a7ca6f13489de04beb70b23cce59c999_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a7ca6f13489de04beb70b23cce59c999_JaffaCakes118
Size

2.3MB
MD5

a7ca6f13489de04beb70b23cce59c999
SHA1

c14537adffd237b33f3cc8da0886e0d1fc9923b1
SHA256

16280b679905d4f620094a6b21675734c130e413369af5d4e5bbd4b9b96bd83c
SHA512

0024799daf7ef3a509405e5d905819484099f319463491ad4b7d67f5a018b1fbbfbf0e83e24cffb2ede63dd39ac22c9b96377537a3457a7f58175476f7b0baea
SSDEEP

49152:6pyH79qCx+wI85ZwcRjBQAhB55xEL2aPvDVjBCfoBVPvVF9:6o79qUIcRjBQAhBnxFYX

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

Files

a7ca6f13489de04beb70b23cce59c999_JaffaCakes118
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e2:54:c9:7a:f6:81:30:58:47:ab:eb:02:f0:ef:77:bd:8e:0d:e0:b5
Signer

Actual PE Digest

e2:54:c9:7a:f6:81:30:58:47:ab:eb:02:f0:ef:77:bd:8e:0d:e0:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/border.png
.png
$PLUGINSDIR/close.png
.png
$PLUGINSDIR/isx.dll
.dll windows:5 windows x86 arch:x86

8805497fd59d82f20ca43d24cd42c912

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

99:fe:cd:2c:c8:01:20:c1:79:95:a0:13:85:43:2f:91:24:2e:9c:dc
Signer

Actual PE Digest

99:fe:cd:2c:c8:01:20:c1:79:95:a0:13:85:43:2f:91:24:2e:9c:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\buildbot\slave1\kugou_installer\build\Release\isx.pdb

Imports

kernel32

CreatePipe
SetHandleInformation
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
GetTickCount
PeekNamedPipe
SetLastError
GetProcAddress
GetModuleHandleW
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
OpenProcess
TerminateProcess
Process32NextW
InterlockedDecrement
GetPrivateProfileSectionW
GetModuleFileNameW
GetCurrentProcess
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
GetDriveTypeW
GetDiskFreeSpaceW
GetSystemInfo
GetProcessAffinityMask
SetProcessAffinityMask
LocalAlloc
LocalFree
SetEvent
SetCurrentDirectoryW
GetCommandLineW
CreateEventW
OpenFileMappingW
OpenEventW
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
SetFilePointer
ReadFile
GetLastError
GetFileSize
GetCurrentThreadId
GetVersionExW
GlobalAlloc
lstrcpynW
GlobalFree
FreeLibrary
LoadLibraryW
WaitForMultipleObjects
DeleteFileW
SetConsoleMode
ReadConsoleInputA
FlushConsoleInputBuffer
GetVersionExA
GlobalMemoryStatus
GetModuleHandleA
CreateThread
WriteFile
DeviceIoControl
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
Sleep
WritePrivateProfileStringW
GetLocalTime
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcmpiW
GetPrivateProfileSectionNamesW
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameW
SetEnvironmentVariableA
GetTimeZoneInformation
WriteConsoleW
OutputDebugStringW
LCMapStringW
CompareStringW
SetConsoleCtrlHandler
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
FlushFileBuffers
SetStdHandle
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetProcessHeap
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
lstrcpyW
lstrlenW
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStartupInfoW
ReadConsoleW
GetConsoleMode
HeapSize
AreFileApisANSI
GetModuleHandleExW
ExitProcess
RtlUnwind
RaiseException
LoadLibraryExW
ExitThread
FileTimeToSystemTime
GetFileInformationByHandle
FileTimeToLocalFileTime
SetFilePointerEx
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetSystemTimeAsFileTime
InterlockedIncrement
FormatMessageA
ExpandEnvironmentStringsA
GetFileType
LoadLibraryA
GetStdHandle
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SleepEx

user32

AllowSetForegroundWindow
LoadStringW
CreatePopupMenu
DestroyMenu
FindWindowExW
PostMessageW
FindWindowW
GetDesktopWindow
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetForegroundWindow
AttachThreadInput
BringWindowToTop
SetForegroundWindow
SystemParametersInfoW
GetWindowThreadProcessId
PeekMessageW
MsgWaitForMultipleObjects
DispatchMessageW
TranslateMessage
wsprintfW
SetWindowsHookExW
GetClassNameW
GetDlgItem
SendMessageW
CallNextHookEx
UnhookWindowsHookEx
CharNextW

advapi32

ReportEventA
DeregisterEventSource
CloseServiceHandle
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegisterEventSourceA

shell32

CommandLineToArgvW
SHGetDesktopFolder
SHGetSpecialFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString
VariantClear
VariantInit

shlwapi

PathFileExistsW
StrToIntW
PathCombineW
PathIsDirectoryEmptyW
PathIsRelativeW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
ord176

wininet

InternetCloseHandle
InternetOpenUrlW
InternetOpenW

iphlpapi

GetAdaptersInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

WSAGetLastError
shutdown
gethostname
getaddrinfo
WSACleanup
getsockopt
closesocket
WSASetLastError
socket
bind
recv
setsockopt
getsockname
ntohs
htons
WSAStartup
connect
getpeername
send
sendto
recvfrom
accept
listen
__WSAFDIsSet
select
ioctlsocket
freeaddrinfo

wldap32

ord50
ord143
ord41
ord35
ord211
ord32
ord26
ord60
ord30
ord79
ord33
ord27
ord301
ord200
ord46
ord22

Exports

Exports

k00
k01
k02
k03
k04
k05
k06
k07
k08
k09
k10
k11
k12
k13
k14
k15
k16
k17
k18
k19
k20
k21
k22
k23
k24
k25
k26
k27
k28
k29
k30
k31
k32
k33
k34
k35
k36
k37
k38
k39
k40
k41
k42
k43
k44
k45
k46
k47
k48
k49
k50
k51
k52
k53
k54
k55
k56
k57
k58
k59
k60
k61
k62
k63
k64
k65
k66
k67
k68
k69
k70
k71
k72
k73
k74
k75

Sections

.text
Size: 927KB - Virtual size: 927KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/kgskin.dll
.dll windows:5 windows x86 arch:x86

e4293a9f56d0fd5dd2cef90ff7ffd011

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

08/12/2017, 00:00

Not After

08/03/2021, 23:59

Subject

CN=Guangzhou KuGou Computer Technology Co.\, Ltd.,OU=IT,O=Guangzhou KuGou Computer Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c3:13:b4:5f:f6:d6:7a:da:df:23:a4:77:29:c5:0c:c9:1a:d5:f1:16
Signer

Actual PE Digest

c3:13:b4:5f:f6:d6:7a:da:df:23:a4:77:29:c5:0c:c9:1a:d5:f1:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\buildbot\slave1\kugou_installer\build\Release\kgskin.pdb

Imports

kernel32

LCMapStringW
LeaveCriticalSection
EnterCriticalSection
GetStringTypeW
HeapSize
GetCPInfo
GetOEMCP
IsValidCodePage
WriteFile
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
WideCharToMultiByte
GetModuleHandleExW
SetLastError
RaiseException
IsProcessorFeaturePresent
IsDebuggerPresent
HeapReAlloc
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
DecodePointer
EncodePointer
RtlUnwind
LoadLibraryExW
OutputDebugStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
lstrcmpW
ExitProcess
ReadFile
CloseHandle
GetFileSize
CreateFileW
GetTickCount
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryW
GetACP
MultiByteToWideChar
GetLastError
GlobalAlloc
lstrcpynW
GlobalFree
lstrcpyW
FreeResource
LockResource
LoadResource
SizeofResource
FindResourceW
lstrlenW
lstrcmpiW
FreeEnvironmentStringsW
FlushFileBuffers

user32

GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
CharPrevW
SetRect
DrawTextW
FillRect
GetWindowLongW
SetWindowLongW
GetClientRect
SetWindowPos
IsWindowVisible
IntersectRect
CharNextW
PtInRect
ReleaseCapture
SetCapture
KillTimer
SetTimer
GetFocus
GetCursorPos
InvalidateRect
UpdateLayeredWindow
IsRectEmpty
EndPaint
BeginPaint
GetUpdateRect
GetDC
ReleaseDC
DestroyWindow
SetRectEmpty
GetKeyState
SetCursor
wvsprintfW
PostMessageW
RemovePropW
GetPropW
RegisterClassExW
GetClassInfoExW
RegisterClassW
LoadCursorW
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetParent
PostQuitMessage
DispatchMessageW
TranslateMessage
SetFocus
GetMessageW
EnableWindow
GetWindow
IsWindow
SetPropW
CreateWindowExW
DefWindowProcW
wsprintfW
SendMessageW
FindWindowExW
CallWindowProcW
ShowWindow
IsWindowEnabled
GetDlgItem
ScreenToClient
SetWindowRgn
OffsetRect
GetWindowRect
IsIconic
MessageBoxW

gdi32

CreateSolidBrush
ExtTextOutW
SetBkColor
SetStretchBltMode
StretchBlt
CreateDIBSection
CombineRgn
ExtSelectClipRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetTextMetricsW
SetWindowOrgEx
Rectangle
BitBlt
RestoreDC
CreatePenIndirect
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
CreatePen
CreateFontIndirectW
GetObjectW
DeleteObject
CreateRoundRectRgn
RoundRect
SetBkMode
SetTextColor
GetCharABCWidthsW
GetTextExtentPoint32W
TextOutW
MoveToEx
SaveDC
GetStockObject
LineTo

ole32

CoUninitialize
CoInitialize
CoCreateInstance

comctl32

ord17
_TrackMouseEvent

Exports

Exports

k0
k1
k10
k2
k3
k4
k5
k6
k7
k8
k9

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/progressbar.png
.png
$PLUGINSDIR/radio0.png
.png
$PLUGINSDIR/radio1.png
.png
$PLUGINSDIR/song.png
.png
$PLUGINSDIR/unbg1.jpg
.jpg
$PLUGINSDIR/unbg2.jpg
.jpg
$PLUGINSDIR/unbg3.jpg
.jpg
$PLUGINSDIR/uncancel.png
.png
$PLUGINSDIR/uninstall.skn
$PLUGINSDIR/unnext.png
.png
$PLUGINSDIR/unok.png
.png

Sharing

General

Malware Config

Signatures

Files

be41bf7b8cc010b614bd36bbca606973

Code Sign

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

e2:54:c9:7a:f6:81:30:58:47:ab:eb:02:f0:ef:77:bd:8e:0d:e0:b5Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 458KB

.ndata Size: - Virtual size: 1.9MB

.rsrc Size: 125KB - Virtual size: 125KB

.reloc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

8805497fd59d82f20ca43d24cd42c912

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

99:fe:cd:2c:c8:01:20:c1:79:95:a0:13:85:43:2f:91:24:2e:9c:dcSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

iphlpapi

version

ws2_32

wldap32

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

e2:54:c9:7a:f6:81:30:58:47:ab:eb:02:f0:ef:77:bd:8e:0d:e0:b5
Signer

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 1.9MB

.rsrc
Size: 125KB - Virtual size: 125KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

99:fe:cd:2c:c8:01:20:c1:79:95:a0:13:85:43:2f:91:24:2e:9c:dc
Signer

.text
Size: 927KB - Virtual size: 927KB

.rdata
Size: 308KB - Virtual size: 307KB

.data
Size: 45KB - Virtual size: 61KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 50KB - Virtual size: 49KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:e8:9e:2a:aa:0f:65:01:f4:8d:a0:3f:f7:95:e9:89
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

c3:13:b4:5f:f6:d6:7a:da:df:23:a4:77:29:c5:0c:c9:1a:d5:f1:16
Signer

.text
Size: 231KB - Virtual size: 231KB

.data
Size: 6KB - Virtual size: 13KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 197KB - Virtual size: 196KB

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B