11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118

resource
11e12e0c4d93c8d9f2efc3787cc100c0_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/ShellLink.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/GoogleTranslator.dll
unpack001/ShaPlus Translator.exe
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 777730664beeade5b6f7b22e8dab7682caa8dfa1456b4c503be930f857265cea
MD5 11e12e0c4d93c8d9f2efc3787cc100c0
SHA1 12b61e351415a72f67afe5e7d6650c1443b47413
SHA512 7ecc0f2582171b5660b51fef1e2a54464450163a382d6818f68727e23668d5007ee7e19e0afcec0d6780a7864ed41ebb85dead3eeb5eaedd999d4dc8521525ce
SSDEEP 3072:fLk395hYXJkmCQMpywCP9EuToe4kNnuB6J0y0dxXiQbLUd/FVhfY2V7kl:fQq6mCQMpLCF1gSnuAJ0y0dxXXLUxFv+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/ShellLink.dll

IMPHASH ac2c09e68d5518a91b4912bdf6a67d1b
SHA256 b96b39cb4ad98f4820b6fd17b67e43d8d0f4b2667d50caa46eff44af245d75bb
MD5 073d44e11a4bcff06e72e1ebfe5605f7
SHA1 5f4e85ab7a1a636d95b50479a10bcb5583af93f3
SHA512 e9f99b96334764ae47aa026f7f24cfb736859a9131bd1c5ec7e070e830b651787f49910911f82e4ade0dc62fea0ad54ba210b07e44830eb2be6abb710a418a98
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH a648aeaa164b592c1e8892a10400b5ae
SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
MD5 a4173b381625f9f12aadb4e1cdaefdb8
SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6391

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/hotkey.ini

SHA256 b2bc8b60b0daee4496c0574bee6a434b117a7724235b0593dac2cef4351dd3ad
MD5 10dac4d611ff7145d79b67e32adfbb9c
SHA1 718b1ec71f4ca424e838f3a58ff3ec63e680967f
SHA512 f016b889859a155a0f1e334b0a72a37b55757fa92a5661e28a752079fdc49fcb6c8ce85377237ec41223b17eb02ff786f4b5a23008d70684569503c0d5d51b24
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$R0

SHA256 0add1bbbbfe844e106ab1373d0c38a9e44dc4b122b562e66ad81adaa15b22a41
MD5 0b6ef2011a4be698aa6e7be1278574e1
SHA1 c2c851d037df6a14dcfc94b725794dd62cb78648
SHA512 8d43a2d2ce69d150ce41b0a633ca0f5011a31912c2902ab81c23e9cea32670509243694ea76db103ebed3744286bd059bef8055bbaad10d036ecdcd124c8b41c
MD5 SHA1 SHA512

NSIS installer

installer

GoogleTranslator.dll

IMPHASH dc2d6b8359dd2ecb5258e7d931696e09
SHA256 1eda6b53b2baa94ed7e6b234b7e1293de965264998155cec64db9c2c994e2463
MD5 b65c33a946268df95bb3e3c4a23fc355
SHA1 4242015823ad88f9a4c1f5418f209988030cd5af
SHA512 a784b68ad612ea5d145658df4b23ec8789b99199cda738cd74e769dbded8233a0729e7781829f20774ce8abb5890bc47c7a9253560554af46adb84c125c380a5
SSDEEP 1536:ZjS0Caz5oZKs8+R+qKS8WqlZ6isBw9agS5Hl5rWeycltHfw0+4+A+L+8Ehrtop5W:ZjS0lz5oZFiEisnNX4vre/kvqcKDp
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7088

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr __vbaAptOffset ord696 __vbaFreeVarList _adj_fdiv_m64 ord698 ord512 __vbaRaiseEvent __vbaFreeObjList ord516 _adj_fprem1 __vbaVarSetVarAddref __vbaResume __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaVarIndexLoadRefLock __vbaExitProc ord301 __vbaObjSet __vbaOnError ord595 _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 ord520 ord307 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 ord632 __vbaChkstk EVENT_SINK_AddRef ord528 __vbaStrCmp __vbaVarTstEq ord560 __vbaR4Str __vbaI2I4 __vbaObjVar ord562 DllFunctionCall __vbaVarLateMemSt __vbaFpUI1 __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStrUI1 __vbaExceptHandler ord711 __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd ord608 __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 _CIlog __vbaErrorOverflow __vbaVarLateMemCallLdRf __vbaInStr __vbaNew2 _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 __vbaVarTstNe ord101 ord102 __vbaI4Var ord103 ord689 ord104 ord105 __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaFpI4 __vbaVarLateMemCallLd __vbaUnkVar __vbaVarCopy __vbaLateMemCallLd _CIatan __vbaStrMove _allmul __vbaLateIdSt __vbaLenVarB _CItan __vbaUI1Var __vbaAryUnlock _CIexp __vbaFreeObj __vbaFreeStr

ShaPlus Translator.exe

IMPHASH 9b5f23c8e519064864e269a1751968b1
SHA256 f12101a956d6b1a7b166299b56409367de899853a774381c5753d89abe51456e
MD5 22af67256b8aa0482fd211f53d876975
SHA1 33608502445dfe96e49d1b430372364530a6eba5
SHA512 38a518b94af76afbf1058447eb60e43693c6ea403e6f3ec68ebf7dcfda662aa371633cb2e31878ab822281f551b81f280ed9e1ead781e8dbf1c3397bd4d57173
SSDEEP 1536:bUMqMZ8fDdAyYm7UPXCB3srj50Uy8UUo5dl5/gEpknzfmlbbc7v/OuuL:bSFDdxQXU3sP50L8UazfmBI7v/z0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6876

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvbvm60

__vbaVarSub __vbaVarTstGt ord690 _CIcos _adj_fptan __vbaVarMove __vbaStrI4 __vbaVarVargNofree __vbaFreeVar __vbaLateIdCall __vbaStrVarMove __vbaLenBstr ord696 __vbaEnd __vbaFreeVarList _adj_fdiv_m64 ord698 ord512 __vbaRaiseEvent __vbaFreeObjList ord516 _adj_fprem1 __vbaResume __vbaStrCat __vbaSetSystemError __vbaLenBstrB __vbaHresultCheckObj __vbaLenVar _adj_fdiv_m32 __vbaVarIndexLoadRefLock __vbaExitProc ord301 ord595 __vbaObjSet __vbaOnError _adj_fdiv_m16i __vbaObjSetAddref _adj_fdivr_m16i __vbaVarIndexLoad ord598 __vbaFpR4 ord520 ord307 __vbaRefVarAry __vbaBoolVarNull _CIsin ord631 ord632 __vbaChkstk EVENT_SINK_AddRef ord528 __vbaStrCmp __vbaVarTstEq ord560 __vbaR4Str __vbaObjVar __vbaI2I4 DllFunctionCall __vbaVarLateMemSt __vbaFpUI1 __vbaLbound __vbaStrR4 _adj_fpatan __vbaR4Var __vbaLateIdCallLd EVENT_SINK_Release __vbaNew __vbaUI1I2 _CIsqrt __vbaObjIs EVENT_SINK_QueryInterface __vbaStrUI1 __vbaExceptHandler ord711 __vbaStrToUnicode ord712 ord606 _adj_fprem _adj_fdivr_m64 __vbaLateIdStAd ord608 __vbaFPException __vbaInStrVar __vbaUbound __vbaStrVarVal __vbaVarCat __vbaI2Var ord644 _CIlog __vbaErrorOverflow __vbaNew2 __vbaVarLateMemCallLdRf __vbaInStr _adj_fdiv_m32i ord572 _adj_fdivr_m32i __vbaStrCopy __vbaI4Str ord681 __vbaFreeStrList _adj_fdivr_m32 _adj_fdiv_r ord685 ord100 __vbaVarTstNe __vbaI4Var ord689 __vbaLateMemCall __vbaStrToAnsi __vbaVarDup __vbaVerifyVarObj __vbaVarCopy __vbaFpI4 __vbaVarLateMemCallLd __vbaUnkVar __vbaLateMemCallLd _CIatan __vbaStrMove _allmul __vbaLateIdSt __vbaLenVarB _CItan __vbaAryUnlock __vbaUI1Var _CIexp __vbaFreeStr __vbaFreeObj

help.chm

SHA256 833ab65897e5867dad5319b7f41294128185167fdc1c928b43c2a8af06078ce6
MD5 950954cb3577222f97461599c44ac891
SHA1 4d10d08fe971ba6aff7a74bbee79b1ca4390761e
SHA512 98de0beaeb931468d60c16f7987c79ae8abcb4f1ab14e4d89ab8cd453018b4638b907d11d62916e96ec83ff82958248ed4b0a9a59ad3f25f9863856c62a1ce9d
SSDEEP 1536:Y9ooojhe/ro4uLXMsWCf2P6NTLGS0GgzMU4rlm48:Kor4ChhGSvgzWmP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninst.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 1814816c054425790ea1d005c8ce15d6f505e9856892087226f79376722d732f
MD5 27f2d91f7ea7e5474dda07833609817e
SHA1 524e6cc8a19418a90a4d2838cf703cfe22ccf09f
SHA512 5f052f2f9924fc570e4fa64c6b0366c9be5ae0e49b15fb3addea1f7065d60fe9e8ec380cd46ac3e79e0f9ae97135e50eadc3a70585113c3aebb34d79dfd1fbcd
SSDEEP 768:s4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJgKSWfM:fLXB65939tY6HBg4sXJgKS6M
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer