177b58c10b45f5d81fce7ea63559e3db_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

177b58c10b45f5d81fce7ea63559e3db_JaffaCakes118
Size

2.1MB
MD5

177b58c10b45f5d81fce7ea63559e3db
SHA1

d76e1402a2adc5e4cbf3f9a4904eaa685bcecd72
SHA256

155cb36c25c2b65a1cb568a9a843ed702a0e62caceb36f7b740fdec47766536b
SHA512

2726af3d1cd75a50600c736278496c2b7483c32144001322e459ece7f07956d1138f8cfe41a18f8a8d251f6a96cbfff7ae13d30e62cb5dafb499200a052f1286
SSDEEP

49152:dwcsf1pCazJblrrfu0aNvnxkGJ/zr91K+26s6EVEW9uv4IXqcbGy+w:GcaTCazJblPfuHNvKSr91K+AVmFADc6U

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/OfficePassword.dll	acprotect
static1/unpack001/OneNotePassword.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/OfficePassword.dll	upx
static1/unpack001/OneNotePassword.dll	upx

Unsigned PE 12 IoCs

Checks for missing Authenticode signature.

resource
177b58c10b45f5d81fce7ea63559e3db_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/OfficePassword.dll
unpack002/out.upx
unpack001/OfficePasswordRecoveryPRO.exe
unpack001/OfficeZip.dll
unpack001/OneNotePassword.dll
unpack003/out.upx
unpack001/uninstall.exe
unpack004/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_1

Files

177b58c10b45f5d81fce7ea63559e3db_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$DOCUMENTS/My Password Recovery/dictionary/Latin-Lowercase.idf
$DOCUMENTS/My Password Recovery/dictionary/Latin-Mixedcase.idf
$DOCUMENTS/My Password Recovery/dictionary/Latin-Uppercase.idf
$DOCUMENTS/My Password Recovery/dictionary/english.idf
$DOCUMENTS/My Password Recovery/kblayouts/Belarusian.klc
$DOCUMENTS/My Password Recovery/kblayouts/Belgian (Comma).klc
$DOCUMENTS/My Password Recovery/kblayouts/Belgian Dutch.klc
$DOCUMENTS/My Password Recovery/kblayouts/Belgian French.klc
$DOCUMENTS/My Password Recovery/kblayouts/Canadian French (Legacy).klc
$DOCUMENTS/My Password Recovery/kblayouts/Canadian French.klc
$DOCUMENTS/My Password Recovery/kblayouts/Canadian Multilingual Standard.klc
$DOCUMENTS/My Password Recovery/kblayouts/Danish.klc
$DOCUMENTS/My Password Recovery/kblayouts/Dutch.klc
$DOCUMENTS/My Password Recovery/kblayouts/Faeroese.klc
$DOCUMENTS/My Password Recovery/kblayouts/Finnish.klc
$DOCUMENTS/My Password Recovery/kblayouts/French.klc
$DOCUMENTS/My Password Recovery/kblayouts/Gaelic.klc
$DOCUMENTS/My Password Recovery/kblayouts/German (IBM).klc
$DOCUMENTS/My Password Recovery/kblayouts/German.klc
$DOCUMENTS/My Password Recovery/kblayouts/Icelandic.klc
$DOCUMENTS/My Password Recovery/kblayouts/Irish.klc
$DOCUMENTS/My Password Recovery/kblayouts/Italian (142).klc
$DOCUMENTS/My Password Recovery/kblayouts/Italian.klc
$DOCUMENTS/My Password Recovery/kblayouts/Latin American.klc
$DOCUMENTS/My Password Recovery/kblayouts/Norwegian.klc
$DOCUMENTS/My Password Recovery/kblayouts/Portuguese (Brazilian ABNT).klc
$DOCUMENTS/My Password Recovery/kblayouts/Portuguese (Brazilian ABNT2).klc
$DOCUMENTS/My Password Recovery/kblayouts/Portuguese.klc
$DOCUMENTS/My Password Recovery/kblayouts/Russian (Typewriter).klc
$DOCUMENTS/My Password Recovery/kblayouts/Russian.klc
$DOCUMENTS/My Password Recovery/kblayouts/Spanish Variation.klc
$DOCUMENTS/My Password Recovery/kblayouts/Spanish.klc
$DOCUMENTS/My Password Recovery/kblayouts/Swedish.klc
$DOCUMENTS/My Password Recovery/kblayouts/Swiss French.klc
$DOCUMENTS/My Password Recovery/kblayouts/Swiss German.klc
$DOCUMENTS/My Password Recovery/kblayouts/US.klc
$DOCUMENTS/My Password Recovery/kblayouts/Ukrainian.klc
$DOCUMENTS/My Password Recovery/kblayouts/United Kingdom.klc
$DOCUMENTS/My Password Recovery/kblayouts/United States-Dvorak for left hand.klc
$DOCUMENTS/My Password Recovery/kblayouts/United States-Dvorak for right hand.klc
$DOCUMENTS/My Password Recovery/kblayouts/United States-Dvorak.klc
$DOCUMENTS/My Password Recovery/kblayouts/United States-International.klc
$DOCUMENTS/My Password Recovery/profiles/Default.ap
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA

user32

TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
OfficePassword.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

0275B477CBEF91435C6805C819AB7C56DD219F0A
03AB3640CEB9F4FA3EC4883FCB5EFC59E94570EC
0669536C86C7BED45779865066FC632F848DEC3C
08530D65B4711EF194D9A126CE521643DFDB5D0C
093B4703F7A279FA81ABC51F4C72C7B538AB35C6
0981382D4657BB71F4DF7233401F32C351B89A68
0D7FF505EA99DCFB0BEAB36AD794828F54F5C831
13967820F31F95D7443E111B42B47BCD1466680C
1B2CD0B2E73EB94F7174AFAD6791F0D9134C83B8
1FE9F848FFAF20B13B83F61C487C96AFF9082F27
210FEB2C4D13952F04BF90DECA83FA3B63FDB776
2123A6CAAEE64DA40C852B6AEB31CF069617E9AB
2290B018A7707980138C8C882C18C067C56433F6
259520006E0AB7A0D0289D88B8303C2CE100E35B
27E26F571741157667A444AC1330AB9A1A1B982D
2F43E27B4EEB2DE680797481B5476C45995B752F
310A966652D63D658ACE20D045CBEB52B5AD5291
3258C2695A19C3012B1AA84027DE73A650187878
34F0257C166530CF78B6BD6B9C591722B0D89A00
35DBBE53D57C4CBB6B7F71B24AA9059785C6E167
3B26B86B6F6DD67372B1B6E553E6B71BED9A829E
40C5031B09110BB6457E66419078990465FEA1CF
42E35FD544B2D717E85FDF19045CE54654603BB7
46FA636F57A2C0093129999165F0EA6DB78FDDA8
4C12C2B9C27C4BA39D0518B3F5AA6E0F2507D707
4EB78D1732DCD75F50103F5DD051A2AEA7FF3DA6
51415A4D99305506740A80D4FF3353AE5FFC6245
52C3756B6AB8BB6DA3451628C3DA1EB7CF6690F1
53BC730C24F3DDBE1001716D42ABA874B40D6215
543C93305AAD3F793D7E2CA994BA1AED10020B5E
5B7FA3F9F5332D9E3039BDF709DDA4F97EB78C46
5FFC9940086D04517FE79B98D097C171AAA309EF
635197BF9DD77099D7AE0591B7EDD24B1D41D563
644B85110A2BFDDDFEDD059FEF637DD270A70F4B
66D512769BDEB14FCA7A23F431BF46775C1F955A
6A89D3FD26DDAF02DC1547C1A500E2D377A71038
6D21E3B1A6867CD24374A8FC93F9C893939F4C34
6D859C81F7AA1E1E174E28177997C3D9131C654C
72C89BD4D7A735DFDE383C2BE858BFDDF3F46CC8
75483CFCF54653728E4B70403EB9A0D1552BE5CA
7A38BEBD15BE1BC6A908C02EC77933EB9175B43B
7D9595C1E5C0D48FDB013A8FFE8066A466C97FA2
8CD18A95725B6E5B7C4BB3D39B4949A56EB7FB5A
8DA8473830627F8AAB54DEB39BFC7761C44A791A
8F2CA30709FA62499D282BBED0F03D8BEA473022
929ED26F7243BF964F7DCD6723C2FEE466248929
970300AE83CCD44AC1EEB1467A7F4D8129DCA10E
99941D699A3ED14DE9D9A38F281EA79FE1BAC991
9EFBF08922D578087FEF84369A555B25DA353B6A
A067349F01D1402FA9009758F1CF05810F79CDC0
A5A5F7E9F161E1E9A163699F75523B75DE888F3F
A62F2FE81DBF328BB1E655EECDAAA8D9EE0DABAE
A86A40909D7B1924EBFEB3AFA1692A848C86EDD0
A992CEDB2A0AAA790883C574E1B573CA6D21F554
AE3EF02F00E57D5F4484CBC76740C56C3A7F3543
AF8983A621839845E0EBF9BECDF13EC3EA983B56
B13E805770B5F5DD65316C70EA580AB921980382
B16B2B2ABB2B95D00F287F6779C5FA71413A2760
BC1B446CB4CA757DB94489DF07E6DF94CD5E65C6
BD34D9C463024DD0A05B2FAD3FF8AA23A13292AC
C4CA9D17E7E1F1B379FD254C238CC538C41A49A9
C6C265799487BF6E39EB812278D7399BF30E63D2
C8D48B6E4C03E5791704A5CB7D520AC7CD848BBF
CC29032101FA338BB850FA40EDB707846DBE82D8
D1BB4167C4D3634917BA46425EDE8DCE00ABC411
D42377E3A9DAB1D9D337A3E774F581C8D87C1CD6
D4787EAB810618978A31F4785EBE0A09E552C723
D7BBD07ABB0BFE5DAD9177750E35DA23E4616F20
D829C58184D5E368B938E34C00217B02E5B07AF3
D8962E4A1C7EFA6B7A8B47AC6281065ED2C029A9
D9C73595575CBF5F1836461F9ABC6376D224059A
DD6F3C94AFB80D9D9D070681AD928CC7143ECF93
DEB33C5757F8EB6C004490BDEF779AF349F8A9BD
DF96FC9D43966AD6752952CADC2BEFC1D5441A92
E15745BADE63C4A4ADC1F3FA354C740D4B307AC6
E2D9D410DCB360938F60BF5BA44C5446DBBF1FC2
E49B33338D29D9A8C16B71CC580E1020726E31E6
E53B7BDA6ED9F2FBBDB9FD66DB1A251FBC1EC52E
E867EDBEE60D15C0AA690FD110C6AD96A64AD235
E8E00C6B9748C3F326903E08AA59DB737046F224
ECC15CFCF044AABF4AC325584EC56DA780478F0D
FE3F2B6EF68B26B8AF192B89506DA27ADF1FA6C1

Sections

UPX0
Size: - Virtual size: 356KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 181KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 5KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OfficePasswordRecoveryPRO.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 16KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 84B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
OfficeZip.dll
.dll windows:4 windows x86 arch:x86

ab554f11259517f774fe7382c16e5ad4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CloseHandle
GetLastError
GetTempFileNameW
GetDriveTypeW
WideCharToMultiByte
GetFileAttributesW
MultiByteToWideChar
GetTempPathW
GetCurrentDirectoryW
SetVolumeLabelW
MoveFileW
GetDiskFreeSpaceExW
DeleteFileW
SetFileAttributesW
GetDriveTypeA
CreateFileA
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryA
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ReadFile
HeapReAlloc
HeapAlloc
WriteFile
GetConsoleCP
GetConsoleMode
GetSystemTimeAsFileTime
SetFilePointer
GetFileType
CreateFileW
SetEndOfFile
GetProcessHeap
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
SetEnvironmentVariableW
SetCurrentDirectoryW
FlushFileBuffers
SetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStdHandle
GetModuleFileNameA
GetACP
GetOEMCP
CompareStringA
CompareStringW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStartupInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
ExitProcess
GetFullPathNameW
GetCurrentDirectoryA
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
HeapSize
GetLocaleInfoW
SetEnvironmentVariableA

Sections

.text
Size: 184KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OneNotePassword.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

395A61B3714B41D01C8A39D7C7C54F617952DC9C
4A1EC4C1963D873719BF7E7DDAC558175FEF956
562534A0DBA56BE091B5D4FEA1D409C93299BDEB
6310DA54B9435D8290EB4434F495BCDF7F30BCD7
680E8964409C24CE46CA110AF8CC6CDFEC3983C3
93753B144364CD199A789334CCA6B929289A27
CC8EDE21336591DF1859794173D292CB35A71F64
CD2FBEA9B21E3F12DE1787A83551D072292DE
D4605A72058984FD5F3614590DD4496B4C0B146
E03B5CAAE3B4E8C998C27F4713AE2C3AD3E46660
F3937A221D6F27F87C3EEC23F1E997BDA2650A7

Sections

UPX0
Size: - Virtual size: 92KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 49KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 613B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
help/[ENG]OfficePasswordRecovery.chm
.chm
uninstall.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.yrdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 21KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 26KB - Virtual size: 25KB

.yrdata Size: 68KB - Virtual size: 68KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 512B - Virtual size: 472B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 496B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 356KB

UPX1 Size: 181KB - Virtual size: 184KB

.text
Size: 22KB - Virtual size: 21KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 26KB - Virtual size: 25KB

.yrdata
Size: 68KB - Virtual size: 68KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 472B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

UPX0
Size: - Virtual size: 356KB

UPX1
Size: 181KB - Virtual size: 184KB

.rsrc
Size: 5KB - Virtual size: 8KB

CODE
Size: 441KB - Virtual size: 440KB

DATA
Size: 25KB - Virtual size: 25KB

BSS
Size: - Virtual size: 5KB

.idata
Size: 4KB - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 17KB - Virtual size: 17KB

.rsrc
Size: 9KB - Virtual size: 8KB

CODE
Size: 1.9MB - Virtual size: 1.9MB

DATA
Size: 15KB - Virtual size: 14KB

BSS
Size: - Virtual size: 16KB

.idata
Size: 17KB - Virtual size: 17KB

.tls
Size: - Virtual size: 84B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 141KB - Virtual size: 140KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 184KB - Virtual size: 181KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 8KB - Virtual size: 32KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 12KB - Virtual size: 11KB

UPX0
Size: - Virtual size: 92KB

UPX1
Size: 49KB - Virtual size: 52KB

.rsrc
Size: 1KB - Virtual size: 4KB

CODE
Size: 93KB - Virtual size: 93KB

DATA
Size: 6KB - Virtual size: 6KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 3KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 613B

.reloc
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 5KB - Virtual size: 5KB

.text
Size: 22KB - Virtual size: 21KB