5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118
Size 846KB
Sample240520-dptt1sha33
SHA256 96a282babf5dde955edbca8cbcaf4337b0629bd6cf568774eebd6486663666a5
MD5 5ce3435b1b1be8e46d196809ee9f0226
SHA1 d87d21908204eadd8640d26769979bbcff2aa886
SHA512 e4b1376beb56f3e0f01c0a863397619a64e90723e6fa870e91ad551f8d6089c1d02ba291c7b58a131c497a2767abaaf45edc5c2190020b98b9ec2d8719906c92
SSDEEP 24576:GtWEmllf2nhgPqqCO84G3bHkTwtcTBCQ2u22:G+KxtEG3bHkM412u22
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118

.exe 846KB
$_3_

.exe 1.8MB
$_4_

17KB
$_5_

.png 12KB

5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 96a282babf5dde955edbca8cbcaf4337b0629bd6cf568774eebd6486663666a5
MD5 5ce3435b1b1be8e46d196809ee9f0226
SHA1 d87d21908204eadd8640d26769979bbcff2aa886
SHA512 e4b1376beb56f3e0f01c0a863397619a64e90723e6fa870e91ad551f8d6089c1d02ba291c7b58a131c497a2767abaaf45edc5c2190020b98b9ec2d8719906c92
SSDEEP 24576:GtWEmllf2nhgPqqCO84G3bHkTwtcTBCQ2u22:G+KxtEG3bHkM412u22
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0f:d1:d4:25:d8:87:58:2b:2a:24:63:b1:25:07:ef:d8:e4:1d:64:f1:33:c8:2b:78:1b:9f:46:b3:1d:cf:0c:f1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Chains

Apr 26, 2019

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

a4:8c:0b:a3:98:82:0f:7e:d0:31:a9:b0:24:18:53:2f:e6:e3:43:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Chains

Apr 26, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Serial Number

45:bb:20:2a:9d:33:0e:fa:75:86:52:1a:e6:f2:20:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2019 - Jan 31, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2014 - Jul 21, 2024

Subject

Serial Number

40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 2, 2008 - Dec 1, 2037

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Serial Number

7f:aa:d4:d3:ff:7b:07:fb:e9:fd:c3:b7:07:fb:79:2c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 16, 2018 - Feb 15, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

17191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$_3_

IMPHASH af73be6d2dd55fcb6ab77fb3ba251324
SHA256 9cffb8f38ca1ff1c7a6244e17dee39d8d379ba5816ced18aeadd91b46aa4a37c
MD5 b1d671736e8e4afd77b6a84f52a85165
SHA1 3392417c0f9ed0a3b0c3bac4b66f22ed459b29dd
SHA512 4ef78e54759f0a829daea4f79b75827dba6bf6a05666154112b535922a822152df40db2f2fca71fbfcf48ed8f3e730597a936bd8e40dc6192874c1608259b299
SSDEEP 49152:5SNY8H0ZGF5j51XdQTPRPgoFx1NslvUOl/WkMWAA:GY00Z8F1XdUG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

3e:f0:ce:89:52:f0:f9:0e:9e:5e:ac:fa:3a:57:f4:3b:5f:9e:e5:9b:2f:aa:90:d4:e7:f1:f0:1f:cb:a6:48:d5

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,ST=Isle Of Man,C=IM

Chains

Oct 19, 2017

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,ST=Isle Of Man,C=IM

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

61:ed:94:21:ca:10:7a:9e:1c:99:87:8c:c0:2c:51:d0:e7:18:c4:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,C=IM

Chains

Oct 19, 2017

Subject

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,C=IM

Serial Number

5d:e1:ea:f8:63:fe:fa:aa:41:73:46:81:10:c7:18:53

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 3, 2017 - Oct 3, 2018

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Playtech Software Ltd.,O=Playtech Software Ltd.,L=Douglas,ST=Isle Of Man,C=IM

Serial Number

16:97:5c:da:0b:ee:3d:bc:eb:2d:80:40:8c:02:4a:04

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 29, 2017 - Nov 11, 2020

Subject

Serial Number

40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 2, 2008 - Dec 1, 2037

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2014 - Jul 21, 2024

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 2, 2017 - Apr 1, 2028

Minor OS version

Major OS version

Entry point

1003657

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetCrackUrlW InternetGetLastResponseInfoW HttpSendRequestW InternetCloseHandle HttpQueryInfoW InternetSetOptionW InternetReadFile InternetGetConnectedState InternetOpenW InternetQueryOptionW InternetConnectW HttpOpenRequestW

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

gdiplus

GdipCreatePen1 GdipDeletePen GdipSetPenMode GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipGetImageHeight GdipReleaseDC GdipCloneImage GdipDeleteBrush GdipAlloc GdipDrawImageRectI GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipSetSmoothingMode GdipCreateSolidFill GdipFree GdipCreateFromHDC GdipFillRectangleI GdipDeleteGraphics GdipGetImageWidth GdipCreateBitmapFromFile

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose CertFreeCertificateContext CertFindCertificateInStore CertGetNameStringW CryptMsgGetParam CertCloseStore CryptQueryObject

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter ExitThread FreeLibraryAndExitThread GetModuleHandleExW QueryPerformanceFrequency DeleteCriticalSection HeapFree InitializeCriticalSectionAndSpinCount HeapSize GetLastError HeapReAlloc RaiseException HeapAlloc DecodePointer HeapDestroy GetProcessHeap GetVersionExW ReadFile GetStdHandle WriteFile EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects MultiByteToWideChar WideCharToMultiByte CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW SetFileTime CreateFileW SetFileAttributesW DeleteFileW CloseHandle FindFirstFileW FindNextFileW FindClose SetFilePointer SetEndOfFile GetFileSize GetSystemInfo GetProcAddress GetModuleHandleW GlobalMemoryStatus VirtualFree VirtualAlloc InitializeCriticalSection WaitForSingleObject CreateEventW SetEvent ResetEvent GetLocalTime SizeofResource LockResource FindResourceExW LoadResource FindResourceW InterlockedDecrement GetCurrentThreadId OutputDebugStringW GetCurrentProcessId GetSystemDefaultLCID CreateThread GetFileAttributesW CopyFileW lstrlenA GetLongPathNameW GetEnvironmentVariableW GetVersion FlushFileBuffers GetModuleFileNameW UnmapViewOfFile Sleep FlushViewOfFile CreateFileMappingW MapViewOfFile GetCurrentProcess TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW SetLastError GlobalAlloc GlobalLock InterlockedIncrement GlobalUnlock lstrcmpW MulDiv GetProcessId LocalAlloc EnumSystemLanguageGroupsW LocalFree GetTickCount GetExitCodeProcess GlobalHandle GlobalFree FreeLibrary lstrcmpiW LoadLibraryExW GetFileType GetModuleHandleA QueryPerformanceCounter LoadLibraryA FlushConsoleInputBuffer WaitForSingleObjectEx GetTimeZoneInformation WriteConsoleW ExitProcess SetConsoleCtrlHandler GetConsoleMode ReadConsoleInputA SetConsoleMode GetACP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleCP SetFilePointerEx IsDebuggerPresent GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead EncodePointer InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache LoadLibraryExA GetStringTypeW TlsAlloc TlsGetValue TlsSetValue TlsFree CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo RtlUnwind ReadConsoleW SetStdHandle FindFirstFileExW IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA IsProcessorFeaturePresent

user32

AnimateWindow SetWindowsHookExW CreateDialogIndirectParamW EnableWindow GetLastInputInfo GetSystemMetrics SwitchToThisWindow FindWindowExW MessageBoxW RegisterClassW ValidateRect LoadIconW UpdateLayeredWindow PostQuitMessage GetWindowLongW GetWindowTextLengthW DefWindowProcW CallWindowProcW GetWindow GetWindowRect GetFocus DestroyWindow GetDC SetWindowPos SetWindowRgn FillRect CreateWindowExW ScreenToClient SendMessageW EndDialog SetWindowTextW RegisterClassExW ShowWindow IsWindow InvalidateRgn CheckMenuRadioItem CallNextHookEx TranslateMessage GetWindowPlacement MessageBoxA IsDialogMessageW SetMenuItemInfoW PeekMessageW SetDlgItemTextW SetMenuDefaultItem SetTimer RedrawWindow ClientToScreen DestroyAcceleratorTable IsChild SendDlgItemMessageW GetSysColor MoveWindow CreateAcceleratorTableW SetLayeredWindowAttributes SetFocus CharNextW SetWindowContextHelpId LoadCursorW GetClassNameW SetCapture GetWindowDC MapDialogRect SetWindowLongW GetClientRect GetDlgItem KillTimer GetDesktopWindow SystemParametersInfoW GetClassInfoExW GetParent RegisterWindowMessageW ReleaseCapture InvalidateRect ReleaseDC BeginPaint EndPaint GetWindowTextW PostMessageW EnumWindows GetUserObjectInformationW GetProcessWindowStation GetMessageW DispatchMessageW UnregisterClassW CharUpperW UnhookWindowsHookEx GetMenuItemInfoW GetWindowThreadProcessId

gdi32

GetStockObject GetDeviceCaps CreateRectRgn DeleteDC GetObjectW CreateCompatibleDC CreateDIBSection CombineRgn SelectObject CreateCompatibleBitmap BitBlt DeleteObject CreateSolidBrush

advapi32

AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW LookupPrivilegeValueW GetTokenInformation RegSetValueW LookupAccountSidW RegEnumKeyExW RegDeleteKeyW RegDeleteValueW RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceA ReportEventA OpenProcessToken RegCloseKey

shell32

ShellExecuteExW ShellExecuteW ExtractIconW SHGetDesktopFolder SHGetPathFromIDListW SHBrowseForFolderW SHCreateDirectoryExW SHFileOperationW

ole32

CoGetClassObject OleUninitialize OleSetContainedObject CoTaskMemAlloc OleCreate StringFromGUID2 CoCreateInstance CLSIDFromProgID CoTaskMemFree CreateStreamOnHGlobal OleDraw OleInitialize StgCreateDocfile CLSIDFromString OleLockRunning CoCreateGuid CoInitialize CoUninitialize CoTaskMemRealloc

oleaut32

SysFreeString VariantClear VariantCopy SysStringLen VariantInit SysAllocStringLen OleCreateFontIndirect LoadTypeLi LoadRegTypeLi DispCallFunc VarUI4FromStr GetErrorInfo SysAllocString

shlwapi

PathIsDirectoryEmptyW ord176 UrlEscapeW

comctl32

InitCommonControlsEx

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

398KB

Virtual Size

397KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

628B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

160KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

5ce3435b1b1be8e46d196809ee9f0226_JaffaCakes118

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$_3_

PE Signature issue

wininet

version

gdiplus

psapi

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic

$_4_

$_5_