27d62427e893278486e67c1ce282b0c0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27d62427e893278486e67c1ce282b0c0_JaffaCakes118
Size

2.0MB
MD5

27d62427e893278486e67c1ce282b0c0
SHA1

b52c6ec4529042b031f5bfbb202510aec6c54839
SHA256

9971b46aa579a436ab78b8b5dfa7359af1bab3144412c3733a2e6985bcac81e7
SHA512

7992395df3f6f70a3fd4e82b6892f726e2e1a9a98ea2aec7a28b7805c1ca3c774a4115b360c2b4dc85ad5cf14306d899265d8407247313d487e21eaa2e6bce76
SSDEEP

49152:DMkA2wZxkBvfY48+I1MmNxyl+ki4pPfx+wdqYtzPYz:DMR2wZx148BMmWlnDT+OqYtzQz

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
27d62427e893278486e67c1ce282b0c0_JaffaCakes118
unpack001/$PLUGINSDIR/FileInfo.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/mumuflash.exe
unpack001/mumuflash_uninstall.exe
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsDialogs.dll

Files

27d62427e893278486e67c1ce282b0c0_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/木木小游戏/config/play.ini
$APPDATA/木木小游戏/data/18/18
.gif
$APPDATA/木木小游戏/data/18/18.html
.html .js polyglot
$APPDATA/木木小游戏/data/18/18.swf
$APPDATA/木木小游戏/data/18/config.ini
$APPDATA/木木小游戏/data/23/23
.gif
$APPDATA/木木小游戏/data/23/23.html
.html .js polyglot
$APPDATA/木木小游戏/data/23/23.swf
$APPDATA/木木小游戏/data/23/config.ini
$APPDATA/木木小游戏/data/262/262
.gif
$APPDATA/木木小游戏/data/262/262.html
.html .js polyglot
$APPDATA/木木小游戏/data/262/262.swf
$APPDATA/木木小游戏/data/262/config.ini
$APPDATA/木木小游戏/data/394/394
.jpg
$APPDATA/木木小游戏/data/394/394.html
.html .js polyglot
$APPDATA/木木小游戏/data/394/394.swf
$APPDATA/木木小游戏/data/394/config.ini
$APPDATA/木木小游戏/data/585/585
.jpg
$APPDATA/木木小游戏/data/585/585.html
.html .js polyglot
$APPDATA/木木小游戏/data/585/585.swf
$APPDATA/木木小游戏/data/585/config.ini
$APPDATA/木木小游戏/html/Thumbs.db
$APPDATA/木木小游戏/html/about.html
$APPDATA/木木小游戏/html/about_templet.html
$APPDATA/木木小游戏/html/base64-80.js
.js
$APPDATA/木木小游戏/html/button_blank.html
.html
$APPDATA/木木小游戏/html/catalog_title.html
.html
$APPDATA/木木小游戏/html/config.html
.html .js polyglot
$APPDATA/木木小游戏/html/download.html
$APPDATA/木木小游戏/html/exe_title.html
.html
$APPDATA/木木小游戏/html/explain.html
$APPDATA/木木小游戏/html/green.swf
$APPDATA/木木小游戏/html/help_templet.html
.html
$APPDATA/木木小游戏/html/hotest_title.html
.html
$APPDATA/木木小游戏/html/images/125_250a.gif
.gif
$APPDATA/木木小游戏/html/images/125_250b.gif
.gif
$APPDATA/木木小游戏/html/images/535_435.jpg
.jpg
$APPDATA/木木小游戏/html/images/Thumbs.db
$APPDATA/木木小游戏/html/images/create_desktop.gif
.gif
$APPDATA/木木小游戏/html/images/dotblue.gif
.gif
$APPDATA/木木小游戏/html/images/exe_title.gif
.gif
$APPDATA/木木小游戏/html/images/guanwang.gif
.gif
$APPDATA/木木小游戏/html/images/lanmu_top_bg.gif
.gif
$APPDATA/木木小游戏/html/images/left_bg.gif
.gif
$APPDATA/木木小游戏/html/images/left_title.gif
.gif
$APPDATA/木木小游戏/html/images/remove_local.gif
.gif
$APPDATA/木木小游戏/html/images/right_title.gif
.gif
$APPDATA/木木小游戏/html/images/select_folder.gif
.gif
$APPDATA/木木小游戏/html/images/set_default.gif
.gif
$APPDATA/木木小游戏/html/images/submit.gif
.gif
$APPDATA/木木小游戏/html/images/webgame_title.gif
.gif
$APPDATA/木木小游戏/html/local_foot.html
$APPDATA/木木小游戏/html/local_head_hotest.html
.html
$APPDATA/木木小游戏/html/local_head_newest.html
.html
$APPDATA/木木小游戏/html/local_hotest_1.html
.html
$APPDATA/木木小游戏/html/local_hotest_2.html
.html
$APPDATA/木木小游戏/html/local_item.html
$APPDATA/木木小游戏/html/local_line_begin.html
$APPDATA/木木小游戏/html/local_line_end.html
$APPDATA/木木小游戏/html/local_newest_1.html
.html
$APPDATA/木木小游戏/html/local_newest_2.html
.html
$APPDATA/木木小游戏/html/main.css
$APPDATA/木木小游戏/html/noexplain.html
.html .js polyglot
$APPDATA/木木小游戏/html/pauseAd.html
$APPDATA/木木小游戏/html/perfectexplain.gif
.gif
$APPDATA/木木小游戏/html/webgame_title.html
.html
$APPDATA/木木小游戏/url/千款热门单机游戏，安全下载.url
.url
$APPDATA/木木小游戏/url/单机游戏下载基地.url
$APPDATA/木木小游戏/url/单机游戏大全.url
$APPDATA/木木小游戏/url/就爱玩游戏.url
$APPDATA/木木小游戏/url/就要DVD.url
$APPDATA/木木小游戏/url/木木小游戏.url
$APPDATA/木木小游戏/url/热门游戏下载乐园.url
$FAVORITES/千款热门单机游戏，安全下载.url
.url
$FAVORITES/单机游戏下载基地.url
$FAVORITES/单机游戏大全.url
$FAVORITES/就爱玩游戏.url
$FAVORITES/就要DVD.url
$FAVORITES/木木小游戏.url
$FAVORITES/热门游戏下载乐园.url
$PLUGINSDIR/FileInfo.dll
.dll windows:4 windows x86 arch:x86

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\program files\nsis\nsis-2.42.6-unicode-src\plugins\FileInfo.pdb

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

SetLastError
lstrcpynW
GlobalFree
lstrcpyW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
LCMapStringA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
WriteFile
InitializeCriticalSection
RtlUnwind
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

user32

wsprintfW

Exports

Exports

GetSpecialBuild

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mumuflash.exe
.exe windows:4 windows x86 arch:x86

c5a39d76c9d0dd0e52ff2fd237cb765c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\flashgames\trunk\bin\debug\mumuflash.pdb

Imports

kernel32

InterlockedDecrement
DeleteCriticalSection
lstrcmpW
VirtualQuery
WriteProcessMemory
GetSystemInfo
Module32FirstW
SizeofResource
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
LoadResource
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetHandleCount
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
MulDiv
ExitProcess
GetModuleHandleA
HeapSize
HeapCreate
HeapDestroy
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStdHandle
GetFileType
WriteConsoleW
HeapReAlloc
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetVersionExA
LoadLibraryW
lstrcpynA
CreateToolhelp32Snapshot
GetFileAttributesW
GetCurrentProcessId
FreeLibrary
MultiByteToWideChar
FindResourceW
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
CreateSemaphoreW
GetVersionExW
InitializeCriticalSection
LoadLibraryA
GlobalAlloc
GetLastError
InterlockedIncrement
GlobalLock
QueryPerformanceCounter
lstrlenW
GetProcAddress
GlobalUnlock
GetModuleFileNameW
CloseHandle
CreateThread
LeaveCriticalSection
Process32FirstW
Process32NextW
LocalAlloc
ReleaseMutex
GetVolumeInformationW
GetDiskFreeSpaceExW
FindClose
FindNextFileW
FindFirstFileW
SetFileAttributesW
GetTempFileNameW
GetTempPathW
MoveFileW
GetFullPathNameW
GetWindowsDirectoryW
GetLongPathNameW
GetFileSize
SetFilePointer
ReadFile
GetCurrentProcess
GetCurrentThreadId
EnterCriticalSection
RaiseException
FlushInstructionCache
GetModuleFileNameA
SetLastError
GetPrivateProfileStringW
LocalFree
FormatMessageW
CreateProcessW
GetLocalTime
RemoveDirectoryW
CopyFileW
ResumeThread
WaitForSingleObject
CreateDirectoryW
GetEnvironmentVariableW
GetProcessHeap
HeapFree
Module32NextW
HeapAlloc
WideCharToMultiByte
DeleteFileW
WriteFile
CreateFileW
GetTickCount
Sleep
CompareStringW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW

user32

ReleaseDC
EnableMenuItem
LoadCursorW
EndPaint
SetWindowLongW
GetClassInfoExW
UnregisterClassA
SetLayeredWindowAttributes
FillRect
IsWindow
SetFocus
CreateWindowExW
GetWindowLongW
RegisterClassExW
SendMessageW
GetClientRect
CallWindowProcW
DefWindowProcW
RedrawWindow
MoveWindow
TranslateMessage
GetMessageW
DispatchMessageW
LoadBitmapW
TrackPopupMenuEx
PostQuitMessage
GetMenuItemCount
MessageBeep
LoadAcceleratorsW
LoadImageW
GetWindowDC
CreatePopupMenu
SetTimer
GetSystemMetrics
LoadStringA
LoadStringW
PtInRect
MapWindowPoints
AppendMenuW
OffsetRect
TranslateAcceleratorW
RemoveMenu
GetMonitorInfoW
PostMessageW
GetActiveWindow
DialogBoxParamW
PeekMessageW
LoadMenuW
DestroyMenu
KillTimer
GetMenuItemInfoW
MonitorFromPoint
SetWindowRgn
MessageBoxW
IsWindowVisible
InflateRect
SetCapture
ClientToScreen
GetWindowTextLengthW
GetCursorPos
GetSystemMenu
CharNextW
IsChild
GetClassNameW
CreateAcceleratorTableW
DestroyAcceleratorTable
ScreenToClient
InvalidateRect
SetWindowTextW
GetDlgItem
RegisterWindowMessageW
InvalidateRgn
GetWindowTextW
ReleaseCapture
DestroyWindow
GetFocus
GetDesktopWindow
SetWindowPos
GetParent
SystemParametersInfoW
GetSysColor
GetWindowRect
GetWindow
GetDC
ShowWindow
EnableWindow
DrawTextW
IsWindowEnabled
GetDlgCtrlID
DrawFocusRect
GetCapture
SetCursor
SetRectEmpty
UpdateWindow
EndDialog
GetWindowThreadProcessId
SetForegroundWindow
SwitchToThisWindow
GetForegroundWindow
BringWindowToTop
AttachThreadInput
GetMenu
AdjustWindowRectEx
DrawEdge
CreateDialogParamW
GetMessagePos
EqualRect
SetPropW
GetPropW
BeginPaint

gdi32

ExtTextOutW
SetTextAlign
CreateRoundRectRgn
CreateRectRgn
CombineRgn
BitBlt
GetObjectW
CreateCompatibleBitmap
CreateCompatibleDC
GetStockObject
GetDeviceCaps
SelectObject
CreateFontIndirectW
CreateSolidBrush
GetTextMetricsW
DeleteObject
DeleteDC
SetTextColor
GetTextExtentPoint32W
SetBkMode
CreatePen
MoveToEx
LineTo
SetPixel
Rectangle
CreateBitmap
PatBlt
CreatePatternBrush

advapi32

RegSetValueExW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyW
RegDeleteKeyW
RegQueryInfoKeyW

ole32

CoInitialize
CoUninitialize
OleUninitialize
CoTaskMemFree
CoGetClassObject
CLSIDFromString
StringFromGUID2
CLSIDFromProgID
CoCreateInstance
OleInitialize
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemRealloc
OleLockRunning

oleaut32

VarUI4FromStr
SafeArrayGetUBound
SafeArrayCreate
SafeArrayAccessData
SafeArrayPutElement
SafeArrayGetLBound
SafeArrayUnaccessData
DispCallFunc
SysFreeString
SysStringByteLen
LoadTypeLi
OleCreateFontIndirect
VariantClear
SysStringLen
VariantInit
SysAllocStringLen
LoadRegTypeLi
SysAllocString

comctl32

_TrackMouseEvent
ImageList_Destroy
ImageList_Draw
ImageList_LoadImageW
ImageList_GetIconSize
InitCommonControlsEx

msimg32

GradientFill
TransparentBlt

ws2_32

inet_addr
gethostbyname
setsockopt
sendto
WSAGetLastError
recvfrom
WSASocketW
WSAStartup
WSACleanup
closesocket

sensapi

IsNetworkAlive

wininet

InternetWriteFile
InternetCrackUrlW
HttpEndRequestW
HttpSendRequestExW
InternetConnectW
InternetOpenW
InternetSetOptionW
HttpOpenRequestW
InternetCloseHandle
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetOpenUrlW
InternetReadFile

shell32

SHBrowseForFolderW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderLocation
SHChangeNotify
SHGetPathFromIDListW

imagehlp

ImageDirectoryEntryToData

Sections

.text
Size: 376KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 928KB - Virtual size: 926KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
mumuflash_uninstall.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
木木小游戏免责声明.txt

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.5MB

.rsrc Size: 57KB - Virtual size: 57KB

f6e384a477f8efc14029bba8fca9bd0f

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 26KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 176B

.reloc Size: 5KB - Virtual size: 4KB

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 899B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 574B

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 48B

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 590B

c5a39d76c9d0dd0e52ff2fd237cb765c

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.5MB

.rsrc
Size: 57KB - Virtual size: 57KB

.text
Size: 26KB - Virtual size: 26KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 176B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

.text
Size: 376KB - Virtual size: 372KB

.rdata
Size: 96KB - Virtual size: 93KB

.data
Size: 24KB - Virtual size: 30KB

.rsrc
Size: 928KB - Virtual size: 926KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.5MB

.rsrc
Size: 57KB - Virtual size: 57KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 899B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 574B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B