067adff0bf0455388cf2a98ece6eff45_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

067adff0bf0455388cf2a98ece6eff45_JaffaCakes118
Size

551KB
MD5

067adff0bf0455388cf2a98ece6eff45
SHA1

079f902354706d303290db5b4ac12770392b5a11
SHA256

10af65fb3b463d5f642abf4e34ce6b71b70db60fe1d0f643f7a09fde5fd00aa1
SHA512

ff40b41549cd207e9de42dcc6cf0bb4386eed5f31aedb70c6a2b27c0b13327a4a713896947e01300ce3b8d74a7cfc1e06d48b8817b2860468dd14b8d76e44283
SSDEEP

12288:/BB2X25Vx0nsWkc9VqDM9osiiF23ZNAc+wovpFL7zE6OS:KX0unsWkc9MooxiKNI1XL7zEK

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/JPEGViewPortable/App/JPEGView/JPEGView.exe
unpack001/JPEGViewPortable/App/JPEGView/ijl15.dll
unpack001/JPEGViewPortable/App/JPEGView/jpegtran.exe
unpack002/$PLUGINSDIR/MoreInfo.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/execDos.dll
unpack002/$PLUGINSDIR/newadvsplash.dll
unpack002/$PLUGINSDIR/newtextreplace.dll
unpack002/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/registry.dll

Files

067adff0bf0455388cf2a98ece6eff45_JaffaCakes118
.rar
JPEGViewPortable/App/AppInfo/Launcher/JPEGViewPortable.ini
JPEGViewPortable/App/AppInfo/appicon.ico
JPEGViewPortable/App/AppInfo/appicon_16.png
.png
JPEGViewPortable/App/AppInfo/appicon_32.png
.png
JPEGViewPortable/App/AppInfo/appinfo.ini
JPEGViewPortable/App/AppInfo/installer.ini
JPEGViewPortable/App/DefaultData/settings/JPEGView.ini
JPEGViewPortable/App/DefaultData/settings/settings_readme.txt
JPEGViewPortable/App/JPEGView/JPEGView.exe
.exe windows:4 windows x86 arch:x86

877b9834679ec577dae242eccc37c573

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ijl15

ord4
ord2
ord3
ord5

gdiplus

GdipDisposeImage
GdipAlloc
GdipDeleteGraphics
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdiplusStartup
GdiplusShutdown
GdipCloneBrush
GdipDrawImageRectI
GdipFillRectangleI
GdipGetImageGraphicsContext
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipGetImageRawFormat
GdipGetImageWidth
GdipDeleteBrush
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipCloneImage
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromGdiDib
GdipGetImageHeight
GdipFree

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
SetFileTime
SystemTimeToFileTime
CreateFileW
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
MultiByteToWideChar
lstrlenW
InterlockedDecrement
FindNextFileW
FindClose
InterlockedIncrement
lstrlenA
SetLastError
FindFirstFileW
lstrcpyW
GetFileTime
GetFileAttributesW
QueryPerformanceCounter
GetTickCount
QueryPerformanceFrequency
GetTimeFormatW
GetDateFormatW
ReadFile
GetFileSize
LeaveCriticalSection
EnterCriticalSection
CreateEventW
OutputDebugStringW
WaitForSingleObject
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetProcessHeap
RaiseException
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
GetCurrentThreadId
GetLastError
CreateMutexW
GetLocaleInfoW
GetThreadLocale
HeapFree
GetVersionExW
DebugBreak
LocalFree
FormatMessageW
WriteFile
MoveFileW
SetFilePointer
GetFileSizeEx
lstrcpynW
FreeEnvironmentStringsA
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetCommandLineW
GetShortPathNameW
CreateProcessW
SetEvent
ResetEvent
VirtualFree
VirtualAlloc
FileTimeToSystemTime
MulDiv
MoveFileExW
SystemTimeToTzSpecificLocalTime
GetFullPathNameW
FreeLibrary
LoadLibraryW
GetSystemTime
CompareStringW
WideCharToMultiByte
CompareStringA
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapReAlloc
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetProcAddress
GetStartupInfoW
GetVersionExA
CreateThread
ResumeThread
ExitThread
DeleteFileW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
LCMapStringA
GetEnvironmentStrings
FreeEnvironmentStringsW
LCMapStringW
Sleep
HeapSize
GetConsoleCP
GetConsoleMode
GetModuleFileNameW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentDirectoryA
GetDriveTypeA
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CreateFileA
CopyFileW

user32

ReleaseCapture
PeekMessageW
MonitorFromWindow
AdjustWindowRectEx
IsClipboardFormatAvailable
EnableMenuItem
SetCursorPos
LoadImageW
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowPos
GetDlgItem
GetParent
GetWindowLongW
EndDialog
UpdateWindow
LoadCursorW
SetCursor
SetTimer
SetCapture
CheckMenuItem
ClientToScreen
ReleaseDC
GetWindowRect
GetClientRect
MonitorFromPoint
GetSysColor
GetSysColorBrush
FrameRect
SetPropW
GetPropW
CallWindowProcW
RemovePropW
EndPaint
BeginPaint
PtInRect
SetFocus
ShowWindow
SetWindowTextW
CreateWindowExW
SendMessageW
TrackPopupMenu
SetWindowPlacement
GetWindowPlacement
MoveWindow
LoadMenuW
GetCursorPos
DeleteMenu
InvalidateRect
GetDC
MessageBoxW
ScreenToClient
DestroyMenu
CharNextW
wvsprintfW
KillTimer
GetKeyState
GetMonitorInfoW
CopyRect
GetSystemMetrics
DefWindowProcW
EnumWindows
GetActiveWindow
ShowCursor
DestroyWindow
DialogBoxParamW
SetWindowLongW
GetWindowTextW
EqualRect
PostMessageW
GetMenuItemCount
GetMenuStringW
SetMenuItemInfoW
GetSubMenu
OffsetRect
DrawTextW
FillRect
InflateRect
CharLowerW
LoadStringW
EmptyClipboard
SetClipboardData
OpenClipboard
GetClipboardData
CloseClipboard
IntersectRect
IsRectEmpty
EnumDisplayMonitors

gdi32

CreateFontIndirectW
GetTextMetricsW
GetTextFaceW
CreateFontW
MoveToEx
LineTo
DeleteObject
CreatePen
DeleteDC
GetTextExtentPoint32W
GetStockObject
TextOutW
SetBkMode
Rectangle
SetDIBitsToDevice
Arc
Ellipse
DPtoLP
GetDeviceCaps
ExcludeClipRect
ExtSelectClipRgn
CreateRectRgn
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
SetBkColor
SetROP2
ExtCreatePen
CreateSolidBrush
SelectObject
SetTextColor

comdlg32

GetOpenFileNameW
GetSaveFileNameW

shell32

DragFinish
DragAcceptFiles
SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
DragQueryFileW

ole32

CoInitialize
CoUninitialize

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
JPEGViewPortable/App/JPEGView/JPEGView.ini.tpl
JPEGViewPortable/App/JPEGView/NavPanel.png
.png
JPEGViewPortable/App/JPEGView/ijl15.dll
.dll windows:4 windows x86 arch:x86

6b540d7d784d97e028bc85e2ab457662

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetStartupInfoA
CloseHandle
ReadFile
WriteFile
SetFilePointer
LoadLibraryA
GetProcAddress
FreeLibrary
OutputDebugStringA
GetCurrentThreadId
GetModuleFileNameA
lstrlenA
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
GetModuleHandleA
HeapAlloc
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
CreateFileA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
InterlockedDecrement
InterlockedIncrement
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers

Exports

Exports

ijlErrorStr
ijlFree
ijlGetLibVersion
ijlInit
ijlRead
ijlWrite

Sections

.text
Size: 304KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
JPEGViewPortable/App/JPEGView/jpegtran.exe
.exe windows:4 windows x86 arch:x86

abff52ee5df43cec4f0a4fdc8aac5981

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetLastError
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
InitializeCriticalSection
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
CloseHandle
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetCurrentThreadId
TlsSetValue
TlsAlloc
InterlockedDecrement
TlsGetValue
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
WriteFile
GetProcAddress
FlushFileBuffers
ReadFile
VirtualAlloc
HeapReAlloc
GetCPInfo
SetStdHandle
CreateFileA
GetACP
GetOEMCP
LoadLibraryA
SetFilePointer
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
JPEGViewPortable/App/JPEGView/readme.html
JPEGViewPortable/App/JPEGView/strings_de.txt
JPEGViewPortable/App/JPEGView/strings_es-ar.txt
JPEGViewPortable/App/JPEGView/strings_es.txt
JPEGViewPortable/App/JPEGView/strings_fr.txt
JPEGViewPortable/App/JPEGView/strings_it.txt
JPEGViewPortable/App/JPEGView/strings_kr.txt
JPEGViewPortable/App/JPEGView/strings_ro.txt
JPEGViewPortable/App/JPEGView/strings_ru.txt
JPEGViewPortable/App/JPEGView/strings_sv.txt
JPEGViewPortable/App/ReadMe.txt
JPEGViewPortable/JPEGViewPortable.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

76:2f:a7:b9:f7:01:b9:bc:b0:55
Certificate

Issuer

CN=John T. Haller,OU=,O=,C=US,1.2.840.113549.1.9.1=#0c11656d61696c406578616d706c652e636f6d

Not Before

11/02/2011, 01:22

Not After

11/02/2016, 01:22

Subject

CN=John T. Haller,OU=,O=,C=US,1.2.840.113549.1.9.1=#0c11656d61696c406578616d706c652e636f6d

Key Usages

KeyUsageDigitalSignature
KeyUsageDataEncipherment

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f5:9e:51:71:a1:b1:a7:e3:ea:1b:53:c3:04:61:5e:cc:a8:dd:e1:04
Signer

Actual PE Digest

f5:9e:51:71:a1:b1:a7:e3:ea:1b:53:c3:04:61:5e:cc:a8:dd:e1:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MoreInfo.dll
.dll windows:4 windows x86 arch:x86

149adf074d317fbf0d2f17314bd18969

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

Imports

user32

wsprintfW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

lstrlenW
lstrcpyW
lstrcpynW
lstrcatW
GlobalAlloc
GetSystemDirectoryW
GlobalFree

Exports

Exports

GetComments
GetCompanyName
GetFileDescription
GetFileVersion
GetInternalName
GetLegalCopyright
GetLegalTrademarks
GetOSUserinterfaceLanguage
GetOriginalFilename
GetPrivateBuild
GetProductName
GetProductVersion
GetSpecialBuild
GetUserDefined

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

c4a726be6ec458c19b16bf3893cf4bc1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
lstrcmpiW
GetCurrentThreadId
GetProcAddress
GetCommandLineW
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
SetEvent
GetVersionExW
SetCurrentDirectoryW
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetExitCodeThread
CreateThread
CreateFileMappingW
CreateEventW
lstrlenW
GlobalAlloc
CreateProcessW
GetLastError
FormatMessageW
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameW
lstrcatW
GetPrivateProfileIntW
GetPrivateProfileStringW
DuplicateHandle
LoadLibraryA

user32

SetWindowsHookExW
DispatchMessageW
TranslateMessage
IsDialogMessageW
PeekMessageW
MsgWaitForMultipleObjects
DefWindowProcW
PostMessageW
SetForegroundWindow
CreateWindowExW
GetWindowThreadProcessId
CallWindowProcW
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClassNameW
CallNextHookEx
CharNextW
DialogBoxParamW
MessageBoxW
EndDialog
SetWindowLongW
LoadImageW
GetWindowLongW
EnableWindow
ShowWindow
wsprintfW
LoadStringW
GetDlgItem
SendMessageW
DestroyWindow

advapi32

GetUserNameW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
AdjustTokenPrivileges
OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/execDos.dll
.dll windows:4 windows x86 arch:x86

b7d63cf7c246ad7d64d63276fee3c6df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
TerminateProcess
Sleep
lstrcatW
lstrcmpiW
ReadFile
GetExitCodeProcess
PeekNamedPipe
CreateFileW
FlushFileBuffers
WriteFile
lstrlenW
CloseHandle
CreateProcessW
DuplicateHandle
GetCurrentProcess
CreatePipe
GlobalAlloc
lstrcpynW
GetExitCodeThread
WaitForSingleObject
lstrcpyW
CreateThread

user32

wsprintfW
GetClassNameW
GetDlgItem
FindWindowExW
SendMessageW

Exports

Exports

exec
isdone
wait

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/newadvsplash.dll
.dll windows:4 windows x86 arch:x86

7efb019e000b6e0291c32d00fe622590

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
CloseHandle
WaitForSingleObject
GetProcAddress
lstrlenW
CreateThread
GetCurrentThreadId
Sleep
lstrcpyW
lstrcmpiW
GlobalAlloc
GlobalFree
lstrcpynW

user32

DefWindowProcW
DestroyWindow
IsWindowVisible
UnregisterClassW
EnumDisplaySettingsW
SendMessageW
wsprintfW
SystemParametersInfoW
EndPaint
SetWindowPos
LoadCursorW
RegisterClassW
CreateWindowExW
IsWindow
GetMessageW
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetWindowLongW
GetClientRect
TranslateMessage
DispatchMessageW
PostMessageW
SetWindowRgn
BeginPaint

gdi32

CombineRgn
GetObjectW
CreateCompatibleDC
SelectObject
GetDIBits
CreateRectRgn
DeleteObject

winmm

timeSetEvent
PlaySoundW
timeKillEvent

oleaut32

OleLoadPicturePath

msvcrt

_lseek
memset
memcmp
_read
memcpy
_wopen
_close
wcstol

Exports

Exports

hwnd
play
show
stop

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 318B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/newtextreplace.dll
.dll windows:4 windows x86 arch:x86

42624ab02b71999959eb0f4168f609bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CloseHandle
CopyFileW
CreateFileW
FindAtomA
GetAtomNameA
GetFileAttributesW
GetFileSize
GlobalAlloc
GlobalFree
MultiByteToWideChar
ReadFile
SetFileAttributesW
SetFilePointer
WideCharToMultiByte
WriteFile
lstrcmpiW
lstrcpyW
lstrcpynA
lstrcpynW
lstrlenA
lstrlenW

msvcrt

__dllonexit
_assert
_errno
abort
fflush
free
malloc
memset

user32

CharUpperA
wsprintfW

Exports

Exports

_FillReadBuffer
_FindInFile
_FreeReadBuffer
_ReplaceInFile
_Unload

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 360B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:5 windows x86 arch:x86

8700d0ebbb41c81ea52718af1ab70a93

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
MultiByteToWideChar
lstrlenA
lstrcmpiW
lstrlenW
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcpynW
GetCommandLineW
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
GetModuleHandleW
GetTickCount
GetStartupInfoW
CreatePipe
GetVersionExW
GlobalLock
DeleteFileW
lstrcatW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
CreateFileW
CopyFileW
GetTempFileNameW
GlobalFree
GlobalAlloc
GetModuleFileNameW
GetProcAddress
PeekNamedPipe
GetCurrentProcess

user32

CharPrevW
CharNextW
SendMessageW
FindWindowExW
wsprintfW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 454B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/registry.dll
.dll windows:4 windows x86 arch:x86

f450890bf454de37198f435d5832e67d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
lstrcpyW
FindClose
FindFirstFileW
lstrcmpW
GetFileSize
SetFilePointer
MultiByteToWideChar
WideCharToMultiByte
CreateFileW
WriteFile
CloseHandle
lstrlenW
lstrcpynW
lstrcmpiW
lstrcatW
GlobalAlloc
ReadFile
GlobalFree

user32

wsprintfW
CharUpperW
SendMessageW
FindWindowExW
GetDlgItem

advapi32

RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegDeleteValueW
RegQueryValueExW
RegCloseKey

Exports

Exports

_Close
_CopyKey
_CopyValue
_CreateKey
_DeleteKey
_DeleteKeyEmpty
_DeleteValue
_Find
_HexToStr
_HexToStrUTF16LE
_KeyExists
_MoveKey
_MoveValue
_Open
_Read
_ReadExtra
_RestoreKey
_SaveKey
_StrToHex
_StrToHexUTF16LE
_Unload
_Write
_WriteExtra

Sections

.text
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
JPEGViewPortable/Other/Help/images/donation_button.png
.png
JPEGViewPortable/Other/Help/images/favicon.ico
JPEGViewPortable/Other/Help/images/help_background_footer.png
.png
JPEGViewPortable/Other/Help/images/help_background_header.png
.png
JPEGViewPortable/Other/Help/images/help_logo_top.png
.png
JPEGViewPortable/Other/Source/AppSource.txt
JPEGViewPortable/Other/Source/JPEGViewPortable.ini
JPEGViewPortable/Other/Source/License.txt
JPEGViewPortable/Other/Source/PortableApps.comInstallerCustom.nsh
JPEGViewPortable/Other/Source/Readme.txt
JPEGViewPortable/help.html
.html

Sharing

General

Malware Config

Signatures

Files

877b9834679ec577dae242eccc37c573

Headers

File Characteristics

Imports

ijl15

gdiplus

kernel32

user32

gdi32

comdlg32

shell32

ole32

comctl32

msimg32

Sections

.text Size: 396KB - Virtual size: 395KB

.rdata Size: 92KB - Virtual size: 89KB

.data Size: 8KB - Virtual size: 17KB

.rsrc Size: 12KB - Virtual size: 10KB

6b540d7d784d97e028bc85e2ab457662

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 304KB - Virtual size: 301KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 8KB - Virtual size: 13KB

.data1 Size: 8KB - Virtual size: 7KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 12KB - Virtual size: 9KB

abff52ee5df43cec4f0a4fdc8aac5981

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 96KB - Virtual size: 94KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 20KB - Virtual size: 24KB

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

76:2f:a7:b9:f7:01:b9:bc:b0:55Certificate

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

f5:9e:51:71:a1:b1:a7:e3:ea:1b:53:c3:04:61:5e:cc:a8:dd:e1:04Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.0MB

.rsrc Size: 27KB - Virtual size: 27KB

149adf074d317fbf0d2f17314bd18969

Headers

DLL Characteristics

File Characteristics

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 92KB - Virtual size: 89KB

.data
Size: 8KB - Virtual size: 17KB

.rsrc
Size: 12KB - Virtual size: 10KB

.text
Size: 304KB - Virtual size: 301KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 8KB - Virtual size: 13KB

.data1
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 12KB - Virtual size: 9KB

.text
Size: 96KB - Virtual size: 94KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 20KB - Virtual size: 24KB

76:2f:a7:b9:f7:01:b9:bc:b0:55
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

f5:9e:51:71:a1:b1:a7:e3:ea:1b:53:c3:04:61:5e:cc:a8:dd:e1:04
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.0MB

.rsrc
Size: 27KB - Virtual size: 27KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 44B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 188B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 9KB - Virtual size: 9KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1024B - Virtual size: 892B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 288B

.reloc
Size: 512B - Virtual size: 266B

.text
Size: 4KB - Virtual size: 3KB