
.gif
Images/LoaderBar.gif
.gif
Images/MenuButton.jpg
.jpg
Images/Menubar.jpg
.jpg
Images/MoreGamesButton.gif
.gif
Images/MoreGamesScreen.jpg
.jpg
Images/SMALLFROGonPAD.gif
.gif
Images/SliderThumb.gif
.gif
Images/Thumbs.db
Images/ToadLives.gif
.gif
Images/Tongue.gif
.gif
Images/_COIN.gif
.gif
Images/_Dialogbutton.gif
.gif
Images/_GauntBackButton.gif
.gif
Images/_GauntDoor1.gif
.gif
Images/_GauntDoor2.gif
.gif
Images/_GauntDoor3.gif
.gif
Images/_GauntDoor4.gif
.gif
Images/_GauntEagleGem.gif
.gif
Images/_GauntHighscore.gif
.gif
Images/_GauntJaguarGem.gif
.gif
Images/_GauntMainMenuButton.gif
.gif
Images/_GauntNextButton.gif
.gif
Images/_GauntSUNGEM.gif
.gif
Images/_GauntScreen.gif
.gif
Images/_GauntTitle.gif
.gif
Images/_GodHead.gif
.gif
Images/_Hole.gif
.gif
Images/_LoaderBar.gif
.gif
Images/_Menubar.gif
.gif
Images/_Menubutton.gif
.gif
Images/_MoreGamesScreen.gif
.gif
Images/_SMALLFROGonPAD.gif
.gif
Images/_SliderThumb.gif
.gif
Images/_Tongue.gif
.gif
Images/_advHighscore.gif
.gif
Images/_advTitle.gif
.gif
Images/_advback.gif
.gif
Images/_advdoor1A.gif
.gif
Images/_advdoor1B.gif
.gif
Images/_advdoor1C.gif
.gif
Images/_advdoor2A.gif
.gif
Images/_advdoor2B.gif
.gif
Images/_advdoor2C.gif
.gif
Images/_advdoor3A.gif
.gif
Images/_advdoor3B.gif
.gif
Images/_advdoor3C.gif
.gif
Images/_advdoor4A.gif
.gif
Images/_advdoor4B.gif
.gif
Images/_advdoor4C.gif
.gif
Images/_advmainmenubutton.gif
.gif
Images/_advmiddle.gif
.gif
Images/_advplaybutton.gif
.gif
Images/_advtemple1.gif
.gif
Images/_advtemple2.gif
.gif
Images/_advtemple2v.gif
.gif
Images/_advtemple3.gif
.gif
Images/_advtemple3v.gif
.gif
Images/_advtemple4.gif
.gif
Images/_baAccuracyLight.gif
.gif
Images/_baBackwardsLight.gif
.gif
Images/_baBomb.gif
.gif
Images/_baLight.gif
.gif
Images/_baSlowLight.gif
.gif
Images/_ballalpha.gif
.gif
Images/_ballshadow.gif
.gif
Images/_checkBUtton.gif
.gif
Images/_checkboxcap.gif
.gif
Images/_checkboxsliver.gif
.gif
Images/_dialogbox.gif
.gif
Images/_gauge.gif
.gif
Images/_gauntpracticebutton.gif
.gif
Images/_gauntsurvivalbutton.gif
.gif
Images/_grayplosion.gif
.gif
Images/_hatchback.gif
.gif
Images/_helpfront.gif
.gif
Images/_mmARCADEBUTTON.gif
.gif
Images/_mmGAUNTLETBUTTON.gif
.gif
Images/_mmMOREGAMESBUTTON.gif
.gif
Images/_mmOPTIONSBUTTON.gif
.gif
Images/_mmQUITBUTTON.gif
.gif
Images/_mmUFO.gif
.gif
Images/_mmeyeleft.gif
.gif
Images/_mmeyemask.gif
.gif
Images/_mmeyeright.gif
.gif
Images/_mmhat.gif
.gif
Images/_mmscreen.gif
.gif
Images/_mmsun.gif
.gif
Images/_mmsunglow.jpg
.jpg
Images/_pitcover.gif
.gif
Images/_slidertrack.gif
.gif
Images/_toadlives.gif
.gif
Images/advHighscore.gif
.gif
Images/advback.jpg
.jpg
Images/advdoor1A.jpg
.jpg
Images/advdoor1B.jpg
.jpg
Images/advdoor1C.jpg
.jpg
Images/advdoor2A.jpg
.jpg
Images/advdoor2B.jpg
.jpg
Images/advdoor2C.jpg
.jpg
Images/advdoor3A.jpg
.jpg
Images/advdoor3B.jpg
.jpg
Images/advdoor3C.jpg
.jpg
Images/advdoor4A.jpg
.jpg
Images/advdoor4B.jpg
.jpg
Images/advdoor4C.jpg
.jpg
Images/advmainmenubutton.jpg
.jpg
Images/advmiddle.jpg
.jpg
Images/advplaybutton.jpg
.jpg
Images/advsky.jpg
.jpg
Images/advstage.gif
.gif
Images/advtemple1.jpg
.jpg
Images/advtemple2.jpg
.jpg
Images/advtemple2v.jpg
.jpg
Images/advtemple3.jpg
.jpg
Images/advtemple3v.jpg
.jpg
Images/advtemple4.jpg
.jpg
Images/advtitle.jpg
.jpg
Images/baAccuracyBlue.gif
.gif
Images/baAccuracyGreen.gif
.gif
Images/baAccuracyPurple.gif
.gif
Images/baAccuracyRed.gif
.gif
Images/baAccuracyWhite.gif
.gif
Images/baAccuracyYellow.gif
.gif
Images/baBackwardsBlue.gif
.gif
Images/baBackwardsGreen.gif
.gif
Images/baBackwardsPurple.gif
.gif
Images/baBackwardsRed.gif
.gif
Images/baBackwardsWhite.gif
.gif
Images/baBackwardsYellow.gif
.gif
Images/baBallBlue.gif
.gif
Images/baBallGreen.gif
.gif
Images/baBallPurple.gif
.gif
Images/baBallRed.gif
.gif
Images/baBallWhite.gif
.gif
Images/baBallYellow.gif
.gif
Images/baBombBlue.gif
.gif
Images/baBombGreen.gif
.gif
Images/baBombPurple.gif
.gif
Images/baBombRed.gif
.gif
Images/baBombWhite.gif
.gif
Images/baBombYellow.gif
.gif
Images/baDotz.gif
.gif
Images/baLightBlue.gif
.gif
Images/baLightGreen.gif
.gif
Images/baLightPurple.gif
.gif
Images/baLightRed.gif
.gif
Images/baLightWhite.gif
.gif
Images/baLightYellow.gif
.gif
Images/baSlowBlue.gif
.gif
Images/baSlowGreen.gif
.gif
Images/baSlowPurple.gif
.gif
Images/baSlowRed.gif
.gif
Images/baSlowWhite.gif
.gif
Images/baSlowYellow.gif
.gif
Images/checkBUtton.gif
.gif
Images/checkboxcap.gif
.gif
Images/checkboxsliver.gif
.gif
Images/cursor_dragging.gif
.gif
Images/cursor_dragging_.gif
.gif
Images/cursor_hand.gif
.gif
Images/cursor_hand_.gif
.gif
Images/cursor_pointer.gif
.gif
Images/cursor_pointer_.gif
.gif
Images/cursor_text.gif
.gif
Images/dialogbox.jpg
.jpg
Images/gauge.gif
.gif
Images/gaugegreen.gif
.gif
Images/gauntpracticebutton.jpg
.jpg
Images/gauntscreen.jpg
.jpg
Images/gauntsky.jpg
.jpg
Images/gauntsurvivalbutton.jpg
.jpg
Images/grayplosion.gif
.gif
Images/happyending.jpg
.jpg
Images/helpback.jpg
.jpg
Images/helpfront.jpg
.jpg
Zuma.exe
.exe windows:4 windows x86 arch:x86

f7c58dfcaf0e42d871716070b2fb95a5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
SetCurrentDirectoryA
GetTickCount
CreateEventA
GetCurrentThread
SetThreadPriority
CloseHandle
ResetEvent
WaitForSingleObject
EnterCriticalSection
LeaveCriticalSection
MulDiv
GetProcAddress
OutputDebugStringA
DeleteFileA
MultiByteToWideChar
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GetWindowsDirectoryA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
GetModuleHandleA
GetLastError
CreateMutexA
GetCommandLineA
FreeLibrary
LoadLibraryA
SetUnhandledExceptionFilter
GetCurrentProcess
VirtualQuery
QueryPerformanceCounter
QueryPerformanceFrequency
GetThreadPriority
InitializeCriticalSection
DeleteCriticalSection
GetVersionExA
IsBadWritePtr
SetErrorMode
InterlockedIncrement
SetEvent
GetFileTime
CreateFileA
WideCharToMultiByte
GetLocaleInfoA
RtlUnwind
RaiseException
ExitProcess
ExitThread
TlsSetValue
TlsGetValue
ResumeThread
CreateThread
TerminateProcess
GetStartupInfoA
HeapFree
IsBadReadPtr
GetSystemTimeAsFileTime
GetDriveTypeA
GetCurrentDirectoryA
GetFullPathNameA
HeapReAlloc
HeapAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetTimeFormatA
GetDateFormatA
CompareStringA
CompareStringW
GetStringTypeA
GetStringTypeW
TlsFree
SetLastError
TlsAlloc
GetCurrentProcessId
ReadFile
WriteFile
HeapSize
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
FlushFileBuffers
SetFilePointer
GetTimeZoneInformation
VirtualProtect
GetSystemInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadCodePtr
GetACP
GetOEMCP
SetStdHandle
SetEnvironmentVariableA
GetLocaleInfoW
SetEndOfFile
GetCurrentThreadId
InterlockedDecrement
Sleep
RemoveDirectoryA

winmm

timeGetTime
timeEndPeriod
timeBeginPeriod
mixerClose
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerSetControlDetails

wsock32

__WSAFDIsSet
select
WSACleanup
closesocket
recv
send
WSAGetLastError
ioctlsocket
inet_ntoa
gethostbyname
htons
connect
socket
WSAStartup

user32

DestroyWindow
ScreenToClient
GetCursorPos
LoadCursorA
SetCursor
MessageBoxA
CloseClipboard
SetClipboardData
OpenClipboard
EndDialog
MoveWindow
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
ReleaseCapture
SetCapture
WindowFromPoint
DispatchMessageA
TranslateMessage
PeekMessageA
SetFocus
GetClipboardData
GetWindowPlacement
SetTimer
CreateWindowExA
AdjustWindowRect
SetWindowLongA
SetForegroundWindow
DefWindowProcA
EndPaint
BeginPaint
GetWindowLongA
GetSystemMetrics
CreateCursor
RegisterClassA
LoadIconA
PostMessageA
RegisterWindowMessageA
DestroyCursor
GetWindowRect
GetMessageA
IsDialogMessageA
DrawTextA
FillRect
GetFocus
GetWindowTextA
GetSysColor
SetWindowTextA
GetSysColorBrush
GetDesktopWindow
ReleaseDC
GetClientRect
ClientToScreen
SystemParametersInfoA
ShowWindow
OffsetRect
DrawTextExA
CloseWindow
GetDC

gdi32

CreateFontA
GetTextMetricsA
TextOutA
SetTextColor
DeleteObject
CreateFontIndirectA
GetObjectA
SelectObject
GetDeviceCaps
CreateSolidBrush
GetTextExtentPoint32A
SetBkMode
IntersectClipRect

advapi32

RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegSetValueExA

shell32

ShellExecuteA

ole32

CoCreateInstance
CoInitialize

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 1012KB - Virtual size: 1010KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 335KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bass.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_Apply3D
BASS_CDDoor
BASS_CDFree
BASS_CDGetID
BASS_CDGetTrackLength
BASS_CDGetTracks
BASS_CDInDrive
BASS_CDInit
BASS_CDPlay
BASS_ChannelBytes2Seconds
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttributes
BASS_ChannelGetData
BASS_ChannelGetEAXMix
BASS_ChannelGetFlags
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelPause
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelResume
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttributes
BASS_ChannelSetDSP
BASS_ChannelSetEAXMix
BASS_ChannelSetFX
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttributes
BASS_ChannelStop
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetDSoundObject
BASS_GetDeviceDescription
BASS_GetEAXParameters
BASS_GetGlobalVolumes
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicGetChannelVol
BASS_MusicGetLength
BASS_MusicGetName
BASS_MusicLoad
BASS_MusicPlay
BASS_MusicPlayEx
BASS_MusicPreBuf
BASS_MusicSetAmplify
BASS_MusicSetChannelVol
BASS_MusicSetPanSep
BASS_MusicSetPositionScaler
BASS_Pause
BASS_RecordFree
BASS_RecordGetDeviceDescription
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleCreateDone
BASS_SampleFree
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SamplePlay
BASS_SamplePlay3D
BASS_SamplePlay3DEx
BASS_SamplePlayEx
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DAlgorithm
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetBufferLength
BASS_SetCLSID
BASS_SetEAXParameters
BASS_SetGlobalVolumes
BASS_SetLogCurves
BASS_SetNetConfig
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_StreamGetLength
BASS_StreamGetTags
BASS_StreamPlay
BASS_StreamPreBuf
BASS_Update
_

Sections

Size: 95KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

dfb06052e74b26a42b0e490bd1c07959

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 252KB

.ndata Size: - Virtual size: 288KB

.rsrc Size: 33KB - Virtual size: 32KB

0b51ce6ce6bf8d5c68b3ea9f3ac1bf2c

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

35e8b490cb254ba4b70b06fe54a9dae6

Headers

File Characteristics

PDB Paths

Imports

kernel32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 68KB - Virtual size: 66KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 176B

.reloc Size: 8KB - Virtual size: 6KB

57221ad2e18bf822f1d27864669e331d

Headers

File Characteristics

PDB Paths

Imports

shell32

kernel32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 2KB

.rsrc Size: 48KB - Virtual size: 47KB

f7c58dfcaf0e42d871716070b2fb95a5

Headers

File Characteristics

Imports

kernel32

winmm

wsock32

user32

gdi32

advapi32

shell32

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 252KB

.ndata
Size: - Virtual size: 288KB

.rsrc
Size: 33KB - Virtual size: 32KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 68KB - Virtual size: 66KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 48KB - Virtual size: 47KB

.text
Size: 1012KB - Virtual size: 1010KB

.rdata
Size: 192KB - Virtual size: 190KB

.data
Size: 24KB - Virtual size: 335KB

.rsrc
Size: 28KB - Virtual size: 25KB