5c3e824e546e1c8aaf245bdf15ce1527_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5c3e824e546e1c8aaf245bdf15ce1527_JaffaCakes118
Size

1.4MB
MD5

5c3e824e546e1c8aaf245bdf15ce1527
SHA1

7a20781b11c26129fe3e7f7ff865546ca3431d0c
SHA256

14206f76855fd5c7e649a70e08e86042bf2bc6658428a549213527ddfcf038c3
SHA512

21d605b51a545dc245c7639800778daf66b3cd0c145dd9028236b7c351dba483bab5f62dc3b79ccbcfe7c1c05e24ffbd75f7f1a0f5d97bfb1b2115955db22d82
SSDEEP

24576:Ie2+E0pJL/j2QLuOPVMxGdHHFwtF18DLsnxzbY1agiSYiwYc4ooFNd:z7pRj2ROtPdn8wDLsnxzbYUusYP

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aegis/Aegis/AUDIOW32.DLL
unpack001/aegis/Aegis/Aegis19.exe
unpack001/aegis/Aegis/Dwspy32.dll
unpack001/aegis/Aegis/MP3PLAY.OCX
unpack001/aegis/Aegis/MSWINSCK.OCX
unpack001/aegis/Aegis/dwsbc32d.ocx
unpack001/aegis/Aegis/regdrop.exe

Files

5c3e824e546e1c8aaf245bdf15ce1527_JaffaCakes118
.zip
aegis/Aegis/AUDIOW32.DLL
.dll windows:4 windows x86 arch:x86

d6057ec88a7894e5b57ca4dcf4f22f4f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetTickCount
CloseHandle
WaitForSingleObject
SetThreadPriority
CreateThread
GlobalLock
GlobalAlloc
GlobalFree
GlobalUnlock
HeapFree
HeapAlloc
HeapReAlloc
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
HeapDestroy
HeapCreate
VirtualFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
VirtualAlloc
GetLastError
SetFilePointer
ReadFile
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
Sleep
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
CreateFileA
SetStdHandle
FlushFileBuffers
LoadLibraryA
SetEndOfFile
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetLocaleInfoA
GetLocaleInfoW
LCMapStringA
LCMapStringW

winmm

waveOutUnprepareHeader
waveOutGetNumDevs
waveOutWrite
waveOutPrepareHeader
waveOutGetDevCapsA
waveOutClose
waveOutOpen
waveOutReset

user32

GetForegroundWindow
MessageBoxA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

Exports

Exports

ACloseAudio
ACloseVoices
ACreateAudioData
ACreateAudioVoice
ADestroyAudioData
ADestroyAudioVoice
AFreeModuleFile
AFreeWaveFile
AGetAudioDataAvail
AGetAudioDevCaps
AGetAudioNumDevs
AGetErrorText
AGetModulePosition
AGetModuleStatus
AGetModuleVolume
AGetVersion
AGetVoiceFrequency
AGetVoicePanning
AGetVoicePosition
AGetVoiceStatus
AGetVoiceVolume
AInitialize
ALoadModuleFile
ALoadWaveFile
AOpenAudio
AOpenVoices
APauseModule
APingAudio
APlayModule
APlayVoice
APrimeVoice
AResumeModule
ASetAudioCallback
ASetAudioTimerProc
ASetAudioTimerRate
ASetModuleCallback
ASetModulePosition
ASetModuleVolume
ASetVoiceFrequency
ASetVoicePanning
ASetVoicePosition
ASetVoiceVolume
AStartVoice
AStopModule
AStopVoice
AUpdateAudio
AWriteAudioData

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/Aegis19.exe
.exe windows:4 windows x86 arch:x86

4c05edd4161232ecccaba6b637db908b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm50

__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaVarVargNofree
__vbaFreeVar
__vbaLateIdCall
ord588
__vbaLenBstr
__vbaStrVarMove
__vbaEnd
__vbaFreeVarList
_adj_fdiv_m64
__vbaPut4
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaStrCat
__vbaVarCmpNe
__vbaError
ord553
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarXor
__vbaLateMemSt
ord592
__vbaStrBool
__vbaBoolStr
__vbaExitProc
__vbaVarForInit
ord593
__vbaFileCloseAll
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
ord597
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord599
__vbaFpR4
ord520
__vbaFpR8
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
ord631
__vbaVargVarMove
ord632
ord525
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaGet4
__vbaVarTstEq
__vbaObjVar
__vbaVarLikeVar
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaCastObjVar
__vbaAryConstruct
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
ord600
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaPrintFile
__vbaInputFile
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
__vbaVarDiv
ord608
ord531
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
ord535
ord536
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord570
__vbaR8Str
__vbaInStr
__vbaNew2
ord571
__vbaVarInt
_adj_fdiv_m32i
ord572
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaVarCmpLt
__vbaVarNot
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
__vbaVarCmpEq
ord610
__vbaLateMemCall
__vbaVarAdd
ord612
__vbaStrToAnsi
__vbaVarDup
ord613
__vbaFpI2
__vbaVarTstGe
ord616
__vbaFpI4
__vbaVarCopy
__vbaLateMemCallLd
ord617
_CIatan
__vbaCastObj
ord618
__vbaStrMove
__vbaStrVarCopy
__vbaMidStmtVar
ord619
ord542
ord543
ord650
_allmul
ord544
__vbaLateIdSt
ord545
_CItan
ord546
ord547
__vbaFPInt
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/CLACK.WAV
aegis/Aegis/Dwspy32.dll
.dll regsvr32 windows:4 windows x86 arch:x86

9cb8b018e2938a84cb1cc64895f59c1a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc40

ord4173
ord2511
ord729
ord2704
ord2081
ord2115
ord1647
ord3956
ord265
ord5637
ord2894
ord5638
ord3952
ord2860
ord2916
ord4096
ord3906
ord5748
ord651
ord3202
ord1073
ord1035
ord1084
ord4046
ord4141
ord4302
ord4462
ord4176
ord5644
ord4700
ord3919
ord2861
ord4099
ord654
ord406
ord1986
ord1633
ord403
ord2176
ord2358
ord3738
ord1071
ord2135
ord1464
ord4973
ord881
ord3827
ord4154
ord4113
ord5023
ord1873
ord4314
ord4375
ord5001
ord3611
ord4133
ord4132
ord4230
ord4124
ord4360
ord4024
ord3997
ord4070
ord4441
ord4380
ord4385
ord4390
ord4122
ord4156
ord4473
ord4127
ord4117
ord3838
ord4241
ord4123
ord4111
ord4110
ord1043
ord4060
ord3854
ord3844
ord3840
ord4202
ord2707
ord1426
ord3892
ord4079
ord4459
ord3898
ord4444
ord4432
ord2177
ord2963
ord4015
ord5363
ord1540
ord5643
ord4704
ord2618
ord2755
ord2844
ord3946
ord2851
ord2621
ord2695
ord3581
ord4098
ord5160
ord632
ord3452
ord381
ord2223
ord2378
ord4403
ord5341
ord5352
ord1387
ord1115
ord1116
ord5003
ord2739
ord3176
ord3148
ord2735
ord1089
ord1097
ord2595
ord2747
ord2394
ord5648
ord731
ord2234
ord2197
ord5070
ord3431
ord965
ord4627
ord2097
ord2909
ord4713
ord4715
ord2389
ord3579
ord4165
ord4719
ord4703
ord5053
ord3458
ord2960
ord3192
ord721
ord504
ord5630
ord1075
ord1085
ord5647
ord4608
ord2086
ord4657
ord3890
ord1539
ord3578
ord5360
ord2199
ord4450
ord4312
ord3859
ord4681
ord5506
ord5653
ord5490
ord3158
ord3153
ord3185
ord1814
ord3724
ord2072
ord315
ord486
ord762
ord706
ord570
ord3134
ord3907
ord4101
ord3580
ord2694
ord3340
ord3346
ord3345
ord2696
ord2620
ord2845
ord2744
ord3945
ord2843
ord2754
ord2617
ord4691
ord1850
ord2140
ord4677
ord1494
ord4510
ord3268
ord5649
ord1785
ord2323
ord3922
ord4296
ord3314
ord4694
ord3837
ord4204
ord4201
ord4505
ord3963
ord999
ord1000
ord711
ord671
ord1105
ord1369
ord1042
ord328
ord1046
ord1367
ord1370
ord269
ord5681
ord733
ord988

msvcrt40

_strupr
strcspn
strstr
_fcvt
_EH_prolog
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_initterm
wcstombs
__CxxFrameHandler
mbstowcs
mktime
time
_CxxThrowException
wcslen
memmove
_adjust_fdiv
_ftol
_adj_fdiv_m64
_adj_fdiv_m32i
atoi
strncpy
_itoa
malloc

kernel32

GlobalLock
OpenFile
GetTickCount
GetEnvironmentStrings
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
lstrcatA
WideCharToMultiByte
lstrcpyA
lstrcmpA
MultiByteToWideChar
GetCurrentThreadId
IsBadWritePtr
CreateEventA
CreateMutexA
GetModuleFileNameA
OpenProcess
GetCurrentProcess
DuplicateHandle
SetEvent
CloseHandle
WaitForSingleObject
ReleaseMutex
lstrlenA
GetCurrentProcessId
GetLastError
GetSystemDefaultLangID
GetModuleHandleA
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
GetProcAddress
FreeLibrary
GlobalAlloc
GlobalFree
LockResource
LoadResource
SizeofResource
FindResourceA
lstrcmpiA
IsDBCSLeadByte
GetVersion
LocalFree
LocalAlloc
Sleep
GlobalUnlock

user32

EnumChildWindows
GetDesktopWindow
IsWindowVisible
FindWindowA
SetRectEmpty
GetKeyState
GetClassNameA
IsWindowEnabled
LoadStringA
MessageBoxA
CharNextA
UpdateWindow
ScreenToClient
DestroyWindow
CreateWindowExA
SetWindowsHookExA
UnhookWindowsHookEx
RegisterWindowMessageA
CallNextHookEx
GetWindowWord
SetWindowWord
DefWindowProcA
FillRect
wsprintfA
CallWindowProcA
GetWindow
GetWindowRect
PtInRect
InvalidateRect
InflateRect
OffsetRect
MessageBeep
ClientToScreen
GetParent
GetPropA
CharPrevA
EnableWindow
GetWindowLongA
SetWindowLongA
DefDlgProcA
PostMessageA
KillTimer
GetClientRect
SetTimer
LoadBitmapA
GetWindowThreadProcessId
SendMessageTimeoutA
SendMessageA
IsWindow
EnumThreadWindows
EnumWindows

gdi32

GetStockObject
DeleteObject
CreateFontIndirectA
GetObjectA
SetTextColor
Ellipse
DeleteDC
GetDeviceCaps
CreateICA
SelectObject
LineTo
MoveToEx

oleaut32

LoadRegTypeLi
SysAllocStringByteLen
SysAllocStringLen
SysFreeString
VariantClear
SysStringByteLen
VariantChangeType
SysAllocString
VariantInit

Exports

Exports

ChangeMessageDetect
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetGraphicalControlForPoint
HookWindow
HookWindowsHook
SWinCBTGblHook
SWinCBTHook
SWinCallMouseGblHook
SWinCallMouseHook
SWinCallWndProcGblHook
SWinCallWndProcHook
SWinCallWndProcRetGblHook
SWinCallWndProcRetHook
SWinGetMsgGblHook
SWinGetMsgHook
SWinJournalPlaybackGblHook
SWinJournalPlaybackHook
SWinJournalRecordGblHook
SWinJournalRecordHook
SWinKeyboardGblHook
SWinKeyboardHook
SWinMsgFilterGblHook
SWinMsgFilterHook
SWinShellGblHook
SWinShellHook
SWinSysMsgGblHook
SWinSysMsgHook
SetHookMode
Spxrvv2
Spxrvv3
UnhookTheWindowsHook
UnhookWindow
dw2IntegersToDWORD
dw4BytesToDWORD
dwCopyData
dwCopyDataSpecial
dwDWORDto2Integers
dwDWORDto4Bytes
dwFreeUDT
dwGetAddressForObject
dwGetAddressForVBString
dwGetControlNameByID
dwGetInstance
dwGetPropertyValue
dwGetReturnHlstr
dwGetSpyWorksVersion
dwGetStringFrom2NullBuffer
dwGetStringFromLPSTR
dwGetWndInstance
dwHugeOffset
dwInp
dwInpd
dwInpw
dwIsValidName
dwMakeROP4
dwOutp
dwOutpd
dwOutpw
dwPOINTStoLong
dwPackUDT
dwPackedUDTSize
dwPrivGetMapping
dwPrivLockMapTest
dwPrivMemTest
dwRegisterUDT
dwSetPropertyValue
dwSubtractFileTimes
dwSwapBytes
dwSwapWords
dwUnpackUDT
dwXAllocateDataFrom
dwXCopyAnsiStringFrom
dwXCopyDataFrom
dwXCopyDataTo
dwXCopyUnicodeStringFrom
dwXFreeDataFrom
dwXGetControlIDForHwnd
dwXGetHwndControl
dwXGetModuleFileName
dwXGetSpyworksAppID
dwXGetSpyworksFormID
dwXGetVBNames
dwXReleaseSpyworksID
dwiGetControlHwndForName
dwiGetControlNameForHwnd
dwiGetControlNames
dwiGetControlUnknown
dwiGetGraphicalControlForPoint
dwiGetHwndHookList
dwiGetObjectPropertyHelper
dwiGetPrivateInfo
dwiGetProcessHwndList
dwiSetObjectPropertyHelper
dwiShiftGraphicalControl
dwiShiftGraphicalControl2
dwiShiftWindowControl
dwiTest1

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/FAQ 1-1.txt
aegis/Aegis/History.txt
aegis/Aegis/Lists/BuSt.dat
aegis/Aegis/Lists/CityTalk.lst
aegis/Aegis/Lists/Findem.dat
aegis/Aegis/Lists/PubRoom.lst
aegis/Aegis/Lists/WWW_a.dat
aegis/Aegis/Lists/WWW_b.dat
aegis/Aegis/Lists/XTra.dat
aegis/Aegis/Lists/[Blacknn White].pnt
aegis/Aegis/Lists/[Color].pnt
aegis/Aegis/Lists/[Test].pnt
aegis/Aegis/MP3PLAY.OCX
.dll regsvr32 windows:4 windows x86 arch:x86

4e775177760fdc49b633daffe32751cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

winmm

waveOutPrepareHeader
waveOutReset
waveOutClose
waveOutWrite
waveOutUnprepareHeader
mmioGetInfo
mmioAscend
mmioOpenA
mmioAdvance
mmioClose
mmioSetInfo
waveOutPause
waveOutRestart
waveOutGetVolume
waveOutSetVolume
mmioCreateChunk
waveOutOpen
mmioWrite

mfc40

ord3431
ord965
ord5070
ord2097
ord2197
ord4627
ord4713
ord4715
ord3579
ord2909
ord4719
ord4703
ord5053
ord4165
ord2754
ord2843
ord3945
ord2744
ord2845
ord2620
ord2617
ord2960
ord3345
ord3346
ord3340
ord2694
ord3580
ord4096
ord2696
ord3192
ord721
ord504
ord5630
ord1075
ord1035
ord1097
ord1085
ord4046
ord4141
ord4302
ord4462
ord4681
ord3906
ord4312
ord4450
ord4176
ord2199
ord5360
ord3578
ord1539
ord3890
ord4657
ord2086
ord4608
ord5644
ord3837
ord4700
ord3314
ord3859
ord3919
ord2323
ord1785
ord5649
ord3268
ord4510
ord1494
ord4677
ord2140
ord1850
ord4691
ord2861
ord4099
ord3907
ord654
ord406
ord1647
ord265
ord5748
ord5637
ord2894
ord5638
ord3952
ord2860
ord2916
ord3202
ord651
ord4296
ord1073
ord1084
ord1986
ord5352
ord1633
ord3738
ord2176
ord5648
ord2234
ord1071
ord2135
ord1464
ord4973
ord881
ord3827
ord4154
ord4113
ord5023
ord1873
ord4314
ord4375
ord5001
ord3611
ord4133
ord4132
ord4230
ord4124
ord4360
ord4024
ord3997
ord4070
ord3963
ord4380
ord4385
ord4390
ord4122
ord4156
ord4473
ord4127
ord4117
ord3838
ord4241
ord4123
ord4111
ord4110
ord4505
ord4060
ord3854
ord3844
ord3840
ord4202
ord4204
ord4201
ord3892
ord4079
ord4459
ord3898
ord4444
ord4432
ord2177
ord2963
ord4015
ord5363
ord1540
ord5643
ord4704
ord3922
ord2618
ord2755
ord2844
ord3946
ord2851
ord2621
ord2695
ord3581
ord4098
ord5160
ord632
ord706
ord2293
ord3452
ord486
ord381
ord3110
ord3158
ord3185
ord569
ord2511
ord5121
ord1425
ord1426
ord1014
ord314
ord2115
ord2223
ord2378
ord4403
ord570
ord315
ord5550
ord483
ord2451
ord2450
ord5341
ord762
ord729
ord3458
ord2389
ord2358
ord731
ord1043
ord403
ord4441
ord1105
ord1369
ord1042
ord328
ord999
ord1046
ord1367
ord5681
ord988
ord1370
ord269
ord733
ord671
ord711
ord1000

msvcrt40

_ftol
strncpy
_CIpow
__CxxFrameHandler
_endthreadex
atol
??1type_info@@UAE@XZ
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_EH_prolog
_beginthreadex
perror
exit
_adj_fdivr_m32
_adj_fdivr_m64
_purecall
_write

kernel32

lstrcpyA
GlobalAlloc
GlobalFree
GetVersion
LocalAlloc
LocalFree
ResumeThread
CreateMutexA
SetThreadPriority
TerminateThread
Sleep
ExitThread
WaitForSingleObject
ReleaseMutex
lstrcpynA
CreateFileA
lstrcmpiA
SetFilePointer
ReadFile
CloseHandle
lstrlenA
GetFileSize

user32

LoadBitmapA
FillRect
EnableWindow
PostMessageA

gdi32

CreateCompatibleDC
GetStockObject
BitBlt

oleaut32

LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/MSWINSCK.OCX
.dll regsvr32 windows:4 windows x86 arch:x86

2e8f1e2d5b71a4e31f9f995ba561d41f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

wsock32

accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send

kernel32

lstrcpyA
GetModuleFileNameA
InitializeCriticalSection
FormatMessageA
GetTickCount
lstrcmpA
GlobalFree
GlobalHandle
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpynA
HeapAlloc
GetProcessHeap
HeapFree
FindResourceA
lstrlenA
lstrcatA
IsBadWritePtr
WideCharToMultiByte
lstrlenW
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
HeapReAlloc
MultiByteToWideChar
SetLastError
LoadResource
GetWindowsDirectoryA
DeleteCriticalSection
FreeLibrary
DisableThreadLibraryCalls
GetVersion
OpenFile
LoadLibraryA
GetLocaleInfoA
InterlockedIncrement
InterlockedDecrement
GetLastError
LockResource

user32

DrawEdge
MessageBoxA
GetActiveWindow
DialogBoxParamA
GetSystemMetrics
LoadBitmapA
LoadCursorA
wsprintfA
ReleaseDC
GetDC
CharNextA
ShowWindow
SetParent
GetWindowRect
SetWindowPos
WinHelpA
IsDialogMessageA
GetWindow
IsChild
GetNextDlgTabItem
GetKeyState
IsWindowEnabled
GetDlgItemTextA
LoadStringA
CreateDialogIndirectParamA
OffsetRect
ClientToScreen
SendDlgItemMessageA
SetDlgItemInt
IntersectRect
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
SetFocus
MoveWindow
PtInRect
MessageBeep
SetDlgItemTextA
SendMessageA
GetParent
GetDlgItem
GetDlgItemInt
DefWindowProcA
GetWindowLongA
DestroyWindow
CreateWindowExA
SetWindowLongA
KillTimer
SetTimer
RegisterClassA
PeekMessageA
PostMessageA
SetWindowRgn
EqualRect
UnregisterClassA
EndDialog

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder

advapi32

RegCloseKey
RegQueryValueA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA

oleaut32

RegisterTypeLi
SysAllocString
SysAllocStringLen
SysFreeString
VariantClear
VariantChangeType
SysStringLen
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
SysAllocStringByteLen
OleCreatePropertyFrame
LoadRegTypeLi
SetErrorInfo
CreateErrorInfo
GetErrorInfo
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
VariantInit
SysStringByteLen

gdi32

CreateRectRgnIndirect
GetDeviceCaps
SetViewportExtEx
SetWindowExtEx
SelectObject
DeleteDC
GetObjectA
SetMapMode
SetViewportOrgEx
SetWindowOrgEx
GetViewportExtEx
GetWindowExtEx
LPtoDP
CreateDCA
BitBlt
CreateCompatibleDC

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/Macro.txt
aegis/Aegis/PLUGINN/ANIMS/DOPE/ANI1.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/DOPE/ANI2.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/DOPE/ANI3.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/DOPE/DOPE.ANM
aegis/Aegis/PLUGINN/ANIMS/DOPE/INFO.TXT
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ.ANM
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ1.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ2.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ3.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ4.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ5.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/HERZ/HERZ6.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L.ANM
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L1.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L2.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L3.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L4.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L5.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L5A.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L5B.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L6.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L7.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L8.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/L0L/L0L9.GIF
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/N.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/S.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/U.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/_G.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/_Y.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/SUN/sun.anm
aegis/Aegis/PLUGINN/ANIMS/TERROR/T.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/Te.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeR.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRR.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRRo.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRRoR.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRRoR2.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRRoR3.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/TeRRoR4.gif
.gif
aegis/Aegis/PLUGINN/ANIMS/TERROR/terror.anm
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL1.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL10.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL11.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL12.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL13.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL2.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL3.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL4.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL5.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL6.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL7.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL8.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/HTL9.JPG
.jpg
aegis/Aegis/PLUGINN/ANIMS/WELCOME/WELCOME.ANM
aegis/Aegis/PLUGINN/SKIN/White Aegis/BTe2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/BTe2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bchat1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bchat1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bop1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bop1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bte1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bte1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bww1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Bww1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lg1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lg1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lg2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lg2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lr1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lr1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lr2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Lr2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Stop1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Stop1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/Stop2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/Stop2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/White Aegis.nfo
aegis/Aegis/PLUGINN/SKIN/White Aegis/White Aegis.odr
aegis/Aegis/PLUGINN/SKIN/White Aegis/bPunt1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/back.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/baol1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/baol1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/baol2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/baol2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bchat2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/bchat2.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bmai1.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/bmai1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bmai2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/bmai2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bnchat.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bnchat2.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bop2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/bop2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bpunt2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bscroll1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bscroll2.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bstart1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bstart2.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bstop1.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bstop2.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/button Kopie.JPG
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/button.psd
aegis/Aegis/PLUGINN/SKIN/White Aegis/button1.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/button1a.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/bww2.GIF
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/bww2.jpg
.jpg
aegis/Aegis/PLUGINN/SKIN/White Aegis/ic1.gif
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/ic2.gif
.gif
aegis/Aegis/PLUGINN/SKIN/White Aegis/msg.jpg
.jpg
aegis/Aegis/beep.wav
aegis/Aegis/dwsbc32d.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

56fe4f484b2f4a47df66f8eee6517617

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

dwspy32

ord305
ord303
ord304
ord306
ord301
ord202
ord212
ord512
ord513
ord302

mfc40

ord2115
ord2707
ord1426
ord2511
ord2704
ord3956
ord729
ord1647
ord265
ord5748
ord4173
ord5637
ord5638
ord3952
ord2860
ord2916
ord4096
ord3906
ord3202
ord651
ord403
ord1073
ord1035
ord2894
ord1084
ord4141
ord4302
ord4462
ord5644
ord4700
ord3919
ord2861
ord4099
ord654
ord406
ord2317
ord1986
ord2003
ord2065
ord2007
ord1975
ord2004
ord1989
ord2005
ord1995
ord2072
ord3724
ord1366
ord974
ord4046
ord4176
ord4704
ord3262
ord724
ord509
ord3762
ord1869
ord2451
ord2293
ord2557
ord1633
ord3738
ord2176
ord2358
ord1043
ord3511
ord2392
ord1097
ord2395
ord2394
ord1071
ord2135
ord1464
ord4973
ord881
ord3827
ord4154
ord4113
ord5023
ord1873
ord4314
ord4375
ord5001
ord3611
ord4360
ord4024
ord3997
ord4070
ord4441
ord4380
ord4385
ord4390
ord4122
ord4156
ord3012
ord5363
ord4241
ord4123
ord4111
ord4110
ord4505
ord4060
ord3854
ord1540
ord486
ord4202
ord4204
ord4201
ord3892
ord4079
ord4459
ord3898
ord4444
ord2177
ord2963
ord4015
ord5643
ord2618
ord2755
ord2844
ord3946
ord2621
ord2695
ord3581
ord4098
ord5160
ord632
ord5317
ord3452
ord381
ord5241
ord2635
ord4657
ord279
ord5568
ord1390
ord4722
ord4724
ord4736
ord4740
ord4739
ord4741
ord2223
ord2378
ord4403
ord3010
ord1400
ord1456
ord5549
ord5352
ord1387
ord5341
ord5190
ord5193
ord2595
ord763
ord3112
ord2515
ord5506
ord5139
ord1543
ord3427
ord3560
ord5492
ord3382
ord5648
ord3963
ord2234
ord2197
ord5070
ord3431
ord965
ord4627
ord2097
ord2909
ord4713
ord4715
ord2389
ord3579
ord4165
ord4719
ord4703
ord5053
ord3458
ord2960
ord3192
ord721
ord504
ord1090
ord5630
ord1075
ord1085
ord2066
ord1991
ord1115
ord1116
ord5003
ord2739
ord3176
ord3148
ord2735
ord3890
ord1539
ord3578
ord5360
ord2199
ord4450
ord4312
ord3859
ord4681
ord731
ord315
ord570
ord762
ord706
ord3185
ord3158
ord3153
ord4101
ord3134
ord3907
ord3340
ord3580
ord2694
ord2696
ord3346
ord3345
ord2744
ord2620
ord2845
ord2754
ord3945
ord2843
ord1850
ord2617
ord4691
ord1494
ord2140
ord4677
ord5649
ord4510
ord3268
ord3922
ord1785
ord2323
ord4694
ord4296
ord3314
ord4608
ord3837
ord5647
ord3844
ord2086
ord3840
ord4473
ord4127
ord1014
ord711
ord999
ord671
ord1369
ord1042
ord1105
ord1046
ord1367
ord328
ord269
ord733
ord1000
ord988
ord5681
ord1370

msvcrt40

_fcvt
_EH_prolog
_except_handler3
__dllonexit
_onexit
_initterm
?terminate@@YAXXZ
free
??1type_info@@UAE@XZ
malloc
_adjust_fdiv
atol
wcslen
_strupr
__CxxFrameHandler
strcspn
_CxxThrowException
memmove
strstr
strncpy

kernel32

GetEnvironmentStrings
_lclose
GetVersion
IsDBCSLeadByte
OpenFile
FreeLibrary
LoadLibraryA
GlobalAlloc
GlobalLock
GlobalFree
FindResourceA
SizeofResource
GlobalUnlock
LockResource
lstrcpyA
LoadResource
WaitForSingleObject
UnmapViewOfFile
ReleaseMutex
CreateFileMappingA
OpenFileMappingA
CloseHandle
CreateMutexA
IsBadReadPtr
MapViewOfFile
lstrcmpiA
lstrlenA
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameA
GetCurrentProcessId
GetProcAddress
IsBadCodePtr
lstrcmpA
GetPrivateProfileIntA
_lread
GetPrivateProfileStringA
_llseek
FileTimeToDosDateTime
_lwrite
LocalFree
LocalAlloc
GetFileTime
GetTickCount
lstrcatA
Sleep

user32

GetWindow
EnumThreadWindows
UpdateWindow
CharNextA
CharPrevA
IsWindowVisible
EnumWindows
GetWindowLongA
GetDesktopWindow
MessageBoxA
LoadStringA
IsWindowEnabled
GetPropA
GetWindowThreadProcessId
EnumChildWindows
SetRectEmpty
IsWindow
GetFocus
GetParent
SetWindowLongA
RegisterWindowMessageA
FillRect
LoadIconA
DrawIcon
PostMessageA
wsprintfA
EnableWindow
SendMessageA
GetClientRect
GetClassNameA

gdi32

MoveToEx
GetObjectA
SelectObject
LineTo
CreateFontIndirectA
DeleteDC
GetDeviceCaps
CreateICA

oleaut32

VariantClear
SysAllocString
LoadRegTypeLi
LoadTypeLi
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
PendedHookProc
SbcHook
StyleHookProc

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aegis/Aegis/epyx.wav
aegis/Aegis/regdrop.exe
.exe windows:4 windows x86 arch:x86

e0b67b2bc21ae39cdab63b41df09f2dd

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
LoadResource
GetProcAddress
LoadLibraryA
FormatMessageA
FindResourceA
FreeLibrary
GetCommandLineA
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetModuleFileNameA
FlushFileBuffers
SetStdHandle
HeapAlloc
VirtualAlloc
SetFilePointer
WriteFile
RtlUnwind
VirtualFree
ReadFile
SetEndOfFile
CreateFileA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleHandleA
GetStartupInfoA
LockResource
GetVersion
HeapFree
CloseHandle
HeapCreate
GetCPInfo
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetFileType
HeapDestroy
GetACP
GetOEMCP
SetHandleCount
GetStdHandle

user32

FillRect
EndDialog
SetWindowTextA
GetDlgItem
DialogBoxParamA
GetKeyState
MessageBoxA
BeginPaint
GetClientRect
EndPaint

gdi32

GetStockObject
SetBkColor

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 943B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
aegis/Aegis/war.wav

Sharing

General

Malware Config

Signatures

Files

d6057ec88a7894e5b57ca4dcf4f22f4f

Headers

File Characteristics

Imports

kernel32

winmm

user32

ole32

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 13KB - Virtual size: 30KB

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 7KB - Virtual size: 6KB

4c05edd4161232ecccaba6b637db908b

Headers

File Characteristics

Imports

msvbvm50

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.data Size: 512B - Virtual size: 100KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 183KB - Virtual size: 183KB

9cb8b018e2938a84cb1cc64895f59c1a

Headers

File Characteristics

Imports

mfc40

msvcrt40

kernel32

user32

gdi32

oleaut32

Exports

Exports

Sections

.text Size: 71KB - Virtual size: 70KB

.sdata Size: 512B - Virtual size: 4B

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 2KB - Virtual size: 6KB

.idata Size: 5KB - Virtual size: 5KB

.rsrc Size: 24KB - Virtual size: 24KB

.reloc Size: 7KB - Virtual size: 6KB

4e775177760fdc49b633daffe32751cc

Headers

File Characteristics

Imports

winmm

mfc40

msvcrt40

kernel32

user32

gdi32

oleaut32

Exports

Exports

Sections

.text Size: 55KB - Virtual size: 55KB

.rdata Size: 20KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 22KB

.idata Size: 3KB - Virtual size: 3KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 5KB - Virtual size: 5KB

2e8f1e2d5b71a4e31f9f995ba561d41f

Headers

File Characteristics

Imports

wsock32

kernel32

user32

ole32

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 13KB - Virtual size: 30KB

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 512B - Virtual size: 100KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 183KB - Virtual size: 183KB

.text
Size: 71KB - Virtual size: 70KB

.sdata
Size: 512B - Virtual size: 4B

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 2KB - Virtual size: 6KB

.idata
Size: 5KB - Virtual size: 5KB

.rsrc
Size: 24KB - Virtual size: 24KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 55KB - Virtual size: 55KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 22KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: 65KB - Virtual size: 65KB

.data
Size: 1024B - Virtual size: 824B

.rsrc
Size: 26KB - Virtual size: 25KB

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 56KB - Virtual size: 55KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 2KB - Virtual size: 7KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 1024B - Virtual size: 943B

.data
Size: 11KB - Virtual size: 15KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 30KB - Virtual size: 29KB