a71ce4082a9c782aedc8d525cfbf2279_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a71ce4082a9c782aedc8d525cfbf2279_JaffaCakes118
Size

664KB
MD5

a71ce4082a9c782aedc8d525cfbf2279
SHA1

9ad69e07e37aeac7f4349d075b15d1d737c13e0b
SHA256

26d72f9a254a5e094c0a5fd02edc24ecfb9e68b8c790075777ac368cf7cdb19b
SHA512

f89aca21463e175dfd4f4515def8537ba54c35217d9b93ce518a28caaeeeaea41bd8bfc42c21aebdcf99ca61a503814c96345d84a029dd62d1ea5ed724a2101e
SSDEEP

12288:Axz+fXM+J8sqhoOQjxavvLIpj6fB23trQpRuvyUwxQUiFOSs:Axaf6sqWOiYEpjvQWfU1

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NIAPSoft AntiRootkit Tools/NIAPDevC.dll
unpack001/NIAPSoft AntiRootkit Tools/NIAPMirrorSystem.sys
unpack001/NIAPSoft AntiRootkit Tools/NIAPRegEdit.exe
unpack001/NIAPSoft AntiRootkit Tools/NIAP_XRay_FileMgr.exe
unpack001/NIAPSoft AntiRootkit Tools/NIAP_XRay_System.exe

Files

a71ce4082a9c782aedc8d525cfbf2279_JaffaCakes118
.zip
NIAPSoft AntiRootkit Tools/NIAPDevC.dll
.dll windows:4 windows x86 arch:x86

c8b6b7a26a15ad057303cf1f967b2c3e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\source\MyPrj\NIAP\NIAPDevC\release\NIAPDevC.pdb

Imports

kernel32

GetTickCount
DeleteFileW
DeviceIoControl
InterlockedExchange
CloseHandle
CreateFileW
VirtualProtect
GetModuleFileNameW
LoadLibraryW
FreeLibrary
Sleep
GetProcAddress
GetLastError
HeapFree
WriteConsoleW
GetFileType
GetStdHandle
HeapAlloc
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteFile
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
ExitProcess
WideCharToMultiByte
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
GetLocaleInfoA
InitializeCriticalSection
RtlUnwind
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
SetStdHandle
CreateFileA

advapi32

QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
QueryServiceConfigW
ChangeServiceConfigW

Exports

Exports

CreateModuleEx

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NIAPSoft AntiRootkit Tools/NIAPMirrorSystem.sys
.sys windows:4 windows x86 arch:x86

2d21bab40a4f1d5ea8e1865ddefefe4b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\source\MyPrj\NIAPMirrorSystem\Release\NIAPMirrorSystem.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
ZwCreateFile
RtlInitUnicodeString
ExAllocatePoolWithTag
strlen
_stricmp
ZwQuerySystemInformation
strcmp
PsGetCurrentProcessId
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
strrchr
memset
KeServiceDescriptorTable
strcpy
KeBugCheck
ZwQueryInformationFile
ObOpenObjectByName
strcat
MmIsAddressValid
ZwQueryValueKey
ZwOpenKey
_wcsnicmp
PsGetVersion
RtlCompareMemory
KeAddSystemServiceTable
PsLookupProcessByProcessId
ExEnumHandleTable
wcslen
ZwClose
ZwReadFile
memcpy
ObReferenceObjectByHandle
_except_handler3

hal

KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KfAcquireSpinLock

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NIAPSoft AntiRootkit Tools/NIAPRegEdit.exe
.exe windows:4 windows x86 arch:x86

32120991d6135761370b746421bbddde

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SizeofResource
GetModuleFileNameA
GetStdHandle
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
ExitProcess
GetFileType
SetStdHandle
HeapReAlloc
RaiseException
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
SetErrorMode
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
GetShortPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
GetStringTypeExW
DeleteFileW
MoveFileW
GetDiskFreeSpaceW
GetFullPathNameW
GetTempFileNameW
GetFileTime
GetFileSize
GetFileAttributesW
CreateFileW
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
GetTickCount
GetVersion
GlobalGetAtomNameW
lstrlenA
lstrcmpA
GetModuleFileNameW
GetModuleHandleA
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
GetCurrentProcessId
GetACP
WideCharToMultiByte
lstrcmpiW
MulDiv
GetProcessHeap
FreeLibrary
FindFirstFileW
LocalAlloc
FindClose
GetCurrentProcess
GetVersionExW
LocalFree
HeapFree
HeapAlloc
CloseHandle
FormatMessageW
GetComputerNameW
GetCurrentDirectoryW
lstrcpyW
lstrlenW
Sleep
InterlockedIncrement
InterlockedDecrement
LoadLibraryW
SetLastError
GetLastError
GetModuleHandleW
GetProcAddress
LockResource
LoadResource
MultiByteToWideChar
FindResourceW

user32

PostThreadMessageW
CharNextW
InvalidateRgn
GetNextDlgGroupItem
PostQuitMessage
RegisterClipboardFormatW
ShowOwnedPopups
ValidateRect
WaitMessage
GetMessageW
TranslateMessage
UnpackDDElParam
ReuseDDElParam
LoadAcceleratorsW
InsertMenuItemW
CreatePopupMenu
SetMenu
TranslateAcceleratorW
SetRect
GetWindowThreadProcessId
GetDesktopWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
EndPaint
BeginPaint
GetWindowDC
IsWindowEnabled
MoveWindow
SetWindowTextW
IsDialogMessageW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetMenuState
GetMenuStringW
InsertMenuW
SetWindowRgn
DrawIcon
FindWindowW
LoadIconW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetForegroundWindow
ShowScrollBar
IsWindowVisible
GetMenu
GetMenuItemID
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
EqualRect
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
BringWindowToTop
KillTimer
SetTimer
RegisterWindowMessageW
FrameRect
GetAsyncKeyState
DrawIconEx
CallWindowProcW
ReleaseCapture
FillRect
SetCapture
IsChild
GetClassNameW
SetFocus
WindowFromPoint
GrayStringW
InvalidateRect
TabbedTextOutW
ClientToScreen
GetKeyState
GetClassInfoW
GetActiveWindow
IsRectEmpty
GetScrollRange
SetScrollPos
GetScrollPos
DrawTextExW
PtInRect
ReleaseDC
GetDC
TrackPopupMenuEx
DestroyMenu
PostMessageW
DrawFocusRect
GetParent
DefWindowProcW
DrawTextW
SetScrollRange
SetRectEmpty
wsprintfW
GetSubMenu
GetWindowLongW
SetWindowLongW
SetParent
DeleteMenu
GetDCEx
UnregisterClassW
GetSysColorBrush
DestroyCursor
SetCursorPos
GetFocus
LoadMenuW
LoadCursorW
SetCursor
DrawMenuBar
DefMDIChildProcW
CharUpperW
SetWindowContextHelpId
GetMessageTime
MapDialogRect
GetCursorPos
LockWindowUpdate
ScreenToClient
MessageBoxW
UpdateWindow
IsZoomed
MessageBeep
ShowWindow
EndDeferWindowPos
DestroyWindow
IsWindow
BeginDeferWindowPos
DeferWindowPos
GetMenuItemInfoW
CopyAcceleratorTableW
LoadImageW
CreateMenu
OffsetRect
GetMenuItemCount
LoadBitmapW
SetMenuItemInfoW
InflateRect
AppendMenuW
CopyRect
GetSystemMetrics
DrawEdge
GetSysColor
SystemParametersInfoW
DestroyIcon
DrawStateW
SendMessageW
RedrawWindow
EnableWindow
GetClientRect
GetWindowRect
SetActiveWindow
UnregisterClassA

gdi32

CreatePatternBrush
GetStockObject
DeleteDC
StretchDIBits
SetRectRgn
CombineRgn
GetTextColor
GetRgnBox
ExtSelectClipRgn
SetBkMode
RestoreDC
SaveDC
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetPixel
GetWindowExtEx
GetViewportExtEx
SelectClipRgn
DeleteObject
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
SetMapMode
GetCharWidthW
GetObjectW
CreateEllipticRgn
SetBkColor
SetTextColor
GetClipBox
CreateRectRgn
GetCurrentObject
CreatePen
StretchBlt
CreateDIBitmap
CreateFontW
CreateSolidBrush
LPtoDP
Escape
PtVisible
GetTextExtentPoint32W
GetBkColor
GetMapMode
RectVisible
ExtTextOutW
GetTextMetricsW
GetDeviceCaps
DPtoLP
TextOutW
CreateRectRgnIndirect
CreateBitmap
PatBlt
BitBlt
SelectObject
CreateCompatibleBitmap
Ellipse
CreateFontIndirectW
CreateCompatibleDC

comdlg32

GetFileTitleW
GetOpenFileNameW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

OpenProcessToken
RegDeleteValueW
RegCreateKeyExW
RegCreateKeyW
RegSetValueExW
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyW
RegSetValueW
RegCloseKey
GetSecurityDescriptorDacl
GetSecurityDescriptorOwner
GetNamedSecurityInfoW
MapGenericMask
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
SetNamedSecurityInfoW
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetSidSubAuthorityCount
GetSidSubAuthority
LookupPrivilegeValueW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
GetSidIdentifierAuthority
IsValidSid

shell32

ExtractIconW
SHGetPathFromIDListW
SHGetDesktopFolder
DragAcceptFiles
DragFinish
DragQueryFileW
SHGetFileInfoW
SHBrowseForFolderW

comctl32

ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent

shlwapi

StrRetToStrW
PathRemoveExtensionW
PathFindFileNameW
PathFindExtensionW
PathStripToRootW
PathMatchSpecW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleIsCurrentClipboard
CoRevokeClassObject
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleFlushClipboard
CoTaskMemAlloc
CoTaskMemFree
CoRegisterMessageFilter
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize

oleaut32

SysAllocStringLen
SysAllocString
OleCreateFontIndirect
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroy
VariantCopy
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysFreeString

aclui

ord2

Sections

.text
Size: 560KB - Virtual size: 556KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NIAPSoft AntiRootkit Tools/NIAP_XRay_FileMgr.exe
.exe windows:4 windows x86 arch:x86

cb56e3389dbf05f815b35e0333720025

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\nativeapi\niap_xray_filemgr\release\NIAP_XRay_FileMgr.pdb

Imports

kernel32

GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitProcess
RaiseException
HeapReAlloc
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
GetFileTime
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFileAttributesW
SetErrorMode
lstrlenA
GetFullPathNameW
GetVolumeInformationW
GetCurrentProcess
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetThreadLocale
InterlockedIncrement
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
WritePrivateProfileStringW
GlobalFlags
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FormatMessageW
LocalFree
InterlockedDecrement
lstrlenW
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
MulDiv
GetModuleHandleA
GlobalUnlock
FreeResource
GlobalFree
GlobalAddAtomW
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
GetModuleFileNameW
GetVersion
EnumResourceLanguagesW
lstrcmpA
GetLocaleInfoW
WideCharToMultiByte
CompareStringA
MultiByteToWideChar
InterlockedExchange
GlobalLock
GlobalAlloc
GetFileInformationByHandle
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
FindNextFileW
lstrcmpW
FindClose
FindFirstFileW
GetLastError
SetEvent
CreateEventW
CreateThread
ResetEvent
GetLogicalDriveStringsW
CloseHandle
LockResource
SizeofResource
LoadResource
FindResourceW
GetCurrentProcessId
WaitForSingleObject
GetModuleHandleW
SetLastError
FreeLibrary
GetProcAddress
HeapDestroy
LoadLibraryW

user32

RegisterClipboardFormatW
PostThreadMessageW
LoadCursorW
GetSysColorBrush
DestroyMenu
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SetFocus
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
TrackPopupMenuEx
SetForegroundWindow
UpdateWindow
GetMenu
GetSubMenu
GetMenuItemCount
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
SetWindowContextHelpId
MapDialogRect
SetWindowPos
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
MessageBoxW
SetCursor
SetWindowsHookExW
CallNextHookEx
GetActiveWindow
UnregisterClassW
IsWindowVisible
PeekMessageW
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
CharNextW
CharUpperW
ReleaseCapture
SetCapture
ValidateRect
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
DestroyIcon
GetParent
GetCursorPos
GetSysColor
CreatePopupMenu
CopyRect
LoadIconW
DispatchMessageW
IsIconic
GetMessageW
SendMessageW
AppendMenuW
InvalidateRect
PostMessageW
TranslateMessage
GetKeyState
IsWindow
GetWindow
DrawIcon
GetSystemMenu
EnableWindow
GetFocus
GetClientRect
LoadStringW
GetSystemMetrics
GetMenuItemID
UnregisterClassA

gdi32

RectVisible
ExtSelectClipRgn
DeleteDC
GetStockObject
GetDeviceCaps
CreateRectRgnIndirect
GetBkColor
GetTextColor
GetRgnBox
GetMapMode
PtVisible
GetWindowExtEx
GetViewportExtEx
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
CreateSolidBrush
GetObjectW
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreatePen
SelectObject
DeleteObject
Rectangle
TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegQueryValueW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetFileInfoW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathIsDirectoryW
PathRemoveBackslashW
PathAppendW
PathAddBackslashW
PathIsRootW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathFileExistsW
PathIsUNCW

oledlg

OleUIBusyW

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CLSIDFromProgID
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

VariantCopy
SysAllocString
SafeArrayDestroy
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
SysStringLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SysFreeString

Sections

.text
Size: 272KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NIAPSoft AntiRootkit Tools/NIAP_XRay_System.exe
.exe windows:4 windows x86 arch:x86

6e58517f37a95bcdda008cc1131d527b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

psapi

EnumProcessModules
GetModuleInformation
EnumProcesses
GetModuleFileNameExA

mfc42

ord3825
ord3079
ord4080
ord4627
ord4424
ord3721
ord796
ord795
ord674
ord554
ord529
ord567
ord366
ord807
ord6199
ord2860
ord2116
ord1168
ord2117
ord4457
ord5252
ord4299
ord5030
ord4271
ord2379
ord800
ord858
ord3303
ord3914
ord540
ord1906
ord4275
ord3698
ord765
ord3072
ord1133
ord1930
ord4083
ord1175
ord860
ord3294
ord6069
ord4160
ord4284
ord613
ord537
ord5789
ord289
ord5265
ord4376
ord4853
ord4998
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord641
ord324
ord2302
ord4234
ord2818
ord3996
ord4710
ord4615
ord4612
ord4610
ord4274
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord6215
ord617
ord5301
ord5214
ord296
ord986
ord520
ord4159
ord6117
ord2621
ord1134
ord1825
ord4238
ord4696
ord3058
ord3065
ord6336
ord2510
ord2542
ord5243
ord5740
ord1746
ord5577
ord3172
ord5653
ord4420
ord4953
ord4858
ord2399
ord4387
ord3454
ord3198
ord6080
ord6175
ord4623
ord4426
ord338
ord652
ord3831
ord4614
ord4613
ord1841
ord4241
ord4589
ord4533
ord5076
ord4340
ord4347
ord4889
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord6054
ord5240
ord5281
ord3748
ord2091
ord2587
ord4406
ord3394
ord3729
ord804
ord364
ord784
ord5260
ord4224
ord2864
ord6785
ord5677
ord3495
ord4720
ord2535
ord665
ord1979
ord6385
ord5186
ord354
ord4456
ord5037
ord3302
ord1725
ord4432
ord1576
ord4230
ord5871
ord6197
ord3089
ord1146
ord816
ord4076
ord562
ord2380
ord2567
ord4023
ord2569
ord2714
ord6880
ord755
ord470
ord3220
ord2859
ord1140
ord3663
ord2582
ord4402
ord3640
ord4220
ord2584
ord3654
ord693
ord1644
ord2438
ord4243
ord6907
ord3998
ord6453
ord6696
ord6762
ord5875
ord3301
ord2754
ord5053
ord6270
ord2863
ord3830
ord3402
ord2976
ord3081
ord2985
ord3262
ord3136
ord4465
ord3259
ord3147
ord2982
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6374
ord5163
ord2385
ord5241
ord4407
ord1776
ord4078
ord6055
ord4427
ord4436
ord1665
ord2649
ord5282
ord5237
ord4077
ord4151
ord2878
ord2879
ord3403
ord5472
ord975
ord5012
ord3350
ord4303
ord4467
ord5103
ord5100
ord3059
ord2390
ord2723
ord4242
ord1842
ord823
ord825
ord4823

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_setmbcp
_stricmp
_exit
_onexit
__dllonexit
memmove
sprintf
__CxxFrameHandler
fclose
fopen
_iob
fputs
_vsnprintf
printf
_except_handler3
_mbsicmp
strrchr
_ftol
strtoul
_XcptFilter

kernel32

CreateFileA
GetTickCount
Sleep
GetLastError
WaitForSingleObject
GetFileSize
CloseHandle
DebugBreak
VirtualQueryEx
GetSystemInfo
GetStartupInfoA
GetLocalTime
GetProcAddress
GetModuleHandleA
DeviceIoControl
OutputDebugStringA
ReadFile
WriteFile
SetFilePointer
OpenProcess
GetSystemDirectoryA
CreateMutexA
SizeofResource
LockResource
LoadResource
FindResourceA
GetCurrentProcess
ReleaseMutex
ReadProcessMemory
VirtualProtectEx
TerminateProcess
GetVersionExA
CreateThread

user32

GetDlgCtrlID
LoadMenuA
EnableMenuItem
GetMenuItemID
SetCapture
GetCursorPos
RedrawWindow
LockWindowUpdate
PtInRect
GetClassLongA
FillRect
GetSysColor
DrawFrameControl
ReleaseDC
GetDCEx
InflateRect
CopyRect
SetRectEmpty
DrawEdge
ClientToScreen
SetCursor
DestroyCursor
GetParent
GetWindowRect
LoadCursorA
SetParent
EqualRect
IsWindow
UpdateWindow
SetRect
EnableWindow
IsWindowVisible
SendMessageA
GetClientRect
OffsetRect
ReleaseCapture
GetSubMenu

gdi32

GetTextExtentPoint32A
SelectObject
PatBlt

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ControlService
StartServiceA
QueryServiceStatus
OpenServiceA
DeleteService
OpenSCManagerA
CreateServiceA
CloseServiceHandle

wininet

InternetOpenA
InternetConnectA
InternetCloseHandle
HttpSendRequestA
InternetReadFile
HttpOpenRequestA

shlwapi

SHDeleteKeyA

Sections

.text
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ReadmeNow.txt

Sharing

General

Malware Config

Signatures

Files

c8b6b7a26a15ad057303cf1f967b2c3e

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 16KB - Virtual size: 12KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 984B

.reloc Size: 8KB - Virtual size: 5KB

2d21bab40a4f1d5ea8e1865ddefefe4b

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 29KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 924B

INIT Size: 1024B - Virtual size: 952B

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 2KB - Virtual size: 1KB

32120991d6135761370b746421bbddde

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

aclui

Sections

.text Size: 560KB - Virtual size: 556KB

.rdata Size: 132KB - Virtual size: 131KB

.data Size: 16KB - Virtual size: 37KB

.rsrc Size: 48KB - Virtual size: 44KB

cb56e3389dbf05f815b35e0333720025

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

Sections

.text Size: 272KB - Virtual size: 268KB

.rdata Size: 76KB - Virtual size: 74KB

.data Size: 16KB - Virtual size: 32KB

.rsrc Size: 24KB - Virtual size: 20KB

6e58517f37a95bcdda008cc1131d527b

Headers

File Characteristics

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 984B

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 29KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 924B

INIT
Size: 1024B - Virtual size: 952B

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 560KB - Virtual size: 556KB

.rdata
Size: 132KB - Virtual size: 131KB

.data
Size: 16KB - Virtual size: 37KB

.rsrc
Size: 48KB - Virtual size: 44KB

.text
Size: 272KB - Virtual size: 268KB

.rdata
Size: 76KB - Virtual size: 74KB

.data
Size: 16KB - Virtual size: 32KB

.rsrc
Size: 24KB - Virtual size: 20KB

.text
Size: 48KB - Virtual size: 46KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 80KB - Virtual size: 78KB