b60c71573bc992bc3717c722d27537a5_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

b60c71573bc992bc3717c722d27537a5_JaffaCakes118
Size

2.3MB
MD5

b60c71573bc992bc3717c722d27537a5
SHA1

e81ec404383f0288ea05252e27e8ecb07a78daa0
SHA256

594b17c07cb503de74a9ac9a9cc6c64824cc8c62670a2953497564d8a86a29e0
SHA512

96024ea47dcca52b59dee8fd7b7741eb5b475c99b39c7fc71d3d1511fc255c87ae9dacc5b01a3a619ed4c047ca1dc9fc3d117b6d3ea793d9ffcd4dc1fa720a1a
SSDEEP

49152:PDeQWCHMdT2c2VqHmMJDWVmsQP8d0FwAS+uO5knVlvQh9FRM:beFCHwLdWVmTk0QJ2ml8i

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/TOC.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
b60c71573bc992bc3717c722d27537a5_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/TOC.exe
unpack002/out.upx
unpack001/Uninstall.exe
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/LangDLL.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_1

Files

b60c71573bc992bc3717c722d27537a5_JaffaCakes118
.exe windows:4 windows x86 arch:x86

4d17be67c8d0394c5c1b8e725359ed89

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
CloseHandle
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
MulDiv
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClassA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
wsprintfA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

c4fa86e78b598d87f225e209ba30786f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
PtInRect
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
OpenClipboard

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 994B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

2db813254ea8b4d2a92d703ecb659f39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpynA
lstrcmpA
lstrlenA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA

user32

TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
Help/en/TOC_en_popup_html.js
.js
Help/en/about_topic.htm
Help/en/addremove_topic.htm
Help/en/calen_topic.htm
Help/en/cicon1.gif
.gif
Help/en/cicon2.gif
.gif
Help/en/cicon9.gif
.gif
Help/en/default.css
Help/en/delay.png
.png
Help/en/delay_topic.htm
Help/en/delete.png
.png
Help/en/delete_topic.htm
Help/en/demo.png
.png
Help/en/demo_topic.htm
Help/en/embim1.png
.png
Help/en/embim2.png
.png
Help/en/embim3.png
.png
Help/en/embim4.png
.png
Help/en/enter1.png
.png
Help/en/enter_topic.htm
Help/en/helpman_topicinit.js
.js
Help/en/index.html
.html .js polyglot
Help/en/lang_topic.htm
Help/en/listcycle.png
.png
Help/en/login.png
.png
Help/en/lost_topic.htm
Help/en/main2en.zoom69.png
.png
Help/en/main_topic.htm
Help/en/menu_topic.htm
Help/en/new.png
.png
Help/en/nienie_oeeeeia.htm
Help/en/pass_change.png
.png
Help/en/pass_topic.htm
Help/en/prefs_topic.htm
Help/en/prefss.png
.png
Help/en/print_setup.png
.png
Help/en/print_topic.htm
Help/en/reg_topic.htm
Help/en/registr.png
.png
Help/en/stat_topic.htm
Help/en/statist.png
.png
Help/en/support_topic.htm
Help/en/toc_en_content_dyn.html
Help/en/toc_en_content_static.html
Help/en/toc_en_navigation.js
.js
Help/en/toc_logo_help.png
.png
Help/en/update_topic.htm
Help/en/veden_topic.htm
Help/ru/TOC_popup_html.js
.js
Help/ru/about_topic.htm
Help/ru/addremove_topic.htm
Help/ru/calen_topic.htm
Help/ru/cicon1.gif
.gif
Help/ru/cicon2.gif
.gif
Help/ru/cicon9.gif
.gif
Help/ru/context.png
.png
Help/ru/default.css
Help/ru/delay.png
.png
Help/ru/delay_topic.htm
Help/ru/delete.png
.png
Help/ru/delete_topic.htm
Help/ru/demo.png
.png
Help/ru/demo_topic.htm
Help/ru/embim1.png
.png
Help/ru/embim2.png
.png
Help/ru/embim3.png
.png
Help/ru/enter1.png
.png
Help/ru/enter_topic.htm
Help/ru/helpman_topicinit.js
.js
Help/ru/index.html
.html .js polyglot
Help/ru/lang_topic.htm
Help/ru/listcycle.png
.png
Help/ru/login.png
.png
Help/ru/lost_topic.htm
Help/ru/main.zoom69.png
.png
Help/ru/main_topic.htm
Help/ru/menu_topic.htm
Help/ru/new.png
.png
Help/ru/nienie_oeeeeia.htm
Help/ru/pass_change.png
.png
Help/ru/pass_topic.htm
Help/ru/prefs_topic.htm
Help/ru/prefss.png
.png
Help/ru/print_setup.png
.png
Help/ru/print_topic.htm
Help/ru/reg_topic.htm
Help/ru/registr.png
.png
Help/ru/stat_topic.htm
Help/ru/statist.png
.png
Help/ru/support_topic.htm
Help/ru/toc_content_dyn.html
Help/ru/toc_content_static.html
Help/ru/toc_logo_help.png
.png
Help/ru/toc_navigation.js
.js
Help/ru/update_topic.htm
Help/ru/veden_topic.htm
Resources/ru.mo
TOC.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 593KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

AddTrayItem
AppAutoCloseGetter
AppAutoCloseSetter
AppBalloonHelpVisibleGetter
AppBalloonHelpVisibleSetter
AppDockItemGetter
AppFolderItemGetter
AppGetCurrentEventTime
AppIntegerVersionStuffGetter
AppMenuBarGetter
AppMenuBarSetter
AppSleepCurrentThread
AppStringVersionStuffGetter
AppendStyledTextRun
ApplicationAddMenuHandler
ApplicationAddPollableObject
ApplicationDoSingleEvent
ApplicationFinalizer
ApplicationInitializer
ApplicationNewDocument
ApplicationOpenDocument
ApplicationQuit
ApplicationRemoveAllPollableObjects
ApplicationRemovePollableObject
ArcShapeConstructor
ArcStartAngleSetter
AutoInitDate
BinaryStreamClose
BinaryStreamDestructor
BinaryStreamEOF
BinaryStreamFlush
BinaryStreamGetLength
BinaryStreamGetPosition
BinaryStreamHandleCtor
BinaryStreamHandleGetter
BinaryStreamInitializer
BinaryStreamLastErrorGetter
BinaryStreamRead
BinaryStreamReadBoolean
BinaryStreamReadByte
BinaryStreamReadDouble
BinaryStreamReadFloat
BinaryStreamReadInt16
BinaryStreamReadInt64
BinaryStreamReadInt8
BinaryStreamReadLong
BinaryStreamReadPString
BinaryStreamReadShort
BinaryStreamReadUInt16
BinaryStreamReadUInt32
BinaryStreamReadUInt64
BinaryStreamReadUInt8
BinaryStreamSetLength
BinaryStreamSetPosition
BinaryStreamWrite
BinaryStreamWriteBoolean
BinaryStreamWriteByte
BinaryStreamWriteDouble
BinaryStreamWriteFloat
BinaryStreamWriteInt16
BinaryStreamWriteInt64
BinaryStreamWriteInt8
BinaryStreamWriteLong
BinaryStreamWritePString
BinaryStreamWriteShort
BinaryStreamWriteUInt16
BinaryStreamWriteUInt32
BinaryStreamWriteUInt64
BinaryStreamWriteUInt8
BinaryStringMemoryBlockCtor
BinaryStringStringCtor
BitwiseAnd
BitwiseOr
BitwiseXor
BlowfishDecipher
BlowfishDecipherByBlock
BlowfishEncipher
BlowfishEncipherByBlock
BlowfishInitialize
BooleanObjectHash
BooleanObjectToBoolean
BooleanObjectToColor
BooleanObjectToDouble
BooleanObjectToInt32
BooleanObjectToInt64
BooleanObjectToSingle
BooleanObjectToString
BooleanToVariant
CanvasCreatePane
CheckBoxCreatePane
CheckBoxDataFieldSetter
CheckBoxDataSourceGetter
CheckBoxDataSourceSetter
ClipboardFinalizer
ClipboardInitializer
ColorObjectHash
ColorObjectToBoolean
ColorObjectToColor
ColorObjectToDouble
ColorObjectToInt32
ColorObjectToInt64
ColorObjectToSingle
ColorObjectToString
ColorToVariant
ConsoleApplicationInitializer
ControlAddMenuHandler
ControlClose
ControlInitialParentSetter
ControlPanelIndexGetter
ControlPanelIndexSetter
ControlParentGetter
ControlParentSetter
ControlTabPanelIndexSetter
ControlVisibleSetter
ConvertObjectToBoolean
ConvertObjectToColor
ConvertObjectToCurrency
ConvertObjectToDate
ConvertObjectToDouble
ConvertObjectToInt32
ConvertObjectToInt64
ConvertObjectToSingle
ConvertObjectToString
ConvertObjectToUInt32
ConvertObjectToUInt64
ConvertPtrToMemoryBlock
ConvertStringToWin32KeyCode
ConvertToWin32KeyCode
CreateApplicationClass
CreateArray
CreateControlClasses
CreateInstance
CreateStandAloneWindow
CriticalSectionFinalizer
CriticalSectionInitializer
CriticalSection_TryEnter
CurrencyObjectHash
CurrencyObjectToBoolean
CurrencyObjectToCurrency
CurrencyObjectToDouble
CurrencyObjectToInt32
CurrencyObjectToInt64
CurrencyObjectToSingle
CurrencyObjectToString
CurrencyObjectToUInt32
CurrencyObjectToUInt64
CurrencyToVariant
CursorFieldBooleanValueGetter
CursorFieldBooleanValueSetter
CursorFieldConvertToBoolean
CursorFieldConvertToDate
CursorFieldConvertToDouble
CursorFieldConvertToInt64
CursorFieldConvertToInteger
CursorFieldConvertToString
CursorFieldCurrencyValueGetter
CursorFieldCurrencyValueSetter
CursorFieldInt64ValueGetter
CursorFieldInt64ValueSetter
CursorFieldValueGetter
CursorFieldValueSetter
CursorMoveFirst
CursorMoveLast
CursorMovePrev
CurveGetControlX
CurveGetControlY
CurveOrderSetter
CurveSetControlX
CurveSetControlY
CurveShapeConstructor
CustomControlConstructor
CustomControlCreatePane
CustomControlDestructor
DaemonizeApp
DataControlActionDestructor
DataControlActionPerformAction
DataControlAddNewRecord
DataControlAlignSetter
DataControlAttributeSetter
DataControlCaptionSetter
DataControlClearBoundControls
DataControlColorSetter
DataControlConstructor
DataControlControlBindSetter
DataControlCreatePane
DataControlDBGetter
DataControlDBSetter
DataControlDeleteRecord
DataControlDestructor
DataControlEncodingGetter
DataControlEncodingSetter
DataControlFieldCount
DataControlFontSetter
DataControlGetBoundPart
DataControlGetConstant
DataControlGetCursor
DataControlGetField
DataControlMoveFirst
DataControlMoveLast
DataControlMoveNext
DataControlMovePrev
DataControlMoveTo
DataControlNewRecord
DataControlQuerySetter
DataControlReadOnlySetter
DataControlRecordLockedGetter
DataControlRepopulateData
DataControlRow
DataControlRowCount
DataControlRunQuery
DataControlSizeSetter
DataControlTableNameSetter
DataControlUpdateRecord
DatabaseConnect
DatabaseConstructor
DateCompare
DateFinalizer
DateToVariant
DebugBreakASAP
DebugRuntimeInit
DecodeBackslashEscape
DecodeBackslashEscapeString
DesignAddDataSource
DictionaryLookup
DisableAutoWaitCursor
DisplayObjectContextualMenu
DockItemFinalizer
DockItemIconGraphicsGetter
DockItemIconUpdate
DockItemInitializer
DockItemResetIcon
DoubleObjectHash
DoubleObjectToBoolean
DoubleObjectToColor
DoubleObjectToCurrency
DoubleObjectToDouble
DoubleObjectToInt32
DoubleObjectToInt64
DoubleObjectToSingle
DoubleObjectToString
DoubleObjectToUInt32
DoubleObjectToUInt64
DoubleToVariant
DragItemAddItem
DragItemDrag
DragItemDropHeightSetter
DragItemDropLeftSetter
DragItemDropTopSetter
DragItemDropWidthSetter
DragItemFinalizer
DragItemFolderItemAvailable
DragItemGetMacData
DragItemInitializer
DragItemMacDataAvailable
DragItemNextItem
DragItemPictureAvailable
DragItemSetMacData
DragItemSetPrivateMacData
DragItemTextAvailable
EditAlignmentSetter
EditCreatePane
EditDataFieldSetter
EditDataSourceGetter
EditDataSourceSetter
EditMaskSetter
EditScrollPositionXGetter
EditScrollPositionXSetter
EditSelAlignmentGetter
EditSelAlignmentSetter
EmbedWithin
EmbedWithinControl
EmbedWithinInternal
EmbedWithinPanel
EmbeddedWindowControlFinalizer
EmbeddedWindowControlInitializer
EnableAutoWaitCursor
EnableCoreGraphicsTextOnOSX
EncodeBackslashEscape
EncodeBackslashEscapeString
EncodingsGetFromCode
EncodingsGetter
FPToInt
FigureShapeAddCubic
FigureShapeAddLine
FigureShapeAddQuad
FigureShapeConstructor
FigureShapeDestructor
FileDisplayNameGetter
FileExtensionVisibleGetter
FileExtensionVisibleSetter
FileShellPathGetter
FileURLGetter
FillSpawnTypeTable
FindTrayItemByID
FireApplicationCancelCloseEvent
FireEWindowInitialResizeEvent
FireLineChangedEvent
FireRectControlContextualMenuAction
FireSerialError
FireTrayItemActionEvent
FireWindowContextualMenuAction
FireWindowOpenEvents
FolderChild
FolderItemAppendTextFile
FolderItemCopyCtor
FolderItemCopyFileTo
FolderItemCreateAsFolder
FolderItemCreateBinaryFile
FolderItemCreateTextFile
FolderItemCreateVirtualVolume
FolderItemDelete
FolderItemDestructor
FolderItemDialogFinalizer
FolderItemDialogInitializer
FolderItemDialogShowModal
FolderItemDialogShowWithin
FolderItemFromPath
FolderItemGetImp
FolderItemGetLastError
FolderItemGetPermissions
FolderItemGetRelative
FolderItemGetSaveInfo
FolderItemGroupGetter
FolderItemGroupSetter
FolderItemImpMakeFileExecutable
FolderItemIsCurrentlyReadable
FolderItemIsCurrentlyWriteable
FolderItemItem
FolderItemLaunch
FolderItemLaunchWithParameters
FolderItemMoveFileTo
FolderItemOpenAsCursor
FolderItemOpenAsIcons
FolderItemOpenAsVirtualVolume
FolderItemOpenBinaryFile
FolderItemOpenImage
FolderItemOpenJPEG
FolderItemOpenMovie
FolderItemOpenResourceMovie
FolderItemOpenSound
FolderItemOpenStyledEditField
FolderItemOpenTextFile
FolderItemOpenVectorImage
FolderItemOwnerGetter
FolderItemOwnerSetter
FolderItemPathCtor
FolderItemPathCtorNoParams
FolderItemSaveAsJPEG
FolderItemSaveAsPicture
FolderItemSaveStyledEditField
FolderItemSetLastError
FolderItemSetPermissionsClass
FolderItemSetPermissionsInteger
FolderItemTrueItem
FolderTrueChild
GetAllDirectionsCursor
GetControlHWND
GetControlVisible
GetCopyCursor
GetCursorsClass
GetDatabaseRecordBlobColumn
GetDatabaseRecordBooleanColumn
GetDatabaseRecordCurrencyColumn
GetDatabaseRecordInt64Column
GetDisabledTextColor
GetDocumentsFolder
GetEastWestCursor
GetEncodingFromTEObject
GetEncodingObjectFromCode
GetEncodingsObject
GetEventInstance
GetFingerPointerCursor
GetHandClosedCursor
GetHandOpenCursor
GetIDERegistryKey
GetInterfaceRoutine
GetInvisibleCursor
GetMacInputDriverRef
GetMacOutputDriverRef
GetMagLargeCursor
GetMagSmallCursor
GetNetworkInterfaceObject
GetNorthEastSouthWestCursor
GetNorthSouthCursor
GetNorthWestSouthEastCursor
GetNotAllowedCursor
GetPosixDescriptor
GetShortcutCursor
GetSpecialFolder
GetSpecialFolderFromCode
GetSplitterEastWestCursor
GetSplitterNorthSouthCursor
GetStandardPointerCursor
GetTabPanelVisible
GetTheIBeamCursor
GetWaitCursor
GetWin32DriverHandle
GetWindowContextualMenu
GlobalShowURL
Group2DAppend
Group2DConstructor
Group2DCount
Group2DDestructor
Group2DGetItem
Group2DInsert
Group2DRemoveByIndex
Group2DRemoveByObject
Group2DSetItem
GroupBoxCreatePane
HasMultipleThreads
HasSerialControls
HideMouseCursor
IPCSocketBytesAvailable
IPCSocketBytesLeftToSend
IPCSocketClose
IPCSocketConnect
IPCSocketEOF
IPCSocketFinalizer
IPCSocketFlush
IPCSocketGetHandle
IPCSocketHadError
IPCSocketInitializer
IPCSocketIsConnected
IPCSocketLastErrorGetter
IPCSocketListen
IPCSocketLookahead
IPCSocketPoll
IPCSocketRead
IPCSocketReadAll
IPCSocketWrite
InitMessageDialogClasses
InsertStyledTextRun
Int32ObjectHash
Int32ObjectToBoolean
Int32ObjectToColor
Int32ObjectToCurrency
Int32ObjectToDouble
Int32ObjectToInt32
Int32ObjectToInt64
Int32ObjectToSingle
Int32ObjectToString
Int32ObjectToUInt64
Int32ToVariant
Int64ObjectHash
Int64ObjectToBoolean
Int64ObjectToColor
Int64ObjectToCurrency
Int64ObjectToDouble
Int64ObjectToInt32
Int64ObjectToInt64
Int64ObjectToSingle
Int64ObjectToString
Int64ObjectToUInt32
Int64ObjectToUInt64
Int64ToVariant
IntToFP
IsCMMClick
IsFunctionAvailable
IsNull
KeyChainAddPassword
KeyChainConstructor
KeyChainFindPassword
KeyChainItemAttributeGetter
KeyChainItemAttributeSetter
KeyChainItemConstructor
KeyChainItemDelete
KeyChainItemDestructor
KeyChainLock
KeyChainUnlock
KillAllTrayItems
LineCreatePane
LineStateGetter
LineStateSetter
ListEnableDragReorderSetter
ListboxCreatePane
ListboxDataFieldSetter
ListboxDataSourceGetter
ListboxDataSourceSetter
LoadFunctionPointerFromLibrary
LoadPlugins
LockCFString
LockWString
LookupObjectDefinition
MDBBooleanGetter
MDBBooleanSetter
MDBCaptionGetter
MDBCaptionSetter
MDButtonGetter
MDIWindowConstructor
MDIWindowDestructor
MDIWindowHandleGetter
MDIWindowMaximize
MDIWindowMinimize
MDIWindowPosGetter
MDIWindowPosSetter
MDIWindowRestore
MDIWindowTitleGetter
MDIWindowTitleSetter
MDIWindowVisibleGetter
MDIWindowVisibleSetter

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.exc
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 689KB - Virtual size: 689KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 129KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:4 windows x86 arch:x86

4d17be67c8d0394c5c1b8e725359ed89

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
CloseHandle
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
MulDiv
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClassA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
wsprintfA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

c4fa86e78b598d87f225e209ba30786f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
PtInRect
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
OpenClipboard

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 994B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

2db813254ea8b4d2a92d703ecb659f39

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpynA
lstrcmpA
lstrlenA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
lic_en.txt
lic_ru.txt

Sharing

General

Malware Config

Signatures

Files

4d17be67c8d0394c5c1b8e725359ed89

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 152KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 17KB - Virtual size: 16KB

c4fa86e78b598d87f225e209ba30786f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 994B

2db813254ea8b4d2a92d703ecb659f39

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 681B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 254B

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 512B - Virtual size: 472B

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.2MB

UPX1 Size: 593KB - Virtual size: 596KB

.rsrc Size: 26KB - Virtual size: 28KB

Headers

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 152KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 994B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 681B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 254B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 472B

UPX0
Size: - Virtual size: 2.2MB

UPX1
Size: 593KB - Virtual size: 596KB

.rsrc
Size: 26KB - Virtual size: 28KB

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 16KB - Virtual size: 15KB

.exc
Size: 512B - Virtual size: 340B

.data
Size: 689KB - Virtual size: 689KB

.CRT
Size: 512B - Virtual size: 148B

.rsrc
Size: 26KB - Virtual size: 26KB

.idata
Size: 12KB - Virtual size: 12KB

.bss
Size: - Virtual size: 129KB

.edata
Size: 78KB - Virtual size: 77KB

.reloc
Size: 113KB - Virtual size: 113KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 152KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 994B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 681B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 254B