61955fbdb78a1954e1170de8a4282e97_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

61955fbdb78a1954e1170de8a4282e97_JaffaCakes118
Size

1.3MB
MD5

61955fbdb78a1954e1170de8a4282e97
SHA1

a7bbcc408c34700839914b117c373be786b5d00c
SHA256

ee53e894a28570f3e592c313f9beaf3043c18097c966e86a579e3f25efc559bf
SHA512

ac84c79978dd683cc8ab3be82a7af6d09a5636a08ffb50e1c7654d61411f08032d349a0399484804c1dc354bbf35da054e0881f0cf9ec46d545a7b4034971b3c
SSDEEP

24576:JIiitssH7bTpxajpLysxkrBpoiI+vM3mRN6nRRg:OXPH7ypL/xklO3yN6nRRg

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

Files

61955fbdb78a1954e1170de8a4282e97_JaffaCakes118
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:ae:ad:3c:09:3f:e2:17:07:fd:31:96:8c:dd:73:29:de:8b:f1:79
Signer

Actual PE Digest

78:ae:ad:3c:09:3f:e2:17:07:fd:31:96:8c:dd:73:29:de:8b:f1:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/border.png
.png
$PLUGINSDIR/close.png
.png
$PLUGINSDIR/isx.dll
.dll windows:5 windows x86 arch:x86

0382f61ab763772ef363841300d3e463

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c4:be:fe:d2:94:89:ed:2c:a6:56:9a:91:aa:fb:d3:01:6a:94:47:c5
Signer

Actual PE Digest

c4:be:fe:d2:94:89:ed:2c:a6:56:9a:91:aa:fb:d3:01:6a:94:47:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\buildbot\slave1\kugou_installer\build\Release\isx.pdb

Imports

kernel32

GlobalAlloc
GetVersionExW
GetCurrentThreadId
GetFileSize
GetLastError
ReadFile
SetFilePointer
lstrlenA
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
OpenProcess
TerminateProcess
Process32NextW
InterlockedDecrement
GetPrivateProfileSectionW
GetCurrentProcess
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetProcAddress
CreateDirectoryW
GetDriveTypeW
GetDiskFreeSpaceW
GetSystemInfo
GetProcessAffinityMask
SetProcessAffinityMask
LocalAlloc
LocalFree
GetModuleHandleW
SetEvent
SetCurrentDirectoryW
GetCommandLineW
CreateEventW
OpenFileMappingW
OpenEventW
GetModuleFileNameW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GlobalFree
FreeLibrary
LoadLibraryW
WaitForMultipleObjects
DeleteFileW
CreateThread
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
SetEnvironmentVariableA
GetTimeZoneInformation
WriteConsoleW
OutputDebugStringW
LCMapStringW
CompareStringW
WriteFile
DeviceIoControl
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
Sleep
WritePrivateProfileStringW
GetLocalTime
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpiW
GetPrivateProfileSectionNamesW
lstrcpyW
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
FreeEnvironmentStringsW
PeekNamedPipe
GetStdHandle
LoadLibraryA
GetFileType
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetProcessHeap
GetStringTypeW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetTickCount
InitializeCriticalSection
lstrlenW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
AreFileApisANSI
GetModuleHandleExW
ExitProcess
RtlUnwind
RaiseException
LoadLibraryExW
ExitThread
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InterlockedIncrement
FormatMessageA
ExpandEnvironmentStringsA
SleepEx

user32

GetForegroundWindow
AttachThreadInput
BringWindowToTop
SetForegroundWindow
GetWindowThreadProcessId
CharNextW
PeekMessageW
TranslateMessage
DispatchMessageW
FindWindowW
PostMessageW
FindWindowExW
DestroyMenu
CreatePopupMenu
LoadStringW
UnhookWindowsHookEx
CallNextHookEx
SendMessageW
GetDlgItem
GetClassNameW
SetWindowsHookExW
wsprintfW
SystemParametersInfoW
MsgWaitForMultipleObjects

advapi32

OpenProcessToken
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
CryptHashData
LookupPrivilegeValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash

shell32

ShellExecuteW
SHGetDesktopFolder
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoCreateGuid
CoInitialize
CoUninitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

shlwapi

PathCombineW
PathIsDirectoryEmptyW
PathIsRelativeW
PathRemoveFileSpecW
PathFileExistsW
StrToIntW
PathFindFileNameW
PathFindExtensionW

wininet

InternetCloseHandle
InternetOpenW
InternetOpenUrlW

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ws2_32

WSAGetLastError
connect
getpeername
send
htons
recvfrom
accept
listen
__WSAFDIsSet
select
ioctlsocket
freeaddrinfo
getaddrinfo
gethostname
ntohs
getsockname
setsockopt
recv
bind
socket
WSASetLastError
closesocket
getsockopt
WSAStartup
sendto
WSACleanup

wldap32

ord60
ord46
ord26
ord41
ord143
ord50
ord22
ord35
ord32
ord200
ord211
ord30
ord79
ord33
ord27
ord301

Exports

Exports

k00
k01
k02
k03
k04
k05
k06
k07
k08
k09
k10
k11
k12
k13
k14
k15
k16
k17
k18
k19
k20
k21
k22
k23
k24
k25
k26
k27
k28
k29
k30
k31
k32
k33
k34
k35
k36
k37
k38
k39
k40
k41
k42
k43
k44
k45
k46
k47
k48
k49
k50
k51
k52
k53
k54
k55
k56
k57
k58
k59
k60
k61
k62
k63
k64
k65
k66
k67
k68
k69

Sections

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/kgskin.dll
.dll windows:5 windows x86 arch:x86

e4293a9f56d0fd5dd2cef90ff7ffd011

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:0e:06:aa:8f:9c:ee:e3:32:47:85:a6:aa:79:4d:0b:a2:d5:09:f0
Signer

Actual PE Digest

07:0e:06:aa:8f:9c:ee:e3:32:47:85:a6:aa:79:4d:0b:a2:d5:09:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\buildbot\slave1\kugou_installer\build\Release\kgskin.pdb

Imports

kernel32

LCMapStringW
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
WriteFile
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
WideCharToMultiByte
GetModuleHandleExW
SetLastError
RaiseException
IsProcessorFeaturePresent
IsDebuggerPresent
HeapReAlloc
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
DecodePointer
EncodePointer
RtlUnwind
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
lstrcmpW
ExitProcess
ReadFile
CloseHandle
GetFileSize
CreateFileW
GetTickCount
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryW
GetACP
MultiByteToWideChar
GetLastError
GlobalAlloc
lstrcpynW
GlobalFree
lstrcpyW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
lstrlenW
lstrcmpiW
FreeEnvironmentStringsW
FlushFileBuffers

user32

GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
CharPrevW
SetRect
DrawTextW
FillRect
GetWindowLongW
SetWindowLongW
GetClientRect
SetWindowPos
IsWindowVisible
IntersectRect
CharNextW
PtInRect
ReleaseCapture
SetCapture
KillTimer
SetTimer
GetFocus
GetCursorPos
InvalidateRect
UpdateLayeredWindow
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetDC
ReleaseDC
DestroyWindow
SetRectEmpty
GetKeyState
SetCursor
wvsprintfW
PostMessageW
RemovePropW
GetPropW
RegisterClassExW
GetClassInfoExW
RegisterClassW
LoadCursorW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetParent
PostQuitMessage
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
IsWindow
SetPropW
CreateWindowExW
DefWindowProcW
wsprintfW
SendMessageW
FindWindowExW
CallWindowProcW
ShowWindow
IsWindowEnabled
GetDlgItem
ScreenToClient
SetWindowRgn
OffsetRect
GetWindowRect
IsIconic
MessageBoxW

gdi32

CreateSolidBrush
ExtTextOutW
SetBkColor
SetStretchBltMode
StretchBlt
CreateDIBSection
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetTextMetricsW
SetWindowOrgEx
Rectangle
BitBlt
RestoreDC
CreatePenIndirect
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
CreatePen
CreateFontIndirectW
GetObjectW
DeleteObject
CreateRoundRectRgn
RoundRect
SetBkMode
SetTextColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
MoveToEx
SaveDC
GetStockObject
LineTo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

comctl32

ord17
_TrackMouseEvent

Exports

Exports

k0
k1
k2
k3
k4
k5
k6
k7
k8
k9

Sections

.text
Size: 231KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/progressbar.png
.png
$PLUGINSDIR/radio0.png
.png
$PLUGINSDIR/radio1.png
.png
$PLUGINSDIR/song.png
.png
$PLUGINSDIR/unbg1.jpg
.jpg
$PLUGINSDIR/unbg2.jpg
.jpg
$PLUGINSDIR/unbg3.jpg
.jpg
$PLUGINSDIR/uncancel.png
.png
$PLUGINSDIR/uninstall.skn
$PLUGINSDIR/unnext.png
.png
$PLUGINSDIR/unok.png
.png

Sharing

General

Malware Config

Signatures

Files

be41bf7b8cc010b614bd36bbca606973

Code Sign

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

78:ae:ad:3c:09:3f:e2:17:07:fd:31:96:8c:dd:73:29:de:8b:f1:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 458KB

.ndata Size: - Virtual size: 1.8MB

.rsrc Size: 126KB - Virtual size: 125KB

.reloc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

0382f61ab763772ef363841300d3e463

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

c4:be:fe:d2:94:89:ed:2c:a6:56:9a:91:aa:fb:d3:01:6a:94:47:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

iphlpapi

version

ws2_32

wldap32

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

78:ae:ad:3c:09:3f:e2:17:07:fd:31:96:8c:dd:73:29:de:8b:f1:79
Signer

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 1.8MB

.rsrc
Size: 126KB - Virtual size: 125KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

c4:be:fe:d2:94:89:ed:2c:a6:56:9a:91:aa:fb:d3:01:6a:94:47:c5
Signer

.text
Size: 295KB - Virtual size: 294KB

.rdata
Size: 73KB - Virtual size: 73KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

07:0e:06:aa:8f:9c:ee:e3:32:47:85:a6:aa:79:4d:0b:a2:d5:09:f0
Signer

.text
Size: 231KB - Virtual size: 230KB

.data
Size: 6KB - Virtual size: 13KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 197KB - Virtual size: 196KB

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B