2bdd2990e2dfb16981a2d49bd2227915_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

2bdd2990e2dfb16981a2d49bd2227915_JaffaCakes118
Size

5.1MB
MD5

2bdd2990e2dfb16981a2d49bd2227915
SHA1

a03274af725002232ee3f61622701abd947a2923
SHA256

af557d30c51a450ef22345e2cca13247bf9e755fb9a25a305553e0cb78379456
SHA512

f633681f486c91a1e2d9f405fd33d94c3f03eec83169b78dab90bc1d41433b022906c99a7ae354a7b9419a08b2b72b8ac0e23e5fb415b896afa157b4b3118643
SSDEEP

98304:seit/V5KgoSKrSFwm9iacJlf8zdzII8z2n9WP4ZgArUZ7YI5G1MZO:tiLUgBF5wIII8z2ncYgU+R81uO

Score

1^/10

Malware Config

Signatures

Files

2bdd2990e2dfb16981a2d49bd2227915_JaffaCakes118
.rar
DwgSeePlus/DSUpdater.exe
.exe windows:5 windows x86 arch:x86

fa37767aeaed30b5c4f00c42d1cb8887

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

19-04-2010 00:00

Not After

19-04-2011 23:59

Subject

CN=Beijing DrawLeader Tech. Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing DrawLeader Tech. Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7
Signer

Actual PE Digest

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCanonicalizeUrlW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetGetConnectedState
InternetOpenW
InternetReadFile

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetProcessHeap
GetConsoleMode
GetConsoleCP
LCMapStringA
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
GetTimeZoneInformation
GetModuleHandleW
InterlockedDecrement
WritePrivateProfileStringW
GetTempPathW
GetPrivateProfileStringW
lstrcpyW
CloseHandle
WriteFile
CreateFileW
FindClose
FindFirstFileW
CreateDirectoryW
GetLastError
MoveFileExW
GetFileAttributesW
DeleteFileW
GetModuleFileNameW
WinExec
GetPrivateProfileIntW
SetLastError
MulDiv
lstrlenW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
HeapSize
LocalFree
FormatMessageW
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
ExitThread
GlobalSize
CopyFileW
GlobalFree
GetSystemTimeAsFileTime
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
RtlUnwind
GetStartupInfoW
FindResourceExW
GetFileTime
GetFileSizeEx
VirtualProtect
SearchPathW
GetProfileIntW
GetTickCount
SetErrorMode
GetTempFileNameW
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
Sleep
GetFileSize
GetCurrentDirectoryW
GetThreadLocale
GlobalGetAtomNameW
GlobalFlags
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateEventW
SuspendThread
GetProcAddress
SetEvent
WaitForSingleObject
ResumeThread
SetThreadPriority
lstrlenA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetCurrentProcessId
WideCharToMultiByte
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
LoadLibraryW
CompareStringW
LoadLibraryA
FreeLibrary
lstrcmpW
GetVersionExA
FreeResource
GetModuleHandleA

user32

GetKeyboardState
GetKeyboardLayout
MapVirtualKeyW
ToUnicodeEx
CopyAcceleratorTableW
PostThreadMessageW
CopyIcon
SubtractRect
GetUpdateRect
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
FrameRect
TranslateAcceleratorW
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
IsClipboardFormatAvailable
DestroyAcceleratorTable
GetDoubleClickTime
SetCursorPos
SetClassLongW
UpdateLayeredWindow
EnableScrollBar
GetMenuDefaultItem
SetMenuDefaultItem
UnionRect
IsMenu
CharUpperW
GetAsyncKeyState
NotifyWinEvent
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
WaitMessage
WindowFromPoint
DeleteMenu
DestroyMenu
GetMenuItemInfoW
SetWindowContextHelpId
MapDialogRect
LoadCursorW
ShowOwnedPopups
GetMessageW
TranslateMessage
LoadMenuW
ReleaseCapture
GetIconInfo
CopyImage
DestroyIcon
GetNextDlgGroupItem
SetCapture
SystemParametersInfoW
MessageBeep
DrawFocusRect
DrawFrameControl
DrawEdge
SetRect
GetCursorPos
SetParent
LockWindowUpdate
ValidateRect
BringWindowToTop
CreatePopupMenu
SetRectEmpty
GetSysColorBrush
DrawIconEx
SetWindowRgn
IsZoomed
InflateRect
IsRectEmpty
PostQuitMessage
GetWindowThreadProcessId
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
GetKeyState
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
IsWindowVisible
PostMessageW
MessageBoxW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowPos
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindow
RegisterWindowMessageW
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
IsWindowEnabled
GetNextDlgTabItem
GetWindowRgn
DestroyCursor
CreateMenu
MapVirtualKeyExW
IsCharLowerW
CharUpperBuffW
GetKeyNameTextW
EndDialog
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
UnregisterClassW
InvalidateRgn
CharNextW
RegisterClipboardFormatW
EnumChildWindows
CreateAcceleratorTableW
GetMenuState
GetMenuStringW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
FindWindowW
GetSysColor
SetCursor
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
GetWindowRect
FillRect
OffsetRect
GetWindowLongW
LoadImageW
IsWindow
SetWindowLongW
GetSystemMetrics
LoadIconW
GetParent
GetClientRect
IsIconic
GetSystemMenu
SendMessageW
AppendMenuW
DrawIcon
MessageBoxIndirectW
EnableWindow
DrawStateW

gdi32

SetTextAlign
SelectClipRgn
CreateRectRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SelectObject
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateBitmap
SelectPalette
GetObjectType
CreatePen
CreateHatchBrush
GetDCOrgEx
CreateRectRgnIndirect
CreatePolygonRgn
CreateRoundRectRgn
CombineRgn
GetBkColor
GetTextColor
PatBlt
MoveToEx
GetTextExtentPoint32W
Polyline
RoundRect
Polygon
GetTextMetricsW
CreateEllipticRgn
Ellipse
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
GetMapMode
DPtoLP
SetDIBColorTable
GetDIBits
RealizePalette
StretchBlt
SetPixel
CreatePalette
GetPaletteEntries
OffsetRgn
GetRgnBox
GetNearestPaletteIndex
GetSystemPaletteEntries
ExtFloodFill
SetPaletteEntries
PtInRegion
FrameRgn
SetPixelV
GetWindowOrgEx
FillRgn
GetBoundsRect
LPtoDP
EnumFontFamiliesExW
GetTextFaceW
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
SetBkColor
RestoreDC
SaveDC
CopyMetaFileW
GetDeviceCaps
GetViewportOrgEx
SetViewportOrgEx
GetStockObject
DeleteObject
CreateSolidBrush
BitBlt
Rectangle
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
SetTextColor
CreateFontIndirectW

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegEnumKeyExW
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyW
RegQueryValueW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegDeleteValueW

shell32

SHBrowseForFolderW
DragFinish
DragQueryFileW
SHAppBarMessage
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW

comctl32

ord17
InitCommonControlsEx
ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathStripToRootW
PathFindExtensionW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleLockRunning
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
CLSIDFromProgID
CoFreeUnusedLibraries
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleGetClipboard
RevokeDragDrop
CoRegisterMessageFilter
CoRevokeClassObject
CLSIDFromString
OleInitialize
CoLockObjectExternal
RegisterDragDrop
OleDuplicateData
OleUninitialize
CoUninitialize

oleaut32

SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysStringLen
OleCreateFontIndirect
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysAllocString

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdiplusStartup
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImageGraphicsContext
GdipDrawImageI
GdipGetImagePalette
GdipCloneImage

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DwgSeePlus/DwgSeePlus.exe
.exe windows:5 windows x86 arch:x86

8fba49b3228e01177cb74b8083a1a7e5

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21-05-2009 00:00

Not After

20-05-2019 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

19-04-2010 00:00

Not After

19-04-2011 23:59

Subject

CN=Beijing DrawLeader Tech. Co.\,Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing DrawLeader Tech. Co.\,Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e1:a2:b7:fb:ab:5e:24:89:07:5d:dc:a0:78:fc:59:bb:6e:25:d0:b7
Signer

Actual PE Digest

e1:a2:b7:fb:ab:5e:24:89:07:5d:dc:a0:78:fc:59:bb:6e:25:d0:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\VSDSoft\DwgSee\Code\Bin\DwgSeePlus.pdb

Imports

kernel32

CreateFileA
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryA
PeekNamedPipe
GetFileInformationByHandle
GetDateFormatA
GetTimeFormatA
LCMapStringA
GetTimeZoneInformation
GlobalAlloc
LCMapStringW
SetEnvironmentVariableW
SetEnvironmentVariableA
GetOEMCP
GetCPInfo
QueryPerformanceCounter
VirtualFree
HeapCreate
GetStartupInfoA
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetStdHandle
HeapSize
VirtualQuery
GetSystemInfo
VirtualAlloc
GetSystemTimeAsFileTime
CreateThread
ExitThread
ExitProcess
GetDriveTypeW
RaiseException
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapFree
HeapReAlloc
HeapAlloc
GetStartupInfoW
FindResourceExW
GetProfileIntW
SearchPathW
GetFileSizeEx
GetFileAttributesExW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
TlsGetValue
GlobalFlags
InterlockedIncrement
VirtualProtect
GlobalReAlloc
GetShortPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
lstrcmpiW
GetThreadLocale
GetStringTypeExW
DeleteFileW
MoveFileW
GetCurrentDirectoryW
GetTickCount
lstrlenA
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
CompareStringA
InterlockedExchange
WritePrivateProfileStringW
WaitForSingleObject
ResumeThread
SetThreadPriority
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
GetFileTime
SetFileTime
GlobalGetAtomNameW
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
GlobalFree
CopyFileW
GlobalSize
MulDiv
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryA
lstrcmpW
GetVersionExA
FreeLibrary
GetFileAttributesW
CreateFileMappingW
MapViewOfFile
CreateFileW
UnmapViewOfFile
LocalAlloc
LocalLock
LocalUnlock
SetEndOfFile
ReadFile
SetFilePointer
GetFileSize
FlushFileBuffers
CloseHandle
GetStdHandle
GetFileType
WriteConsoleW
WriteFile
SetErrorMode
GetACP
GetLocalTime
FileTimeToLocalFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
IsDBCSLeadByteEx
IsValidCodePage
GetVersionExW
GetDateFormatW
GetTimeFormatW
GetWindowsDirectoryW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CompareStringW
lstrlenW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetTempPathW
Sleep
WinExec
InterlockedDecrement
FindClose
FindNextFileW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFree
FormatMessageW
FindFirstFileW
GetProcAddress
GetModuleHandleW
SetLastError
LoadLibraryW
WideCharToMultiByte
GetLastError
lstrcpyW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalUnlock
GlobalLock
GetDriveTypeA

user32

GetDoubleClickTime
CopyImage
IsClipboardFormatAvailable
DestroyAcceleratorTable
GetUpdateRect
UpdateLayeredWindow
UnionRect
EnableScrollBar
FrameRect
SetCursorPos
CopyIcon
DestroyIcon
SetMenuDefaultItem
IsMenu
GetMenuDefaultItem
GetMenuItemInfoW
NotifyWinEvent
WindowFromPoint
DeleteMenu
ShowOwnedPopups
PostThreadMessageW
SetWindowContextHelpId
MapDialogRect
MessageBeep
MapVirtualKeyW
GetKeyNameTextW
CreateDialogIndirectParamW
GetNextDlgTabItem
GetAsyncKeyState
WaitMessage
GetMessageW
ValidateRect
DrawFrameControl
DrawEdge
DrawStateW
SystemParametersInfoW
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnpackDDElParam
ReuseDDElParam
DestroyMenu
GetActiveWindow
LoadAcceleratorsW
InsertMenuItemW
TranslateAcceleratorW
IsZoomed
GetWindowThreadProcessId
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
TabbedTextOutW
GetMenuStringW
InsertMenuW
RemoveMenu
GetCursorPos
SetParent
SetWindowRgn
AppendMenuW
CreatePopupMenu
IsWindowEnabled
MoveWindow
IsDialogMessageW
SetDlgItemTextW
CheckDlgButton
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
CharNextW
GetForegroundWindow
GetLastActivePopup
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenuItemID
GetMenuItemCount
MessageBoxW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
SetWindowPlacement
CallWindowProcW
GetMenu
GetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
GetMenuState
CheckMenuItem
IsWindow
DeferWindowPos
SetClassLongW
GetDlgCtrlID
EqualRect
DrawIconEx
GetIconInfo
IsRectEmpty
WindowFromDC
DefWindowProcW
RegisterClassExW
EnableWindow
SendMessageW
GetSysColor
DrawFocusRect
CopyRect
PostMessageW
RedrawWindow
RegisterClipboardFormatW
OpenClipboard
GetDesktopWindow
CreateWindowExW
UnregisterClassW
GetSysColorBrush
CharLowerW
CharUpperW
DialogBoxParamW
CreateIconIndirect
SetWindowLongW
ShowWindow
SetWindowTextW
EndDialog
GetDlgItem
GetWindowTextW
DestroyWindow
LockWindowUpdate
DrawTextW
BringWindowToTop
CopyAcceleratorTableW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
GetNextDlgGroupItem
EnumChildWindows
InvalidateRgn
CharUpperBuffW
DrawIcon
SubtractRect
KillTimer
SetActiveWindow
IsWindowVisible
GetWindow
GetSystemMetrics
LoadImageW
LoadIconW
GetClassInfoW
SetTimer
SetRectEmpty
InvalidateRect
CreateMenu
GetWindowRgn
IsCharLowerW
MapVirtualKeyExW
GetTabbedTextExtentA
GetWindowTextLengthW
EmptyClipboard
SetClipboardData
CloseClipboard
GetClientRect
InflateRect
FindWindowW
SetForegroundWindow
UpdateWindow
PostQuitMessage
GetKeyState
GetSystemMenu
EnableMenuItem
LoadMenuW
GetSubMenu
IsChild
GetFocus
GetParent
ClientToScreen
GetDC
ReleaseDC
GetClipboardData
DestroyCursor
SetCursor
LoadCursorW
GetWindowRect
InvertRect
ScreenToClient
PtInRect
SetCapture
ReleaseCapture
SetRect
OffsetRect
IntersectRect
PeekMessageW
TranslateMessage
DispatchMessageW
LoadBitmapW
FillRect
GetMessagePos
GetKeyboardLayout

gdi32

SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
StartDocW
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
CreatePatternBrush
GetObjectType
CreateHatchBrush
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
CreateEllipticRgn
ExcludeClipRect
CombineRgn
GetBkColor
PatBlt
GetSystemPaletteEntries
CreateRoundRectRgn
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
SetRectRgn
RealizePalette
RoundRect
OffsetRgn
GetCharWidthW
PtInRegion
FrameRgn
SetPixelV
GetViewportOrgEx
LPtoDP
FillRgn
GetBoundsRect
GetWindowOrgEx
ExtFloodFill
SetPaletteEntries
GetNearestColor
GetBkMode
GetPolyFillMode
GetROP2
GetStretchBltMode
GetTextAlign
GetTextFaceW
GetTextExtentPoint32A
GetCurrentObject
SetWindowOrgEx
SelectPalette
SetStretchBltMode
SetROP2
CopyMetaFileW
GetClipBox
GetDCOrgEx
GetTextColor
CreateDCW
GetPaletteEntries
SetDIBColorTable
SetEnhMetaFileBits
DeleteEnhMetaFile
RestoreDC
SetPolyFillMode
IntersectClipRect
SaveDC
BeginPath
PolyPolygon
EndPath
SelectClipPath
Polygon
MoveToEx
LineTo
ExtCreatePen
CreatePenIndirect
SetBkMode
SetTextColor
CreatePolygonRgn
BitBlt
CreatePalette
GetNearestPaletteIndex
EnumFontFamiliesExW
GetFontLanguageInfo
GetCharacterPlacementW
GetFontUnicodeRanges
GetFontData
GetTextMetricsW
GetGlyphOutlineW
GetMapMode
SetMapMode
CreateBitmap
DPtoLP
SetBitmapBits
GetBitmapBits
SetDIBits
GetDIBits
SetPixel
Polyline
CreatePen
SetBkColor
PlayEnhMetaFile
SetWinMetaFileBits
StretchDIBits
GetTextExtentPoint32W
GetStockObject
GetPixel
CreateRectRgnIndirect
GetRgnBox
GetClipRgn
CreateRectRgn
GetDeviceCaps
DeleteObject
CreateDIBSection
Ellipse
DeleteDC
StretchBlt
SelectObject
CreateCompatibleBitmap
CreateFontIndirectW
CreateSolidBrush
Rectangle
GetObjectW
CreateCompatibleDC
CreateBrushIndirect

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

GetPrinterW
ClosePrinter
EnumFormsW
EnumPrintersW
GetJobW
OpenPrinterW
DeviceCapabilitiesW
DocumentPropertiesW

advapi32

RegEnumKeyW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
GetUserNameW
RegEnumValueW
RegSetValueW
SetFileSecurityW
GetFileSecurityW
RegCreateKeyExW
RegCreateKeyW
RegQueryValueW
RegOpenKeyW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW

shell32

SHGetPathFromIDListW
DragAcceptFiles
ShellExecuteW
DragQueryFileW
DragFinish
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
ExtractIconW
SHAppBarMessage
SHGetFileInfoW
SHBrowseForFolderW
SHFileOperationW

comctl32

InitCommonControlsEx
ImageList_GetIconSize
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_Remove
ImageList_DrawEx

shlwapi

PathFindExtensionW
PathRemoveExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathRemoveFileSpecW
PathCompactPathW

oledlg

OleUIBusyW

ole32

CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CoInitializeEx
CoCreateInstance
CoUninitialize
OleDuplicateData
ReleaseStgMedium
OleCreateMenuDescriptor
CLSIDFromString
CoCreateGuid
StringFromCLSID
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
IsAccelerator
OleTranslateAccelerator
OleLockRunning
CoGetClassObject
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
OleDestroyMenuDescriptor
RevokeDragDrop
CoLockObjectExternal
DoDragDrop
RegisterDragDrop
OleGetClipboard
CreateILockBytesOnHGlobal

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysStringLen
OleCreateFontIndirect
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime

gdiplus

GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageBounds
GdipSetSmoothingMode
GdipSetInterpolationMode
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipImageSelectActiveFrame
GdipLoadImageFromStream
GdipSaveImageToFile
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateHBITMAPFromBitmap
GdipGetImageThumbnail
GdipGetImageWidth
GdipGetImageHeight
GdipDisposeImage
GdipCloneImage
GdipAlloc
GdipFree
GdipCreateBitmapFromFile
GdipDrawImageI

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 8.1MB - Virtual size: 8.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 198KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 766KB - Virtual size: 765KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DwgSeePlus/Fonts/HzTXT.shx
DwgSeePlus/Fonts/Txt.shx

Sharing

General

Malware Config

Signatures

Files

fa37767aeaed30b5c4f00c42d1cb8887

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fbCertificate

Extended Key Usages

Key Usages

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7Signer

Headers

DLL Characteristics

File Characteristics

Imports

wininet

version

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

gdiplus

imm32

winmm

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 283KB - Virtual size: 283KB

.data Size: 24KB - Virtual size: 52KB

.rsrc Size: 90KB - Virtual size: 89KB

8fba49b3228e01177cb74b8083a1a7e5

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fbCertificate

Extended Key Usages

Key Usages

e1:a2:b7:fb:ab:5e:24:89:07:5d:dc:a0:78:fc:59:bb:6e:25:d0:b7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

90:5d:c5:13:05:ca:c8:57:39:8f:df:6a:c3:60:1c:12:af:cc:aa:f7
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 283KB - Virtual size: 283KB

.data
Size: 24KB - Virtual size: 52KB

.rsrc
Size: 90KB - Virtual size: 89KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

21:b6:92:13:c0:02:43:06:e2:b9:74:93:e4:5a:51:fb
Certificate

e1:a2:b7:fb:ab:5e:24:89:07:5d:dc:a0:78:fc:59:bb:6e:25:d0:b7
Signer

.text
Size: 8.1MB - Virtual size: 8.1MB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.data
Size: 198KB - Virtual size: 236KB

.rsrc
Size: 2.5MB - Virtual size: 2.5MB

.reloc
Size: 766KB - Virtual size: 765KB