cdff1b9707b2f9831fd6b3b2782fcdd4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

cdff1b9707b2f9831fd6b3b2782fcdd4_JaffaCakes118
Size

2.6MB
MD5

cdff1b9707b2f9831fd6b3b2782fcdd4
SHA1

df32c3110cdfed8c78f272d40aefe252b6b2c413
SHA256

74f67ef57041294388d2fb0bedb5dfb08a57d0608909fc07c3707f7942fe9ba9
SHA512

cee5fc1a1bc1763d5fec8033f2d718ae6fb18686da38936071b0f511fb4592670296f452fc975b6fa0ba02d2e2fe5b73bc60354d43f29efa128bcdbca076faf0
SSDEEP

49152:JPLJ4bdnPPFgIGkQK3HTVFMHIJ8BZIZuphCgtXgrqfe9Se9wjXgtVARGMqy:JN4hn3FgIGkDzfMHUeZWup8IQrqfR2VC

Score

3^/10

Malware Config

Signatures

Unsigned PE 16 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CardReader/MS/rimsptsk.sys
unpack001/CardReader/MS/snymsico.dll
unpack001/CardReader/MSx64/Rimspx64.sys
unpack001/CardReader/MSx64/snymsico.dll
unpack001/CardReader/SDMMC/rimmptsk.sys
unpack001/CardReader/SDMMCx64/rimmpx64.sys
unpack001/CardReader/XD/RixDICON.dll
unpack001/CardReader/XD/rixdptsk.sys
unpack002/DotNetInstaller.exe
unpack002/IScript.dll
unpack002/IUser.dll
unpack002/ctor.dll
unpack002/ikernel.dll
unpack002/objectps.dll
unpack001/CardReader/xDx64/RixDICON.dll
unpack001/CardReader/xDx64/Rixdpx64.sys

Files

cdff1b9707b2f9831fd6b3b2782fcdd4_JaffaCakes118
.zip
CardReader/MS/rimsptsk.cat
CardReader/MS/rimsptsk.inf
CardReader/MS/rimsptsk.sys
.sys windows:6 windows x86 arch:x86

afb16ba7eb532fecc5ae0dcc3a2f2233

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\12setsu\ricohdriver\x86\ms_src\src\objfre_wlh_x86\i386\rimsptsk.pdb

Imports

ntoskrnl.exe

ObfReferenceObject
IofCallDriver
KeSetEvent
MmUnmapIoSpace
IoSetDeviceInterfaceState
ZwClose
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeInitializeEvent
IoRegisterDeviceInterface
MmMapIoSpace
IoReleaseRemoveLockEx
IoInvalidateDeviceRelations
swprintf
IoAcquireRemoveLockEx
KeClearEvent
PoSetPowerState
PoCallDriver
PoStartNextPowerIrp
memcpy
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
IoCreateDevice
IoFreeIrp
IoAllocateIrp
KeDelayExecutionThread
MmGetPhysicalAddress
READ_REGISTER_BUFFER_ULONG
KeSetTimer
ObfDereferenceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
PsCreateSystemThread
IoDisconnectInterrupt
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
IoConnectInterrupt
KeInitializeDpc
KeInitializeTimer
KeReleaseInterruptSpinLock
KeAcquireInterruptSpinLock
IoCreateNotificationEvent
KeTickCount
KeBugCheckEx
memset
ExAllocatePoolWithTag
RtlQueryRegistryValues
ExFreePoolWithTag
PoRequestPowerIrp
IofCompleteRequest

hal

KfReleaseSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfAcquireSpinLock

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 487B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/MS/snymsico.dll
.dll windows:4 windows x86 arch:x86

46039de89f8560750f5a6dacd1c7a453

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
GetCommandLineA
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/MSx64/Rimspx64.sys
.sys windows:6 windows x64 arch:x64

42586653c1379eec055f967aa30cc377

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\12setsu\ricohdriver\x64_src\ms_x64_src\src\objfre_wlh_amd64\amd64\Rimspx64.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
RtlQueryRegistryValues
ExAllocatePool
IofCompleteRequest
IoDetachDevice
MmUnmapIoSpace
IoSetDeviceInterfaceState
RtlInitUnicodeString
ObfReferenceObject
IoDeleteDevice
KeSetEvent
swprintf
KeInitializeEvent
ZwQueryValueKey
ExAllocatePoolWithTag
IoAcquireRemoveLockEx
ZwSetValueKey
IoReleaseRemoveLockEx
IofCallDriver
MmMapIoSpace
IoInvalidateDeviceRelations
ZwClose
ZwCreateKey
ZwOpenKey
KeWaitForSingleObject
IoRegisterDeviceInterface
KeClearEvent
ExReleaseFastMutex
ExAcquireFastMutex
PoRequestPowerIrp
PoSetPowerState
PoStartNextPowerIrp
PoCallDriver
IoInitializeRemoveLockEx
IoCreateDevice
IoAttachDeviceToDeviceStack
IoFreeIrp
IoAllocateIrp
KeDelayExecutionThread
MmGetPhysicalAddress
KeInsertQueueDpc
IoConnectInterrupt
ObReferenceObjectByHandle
KeSetTimer
ObfDereferenceObject
IoDisconnectInterrupt
KeInitializeDpc
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
KeInitializeTimer
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
KeReleaseInterruptSpinLock
KeAcquireInterruptSpinLock
IoCreateNotificationEvent
KeBugCheckEx
__C_specific_handler

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 77B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/MSx64/rimsptsk.inf
CardReader/MSx64/rimspx64.cat
CardReader/MSx64/snymsico.dll
.dll windows:4 windows x86 arch:x86

46039de89f8560750f5a6dacd1c7a453

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
GetCommandLineA
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/SDMMC/Rimmptsk.inf
CardReader/SDMMC/rimmptsk.cat
CardReader/SDMMC/rimmptsk.sys
.sys windows:6 windows x86 arch:x86

2b7ab0d6fbed05c37921c0b99f4f307a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\12setsu\ricohdriver\x86\mmc_src\drv\objfre_wlh_x86\i386\rimmptsk.pdb

Imports

ntoskrnl.exe

KeSetEvent
MmUnmapIoSpace
IoSetDeviceInterfaceState
ZwClose
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ExAllocatePoolWithTag
ZwOpenKey
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeInitializeEvent
IoRegisterDeviceInterface
READ_REGISTER_BUFFER_UCHAR
MmMapIoSpace
IoReleaseRemoveLockEx
IoInvalidateDeviceRelations
swprintf
IoAcquireRemoveLockEx
PoSetPowerState
PoCallDriver
IofCallDriver
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
IoCreateDevice
READ_REGISTER_BUFFER_ULONG
KeDelayExecutionThread
KeClearEvent
KeSetTimer
ObfDereferenceObject
ObReferenceObjectByHandle
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
PsCreateSystemThread
IoDisconnectInterrupt
KeInsertQueueDpc
IoConnectInterrupt
KeInitializeDpc
KeInitializeTimer
IoCreateNotificationEvent
KeTickCount
KeBugCheckEx
ObfReferenceObject
memcpy
memset
ExAllocatePool
RtlQueryRegistryValues
ExFreePoolWithTag
PoStartNextPowerIrp
IofCompleteRequest

hal

KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex
ExAcquireFastMutex

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 980B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/SDMMCx64/Rimmptsk.inf
CardReader/SDMMCx64/rimmpx64.cat
CardReader/SDMMCx64/rimmpx64.sys
.sys windows:6 windows x64 arch:x64

ff2a95b937363aad0d65e57ec2c6e232

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\12setsu\ricohdriver\x64_src\mmc_x64_src\src\objfre_wlh_amd64\amd64\rimmpx64.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
RtlQueryRegistryValues
ExAllocatePool
IofCompleteRequest
RtlInitUnicodeString
IoDeleteDevice
ZwCreateKey
IoDetachDevice
KeSetEvent
ZwQueryValueKey
MmUnmapIoSpace
swprintf
KeInitializeEvent
MmMapIoSpace
ExAllocatePoolWithTag
ZwClose
IofCallDriver
ZwSetValueKey
ZwOpenKey
IoReleaseRemoveLockEx
ObfReferenceObject
IoInvalidateDeviceRelations
IoAcquireRemoveLockEx
KeWaitForSingleObject
ExReleaseFastMutex
ExAcquireFastMutex
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
PoRequestPowerIrp
PoSetPowerState
PoStartNextPowerIrp
PoCallDriver
IoInitializeRemoveLockEx
IoCreateDevice
IoAttachDeviceToDeviceStack
KeDelayExecutionThread
IoDisconnectInterrupt
KeInitializeDpc
KeInitializeTimer
PsCreateSystemThread
MmMapLockedPagesSpecifyCache
PsTerminateSystemThread
KeInsertQueueDpc
KeClearEvent
IoConnectInterrupt
ObReferenceObjectByHandle
KeSetTimer
ObfDereferenceObject
KeBugCheckEx

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 209B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/XD/RixDICON.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/XD/rixdptsk.cat
CardReader/XD/rixdptsk.inf
CardReader/XD/rixdptsk.sys
.sys windows:6 windows x86 arch:x86

adf9b51ba255560b1e462d09886e5acc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\12setsu\ricohdriver\x86\xd_src\src\objfre_wlh_x86\i386\rixdptsk.pdb

Imports

ntoskrnl.exe

ObfReferenceObject
IofCallDriver
KeSetEvent
MmUnmapIoSpace
IoSetDeviceInterfaceState
ZwClose
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeInitializeEvent
IoRegisterDeviceInterface
MmMapIoSpace
IoReleaseRemoveLockEx
ExAllocatePoolWithTag
IoInvalidateDeviceRelations
swprintf
IoAcquireRemoveLockEx
KeClearEvent
PoSetPowerState
PoCallDriver
memcpy
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
IoCreateDevice
KeDelayExecutionThread
MmGetPhysicalAddress
READ_REGISTER_BUFFER_ULONG
KeSetTimer
ObfDereferenceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
PsCreateSystemThread
IoDisconnectInterrupt
KeInsertQueueDpc
MmMapLockedPagesSpecifyCache
IoConnectInterrupt
KeInitializeDpc
KeInitializeTimer
IoCreateNotificationEvent
KeTickCount
KeBugCheckEx
RtlUnwind
memset
ExAllocatePool
RtlQueryRegistryValues
ExFreePoolWithTag
PoStartNextPowerIrp
IofCompleteRequest

hal

KfAcquireSpinLock
KfReleaseSpinLock
ExReleaseFastMutex
ExAcquireFastMutex
KeGetCurrentIrql

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/data1.cab
CardReader/data1.hdr
CardReader/data2.cab
CardReader/engine32.cab
.cab
DotNetInstaller.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IScript.dll
.dll regsvr32 windows:4 windows x86 arch:x86

01079e578402fb3b7165570d3ad44913

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
GetShortPathNameA
GetModuleHandleA
lstrlenW
lstrlenA
GetModuleFileNameA
lstrcmpiA
HeapDestroy
FindClose
FindFirstFileA
GetFileAttributesA
CreateFileA
MultiByteToWideChar
EnterCriticalSection
CloseHandle
UnmapViewOfFile
ReadFile
WaitForSingleObject
SetEvent
FreeLibrary
LoadLibraryA
GetProcAddress
GetOEMCP
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
LocalFree
GetLastError
FormatMessageA
WideCharToMultiByte
QueryPerformanceFrequency
CreateEventA
IsBadCodePtr
ResetEvent
GetACP
GetStringTypeW
GetStringTypeA
SystemTimeToFileTime
VirtualAlloc
WriteFile
IsBadWritePtr
HeapCreate
GetVersionExA
VirtualFree
GetEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentVariableA
FreeEnvironmentStringsA
GetStartupInfoA
FreeEnvironmentStringsW
IsBadReadPtr
GetCPInfo
Sleep
InterlockedExchange
GetStdHandle
SetHandleCount
GetFileType
LCMapStringW
UnhandledExceptionFilter
LCMapStringA
SetLastError
lstrcatA
MapViewOfFile
CreateFileMappingA
GetFileSize
VirtualQuery
VirtualProtect
SearchPathA
lstrcpyA
GetWindowsDirectoryA
lstrcpynA
GetCommandLineA
GetTickCount
QueryPerformanceCounter
GetVersion
HeapFree
HeapReAlloc
HeapSize
RaiseException
RtlUnwind
CreateThread
GetCurrentThreadId
TlsSetValue
ExitThread
SetUnhandledExceptionFilter
TlsAlloc
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
TlsFree
TlsGetValue

user32

MsgWaitForMultipleObjects
PeekMessageA
LoadStringA
wsprintfA
CharLowerBuffA
TranslateMessage
GetDesktopWindow
GetMessageA
DispatchMessageA
PostThreadMessageA

advapi32

RegQueryValueA
RegQueryValueExA
RegOpenKeyA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA

ole32

CLSIDFromProgID
CoInitialize
CoMarshalInterThreadInterfaceInStream
CoUninitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromCLSID
ProgIDFromCLSID
CoTaskMemFree

oleaut32

GetErrorInfo
SafeArrayRedim
SafeArrayGetUBound
SysStringByteLen
SafeArrayCreate
DispGetParam
VariantCopyInd
LoadRegTypeLi
SafeArrayGetElement
SafeArrayPutElement
SysAllocStringLen
SafeArrayGetLBound
SafeArrayGetDim
SysStringLen
SafeArrayDestroy
SysFreeString
SysAllocString
SysReAllocStringLen
VariantChangeType
VariantClear
VariantCopy
VariantInit
SetErrorInfo
CreateErrorInfo
SysAllocStringByteLen

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 156KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IUser.dll
.dll regsvr32 windows:4 windows x86 arch:x86

ed67065e5e9b57547897a7e97c585c27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DisableThreadLibraryCalls
lstrcmpiA
LoadResource
HeapDestroy
GetTickCount
FreeLibrary
FindResourceA
FlushInstructionCache
LockResource
GetCurrentProcess
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
lstrcatA
GetModuleHandleA
GetModuleFileNameA
GlobalFree
LoadLibraryA
GetProcAddress
GlobalUnlock
GlobalAlloc
GlobalLock
GetShortPathNameA
DeleteCriticalSection
EnterCriticalSection
GetEnvironmentStrings
CloseHandle
FlushFileBuffers
SetFilePointer
SetStdHandle
ReadFile
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
GetCPInfo
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadWritePtr
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetEnvironmentStringsW
GetFileAttributesA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
HeapSize
HeapReAlloc
TerminateProcess
ExitProcess
SetLastError
HeapAlloc
TlsGetValue
lstrcpyA
TlsFree
TlsAlloc
TlsSetValue
RaiseException
HeapFree
GetVersion
GetCommandLineA
RtlUnwind
InterlockedExchange
Sleep
GetLastError
LeaveCriticalSection
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
lstrlenA

user32

DestroyWindow
GetDlgCtrlID
GetClassNameA
MessageBeep
IntersectRect
IsIconic
EnumChildWindows
SetWindowRgn
LoadIconA
ScreenToClient
GetWindowRect
FillRect
GetSysColor
GetDlgItem
MoveWindow
SetWindowPos
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
IsWindow
SetWindowTextA
ReleaseCapture
SetCursor
LoadCursorA
SetCapture
EnableWindow
GetDesktopWindow
CopyRect
OffsetRect
DrawTextA
wsprintfA
GetDlgItemTextA
GetWindowDC
DefWindowProcA
CreateWindowExA
GetParent
ShowWindow
BeginPaint
EndPaint
SendMessageA
UpdateWindow
GetWindow
SystemParametersInfoA
MapWindowPoints
CreateDialogIndirectParamA
ClientToScreen
SetFocus
SetDlgItemTextA
AppendMenuA
InvalidateRect
DialogBoxParamA
GetSystemMenu
RemoveMenu
LoadStringA
GetClientRect
GetClassInfoExA
RegisterClassExA
GetWindowTextLengthA
GetWindowTextA
CallWindowProcA

gdi32

DeleteObject
CreateRectRgn
TextOutA
SetTextColor
RestoreDC
SelectObject
SaveDC
SetBkMode
CreateFontIndirectA
GetDeviceCaps
CreateSolidBrush
GetStockObject
GetTextExtentPoint32A
Rectangle
DeleteDC
BitBlt
DeleteMetaFile
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectA
EnumFontFamiliesExA

advapi32

RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegSetValueExA

ole32

StringFromCLSID
CoTaskMemFree
ProgIDFromCLSID

oleaut32

SysStringLen
SysReAllocStringLen
GetErrorInfo
CreateErrorInfo
SetErrorInfo
SysFreeString
SysAllocStringLen
LoadRegTypeLi
SysAllocString

winmm

mciSendCommandA
sndPlaySoundA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IsProBE9x.tlb
IsProBENT.tlb
ctor.dll
.dll regsvr32 windows:4 windows x86 arch:x86

66e125b3db52dda3a29db9e25cbdb706

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CopyFileA
HeapAlloc
GetSystemInfo
GetVersionExA
HeapCreate
SetLastError
CreateFileA
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
InterlockedDecrement
CompareStringA
CompareStringW
GetPrivateProfileIntA
CreateEventA
HeapDestroy
LoadLibraryA
lstrcatA
DeleteFileA
GetTempPathA
GetWindowsDirectoryA
GetTickCount
GetFileAttributesA
GetTempFileNameA
GetCurrentProcessId
GetCurrentProcess
DebugBreak
HeapFree
GetPrivateProfileStringA
GetProcAddress
LoadLibraryExA
FreeLibrary
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
CreateProcessA
CloseHandle
lstrlenA
lstrcpyA
GetModuleFileNameA
GetModuleHandleA
lstrcmpiA
GetShortPathNameA
GetSystemDirectoryA
GetVersion
GetCurrentThread

user32

MessageBoxA
CharUpperA
LoadStringA
PeekMessageA
MsgWaitForMultipleObjects
wsprintfA
CharNextA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid

ole32

StringFromCLSID
CoMarshalInterThreadInterfaceInStream
CoReleaseMarshalData
CLSIDFromString
CoCreateInstance
CoTaskMemFree
ProgIDFromCLSID
CoLoadLibrary

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
LoadTypeLi
SysAllocStringLen
VariantCopy
VariantClear
SysAllocString
SysFreeString
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
LaunchSetup

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
iKernel.rgs
ikernel.dll
.dll regsvr32 windows:4 windows x86 arch:x86

4388eae753019d8a9b20cf9b64adc7d4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
GetModuleHandleA
GetModuleFileNameA
Sleep
CreateProcessA
GetPrivateProfileStringA
lstrcmpA
CreateFileA
QueryPerformanceFrequency
CreateEventA
SetFilePointer
ReadFile
SystemTimeToFileTime
GetSystemTime
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileSize
GetFileTime
CompareStringA
CompareStringW
GetVersionExA
WriteFile
LocalFileTimeToFileTime
DosDateTimeToFileTime
LoadLibraryExA
SearchPathA
FreeLibrary
WaitForSingleObject
OpenEventA
GetCurrentProcessId
GetWindowsDirectoryA
CreateDirectoryA
CopyFileA
GetVersion
GetPrivateProfileSectionA
GetShortPathNameA
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
SetEvent
LockResource
LoadResource
SizeofResource
FindResourceA
SetFileAttributesA
RemoveDirectoryA
SetFileTime
GetCurrentProcess
WritePrivateProfileStringA
GetSystemDirectoryA
WinExec
MoveFileExA
IsBadWritePtr
IsBadReadPtr
GetPrivateProfileSectionNamesA
WritePrivateProfileSectionA
MoveFileA
ResetEvent
DeleteFileA
GetPrivateProfileIntA
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
lstrlenA
GlobalAlloc
CloseHandle
GlobalLock
InterlockedDecrement
GlobalUnlock
GlobalFree
FormatMessageA
LocalFree
InterlockedIncrement
lstrlenW
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
lstrcpyA
GetTickCount
LoadLibraryA
SetUnhandledExceptionFilter
TlsFree
SetLastError
GetLastError
HeapSize
HeapReAlloc
GetStringTypeW
GetStringTypeA
IsBadCodePtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
UnhandledExceptionFilter
LCMapStringW
TerminateProcess
HeapFree
HeapAlloc
GetCommandLineA
TlsSetValue
GetCurrentThreadId
ExitThread
RaiseException
RtlUnwind
CreateThread
QueryPerformanceCounter
lstrcpynA
InterlockedExchange
TlsAlloc
ExitProcess
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
VirtualQuery
GetCurrentThread
VirtualProtect
GetCPInfo
GetACP
LCMapStringA
TlsGetValue
lstrcatA
GetOEMCP

user32

PostThreadMessageA
MsgWaitForMultipleObjects
LoadStringA
wsprintfA
CharUpperA
GetDesktopWindow
CharLowerA
ExitWindowsEx
PeekMessageA
CharLowerBuffA
DispatchMessageA
TranslateMessage
GetMessageA
MessageBoxA

advapi32

IsValidSecurityDescriptor
ControlService
QueryServiceStatus
OpenServiceA
CloseServiceHandle
RegEnumValueA
DeleteService
RegDeleteValueA
RegQueryInfoKeyA
RegConnectRegistryA
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyA
GetFileSecurityA
RegSetValueExA
SetFileSecurityA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenThreadToken
RegQueryValueA
OpenSCManagerA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc

ole32

WriteClassStm
ProgIDFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
StgCreateDocfile
StgOpenStorage
StringFromCLSID
CoLoadLibrary
OleLoadFromStream
CoCreateGuid
CLSIDFromString
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoGetInterfaceAndReleaseStream
CoCreateInstance
StringFromGUID2
OleSaveToStream

oleaut32

SafeArrayGetDim
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SafeArrayGetLBound
SafeArrayCopy
SafeArrayGetUBound
SafeArrayCreate
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SafeArrayGetElement
SafeArrayDestroy
SetErrorInfo
SysReAllocStringLen
CreateErrorInfo
VariantCopy
VariantInit
VariantCopyInd
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString
VariantClear
SafeArrayPutElement
SysStringByteLen

rpcrt4

UuidFromStringA
UuidCreate

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 500KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
objectps.dll
.dll regsvr32 windows:4 windows x86 arch:x86

a946c4bf5da14af630ebc8e61f6454ef

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
RtlUnwind

rpcrt4

CStdStubBuffer_CountRefs
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Invoke
CStdStubBuffer_Disconnect
CStdStubBuffer_Connect
CStdStubBuffer_AddRef
CStdStubBuffer_QueryInterface
IUnknown_Release_Proxy
IUnknown_AddRef_Proxy
IUnknown_QueryInterface_Proxy
NdrOleFree
NdrOleAllocate
NdrProxyErrorHandler
NdrClearOutParameters
NdrProxyFreeBuffer
NdrPointerUnmarshall
NdrConvert
NdrSimpleStructMarshall
CStdStubBuffer_DebugServerRelease
NdrProxyGetBuffer
RpcRaiseException
NdrProxyInitialize
NdrPointerFree
NdrPointerMarshall
NdrStubGetBuffer
NdrPointerBufferSize
NdrSimpleStructUnmarshall
NdrStubInitialize
NdrInterfacePointerMarshall
NdrInterfacePointerBufferSize
NdrInterfacePointerFree
NdrInterfacePointerUnmarshall
NdrDllGetClassObject
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
NdrDllRegisterProxy
NdrDllUnregisterProxy
NdrProxySendReceive

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 128B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/layout.bin
CardReader/setup.boot
CardReader/setup.exe
.exe windows:4 windows x86 arch:x86

5523dda9a438aa3992e03f3746f19bf6

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

01
Certificate

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

08:d1:35
Certificate

Issuer

CN=Thawte Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c177365727665722d6365727473407468617774652e636f6d

Not Before

12/02/2002, 00:05

Not After

12/02/2003, 00:05

Subject

CN=InstallShield Software Corporation,OU=Research and Development,O=InstallShield Software Corporation,L=Schaumburg,ST=Illinois,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

VerInstallFileA
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

GetLastError
SetLastError
lstrcmpiA
lstrlenA
CompareStringW
GetVersionExA
DeleteFileA
CompareStringA
GetWindowsDirectoryA
GetTempPathA
GetFileAttributesA
GetTempFileNameA
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalFree
GetTickCount
LockResource
LoadResource
FindResourceA
lstrcpyA
SetErrorMode
FreeLibrary
RemoveDirectoryA
LeaveCriticalSection
EnterCriticalSection
CreateThread
CreateMutexA
WaitForSingleObject
ReleaseMutex
InitializeCriticalSection
DeleteCriticalSection
SetEvent
OpenEventA
GetModuleHandleA
GetCurrentThreadId
HeapAlloc
GetSystemInfo
HeapCreate
lstrcpynA
lstrcatA
GetPrivateProfileIntA
lstrlenW
FindFirstFileA
SetFilePointer
GetProcAddress
LoadLibraryA
GetShortPathNameA
GetSystemDefaultLangID
MoveFileA
FindResourceExA
GetFileSize
HeapDestroy
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
SizeofResource
GetStartupInfoA
ExitProcess
GetCommandLineA
DebugBreak
HeapReAlloc
HeapFree
VirtualQuery
VirtualProtect
SearchPathA
ResetEvent
QueryPerformanceCounter
SystemTimeToFileTime
lstrcmpA
MultiByteToWideChar
GetCurrentThread
GetVersion
IsBadReadPtr
ReadFile
Sleep
WriteFile
CloseHandle
CreateEventA
QueryPerformanceFrequency
InterlockedDecrement
InterlockedIncrement
CreateFileA
GetModuleFileNameA
CreateDirectoryA
WideCharToMultiByte
WritePrivateProfileStringA
GetPrivateProfileStringA
FindClose
CreateProcessA
GetCurrentProcess

user32

MsgWaitForMultipleObjects
LoadStringA
CharNextA
PeekMessageA
PostThreadMessageA
CharUpperA
SetTimer
SetWindowRgn
DialogBoxIndirectParamA
SetActiveWindow
CharLowerBuffA
CreateDialogIndirectParamA
GetDlgItem
SendMessageA
SetDlgItemTextA
LoadIconA
GetWindowRect
SystemParametersInfoA
SetWindowPos
CharLowerA
GetWindowTextA
GetDesktopWindow
ScreenToClient
MoveWindow
KillTimer
DestroyWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetDC
ReleaseDC
SetWindowTextA
ShowWindow
EndDialog
wsprintfA

gdi32

CreateFontIndirectA
LPtoDP
GetTextExtentPoint32A
DeleteObject
GetObjectA

advapi32

RegCreateKeyExA
OpenThreadToken
OpenProcessToken
GetTokenInformation
RegCloseKey
RegOpenKeyExA
RegSetValueExA
AllocateAndInitializeSid
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyA
RegQueryValueA
FreeSid
EqualSid

ole32

CoTaskMemFree
StringFromGUID2
GetRunningObjectTable
CoCreateInstance
CoCreateGuid
CoReleaseMarshalData
CoInitialize
CoGetInterfaceAndReleaseStream
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
CoTaskMemAlloc
CoMarshalInterThreadInterfaceInStream

oleaut32

SysStringLen
SysFreeString
SysAllocStringLen
VariantCopy
VariantClear
LoadRegTypeLi
LoadTypeLi
RegisterTypeLi
SysAllocString

lz32

LZClose
LZCopy
LZOpenFileA

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
CardReader/setup.ini
CardReader/setup.inx
CardReader/setup.iss
CardReader/xDx64/RixDICON.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 4KB - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/xDx64/Rixdpx64.sys
.sys windows:5 windows x64 arch:x64

01502a49475af579b73455217b0800c9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\driver\x64\wsv2003\src\objfre_wnet_AMD64\amd64\Rixdpx64.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
ExFreePoolWithTag
RtlQueryRegistryValues
ExAllocatePoolWithTag
ObfReferenceObject
IofCallDriver
KeSetEvent
MmUnmapIoSpace
IoSetDeviceInterfaceState
ZwClose
ZwSetValueKey
ZwCreateKey
ZwQueryValueKey
ZwOpenKey
RtlInitUnicodeString
IoDeleteDevice
IoDetachDevice
KeWaitForSingleObject
KeInitializeEvent
IoRegisterDeviceInterface
MmMapIoSpace
IoReleaseRemoveLockEx
IoInvalidateDeviceRelations
swprintf
IoAcquireRemoveLockEx
ExAcquireFastMutex
ExReleaseFastMutex
KeClearEvent
KeReleaseSpinLock
KeAcquireSpinLockRaiseToDpc
PoSetPowerState
PoCallDriver
PoStartNextPowerIrp
PoRequestPowerIrp
IoAttachDeviceToDeviceStack
IoInitializeRemoveLockEx
IoCreateDevice
KeDelayExecutionThread
MmGetPhysicalAddress
KeSetTimer
ObfDereferenceObject
ObReferenceObjectByHandle
PsTerminateSystemThread
PsCreateSystemThread
IoDisconnectInterrupt
KeInsertQueueDpc
__C_specific_handler
MmMapLockedPagesSpecifyCache
IoConnectInterrupt
KeInitializeDpc
KeInitializeTimer
IoCreateNotificationEvent
KeBugCheckEx

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 273KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 115B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CardReader/xDx64/rixdptsk.inf
CardReader/xDx64/rixdpx64.cat

Sharing

General

Malware Config

Signatures

Files

afb16ba7eb532fecc5ae0dcc3a2f2233

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 34KB - Virtual size: 33KB

.rdata Size: 512B - Virtual size: 487B

.data Size: 512B - Virtual size: 16KB

PAGE Size: 512B - Virtual size: 66B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

46039de89f8560750f5a6dacd1c7a453

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 48KB - Virtual size: 45KB

.reloc Size: 4KB - Virtual size: 3KB

42586653c1379eec055f967aa30cc377

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 43KB - Virtual size: 42KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 16KB

.pdata Size: 1KB - Virtual size: 1KB

PAGE Size: 512B - Virtual size: 77B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 96B

46039de89f8560750f5a6dacd1c7a453

Headers

File Characteristics

Imports

kernel32

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 12KB - Virtual size: 12KB

.rsrc Size: 48KB - Virtual size: 45KB

.reloc Size: 4KB - Virtual size: 3KB

2b7ab0d6fbed05c37921c0b99f4f307a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

hal

Sections

.text Size: 32KB - Virtual size: 31KB

.rdata Size: 512B - Virtual size: 472B

.data Size: 512B - Virtual size: 152B

PAGE Size: 512B - Virtual size: 66B

INIT Size: 2KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 980B

ff2a95b937363aad0d65e57ec2c6e232

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

.text
Size: 34KB - Virtual size: 33KB

.rdata
Size: 512B - Virtual size: 487B

.data
Size: 512B - Virtual size: 16KB

PAGE
Size: 512B - Virtual size: 66B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 48KB - Virtual size: 45KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 43KB - Virtual size: 42KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 16KB

.pdata
Size: 1KB - Virtual size: 1KB

PAGE
Size: 512B - Virtual size: 77B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 96B

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 48KB - Virtual size: 45KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 152B

PAGE
Size: 512B - Virtual size: 66B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 980B

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 448B

.pdata
Size: 2KB - Virtual size: 1KB

PAGE
Size: 512B - Virtual size: 209B

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 84B

.rdata
Size: 4KB - Virtual size: 289B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 27KB - Virtual size: 27KB

.rdata
Size: 1024B - Virtual size: 608B

.data
Size: 512B - Virtual size: 273KB

INIT
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 156KB - Virtual size: 152KB

.rdata
Size: 36KB - Virtual size: 33KB

.data
Size: 16KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB