09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118

resource
09cf08a8763752fc1fef65105d0b4ed7_JaffaCakes118
unpack001/$SYSDIR/Jennie_Finch_Screensaver.scr
unpack001/$TEMP/dospop.exe
unpack002//tbu03344/RSSReader_plugin.dll
unpack002//tbu03344/dospop.dll
unpack002//tbu03344/tbhelper.dll
unpack001/Uninstall.exe

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/$TEMP/dospop.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

IMPHASH 773e933db287d0293e61a62d958e00ab
SHA256 29d7bcce549e42be131c7c3d39a46fe884925ceb742dc8cc1da7f6cae804f4cb
MD5 09cf08a8763752fc1fef65105d0b4ed7
SHA1 4eec2eda07b08e150fe53c02c160c8c6e91f487a
SHA512 c67a5a144dc7d0c0b37f932f60b6ac715c1b9f46f7bd3c1a20942281881b0616164631668bf4f642930b56adb308ff5e4cd6caff0359c90cd85e85983613b64d
SSDEEP 98304:8s/47Xh1GSSksDKNVpBXTg5XDz/v+YlQCqe:F4lQSSk3VpRTgVDz/vN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess ExitProcess lstrcmpiA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$SYSDIR/Jennie_Finch_Screensaver.scr

IMPHASH c62e202f7c61f5b0d93e1e66b041122a
SHA256 98c8f946a121c5dd0743d43f8e286b0883f5e562b7120ade24b3b3603d01ab75
MD5 6a4d0b2d75851d844e1faad2a0e4ee69
SHA1 70ff2cd4ce4f56e03a4b1e1fd3903723fe47cbb2
SHA512 14434eb350245f00b87ad67dd23176a65d207274b634e80032b0ec2eef4acc8d7589e525f469d6cbc47f138803f4d5b495f3ad439d43a2ca5d4ca2ff0e7640f1
SSDEEP 98304:H+zn2M6MkLClncZx9aq0btXtGg+p2sWuJ:In25l2lox9apXUg+EPuJ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

379368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveOutReset waveOutClose waveOutUnprepareHeader waveOutPrepareHeader waveOutWrite waveOutOpen PlaySoundA mciGetErrorStringA mciSendCommandA

msacm32

acmStreamOpen acmStreamSize acmStreamConvert acmStreamClose acmStreamUnprepareHeader acmFormatTagDetailsA acmStreamPrepareHeader

kernel32

FindClose GetVolumeInformationA GetFullPathNameA GetThreadLocale LocalAlloc GlobalHandle LocalReAlloc GetProcessVersion GlobalFlags GetCPInfo GetOEMCP GetFileAttributesA GetCurrentDirectoryA SetErrorMode RtlUnwind ExitProcess TerminateProcess HeapFree GetTimeZoneInformation GetLocalTime HeapReAlloc HeapAlloc RaiseException GetStartupInfoA GetCommandLineA CreateThread ExitThread GetACP HeapSize SetStdHandle GetFileType GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings SetEndOfFile SetHandleCount GetStdHandle LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetDriveTypeA IsBadCodePtr CompareStringA CompareStringW SetEnvironmentVariableA GetProfileStringA InterlockedExchange CreateEventA lstrlenA CloseHandle WaitForSingleObject Sleep SetEvent DeleteFileA LockResource SizeofResource LoadResource FindResourceA ResumeThread ResetEvent lstrcmpiA FreeLibrary GetProcAddress LoadLibraryA CreateFileA SetFilePointer UnlockFile LockFile FlushFileBuffers GetCurrentProcess DuplicateHandle GetCurrentThread lstrcmpA GetModuleFileNameA WritePrivateProfileStringA GetPrivateProfileStringA GetPrivateProfileIntA GetVersion GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA GetEnvironmentStringsW SetThreadPriority GetSystemInfo GlobalFree ReadFile GlobalAlloc GetFileSize WriteFile GlobalDeleteAtom FormatMessageA LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement GlobalLock GlobalUnlock MulDiv GetModuleHandleA SetLastError SuspendThread GetCurrentThreadId FindFirstFileA FindNextFileA GetFileTime RemoveDirectoryA OutputDebugStringA IsBadReadPtr IsBadWritePtr GlobalReAlloc GetTempFileNameA TlsFree TlsAlloc DeleteCriticalSection TlsGetValue TlsSetValue EnterCriticalSection LeaveCriticalSection InitializeCriticalSection ExpandEnvironmentStringsA WaitForMultipleObjects GlobalSize SetFileTime FileTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime CreateDirectoryA CopyFileA GetLastError GetSystemTime GetTickCount lstrcpyA GetVersionExA lstrcpynA lstrcatA GetTempPathA

user32

CopyAcceleratorTableA GetNextDlgGroupItem RegisterClipboardFormatA SetCursor LoadStringA wvsprintfA ShowWindow MoveWindow SetWindowTextA IsDialogMessageA IsDlgButtonChecked CheckRadioButton LoadIconA SendDlgItemMessageA MapWindowPoints SetFocus AdjustWindowRectEx GetTopWindow IsChild GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetWindowTextLengthA GetWindowTextA GetDlgCtrlID CreateWindowExA GetClassLongA SetPropA GetPropA RemovePropA DefWindowProcA GetMessageTime GetMessagePos GetLastActivePopup SetForegroundWindow GetWindow SetWindowLongA SetWindowPos RegisterWindowMessageA IsIconic GetWindowPlacement EndDialog SetActiveWindow CreateDialogIndirectParamA DestroyWindow GetWindowLongA IsWindowEnabled UnhookWindowsHookEx GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetWindowDC ClientToScreen GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState CallNextHookEx ValidateRect IsWindowVisible PeekMessageA SetWindowsHookExA GetMenuCheckMarkDimensions GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem CopyRect GetDesktopWindow GetWindowRect GetDC ReleaseDC DrawEdge GetParent LoadCursorA IsWindow MessageBeep MessageBoxA GetSysColorBrush DrawIcon UpdateWindow DestroyMenu PtInRect GetClassNameA InflateRect CharNextA CharUpperA MapDialogRect CallWindowProcA SetWindowContextHelpId PostThreadMessageA GetSystemMetrics OffsetRect IntersectRect UnionRect GetSysColor SetRect PostQuitMessage RedrawWindow GetCursorPos ScreenToClient PostMessageA SetClassLongA ShowCursor SetCursorPos SystemParametersInfoA SetTimer LoadBitmapA GetForegroundWindow SendMessageA EnableWindow GetClientRect FillRect IsWindowUnicode DefDlgProcA InvalidateRect DrawFocusRect ExcludeUpdateRgn ShowCaret HideCaret UnregisterClassA GetDlgItem

gdi32

SetBitmapDimensionEx CreateFontIndirectA CreatePalette GetSystemPaletteEntries DeleteDC SelectObject RealizePalette SelectPalette GetStockObject SetBkColor SetMapMode GetMapMode DPtoLP GetObjectA CreateDIBitmap SaveDC RestoreDC SetBkMode SetTextColor SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox IntersectClipRect MoveToEx LineTo SetTextAlign GetViewportExtEx GetWindowExtEx CreatePen CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextColor GetBkColor PatBlt LPtoDP GetDIBits CreateDIBSection DeleteObject SetDIBitsToDevice StretchBlt GetDeviceCaps GetBitmapDimensionEx CreateBitmap GetTextExtentPoint32A BitBlt CreateFontA CreateCompatibleDC GetTextMetricsA GetTextExtentPointA CreateCompatibleBitmap

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA DocumentPropertiesA ClosePrinter

advapi32

RegDeleteKeyA RegCloseKey RegDeleteValueA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA

shell32

ShellExecuteA SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc SHGetFileInfoA ShellExecuteExA

comctl32

ord17

oledlg

ord8

ole32

OleFlushClipboard OleIsCurrentClipboard CLSIDFromProgID CLSIDFromString CoGetClassObject StgOpenStorageOnILockBytes StgCreateDocfileOnILockBytes CreateILockBytesOnHGlobal CoTaskMemFree CoTaskMemAlloc OleInitialize OleUninitialize CoFreeUnusedLibraries CoRegisterMessageFilter CoRevokeClassObject

olepro32

ord253

oleaut32

VariantChangeType SysAllocStringByteLen VariantTimeToSystemTime SysStringLen VariantCopy SysAllocStringLen SysFreeString SysAllocString VariantClear

wininet

InternetOpenA InternetCloseHandle InternetQueryOptionA InternetCanonicalizeUrlA InternetCrackUrlA InternetSetStatusCallback InternetSetFilePointer InternetWriteFile InternetGetLastResponseInfoA HttpQueryInfoA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetQueryDataAvailable InternetReadFile InternetSetOptionExA

$TEMP/dospop.exe

IMPHASH 81c812ed76d4690c8678b3a4f0737a5f
SHA256 9240b45f226db49da56c7b12b7a347eaee578cfc0e4603019091a1fd81bfcafb
MD5 b2347a5c2350b6342cdabda956618759
SHA1 f6a779efafcf4bd6a9e1f8bf2c66af33f140622e
SHA512 76468bda8a4e0df0bf49efdf6cf96d3f45a85db73540e066cc156ca0481d676606d46f3b98774395914c4f357d752c9bbae6e41f9277bc362dd712bd430eda04
SSDEEP 12288:WGeC/oEjVcYKKrh/RfKum6YGBzz9QJWCqoRFf:8CNjVcNKrnVm6vBzBCqoH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

16539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

comctl32

ImageList_Create ord17 ImageList_AddMasked ImageList_Destroy

kernel32

GetExitCodeProcess WaitForSingleObject ExpandEnvironmentStringsA GetEnvironmentVariableA lstrcmpiA FindNextFileA DeleteFileA FindFirstFileA SetFileTime GetFileAttributesA CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA CreateDirectoryA SetFileAttributesA CreateFileA GetFileSize GetModuleFileNameA GetTickCount CopyFileA SetErrorMode lstrcpynA GetCommandLineA GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GetVersion GlobalUnlock GlobalLock GlobalAlloc CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA EnterCriticalSection Sleep LeaveCriticalSection InitializeCriticalSection CloseHandle GlobalFree GetModuleHandleA LoadLibraryA CreateThread GetProcAddress FreeLibrary MultiByteToWideChar GetCurrentProcess WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile SetFilePointer FindClose MulDiv ExitProcess

user32

CreateDialogParamA DialogBoxParamA GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA EndDialog SetFocus ScreenToClient GetWindowRect GetWindowLongA SetClassLongA IsWindowEnabled SetWindowPos LoadCursorA SetCursor GetDlgItemTextA MapWindowPoints GetMessagePos LoadBitmapA CallWindowProcA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA MessageBoxA CharPrevA DestroyWindow SetTimer SetForegroundWindow ShowWindow CharNextA wsprintfA SendMessageTimeoutA FindWindowExA IsWindow GetDlgItem GetSysColor SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA ExitWindowsEx PostQuitMessage SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect GetWindowTextA DrawTextA EndPaint InvalidateRect

gdi32

SetBkColor GetDeviceCaps CreateFontIndirectA DeleteObject CreateSolidBrush CreateFontA SetBkMode SetTextColor CreateBrushIndirect SelectObject

advapi32

RegEnumValueA RegEnumKeyA RegQueryValueExA RegSetValueExA RegDeleteKeyA RegOpenKeyExA RegDeleteValueA RegCreateKeyA RegCloseKey

shell32

ShellExecuteA SHBrowseForFolderA SHGetPathFromIDListA SHGetMalloc SHGetSpecialFolderLocation SHFileOperationA

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

/tbu03344/RSSReader_plugin.dll

IMPHASH 3b52a18ae5379d4e489674813f3a5458
SHA256 efb9b1707ca2447c63036b1074c402f8ff6a5f30441c03ea372d1f0ec8423bc5
MD5 131fa8aaa9f5e717477d6e16c6f8fb70
SHA1 17e50467e224d7461c46a456442f10a0da3cc7ec
SHA512 d87a6789aec7574c4888e4a6da3c7776e937b62ab481e2aa874752d71854b32a9ad2814321cb24da1f1b134e3b443be4474fbfb09335e06349862151beccd32e
SSDEEP 3072:OoqSEB35vhDI5+crn7CAjtjJ0voNZmDlny+sSy2EjJqP8InGnhIkIoRQc5ciab/W:dEB3QrCgOvSmD1TBEleGOkPWe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

131351

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA GetCurrentThreadId FlushInstructionCache GetCurrentProcess InitializeCriticalSection DeleteCriticalSection MultiByteToWideChar CloseHandle SetEvent WaitForSingleObject CreateThread CreateEventW WriteFile CreateFileW DeleteFileW IsBadReadPtr MoveFileW LockResource SizeofResource LoadResource FindResourceW ReadFile GetFileSize HeapDestroy ExitProcess HeapFree SetEnvironmentVariableA CompareStringW CompareStringA OutputDebugStringW SetEndOfFile LoadLibraryA GetOEMCP GetACP GetStringTypeW GetStringTypeA IsBadCodePtr CreateFileA SetStdHandle GetCPInfo FlushFileBuffers SetFilePointer IsBadWritePtr VirtualAlloc VirtualFree HeapCreate GetVersionExA GetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetModuleFileNameA GetStartupInfoA DebugBreak EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement lstrlenW GetFileType GetStdHandle SetHandleCount LCMapStringW GetVersion GetCommandLineA GetLocalTime GetSystemTime GetTimeZoneInformation RaiseException RtlUnwind LCMapStringA SetUnhandledExceptionFilter GetModuleHandleA GetProcAddress HeapSize HeapReAlloc TerminateProcess HeapAlloc TlsGetValue SetLastError TlsFree TlsAlloc GetLastError WideCharToMultiByte LocalFree Sleep InterlockedExchange TlsSetValue

user32

TranslateMessage LoadStringW wvsprintfW CharNextW DialogBoxParamW EndDialog EnableWindow SendMessageW GetDlgItem EnumChildWindows GetParent GetActiveWindow SetDlgItemTextW MessageBoxW CallWindowProcW DefWindowProcW CreateWindowExW GetClassInfoExW LoadCursorW wsprintfW RegisterClassExW SendMessageTimeoutW KillTimer SetTimer GetDlgItemTextW GetMessageW DispatchMessageW SetWindowLongW GetWindowTextW SetWindowTextW GetWindowLongW GetWindow GetWindowRect SystemParametersInfoW GetClientRect MapWindowPoints SetWindowPos

advapi32

RegDeleteKeyW RegCreateKeyExW RegQueryValueExW RegCloseKey RegOpenKeyExW RegSetValueExW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

VariantInit SysStringLen SysAllocStringByteLen VariantClear SysFreeString SysAllocString

wininet

HttpOpenRequestW InternetSetStatusCallbackW HttpAddRequestHeadersW HttpSendRequestW InternetCloseHandle InternetCrackUrlW InternetOpenW InternetReadFile HttpQueryInfoA InternetConnectW

shlwapi

PathFileExistsW

/tbu03344/basis.xml

SHA256 e5e25d47c991d1b7582de5cb41427b4f58bbb72d67c208829dba6a52b40e9a27
MD5 5c2f5edec42b592cdf320560602566f9
SHA1 cf0725203afc620590ef0ba06b23f83895c2a9e1
SHA512 699f2982f9fa7afd3520c3afbde55bbda2e40b6d1043f325e9611db1639092fe2fa4df08f3735541409a17577e30af345ec0f5a73c6e868c9a02fcd9a71bcfda
SSDEEP 192:F0kDUvSIzLKoI2tO6HCn0JVcGZ2L38MWmHOHxCVUtzpw3:F0kepHugO6io3ZKMT+OH869w3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

/tbu03344/channel.tmpl

SHA256 6f8cc62517419e67bf3c511034bca1c2df5d0b527f13c8c32de5393e10382286
MD5 e725017212f6c8e0f21fb7d48ab63df6
SHA1 0c836aeeecf377f514f1dda98de78b92a7ad5e83
SHA512 3da9f258a501971286fb5a1389bc8ddbf6b0f0ac72e090846a4a463c30cbf3d8565beaf922e61f9d394cf18456607ce822b14d90643094116cb38e71722af32b
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/content.tmpl

SHA256 d069903c72eb22e8b2a3b581e579796df3750e902d2428ed4cb39882891a0d1a
MD5 80ba40bb56e55f81154073497011785e
SHA1 b3c465dd09afed93e7a7ef6473a329f4c0ca2ccf
SHA512 f6fbc20ce71a66837b4aa33e5c7af0ade8229290efcb3a2d4e8fd3680de7a3ee33312baffda9de62906f40bce6386c7e148ec0e572fcf5f1a8489b0ebb31b6c5
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/dospop.dll

IMPHASH bcdbdc66bc53b1ee79d77f4040004cdb
SHA256 7e333107d1b5d943b9ad2a52625b02d28d79be60734e2d77a8ed2c7335214632
MD5 c97179ba4ed0491d227335ffebdc856a
SHA1 6de5da7bf23ec5e519a9068817cd26890c1a8930
SHA512 bc2eb7c9c939907e7390530722b722aefc7e59a06d59187d9cbb9b9678d2209f484d53b0e3c22337026c4ae6b8c619a53ccd0505612f5ab6b456ec204a4b2265
SSDEEP 12288:JbJRJfYLE7U0n/y2xVlZcuKFAejQD48mCJon71dEMcSbLn3BghuL2OT31YzsPzXh:JVRJfCEw0nq2xVtKFApY5v3+19e
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

647897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

dbghelp

SymLoadModule SymInitialize SymGetOptions SymSetOptions SymGetLineFromAddr SymFunctionTableAccess SymGetModuleBase StackWalk SymGetSymFromAddr SymCleanup

version

VerLanguageNameW GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

winmm

PlaySoundW

setupapi

SetupIterateCabinetW

kernel32

lstrcpynW FormatMessageW IsBadReadPtr ReadProcessMemory CreateFileW OpenProcess MultiByteToWideChar WideCharToMultiByte GlobalUnlock GlobalLock WinExec FreeLibrary lstrcpyW lstrcatW RemoveDirectoryW MoveFileExW DeleteFileW WriteFile CreateFileA GetTempPathA CopyFileW MoveFileW GetTempFileNameW FindFirstFileW FindNextFileW FindClose GlobalFree GlobalAlloc lstrcmpW GetVersion Sleep GetTickCount GetShortPathNameW DisableThreadLibraryCalls InitializeCriticalSection HeapDestroy DeleteCriticalSection MapViewOfFile CreateFileMappingW OpenFileMappingW UnmapViewOfFile TerminateProcess GetCurrentProcessId GetModuleFileNameA VirtualAlloc VirtualFree HeapSize FatalAppExitA ExitProcess GetCommandLineA RaiseException GetLocalTime GetSystemTime GetTimeZoneInformation GetFullPathNameW GetCurrentDirectoryW SetEnvironmentVariableW ExitThread TlsSetValue CreateThread ResumeThread HeapReAlloc RtlUnwind LocalFree InterlockedExchange TlsAlloc TlsFree TlsGetValue UnhandledExceptionFilter LCMapStringA IsBadWritePtr IsBadCodePtr SetUnhandledExceptionFilter lstrlenA OutputDebugStringW DebugBreak LoadLibraryA SetCurrentDirectoryW GetTempPathW CreateDirectoryW HeapFree GetProcessHeap HeapAlloc CloseHandle GetCurrentThread GetVersionExW GetCurrentProcess FlushInstructionCache GetCurrentThreadId lstrlenW InterlockedIncrement GetModuleHandleW LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW FlushFileBuffers GetCPInfo IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetModuleHandleA GetProcAddress GetModuleFileNameW LoadLibraryW OutputDebugStringA GetLastError SetLastError EnterCriticalSection LeaveCriticalSection InterlockedDecrement GetEnvironmentVariableA GetVersionExA GetUserDefaultLCID GetStringTypeA GetStringTypeW SetStdHandle GetCurrentDirectoryA GetFullPathNameA GetDriveTypeA GetACP GetOEMCP SetConsoleCtrlHandler SetEndOfFile GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA ReadFile HeapCreate

user32

GetMenuItemInfoW EnableMenuItem LoadMenuW GetSubMenu InsertMenuW PeekMessageW GetMessagePos LoadBitmapW DrawFrameControl GetCursorPos PostMessageW CopyRect GetMenu AdjustWindowRectEx KillTimer UpdateWindow DrawTextW LoadImageW IsWindowVisible SetWindowsHookExW TrackPopupMenu UnhookWindowsHookEx EndMenu GetDlgItem IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect CreateAcceleratorTableW GetDC ReleaseDC BeginPaint FillRect EndPaint GetSysColor SystemParametersInfoW OffsetRect ClientToScreen GetAsyncKeyState SetWindowRgn DrawEdge InflateRect MapWindowPoints RegisterHotKey UnregisterHotKey RegisterWindowMessageW GetDesktopWindow SetWindowPos GetWindow GetDlgCtrlID UnregisterClassW DialogBoxIndirectParamW wsprintfA WindowFromPoint CallNextHookEx SetCursor ScreenToClient PtInRect GetKeyState GetClassNameW DestroyCursor SetDlgItemTextW IsDlgButtonChecked CheckDlgButton EndDialog SetActiveWindow SetFocus GetWindowRect GetClientRect GetWindowTextW TranslateMessage DispatchMessageW GetWindowTextLengthW CharUpperW DialogBoxParamW GetActiveWindow SetLastErrorEx GetWindowLongW CharNextW wvsprintfW CallWindowProcW DefWindowProcW SetTimer LoadCursorFromFileW CharLowerW IsWindowEnabled DrawFocusRect GetCapture OpenClipboard EmptyClipboard CloseClipboard MessageBoxW CreateWindowExW SetWindowLongW LoadStringW GetParent GetClassInfoExW RegisterClassExW LoadCursorW wsprintfW ShowWindow MoveWindow SetWindowTextW SendMessageW GetFocus IsWindow DestroyWindow DestroyMenu CreatePopupMenu AppendMenuW GetSystemMetrics ReleaseCapture

gdi32

ExtTextOutW CreateFontW DeleteObject CreateRectRgn SetBkMode GetTextMetricsW CreateBrushIndirect CreateRectRgnIndirect CreatePatternBrush SelectClipRgn GetClipBox SetBkColor RestoreDC SaveDC SetTextColor GetTextExtentPointW GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC BitBlt DeleteDC GetTextExtentPoint32W SelectObject

advapi32

GetSidIdentifierAuthority RegEnumKeyExW RegSetValueExW RegEnumValueW RegDeleteValueW RegCloseKey RegOpenKeyExW FreeSid EqualSid AllocateAndInitializeSid GetTokenInformation OpenProcessToken OpenThreadToken GetSidSubAuthority GetSidSubAuthorityCount IsValidSid RegSetKeySecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor RegGetKeySecurity RegCreateKeyExW RegDeleteKeyW RegEnumKeyW GetUserNameW RegQueryValueExW

shell32

ShellExecuteA SHAddToRecentDocs ShellExecuteW DragQueryFileW SHEmptyRecycleBinW

ole32

CoUninitialize CoCreateInstance RegisterDragDrop ReleaseStgMedium OleUninitialize CreateStreamOnHGlobal OleInitialize CLSIDFromProgID CLSIDFromString CoTaskMemAlloc OleLockRunning CoTaskMemFree StringFromCLSID CoCreateGuid CoInitialize

oleaut32

SysAllocString SysFreeString VariantInit SysAllocStringByteLen SysStringByteLen SysStringLen VariantClear LoadTypeLi OleCreateFontIndirect SysAllocStringLen LoadRegTypeLi SafeArrayDestroy SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreateVector DispCallFunc VariantCopy VariantChangeType SafeArrayPutElement SafeArrayCreate RegisterTypeLi GetErrorInfo SetErrorInfo CreateErrorInfo

wininet

DeleteUrlCacheEntryW FindNextUrlCacheEntryW FindFirstUrlCacheEntryW FindCloseUrlCache

shlwapi

PathFileExistsW PathRemoveFileSpecW

Name

.text

Size

688KB

Virtual Size

687KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

/tbu03344/icons.bmp

SHA256 6f00271baba262330950c748e67f41f0d2c98d5e0a5ef7cf099d864d7d9891c0
MD5 0540c76a162cf8aea5b333a6e183bdbc
SHA1 10650aed77cafd0e0e10a98a67343157abe93652
SHA512 7acbe3537f07ef6dc4a2dff809b8cc74edbf7d02ee4a75d0f399725d2dda28c5fa1f407495a23301f322e1655cfef83271be05e8062aab022538fddd6b001ee4
SSDEEP 768:uB7ICuhSBmFLgxOzaO2KDmC1usRgaW7zl5sAPKnho+oZfdfbYyVMuUUUvyVUiUbq:mzAxuO26ZpR67rSho+oZfdfbF242s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

/tbu03344/logo16.bmp

SHA256 4d502980795f580774e0904c22cef73aaf81eef9858e67e05d0ef10b74c62105
MD5 ecf6053084c253b4ecb999b77fd5e7fb
SHA1 fe7359187bd92e1e9312789a7c9ca1df08947c26
SHA512 7a86d529bf6eca3daaa428fbc7d0dbac20cf30261f2ab1495532cf52087209eb712734fa90d23e063bb3a8e833d90c827fc920cc6785fc19951b5c883fa93f3f
SSDEEP 96:2kD4vHh/oThfm9yZCkR3NStAYrsNqI1hYidMeILPA0lhoHzScmKyagOozOGyOZg1:4vHh/Q48wkRJ31XyLRmmOwve1
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

/tbu03344/marquee.tmpl

SHA256 5dd15a2ba1b7b646b1ca35e13ea9ae6c5f3fd5ccfa0480c0070a9b9bf59d477a
MD5 1cb103dabfc25402a01957b9eb04f948
SHA1 da250b475bfb386b1741805bda18fbe6e1ae9282
SHA512 66441e7796cb87eba88aa2b9493f8dea5371dbe045a5f4bfd45a4d9922fab9e0f5277819c0d11d7d561389c75edb1f9b9002439829a13406b92f46fbfd85d2f7
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/options.html

SHA256 29e525a91d8ac4ec6bb2fa299a404d9f151b45400c7cab09675a23469373435b
MD5 adc6e16ce6e97bd1eb19d3a8dad7274f
SHA1 12b55eab3225b2250ba051803f7d791db59a46a1
SHA512 2c4bc233ae8741fe0a6995845aa88d707b347cfc78745fefac346ce27ddd5b799dd374bbba15516f6e61348f52720be3639cf0cd925a599250a9947a33ab7103
SSDEEP 96:BKQ/O9mOdYCQiLFyzNYs90Yi67mX9gPui39bnLNza7/OBgx4wTn:BFj1cFUYJYnV6Bm8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

/tbu03344/rss.gif

SHA256 17bee1b6c22de92927b00654f08837fc04f717df328278eb566b88fb2d901f36
MD5 7591394b520f9de583c4a5fb85339a04
SHA1 297d99002d62c7e7f77fc970eab65720f565c003
SHA512 e271da8410979656355e68dcc4739e1023c0d443199171964c2886692d30c57273f9d0a4c38c91f2b1a11117b3da7782281cc6551da0a543f4957d100582848e
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/static_img.html

SHA256 e94503ad0ea2a4f7002ba70f57e12da9daabb5037b6bedc7725d1fc43a487415
MD5 2caff3519f5be538757c467d4fec4756
SHA1 7e77344f049d9ee4d216b6f412c01ba28596773c
SHA512 029814dd117053d03acc6c0cb1af2802256149c6a3588cd41334deeffad6095dc16386887e2053f288b13a5ebd3599cbf9c55c194fde81f3df77045d2609a467
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/static_pub.html

SHA256 29101ddb9fc880b921c78a8aa0952310ccf0fe4eb03479425500fc2e779d4b2b
MD5 0bf3de7de6f6a9ece7674fb245c7e428
SHA1 a71d601820676d5741734e825c7347d59570bc98
SHA512 30dc0cf67d772a79dec244882f24c4a6ad71a3139b1b92d6e059f1e677ef138596e71c7bf12c2283b591ad64744b9abd15895fa29c4a600f64c784423bc270b2
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/tbhelper.dll

IMPHASH 801f33c8a45029494e46ec8d40215f59
SHA256 3f56aa185c36a69557a87633def1b291bc7e61064e4ee51483e7b6a2659bb51c
MD5 bd60d9ff3cfc8ce202063f75eb817780
SHA1 27f7e3d852ca84223f2a4b48a5a6f8fbca11dfbf
SHA512 2946d94e697d02c6d25e9daa7b7f18430a6ba597f9f0ce082296b57e28821d2199aab92ed14c58a95a2fa80824c800ab968fc88797d0f0cf1839befb04518155
SSDEEP 3072:063enkjfM0238ENyc0eePgN8MsSBTwMifOZUv+2jFoArAMsJg:0BiE02HePgCfswMiWZyl0Jg
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

49995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

urlmon

URLDownloadToFileW

kernel32

TerminateThread WriteFile CreateFileW DeleteFileW InterlockedIncrement InterlockedDecrement MultiByteToWideChar DisableThreadLibraryCalls InitializeCriticalSection LeaveCriticalSection EnterCriticalSection HeapDestroy DeleteCriticalSection GetShortPathNameW GetModuleFileNameW CloseHandle GetProcAddress LoadLibraryW lstrcpyW lstrcatW GlobalUnlock GlobalLock GetCPInfo FlushFileBuffers SetEnvironmentVariableA CompareStringW CompareStringA GetLocaleInfoW SetConsoleCtrlHandler SetEndOfFile CreateThread Sleep lstrlenW IsValidLocale FreeLibrary RtlUnwind GetStringTypeW GetStringTypeA LoadLibraryA GetOEMCP SetUnhandledExceptionFilter GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA SetFilePointer GetStartupInfoA GetFileType GetStdHandle SetHandleCount ReadFile GetACP LCMapStringW LCMapStringA UnhandledExceptionFilter IsBadCodePtr IsBadReadPtr SetStdHandle GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA LocalFree InterlockedExchange HeapSize HeapReAlloc HeapAlloc GetTimeZoneInformation GetSystemTime GetLocalTime GetCommandLineA GetVersion RaiseException HeapFree ExitProcess FatalAppExitA GetLastError GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread VirtualFree VirtualAlloc IsBadWritePtr GetModuleHandleA GetModuleFileNameA GetEnvironmentVariableA GetVersionExA HeapCreate TerminateProcess GetCurrentProcess IsValidCodePage

user32

CharNextW CloseClipboard GetClipboardData OpenClipboard CharUpperW CharLowerW LoadStringW

advapi32

RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW

ole32

CLSIDFromProgID CoCreateInstance CoInitialize

oleaut32

VariantCopy VariantInit SysStringLen LoadRegTypeLi RegisterTypeLi LoadTypeLi SysStringByteLen SysAllocStringByteLen SysAllocString VariantClear SysFreeString GetErrorInfo SetErrorInfo VariantChangeType CreateErrorInfo

wininet

InternetOpenUrlW InternetOpenW InternetCloseHandle InternetReadFile HttpQueryInfoW

shlwapi

PathFileExistsW

rpcrt4

UuidFromStringA

Name

.text

Size

104KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.SHARED

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

/tbu03344/toolbar-logo-dospop.bmp

SHA256 759282b69a5a1c30a01e0ef7c19a2eb59955e33f0caa0b066e418ef54f5c5884
MD5 de7f84d3713c0e55ee2f584345647504
SHA1 8903bf45c1993fc2df3313e89971b4cba2ba9239
SHA512 96c820d6caf2385faf18aaeaffe743846e158b1e2eabdeb53ec9dafda3fa86ee30f070f7c8e65bd1a0325e6d6fffcfafec175dad07f0dee0f6fcb2660133a193
MD5 SHA1 SHA512

NSIS installer

installer

/tbu03344/version.txt

SHA256 0f85f776d85b5ee164a43c166dab525625655bd42b6c0503fa8d36fb702df666
MD5 f1610ba6a619c1703c4dd4ea1c8d71e5
SHA1 539d1b8b903d98bd9abaf232b4c2f370ac1e9e81
SHA512 de5058badc73c1e267e24d7cd18e2c1207337d78185bcd17c4e1ab1131e30f4df5c051cceb748966fd4a8a6b8b2f1d11e2ced29bf5c5ca8404e3f5da5d2d438e
MD5 SHA1 SHA512

NSIS installer

installer

Uninstall.exe

IMPHASH 773e933db287d0293e61a62d958e00ab
SHA256 dfffd4857f5c4978b3f982309a6ee87839a62a17775261833af91f5fce9a1cb0
MD5 91b4ed32fb67509e715ab80fd3714eaf
SHA1 dbd27ab84a23dea5dcf1ae6d363e2336c0579d75
SHA512 5753d0d1524f84c7605b6c5a30296bf39a33055304d88acf619ecfd8f379f6753db9931deba0a7543c0aa35c5779e04e3ef53506f437757c904de9021dc18feb
SSDEEP 768:LbGBkj++ARXzxc2FdZ6IOw7UkfSy0D3DwdFkqsWkJd+eJRn5Am6kRRJ2iZ3igvu:/EkjY1zy214Qay0DGkJYqAELVigvu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle SetFileTime CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess ExitProcess lstrcmpiA GetWindowsDirectoryA GetTempPathA GetCommandLineA LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA lstrcmpA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile MulDiv ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA CopyFileA

user32

ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA DispatchMessageA PeekMessageA CreateDialogParamA DestroyWindow SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow SendMessageTimeoutA FindWindowExA RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA TrackPopupMenu ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint wsprintfA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer