privateloader | 10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118
Size 18.0MB
Sample240503-lfc4xade94
SHA256 5c9f078e9a4f15bda5af2ed8aed826ecfd3e2af0d36458a0a582df8455a23e38
MD5 10307f9873c21ae7ec3f55b6ddc8e0c3
SHA1 8ffd3b047a3149ba5f845d652cc1bfa59f4b8d98
SHA512 6c448877f2c095dc0fe42452352b3b399eb0bc86fd47e880f48fd1e074b99a6cdb2509c49da76cfc4606b30688e8427a2e3e7404030148b864996473310c1ed4
SSDEEP 393216:dvTA8CGwmSdqZunrzB7Rq9Xam6M1BtyrgLbpzBo6OFQQpkREbL/Zv:tAIwmSMZurzzKngrSze6OFQqpZv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

privateloader

Malware Config

Signatures

Privateloader family
privateloader

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/4dotsLanguageDownloader.exe
unpack001/FreeMOVToMP3Converter.exe
unpack001/GlowButton.dll
unpack001/MediaSlider.dll
unpack001/Uninstall.exe
unpack002/$PLUGINSDIR/System.dll
unpack001/ffmpeg.exe
unpack001/mplayer.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2

File Explorer

10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118

.exe 18.0MB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/NSISAdditionalActionsPage.ini

339B
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/inetc.dll

.dll 20KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
4dotsLanguageDownloader.exe

.exe 70KB
Free MOV To MP3 Converter 4dots - User's Manual.url

.url 235B
FreeMOVToMP3Converter.exe

.exe 552KB
GlowButton.dll

.dll 18KB
MediaSlider.dll

.dll 78KB
Uninstall.exe

.exe 58KB
$PLUGINSDIR/System.dll

.dll 11KB
ffmpeg.exe

.exe 23.8MB
license_agreement.rtf

.rtf 4KB
mplayer.exe

.exe 16.5MB

10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 5c9f078e9a4f15bda5af2ed8aed826ecfd3e2af0d36458a0a582df8455a23e38
MD5 10307f9873c21ae7ec3f55b6ddc8e0c3
SHA1 8ffd3b047a3149ba5f845d652cc1bfa59f4b8d98
SHA512 6c448877f2c095dc0fe42452352b3b399eb0bc86fd47e880f48fd1e074b99a6cdb2509c49da76cfc4606b30688e8427a2e3e7404030148b864996473310c1ed4
SSDEEP 393216:dvTA8CGwmSdqZunrzB7Rq9Xam6M1BtyrgLbpzBo6OFQQpkREbL/Zv:tAIwmSMZurzzKngrSze6OFQqpZv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

4dotsLanguageDownloader.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 dbe1d24f9c97f0c35b84ad4112f0219c954206570e0fa458ca19145dda60030f
MD5 2d3f435d861ee8bfae18042db9c0dbe9
SHA1 ca14a8af462e9c23cc41549d56167dd493925a8f
SHA512 92a0e028c3dbbe0ad5595d00bb87948defd2f092e7e1b709bd13748b95e655e90d4d12725e5632abe5f8a8c8e8dd1d775d104fdb56670b1557dbce690263bca6
SSDEEP 1536:NzT2FFCy6ghQPmkXNQT2FFCy6ghQPmuc:kFR6ghQPmyNdFR6ghQPmuc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

47550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\code\Misc\4dotsLanguageDownloader\obj\Debug\4dotsLanguageDownloader.pdb

FreeMOVToMP3Converter.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 d2deba67d610a2577c1cab394288bf912551236d2b865af9c3118f1994e6664b
MD5 43aaff879b04b066ba3af58f928fe16a
SHA1 1184e52fd39d0df097f27086eaca679a9a2fa9da
SHA512 771e2cb6471358c4ec66aa23c9e48cbc1d9bd0458b733d9d9c76c77c9d864588ad1c45523e7ab6368e0523dec3796958aba15446fc67c2e0c3c80d1f9cecd75b
SSDEEP 12288:IBewdnVyN+uRQq0TVdWutgnLnbTvpOFFTyKbmbnz:6ewdnYSq0TVdafvpmTyqmbnz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

562794

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\code\Video Audio Tools\Video To MP3 Specific\FreeMOVToMP3Converter4dots\FreeFLACToMP3Converter4dots\bin\Debug\CryptoObfuscator_Output\FreeMOVToMP3Converter.pdb

GlowButton.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b04d657fcd67cc8cff1085198527bde1b7a6cd77e6ca2ca555be644d6b6b0b12
MD5 beedac13f12acb12160b7f77c5d0c62c
SHA1 82fc7c198f86e40c6b90ee0e71863039c008d821
SHA512 db9cf0689bb33c39d101260006abf671a9bc1346625a3f937e8a324456d8092cc52608805c7f80e2b0897f931c3dc6e8c42fe75cb05e50d735f787c36fc8bf90
SSDEEP 384:jn4zIf3R6GPysEatCOu7ppvoUbX4oB5MtvGKcSI:j4zIv4cEuCOu7bQ3oBmtLcZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

24974

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\codedoc\pwr\CustomGlowButton\obj\Debug\GlowButton.pdb

MediaSlider.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fc3370103c230793da648aecebcccaeec5ef4db020a98b1dfca7028dee25dc98
MD5 665e38cd34d6dc9daf6d68fa44a45385
SHA1 56c65655976520ef83ada37609dca2f011ecc45a
SHA512 b3eedc195188e8f396ea53810f2ed2576e38d99c221420516a06dce21defaf21321512e9af3860c06c4be25a2fa039206722a78240f8fb93692f40e5efd54429
SSDEEP 1536:NprC3/uFp32k4r4Rsq2DyK+uGnKHd+ODyFNddNDzE:NJ+/uFpJ4r4O6nKHwFND4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

85550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\codedoc\pwr\CustomMediaSlider\obj\Debug\MediaSlider.pdb

Uninstall.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 748cd532da3394957238ca58a9b8d3881ed17aaf8579641a71ba01ecf4d9876e
MD5 ed0c54013de9ebdb008732b7839e96c6
SHA1 4752a355df756f1e1cf0286dec6f34bd6c452d90
SHA512 a1b701161c9ab72a9569db76c2779f73961dac1afcea97551ba251db0a853f48648cbf74eed9572bc5eecf0c9d145fb89dd5abf97108f899e037a3a8d7073fd3
SSDEEP 1536:apgpHzb9dZVX9fHMvG0D3XJYgDagLeAyN/uYff2r:YgXdZt9P6D3XJYpceAfAOr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ffmpeg.exe

IMPHASH fc23b5da97ec23813074d3d73953756e
SHA256 0c9ad491564af3316cb7f829dc6b8c800f2921ad2f4fc443e23f43f09322837c
MD5 fa4c4259ff26da782fc45f48a5e3e7cf
SHA1 8c0bd9037eea294a000558cc1be951161d643bf2
SHA512 7d443cb26954b49df0aaacf671c238567fe975d638549bb7ecc4d9a05c9d2bef655d0e0f2d30ab86498a4d6ede9e33ebda6a0b6075098bbac3513a7eba4ad35d
SSDEEP 393216:4cUtOKBZz6S5rDI4j5TqxoDsPPfhGwQLp0dlHc:4cUtxprJRi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptGenRandom CryptReleaseContext DeregisterEventSource RegCloseKey RegOpenKeyExA RegQueryValueExA RegisterEventSourceA ReportEventA

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

crypt32

CertCloseStore CertEnumCertificatesInStore CertOpenSystemStoreA

gdi32

BitBlt ChoosePixelFormat CreateCompatibleBitmap CreateCompatibleDC CreateDCA CreateDIBSection CreatePalette DeleteDC DeleteObject DescribePixelFormat GetBitmapBits GetDIBits GetDeviceCaps GetDeviceGammaRamp GetObjectA GetSystemPaletteEntries GetSystemPaletteUse RealizePalette SelectObject SelectPalette SetDIBColorTable SetDeviceGammaRamp SetPaletteEntries SetPixelFormat SetSystemPaletteUse SwapBuffers UnrealizeObject

kernel32

AllocConsole CloseHandle CreateConsoleScreenBuffer CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileA FindNextFileA FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetConsoleCursorInfo GetConsoleMode GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExA GetFileType GetFullPathNameA GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleW GetNumberOfConsoleInputEvents GetProcAddress GetProcessAffinityMask GetProcessTimes GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalHandle GlobalLock GlobalMemoryStatus GlobalUnlock InitializeCriticalSection InterlockedDecrement InterlockedIncrement IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LocalFree MapViewOfFile MultiByteToWideChar OpenProcess PeekConsoleInputA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleInputA ReadFile ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread SetConsoleActiveScreenBuffer SetConsoleCursorInfo SetConsoleMode SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleTitleA SetConsoleWindowInfo SetEnvironmentVariableA SetErrorMode SetEvent SetFilePointer SetLastError SetProcessAffinityMask SetThreadAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepEx SuspendThread TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitNamedPipeW WideCharToMultiByte WriteConsoleOutputW WriteConsoleW WriteFile lstrcpyA lstrcpynA

msvcrt

__dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _beginthreadex _cexit _close _endthreadex _errno _exit _filelengthi64 _fileno _findclose _findnext _fmode _fstati64 _ftime _ftime64 _fullpath _get_osfhandle _getch _initterm _iob _isctype _lock _lseeki64 _mbsrchr _mkdir _mktemp _onexit _open _setjmp3 _setmode _snprintf _snwprintf _sopen _stat _stati64 _wstati64 time mktime localtime gmtime _strdup _stricmp _strnicmp _unlock calloc clock cosh div exit fclose feof ferror fflush fgetc fgetpos fgets fopen fprintf fputc fputs fread free frexp fscanf fseek fsetpos ftell fwprintf fwrite getc getchar getenv gmtime isalnum isalpha islower isprint isspace isupper isxdigit localeconv localtime log10 malloc memchr memcmp memcpy memmove memset perror printf putc putchar puts qsort raise rand realloc rename rewind setlocale setvbuf signal sinh sprintf srand sscanf strcat strchr strcmp strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtok strtol strtoul _vsnprintf _wfindnext _wfopen _wrename _write _wsopen _wunlink abort acos asin atan atan2 atof atoi atol bsearch tan tanh time tolower toupper ungetc vfprintf vsprintf wcscmp wcscpy wcslen wcsstr _wfindfirst _findfirst longjmp _hypot _write _wcsdup _unlink _tempnam _strdup _setmode _rmdir _read _putenv _open _kbhit _isatty _getpid _getch _fileno _fdopen _close _chmod _access

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize

psapi

GetProcessMemoryInfo

shell32

CommandLineToArgvW

user32

AdjustWindowRect AdjustWindowRectEx BeginPaint CallWindowProcA ChangeDisplaySettingsA ClientToScreen ClipCursor CreateCursor CreateIconFromResourceEx CreateWindowExA DefWindowProcA DestroyCursor DestroyIcon DestroyWindow DispatchMessageA EndPaint EnumDisplaySettingsA GetClassInfoA GetClientRect GetCursor GetCursorPos GetDC GetDesktopWindow GetForegroundWindow GetKeyState GetKeyboardLayout GetKeyboardLayoutNameA GetKeyboardState GetMenu GetMessageA GetParent GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW GetWindowLongA GetWindowRect InvalidateRect IsZoomed KillTimer LoadImageA LoadKeyboardLayoutA MapVirtualKeyA MapVirtualKeyExA MapWindowPoints MessageBoxA MessageBoxW MsgWaitForMultipleObjects PeekMessageA PostMessageA PostQuitMessage PtInRect RegisterClassA ReleaseCapture ReleaseDC ScreenToClient SendMessageA SetCapture SetClassLongA SetCursor SetCursorPos SetFocus SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow ToAsciiEx ToUnicode TranslateMessage UnregisterClassA WindowFromPoint wsprintfA

winmm

joyGetDevCapsA joyGetNumDevs joyGetPosEx mciGetErrorStringA mciSendCommandA timeBeginPeriod timeEndPeriod timeGetTime timeKillEvent timeSetEvent waveOutClose waveOutGetErrorTextA waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

ws2_32

WSACleanup WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSASetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getnameinfo getpeername getsockname getsockopt htonl htons inet_addr ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

17.6MB

Virtual Size

17.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

mplayer.exe

IMPHASH 9ac68409f7cd8b5e4597ca07021f41b9
SHA256 1e4c24708e22fc7b1e67e2f32acd0f5fa1cbc3ebbb9697be7fd853229be98aea
MD5 c9417da824ed6d392a1eb7a02c26f712
SHA1 2ffb3b79326f24714a8460a74f5af3b6b52147e6
SHA512 645a50f7c49f01d855b5641e9dd76b5f2ecb531da9265cf82af81208a143e69159549fa851c6e38b3342a3fdea115d33a40f82085eaf8046a017be176d3dcf9a
SSDEEP 196608:6gabkv/XiAWpWSn+VV0NXjHJEMHITIK32BNBlvxmQnz7uo9Nmy+s7sJ7e6So8c9k:2iKAWdn+OSWTU7sS7e6S5pNRUpRQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

5344

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext RegCloseKey RegCreateKeyExA RegSetValueExA

gdi32

ChoosePixelFormat CreateDCA CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat GetPixel GetPixelFormat GetStockObject SetPixel SetPixelFormat SwapBuffers

kernel32

AllocConsole CloseHandle CreateConsoleScreenBuffer CreateEventA CreateFileA CreateFileMappingA CreateSemaphoreA CreateThread DeleteCriticalSection DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FindResourceA FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileType GetFullPathNameA GetHandleInformation GetLastError GetLogicalDrives GetLongPathNameA GetModuleFileNameA GetModuleHandleA GetNumberOfConsoleInputEvents GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA HeapAlloc HeapFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleInputA ReadFile ReleaseSemaphore ResetEvent ResumeThread SetConsoleActiveScreenBuffer SetConsoleCursorInfo SetConsoleMode SetConsoleScreenBufferSize SetConsoleTextAttribute SetConsoleTitleA SetConsoleWindowInfo SetEnvironmentVariableA SetErrorMode SetEvent SetFilePointer SetLastError SetPriorityClass SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepEx SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteConsoleOutputW WriteConsoleW lstrlenA

msvcrt

_access _chmod _close _fdopen _fileno _getcwd _getpid _isatty _memccpy _open _putenv _read _rmdir _setmode _strdup _swab _unlink _write __dllonexit __doserrno __getmainargs __initenv __lconv_init __mb_cur_max __pioinfo __set_app_type __setusermatherr _acmdln _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _atoi64 _beginthread _beginthreadex _cexit _close _endthread _endthreadex _errno _exit _filelengthi64 _fileno _findclose _findfirst _findnext _fmode _fstati64 _ftime _fullpath _get_osfhandle _initterm _iob _lock _lseeki64 _mbsrchr _mkdir _onexit _open _open_osfhandle _osver _pclose _popen _setjmp3 _snprintf _stati64 _stricmp _strnicmp _sys_nerr _unlock _vsnprintf _wfindfirst _wfindnext _wfopen _wfullpath _wmkdir _wopen _write _wstati64 abort acos asin atan atan2 atof atoi atol bsearch calloc ceil clearerr clock cosh exit fclose feof ferror fflush fgetc fgetpos fgets floor fopen fprintf fputc fputs fread free freopen frexp fscanf fseek fsetpos ftell fwrite getc getenv gmtime isalnum isalpha iscntrl isgraph islower isprint ispunct isspace isupper isxdigit localeconv localtime log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset mktime perror printf putc putchar puts qsort raise rand realloc remove rename rewind setlocale setvbuf signal sinh sprintf srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtok strtol strtoul system tan tanh time tmpfile tmpnam tolower toupper ungetc vfprintf vsprintf wcscat wcscpy wcslen wcstombs

ole32

CoCreateInstance CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateItemMoniker GetRunningObjectTable

opengl32

glBegin glBlendFunc glCallList glCallLists glClear glClearColor glColor4f glColor4ub glColorMask glColorPointer glDeleteLists glDeleteTextures glDepthMask glDisable glDisableClientState glDrawArrays glDrawBuffer glEnable glEnableClientState glEnd glEndList glFinish glFlush glGenLists glGenTextures glGetBooleanv glGetError glGetIntegerv glGetString glGetTexImage glLoadIdentity glMatrixMode glNewList glOrtho glPixelStorei glPopMatrix glPushMatrix glReadBuffer glReadPixels glScaled glTexCoord2f glTexCoord2fv glTexCoordPointer glTexEnvi glTexImage1D glTexImage2D glTexParameterf glTexParameterfv glTexParameteri glTexSubImage2D glTranslated glVertex2f glVertexPointer glViewport wglCreateContext wglDeleteContext wglGetProcAddress wglMakeCurrent

shell32

CommandLineToArgvW ExtractIconA

user32

AdjustWindowRect ChangeDisplaySettingsA ClientToScreen CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EnableWindow EnumDisplayDevicesA EnumDisplaySettingsA FillRect GetClientRect GetDC GetDesktopWindow GetSystemMetrics GetWindowLongA IsWindow LoadCursorA LoadIconA MessageBoxA MoveWindow PeekMessageA RegisterClassExA ReleaseCapture ReleaseDC SendMessageA SetFocus SetWindowLongA SetWindowPos SetWindowTextA ShowCursor ShowWindow TranslateMessage UnregisterClassA wsprintfW

winmm

mciGetErrorStringA mciSendCommandA timeBeginPeriod timeEndPeriod timeGetTime

wldap32

ber_free ldap_err2string ldap_first_attribute ldap_first_entry ldap_get_dn ldap_get_values_len ldap_init ldap_memfree ldap_msgfree ldap_next_attribute ldap_next_entry ldap_search_s ldap_set_option ldap_simple_bind_s ldap_sslinit ldap_unbind_s ldap_value_free_len

ws2_32

WSACleanup WSAGetLastError WSASetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyname gethostname getnameinfo getpeername getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

luaL_addlstring luaL_addstring luaL_addvalue luaL_argerror luaL_buffinit luaL_buffinitsize luaL_callmeta luaL_checkany luaL_checkinteger luaL_checklstring luaL_checknumber luaL_checkoption luaL_checkstack luaL_checktype luaL_checkudata luaL_checkunsigned luaL_checkversion_ luaL_error luaL_execresult luaL_fileresult luaL_getmetafield luaL_getsubtable luaL_gsub luaL_len luaL_loadbufferx luaL_loadfilex luaL_loadstring luaL_newmetatable luaL_newstate luaL_openlib luaL_openlibs luaL_optinteger luaL_optlstring luaL_optnumber luaL_optunsigned luaL_prepbuffsize luaL_pushmodule luaL_pushresult luaL_pushresultsize luaL_ref luaL_requiref luaL_setfuncs luaL_setmetatable luaL_testudata luaL_tolstring luaL_traceback luaL_unref luaL_where lua_absindex lua_arith lua_atpanic lua_callk lua_checkstack lua_close lua_compare lua_concat lua_copy lua_createtable lua_dump lua_error lua_gc lua_getallocf lua_getctx lua_getfield lua_getglobal lua_gethook lua_gethookcount lua_gethookmask lua_getinfo lua_getlocal lua_getmetatable lua_getstack lua_gettable lua_gettop lua_getupvalue lua_getuservalue lua_insert lua_iscfunction lua_isnumber lua_isstring lua_isuserdata lua_len lua_load lua_newstate lua_newthread lua_newuserdata lua_next lua_pcallk lua_pushboolean lua_pushcclosure lua_pushfstring lua_pushinteger lua_pushlightuserdata lua_pushlstring lua_pushnil lua_pushnumber lua_pushstring lua_pushthread lua_pushunsigned lua_pushvalue lua_pushvfstring lua_rawequal lua_rawget lua_rawgeti lua_rawgetp lua_rawlen lua_rawset lua_rawseti lua_rawsetp lua_remove lua_replace lua_resume lua_setallocf lua_setfield lua_setglobal lua_sethook lua_setlocal lua_setmetatable lua_settable lua_settop lua_setupvalue lua_setuservalue lua_status lua_toboolean lua_tocfunction lua_tointegerx lua_tolstring lua_tonumberx lua_topointer lua_tothread lua_tounsignedx lua_touserdata lua_type lua_typename lua_upvalueid lua_upvaluejoin lua_version lua_xmove lua_yieldk luaopen_base luaopen_bit32 luaopen_coroutine luaopen_debug luaopen_io luaopen_math luaopen_os luaopen_package luaopen_string luaopen_table

Name

.text

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

215KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

245KB

Virtual Size

245KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/NSISAdditionalActionsPage.ini

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

4dotsLanguageDownloader.exe

mscoree

dotnet

Free MOV To MP3 Converter 4dots - User's Manual.url

FreeMOVToMP3Converter.exe

mscoree

dotnet

GlowButton.dll

mscoree

dotnet

MediaSlider.dll

mscoree

dotnet

Uninstall.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

ffmpeg.exe

advapi32

avicap32

crypt32

gdi32

kernel32

msvcrt