91936315e938af44d665c31f6ec7af08_JaffaCakes118
- SHA256 bfe585fde57162ecc54ee3b34d91952b7ad12cbe85bfc923eeeff434815eb0bc
Overview
overview
9Static
static
3VBA Recove...up.exe
windows7-x64
3VBA Recove...up.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
4Uninstall.exe
windows10-2004-x64
4VBAPass.chm
windows7-x64
1VBAPass.chm
windows10-2004-x64
1VBAPass.exe
windows7-x64
9VBAPass.exe
windows10-2004-x64
9Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
VBA Recovery Toolkit setup.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
VBA Recovery Toolkit setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Uninstall.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
VBAPass.chm
Resource
win7-20240419-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
VBAPass.chm
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
VBAPass.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
VBAPass.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 91936315e938af44d665c31f6ec7af08_JaffaCakes118
- Size 3.1MB
- Sample240603-nbrslscd7w
- SHA256 bfe585fde57162ecc54ee3b34d91952b7ad12cbe85bfc923eeeff434815eb0bc
- MD5 91936315e938af44d665c31f6ec7af08
- SHA1 b11cc51cbf9c8b5dea90dcfc321f6685162609eb
- SHA512 b5a67cf2730efafd7e5568286cbc7a5615283f0d521810832fde08127e3207434e35d4cc3f2167f6e81d651308d29bf030d3fadcd627e1e3dbaf8cb880f362ba
- SSDEEP 49152:QRMsfsnX4Xe0wga0Ygy/snEcLJL+meDSB2qPdCm7IkSifVC/KG5XG0bzIhZY:QysfsnqejczQBDSB2qkmU625bILY
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/$PLUGINSDIR/InstallOptions.dll - NSIS installer 4 IoCs
resource yara_rule static1/unpack001/VBA Recovery Toolkit setup.exe nsis_installer_1 static1/unpack001/VBA Recovery Toolkit setup.exe nsis_installer_2 static1/unpack002/Uninstall.exe nsis_installer_1 static1/unpack002/Uninstall.exe nsis_installer_2
File Explorer
-
91936315e938af44d665c31f6ec7af08_JaffaCakes118.zip 3.1MB
-
VBA Recovery Toolkit setup.exe.exe 3.1MB
-
$PLUGINSDIR/InstallOptions.dll.dll 14KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp9KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
Uninstall.exe.exe 59KB
-
$PLUGINSDIR/modern-header.bmp9KB
-
VBAPass.chm.chm 23KB
-
VBAPass.exe.exe 3.1MB
VBA Recovery Toolkit setup.exe
- IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
- SHA256 4ad7116cb3f2b74dd7ad9073986a614781c53e7c97e36ddc2d6173e7bcf693e4
- MD5 b705b211b6fa95cf5f63c73017f137d6
- SHA1 fd95a7d94e8d33988c119c8af06e48e62d9c23b4
- SHA512 7c475d9e5ecf7e6d9245144455d70b01a7c77dcbd34a94e75df141093670d482c8ebaaf3ebe9506e07ff3311e99d1965bcd2fa5b925bf7a05c6da2f39947ac6d
- SSDEEP 49152:7XsPsfX4Xgkw0kQE4GPwTweLZL+yehSl6qvDWYluCS4HFQnoYxfesbz0DZB:7XsPsfqgTwr2lhSl6qCYwiUxD01B
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Digest
57:7a:23:5a:79:75:29:30:8f:dc:0c:8d:2d:82:11:a1:c9:20:f3:b7:2d:f1:98:16:39:78:42:5f:6b:97:6c:88
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Chains
Jun 13, 2018
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Serial Number
5c:22:1c:e5:5d:2b:36:92:57:c6:6a:c1:21:98:57:05
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 10, 2014 - Jan 10, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
13096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH 610235b90207a63ccf481f0d4375d329
- SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
- MD5 8d5a5529462a9ba1ac068ee0502578c7
- SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
- SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
- SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10722
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetPrivateProfileIntA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileStringA
SetCurrentDirectoryA
GetModuleHandleA
lstrcmpiA
WritePrivateProfileStringA
lstrcatA
lstrcpynA
GlobalFree
lstrlenA
lstrcpyA
GlobalUnlock
GlobalAlloc
GlobalLock
user32
MapWindowPoints
PtInRect
CloseClipboard
LoadCursorA
GetDlgCtrlID
OpenClipboard
GetClientRect
SetWindowRgn
DrawFocusRect
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
SetCursor
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
GetSysColor
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowLongA
EnableMenuItem
GetSystemMenu
GetClipboardData
LoadIconA
gdi32
DeleteObject
CombineRgn
SetTextColor
GetDIBits
SelectObject
CreateRectRgn
GetObjectA
CreateCompatibleDC
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetDesktopFolder
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
dialog
initDialog
show
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=74, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-header.bmp
- SHA256 22938e527fefdebecc6009ee63dd9849ebde7f3f734d85b375396c41640d6a30
- MD5 43a6d657abb27bf419b60eeb4c56a880
- SHA1 a06d1a84bd78aa0b3cbc322b7d73cdee91e58e0d
- SHA512 36cf2df9e788b162b6a40b99854810465e50778905a81d40279b163ff5acbcc3cd52f7f83b8cf6dce898041cc330ca6f3bd2592080e47eb9c1fe63987d643168
- SSDEEP 48:1TgLzqmixpAB93s0od7Ay6vrk6GTe26VKI7giJSUoH+yJtJIFM:VgLzqNpAB93s0odYrk6Gi26oI7/JS2VO
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
Uninstall.exe
- IMPHASH 3abe302b6d9a1256e6a915429af4ffd2
- SHA256 57570d68d9ad4a05b31d189749deba5117349dd5f9b0b730346532eb75994148
- MD5 4cd58b6fdf7b31a3cbe9c4e405bf1376
- SHA1 b34430e909a7798687f29d914c4b23b5c4a24bb8
- SHA512 640b5d0eb675b78cff16e1c296a50516aa55bc11a48a053094e18b22a300784772dfe8f1e90daa455815e70123f016d3e8bcdcd4d33ee6f8c33b98c21ec623fd
- SSDEEP 1536:kHYMiClDhdyA5x5Z0DvyecncS7eFx3IiFI:QYjClDhQlDvrccfFx3JI
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
Digest
19:bf:c6:f1:bc:e3:2d:b7:e9:37:de:68:0a:25:27:df:fb:1c:5f:94:6d:5e:46:fc:4b:11:26:ca:24:92:31:47
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Chains
Jun 13, 2018
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Serial Number
5c:22:1c:e5:5d:2b:36:92:57:c6:6a:c1:21:98:57:05
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 10, 2014 - Jan 10, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
12812
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTempPathA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
Sleep
GetTickCount
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GetWindowsDirectoryA
SetCurrentDirectoryA
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
CreateThread
GlobalLock
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA
user32
ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA
advapi32
AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=159, id=1, productName=Unmarked objects,
count=15, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/modern-header.bmp
- SHA256 22938e527fefdebecc6009ee63dd9849ebde7f3f734d85b375396c41640d6a30
- MD5 43a6d657abb27bf419b60eeb4c56a880
- SHA1 a06d1a84bd78aa0b3cbc322b7d73cdee91e58e0d
- SHA512 36cf2df9e788b162b6a40b99854810465e50778905a81d40279b163ff5acbcc3cd52f7f83b8cf6dce898041cc330ca6f3bd2592080e47eb9c1fe63987d643168
- SSDEEP 48:1TgLzqmixpAB93s0od7Ay6vrk6GTe26VKI7giJSUoH+yJtJIFM:VgLzqNpAB93s0odYrk6Gi26oI7/JS2VO
- MD5 SHA1 SHA512 SSDEEP
VBAPass.chm
- SHA256 2aab635c4be3fdb85d56d35632396d9260c69e65ea4633bfd3e3c396aa53b965
- MD5 03ab84915fbb8cff181ac17a6b09a5f3
- SHA1 a5819477b8c91a0b757841a0dcfc6fa04a8f9f33
- SHA512 92cad49e981474cff6a1169f26fbaf7146269d4843fb742ba02bfa826d6ff817df5401e4210b0e8a63370cd79c03b822018b70965cae925497abddad043244e8
- SSDEEP 384:QPfwkEVdnwPu0FQHBOdz3Z0N0Ns4n3XJPvh0moNe:QPfwkiRHBAZ0Ncs0hZ0ze
- MD5 SHA1 SHA512 SSDEEP
VBAPass.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 c7fa6d56b72b6c3468df2669319153ed0244f9f8149a7508901a86361d229f28
- MD5 3d7a50097d7342c76072cfe1c77c0caf
- SHA1 adffbf61e11661e534eb6cb31a5c4d7839a86a65
- SHA512 9b09a103797b01dda3777724633ef1f09095201b12bc02c495840071c6dee5d5fb19cd4d1246d13bd7495ff66f72908212b745266430dca7d61f6546cf1503fc
- SSDEEP 98304:y95rG7EBc/wTv9F4uwX9qNrewiK8raowZD:y95S7CYwhwX9qNyKSCD
- MD5 SHA1 SHA512 SSDEEP
Digest
84:15:ee:0a:dc:47:dd:46:a0:8d:93:7d:d1:e2:8f:22:56:45:b0:af:d3:da:c3:c2:c9:35:8e:ef:12:45:ad:f1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Chains
Jun 13, 2018
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=THEGRIDEON LTD,O=THEGRIDEON LTD,POSTALCODE=EC1V 4PW,STREET=145-157 St John Street,L=London,ST=n/a,C=GB
Serial Number
5c:22:1c:e5:5d:2b:36:92:57:c6:6a:c1:21:98:57:05
Issuer
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jan 10, 2014 - Jan 10, 2019
Subject
CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Issuer
CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 9, 2013 - May 8, 2028
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
8945664
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
220KB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
jzksmufb
Size
2.8MB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
rffzhmbb
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.taggant
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=126, version=50327,
count=26, id=125, productName=VS2005 build 50727, version=50727,
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=263, id=1, productName=Unmarked objects,
count=1, id=259, productName=VS2015 [14.0] build 23026, version=23026,
count=132, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=259, productName=VS2017 v15.6.3 build 26129, version=26129,
count=83, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=2, productName=Unmarked objects (old),
count=1, id=120, productName=VS2005 build 50727, version=50727,