9436ab4e9ec75c918156cce55b837698_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

9436ab4e9ec75c918156cce55b837698_JaffaCakes118
Size

923KB
MD5

9436ab4e9ec75c918156cce55b837698
SHA1

8664429d95f1545269afbbf13f3db888a0cbfd32
SHA256

21dfcf67cfb5d52a396eb6c17354e051a62c4cd5464d924a1ead215f8cff05db
SHA512

a479073b4ba6dad986e2ed3c6f2057faa55d538b28c76d72dbc2a19d1dbf7b1f58bb85e93e32ce5d5a9c4b9f332c4bb89ebe7595504c3006437da2753eeadc27
SSDEEP

24576:5oaJNgZrANDF+op4Gh4KA7RDktIqoHt+ueDR0:blNReC4KAtDCMt+1Dq

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/UninstallIME.exe	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/freewb4.5_big5.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/UninstallIME.exe
unpack003/out.upx
unpack002/freewb.dll
unpack002/freewb.ime
unpack002/registry.exe
unpack002/unregistry.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/freewb4.5_big5.exe	nsis_installer_1
static1/unpack002/unregistry.exe	nsis_installer_1

Files

9436ab4e9ec75c918156cce55b837698_JaffaCakes118
.rar
freewb4.5_big5.exe
.exe windows:4 windows x86 arch:x86

b711f65a9aff6a22fb2f57f0ac8bda33

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
CreateWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
EmptyClipboard
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
GetDlgItem

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
UninstallIME.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
background/Metal.bmp
background/goose2.bmp
background/goose_b.bmp
background/gray_fade.bmp
background/leaf.bmp
convert.mb
freewb.bex
freewb.bin
freewb.dll
.dll windows:4 windows x86 arch:x86

a24142a2ecd6c8b29e97d82f89df6b62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadWritePtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
VirtualAlloc
VirtualFree
GetPrivateProfileStringA
HeapCreate
HeapDestroy
GetACP
HeapReAlloc
HeapSize
GetTimeZoneInformation
TerminateProcess
ExitProcess
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
FindNextFileA
RtlUnwind
GetFileTime
GetFileAttributesA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalAlloc
lstrcmpA
GetCurrentThread
GetFullPathNameA
lstrcpynA
GetVolumeInformationA
FindFirstFileA
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetCurrentProcess
DuplicateHandle
GetLastError
FormatMessageA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
lstrlenA
InterlockedIncrement
GetModuleFileNameA
InterlockedDecrement
SetLastError
GlobalLock
GlobalUnlock
GlobalFree
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcpyA
GetProcAddress
GetTickCount
lstrcmpiA
SetFilePointer
CloseHandle
CopyFileA
WriteFile
GetFileSize
ReadFile
CreateFileA
DeleteFileA
GetModuleHandleA
MulDiv
WritePrivateProfileStringA
GetPrivateProfileIntA
IsBadReadPtr

user32

SetCapture
SetParent
SetRect
WindowFromPoint
ReleaseCapture
LoadStringA
GetSysColorBrush
GetDesktopWindow
UnregisterClassA
InflateRect
RegisterClipboardFormatA
GetMessageA
TranslateMessage
ValidateRect
GetCursorPos
PostQuitMessage
DestroyMenu
CharUpperA
PtInRect
SetRectEmpty
GrayStringA
DrawTextA
TabbedTextOutA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ShowWindow
MoveWindow
EndDialog
GetActiveWindow
CreateDialogIndirectParamA
IsWindowEnabled
GetMenuCheckMarkDimensions
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetDCEx
SendDlgItemMessageA
MapWindowPoints
PeekMessageA
DispatchMessageA
SetActiveWindow
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetTopWindow
MessageBoxA
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
DefWindowProcA
SendMessageA
LoadBitmapA
IsDialogMessageA
EnableWindow
LoadCursorA
InvalidateRect
ReleaseDC
FrameRect
FillRect
GetSysColor
GetClientRect
GetDC
ScreenToClient
GetWindowRect
LoadImageA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
PostThreadMessageA
GetNextDlgTabItem
GetWindow
SetWindowPos
IntersectRect
IsIconic
GetWindowPlacement
GetSystemMetrics
IsChild
GetClassNameA
SetFocus
GetFocus
SetTimer
KillTimer
RegisterWindowMessageA
GetKeyState
GetSubMenu
LoadMenuA
PostMessageA
SetWindowTextA
UpdateWindow
GetParent
RedrawWindow
OffsetRect
SetCursor
IsWindow
LockWindowUpdate
SetWindowLongA
GetWindowLongA
CopyRect
LoadIconA
SystemParametersInfoA

gdi32

CreateRectRgn
CreatePatternBrush
RectVisible
ExtTextOutA
Escape
PatBlt
CreateRectRgnIndirect
StretchDIBits
GetCharWidthA
SetRectRgn
CombineRgn
GetTextMetricsA
SetTextAlign
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
RestoreDC
SetViewportExtEx
OffsetViewportOrgEx
SetStretchBltMode
PtVisible
DeleteDC
SaveDC
GetClipBox
CreatePen
Ellipse
Rectangle
GetStockObject
GetViewportOrgEx
SetViewportOrgEx
CreateFontIndirectA
CreateFontA
SetBkMode
GetTextExtentPoint32A
SetTextColor
TextOutA
CreateSolidBrush
CreateRoundRectRgn
StretchBlt
FillRgn
FrameRgn
GetDeviceCaps
CreateCompatibleDC
SelectObject
GetObjectA
DPtoLP
CreateBitmap
CreateCompatibleBitmap
GetMapMode
SetMapMode
BitBlt
SetBkColor
DeleteObject

comdlg32

FindTextA
ReplaceTextA
ChooseColorA
ChooseFontA
GetOpenFileNameA
GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA

comctl32

ord17
ImageList_Destroy

oledlg

ord8

ole32

OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoRevokeClassObject

oleaut32

VarDateFromStr

Exports

Exports

?CreateBig5@@YAXXZ
EditFile
GroupDeleteWord
Setup

Sections

.text
Size: 176KB - Virtual size: 175KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
freewb.htm
.html
freewb.ime
.dll windows:4 windows x86 arch:x86

cf644facb59aa41829ecb9235f09d4be

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

imm32

ImmGetCompositionWindow
ImmCreateSoftKeyboard
ImmShowSoftKeyboard
ImmDestroySoftKeyboard
ImmGetIMEFileNameA
ImmSetOpenStatus
ImmGenerateMessage
ImmSetStatusWindowPos
ImmSetConversionStatus
ImmCreateIMCC
ImmReSizeIMCC
ImmDestroyIMCC
ImmLockIMCC
ImmUnlockIMCC
ImmLockIMC
ImmUnlockIMC

kernel32

Beep
FreeLibrary
LoadLibraryA
DeleteFileA
SetEnvironmentVariableA
CompareStringW
CompareStringA
RaiseException
SetEndOfFile
GetTimeZoneInformation
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
RtlUnwind
InterlockedIncrement
InterlockedDecrement
GetEnvironmentStringsW
GetEnvironmentStrings
GetCurrentThreadId
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetModuleFileNameA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentProcess
TerminateProcess
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
HeapReAlloc
VirtualAlloc
ExitProcess
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
GetVersion
GetCommandLineA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindNextFileA
FindFirstFileA
GetFileAttributesA
HeapAlloc
HeapFree
GlobalAddAtomA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFilePointer
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
CreateMutexA
GetLastError
GlobalAlloc
ReleaseMutex
GlobalFree
CreateFileA
GetFileSize
ReadFile
CloseHandle
WriteFile
GetPrivateProfileIntA
GetVersionExA
FindResourceA
LoadResource
LockResource
FreeResource
WritePrivateProfileStringA
lstrcpyA
GetLocalTime
MulDiv
lstrlenA
GetPrivateProfileStringA
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalUnlock
WideCharToMultiByte

user32

GetSubMenu
InsertMenuA
CheckMenuItem
EnableMenuItem
TrackPopupMenu
GetMenu
SetWindowTextA
LoadMenuA
SetWindowPos
SetWindowRgn
DialogBoxParamA
GetDlgItem
EndDialog
GetWindowTextA
MessageBeep
IntersectRect
SetFocus
RedrawWindow
DestroyWindow
GetAsyncKeyState
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
IsWindowVisible
IsIconic
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
FindWindowA
IsWindow
GetKeyboardLayoutList
ToAscii
GetActiveWindow
DrawTextA
GetWindowPlacement
GetKeyState
IsWindowEnabled
GetForegroundWindow
UnregisterClassA
DestroyIcon
LoadImageA
GetClassInfoExA
RegisterClassExA
GetSystemMetrics
EnumWindows
LoadStringA
MessageBoxA
GetClassNameA
SystemParametersInfoA
GetDC
ReleaseDC
GetKeyboardState
DestroyMenu
wsprintfA
MapVirtualKeyA
GetFocus
keybd_event
BeginPaint
EndPaint
DefWindowProcA
KillTimer
SetTimer
LoadBitmapA
ReleaseCapture
PostMessageA
GetCursorPos
ScreenToClient
PtInRect
LoadCursorA
SetCursor
SetCapture
GetWindowRect
SendMessageA
GetWindow
CreateWindowExA
SetWindowLongA
ShowWindow
GetWindowLongA
ClientToScreen
UpdateWindow

gdi32

CreateDCA
GetTextExtentPoint32A
GetCurrentObject
GetPixel
CombineRgn
GetStockObject
GetDeviceCaps
CreateFontA
LineTo
MoveToEx
CreatePen
SetTextColor
SetBkMode
ExtTextOutA
CreateBrushIndirect
SelectObject
PatBlt
DeleteObject
CreateCompatibleDC
GetObjectA
BitBlt
SetStretchBltMode
StretchBlt
DeleteDC
CreateSolidBrush
CreateRectRgn
CreateRoundRectRgn
FrameRgn
GetTextExtentPointA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteA

Exports

Exports

CandWndProc
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
StatusWndProc
UIWndProc

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mJDShar
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
freewb.ini
g2b.dat
mb/default/attach.mb
mb/default/freewb.dat
mb/default/freewb.mb
mb/default/freewbcht.mb
mb/default/quick.mb
mb/default/user.ini
registry.exe
.exe windows:4 windows x86 arch:x86

b3c56e49f70d84319ca30d3d04049934

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetStringTypeW
FlushFileBuffers
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
HeapFree
GetStringTypeA
CreateMutexA
GetLastError
ReleaseMutex
CopyFileA
WinExec
DeleteFileA
GetSystemDirectoryA
GetCommandLineA
LCMapStringW
GetFileAttributesA
RtlUnwind
GetStartupInfoA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
SetFilePointer
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
SetStdHandle
MultiByteToWideChar
LCMapStringA
CloseHandle

user32

LoadIconA
RegisterClassA
MessageBoxA

advapi32

LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
GetAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegDeleteKeyA
RegQueryValueExA

imm32

ImmInstallIMEA

Sections

.text
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
skin/Bar.bmp
skin/Bar.ini
skin/Paper.bmp
skin/Paper.ini
skin/blue.bmp
skin/blue.ini
unregistry.exe
.exe windows:4 windows x86 arch:x86

b711f65a9aff6a22fb2f57f0ac8bda33

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
CreateWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
EmptyClipboard
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
GetDlgItem

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

Files

b711f65a9aff6a22fb2f57f0ac8bda33

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 109KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 3KB - Virtual size: 4KB

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 36KB

UPX1 Size: 17KB - Virtual size: 20KB

UPX2 Size: 512B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 10KB - Virtual size: 15KB

a24142a2ecd6c8b29e97d82f89df6b62

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

oleaut32

Exports

Exports

Sections

.text Size: 176KB - Virtual size: 175KB

.rdata Size: 44KB - Virtual size: 43KB

.data Size: 12KB - Virtual size: 26KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 32KB - Virtual size: 30KB

cf644facb59aa41829ecb9235f09d4be

Headers

File Characteristics

Imports

imm32

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 109KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 3KB - Virtual size: 4KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

UPX0
Size: - Virtual size: 36KB

UPX1
Size: 17KB - Virtual size: 20KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 10KB - Virtual size: 15KB

.text
Size: 176KB - Virtual size: 175KB

.rdata
Size: 44KB - Virtual size: 43KB

.data
Size: 12KB - Virtual size: 26KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 32KB - Virtual size: 30KB

.text
Size: 260KB - Virtual size: 259KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 36KB - Virtual size: 102KB

.mJDShar
Size: 8KB - Virtual size: 4KB

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 24KB - Virtual size: 20KB

.text
Size: 20KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 480B

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 109KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 3KB - Virtual size: 4KB