931b12be80c60acd76de1b96d4a90799_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
931b12be80c60acd76de1b96d4a90799_JaffaCakes118
Size 19.2MB
Sample240604-amlh3sed9z
SHA256 06c2ba2931b74c1ad30af2f8315ccbf06ad5e25aa472f8dd3c27456b739e2f1f
MD5 931b12be80c60acd76de1b96d4a90799
SHA1 6df652fa5e0f8646adfa79f3a821d18bb49c6b09
SHA512 6570c72a23f3c114b98a1ff701c80a87c5f519e903a6a642441a322d80aa2b1a3144a698aa1df38fe21f7dbd1358e033a7516a38a716d6bd8b5292169025b76b
SSDEEP 393216:6nmHYd25WMvHR8pkGs9DO2aLgNodHzCKRog5meGQvP/sW1f3J5:6mHXJHLp9qhGodHzCKRoQ/Pkuf3j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/SetupPlugin.dll

File Explorer

931b12be80c60acd76de1b96d4a90799_JaffaCakes118

.exe 19.2MB
$EXEDIR/install_flash_player_21_plugin.exe

.exe 19.0MB
$PLUGINSDIR/SetupPlugin.dll

.dll 136KB

931b12be80c60acd76de1b96d4a90799_JaffaCakes118

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 06c2ba2931b74c1ad30af2f8315ccbf06ad5e25aa472f8dd3c27456b739e2f1f
MD5 931b12be80c60acd76de1b96d4a90799
SHA1 6df652fa5e0f8646adfa79f3a821d18bb49c6b09
SHA512 6570c72a23f3c114b98a1ff701c80a87c5f519e903a6a642441a322d80aa2b1a3144a698aa1df38fe21f7dbd1358e033a7516a38a716d6bd8b5292169025b76b
SSDEEP 393216:6nmHYd25WMvHR8pkGs9DO2aLgNodHzCKRog5meGQvP/sW1f3J5:6mHXJHLp9qhGodHzCKRoQ/Pkuf3j
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

ed:96:4a:ee:ce:ef:0f:cb:87:ae:72:9a:56:55:51:c2:95:94:c4:67:21:da:9b:04:c1:b3:22:ee:8b:f8:87:97

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

May 13, 2016

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

PE Signature issue

Digest

20:eb:94:5a:39:d8:cf:b0:c0:0b:dc:d9:a0:16:0b:d7:b2:f1:ef:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Chains

May 13, 2016

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 4, 2016 - Mar 28, 2019

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Serial Number

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2016 - Mar 28, 2019

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=GeoTrust 2048-bit Timestamping Signer 4,O=GeoTrust Inc,C=US

Serial Number

70:a0:1c:f4:ea:ef:99:fd:46:6c:ed:16:30:c1:b0:1f

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 11, 2015 - Dec 29, 2020

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Serial Number

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Timespan

Jan 1, 1997 - Dec 31, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Minor OS version

Major OS version

Entry point

13628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$EXEDIR/install_flash_player_21_plugin.exe

IMPHASH 56b297a426c388478ce18339f58ca594
SHA256 6b87a45ba965672d9cc4270668dff74e1307a3a8c207ba727c88fd92e76e6c0b
MD5 e9fbb2a2c30af313c6ed70d77c2c674b
SHA1 1dc0aff30de4577aa9870be61f16d6614ac22a8e
SHA512 bfe25c8960670bcfc1ca7d0d162c8a38addd1a92f1869628c4252e60fa0977da50fbfab1a7b7594c729f189cfa00781e762d5a78f53e1eac659c3ba80997d745
SSDEEP 393216:/pGhrKnwYcEqtKfVAGx2U8yP9LQzXIDmmlsrtnOdZBj3TH/m4:/QhrGvcEqtuiABQjEmWBj3Tfm4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Digest

80:ff:f9:ab:2b:4d:36:dd:b8:06:0f:5a:35:86:38:53:25:dd:f6:c3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

May 10, 2016

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 4, 2014 - Mar 3, 2024

Subject

Serial Number

4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:ba

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 14, 2015 - May 7, 2017

Minor OS version

Major OS version

Entry point

127292

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Morpheme.pdb

kernel32

GetFileSize Sleep GetTickCount CreateProcessW FindResourceW CreateDirectoryW WriteFile DeleteFileW GetTempFileNameW GetTempPathW FreeResource LockResource SizeofResource LoadResource SetFilePointer OpenProcess TerminateProcess GetThreadLocale GetProcAddress GetSystemDirectoryW GetSystemTime FindResourceA OutputDebugStringW LoadLibraryA InterlockedIncrement InterlockedDecrement GlobalAddAtomW ReadFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetLocaleInfoA InitializeCriticalSectionAndSpinCount IsValidCodePage GetOEMCP GetACP GetCPInfo FlushFileBuffers GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleHandleA HeapSize GetProcessHeap SetEndOfFile GetModuleFileNameA SetStdHandle GetStdHandle SetHandleCount WriteConsoleW GetConsoleOutputCP WriteConsoleA HeapReAlloc VirtualAlloc CreateThread CreateWaitableTimerW ExitThread SetWaitableTimer QueueUserAPC ReleaseMutex SetDllDirectoryW GetModuleHandleW GetCommandLineW CopyFileW GetLastError SetFileAttributesW MultiByteToWideChar WideCharToMultiByte RemoveDirectoryW WaitForSingleObject GetExitCodeProcess SetThreadLocale GetCurrentProcess LocalAlloc LocalFree GetUserDefaultUILanguage GetVersionExA MoveFileExW CreateFileW GetModuleFileNameW GetEnvironmentVariableW ExitProcess FreeLibrary LoadLibraryW CloseHandle CreateMutexW DeleteCriticalSection VirtualFree HeapCreate GetCurrentThreadId SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue LeaveCriticalSection EnterCriticalSection GetStartupInfoA GetCommandLineA InterlockedExchange IsDebuggerPresent SetUnhandledExceptionFilter RtlUnwind HeapFree GetConsoleCP GetConsoleMode HeapAlloc GetFileType CreateFileA RaiseException UnhandledExceptionFilter

user32

LoadStringW GetForegroundWindow EndPaint SetWindowPos DrawTextW ClientToScreen SetRect SetPropW GetParent CallWindowProcW MapWindowPoints GetPropW RegisterClassExW CreateWindowExW SetForegroundWindow SetTimer GetMessageW GetWindowLongW DispatchMessageW DefWindowProcW BeginPaint TranslateMessage SetWindowLongW GetKeyState LoadCursorW SetCursor InvalidateRect ReleaseCapture SetCapture GetClientRect GetWindowRect MoveWindow GetDC ReleaseDC PostQuitMessage PostMessageW FillRect ShowWindow SetWindowTextW DestroyWindow GetWindow

gdi32

GetTextExtentExPointW SetTextColor CreateFontA BitBlt CreateCompatibleDC CreateCompatibleBitmap SelectObject DeleteDC StretchBlt CreateSolidBrush DeleteObject CreateDIBSection SetBkMode

advapi32

RegDeleteValueW RegSetValueExW RegQueryValueExW ControlService OpenSCManagerW OpenServiceW CloseServiceHandle CryptHashData CryptGetHashParam CryptReleaseContext RegCreateKeyExW RegSetValueExA RegOpenKeyExW RegCloseKey AllocateAndInitializeSid CheckTokenMembership FreeSid

shell32

ShellExecuteW ord680 ShellExecuteExW SHGetFolderPathW

ole32

StringFromGUID2 CoCreateGuid CoUninitialize CoInitializeSecurity CoInitializeEx CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

$PLUGINSDIR/SetupPlugin.dll

IMPHASH 769dc54489a0583761c7e9782a6c8593
SHA256 7f90c32afe9ccce50d99f845ee3639aa36ce85f7be69ba2777ffc3a466d93900
MD5 5508dca735abb51f7eda223ed487e43f
SHA1 2f2ac64e4900e8d5217124dd06ed790494e2dcd2
SHA512 9b3d2d41c3e03ed5c7d16fdb95b7f2e229f1dd7330f9d93c6a415a06e2492346b5ac0e15a977fdfba94e58dc33c6dda8911ec76ed390d191ef3e36ceb0c48c30
SSDEEP 1536:YnN4PBdeANfP1rP9zv7WB3QF8OaAALJ2MV2i42nFbjj5mFMLwawAt5a:YN4PmmhWdmHtqIik6LvwAt5a
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

46329

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Codes\自制包工具\NSIS2.38_Unicode\Plugins\SetupPlugin.pdb

kernel32

TerminateProcess GetCurrentProcess GetWindowsDirectoryW GetSystemDirectoryW GetTempPathW GetTempFileNameW LoadLibraryW GetProcAddress FreeLibrary MapViewOfFileEx CloseHandle UnmapViewOfFile GetLocalTime CreateFileW WideCharToMultiByte MultiByteToWideChar WriteFile GetCPInfo IsDBCSLeadByte SetFilePointer GetFileSize GetCurrentThread GetLastError CreateFileMappingW GetVersionExW RemoveDirectoryW MoveFileExW FindClose FindNextFileW FindFirstFileW GetFileAttributesW DeleteFileW OutputDebugStringW CopyFileW FindResourceW FindResourceExW LoadResource LockResource SizeofResource lstrcpynW GlobalFree FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetVersionExA HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess GetOEMCP IsValidCodePage LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualAlloc RtlUnwind GetConsoleCP GetConsoleMode LoadLibraryA GetStringTypeA GetStringTypeW

advapi32

OpenProcessToken OpenThreadToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsTextUnicode GetUserNameW RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation

shell32

SHCreateDirectoryExW SHGetFolderPathW SHFileOperationW

shlwapi

PathFileExistsW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

user32

UnregisterClassA

931b12be80c60acd76de1b96d4a90799_JaffaCakes118

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$EXEDIR/install_flash_player_21_plugin.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/SetupPlugin.dll

kernel32

advapi32

shell32

shlwapi

version

user32

generic