b820642202b4f50fa03f53459fc31a43_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b820642202b4f50fa03f53459fc31a43_JaffaCakes118
Size

3.9MB
MD5

b820642202b4f50fa03f53459fc31a43
SHA1

39e249d14c4fe15a8be273815ae5eaea5f1f71d1
SHA256

d299d0f0ed73161e4934a8a1ab84397b5bdc2b2270d2e6a06480d9ac8094db03
SHA512

6f927008f1e07e446d26466db210a74a12fd1120e049e139358a9988ecaec2a945da0a14add4c8671c507b62864e4037d6a9a083e6f838e999d5da348bde4b72
SSDEEP

98304:wPMtAruNuWBSidGrU57bq9M4YTWV18UYrynKYzA:wPMyCsWEidGrU5S9M4nj8UjnxA

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/StartMenu.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$R0
unpack002/au32.exe
unpack001/KeyMaker.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/Ace.Optimizer.Utilities.exe	nsis_installer_1
static1/unpack001/Ace.Optimizer.Utilities.exe	nsis_installer_2

Files

b820642202b4f50fa03f53459fc31a43_JaffaCakes118
.rar
Ace.Optimizer.Utilities.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:1e:d9:dd:95:c5:4c:fb:ad:be:25:4f:a7:38:18:26
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

06/11/2007, 00:00

Not After

26/12/2008, 23:59

Subject

CN=Acelogix Software,OU=SECURE APPLICATION DEVELOPMENT,O=Acelogix Software,L=Trivandrum,ST=Kerala,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

2f:a9:45:40:c1:b1:2a:e5:3e:ad:4b:25:51:ba:79:3b:6d:09:73:14
Signer

Actual PE Digest

2f:a9:45:40:c1:b1:2a:e5:3e:ad:4b:25:51:ba:79:3b:6d:09:73:14

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA

user32

TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioC.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$R0
.dll windows:5 windows x64 arch:x64

ce556fdd7315e56499fc84d4df3915ac

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GlobalFindAtomW
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
HeapAlloc
HeapFree
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapReAlloc
ExitProcess
ExitThread
CreateThread
HeapSize
HeapQueryInformation
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetVersionExA
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
GlobalFlags
WritePrivateProfileStringW
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
TlsGetValue
LocalAlloc
GetCurrentProcessId
GlobalAddAtomW
SuspendThread
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetModuleFileNameW
lstrcmpA
GetLocaleInfoW
lstrcmpW
GetModuleHandleW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
CreateEventW
CreateDirectoryW
GetCurrentProcess
GetFileTime
GetVolumeInformationW
GetFileAttributesW
SetLastError
SetEndOfFile
GetFileSize
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
LocalFree
FormatMessageW
MultiByteToWideChar
lstrlenA
CreateFileW
DeviceIoControl
ReadFile
GetLastError
CloseHandle
VirtualFree
GetShortPathNameW
VirtualAlloc
GetDiskFreeSpaceW
WideCharToMultiByte
lstrlenW
GetProcAddress
LoadLibraryW
RemoveDirectoryW
DeleteFileW
SetFileAttributesW
GetExitCodeThread
lstrcpynW
GetCurrentThreadId
FindClose
FindNextFileW
FindFirstFileW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
MoveFileW
GetVersionExW
FreeLibrary
SetEvent
TerminateThread
lstrcpynA
FlushFileBuffers
WriteFile
WaitForSingleObject
SetFilePointer
ResetEvent
GetTickCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetACP
InitializeCriticalSection

user32

DestroyMenu
ShowWindow
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
CopyRect
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
GetDlgCtrlID
GetWindowRect
GetClassNameW
PtInRect
SetWindowTextW
LoadCursorW
GetSystemMetrics
GetSysColorBrush
PostMessageW
IsWindow
GetWindowTextW
GetSysColor
ReleaseDC
GetDC
ClientToScreen
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
UnregisterClassW
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
PostQuitMessage
UnhookWindowsHookEx
ValidateRect
GetCursorPos
PeekMessageW
GetKeyState
SendMessageW
IsWindowVisible
GetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
CallNextHookEx
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
SetCursor
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
ModifyMenuW
EnableMenuItem
CheckMenuItem
SetWindowsHookExW
GetClassInfoW

gdi32

TextOutW
GetStockObject
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
GetDeviceCaps
RectVisible
PtVisible
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
ExtTextOutW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken

shlwapi

PathFindFileNameW
PathFindExtensionW

oleaut32

VariantClear
VariantChangeType
VariantInit

Exports

Exports

wipeAlloc
wipeCheck
wipeFolder
wipeFree
wipeGetAttr
wipeGetInfo
wipeGetResult
wipeGetString
wipeInit
wipeItem
wipeSetAttr
wipeStart
wipeStop
wipeUninit

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Balloon.wav
Command.wav
Data/Ignore_Dup/ignorelist.ini
Data/Ignore_Junk/Microsoft Publisher.ini
Data/Ignore_Junk/New2.41.ini
Data/Ignore_Junk/New3.ini
Data/Ignore_Junk/New4.ini
Data/Ignore_Junk/aceignore_junk.ini
Data/Ignore_Junk/additional.ini
Data/Ignore_Junk/hp.ini
Data/Ignore_Junk/mozilla.ini
Data/Ignore_Junk/new2.2.ini
Data/Ignore_Junk/new2.5.ini
Data/Ignore_Junk/powertech.ini
Data/Ignore_Junk/vista.ini
Data/Ignore_Reg/AFTERXP.INI
Data/Ignore_Reg/AFTERXPsp3.INI
Data/Ignore_Reg/Acrobat.dat
Data/Ignore_Reg/Autocad.dat
Data/Ignore_Reg/Careful241.ini
Data/Ignore_Reg/Careful3.ini
Data/Ignore_Reg/Diskeeper.dat
Data/Ignore_Reg/Dont Scan.ini
Data/Ignore_Reg/Easy CD Creator.dat
Data/Ignore_Reg/Easy media Creator.dat
Data/Ignore_Reg/Encarta.dat
Data/Ignore_Reg/Flash Player.dat
Data/Ignore_Reg/Genie Backup Manager.dat
Data/Ignore_Reg/HP fax machine.ini
Data/Ignore_Reg/IE7.dat
Data/Ignore_Reg/Kinko File Prep Tool.dat
Data/Ignore_Reg/MS DotNet.dat
Data/Ignore_Reg/MS Office.dat
Data/Ignore_Reg/MS Publisher.dat
Data/Ignore_Reg/MS VisualStudioNet.dat
Data/Ignore_Reg/MSN.dat
Data/Ignore_Reg/McAfee.dat
Data/Ignore_Reg/Microsoft Money.dat
Data/Ignore_Reg/New4.ini
Data/Ignore_Reg/Norton AntiVirus.dat
Data/Ignore_Reg/Norton Internet Security.dat
Data/Ignore_Reg/ORACLE.dat
Data/Ignore_Reg/Paint Shop Pro.dat
Data/Ignore_Reg/Panda AV.dat
Data/Ignore_Reg/PhotoShop.dat
Data/Ignore_Reg/PowerArchiver.dat
Data/Ignore_Reg/StandardScanOnly.ini
Data/Ignore_Reg/THE BAT!.dat
Data/Ignore_Reg/WS_FTP Pro.dat
Data/Ignore_Reg/Windows Desktop Search.dat
Data/Ignore_Reg/afterVista.ini
Data/Ignore_Reg/apps.ini
Data/Ignore_Reg/careful.ini
Data/Ignore_Reg/careful2.ini
Data/Ignore_Reg/dangerous.ini
Data/Ignore_Reg/roxio.dat
Data/Ignore_Reg/shlext_approved.ini
Data/Ignore_Reg/wordperfect.dat
Data/Info.ini
Data/RegFixer/ignorefolders.ini
Data/RegFixer/ignorekeys.ini
Data/ignore_empty/ignore.ini
Data/startup.dat
Default.wav
History.txt
Plugins/7-Zip Compression.aup
Plugins/ACDSee 4.x.aup
Plugins/ACDSee 5.aup
Plugins/AOL 7.0 Chat Log.aup
Plugins/AOL Instant Messenger.aup
Plugins/AX-Icons 4.x.aup
Plugins/AbsoluteFTP.aup
Plugins/Acon Digital Media Acoustica 3.aup
Plugins/Acoustica CD Label Maker.aup
Plugins/Ad-Aware.aup
Plugins/Adaptec Easy CD Creator.aup
Plugins/AddSoft Log Files.aup
Plugins/AddWeb.aup
Plugins/Adobe Acrobat Full 4.aup
Plugins/Adobe Acrobat Reader 3.x.aup
Plugins/Adobe Acrobat Reader 4.0.aup
Plugins/Adobe Acrobat Reader 5.aup
Plugins/Adobe Acrobat Reader 6.aup
Plugins/Advanced Disk Catalog.aup
Plugins/Advanced MP3 Catalog.aup
Plugins/Agent NewsReader.aup
Plugins/Alcohol MRU.aup
Plugins/AltaVista Toolbar.aup
Plugins/Audio CD Info.aup
Plugins/AudioCatalyst.aup
Plugins/Avant Browser History.aup
Plugins/AwIcons.aup
Plugins/Axialis Icon Workshop.aup
Plugins/Axialis Media Browser.aup
Plugins/Babylon Builder.aup
Plugins/Babylon.aup
Plugins/BearShare.aup
Plugins/Beyond Compare 2.x.aup
Plugins/BookReader.aup
Plugins/Borland Delphi.aup
Plugins/CRT.aup
Plugins/Cabinet Manager.aup
Plugins/Chameleon Web Browser.aup
Plugins/CoffeeCup DirectFTP.aup
Plugins/Coffeecup Gif Animator.aup
Plugins/Conexware PowerArchivier 8.6.aup
Plugins/CoolEditPro.aup
Plugins/Cute MX.aup
Plugins/CuteFTP 4.0 .aup
Plugins/CuteHtml.aup
Plugins/Disk Explorer Professional.aup
Plugins/Diskeeper.aup
Plugins/Divx Player.aup
Plugins/Download Accelerator (DAP).aup
Plugins/Dreamweaver 3.aup
Plugins/Dreamweaver Ultradev_4.aup
Plugins/Easy CD Creator.aup
Plugins/Easy Icon Maker.aup
Plugins/Ebay Toolbar.aup
Plugins/EditPad.aup
Plugins/EditPlus.aup
Plugins/Enigma Browser.aup
Plugins/Eudora Mail.aup
Plugins/FAR.aup
Plugins/FTP Explorer.aup
Plugins/FTP Voyager.aup
Plugins/Flash5.aup
Plugins/FlashGet(JetCar).aup
Plugins/Fotostation.aup
Plugins/Free Download Manager.aup
Plugins/FreeCell Statistics.aup
Plugins/Fun CD.aup
Plugins/GO!ZLLA.aup
Plugins/Gamani GIF Movie Gear 3.aup
Plugins/Game Maker 4.3c.aup
Plugins/GetRight 4x.aup
Plugins/Goldwave.aup
Plugins/Google DeskBar.aup
Plugins/Google Tool Bar.aup
Plugins/Google Video Player.aup
Plugins/Gravity Newsreader.aup
Plugins/HEX Workshop 4.2.aup
Plugins/Homesite (Allaire).aup
Plugins/HotJava Browser.aup
Plugins/Html Help Workshop.aup
Plugins/ICQ 2000.aup
Plugins/IE Default Download Dir.aup
Plugins/IZArc.aup
Plugins/Imaging.aup
Plugins/Indigo Rose Setup Factory 6.0.aup
Plugins/Inoculatelt PE Virus Scan.aup
Plugins/InterQuick.aup
Plugins/Internet Download Manager.aup
Plugins/Irfanview3.aup
Plugins/Jasc Animation Shop 3.aup
Plugins/Jet Photo Shell.aup
Plugins/K-Lite Codec Pack.aup
Plugins/KaZaA.aup
Plugins/Kazaa media desktop.aup
Plugins/LView Pro.aup
Plugins/LeapFTP.aup
Plugins/Letterbox.aup
Plugins/MEDA MP3 Splitter.aup
Plugins/MS Media Player 7.aup
Plugins/MS Media Player 9.aup
Plugins/MS Movie Maker.aup
Plugins/MSN Messenger.txt
Plugins/MSN Tool Bar.aup
Plugins/MacroMedia Dreamweaver MX.aup
Plugins/MacroMedia Firework MX.aup
Plugins/MacroMedia Flash MX.aup
Plugins/Magic ISO Maker.aup
Plugins/Mass Download.aup
Plugins/MasterSplitter.aup
Plugins/McAfee Virus Scan.aup
Plugins/Media Player 6.0.aup
Plugins/Metapad.aup
Plugins/MicroAngelo.aup
Plugins/Micrografx Picture Publisher.aup
Plugins/Microsoft Netmeeting.aup
Plugins/Microsoft Office InfoPath.aup
Plugins/Microsoft Photo Editor_3.aup
Plugins/Microsoft PictureIt.aup
Plugins/Microsoft Windows Media Player 8.aup
Plugins/Microsoft Works.aup
Plugins/Miranda ICQ.aup
Plugins/Morpheus.aup
Plugins/Mozart 4.aup
Plugins/MusicMatch Jukebox.aup
Plugins/Naviscope.aup
Plugins/Negatory Assembly Studio 1.0.aup
Plugins/Nero - Burning ROM.aup
Plugins/NetAnts.aup
Plugins/NetCaptor.aup
Plugins/Netsonic.aup
Plugins/Netzip.aup
Plugins/NewsBin.aup
Plugins/Norton Anti-Virus.aup
Plugins/Norton File Manager.aup
Plugins/NortonAV2000.aup
Plugins/NortonCom.aup
Plugins/NotePad Plus.aup
Plugins/NoteTab Light.aup
Plugins/NoteTab Pro.aup
Plugins/Notepad2.aup
Plugins/Office 2003.aup
Plugins/Office 2007.aup
Plugins/Office XP.aup
Plugins/Office2000.aup
Plugins/Office97.aup
Plugins/OmniPage.aup
Plugins/Opera6.aup
Plugins/Opera7.aup
Plugins/PE Explorer.aup
Plugins/PKZip for Windows.aup
Plugins/Paint Shop Pro 5.x.aup
Plugins/Paint Shop Pro 6.x.aup
Plugins/Paint Shop Pro 7.x.aup
Plugins/PasswordSafe.aup
Plugins/Personal Ancestral File.aup
Plugins/PhotoDraw.aup
Plugins/PhotoExpress.aup
Plugins/PhotoImpact.aup
Plugins/Photocanvas.aup
Plugins/Photoshop 50.aup
Plugins/Photoshop 55.aup
Plugins/Photoshop 6.aup
Plugins/Photoshop 7.aup
Plugins/PicoZip.aup
Plugins/PolyView.aup
Plugins/PopUpCop.aup
Plugins/Popup Purger.aup
Plugins/PowerArchiver.aup
Plugins/PowerDVD.aup
Plugins/PowerDesk.aup
Plugins/PowerZip.aup
Plugins/QuickTime.aup
Plugins/RealNetworks Real Download.aup
Plugins/RealOne Player.aup
Plugins/RealPlayer.aup
Plugins/RealVNC.aup
Plugins/SWiSH.aup
Plugins/Smart Explorer.aup
Plugins/Sonique.aup
Plugins/Spinner Plus.aup
Plugins/Spybot.aup
Plugins/Star Downloader.aup
Plugins/StarOffice.aup
Plugins/SunJavaCache.aup
Plugins/Sygate Personal Firewall.aup
Plugins/System Mechanic 4 Pro.aup
Plugins/System Mechanic 4.aup
Plugins/System Mechanic3.aup
Plugins/Teleport Pro.aup
Plugins/Tennyson Maxwell Teleport Pro 1.29.aup
Plugins/TextPad_4.x.aup
Plugins/The Playe.aup
Plugins/Trillian.aup
Plugins/Ulead GIF Animator.aup
Plugins/Ultimate Paint.aup
Plugins/Ultra Edit.aup
Plugins/UltraISO.aup
Plugins/Visual Studio 6.aup
Plugins/WINRAR.AUP
Plugins/WebFerret.aup
Plugins/WinAce.aup
Plugins/WinME Regedit Recent Key.aup
Plugins/WinZip.aup
Plugins/Winamp.aup
Plugins/Windows Commander.aup
Plugins/Windows Logs.aup
Plugins/Windows Paint.aup
Plugins/Windows Word Pad.aup
Plugins/Wordperfect10.aup
Plugins/Xara 3D.aup
Plugins/XingMp3 Player.aup
Plugins/XnView.aup
Plugins/Xnews.aup
Plugins/Xolox.aup
Plugins/Yahoo! Messenger.aup
Plugins/Yahoo! Toolbar.aup
Plugins/YahooPlayer.aup
Plugins/Yamaha XG.aup
Plugins/ZipMagic.aup
Plugins/ZoneAlarm.aup
Plugins/eMule.aup
Plugins/uTorrent.aup
au.chm
.chm
au.exe
.exe windows:5 windows x64 arch:x64

b49ccc959843da7c245f6e7a08fad245

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:1e:d9:dd:95:c5:4c:fb:ad:be:25:4f:a7:38:18:26
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

06/11/2007, 00:00

Not After

26/12/2008, 23:59

Subject

CN=Acelogix Software,OU=SECURE APPLICATION DEVELOPMENT,O=Acelogix Software,L=Trivandrum,ST=Kerala,C=IN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

e7:c8:13:aa:98:27:98:e9:e4:bd:ff:6a:35:db:ed:81:3b:5e:db:3e
Signer

Actual PE Digest

e7:c8:13:aa:98:27:98:e9:e4:bd:ff:6a:35:db:ed:81:3b:5e:db:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
CreateThread
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
WideCharToMultiByte
IsBadReadPtr
GlobalAddAtomA
GlobalAddAtomW
GlobalFree
GlobalGetAtomNameA
GlobalDeleteAtom
GlobalGetAtomNameW
GetLastError
FreeConsole
GetEnvironmentVariableA
VirtualProtect
VirtualAlloc
GetProcAddress
LoadLibraryA
SetLastError
CreateProcessA
GetCommandLineA
GetStartupInfoA
SetEnvironmentVariableA
ReleaseMutex
WaitForSingleObject
CreateMutexA
OpenMutexA
GetCurrentThreadId
ReadFile
GetFileSize
CreateFileA
FindClose
FindFirstFileA
FindFirstFileW
ExitProcess
GetLocalTime
Sleep
CompareStringA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapReAlloc
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
HeapCreate
HeapSetInformation
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
CompareStringW
RtlUnwindEx
IsDebuggerPresent
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
InitializeCriticalSection
GetCurrentProcessId
GetModuleFileNameW
GetShortPathNameW
GetModuleFileNameA
GetShortPathNameA
GetModuleHandleA
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetDateFormatA
GetTimeFormatA
HeapFree
HeapAlloc
GetProcessHeap
GetCPInfo
GetACP
GetOEMCP
FlsGetValue
FlsSetValue
TlsFree
FlsFree
FlsAlloc
RaiseException
RtlPcToFileHeader
WriteFile
GetStdHandle

user32

BeginPaint
EndPaint
KillTimer
GetAsyncKeyState
SetTimer
LoadStringA
LoadStringW
FindWindowA
WaitForInputIdle
DestroyWindow
SetWindowTextA
GetDlgItem
CreateDialogIndirectParamA
ShowWindow
UpdateWindow
InSendMessage
UnpackDDElParam
FreeDDElParam
DefWindowProcA
LoadCursorA
RegisterClassW
CreateWindowExW
RegisterClassA
CreateWindowExA
GetWindowThreadProcessId
SendMessageW
SendMessageA
PeekMessageA
TranslateMessage
DispatchMessageA
EnumWindows
IsWindowUnicode
PackDDElParam
PostMessageW
PostMessageA
IsWindow
MessageBoxA
GetSystemMetrics

gdi32

SelectObject
BitBlt
DeleteObject
CreatePalette
CreateDCA
SelectPalette
RealizePalette
CreateDIBitmap
DeleteDC
CreateCompatibleDC

Sections

.text
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 704KB - Virtual size: 703KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text1
Size: 144KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 4KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 60KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata1
Size: 8KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata2
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc1
Size: 452KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
au32.exe
.exe windows:5 windows x86 arch:x86

4b5c3bdd306e1e18721449d15844edfe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

Q:\Vista\Ace Utilities\More\au32\Release\au32.pdb

Imports

kernel32

GetModuleHandleA
GetProcAddress
GetCommandLineA
CreateFileMappingW
MapViewOfFile
OpenEventW
CreateEventW
SetEvent
lstrcatA
UnmapViewOfFile
CloseHandle
lstrcmpA
GetVersionExA
MultiByteToWideChar
lstrcpyA
lstrlenA
WaitForSingleObject
lstrcmpiA
LocalAlloc
FreeLibrary
InterlockedExchange
GetLastError
LoadLibraryA
RaiseException
GetStartupInfoA
HeapAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount

user32

CharNextA
wsprintfA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 556B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
clearpasticonhistory.vbs
.vbs
createsrpoint.vbs
.vbs
readme.txt
KeyMaker.exe
.exe windows:4 windows x86 arch:x86

8a724c4e7c32c1f1f5d2eb0337f1399b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetProcessHeap
GetStartupInfoA
GetModuleHandleA
CreateThread
WaitForSingleObject
CloseHandle
Sleep
LocalFree
lstrcpyA
FindResourceA
LoadResource
SizeofResource
GlobalAlloc
LockResource
GlobalLock
GlobalUnlock
LocalAlloc
GlobalFree
lstrlenA
HeapAlloc

user32

CloseClipboard
MessageBoxA
CopyImage
EmptyClipboard
OpenClipboard
ReleaseDC
SendMessageA
CreateWindowExA
UpdateWindow
InvalidateRect
DefWindowProcA
SetDlgItemTextA
GetWindowTextA
GetWindowTextLengthA
PostMessageA
SendDlgItemMessageA
SetTimer
SetFocus
GetDlgItem
LoadIconA
LoadCursorA
RegisterClassExA
GetSystemMetrics
AdjustWindowRect
ShowWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetLayeredWindowAttributes
DestroyWindow
BeginPaint
GetSysColorBrush
FillRect
GetSysColor
EndPaint
PostQuitMessage
GetDC
SetClipboardData

gdi32

TextOutA
SetBkMode
DeleteDC
RestoreDC
BitBlt
DeleteObject
CreateCompatibleBitmap
SaveDC
CreateCompatibleDC
GetObjectA
CreateFontIndirectA
SelectObject
SetTextColor
GetTextExtentPoint32A

ole32

CreateStreamOnHGlobal

oleaut32

OleLoadPicture

comctl32

ord17

winmm

waveOutPrepareHeader
waveOutClose
waveOutWrite
waveOutUnprepareHeader
waveOutOpen

wsock32

ntohs
ntohl

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strncmp
??2@YAPAXI@Z
strcat
strchr
strcpy
memset
memcpy
free
time
strlen
sprintf
_timezone
malloc
__set_app_type
_except_handler3
_controlfp
_putenv
__p__fmode

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

72:1e:d9:dd:95:c5:4c:fb:ad:be:25:4f:a7:38:18:26Certificate

Extended Key Usages

2f:a9:45:40:c1:b1:2a:e5:3e:ad:4b:25:51:ba:79:3b:6d:09:73:14Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 48KB

.rsrc Size: 29KB - Virtual size: 28KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

7868cd55f358bfb360f9eb8ce1512ca0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

.reloc Size: 512B - Virtual size: 472B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

72:1e:d9:dd:95:c5:4c:fb:ad:be:25:4f:a7:38:18:26
Certificate

2f:a9:45:40:c1:b1:2a:e5:3e:ad:4b:25:51:ba:79:3b:6d:09:73:14
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 48KB

.rsrc
Size: 29KB - Virtual size: 28KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 512B - Virtual size: 472B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 211KB - Virtual size: 211KB

.rdata
Size: 82KB - Virtual size: 81KB

.data
Size: 11KB - Virtual size: 35KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 14KB - Virtual size: 14KB

.reloc
Size: 10KB - Virtual size: 9KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

72:1e:d9:dd:95:c5:4c:fb:ad:be:25:4f:a7:38:18:26
Certificate

e7:c8:13:aa:98:27:98:e9:e4:bd:ff:6a:35:db:ed:81:3b:5e:db:3e
Signer

.text
Size: - Virtual size: 1.8MB

.rdata
Size: 704KB - Virtual size: 703KB

.data
Size: - Virtual size: 68KB

.pdata
Size: - Virtual size: 132KB

.tls
Size: - Virtual size: 2KB

.text1
Size: 144KB - Virtual size: 192KB

.adata
Size: 4KB - Virtual size: 64KB

.data1
Size: 60KB - Virtual size: 64KB

.pdata1
Size: 8KB - Virtual size: 64KB

.rsrc
Size: 4KB - Virtual size: 128KB

.pdata2
Size: 1.2MB - Virtual size: 1.2MB

.rsrc1
Size: 452KB - Virtual size: 1.1MB

.text
Size: 34KB - Virtual size: 34KB