2709caed68029067c28fea7c135978d2_JaffaCakes118

resource
2709caed68029067c28fea7c135978d2_JaffaCakes118
unpack001/$PLUGINSDIR/ChromeI.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserMgr.dll
unpack001/$R0
unpack001/$R2/NSIS.Library.RegTool.v3.$_15_.exe
unpack001/updater.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH b76363e9cb88bf9390860da8e50999d2
SHA256 072f4a30adc96c3271ed2f7ef98892efb0ca899d1f5bbc86af6b25191e562a36
MD5 2709caed68029067c28fea7c135978d2
SHA1 f864a2027f26335c2e4d9e7d6d3656d282c0fb3b
SHA512 b968d94ccc6f05cb82ccbafa2e8b04fa68f33f20b0dc5eb172b399bc459794953020259b0d91e68587bc361abb8daf0d341f91ed44a710ec2aab815c58d4f4e0
SSDEEP 24576:ZW8abOYrPS+9nXk/AAGQuBZlyDOF2eZdhuvPEBjZzq:03bOUN9nX7lyDOpZdhuvAdq
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12586

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA SetFileAttributesA CompareFileTime SearchPathA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA Sleep lstrcmpiA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrcatA GetSystemDirectoryA WaitForSingleObject SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc lstrlenA GetCommandLineA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv MultiByteToWideChar LoadLibraryExA GetModuleHandleA FreeLibrary

user32

SetCursor GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor EndDialog ScreenToClient LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow GetWindowLongA RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx SetTimer PostQuitMessage SetWindowLongA SendMessageTimeoutA LoadImageA wsprintfA GetDlgItem FindWindowExA IsWindow SetClipboardData EmptyClipboard OpenClipboard EndPaint CreateDialogParamA DestroyWindow ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA ShellExecuteA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_AddMasked ImageList_Destroy ImageList_Create ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/ChromeI.dll

IMPHASH 75ff482f0a63980b50efbc7eeeddcfaf
SHA256 1ab36e4990c1f57816e22bfdbf31c6b60d63d1d11760b8534a0e543493e69fc2
MD5 b5fb2749c737cffcdbe599b269adddf5
SHA1 6932ecc9baee317cb51340ac1a2f835bfada1d41
SHA512 e9f6dda2c9a3a6c3ee02115ba3275e0db292bca9b7b966ec80040b1d257134e817a3bd7581f003c736109b198fdd1ab77b930356f21f6405fd5c1fad1b65c000
SSDEEP 12288:nXyN7tRveGLwzMUdN/j2oE0ZBiFhjx2DZdw5Mfp:nXyNJRveGL0MUTrkjFhjx2DqMfp
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

427503

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcpyA GlobalFree lstrcpynA WideCharToMultiByte AreFileApisANSI ReadFile EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateFileW GetFileAttributesW UnmapViewOfFile Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GlobalAlloc GetFileAttributesExW CreateFileA LoadLibraryA GetVersionExA DeleteFileA DeleteFileW CloseHandle GetSystemInfo LoadLibraryW UnlockFile GetProcAddress CreateFileMappingA LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId FreeLibrary GetSystemTimeAsFileTime GetSystemTime FormatMessageA MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers GetFileAttributesA EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException LoadLibraryExW GetModuleFileNameW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetACP GetStdHandle GetFileType GetConsoleCP GetConsoleMode IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetFilePointerEx GetTimeZoneInformation GetProcessHeap IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA GetCommandLineA GetCommandLineW SetStdHandle WriteConsoleW HeapSize MultiByteToWideChar

advapi32

SystemFunction036

Name

.text

Size

510KB

Virtual Size

510KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH f2ac1ab587d5531d5f1bf76c094aef4c
SHA256 4ca5bf1beb4b802914c4d3e2f37861f6ba5ecf969cfeadf5855edf58f647a721
MD5 0ff5120f1afd0f295c2baa0f7192d3f8
SHA1 bde842d5d11005dcb4ff1d4ea97da31865477697
SHA512 e049ffd7aace8d136eee007ee4f8dbc2ae8f3dce79d1c633d9654392240f8215787df8a6d08085257db51f28ff2a8023a13333dda3ea7f9bdc8b9c57b605f0a0
SSDEEP 192:Xv+cJZE61KRWJQO6tFiUdK7ckD4k7l1XRBm0w+NiHi1nSJ:Xf6rtFRdbQ1W+fn8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserMgr.dll

IMPHASH bac2b3d4a0df9a23aee940b8ecd0d168
SHA256 54a9ab4ac127d950ad293a71f5a496af3ab09b70aa73839fd0f1c9cbaf35f70e
MD5 74813d238f84d5c0f5328bd7ba79537a
SHA1 5aeecd94f0902bad1572fd2cceada9ad44af6725
SHA512 ac7fb85c6375bc3e0e76b535550b604cbad31e69696030314f34e41d3bb5c04411ec826c89885c30556649961d45061f501db6a37a23bb419e4f1e7cea34deff
SSDEEP 768:WThBSJtwQegACHpCygw5eKeK/B/viiTRvTkujLWf2UEHzDSZA7yM5jt/BJE4lW:aSCQeLCHpCyNV9ZTRbkuOQzyMVt/blW
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13593

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalAlloc LocalFree GetEnvironmentVariableA GetProcessHeap HeapAlloc HeapReAlloc HeapFree GetCurrentProcess GetLastError CloseHandle FlushFileBuffers GetStringTypeW GetStringTypeA SetStdHandle LoadLibraryA GetProcAddress GetOEMCP GetACP GetCPInfo GlobalFree lstrcpyA lstrcpynA GlobalAlloc RtlUnwind InterlockedDecrement InterlockedIncrement GetCommandLineA GetVersion WideCharToMultiByte MultiByteToWideChar LCMapStringA LCMapStringW InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess TerminateProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetVersionExA HeapDestroy HeapCreate VirtualFree WriteFile SetFilePointer VirtualAlloc

advapi32

LsaOpenPolicy LsaEnumerateAccountRights LsaNtStatusToWinError LsaFreeMemory GetNamedSecurityInfoA SetEntriesInAclA SetNamedSecurityInfoA LsaClose ConvertStringSidToSidA LookupAccountSidA GetUserNameA RegUnLoadKeyA ConvertSidToStringSidA RegOpenKeyExA LsaAddAccountRights LsaRemoveAccountRights AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken LookupAccountNameA LogonUserA RegLoadKeyA RegCloseKey RegQueryValueExA

netapi32

NetUserAdd NetUserDel NetGroupDelUser NetLocalGroupGetMembers NetLocalGroupAddMembers NetLocalGroupAdd NetLocalGroupDel NetUserChangePassword NetUserSetInfo NetUserGetInfo NetWkstaUserGetInfo NetApiBufferFree

userenv

LoadUserProfileA UnloadUserProfile

$R0

IMPHASH a42a43746a2e2d0c82df709d2bde53d4
SHA256 4902b2a99a4c53045c21dd542d2e60352da5f1b2b95e04ec85348201708334c2
MD5 8238d42c6e0a538e15bb4565ec969acf
SHA1 8561af6b5dd6601be97ea0256c78699d274fe19d
SHA512 03ae59bf8d83beef8ada6af7776b9a9be5a9a77d120fc0e67d1e76e0c2e507b5bb7aab9d9ab6ae8fa081b893abad78b53f6831e5bab7ca8bf3b28fb4cad20ac9
SSDEEP 6144:ko4GvXJhRFVwG7LrM2E91xI4wyiySoezOw+3X/1ve/pqnoo:3vfJHfwkPMzrxIYiySXywq/dvnoo
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

152300

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\hozic\Desktop\DealbeaverIE\Dealbeaver\Release\Dealbeaver.pdb

kernel32

lstrcmpiW FindResourceW MultiByteToWideChar GetThreadLocale SetThreadLocale OutputDebugStringW CloseHandle HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap ReleaseMutex WaitForSingleObject CreateMutexW SizeofResource CreateThread CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile FindResourceExW LockResource LocalFree WideCharToMultiByte SetLastError IsDebuggerPresent GetCommandLineW GetCommandLineA LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary LeaveCriticalSection EnterCriticalSection EncodePointer DeleteCriticalSection InitializeCriticalSectionEx GetLastError RaiseException OpenMutexW DecodePointer CreateFileW WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle GetACP GetModuleHandleExW ExitProcess QueryPerformanceCounter InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent SetEvent ResetEvent WaitForSingleObjectEx GetStartupInfoW GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind InterlockedFlushSList SetStdHandle

user32

CharNextW SetTimer KillTimer

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegCreateKeyW GetSecurityDescriptorSacl RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCloseKey SystemFunction036 SetSecurityInfo

ole32

CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoCreateInstance CoUninitialize CoInitializeEx CLSIDFromProgID CoCreateGuid CoTaskMemAlloc

oleaut32

LoadRegTypeLi VariantCopy VariantClear SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetLBound SafeArrayGetUBound SysAllocStringByteLen SysStringByteLen UnRegisterTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr SysStringLen SysAllocString SysFreeString

Name

.text

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$R2/NSIS.Library.RegTool.v3.$_15_.exe

IMPHASH d16ab3022432d93d45fa93eaa0c2bbd3
SHA256 2420dda4f56c52b39f947b2c29bc7f903ab6b1a4138a70b95e6c95752fc03037
MD5 e7809fffb6c42eaaa43aa403dd0d2deb
SHA1 54acd8eb0c4ff54f91e43456bcc3c5f22d097fd6
SHA512 4e33e81f9a12f8a2d500e9f4890f472f4b148eae79b2f27ce03f55dbdd8ebf5267e13615e5b6ee0bb0f8f01520d31e3cd9f02eeda9fc0137595f07337d4bd6d0
SSDEEP 96:fl7w199EMljf/O4kpi20SkJqbdC9Xh+MClQGZ56:W19CUe4kj0SkMbd9XlQGZ5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

$TEMP/cbljfancdo/part1.txt

SHA256 34b065d9ec6e277bb96dad1990b5a99d9be7a097a02a31f22ab6a971e323a1f0
MD5 5b6a71eddec8ca615be30a384d81f475
SHA1 fe49bb83d086fae1ee8483984b2b3906dd44b634
SHA512 ec30456c1e3e58c5262726f2d7ebab59143345e3197f0d17976fde18b5b587e1367ea9ac5906bea5efc27ab79558636f47b156e7cdd419724e92e5573067bd25
MD5 SHA1 SHA512

NSIS installer

installer

$TEMP/cbljfancdo/part1s.txt

SHA256 fb0a476facb374a8c38fa115d211017c3e6beda05a293f2aa57020e2c034da05
MD5 6097ffcbd46e9734c1ccb941ced2fd9a
SHA1 c4cdb386e346dfe5451f0055822eaa0988ddc10f
SHA512 37f65db4a6e18691a1f27d94edeaf258eb4dc8e906a81346a07a4909ab97097e003bd2de682a79dbf149483417f66221ad550cca968fe52f530a9ba4d13ab311
MD5 SHA1 SHA512

NSIS installer

installer

updater.exe

IMPHASH c12c0b499d1ed02bd9031b4f52e122d6
SHA256 623db9e2dc498ffdfc03250589983a3b0dd7ff01222793518958822036dbdf0f
MD5 739edb1948f854b413d0569eb3701160
SHA1 ad338f388177be57c30db121ab622ed87e4abc4f
SHA512 07d42e4e06d3979f4d70b753540c2aee5665bba59446947b958b107a2dfeee56bd9173ed65dd9aea87ec56acf2b3f4ddd5695cae0293cbe9001f63f37f445361
SSDEEP 6144:vhKXFHMQax+lMjRnfuPZCkV7gaBmhucq/19R5IsVGOsw08/S1+0aPcqBI:vIMQWAPZCkV7hsuNj5p1M1+0akqBI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

138104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\Mario\documents\visual studio 2015\Projects\Win32Project1\Release\Win32Project1.pdb

shell32

SHGetFolderPathW

kernel32

GetPrivateProfileStringW GetLastError CloseHandle WideCharToMultiByte MultiByteToWideChar GetStringTypeW QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer GetCPInfo SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress CompareStringW LCMapStringW GetLocaleInfoW SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateFileW GetPrivateProfileIntW WriteFile SetEndOfFile HeapSize ReadConsoleW RtlUnwind RaiseException GetModuleFileNameW FreeLibrary LoadLibraryExW HeapAlloc HeapReAlloc HeapFree GetStdHandle ExitProcess GetModuleHandleExW GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetProcessHeap FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle WriteConsoleW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW SystemFunction036

Name

.text

Size

250KB

Virtual Size

250KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

796B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

56KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer