3623e17b8907aaaac2917ee2e528bc42_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3623e17b8907aaaac2917ee2e528bc42_JaffaCakes118
Size

1.6MB
MD5

3623e17b8907aaaac2917ee2e528bc42
SHA1

571b0f68f2d6d6dbbcfde8f4b2de56fa92cef584
SHA256

ca702bcfe328a2c3a567385e73c1fbe73b63acaf92008d27a680d082214f156c
SHA512

72a9ae76198bd02285ceedff9eca478d7931b0a78509ef3c26d805e6a74e2def2f7813a7e8860df4efecb9aaea862eac3065d025bb025f5d597e2d5403e9298e
SSDEEP

49152:Mtv42qFzdFFHoUMrntiJixYjYYV4Q6S8s8H4:Mh42qLFFoUeti+Rss4

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/IntegrityLevel.dll	acprotect
static1/unpack001/npsoe.dll	acprotect
static1/unpack001/npsoeact.dll	acprotect

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/IntegrityLevel.dll	upx
static1/unpack001/Launcher.exe	upx
static1/unpack001/npsoe.dll	upx
static1/unpack001/npsoeact.dll	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
3623e17b8907aaaac2917ee2e528bc42_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/IntegrityLevel.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/newadvsplash.dll
unpack001/$PLUGINSDIR/nsisos.dll
unpack001/Launcher.dll
unpack001/Launcher.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

3623e17b8907aaaac2917ee2e528bc42_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/IntegrityLevel.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SetLow
SetMedium

Sections

UPX0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 36KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/newadvsplash.dll
.dll windows:4 windows x86 arch:x86

eee37c14e102da3f62385f9796c701ce

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetProcAddress
GetModuleHandleA
CloseHandle
CreateThread
lstrcpynA
lstrlenA
GetCurrentThreadId
Sleep
lstrcpyA
lstrcmpiA
lstrcatA
GlobalAlloc
GlobalFree
WaitForSingleObject

user32

DefWindowProcA
DestroyWindow
IsWindowVisible
UnregisterClassA
EnumDisplaySettingsA
wsprintfA
SetWindowPos
LoadCursorA
BeginPaint
CreateWindowExA
GetMessageA
TranslateMessage
DispatchMessageA
IsWindow
GetClientRect
SetWindowLongA
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
RegisterClassA
SystemParametersInfoA
SendMessageA
ShowWindow
PostMessageA
SetWindowRgn
EndPaint

gdi32

CombineRgn
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
CreateRectRgn
DeleteObject

msvfw32

MCIWndCreateA

winmm

timeSetEvent
PlaySoundA
timeKillEvent

oleaut32

OleLoadPicturePath

msvcrt

_lseek
memset
memcmp
_read
memcpy
_close
_open
strtol

Exports

Exports

hwnd
play
show
stop

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 634B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisos.dll
.dll windows:1 windows x86 arch:x86

a70233c77fd258ec47709388c2338273

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetEnvironmentStringsA
GetVersionExA
RtlUnwind
RtlZeroMemory
lstrcpyA

crtdll

_fdopen
_open_osfhandle
_ultoa
fclose
_cexit
malloc
printf
raise
setbuf
strcpy

Exports

Exports

osplatform
osversion

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 588B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 156B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE

.edata
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
$TEMP/EQII_Splash.JPG
.jpg
EQII.ico
Launcher.dll
.dll windows:4 windows x86 arch:x86

57ff62c4fbe00caeb1142f657869b05a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\PERFORCE\dkinney\Desktop\Win\Output\bin\Release\Launcher.dll.pdb

Imports

kernel32

LoadLibraryExA
lstrcmpiA
lstrcmpA
WriteFile
CompareStringW
CompareStringA
Sleep
InterlockedCompareExchange
VirtualAlloc
VirtualQuery
GetSystemInfo
HeapAlloc
HeapFree
GetProcessHeap
WriteProcessMemory
OpenProcess
VirtualFree
HeapDestroy
ResumeThread
SuspendThread
DuplicateHandle
GetCurrentThread
FindResourceW
LocalFree
HeapCreate
CreateMutexW
CreateFileW
ReadProcessMemory
VirtualProtect
CreateEventW
SystemTimeToFileTime
GetSystemTime
ReadFile
VirtualProtectEx
VirtualAllocEx
GetSystemDirectoryW
GetFullPathNameW
lstrcpyW
GetTickCount
CreateThread
FindResourceExW
SetFilePointer
TlsSetValue
VirtualFreeEx
GetLocaleInfoW
TerminateProcess
lstrcatW
TlsGetValue
CreateRemoteThread
LoadLibraryExW
TlsFree
DeleteFileW
EnumResourceNamesW
CreatePipe
TlsAlloc
FlushFileBuffers
lstrcpynW
GetLogicalDriveStringsW
SetErrorMode
CreateDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetStartupInfoA
DisableThreadLibraryCalls
lstrlenW
GetConsoleMode
GetConsoleCP
IsValidCodePage
GetCurrentThreadId
GetCPInfo
GetStdHandle
RtlUnwind
GetFullPathNameA
GetDateFormatA
GetTimeFormatA
FindNextFileW
FindFirstFileW
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentDirectoryA
IsDebuggerPresent
UnhandledExceptionFilter
GetThreadLocale
GetLocaleInfoA
GetACP
HeapSize
HeapReAlloc
CompareFileTime
FindClose
FindFirstFileA
DeleteFileA
FindNextFileA
IsBadReadPtr
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetComputerNameExA
Process32Next
OpenThread
Thread32First
GetEnvironmentStrings
GetCurrentProcessId
CreateFileA
GetThreadContext
Module32First
GetCommandLineA
CreateDirectoryA
Module32Next
ExitProcess
CreateToolhelp32Snapshot
Process32First
GetThreadPriority
FreeEnvironmentStringsA
GetFileAttributesExA
Thread32Next
GetSystemTimeAsFileTime
GetFileAttributesA
CopyFileW
CopyFileA
GetFileType
InitializeCriticalSection
SetStdHandle
GetTimeZoneInformation
InterlockedDecrement
InterlockedIncrement
MulDiv
IsDBCSLeadByte
InterlockedExchange
GetPrivateProfileStringA
lstrcpyA
lstrcmpiW
FlushInstructionCache
lstrlenA
GetCurrentProcess
LoadLibraryW
MoveFileA
GetLastError
GetModuleHandleW
SetHandleCount
GetModuleHandleA
GetModuleFileNameA
GetFileAttributesW
GetVersion
GetProcAddress
GetVersionExA
FindResourceExA
RaiseException
GetModuleFileNameW
SetLastError
CloseHandle
CreateMutexA
WaitForSingleObject
LeaveCriticalSection
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
SetEndOfFile
ReleaseMutex
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
DeleteCriticalSection
EnterCriticalSection
FreeLibrary
LoadLibraryA
LoadResource
LockResource
GlobalUnlock
SizeofResource
GlobalFree
GlobalAlloc
FindResourceA
GlobalLock
WideCharToMultiByte
MultiByteToWideChar
GetOEMCP
QueryPerformanceCounter

user32

CopyRect
EndDialog
UnregisterClassA
GetUpdateRect
CallWindowProcA
GetDlgItemTextA
GetDlgCtrlID
DialogBoxIndirectParamA
EnableWindow
IsRectEmpty
BeginPaint
SetRect
EndPaint
OffsetRect
wsprintfA
PtInRect
PostMessageA
SetWindowLongA
GetClientRect
GetParent
GetWindowLongA
DefWindowProcA
DestroyWindow
GetDC
RedrawWindow
MessageBoxA
LoadStringA
MessageBeep
MapWindowPoints
RegisterClassExA
GetActiveWindow
IsWindow
CreateDialogParamA
PeekMessageA
PostQuitMessage
GetClassInfoExA
CreatePopupMenu
ShowWindow
DestroyMenu
TrackPopupMenuEx
LoadStringW
AppendMenuA
GetMenuItemCount
LoadCursorA
RemoveMenu
SetMenuItemInfoA
GetMenuItemInfoA
SetMenuDefaultItem
MonitorFromPoint
GetMonitorInfoA
SetFocus
CreateWindowExA
SendMessageA
InvalidateRect
GetWindowRect
SetWindowPos
TranslateAcceleratorA
SetWindowTextA
UpdateLayeredWindow
SetTimer
KillTimer
SetCapture
ReleaseCapture
GetClassNameA
DestroyAcceleratorTable
LoadImageA
CreateAcceleratorTableA
InvalidateRgn
RegisterWindowMessageA
CharNextA
GetWindowTextLengthA
IsChild
GetFocus
LoadAcceleratorsA
GetWindow
GetMessageA
LoadMenuA
GetDesktopWindow
TranslateMessage
DispatchMessageA
ClientToScreen
GetWindowTextA
ScreenToClient
SystemParametersInfoA
FillRect
MoveWindow
GetDlgItem
GetSysColor
ReleaseDC

gdi32

CreateSolidBrush
GetDeviceCaps
GetObjectA
GetDIBColorTable
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject
BitBlt
ExtTextOutA
SetBkColor
SelectObject
DeleteDC
GetStockObject

advapi32

RegQueryValueExA
EqualSid
GetSidIdentifierAuthority
AllocateAndInitializeSid
RegQueryValueExW
GetSidSubAuthority
GetSidSubAuthorityCount
RegDeleteKeyW
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
LookupAccountSidA

shell32

SHGetFolderPathA
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
ExtractIconExA
SHGetFolderPathW

ole32

CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
CLSIDFromString
CLSIDFromProgID
StringFromGUID2
CoGetClassObject
OleUninitialize
CoTaskMemAlloc
OleLockRunning
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
VarUI4FromStr
SysStringByteLen
VariantChangeType
VariantClear
DispCallFunc
SysAllocStringLen
VariantCopyInd
SysFreeString
VariantInit

shlwapi

PathAppendA
PathStripPathA
PathRemoveFileSpecA
PathFileExistsA

gdiplus

GdipCloneBrush
GdipGetImageWidth
GdipGetImagePaletteSize
GdiplusShutdown
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipSetClipRectI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdiplusStartup
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipDrawString
GdipCreateSolidFill
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipFree
GdipGetGenericFontFamilySansSerif
GdipCloneImage
GdipCreateFont
GdipAlloc
GdipDisposeImage
GdipDeleteGraphics
GdipDeleteBrush
GdipCreateFromHDC
GdipDrawImageI
GdipSetStringFormatLineAlign
GdipGetImageHeight
GdipCreateBitmapFromStream

msimg32

TransparentBlt
AlphaBlend

urlmon

CoInternetSetFeatureEnabled

ws2_32

WSACleanup
WSARecv
WSAStartup
WSASendTo
WSARecvFrom
WSAConnect
getsockname
gethostname
WSAGetLastError
connect
htons
inet_addr
WSASend
htonl
select
closesocket
send
setsockopt
shutdown
accept
recv
listen
getsockopt
bind
ntohs
ioctlsocket
WSASocketA
inet_ntoa
WSAIoctl
gethostbyname
__WSAFDIsSet
WSASetLastError

iphlpapi

GetAdaptersInfo

psapi

EnumProcessModules
GetModuleFileNameExA
GetModuleBaseNameA
GetProcessMemoryInfo

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

dbghelp

SymInitialize
SymEnumerateModules64
MiniDumpWriteDump
SymSetOptions
SymCleanup
StackWalk64
SymFunctionTableAccess64
SymGetModuleBase64
SymEnumSymbols
SymGetLineFromAddr64

Exports

Exports

SL_Launch
SL_SetRecapSessionGID
SL_Version

Sections

.text
Size: 493KB - Virtual size: 492KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 241KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Launcher.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 232KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 137KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Launcher.ini
Launcher.png
.png
npsoe.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:a0:48:aa:c5:f1:e7:f7:d0:c8:30:b1:15:cc:ef:bc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/03/2009, 00:00

Not After

17/03/2011, 23:59

Subject

CN=Sony Online Entertainment,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Sony Online Entertainment LLC,O=Sony Online Entertainment,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

63:8b:77:1f:1f:de:85:fd:fb:5f:59:6c:fa:9b:23:f2:41:eb:d5:48
Signer

Actual PE Digest

63:8b:77:1f:1f:de:85:fd:fb:5f:59:6c:fa:9b:23:f2:41:eb:d5:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown
SetupPlugin

Sections

UPX0
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 98KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npsoeact.dll
.dll windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:a0:48:aa:c5:f1:e7:f7:d0:c8:30:b1:15:cc:ef:bc
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

17/03/2009, 00:00

Not After

17/03/2011, 23:59

Subject

CN=Sony Online Entertainment,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Sony Online Entertainment LLC,O=Sony Online Entertainment,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cc:97:d3:84:d0:19:32:3a:66:e4:be:e7:75:5c:f1:f7:3a:17:88:b1
Signer

Actual PE Digest

cc:97:d3:84:d0:19:32:3a:66:e4:be:e7:75:5c:f1:f7:3a:17:88:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

PLG_AddParam
PLG_CheckUpdateNeeded
PLG_CreatePlugin
PLG_Delete
PLG_DestroyStream
PLG_DirectInstaller
PLG_GetFolder
PLG_GetLoadState
PLG_GetParamNames
PLG_GetProductName
PLG_GetStream
PLG_GetURL
PLG_HasError
PLG_InitLoadState
PLG_Install
PLG_InstalledSize
PLG_NewStream
PLG_NewWindow
PLG_ProcessParams
PLG_SetRecapSessionGID
PLG_SpeedLauncher
PLG_Uninstall
PLG_Update
PLG_Version
PLG_Write
PLG_set_error

Sections

UPX0
Size: - Virtual size: 324KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 187KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uninst.exe.nsis

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 56KB

.rsrc Size: 86KB - Virtual size: 86KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 64KB

UPX1 Size: 36KB - Virtual size: 40KB

.rsrc Size: 1024B - Virtual size: 4KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 741B

.rdata Size: 1024B - Virtual size: 673B

.data Size: 512B - Virtual size: 88B

.reloc Size: 512B - Virtual size: 190B

eee37c14e102da3f62385f9796c701ce

Headers

File Characteristics

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 56KB

.rsrc
Size: 86KB - Virtual size: 86KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

UPX0
Size: - Virtual size: 64KB

UPX1
Size: 36KB - Virtual size: 40KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1024B - Virtual size: 741B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 88B

.reloc
Size: 512B - Virtual size: 190B

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 289B

.reloc
Size: 1024B - Virtual size: 634B

.text
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 16B

.data
Size: 80B - Virtual size: 80B

.idata
Size: 588B - Virtual size: 588B

.reloc
Size: 156B - Virtual size: 156B

.edata
Size: 96B - Virtual size: 96B

.text
Size: 493KB - Virtual size: 492KB

.rdata
Size: 129KB - Virtual size: 128KB

.data
Size: 241KB - Virtual size: 249KB

.rsrc
Size: 55KB - Virtual size: 55KB

.reloc
Size: 40KB - Virtual size: 40KB

UPX0
Size: - Virtual size: 232KB

UPX1
Size: 137KB - Virtual size: 140KB

.rsrc
Size: 12KB - Virtual size: 12KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate