7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118
Size 789KB
Sample240526-mpdbpsfc6z
SHA256 58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d
MD5 7535365c3a3597101d7bcd9e2bacd1d7
SHA1 c4d4e596d414ab22767cd1b21fa901f735083878
SHA512 f812e0aff7bd56ba44778076390eae4c24d3cc89eb754c7160e64e8a9619541fff17d5167df3850933af8f3873512c6b15ca395fad2246b244e6c3c0a6b9ac09
SSDEEP 12288:StobbXN42nHq+EgqfRAUEcB3gOE6DZlZUXavlXluE70pFdZigcyrG4EEu44S+j:St8RHjEgYAw1hZlZTWQu7igcyKPEujz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/StdUtils.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

File Explorer

7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118

.exe 789KB
$PLUGINSDIR/StdUtils.dll

.dll 14KB
$_3_

.exe 1.8MB
$_4_

17KB
$_5_

.png 12KB

7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 58699ab5d4d95d6755f4582bf6f7bbd8e1ef2b91f64e9845b2646e1350649f0d
MD5 7535365c3a3597101d7bcd9e2bacd1d7
SHA1 c4d4e596d414ab22767cd1b21fa901f735083878
SHA512 f812e0aff7bd56ba44778076390eae4c24d3cc89eb754c7160e64e8a9619541fff17d5167df3850933af8f3873512c6b15ca395fad2246b244e6c3c0a6b9ac09
SSDEEP 12288:StobbXN42nHq+EgqfRAUEcB3gOE6DZlZUXavlXluE70pFdZigcyrG4EEu44S+j:St8RHjEgYAw1hZlZTWQu7igcyKPEujz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

ad:fe:36:9b:9f:1a:31:02:16:ca:44:26:a8:18:55:7a:b4:8e:8f:1f:58:05:11:b8:eb:04:f3:1f:e7:b8:e3:05

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Chains

Apr 22, 2019

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

85:53:7f:1c:dd:35:b2:ae:8e:84:2b:7e:07:df:65:62:09:9e:f4:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Chains

Apr 22, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Serial Number

45:bb:20:2a:9d:33:0e:fa:75:86:52:1a:e6:f2:20:e4

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 1, 2019 - Jan 31, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jul 22, 2014 - Jul 21, 2024

Subject

Serial Number

40:1a:c4:64:21:b3:13:21:03:0e:bb:e4:12:1a:c5:1d

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 2, 2008 - Dec 1, 2037

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,C=IM

Serial Number

7f:aa:d4:d3:ff:7b:07:fb:e9:fd:c3:b7:07:fb:79:2c

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 16, 2018 - Feb 15, 2021

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

17191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/StdUtils.dll

IMPHASH 6aa1fb50f909cdf4bea3d3523348e900
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_3_

IMPHASH ad0c070707e2c3413be9c2aad29f01a4
SHA256 f2126481c02d2a5af29e56023902a0897d05867c1caaf8079cf6e1f05dd9b209
MD5 9ab5db4bb5971035b4d287d64f9676b5
SHA1 33d17f016339572dd05c124d6243fffefd0cd039
SHA512 d36262fdd4d8bd083d8537f0698c423240c9e42b2dc0048e2470d87411f295d6e3428587b76b0486875495d502f1f31f9edf3eb6fdb914f13421b7f29fa5f066
SSDEEP 49152:G0BIrT/YNRoLlps7tZokvTopSdmX4Foni7iMmdc:GbTRps7Xj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

Digest

6a:6b:c7:73:36:79:60:2f:2d:a0:47:23:b8:cf:3a:fb:6a:46:6c:ff:09:5b:7d:e5:4e:4a:10:7f:09:79:84:2c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,ST=Isle Of Man,C=IM

Chains

Mar 8, 2017

CN=Playtech PLC,O=Playtech PLC,L=Douglas,ST=Isle Of Man,C=IM

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

93:ab:67:9d:96:be:f8:42:c6:a2:ca:5c:61:30:aa:e7:e6:98:04:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Playtech PLC,O=Playtech PLC,L=Douglas,ST=Isle Of Man,C=IM

Chains

Mar 8, 2017

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,ST=Isle Of Man,C=IM

Serial Number

6b:5f:59:af:12:47:a2:e7:a0:51:03:4f:f7:9f:00:8a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 14, 2014 - Feb 12, 2018

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Playtech PLC,O=Playtech PLC,L=Douglas,ST=Isle Of Man,C=IM

Serial Number

12:ff:91:3c:87:bf:19:5c:ff:a0:6e:52:05:ed:d8:d2

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 14, 2016 - Feb 12, 2018

Subject

Serial Number

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 8, 2006 - Jul 16, 2036

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Serial Number

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

980693

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetConnectW HttpSendRequestW InternetSetOptionW HttpQueryInfoW InternetReadFile InternetGetLastResponseInfoW InternetCloseHandle InternetGetConnectedState InternetCrackUrlW InternetQueryOptionW HttpOpenRequestW InternetOpenW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

gdiplus

GdipDeleteBrush GdipFree GdipDeletePen GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreatePen1 GdipReleaseDC GdipGetImageWidth GdipCloneImage GdipFillRectangleI GdipCreateFromHDC GdipCreateBitmapFromHBITMAP GdipCreateBitmapFromFile GdipDisposeImage GdipAlloc GdipCreateSolidFill GdipSetSmoothingMode GdipDrawImageRectI GdipDeleteGraphics GdipSetPenMode GdipGetImageHeight

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose CertGetNameStringW CryptQueryObject CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam

kernel32

ReadConsoleInputA SetConsoleMode IsValidCodePage GetACP DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetVersionExW WriteFile ReadFile GetStdHandle GetLastError LeaveCriticalSection EnterCriticalSection WaitForMultipleObjects WideCharToMultiByte MultiByteToWideChar GetFullPathNameW CreateDirectoryW SetFileTime CreateFileW lstrlenW RemoveDirectoryW CloseHandle DeleteFileW SetFileAttributesW FindFirstFileW FindClose FindNextFileW GetFileSize SetFilePointer SetEndOfFile GlobalMemoryStatus GetModuleHandleW GetProcAddress GetSystemInfo VirtualFree VirtualAlloc WaitForSingleObject SetEvent InitializeCriticalSection ResetEvent CreateEventW FindResourceExW FindResourceW LoadResource SizeofResource GetOEMCP InterlockedDecrement OutputDebugStringW GetCurrentThreadId GetCurrentProcessId GetSystemDefaultLCID CreateThread CopyFileW GetFileAttributesW lstrlenA GetEnvironmentVariableW FlushFileBuffers GetLongPathNameW GetVersion MapViewOfFile UnmapViewOfFile FlushViewOfFile Sleep GetModuleFileNameW CreateFileMappingW GetCurrentProcess OpenProcess TerminateProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot HeapAlloc HeapFree GetProcessHeap InterlockedIncrement GlobalLock GlobalAlloc MulDiv lstrcmpW GlobalUnlock FlushInstructionCache RaiseException SetLastError GetTickCount GetExitCodeProcess EnumSystemLanguageGroupsW GetProcessId LocalAlloc LocalFree GlobalFree GlobalHandle FreeLibrary LoadLibraryExW lstrcmpiW GetModuleHandleA GetFileType QueryPerformanceCounter LoadLibraryA GetVersionExA FlushConsoleInputBuffer UnhandledExceptionFilter SetUnhandledExceptionFilter TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW HeapSize RtlUnwind GetConsoleCP SetFilePointerEx GetStringTypeW LoadLibraryW GetEnvironmentStringsW FreeEnvironmentStringsW ReadConsoleW SetStdHandle GetLocaleInfoW IsValidLocale GetUserDefaultLCID EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent HeapReAlloc ExitThread GetSystemTimeAsFileTime GetLocalTime GetTimeZoneInformation GetCPInfo GetModuleHandleExW WriteConsoleW GetCommandLineW ExitProcess AreFileApisANSI SetConsoleCtrlHandler GetConsoleMode EnumSystemLocalesW CompareStringW LCMapStringW SetEnvironmentVariableA HeapDestroy InterlockedCompareExchange InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList LockResource

user32

GetMessageW GetUserObjectInformationW GetProcessWindowStation MessageBoxA AnimateWindow CallNextHookEx GetMenuItemInfoW TranslateMessage IsDialogMessageW GetWindowPlacement CreateDialogIndirectParamW CheckMenuRadioItem PeekMessageW SetMenuDefaultItem SetWindowsHookExW UnhookWindowsHookEx GetSystemMetrics SetDlgItemTextW EnableWindow SetMenuItemInfoW DispatchMessageW GetLastInputInfo SwitchToThisWindow UpdateLayeredWindow PostQuitMessage UnregisterClassW LoadIconW FindWindowExW MessageBoxW RegisterClassW ValidateRect EndPaint ClientToScreen DestroyWindow GetWindowTextLengthW DestroyAcceleratorTable SetWindowRgn SetTimer ScreenToClient GetWindowRect MapDialogRect CharNextW GetWindowDC RegisterWindowMessageW FillRect IsChild SetCapture KillTimer GetFocus GetParent InvalidateRgn LoadCursorW GetClientRect CreateAcceleratorTableW SetFocus BeginPaint GetClassInfoExW GetDC SetWindowContextHelpId RegisterClassExW InvalidateRect GetWindowLongW GetWindowTextW SystemParametersInfoW GetClassNameW ReleaseDC GetDlgItem SetWindowLongW EndDialog RedrawWindow SendDlgItemMessageW GetDesktopWindow GetSysColor SetWindowPos SetLayeredWindowAttributes ShowWindow IsWindow CreateWindowExW ReleaseCapture SendMessageW SetWindowTextW CallWindowProcW DefWindowProcW GetWindow MoveWindow EnumWindows GetWindowThreadProcessId CharUpperW PostMessageW

gdi32

DeleteDC CreateDIBSection GetDeviceCaps DeleteObject SelectObject CreateCompatibleDC CombineRgn CreateSolidBrush BitBlt CreateRectRgn GetObjectW CreateCompatibleBitmap GetStockObject

advapi32

RegisterEventSourceA RegOpenKeyExW RegCloseKey ReportEventA DeregisterEventSource RegQueryInfoKeyW RegSetValueExW RegDeleteValueW RegCreateKeyExW RegEnumKeyExW LookupAccountSidW RegDeleteKeyW RegSetValueW OpenProcessToken LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges RegQueryValueExW

shell32

ShellExecuteExW ExtractIconW SHGetPathFromIDListW ShellExecuteW SHBrowseForFolderW SHGetDesktopFolder SHCreateDirectoryExW SHFileOperationW

ole32

CoCreateInstance OleLockRunning CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal StringFromGUID2 OleSetContainedObject OleInitialize OleUninitialize StgCreateDocfile OleCreate OleDraw CoTaskMemFree CoGetClassObject CoTaskMemAlloc CoCreateGuid CoUninitialize CoTaskMemRealloc CoInitialize

oleaut32

GetErrorInfo VarUI4FromStr DispCallFunc LoadRegTypeLi OleCreateFontIndirect SysAllocStringLen SysAllocString SysFreeString VariantClear VariantCopy SysStringLen VariantInit LoadTypeLi

shlwapi

ord176 UrlEscapeW PathIsDirectoryEmptyW

comctl32

InitCommonControlsEx

7535365c3a3597101d7bcd9e2bacd1d7_JaffaCakes118

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

kernel32

user32

shell32

ole32

oleaut32

generic

$_3_

PE Signature issue

wininet

version

gdiplus

psapi

crypt32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

generic

$_4_

$_5_