855e8889e3b63c4d56d845b7361c2f82_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

855e8889e3b63c4d56d845b7361c2f82_JaffaCakes118
Size

2.5MB
MD5

855e8889e3b63c4d56d845b7361c2f82
SHA1

feeab719ebe900f6987c17a1f5b0d89474266674
SHA256

44e8aebf6b9f6f77d1e65e22cb806374ca89d80666221e27c0c28f86029dd0b3
SHA512

b6cfe07ec1a872694fb1ed2ac0ea86da8d57b7a16263856c60f2d901f75d12da8e399294a1267a49d7ad924f2cc7c2e3047512bed05bfc6faa98b1d165105022
SSDEEP

49152:QXUnOFDCI+XhnVTEKWmmnZTxDYpMkJm/2NxFz07/u5r4LeaZur68XyU:QEnK+pXhnZWxZTNpkEuN3Br4LeaZ+hB

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/SkypePTT/KeyPress.dll
unpack001/SkypePTT/SkypePTT.exe

Files

855e8889e3b63c4d56d845b7361c2f82_JaffaCakes118
.rar
SkypePTT/KeyPress.dll
.dll windows:5 windows x86 arch:x86

6dd60408b2f05ae63e104a1f66bb84ce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Users\Nudua\Documents\Visual Studio 2008\Projects\qt\SkypePTT\Release\KeyPress.pdb

Imports

user32

CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW

kernel32

QueryPerformanceCounter
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

??0KeyboardHook@@QAE@ABV0@@Z
??0KeyboardHook@@QAE@XZ
??1KeyboardHook@@QAE@XZ
??4KeyboardHook@@QAEAAV0@ABV0@@Z
??_7KeyboardHook@@6B@
?FixHook@KeyboardHook@@QAEXXZ
?Init@KeyboardHook@@QAEXXZ
?KeyDown@KeyboardHook@@UAEXHH@Z
?KeyUp@KeyboardHook@@UAEXHH@Z
?KeyboardProc@KeyboardHook@@CGJHIJ@Z
?MouseProc@KeyboardHook@@CGJHIJ@Z
?UnInit@KeyboardHook@@QAEXXZ

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SkypePTT/Skype4COM.dll
.dll regsvr32 windows:4 windows x86 arch:x86

d71d9d87fe5162ed7caa5a753ad7a54a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:c0:59:9f:af:e4:ab:dc:48:62:84:4f:25:05:5e:e6
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

26/05/2008, 00:00

Not After

26/05/2009, 23:59

Subject

CN=Skype Technologies SA,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Skype Technologies SA,L=Luxembourg,ST=Luxembourg,C=LU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

40:9d:59:91:20:86:ef:53:11:42:e0:f1:91:24:50:ac:23:b2:27:02
Signer

Actual PE Digest

40:9d:59:91:20:86:ef:53:11:42:e0:f1:91:24:50:ac:23:b2:27:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleHandleW
MulDiv
CloseHandle
CreateProcessW
SetWaitableTimer
CreateWaitableTimerW
CreateEventW
WaitForSingleObject
ResetEvent
SetEvent
LocalFree
InterlockedCompareExchange
GetStringTypeExW
ReadFile
SetEndOfFile
GetLocaleInfoW
LoadLibraryA
CreateFileW
SetFilePointer
FlushFileBuffers
SetStdHandle
GetOEMCP
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
lstrcpynW
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
WriteFile
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
IsBadWritePtr
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
ExitProcess
CreateThread
ExitThread
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
RtlUnwind
GetVersionExA
lstrcmpiW
lstrcpyW
OutputDebugStringW
DebugBreak
Sleep
GetComputerNameExW
lstrlenA
MultiByteToWideChar
InterlockedIncrement
GlobalAlloc
GlobalLock
GlobalUnlock
WideCharToMultiByte
GetLastError
HeapFree
GetLocalTime
SystemTimeToFileTime
FindResourceW
LoadResource
SizeofResource
InterlockedExchange
LockResource
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrlenW
GetModuleFileNameW
InterlockedDecrement
GetCurrentThreadId
GetProcessHeap
HeapAlloc
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
QueryPerformanceCounter

user32

DialogBoxParamW
DefWindowProcW
GetDesktopWindow
CreateWindowExW
RegisterClassExW
LoadCursorW
GetWindowLongW
GetClassInfoExW
KillTimer
SetTimer
SetWindowLongW
DestroyWindow
UnregisterClassW
CallWindowProcW
wsprintfW
SendMessageW
GetMessageW
TranslateMessage
GetParent
GetActiveWindow
EndDialog
EnableWindow
GetDlgItem
DrawTextW
GetWindowTextW
PostThreadMessageW
PostMessageW
SendMessageTimeoutW
LoadIconW
MsgWaitForMultipleObjects
PeekMessageW
DispatchMessageW
GetWindowThreadProcessId
EnumWindows
GetClassNameW
SetFocus
GetFocus
IsChild
BeginPaint
EndPaint
InvalidateRect
IsWindow
GetKeyState
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
GetDC
ReleaseDC
UnionRect
PtInRect
RegisterWindowMessageW
CharNextW
wvsprintfW
EnumChildWindows
CheckRadioButton
IsDlgButtonChecked
CopyRect
LoadBitmapW
GetWindow
GetWindowRect
SystemParametersInfoW
MapWindowPoints
SetWindowPos
GetSystemMetrics
LoadImageW
ShowWindow
LoadStringW
SetWindowTextW
GetDlgCtrlID
GetClientRect
FillRect
InflateRect
SetRect

gdi32

SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
CreateDCW
GetDeviceCaps
CreateMetaFileW
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
Rectangle
SetTextAlign
TextOutW
SetBkColor
RoundRect
GetCurrentObject
GetObjectW
CreateFontIndirectW
SelectObject
DeleteObject
CreatePen
CreateSolidBrush
GetStockObject
LPtoDP
SaveDC

advapi32

RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteW

ole32

OleRegEnumVerbs
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateOleAdviseHolder
CoCreateInstance
OleRegGetMiscStatus
OleRegGetUserType
CreateDataAdviseHolder
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
ProgIDFromCLSID
CoTaskMemFree
CLSIDFromString
CreateStreamOnHGlobal

oleaut32

VariantInit
OleCreatePropertyFrame
VariantChangeType
DispCallFunc
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
CreateErrorInfo
SetErrorInfo
SysAllocStringLen
SystemTimeToVariantTime
VarBstrCmp
LoadTypeLi
LoadRegTypeLi
SysStringLen
VariantCopy
SysFreeString
SysAllocStringByteLen
SysStringByteLen
VariantClear
SysAllocString

shlwapi

PathFindExtensionW

comctl32

ImageList_AddMasked
InitCommonControlsEx
ImageList_Create

urlmon

ReleaseBindInfo

wininet

CreateUrlCacheEntryW
DeleteUrlCacheEntryW
InternetCrackUrlW
CommitUrlCacheEntryW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 780KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 856KB - Virtual size: 854KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SkypePTT/SkypePTT.exe
.exe windows:5 windows x86 arch:x86

7cdf6357563f5fd70e466cb994c1e5e7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

dinput8

DirectInput8Create

kernel32

ReadProcessMemory
VirtualFreeEx
GetUserDefaultLangID
ExpandEnvironmentStringsW
CreateProcessW
GlobalSize
lstrcmpW
GetModuleHandleW
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
GetStringTypeW
GetStringTypeA
CompareStringA
GetLocaleInfoA
GetModuleHandleA
LCMapStringW
LCMapStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
LoadLibraryA
FlushFileBuffers
VirtualAlloc
GetSystemTimeAsFileTime
GetTickCount
VirtualAllocEx
VirtualFree
InterlockedDecrement
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
HeapSize
SetLastError
InterlockedIncrement
RaiseException
GetConsoleMode
GetConsoleCP
SetFileAttributesW
GetCurrentDirectoryA
SetStdHandle
CreateFileA
GetDriveTypeA
SetFilePointer
GetTimeZoneInformation
ExitThread
ExitProcess
HeapReAlloc
HeapFree
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
GetCommandLineA
RtlUnwind
CloseHandle
WideCharToMultiByte
HeapCreate
GetLastError
MultiByteToWideChar
CompareStringW
GetUserDefaultLCID
GetCommandLineW
OpenProcess
CreateThread
ReleaseMutex
CreateMutexW
GlobalAlloc
GlobalUnlock
GlobalLock
IsValidLocale
QueryPerformanceCounter
IsValidLanguageGroup
GetCurrentProcessId
GetVersionExW
FormatMessageW
LocalFree
TlsAlloc
TlsFree
FindNextFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetEndOfFile
DeviceIoControl
TlsGetValue
GetLogicalDrives
GetCurrentDirectoryW
GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
MoveFileW
CopyFileW
DeleteFileW
GetFileType
WriteFile
ReadFile
SetFilePointerEx
GetFileInformationByHandle
FindClose
FindFirstFileW
GetFileAttributesExW
CreateFileW
GetFullPathNameW
LoadLibraryW
ResetEvent
OutputDebugStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameW
GetTimeFormatW
GetDateFormatW
GetProcAddress
SetErrorMode
GetLocaleInfoW
GetLocalTime
TerminateThread
ResumeThread
SetThreadPriority
GetThreadPriority
Sleep
GetSystemInfo
WaitForMultipleObjects
SetEvent
CreateEventW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcess
DuplicateHandle
TlsSetValue

user32

DestroyWindow
UnregisterClassW
PeekMessageW
PostMessageW
KillTimer
GetWindowLongW
DefWindowProcW
CharNextExA
CallNextHookEx
RegisterClassW
CreateWindowExW
SetWindowLongW
SetTimer
SetWindowsHookExW
MsgWaitForMultipleObjectsEx
TranslateMessage
GetAsyncKeyState
UnhookWindowsHookEx
GetQueueStatus
GetCursorPos
GetClipboardFormatNameW
SetClipboardViewer
ChangeClipboardChain
GetMenu
ToAscii
MapVirtualKeyW
GetKeyboardState
GetKeyboardLayout
TrackPopupMenuEx
SetMenuItemInfoW
ToUnicode
LoadIconW
MapWindowPoints
GetWindowThreadProcessId
FindWindowExW
FindWindowW
RegisterClipboardFormatW
CreateCursor
SetCursorPos
DestroyCursor
GetFocus
SetFocus
GetActiveWindow
IsChild
GetDC
ReleaseDC
GetSystemMetrics
GetDesktopWindow
AdjustWindowRectEx
DrawIconEx
GetIconInfo
CreateIconIndirect
HideCaret
CreateCaret
DestroyCaret
SetCaretPos
RegisterWindowMessageW
GetKeyboardLayoutList
GetDoubleClickTime
SetDoubleClickTime
SetCaretBlinkTime
EndPaint
BeginPaint
InvalidateRgn
GetUpdateRect
SetWindowPos
ClipCursor
GetWindowRgn
FlashWindowEx
GetCaretBlinkTime
MessageBeep
GetParent
WindowFromPoint
GetKeyState
GetSysColorBrush
LoadImageW
GetClassInfoW
SystemParametersInfoW
GetSysColor
SetWindowRgn
UpdateWindow
ScrollWindowEx
GetWindowRect
SetWindowPlacement
GetWindowPlacement
ValidateRgn
InvalidateRect
MoveWindow
IsZoomed
IsIconic
SetForegroundWindow
ReleaseCapture
SetCursor
SetCapture
SendMessageW
DestroyIcon
SetWindowTextW
ScreenToClient
SetParent
ShowWindow
IsWindowVisible
EnableMenuItem
GetSystemMenu
ClientToScreen
GetClientRect
DispatchMessageW

shell32

Shell_NotifyIconW
ShellExecuteW

ole32

CoUninitialize
OleRun
CoCreateInstance
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
CoCreateGuid
StringFromGUID2
OleInitialize
OleUninitialize
ReleaseStgMedium
DoDragDrop
OleGetClipboard
OleSetClipboard
OleFlushClipboard
OleIsCurrentClipboard
CoTaskMemFree
CoGetMalloc
CoInitialize

advapi32

RegOpenKeyExW
GetTokenInformation
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegFlushKey
OpenProcessToken

ws2_32

WSAAsyncSelect

gdi32

CreateFontIndirectW
CreateBitmap
GetDIBits
CreateDIBSection
DeleteDC
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
PtInRegion
GetFontData
SelectPalette
GetObjectW
GetStockObject
GetRegionData
CreateRectRgn
DeleteObject
OffsetRgn
CombineRgn
GetDeviceCaps
CreatePalette
GetPaletteEntries
EnumFontFamiliesExW
GetTextMetricsW
GetTextFaceW
GetOutlineTextMetricsW
GetTextExtentPoint32W
SetGraphicsMode
SetWorldTransform
GetGlyphOutlineW
GetCharABCWidthsFloatW
GetCharABCWidthsW
SetTextColor
SetBkMode
SetTextAlign
RealizePalette
GdiFlush
SelectClipRgn
ExtTextOutW

oleaut32

VariantInit
SysFreeString
SysStringLen
SysAllocStringByteLen
SysAllocString
GetErrorInfo

imm32

ImmGetDefaultIMEWnd
ImmReleaseContext
ImmNotifyIME
ImmGetCompositionStringW
ImmSetCompositionFontW
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContext
ImmGetContext

winmm

PlaySoundW

keypress

?Init@KeyboardHook@@QAEXXZ
?UnInit@KeyboardHook@@QAEXXZ
??1KeyboardHook@@QAE@XZ
??0KeyboardHook@@QAE@XZ
?FixHook@KeyboardHook@@QAEXXZ
?KeyDown@KeyboardHook@@UAEXHH@Z
?KeyUp@KeyboardHook@@UAEXHH@Z

Exports

Exports

??0KeyboardHook@@QAE@ABV0@@Z
??4KeyboardHook@@QAEAAV0@ABV0@@Z
??_7KeyboardHook@@6B@

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 201KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SkypePTT/skypeptt.ini
SkypePTT/sounds/MicKeyDown.wav
SkypePTT/sounds/MicKeyUp.wav

Sharing

General

Malware Config

Signatures

Files

6dd60408b2f05ae63e104a1f66bb84ce

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

kernel32

Exports

Exports

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 4KB - Virtual size: 4KB

d71d9d87fe5162ed7caa5a753ad7a54a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

06:c0:59:9f:af:e4:ab:dc:48:62:84:4f:25:05:5e:e6Certificate

Extended Key Usages

Key Usages

40:9d:59:91:20:86:ef:53:11:42:e0:f1:91:24:50:ac:23:b2:27:02Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

urlmon

wininet

Exports

Exports

Sections

.text Size: 780KB - Virtual size: 776KB

.rdata Size: 168KB - Virtual size: 165KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 856KB - Virtual size: 854KB

.reloc Size: 72KB - Virtual size: 71KB

7cdf6357563f5fd70e466cb994c1e5e7

Headers

DLL Characteristics

File Characteristics

Imports

dinput8

kernel32

user32

shell32

ole32

advapi32

ws2_32

gdi32

oleaut32

imm32

winmm

keypress

Exports

Exports

Sections

.text Size: 3.8MB - Virtual size: 3.8MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 4KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

06:c0:59:9f:af:e4:ab:dc:48:62:84:4f:25:05:5e:e6
Certificate

40:9d:59:91:20:86:ef:53:11:42:e0:f1:91:24:50:ac:23:b2:27:02
Signer

.text
Size: 780KB - Virtual size: 776KB

.rdata
Size: 168KB - Virtual size: 165KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 856KB - Virtual size: 854KB

.reloc
Size: 72KB - Virtual size: 71KB

.text
Size: 3.8MB - Virtual size: 3.8MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 30KB - Virtual size: 50KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 201KB - Virtual size: 200KB