a8cf970730a2ffdb0e60a4709c229696_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a8cf970730a2ffdb0e60a4709c229696_JaffaCakes118
Size

3.0MB
MD5

a8cf970730a2ffdb0e60a4709c229696
SHA1

d32a9429961ff12c9ed8aef142c11a52627ab087
SHA256

83928bc3c979f90d7c88d678b368c89115177b20072873ad56fa87faba2716c6
SHA512

e8ad69fc83047610e572b8a7a1b2ac91d9c7c7bff99b8f3ec9306570f5c31483a27b7cc45ca20b84651fddd3b8565b6f78b1d1beca978c1758bff9b2e53172cc
SSDEEP

49152:B5nq4DPfDKmxa9LriE9F7l7hPWE2SRzRWngFxYju5hDI0AL3C88h8uWYX1nCYL:Hq4DK6IPiY7l7hPB2SRzRWnWaju5hDy8

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
a8cf970730a2ffdb0e60a4709c229696_JaffaCakes118
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/BASSMOD.dll
unpack001/ReflexiveArcade/ReflexiveArcade.dll
unpack001/around.exe
unpack001/uninst.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

a8cf970730a2ffdb0e60a4709c229696_JaffaCakes118
.exe windows:4 windows x86 arch:x86

1c042238f43557c055fca8642de8a074

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$DESKTOP/ȫ.lnk
.lnk
$PLUGINSDIR/BrandingURL.dll
.dll windows:4 windows x86 arch:x86

135de77644e2add2fd9dd8176740e7e0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GlobalFree

user32

GetWindowRect
SetCapture
InvalidateRect
SendMessageA
GetCapture
ClientToScreen
EnableWindow
LoadImageA
SetPropA
SetWindowLongA
GetWindowLongA
GetDlgItem
PtInRect
ReleaseCapture
SetCursor
GetPropA
CallWindowProcA
RedrawWindow

gdi32

GetObjectA
SetTextColor
CreateFontIndirectA

shell32

ShellExecuteA

Exports

Exports

Set
Unload

Sections

.text
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 839B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SMPROGRAMS/Ʒ/155ɫվ.lnk
.lnk
155ɫվ.lnk
.lnk
BASSMOD.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASSMOD_ErrorGetCode
BASSMOD_Free
BASSMOD_GetCPU
BASSMOD_GetDeviceDescription
BASSMOD_GetVersion
BASSMOD_GetVolume
BASSMOD_Init
BASSMOD_MusicFree
BASSMOD_MusicGetLength
BASSMOD_MusicGetName
BASSMOD_MusicGetPosition
BASSMOD_MusicIsActive
BASSMOD_MusicLoad
BASSMOD_MusicPause
BASSMOD_MusicPlay
BASSMOD_MusicPlayEx
BASSMOD_MusicRemoveSync
BASSMOD_MusicSetAmplify
BASSMOD_MusicSetPanSep
BASSMOD_MusicSetPosition
BASSMOD_MusicSetPositionScaler
BASSMOD_MusicSetSync
BASSMOD_MusicStop
BASSMOD_SetVolume

Sections

Size: 33KB - Virtual size: 240KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Data/Config.Cfg
Data/Resource.Ngr
Data/Sounds/action.wav
Data/Sounds/add_block.wav
Data/Sounds/add_ring.wav
Data/Sounds/alarm.wav
Data/Sounds/click.WAV
Data/Sounds/count_points.wav
Data/Sounds/explosion.wav
Data/Sounds/extra_points.wav
Data/Sounds/fall_down.wav
Data/Sounds/level_over.wav
Data/Sounds/loose.wav
Data/Sounds/rotate_ring.wav
Data/Sounds/smash_ring.wav
Data/Sounds/win.wav
Data/around.ico
Data/cScore.dat
Data/rScore.dat
ReflexiveArcade/Application.dat
ReflexiveArcade/Arcade.dat
ReflexiveArcade/ReflexiveArcade.dll
.dll windows:4 windows x86 arch:x86

1a07be9d954d016ba837689c232e4e2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

GetActiveWindow
wsprintfA
LoadCursorA
SetCursorPos
MessageBoxA
GetDesktopWindow
ClientToScreen
SetForegroundWindow
ShowWindow
SetCursor
SystemParametersInfoA
ScreenToClient
WindowFromPoint
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClipboardFormatA
GetClipboardData
SetTimer
KillTimer
GetCursorPos
GetClientRect

kernel32

SetCurrentDirectoryA
DeviceIoControl
CreateFileA
CloseHandle
GetShortPathNameA
SetPriorityClass
GetCurrentDirectoryA
SizeofResource
LockResource
LoadResource
FindResourceA
GetComputerNameA
GetVersionExA
GetProcAddress
LoadLibraryA
GetLastError
GetModuleFileNameA
OutputDebugStringA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
SetUnhandledExceptionFilter
GetCurrentProcess
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetOEMCP
GetTickCount
GetTempPathA
CreateProcessA
GetExitCodeProcess
IsBadReadPtr
IsBadWritePtr
MulDiv
CreateMutexA
WaitForSingleObject
ReleaseMutex
FileTimeToDosDateTime
GetSystemTimeAsFileTime
FindClose
FindFirstFileA
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
FindNextFileA
GetFileTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
FileTimeToLocalFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetVersion
SetFileAttributesA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
ExitProcess
TerminateProcess
IsBadCodePtr
HeapAlloc
HeapFree
GetCommandLineA
DeleteFileA
SetEndOfFile
InterlockedDecrement
InterlockedIncrement
RtlUnwind
HeapReAlloc
GetModuleHandleA
HeapSize
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
FlushFileBuffers
ReadFile
SetFilePointer
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
RaiseException
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP

advapi32

RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegCreateKeyA

netapi32

Netbios

gdi32

DeleteObject

shell32

ShellExecuteA

Exports

Exports

radll_DrawNextFrameIntoBuffer
radll_EnterMenuSession
radll_GetDLLVersionAsInt
radll_GetDLLVersionAsString
radll_GetLastErrorInformation
radll_GetNumberOfRectsToUpdate
radll_GetUpdateRect
radll_GetValueAsFloat
radll_GetValueAsInt
radll_GetValueAsString
radll_HandleWindowsMessage
radll_HasTheProductBeenPurchased
radll_Initialize
radll_IsASystemUpdateRequired
radll_IsTheMenuSessionComplete
radll_SetPalette
radll_ShutDown

Sections

.text
Size: 728KB - Virtual size: 726KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 705KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Report.html
.html
around.exe
.exe windows:4 windows x86 arch:x86

bccfafbef76010e63f2ff46a66501716

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glRasterPos2i
glGetFloatv
glDisable
glEnd
glBegin
glColor4f
glVertex3f
glTexCoord2f
glBlendFunc
glEnable
glPopMatrix
glCullFace
glMultMatrixf
glPushMatrix
glColor3f
glLineWidth
glHint
glVertex2f
glIsEnabled
glTranslatef
glOrtho
glLoadIdentity
glMatrixMode
glLoadMatrixf
glViewport
glAlphaFunc
glDeleteLists
glCallLists
glListBase
glGenLists
glScalef
glTranslated
glEndList
glNewList
glVertex2i
glLightModeli
glLightfv
glVertex3fv
glBindTexture
glTexImage2D
glRects
wglCreateContext
glGenTextures
glDeleteTextures
wglMakeCurrent
wglDeleteContext
glFlush
glDepthFunc
glColor3ub
glClearColor
glClear
glDepthMask
glPixelZoom
glPixelStorei
glDrawPixels
glCallList
glTexCoord2fv
glNormal3fv
glTexParameterf

glu32

gluBuild2DMipmaps
gluPerspective
gluOrtho2D

winmm

mixerGetNumDevs
waveOutOpen
mixerGetID
waveOutClose
mixerOpen
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetLineInfoA
mixerGetLineControlsA
mixerClose
PlaySoundA
timeGetTime

dsound

ord1

bassmod

BASSMOD_MusicPlay
BASSMOD_MusicPause
BASSMOD_Init
BASSMOD_Free
BASSMOD_MusicStop
BASSMOD_MusicFree
BASSMOD_MusicLoad
BASSMOD_MusicSetSync
BASSMOD_ErrorGetCode
BASSMOD_GetVolume
BASSMOD_SetVolume
BASSMOD_MusicGetPosition
BASSMOD_MusicSetPosition

kernel32

SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
GetDateFormatA
GetTimeFormatA
HeapReAlloc
GetCPInfo
LCMapStringW
GetLastError
LCMapStringA
GetCommandLineA
GetStartupInfoA
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
ExitProcess
HeapFree
IsBadReadPtr
RaiseException
RtlUnwind
MultiByteToWideChar
GetLocaleInfoA
WideCharToMultiByte
VirtualAlloc
IsBadWritePtr
WriteFile
HeapDestroy
HeapCreate
HeapAlloc
VirtualFree
FlushFileBuffers
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
ReadFile
VirtualProtect
GetSystemInfo
VirtualQuery
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
DebugBreak
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
IsBadCodePtr
GetTimeZoneInformation
SetStdHandle
GetACP
GetOEMCP
SetEnvironmentVariableA
GetModuleHandleA
GetLocalTime
UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingA
GetFileSize
CreateFileA
GetVersionExA
DeleteFileA
SetFileAttributesA
FindClose
FindNextFileA
MoveFileA
SetEndOfFile
RemoveDirectoryA
GetProcAddress
FreeLibrary
LoadLibraryA
GetModuleFileNameA
GetProcessHeap
GetLocaleInfoW
FindFirstFileA

user32

ShowWindow
DestroyWindow
SetFocus
SetForegroundWindow
SetWindowPos
GetWindowRect
PostQuitMessage
DispatchMessageA
TranslateMessage
PeekMessageA
ReleaseCapture
SetCapture
DefWindowProcA
MessageBoxA
wvsprintfA
ShowCursor
GetDesktopWindow
RegisterClassExA
EnumDisplaySettingsA
GetDC
UnregisterClassA
AdjustWindowRectEx
CreateWindowExA
SetWindowLongA
ChangeDisplaySettingsA
GetSystemMetrics
LoadIconA
LoadCursorA
RegisterClassA
GetWindowLongA
ReleaseDC

gdi32

DescribePixelFormat
ChoosePixelFormat
SwapBuffers
SetPixelFormat

advapi32

CryptCreateHash
CryptAcquireContextA
CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA

shell32

ShellExecuteA

Sections

.text
Size: 452KB - Virtual size: 449KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FFF
Size: 256B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
help.chm
.chm
uninst.exe
.exe windows:4 windows x86 arch:x86

1c042238f43557c055fca8642de8a074

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

Files

1c042238f43557c055fca8642de8a074

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 3KB - Virtual size: 112KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 28KB - Virtual size: 28KB

135de77644e2add2fd9dd8176740e7e0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 992B

.rdata Size: 1024B - Virtual size: 839B

.data Size: 512B - Virtual size: 336B

.reloc Size: 512B - Virtual size: 220B

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 33KB - Virtual size: 240KB

Size: 2KB - Virtual size: 1KB

1a07be9d954d016ba837689c232e4e2c

Headers

File Characteristics

Imports

user32

kernel32

advapi32

netapi32

gdi32

shell32

Exports

Exports

Sections

.text Size: 728KB - Virtual size: 726KB

.rdata Size: 72KB - Virtual size: 70KB

.data Size: 80KB - Virtual size: 705KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 112KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 28KB - Virtual size: 28KB

.text
Size: 1024B - Virtual size: 992B

.rdata
Size: 1024B - Virtual size: 839B

.data
Size: 512B - Virtual size: 336B

.reloc
Size: 512B - Virtual size: 220B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 728KB - Virtual size: 726KB

.rdata
Size: 72KB - Virtual size: 70KB

.data
Size: 80KB - Virtual size: 705KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 56KB - Virtual size: 53KB

.text
Size: 452KB - Virtual size: 449KB

.rdata
Size: 76KB - Virtual size: 72KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 8KB - Virtual size: 7KB

.FFF
Size: 256B - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 3KB - Virtual size: 112KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 28KB - Virtual size: 28KB