06a9d344a3ca6039e6d65f31e3469846_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

06a9d344a3ca6039e6d65f31e3469846_JaffaCakes118
Size

510KB
MD5

06a9d344a3ca6039e6d65f31e3469846
SHA1

26b4bb2c52c7f51ba98f599afab8e62fc92f117b
SHA256

de48a317d325136e85b0c8c35e60823b460049d67cca0c6bb266bc63b4a585b5
SHA512

04acda132b773674a4c238ba1cbfe038986810b79425a2abc1de19af0f65d267328bd237b2c429a6c90f063ab3cc3cd402fe36d77dba1fb92b81bce9aba4173c
SSDEEP

12288:/tQmKjLk0iZiTqg1fyAtl/DoJHHZ11zQNkfh16t0JRhgMZWU8AiVBYAw3:V5wxTqg1Kol0J/1xm6JbYIp

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/namipan/DUTool.exe
unpack001/namipan/DUTool官方版.exe
unpack001/namipan/Data/CloseIEDll.dll
unpack001/namipan/Data/NamipanExt1.dll
unpack001/namipan/Plugins/SkyDrive2.dll
unpack002/RobotWrapper.exe
unpack004/Plugins/npnami.dll

Files

06a9d344a3ca6039e6d65f31e3469846_JaffaCakes118
.rar
namipan/DUTool.exe
.exe windows:4 windows x86 arch:x86

c7985d478b4b73d1b7b45e6376925114

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
InterlockedCompareExchange
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GetDiskFreeSpaceW
WideCharToMultiByte
GlobalAddAtomW
OutputDebugStringW
GetCurrentThreadId
GlobalFindAtomW
GetCommandLineW
CreateMutexW
CompareStringW
CompareStringA
GetCurrentProcessId
LoadLibraryA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
CreateFileA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesExW
VirtualQuery
GetSystemInfo
VirtualProtect
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TerminateProcess
ExitProcess
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetTimeZoneInformation
GetCPInfo
GetVersionExA
GetStartupInfoW
GetModuleHandleA
CreateThread
ExitThread
HeapReAlloc
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
CompareFileTime
SetEndOfFile
MoveFileW
InterlockedExchange
GetExitCodeThread
Sleep
GlobalSize
GlobalLock
GlobalUnlock
CloseHandle
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
DeleteFileW
CreateFileW
GetLastError
GetFileSize
GlobalAlloc
GlobalHandle
GlobalReAlloc
GlobalFree
WaitForSingleObject
ReleaseMutex
GetModuleHandleW
MultiByteToWideChar
GetModuleFileNameW
GetSystemDirectoryW
CreateDirectoryW
GetFileAttributesW
GetVersionExW
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
EnterCriticalSection
LoadLibraryW
GetProcAddress
FormatMessageW
LocalFree
FreeLibrary
GetTickCount
OutputDebugStringA
LeaveCriticalSection
GetModuleFileNameA
SetEnvironmentVariableA

user32

SendDlgItemMessageW
MessageBoxW
InvalidateRect
GetClientRect
DrawMenuBar
DestroyMenu
RemoveMenu
GetSubMenu
GetMenuItemCount
DefWindowProcW
PostMessageW
GetWindowLongW
GetParent
SetWindowLongW
GetMessageW
LoadAcceleratorsW
LoadStringW
GetWindowTextA
RegisterClassExA
DialogBoxParamW
SwitchToThisWindow
SetForegroundWindow
FindWindowW
IsIconic
ShowWindow
SystemParametersInfoW
GetDlgCtrlID
WindowFromPoint
EndPaint
FillRect
BeginPaint
SetTimer
wsprintfW
MessageBeep
GetWindowRect
DrawTextW
ScreenToClient
GetCursorPos
CallWindowProcW
SetCursor
LoadCursorW
ReleaseDC
GetDC
CreateWindowExW
TrackPopupMenu
GetSystemMetrics
SetWindowPos
MoveWindow
GetWindowTextW
IsWindowEnabled
IsWindowVisible
GetDlgItem
CreateDialogParamW
EnableMenuItem
LoadMenuW
UnregisterClassW
SendMessageW
BringWindowToTop
TranslateAcceleratorW
IsDialogMessageW
GetFocus
TranslateMessage
DispatchMessageW
LoadIconW
RegisterClassExW
PostQuitMessage
ReleaseCapture
SetCapture
DrawFocusRect
SetRect
DestroyWindow
UpdateWindow
KillTimer
GetClipboardData
GetKeyState
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnableWindow
UnregisterHotKey
RegisterHotKey
GetScrollPos
EndDialog

gdi32

CreateSolidBrush
CreateFontW
DeleteObject
TextOutW
GetTextExtentPoint32W
SetBkMode
SelectObject
SetTextColor
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
RoundRect
SelectClipRgn
LineTo
MoveToEx
Rectangle
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
DeleteDC

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW

shell32

Shell_NotifyIconW
ShellExecuteW
ExtractIconExW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

OleInitialize
CoRegisterClassObject
RegisterDragDrop
RevokeDragDrop
CoInitialize
OleUninitialize
CoUninitialize
CoCreateGuid
StgCreateDocfile
OleCreate
OleSetContainedObject
CLSIDFromString
CoRevokeClassObject

oleaut32

SysFreeString
SysAllocString

ws2_32

ntohl
inet_ntoa
inet_addr
ntohs
select
WSASetLastError
accept
listen
getsockname
WSAAsyncSelect
WSAStartup
WSACleanup
WSASetEvent
connect
WSAEnumNetworkEvents
send
recv
WSAEventSelect
WSACreateEvent
socket
bind
closesocket
ioctlsocket
recvfrom
setsockopt
WSAGetLastError
sendto
htons
WSAAsyncGetHostByName
WSACancelAsyncRequest

iphlpapi

GetBestInterface
GetAdaptersInfo
GetIpForwardTable

wininet

InternetGetCookieW
InternetSetCookieW

shlwapi

StrStrW

msimg32

GradientFill

comctl32

ImageList_BeginDrag
ImageList_DrawEx
CreateStatusWindowW
ImageList_Create
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ord17
ImageList_DragEnter

Sections

.text
Size: 412KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
namipan/DUTool官方版.exe
.exe windows:4 windows x86 arch:x86

c7985d478b4b73d1b7b45e6376925114

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ResumeThread
InterlockedCompareExchange
CopyFileW
QueryPerformanceCounter
QueryPerformanceFrequency
GetDiskFreeSpaceW
WideCharToMultiByte
GlobalAddAtomW
OutputDebugStringW
GetCurrentThreadId
GlobalFindAtomW
GetCommandLineW
CreateMutexW
CompareStringW
CompareStringA
GetCurrentProcessId
LoadLibraryA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
CreateFileA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileAttributesExW
VirtualQuery
GetSystemInfo
VirtualProtect
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
HeapSize
TerminateProcess
ExitProcess
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetTimeZoneInformation
GetCPInfo
GetVersionExA
GetStartupInfoW
GetModuleHandleA
CreateThread
ExitThread
HeapReAlloc
RaiseException
RtlUnwind
GetSystemTimeAsFileTime
InterlockedIncrement
InterlockedDecrement
CompareFileTime
SetEndOfFile
MoveFileW
InterlockedExchange
GetExitCodeThread
Sleep
GlobalSize
GlobalLock
GlobalUnlock
CloseHandle
FlushFileBuffers
ReadFile
SetFilePointer
WriteFile
DeleteFileW
CreateFileW
GetLastError
GetFileSize
GlobalAlloc
GlobalHandle
GlobalReAlloc
GlobalFree
WaitForSingleObject
ReleaseMutex
GetModuleHandleW
MultiByteToWideChar
GetModuleFileNameW
GetSystemDirectoryW
CreateDirectoryW
GetFileAttributesW
GetVersionExW
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
EnterCriticalSection
LoadLibraryW
GetProcAddress
FormatMessageW
LocalFree
FreeLibrary
GetTickCount
OutputDebugStringA
LeaveCriticalSection
GetModuleFileNameA
SetEnvironmentVariableA

user32

SendDlgItemMessageW
MessageBoxW
InvalidateRect
GetClientRect
DrawMenuBar
DestroyMenu
RemoveMenu
GetSubMenu
GetMenuItemCount
DefWindowProcW
PostMessageW
GetWindowLongW
GetParent
SetWindowLongW
GetMessageW
LoadAcceleratorsW
LoadStringW
GetWindowTextA
RegisterClassExA
DialogBoxParamW
SwitchToThisWindow
SetForegroundWindow
FindWindowW
IsIconic
ShowWindow
SystemParametersInfoW
GetDlgCtrlID
WindowFromPoint
EndPaint
FillRect
BeginPaint
SetTimer
wsprintfW
MessageBeep
GetWindowRect
DrawTextW
ScreenToClient
GetCursorPos
CallWindowProcW
SetCursor
LoadCursorW
ReleaseDC
GetDC
CreateWindowExW
TrackPopupMenu
GetSystemMetrics
SetWindowPos
MoveWindow
GetWindowTextW
IsWindowEnabled
IsWindowVisible
GetDlgItem
CreateDialogParamW
EnableMenuItem
LoadMenuW
UnregisterClassW
SendMessageW
BringWindowToTop
TranslateAcceleratorW
IsDialogMessageW
GetFocus
TranslateMessage
DispatchMessageW
LoadIconW
RegisterClassExW
PostQuitMessage
ReleaseCapture
SetCapture
DrawFocusRect
SetRect
DestroyWindow
UpdateWindow
KillTimer
GetClipboardData
GetKeyState
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnableWindow
UnregisterHotKey
RegisterHotKey
GetScrollPos
EndDialog

gdi32

CreateSolidBrush
CreateFontW
DeleteObject
TextOutW
GetTextExtentPoint32W
SetBkMode
SelectObject
SetTextColor
CombineRgn
CreatePolygonRgn
CreateRoundRectRgn
RoundRect
SelectClipRgn
LineTo
MoveToEx
Rectangle
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
DeleteDC

comdlg32

GetOpenFileNameW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW

shell32

Shell_NotifyIconW
ShellExecuteW
ExtractIconExW
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW

ole32

OleInitialize
CoRegisterClassObject
RegisterDragDrop
RevokeDragDrop
CoInitialize
OleUninitialize
CoUninitialize
CoCreateGuid
StgCreateDocfile
OleCreate
OleSetContainedObject
CLSIDFromString
CoRevokeClassObject

oleaut32

SysFreeString
SysAllocString

ws2_32

ntohl
inet_ntoa
inet_addr
ntohs
select
WSASetLastError
accept
listen
getsockname
WSAAsyncSelect
WSAStartup
WSACleanup
WSASetEvent
connect
WSAEnumNetworkEvents
send
recv
WSAEventSelect
WSACreateEvent
socket
bind
closesocket
ioctlsocket
recvfrom
setsockopt
WSAGetLastError
sendto
htons
WSAAsyncGetHostByName
WSACancelAsyncRequest

iphlpapi

GetBestInterface
GetAdaptersInfo
GetIpForwardTable

wininet

InternetGetCookieW
InternetSetCookieW

shlwapi

StrStrW

msimg32

GradientFill

comctl32

ImageList_BeginDrag
ImageList_DrawEx
CreateStatusWindowW
ImageList_Create
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_EndDrag
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ord17
ImageList_DragEnter

Sections

.text
Size: 412KB - Virtual size: 410KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
namipan/Data/CloseIEDll.dll
.dll windows:4 windows x86 arch:x86

6194638ee066be547c7c638ed67b0b9d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\CloseIEDll\Release\CloseIEDll.pdb

Imports

kernel32

GetLastError
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter

user32

EnumWindows
EnumChildWindows
GetWindowTextLengthW
GetWindowTextW
MessageBoxW
SendMessageW

Exports

Exports

CloseIEFunc

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
namipan/Data/NamipanExt1.dll
.dll regsvr32 windows:4 windows x86 arch:x86

71a15e319497303ce32b771d4693f5a5

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ole32

CoGetClassObject

kernel32

InterlockedDecrement
lstrcpyA
InterlockedIncrement

user32

FindWindowA
SendMessageA
InsertMenuA
SetMenuItemBitmaps
LoadImageA

gdi32

DeleteObject

shell32

DragQueryFileA

msvcr71

__dllonexit
_except_handler3
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_onexit
free
??2@YAPAXI@Z
??3@YAXPAX@Z

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 346B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
namipan/Data/du.html
.html .js polyglot
namipan/Plugins/SkyDrive2.dll
.dll regsvr32 windows:4 windows x86 arch:x86

130141f3e03126b5abcc950ff0a88ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

HttpSendRequestW
InternetOpenW
InternetReadFile
InternetCloseHandle
HttpQueryInfoW
HttpOpenRequestW
InternetConnectW
HttpAddRequestHeadersW
HttpSendRequestExW
InternetWriteFile
HttpEndRequestW
InternetQueryDataAvailable

kernel32

GetLocaleInfoW
LoadLibraryA
SetFilePointer
GetOEMCP
GetACP
IsBadCodePtr
IsBadReadPtr
ReleaseMutex
WaitForSingleObject
lstrlenW
GlobalFree
GlobalReAlloc
GlobalHandle
GetModuleFileNameW
GlobalAlloc
CloseHandle
GetLastError
CreateMutexW
DisableThreadLibraryCalls
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
SetStdHandle
OutputDebugStringW
MoveFileW
DeleteFileW
WriteFile
CreateFileW
WideCharToMultiByte
ReadFile
GetFileSize
OutputDebugStringA
GetExitCodeThread
Sleep
InterlockedExchange
ResumeThread
InterlockedCompareExchange
GetFileAttributesExW
MultiByteToWideChar
HeapSize
GetCurrentProcessId
QueryPerformanceCounter
IsValidCodePage
IsValidLocale
FlushFileBuffers
GetTickCount
InterlockedIncrement
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetEnvironmentStringsW
InterlockedDecrement
HeapReAlloc
HeapAlloc
RaiseException
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetVersionExA
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW

user32

wsprintfW

comdlg32

GetOpenFileNameW

advapi32

RegCreateKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

oleaut32

SysAllocString
SysFreeString

ws2_32

WSAStartup
WSACleanup

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 248KB - Virtual size: 245KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
namipan/nami_addon.xpi
.zip
RobotWrapper.exe
.exe windows:4 windows x86 arch:x86

d33c30e7469481fa719500b6f0d56e40

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\work\xul\exe\RobotWrapper\Release\RobotWrapper.pdb

Imports

kernel32

GetUserDefaultLCID
GetOEMCP
GetACP
ReadFile
SetStdHandle
WideCharToMultiByte
MultiByteToWideChar
LocalFree
GetLastError
RtlUnwind
ExitProcess
HeapFree
RaiseException
GetModuleHandleA
GetVersionExA
LCMapStringA
LCMapStringW
GetCPInfo
HeapAlloc
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
HeapSize
IsBadReadPtr
IsBadCodePtr
FlushFileBuffers
SetFilePointer
CloseHandle
InterlockedExchange
LoadLibraryA
GetLocaleInfoW

user32

MessageBoxW

ole32

OleInitialize
CoCreateInstance

oleaut32

SysAllocString
VariantInit
SysFreeString

Sections

.text
Size: 56KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
chrome.manifest
chrome/nami.jar
.zip
content/nami/about.xul
.xml
content/nami/contents.rdf
.xml
content/nami/namiOverlay.js
.js
content/nami/namiOverlay.xul
.xml
skin/classic/nami/contents.rdf
.xml
skin/classic/nami/exe1.ico
skin/classic/nami/nami.css
install.rdf
.xml
namipan/skydrive.1.03.xpi
.zip
Plugins/npnami.dll
.dll windows:4 windows x86 arch:x86

313c2e579e879cf6f863729ba20ac0bb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\firefox_plugin\Debug\another.pdb

Imports

ws2_32

htons
htonl

kernel32

CompareStringW
OutputDebugStringA
WideCharToMultiByte
OutputDebugStringW
MultiByteToWideChar
CompareStringA
GetLocaleInfoW
SetEnvironmentVariableA
GetSystemInfo
VirtualProtect
GetTimeZoneInformation
FlushFileBuffers
LCMapStringW
LCMapStringA
SetFilePointer
GetSystemTimeAsFileTime
SetStdHandle
HeapAlloc
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
RtlUnwind
IsBadWritePtr
IsBadReadPtr
HeapValidate
RaiseException
GetModuleFileNameA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DebugBreak
GetProcAddress
LoadLibraryA
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
GetStdHandle
WriteFile
InterlockedDecrement
InterlockedIncrement
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
SetLastError
GetLastError
GetCurrentThread
Sleep
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
ExitProcess
VirtualAlloc
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetProcessHeap
CloseHandle
FreeLibrary
InitializeCriticalSection
VirtualQuery
InterlockedExchange
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
GetTimeFormatA
GetDateFormatA
GetStringTypeA
GetStringTypeW
IsValidLocale

user32

SetWindowLongA
UpdateWindow
BeginPaint
GetClientRect
FrameRect
GetWindowLongA
DrawTextA
EndPaint
DefWindowProcA
InvalidateRect

gdi32

GetStockObject

ole32

CoCreateInstance

oleaut32

SysStringLen
SysAllocString
VariantClear
SysFreeString

Exports

Exports

NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.textbss
Size: - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 356KB - Virtual size: 352KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
install.rdf
namipan/卸载插件.bat
namipan/注册插件.bat

Sharing

General

Malware Config

Signatures

Files

c7985d478b4b73d1b7b45e6376925114

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

shlwapi

msimg32

comctl32

Sections

.text Size: 412KB - Virtual size: 410KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 12KB - Virtual size: 55KB

.rsrc Size: 16KB - Virtual size: 13KB

c7985d478b4b73d1b7b45e6376925114

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

ws2_32

iphlpapi

wininet

shlwapi

msimg32

comctl32

Sections

.text Size: 412KB - Virtual size: 410KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 12KB - Virtual size: 55KB

.rsrc Size: 16KB - Virtual size: 13KB

6194638ee066be547c7c638ed67b0b9d

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 20KB - Virtual size: 19KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

71a15e319497303ce32b771d4693f5a5

Headers

File Characteristics

Imports

ole32

kernel32

user32

gdi32

shell32

msvcr71

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.text
Size: 412KB - Virtual size: 410KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 12KB - Virtual size: 55KB

.rsrc
Size: 16KB - Virtual size: 13KB

.text
Size: 412KB - Virtual size: 410KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 12KB - Virtual size: 55KB

.rsrc
Size: 16KB - Virtual size: 13KB

.text
Size: 20KB - Virtual size: 19KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 92B

.rsrc
Size: 1024B - Virtual size: 568B

.reloc
Size: 512B - Virtual size: 346B

.text
Size: 248KB - Virtual size: 245KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 40KB - Virtual size: 42KB

.rsrc
Size: 4KB - Virtual size: 880B

.reloc
Size: 16KB - Virtual size: 12KB

.text
Size: 56KB - Virtual size: 54KB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 10KB

.textbss
Size: - Virtual size: 162KB

.text
Size: 356KB - Virtual size: 352KB

.rdata
Size: 40KB - Virtual size: 37KB

.data
Size: 12KB - Virtual size: 18KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB