3a625b403453efd630bec54b1c0938e7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3a625b403453efd630bec54b1c0938e7_JaffaCakes118
Size

593KB
MD5

3a625b403453efd630bec54b1c0938e7
SHA1

f287035aaecfdafe72f310178d5f2e26e73a37d2
SHA256

59eb89f1ba93209eddbb1c102cc273cce5efe6cd58b0adf43c4fd23ac556b933
SHA512

5ad2f2be94c7b8e33d60aee10b7a325d38d78fed2c7a54a9f6cdad0c77684102ab968da1f839bf0cea5c3730724d36022f1653c23facd211ee4fa4e08866687f
SSDEEP

12288:iUw01kNk1U6yQUe/B1LExlXmbKpjU3fYJy6qouBLmY8c2IqH:iUw5kq6yu6VjpjUPn4d3

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/bdtmp/InstDll.dll
unpack001/baidubar.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

3a625b403453efd630bec54b1c0938e7_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
CreateWindowExA
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetDlgItem
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
SetClipboardData
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 272KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PROGRAM_FILES/Baidu/bar/Buttons/custom.xml
.xml
$TEMP/bdtmp/InstDll.dll
.dll windows:4 windows x86 arch:x86

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
CloseHandle
DeviceIoControl
GetWindowsDirectoryA
CreateFileA

msvcrt

_snprintf
__CxxFrameHandler
free
_initterm
malloc
_adjust_fdiv
__dllonexit
_onexit

shlwapi

SHDeleteKeyA
SHDeleteValueA
SHSetValueA

Exports

Exports

DelKey
DelValue
SetRegValue

Sections

.rdata
Size: 1024B - Virtual size: 785B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BaiduBar.dat
baidubar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

55028093f8bd5816ead60fd512d82d8b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetFileAttributesA
GlobalFree
GlobalAlloc
GetACP
GetCurrentProcessId
lstrcmpA
LockResource
CompareStringA
GetFileAttributesA
SetFilePointer
WritePrivateProfileSectionA
GetPrivateProfileSectionA
SetErrorMode
GetEnvironmentVariableA
ReadProcessMemory
VirtualProtect
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
LocalFree
FormatMessageA
GetVolumeInformationA
TerminateThread
DeviceIoControl
CopyFileA
IsBadStringPtrW
FreeResource
TerminateProcess
GetExitCodeProcess
HeapFree
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetFileTime
SwitchToThread
SetEvent
ResumeThread
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetLocalTime
VirtualQuery
GetExitCodeThread
MoveFileExA
RemoveDirectoryA
CreateDirectoryA
WritePrivateProfileStringA
GetVersionExA
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
GetTickCount
CreateFileA
CreateProcessA
WaitForSingleObject
CreateMutexA
GetTempFileNameA
ReleaseMutex
GlobalLock
GlobalUnlock
lstrcatA
lstrcpyA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
IsDBCSLeadByte
lstrcpynA
lstrcmpiA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
GetShortPathNameA
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
Sleep
lstrlenW
GetCurrentProcess
WriteProcessMemory
IsBadStringPtrA
CreateThread
WideCharToMultiByte
GetFileSize
GetProcessHeap
HeapAlloc
ReadFile
CloseHandle
MultiByteToWideChar
WriteFile
LoadLibraryA
InterlockedDecrement
GetModuleFileNameW
LoadLibraryW
OutputDebugStringA
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetLastError
SetLastError
GetPrivateProfileIntA
GetPrivateProfileStringA
InterlockedIncrement
lstrlenA
OpenMutexA

user32

AdjustWindowRectEx
LoadBitmapA
SetTimer
GetGUIThreadInfo
GetWindowThreadProcessId
IsRectEmpty
EndDialog
SetWindowTextA
IsWindow
ClientToScreen
InsertMenuA
GetDlgItem
CheckMenuItem
RedrawWindow
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetAsyncKeyState
GetSubMenu
GetClassNameA
EnumChildWindows
IsChild
UnhookWindowsHookEx
DefWindowProcA
DestroyWindow
GetFocus
SetFocus
PostMessageA
SetWindowsHookExA
wsprintfA
LoadCursorA
RegisterClassExA
GetClassInfoExA
CallWindowProcA
CreateWindowExA
GetActiveWindow
DialogBoxParamA
BeginPaint
SetWindowLongA
GetWindowLongA
SendMessageA
EndPaint
CharNextA
LoadStringA
DestroyIcon
CharLowerA
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoA
GetWindowRect
GetWindow
DeleteMenu
GetParent
IsWindowVisible
IsMenu
GetMenuItemID
EnableMenuItem
ShowWindow
LoadImageA
AdjustWindowRect
SetRect
UpdateWindow
LoadMenuA
DestroyMenu
GetKeyState
MessageBoxA
CreatePopupMenu
AppendMenuA
GetMenuItemCount
EnableWindow
SetCursor
GetWindowTextA
GetWindowTextLengthA
SetRectEmpty
ScreenToClient
GetCursorPos
ReleaseCapture
GetCapture
SetCapture
PtInRect
InvalidateRect
FillRect
OffsetRect
DrawTextA
GetDC
DrawFocusRect
ReleaseDC
DispatchMessageA
TranslateMessage
KillTimer
GetDesktopWindow
GetScrollInfo
SetScrollInfo
ScrollWindow
CharLowerBuffA
CallWindowProcW
IsWindowUnicode
SetWindowLongW
CharNextW
GetMenuItemRect
GetMessageA
PostThreadMessageA
CreateIconFromResourceEx
GetPropA
SetPropA
RemovePropA
FindWindowExA
InflateRect
CreateDialogParamA
SetDlgItemTextA
GetDlgItemTextA
EnumWindows
IsDialogMessageA
CharUpperA
InsertMenuItemA
GetMenuState
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CopyImage
PeekMessageA
CallNextHookEx
DrawStateA
GetSystemMetrics
RegisterWindowMessageA
TrackPopupMenuEx
GetMessagePos
GetSysColorBrush
FrameRect
GetMenuItemInfoA
SetMenuItemInfoA
IsWindowEnabled
MessageBeep
GetTopWindow
MenuItemFromPoint
GetClassInfoA
GetWindowPlacement
GetDlgCtrlID
GetWindowDC
GetMenuStringA
ModifyMenuA
WindowFromPoint
FindWindowA
LoadIconA
CopyRect
DrawIconEx
GetSysColor
MoveWindow

gdi32

ExcludeClipRect
GetClipBox
SetViewportOrgEx
GetDeviceCaps
DPtoLP
SaveDC
RestoreDC
CreateBitmap
GetTextColor
GetCurrentObject
ExtTextOutA
Rectangle
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
CreateSolidBrush
GetPixel
TextOutA
CreateFontA
DeleteDC
SetTextColor
GetObjectA
CreateFontIndirectA
SetBkMode
SetBkColor
GetStockObject
CreatePen
SelectObject
MoveToEx
LineTo
GetTextExtentPoint32A
DeleteObject

advapi32

RegDeleteKeyA
GetUserNameA
RegSetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
GetLengthSid
CopySid
EnumDependentServicesA
ControlService
OpenSCManagerA
OpenServiceA
StartServiceA
QueryServiceStatus
ChangeServiceConfigA
CloseServiceHandle
RegCreateKeyA
RegEnumKeyA
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA

shell32

DragQueryFileA
SHGetFileInfoA
SHGetFileInfoW
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
ExtractIconA
ShellExecuteA
SHGetSpecialFolderPathA
SHGetDesktopFolder
SHBrowseForFolderA

ole32

ReleaseStgMedium
GetHGlobalFromStream
CoInitialize
OleInitialize
RevokeDragDrop
CoGetClassObject
CreateStreamOnHGlobal
OleUninitialize
RegisterDragDrop
CoCreateGuid
StringFromGUID2
OleRun
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
SysStringByteLen
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
OleLoadPicture
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
VariantChangeType
VariantInit
VariantCopy
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString

shlwapi

PathIsDirectoryA
PathRemoveFileSpecA
UrlCanonicalizeA
SHDeleteKeyA
PathFileExistsA
PathFindFileNameA
PathRemoveExtensionA
SHSetValueA
SHDeleteValueA
UrlUnescapeA
UrlEscapeA
StrRetToStrW
StrRetToStrA
StrStrIA
SHCopyKeyA
SHGetValueA

oleacc

AccessibleObjectFromPoint

rpcrt4

UuidCreate

imm32

ImmGetDefaultIMEWnd

urlmon

CoInternetGetSession
URLDownloadToFileA

msimg32

TransparentBlt
AlphaBlend

msvcrt

_strcmpi
_stricmp
_wcsnicmp
_wcsupr
_adjust_fdiv
_initterm
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_endthreadex
strncmp
_memicmp
strtol
_beginthread
_endthread
_local_unwind2
_mbspbrk
tolower
strncat
bsearch
qsort
_fullpath
printf
_vsnprintf
_CxxThrowException
_strnicmp
toupper
strstr
isxdigit
isalnum
_wstat
fputs
fseek
ftell
_mbsnbcmp
__RTDynamicCast
strtod
atol
abs
fwrite
fread
_ftol
_mbsnbcpy
_mbsicoll
sscanf
fopen
fprintf
fclose
_beginthreadex
calloc
localtime
atof
_snwprintf
wcsncpy
wcsstr
wcschr
_wcsicmp
iswdigit
swscanf
iswalpha
_mbstok
_mbsrchr
strcat
malloc
memmove
strcmp
wcscmp
memset
strncpy
strrchr
_stat
_snprintf
srand
rand
memcmp
strcpy
strchr
_mbschr
_ismbcspace
_mbsnbicmp
_except_handler3
free
realloc
_mbsicmp
_mbscmp
_purecall
time
atoi
_ismbcdigit
wcslen
sprintf
strlen
vsprintf
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
_mbsstr

wininet

InternetSetStatusCallback
FtpOpenFileA
InternetAttemptConnect
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
DeleteUrlCacheEntry
InternetCrackUrlA
InternetCanonicalizeUrlA
InternetConnectA
InternetConnectW
HttpOpenRequestA
HttpOpenRequestW
HttpSendRequestA
HttpQueryInfoA
HttpSendRequestW
HttpQueryInfoW
InternetCloseHandle
InternetSetStatusCallbackA
InternetSetStatusCallbackW
InternetReadFile
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
GetUrlCacheEntryInfoA
InternetQueryDataAvailable
InternetSetFilePointer
InternetSetCookieA
InternetGetCookieA
HttpAddRequestHeadersA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
InternetQueryOptionA
InternetGetConnectedState
FindNextUrlCacheEntryA
FindFirstUrlCacheEntryA
FindCloseUrlCache

setupapi

SetupIterateCabinetA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

iphlpapi

GetAdaptersInfo
GetNetworkParams

ws2_32

gethostname
gethostbyname

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
Install
Uninstall

Sections

.text
Size: 952KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 252KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
img/imglist.bmp
img/logo.bmp

Sharing

General

Malware Config

Signatures

Files

1bed3305885b0ca596d9cbba22baf78a

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 262KB

.ndata Size: - Virtual size: 272KB

.rsrc Size: 24KB - Virtual size: 28KB

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 494B

e44f82ce77eec687f2bd1fd452dd3940

Headers

File Characteristics

Imports

kernel32

msvcrt

shlwapi

Exports

Exports

Sections

.rdata Size: 1024B - Virtual size: 785B

.data Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 164B

55028093f8bd5816ead60fd512d82d8b

Headers

File Characteristics

Imports

kernel32

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 262KB

.ndata
Size: - Virtual size: 272KB

.rsrc
Size: 24KB - Virtual size: 28KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 494B

.rdata
Size: 1024B - Virtual size: 785B

.data
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 164B

.text
Size: 952KB - Virtual size: 950KB

.rdata
Size: 168KB - Virtual size: 167KB

.data
Size: 76KB - Virtual size: 100KB

.idata
Size: 20KB - Virtual size: 17KB

.Shared
Size: 4KB - Virtual size: 260B

.rsrc
Size: 252KB - Virtual size: 249KB

.reloc
Size: 72KB - Virtual size: 68KB