1f6b698d96080d9badfdb89c24f3cde1_JaffaCakes118
- SHA256 9c16bb70a18f6ded1175afb94cd31981e7d5dc63663cb657f7ecb4bfc54376d3
Overview
overview
6Static
static
3viewspeed/...��.htm
windows7-x64
1viewspeed/...��.htm
windows10-2004-x64
1viewspeed/...��.htm
windows7-x64
1viewspeed/...��.htm
windows10-2004-x64
1viewspeed/...��.url
windows7-x64
1viewspeed/...��.url
windows10-2004-x64
1viewspeed/...��.exe
windows7-x64
1viewspeed/...��.exe
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/AlxRes.dll
windows7-x64
1$SYSDIR/AlxRes.dll
windows10-2004-x64
1$SYSDIR/AlxTB1.dll
windows7-x64
6$SYSDIR/AlxTB1.dll
windows10-2004-x64
6viewspeed/...��.url
windows7-x64
1viewspeed/...��.url
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
viewspeed/77169.org˵.htm
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
viewspeed/77169.org˵.htm
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
viewspeed/viewspeed/77169.org˵.htm
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
viewspeed/viewspeed/77169.org˵.htm
Resource
win10v2004-20240419-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
viewspeed/viewspeed/ĺڿͬ.url
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
viewspeed/viewspeed/ĺڿͬ.url
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
viewspeed/viewspeed/ٹ.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
viewspeed/viewspeed/ٹ.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$SYSDIR/AlxRes.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$SYSDIR/AlxRes.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$SYSDIR/AlxTB1.dll
Resource
win7-20240419-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
$SYSDIR/AlxTB1.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral17
Sample
viewspeed/ĺڿͬ.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
viewspeed/ĺڿͬ.url
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 1f6b698d96080d9badfdb89c24f3cde1_JaffaCakes118
- Size 392KB
- Sample240507-ew1ftacd42
- SHA256 9c16bb70a18f6ded1175afb94cd31981e7d5dc63663cb657f7ecb4bfc54376d3
- MD5 1f6b698d96080d9badfdb89c24f3cde1
- SHA1 c498144deaea1e68bb06499e347f58c67160eb14
- SHA512 1eb6314807066214bce43ee62086242feff4780f444d06722ae9bc6928803772306900006405bdd930382825e720a0825466269e62db68d2fa0095ae7f55ddf5
- SSDEEP 12288:LHjIXxTlYkYu3IsdryaNSEU9PFFno4kQBkE2YTB7W:LHjEGkYWIs5vNxgPjnrrkE20q
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/$PLUGINSDIR/System.dll unpack002/$SYSDIR/AlxRes.dll unpack002/$SYSDIR/AlxTB1.dll - NSIS installer 1 IoCs
resource yara_rule static1/unpack001/viewspeed/viewspeed/ٹ.exe nsis_installer_1
File Explorer
-
1f6b698d96080d9badfdb89c24f3cde1_JaffaCakes118.zip 392KB
-
viewspeed/77169.orgʹð˵.txt4KB
-
viewspeed/77169.org˵.htm.html 5KB
-
viewspeed/viewspeed/77169.orgʹð˵.txt4KB
-
viewspeed/viewspeed/77169.org˵.htm.html 5KB
-
viewspeed/viewspeed/ĺڿͬ.url76B
-
viewspeed/viewspeed/ٹ.exe.exe 400KB
-
$PLUGINSDIR/InstallOptions.dll.dll 12KB
-
$PLUGINSDIR/System.dll.dll 9KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp33KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
$PLUGINSDIR/notify.ini199B
-
$SYSDIR/AlxRes.dll.dll .js 332KB
-
$SYSDIR/AlxTB1.dll.dll 508KB
-
uninstall.exe.nsis12KB
-
viewspeed/ĺڿͬ.url76B
viewspeed/77169.orgʹð˵.txt
- SHA256 8a28795dcd46b5742f68d91ccbfd0c29ee35971f1664aca089485cbf6ff7100d
- MD5 84043230514c11cddd48ddb98d90bdc0
- SHA1 60e757bd26ec076a50a794444f297d2e84ed561d
- SHA512 af3aa11eaaac30721f19a70aef3b1eb7a35547b917e80ddd9abf586977fe36391e6311086026d301d297fac446bd941d9919a9edcc086de38951ee59ccd09546
- SSDEEP 96:uZ7XFLkK0e+ihgwEZkjvW8oJ1PmpcAKp979Y:IX9kK0/IgwEZcWJ1PmpcAKb79Y
- MD5 SHA1 SHA512 SSDEEP
viewspeed/77169.org˵.htm
- SHA256 1a246e720e02d8b2f9c59eebb673e48885d6d7a8fb194b5f4f0de57df28c4812
- MD5 d122408c88ea147d35137fa775d78d32
- SHA1 818dfc81160c9e783e195d914d4b2ad81417a2d2
- SHA512 4c1963e822bd52ced208c5906de4901349717b5fed2367b028a4dc8923d8c04f0fa25b8b9c5cf32391acc750a594de4107af71118416cfbe04a53b326634b917
- SSDEEP 96:m1OQF/fRA2RWhwM6w6mheySgh/SnqjQhhwQ0660X8bJhnYOPMj1zNMXlGvak:mXF/JA0VdIYehN2hwQpZ+JhnYOPMjxNJ
- MD5 SHA1 SHA512 SSDEEP
viewspeed/viewspeed/77169.orgʹð˵.txt
- SHA256 cfc0aaa16458e08ee4eec8ebcc8ed11da428bdaa6cda642566d4832c11003620
- MD5 c8fb96fcd501d43fde55d6211058dc9b
- SHA1 889bdda04c05a4c7dc5fc856217d7ffa58ace187
- SHA512 9c83db4616073f999f8991d326aa0cc78046c9c2a25240c94bf90b8cd2437bf3c9ee507416819626a349771807f04652fe075def720b8acfd082f121c2f954d1
- SSDEEP 96:uZ7XFLkK0eZihgwEZkjvW8oJ1PmpcAKp979Y:IX9kK0UIgwEZcWJ1PmpcAKb79Y
- MD5 SHA1 SHA512 SSDEEP
viewspeed/viewspeed/77169.org˵.htm
- SHA256 1a246e720e02d8b2f9c59eebb673e48885d6d7a8fb194b5f4f0de57df28c4812
- MD5 d122408c88ea147d35137fa775d78d32
- SHA1 818dfc81160c9e783e195d914d4b2ad81417a2d2
- SHA512 4c1963e822bd52ced208c5906de4901349717b5fed2367b028a4dc8923d8c04f0fa25b8b9c5cf32391acc750a594de4107af71118416cfbe04a53b326634b917
- SSDEEP 96:m1OQF/fRA2RWhwM6w6mheySgh/SnqjQhhwQ0660X8bJhnYOPMj1zNMXlGvak:mXF/JA0VdIYehN2hwQpZ+JhnYOPMjxNJ
- MD5 SHA1 SHA512 SSDEEP
viewspeed/viewspeed/ĺڿͬ.url
- SHA256 0aeee0ba3eac8e4787109250c895aa0cfbce84416acdec154c33129cb65a56e9
- MD5 05ed0537b8052c33a9096c68b4d1d905
- SHA1 19fccec1f302e67908f386ac239d31e2edd7b820
- SHA512 d633e68263362b027c53df7a3d463ab6db8361702f718670f1717cea6785f4d7a3abcae77d8bb27b40221ef47c54b4ddead00c690468b9339235848948071127
- MD5 SHA1 SHA512
viewspeed/viewspeed/ٹ.exe
- IMPHASH daa039536cce91b63a8608b9aa7b3078
- SHA256 857f7146ba30540009dee0691695296916b76d1b99e7a85d5775d63c29a3534b
- MD5 d1fe132d4cb8e7c88f04820378343ab7
- SHA1 c5b5363b25df3847561bed25fdc273247c6fb8a7
- SHA512 a8939e4cf0742f49b631d1353160ccc120ff9d5b26a9d03f85f54f3feac53b49d854ab0cd410a4d8f0ef712b1e6e6b9bb3ffd636863cb6862c6ad697e3ecc5cb
- SSDEEP 12288:fkDxTlYYYu3aUdNyaNSE493FFnoqkQB8E2Y41:sNGYYWaUHvNxc3jn7r8E2n1
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
6d:a2:7a:e9:29:2e:b6:dd:c0:a8:00:1d:47:6e:3b:69
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Dec 3, 2001 - Dec 2, 2011
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=Alexa Internet,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alexa Internet,L=San Francisco,ST=CA,C=US
Serial Number
52:c1:df:38:b1:24:a0:e7:63:48:94:64:7a:0b:77:12
Issuer
CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 13, 2004 - Oct 4, 2005
Minor OS version
0
Major OS version
4
Entry point
17623
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
SetErrorMode
GetExitCodeProcess
WaitForSingleObject
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
FreeLibrary
CreateFileA
GetFileSize
GetModuleFileNameA
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetVersion
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateProcessA
GetTempFileNameA
lstrcpyA
lstrlenA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetSystemDirectoryA
RemoveDirectoryA
EnterCriticalSection
Sleep
MultiByteToWideChar
GetCurrentProcess
WritePrivateProfileStringA
LeaveCriticalSection
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
CreateThread
GlobalFree
CloseHandle
InitializeCriticalSection
GetTickCount
user32
SetWindowTextA
SetTimer
DestroyWindow
CreateDialogParamA
CharNextA
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcA
IsWindowVisible
LoadBitmapA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuA
CreatePopupMenu
GetSystemMetrics
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
ExitWindowsEx
PostQuitMessage
InvalidateRect
SendMessageA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
DefWindowProcA
gdi32
GetDeviceCaps
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
CreateFontA
SetBkMode
SetTextColor
SetBkColor
SelectObject
advapi32
RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegDeleteKeyA
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
SHGetPathFromIDListA
ole32
OleUninitialize
OleInitialize
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=95, version=2179,
count=1, id=28, version=9178,
count=2, id=93, version=2067,
count=10, id=93, version=2179,
count=5, id=25, version=9210,
count=163, id=1, productName=Unmarked objects,
count=2, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=7, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=94, productName=VS2003 (.NET) build 3052, version=3052,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH 3764e6c387ce3c76b39936a24d523dce
- SHA256 75e20f4c5eb00e9e5cb610273023e9d2c36392fa3b664c264b736c7cc2d1ac84
- MD5 4c7d97d0786ff08b20d0e8315b5fc3cb
- SHA1 bb6f475e867b2bf55e4cd214bd4ef68e26d70f6c
- SHA512 f37093fd5cdda74d8f7376c60a05b442f884e9d370347c7c39d84eca88f23fbea6221da2e57197acd78c817a74703c49fb28b89d41c3e34817cc9301b0b6485a
- SSDEEP 192:6KdqJ4Bhf1mdCMI26t510swClJOeFIsm7F1QuPs:6KdE4zAddwR0swqOeFxu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9995
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetPrivateProfileIntA
MultiByteToWideChar
GetPrivateProfileStringA
MulDiv
lstrcmpiA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GetModuleHandleA
GlobalAlloc
user32
PtInRect
MapWindowPoints
GetDlgCtrlID
LoadIconA
LoadImageA
LoadCursorA
CreateWindowExA
GetDC
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
EnableWindow
SendMessageA
SetWindowTextA
GetWindowTextA
wsprintfA
CharNextA
SetWindowLongA
gdi32
SetTextColor
CreateCompatibleDC
SelectObject
GetTextMetricsA
GetTextExtentPoint32A
DeleteDC
DeleteObject
comdlg32
GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA
dialog
initDialog
show
Name
.text
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=61, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 445ca064c668ebcb89957d525a8bef23
- SHA256 4eb689e2db8d683afcfffe6dee1985fbd458d2770093547331d563acece80c67
- MD5 e085476805e8f5ef1c7ed635c5309017
- SHA1 609e79fdc29d6dee40cc5dd333094db5f9f63eec
- SHA512 082932aea8d993de8ca1eeb60f7bb4e56cc7eab4a683c59822b2c544223febab5915bb2b7c2e2dad79472bbd8ad400770dd7c1f112cef24d18ebd0f1ad63fe9f
- SSDEEP 96:DomrrPB3x4gJcp7/qzt1SGr3DEkJjUFezthPhwrWNHRW5j5/Y0+YAZIhtyPEM75C:nnTEjwT3XgFshpwrlR5/7AZlTpVHlmV
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10251
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
f:\Cpp\!nsis!\System\Release\System.pdb
kernel32
GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
478B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2067,
count=5, id=93, version=2179,
count=17, id=1, productName=Unmarked objects,
count=5, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=4, id=99, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-header.bmp
- SHA256 d73f1747f8b0f7ccb08d5f20e111544b55d8aba4d2317de52a058de9e233da23
- MD5 1968e8c79a77f53f065ea299cbfabe29
- SHA1 79767eefa3466b26ba367ca5e22409976dedcf95
- SHA512 02b31bc38e169f0163a90847aa96274b3f2bf2bee4ec536bb6ce78b0fa8f56538cbe64d3375738ac2dcc315ca8d9256678b259793a0172901d816fce70ccf184
- SSDEEP 192:TYaCYkUfw6EHRS0az89MI0XSYv/BSrysG7LN1tQiyoANa+8:TYaZwwzix28zG7LN1tcpP8
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/notify.ini
- SHA256 0a9e4879745764e8624f6c608d6777daabe46b90942a11ed3b79d1f3e44485d1
- MD5 244897651f0f1c1cfb75740963d6f639
- SHA1 48b160f50588722ec05e3816d6b571768666e318
- SHA512 64d85c441fa0b94aba9463586aab8171dd46eea6e6daee53e2a57a43c649e369d55d873e5fec6f57d30ef38784c0ba2a03e3fed554ebedde2d9d30a27d4b5dda
- MD5 SHA1 SHA512
$SYSDIR/AlxRes.dll
- IMPHASH 6509377393ad0b7f03490407cdb297b7
- SHA256 181d7b416877d93995e4c9d06cf86e441e5ee70bbe14ce674111ee4d180e7c81
- MD5 6c3ca744145effece919fba3755cf209
- SHA1 180b1a0bdd9362b2c64355d3af2e3f0da04f48d4
- SHA512 9afe246f417dbaa96eee7ed2e620e6cea2038b3ca24c087ce39584a41c800a9b2209f3183777918e8d0cbce2e5cd22d033ca1612a7b7988f4c657641deb53b66
- SSDEEP 6144:/zBjrq8G/j4c8Lx2uHJjNhcvWf0GoTORHb:/9Y/j4cS2DWfMa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
8189
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
DeleteCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
MultiByteToWideChar
lstrlenA
lstrcatA
WideCharToMultiByte
lstrlenW
GetModuleFileNameA
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCommandLineA
GetVersion
HeapFree
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapCreate
VirtualFree
WriteFile
HeapAlloc
VirtualAlloc
HeapReAlloc
user32
CharNextA
ole32
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
validate
Name
.text
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
296KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=14, version=7299,
count=23, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=95, version=2190,
count=9, id=93, version=2179,
count=63, id=1, productName=Unmarked objects,
count=6, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$SYSDIR/AlxTB1.dll
- IMPHASH a3a4e5f48ad2ebdba4011ec2991d3567
- SHA256 e6b8333c896974e1897a25b73547b3effc5f97e2342e8a2960c3b3408a015f44
- MD5 5434903cbf712973f82963537ddf8973
- SHA1 43b0e29ad978434084034ca01978870605dc8748
- SHA512 06714d000d3ee9dc285a550cc81cc805936cfb10549dd1796cf0651e6dfaa47c6a792519314cce51d33472927f079b486df6617e1612a0adba0f2254be7c52c4
- SSDEEP 12288:o0lINhcubEMZCcrw+GyN1sywMCSN1fEf2VDC6ZQG:oEINhcCEMZCEw+GysNQfmdG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
224336
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
lstrlenA
GetSystemDirectoryA
MoveFileA
DeleteFileA
GetWindowsDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
SetEndOfFile
SetConsoleCtrlHandler
SetStdHandle
UnhandledExceptionFilter
IsBadCodePtr
IsBadReadPtr
GetVersionExA
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
SetUnhandledExceptionFilter
FlushFileBuffers
ReadFile
SetFilePointer
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
Sleep
GetStdHandle
SetHandleCount
WriteFile
lstrlenW
TerminateProcess
GetStringTypeW
GetStringTypeA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
FatalAppExitA
ExitProcess
RaiseException
GetVersion
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RtlUnwind
InterlockedExchange
GetModuleHandleA
EnumResourceNamesA
EnumResourceTypesA
GetFileSize
CreateProcessA
GlobalReAlloc
lstrcatA
lstrcpyA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
GetLastError
SizeofResource
GetShortPathNameA
DisableThreadLibraryCalls
LoadLibraryA
GetProcAddress
FreeLibrary
LoadLibraryExA
CreateFileA
CloseHandle
GetModuleFileNameA
GetCurrentProcess
FlushInstructionCache
lstrcmpA
GetCurrentThreadId
OutputDebugStringA
WideCharToMultiByte
GlobalLock
GlobalUnlock
EnterCriticalSection
GetFileType
LeaveCriticalSection
_llseek
_lread
GlobalAlloc
_hread
_lwrite
OpenFile
_hwrite
_lclose
LocalAlloc
LocalFree
FindResourceA
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
InterlockedDecrement
HeapSize
InterlockedIncrement
user32
IntersectRect
GetAsyncKeyState
DialogBoxIndirectParamA
RegisterClassExA
LoadCursorA
GetClassInfoExA
RegisterWindowMessageA
DefWindowProcA
GetWindow
SetWindowLongA
SetWindowTextA
GetWindowTextA
GetWindowTextLengthA
GetWindowLongA
EndDialog
IsDlgButtonChecked
SetFocus
GetParent
CheckDlgButton
SendMessageA
GetDlgItem
FillRect
GetClientRect
GetSysColor
IsChild
GetFocus
CallWindowProcA
SetWindowPos
IsWindow
RedrawWindow
LoadBitmapA
EndPaint
BeginPaint
ReleaseDC
GetDesktopWindow
GetDC
CreateAcceleratorTableA
ReleaseCapture
SetCapture
InvalidateRect
InvalidateRgn
DestroyWindow
CreatePopupMenu
InsertMenuA
DrawMenuBar
TrackPopupMenu
DestroyMenu
LoadStringA
ClientToScreen
CloseWindow
OpenIcon
SetRect
PostMessageA
PostQuitMessage
EnumChildWindows
MoveWindow
MessageBoxA
CreateWindowExA
EqualRect
OffsetRect
SetWindowRgn
UnionRect
PtInRect
GetKeyState
ShowWindow
CharNextA
wsprintfA
GetWindowRect
SystemParametersInfoA
MapWindowPoints
GetClassNameA
GetUpdateRect
gdi32
CreatePen
LineTo
MoveToEx
CreateRectRgn
CreateDIBSection
ExtCreateRegion
CombineRgn
SelectPalette
RealizePalette
CreateDCA
CreateRectRgnIndirect
LPtoDP
SaveDC
SetWindowOrgEx
SetViewportOrgEx
RestoreDC
GetDeviceCaps
CreateSolidBrush
CreateCompatibleBitmap
DeleteDC
SetWindowExtEx
SetViewportExtEx
SetMapMode
CreateCompatibleDC
SelectObject
BitBlt
GetStockObject
GetObjectA
CreateFontIndirectA
DeleteObject
CreateBrushIndirect
SetDIBitsToDevice
StretchDIBits
SetStretchBltMode
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
ws2_32
send
WSACleanup
WSAStartup
gethostbyname
socket
connect
htons
ioctlsocket
WSAGetLastError
advapi32
RegOpenKeyExA
RegEnumValueA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyA
ole32
OleLockRunning
OleLoadFromStream
OleSaveToStream
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CLSIDFromProgID
CLSIDFromString
CoTaskMemFree
StringFromCLSID
CoTaskMemAlloc
CoUninitialize
CoInitialize
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
OleRegGetMiscStatus
WriteClassStm
CoCreateGuid
oleaut32
SetErrorInfo
GetErrorInfo
CreateErrorInfo
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayUnaccessData
VariantCopy
OleCreatePropertyFrame
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantChangeType
LoadRegTypeLi
OleCreateFontIndirect
SysAllocString
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
VariantInit
VariantClear
wininet
InternetCrackUrlA
InternetSetCookieA
InternetGetCookieA
InternetQueryOptionA
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
urlmon
URLDownloadToFileA
URLDownloadToCacheFileA
AssignAssociateID
ChecksumResources
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetDLLVersion
Install
Uninstall
validate
Name
.text
Size
288KB
Virtual Size
287KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
64KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
108KB
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=33, id=14, version=7299,
count=23, id=10, version=8447,
count=7, id=11, version=8447,
count=12, id=95, version=2190,
count=21, id=93, version=2179,
count=303, id=1, productName=Unmarked objects,
count=145, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=55, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) cvtres build 1720, version=1720,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
uninstall.exe.nsis
- SHA256 84bfaf6b37fc260584f93d9a4242042fc07433a71a9e050140dabfded3f8b629
- MD5 28ec5ed6bfc443afbb57f6db531dd0b3
- SHA1 f03051125dc1d6b6bd3437854de3f591a9d66f29
- SHA512 52aaabbdca322b3cc2e077e2f9c5df1650cc6a1af2d9274279dbd478d91d9a4f357e4f39c103f2c1fdbd7a7eff2166696ac15d8060c8d3907422243f2606c4bc
- SSDEEP 384:HOUOoRpM0QegVfAa1AYKhEEmvtudau+I817Q:HOUdwRbfJA3lOuda2IM
- MD5 SHA1 SHA512 SSDEEP
viewspeed/ĺڿͬ.url
- SHA256 0aeee0ba3eac8e4787109250c895aa0cfbce84416acdec154c33129cb65a56e9
- MD5 05ed0537b8052c33a9096c68b4d1d905
- SHA1 19fccec1f302e67908f386ac239d31e2edd7b820
- SHA512 d633e68263362b027c53df7a3d463ab6db8361702f718670f1717cea6785f4d7a3abcae77d8bb27b40221ef47c54b4ddead00c690468b9339235848948071127
- MD5 SHA1 SHA512