d1a15ddba5b6e382a38b535be6976145_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d1a15ddba5b6e382a38b535be6976145_JaffaCakes118
Size

1.1MB
MD5

d1a15ddba5b6e382a38b535be6976145
SHA1

ee161cb7692216a3c38095140aa86efd1da02e0f
SHA256

d037442c4f984db64d723d4a5073b273680e3eff65604abb1fac7f54711d5a9c
SHA512

e41112a4e4c7c4382ddb1693c2046c979533138d3146572c5584ff12e8138807ebf1140b6f12e09ef7e885ae64b012bcfe0328a27ed2972a894e019d01bf3885
SSDEEP

24576:3nQ0c5AN0T83mMO/nE2be49aSSqN/74s82:A0jyn7be49aJqN/8u

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/PjPlayer.exe
unpack001/SkinCrafterDll.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

d1a15ddba5b6e382a38b535be6976145_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:a9:eb:b2:b8:04:c8:9d:58:d1:22:9a:a3:ab:19:98
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/11/2010, 00:00

Not After

29/11/2011, 23:59

Subject

CN=Safe Download x3,O=Safe Download x3,L=Stockholm,ST=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/$_20_
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GetACP
lstrlenA
lstrcmpA
lstrcpynA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/OCSetupHlp.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0615854a8bf9998cbbbcc756d6e6d4bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:a9:3d:fd:83:11:ae:f1:45:ae:a6:b4:6f:66:0f:bd:01:2f:d6:57
Signer

Actual PE Digest

f6:a9:3d:fd:83:11:ae:f1:45:ae:a6:b4:6f:66:0f:bd:01:2f:d6:57

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
CreateFileW
GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
WaitForSingleObject
OutputDebugStringW
WriteFile
DeleteFileW
GetCurrentThreadId
SetLastError
GetCurrentProcess
FlushInstructionCache
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
CreateMutexW
OpenMutexW
ReleaseMutex
CreateDirectoryW
GetShortPathNameW
GetTempPathW
SetFilePointer
GetTickCount
CreateEventW
SetEvent
CreateProcessW
MoveFileExW
GlobalUnlock
GlobalLock
GlobalAlloc
Process32NextW
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetFileAttributesA
CreateProcessA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
Process32FirstW
CreateToolhelp32Snapshot
WriteConsoleA
GetCurrentDirectoryA
CreateFileA
CloseHandle
GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetModuleHandleA
SetErrorMode
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
ExitThread
GetSystemTimeAsFileTime
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
HeapFree
HeapAlloc
GetProcessHeap
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
FileTimeToSystemTime
GetVersion
GetSystemInfo
GetVersionExW
GetTempFileNameW
GlobalFree
ReleaseSemaphore
ResumeThread
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
lstrlenA
WideCharToMultiByte
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
DeleteCriticalSection
lstrcmpiW
EnterCriticalSection
GetProcAddress
GetThreadLocale
GetLastError
SetThreadLocale
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
QueryPerformanceCounter
LoadLibraryExW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
Sleep
PeekNamedPipe
CreateThread

psapi

EnumProcesses
GetProcessImageFileNameW

ws2_32

WSACleanup
WSAStartup
closesocket
WSAGetLastError
gethostname
ioctlsocket
getaddrinfo
freeaddrinfo
select
__WSAFDIsSet
WSASetLastError
connect
setsockopt
getpeername
getsockopt
htons
bind
ntohs
getsockname
send
recv
socket

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

IsWindow
CallWindowProcW
DefWindowProcW
GetWindowLongW
SetWindowLongW
GetCursor
ReleaseCapture
TrackPopupMenu
GetCursorPos
DestroyWindow
PostMessageW
PostQuitMessage
KillTimer
UnregisterClassA
GetForegroundWindow
DestroyMenu
NotifyWinEvent
FindWindowW
GetParent
GetAncestor
SetFocus
CreateDialogParamW
LoadImageW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SystemParametersInfoW
SetWindowsHookExW
DrawTextW
ScreenToClient
SetMenuItemInfoW
IsWindowVisible
SetForegroundWindow
SetCursor
ClientToScreen
GetWindowRect
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
SetDlgItemTextW
MessageBoxW
CreateWindowExW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetDesktopWindow
CharNextW
FillRect
InvalidateRect
GetAsyncKeyState
EndPaint
BeginPaint
DrawFocusRect
ReleaseDC
GetDC
GetSysColorBrush
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos
MoveWindow
GetClientRect
SetWindowTextW
SendMessageW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
ShowWindow
EnumWindows
EnumChildWindows
GetWindowTextW
GetWindowTextLengthW
SetTimer

gdi32

CreateSolidBrush
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetTextExtentPoint32W
SelectObject
CreateDIBSection
SetBkMode
SetTextColor
CreateFontIndirectW
GetObjectW
DeleteObject
DeleteDC
GetDeviceCaps
GetStockObject
GdiFlush

advapi32

RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegSetValueExW
RegDeleteValueA
LookupPrivilegeValueW
RegDeleteValueW
AdjustTokenPrivileges
OpenProcessToken
DuplicateTokenEx
GetUserNameW
RegEnumKeyW

shell32

SHGetFolderPathW
Shell_NotifyIconW
ShellExecuteW

ole32

CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoTaskMemRealloc
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree

oleaut32

VariantClear
LoadRegTypeLi
SysAllocStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString

comctl32

InitCommonControlsEx

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD462CanLeaveOfferPage
OCPRD462CleanupProduct
OCPRD462Detach
OCPRD462FindGuidAndRunDialog
OCPRD462FindGuidAndRunDialogA
OCPRD462GetAsyncOfferStatus
OCPRD462GetBannerInfo
OCPRD462GetBannerInfoW
OCPRD462GetMsg
OCPRD462GetNoCandy
OCPRD462GetOfferState
OCPRD462GetOfferType
OCPRD462Init2A
OCPRD462Init2W
OCPRD462InnoAdjust
OCPRD462InnoRestore
OCPRD462InstallShieldAdjust
OCPRD462LoadOpenCandyDLL
OCPRD462LogDevModeMessage
OCPRD462LogDevModeMessageW
OCPRD462NSISAdjust
OCPRD462PreInit
OCPRD462PrepareDownload
OCPRD462RunDialog
OCPRD462SetCmdLineValues
OCPRD462SetCmdLineValuesW
OCPRD462SetCustomBrushColor
OCPRD462SetCustomBrushColorW
OCPRD462SetNoCandy
OCPRD462SetOCOfferEnabled
OCPRD462SetOfferData
OCPRD462SetOfferLocation
OCPRD462SetUseDefaultColorBkGrnd
OCPRD462Shutdown
OCPRD462SignalProductFailed
OCPRD462SignalProductInstalled
OCPRD462StartDLMgr2Download
OCPRD462StartDLMgr2DownloadRunasAdmin
_OCPRD462DLMgr2Check@16
_OCPRD462Display@16
_OCPRD462DownloadMgr2RecycleOffer@12
_OCPRD462MgrCheck@16
_OCPRD462MgrExec@16
_OCPRD462RestartDll@16
_OCPRD462RestartDllAsAdmin@16
_OCPRD462RunOpenCandyDLL@16

Sections

.text
Size: 507KB - Virtual size: 506KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

8773e19ae02f331332db1b00671fdecf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
GetLastError
GlobalFree
lstrcmpiA
DeleteFileA
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize
CreateFileA

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
IsWindow
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
SendDlgItemMessageA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PjPlayer.exe
.exe windows:4 windows x86 arch:x86

17fcb31b952eb464768ab95b537f90af

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\temp\x3player\Release\VladPlayerII.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

kernel32

SetErrorMode
GetFileTime
GetStartupInfoW
ExitProcess
RtlUnwind
HeapReAlloc
ExitThread
CreateThread
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
FileTimeToLocalFileTime
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
IsBadWritePtr
SetUnhandledExceptionFilter
GetTimeZoneInformation
GetOEMCP
GetCPInfo
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
SystemTimeToFileTime
FileTimeToSystemTime
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
GlobalHandle
GlobalReAlloc
LocalAlloc
GlobalFlags
GetCurrentThread
lstrcmpA
lstrcmpiA
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
GetVolumeInformationW
FindFirstFileW
FindClose
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiW
GetProfileIntW
SetLastError
CopyFileW
GlobalSize
FormatMessageW
LocalFree
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
lstrcatW
GetModuleHandleW
GetVersionExA
CreateMutexW
OpenProcess
TerminateProcess
CreateToolhelp32Snapshot
GetCurrentProcessId
Process32FirstW
Process32NextW
ReleaseSemaphore
DuplicateHandle
CreateSemaphoreA
LoadLibraryW
GetProcAddress
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateDirectoryW
GetFileAttributesW
SetFilePointer
ReadFile
GetVersion
CreateFileW
WriteFile
FreeResource
GlobalFree
CreateEventW
ResumeThread
CreateWaitableTimerW
SetWaitableTimer
WaitForMultipleObjects
ResetEvent
lstrcpynW
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
GetTickCount
GetCurrentThreadId
GetFullPathNameW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
lstrcmpW
lstrlenW
GlobalAlloc
GlobalLock
GlobalUnlock
HeapAlloc
GetCurrentProcess
FlushInstructionCache
MulDiv
lstrcpyW
lstrlenA
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetProcessHeap
HeapFree
WaitForSingleObject
GetSystemTimeAsFileTime
SetEvent
CloseHandle
CreateEventA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
Sleep
ReleaseMutex
CreateMutexA
CreateWaitableTimerA
GetCommandLineW

user32

GetMenuCheckMarkDimensions
LoadBitmapW
IsDialogMessageW
SetDlgItemTextW
GetMessageW
TranslateMessage
ValidateRect
GetMenuState
WinHelpW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
GetForegroundWindow
GetLastActivePopup
DispatchMessageW
GetTopWindow
GetMessageTime
GetMessagePos
PeekMessageW
TrackPopupMenu
GetKeyState
UpdateWindow
AdjustWindowRectEx
RegisterClassW
SetWindowPlacement
SystemParametersInfoA
GetWindowPlacement
SetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
FindWindowW
SendMessageTimeoutW
UnhookWindowsHookEx
SetWindowsHookExW
GetClassInfoW
CallNextHookEx
GetCapture
TrackMouseEvent
SetCursor
GrayStringW
GetSysColorBrush
DrawTextW
TabbedTextOutW
GetIconInfo
ClientToScreen
DrawIconEx
GetClassLongW
SetClassLongW
CopyImage
DestroyCursor
SetRect
IsRectEmpty
DestroyIcon
MapWindowPoints
PostThreadMessageW
MessageBoxW
LoadImageW
RegisterClipboardFormatW
GetSystemMetrics
LoadIconW
SetForegroundWindow
IsZoomed
IsIconic
SetMenu
GetMenu
LoadMenuW
ModifyMenuW
InsertMenuW
GetSubMenu
SetMenuItemInfoW
GetMenuItemInfoW
GetMenuStringW
GetMenuItemID
GetMenuItemCount
DeleteMenu
DrawIcon
PtInRect
LoadAcceleratorsW
TranslateAcceleratorW
IntersectRect
SystemParametersInfoW
LockWindowUpdate
ScreenToClient
DrawFocusRect
CopyRect
SetParent
EqualRect
OffsetRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgCtrlID
GetAsyncKeyState
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
CreateWindowExW
DestroyMenu
PostQuitMessage
CharUpperW
WindowFromPoint
ShowWindow
CreateAcceleratorTableW
CharNextW
GetParent
GetClassNameW
SetWindowPos
RedrawWindow
IsWindow
GetDlgItem
SetFocus
GetFocus
IsChild
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
SetMenuItemBitmaps
EnableMenuItem
DrawTextExW
CheckMenuItem
GetDesktopWindow
InvalidateRgn
ReleaseDC
GetDC
FillRect
SetCapture
ReleaseCapture
GetSysColor
GetCursorPos
SetCursorPos
SendInput
DestroyWindow
DefWindowProcW
InflateRect
GetWindowRect
EnableWindow
KillTimer
SetTimer
IsWindowVisible
InvalidateRect
SendMessageW
PostMessageW
GetWindowLongW
SetWindowLongW
UnregisterClassW
MoveWindow
GetClientRect
SetRectEmpty
GetActiveWindow

gdi32

CreatePen
MoveToEx
LineTo
SetMapMode
SetBkMode
RestoreDC
CreateBitmap
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateFontIndirectW
CreateSolidBrush
SaveDC
CopyMetaFileW
SetBkColor
SetTextColor
GetClipBox
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
SetPixelV
Polygon
CreateRectRgn
PtInRegion
CreatePolygonRgn
GetTextExtentPoint32W
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
GetStockObject
GetObjectW

msimg32

GradientFill

comdlg32

GetOpenFileNameW
GetSaveFileNameW
GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegDeleteKeyW
RegEnumKeyW
RegQueryValueW
RegDeleteValueW
RegSetValueExW

shell32

SHGetFolderPathW
Shell_NotifyIconW
DragQueryFileW

comctl32

ImageList_Draw
ImageList_DrawEx
ord17
ImageList_GetIcon
ImageList_GetImageInfo
ImageList_Destroy
ImageList_Create
ImageList_Duplicate
ImageList_GetIconSize

shlwapi

PathIsUNCW
PathFindExtensionW
PathStripToRootW
PathFindFileNameW

ole32

OleUninitialize
OleInitialize
CoCreateInstance
CLSIDFromString
CoInitialize
CoGetClassObject
CreateStreamOnHGlobal
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoUninitialize
ReleaseStgMedium
OleDuplicateData
RegisterDragDrop
RevokeDragDrop
CoLockObjectExternal
OleGetClipboard
CLSIDFromProgID

oleaut32

SysAllocStringLen
VariantChangeType
SysAllocStringByteLen
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
OleLoadPicture
LoadTypeLi
LoadRegTypeLi
VariantInit
OleCreateFontIndirect
SysStringByteLen
VariantClear
SysStringLen
SysAllocString
SysFreeString

Sections

.text
Size: 404KB - Virtual size: 401KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
SkinCrafterDll.dll
.dll windows:4 windows x86 arch:x86

8adf4dcd87bc0a5878820eb28d5b4aaa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msimg32

TransparentBlt

mfc42

ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord2452
ord816
ord562
ord2381
ord5590
ord2571
ord3701
ord500
ord772
ord6142
ord3986
ord5981
ord3619
ord2405
ord2859
ord2754
ord4133
ord4297
ord5787
ord5788
ord283
ord2753
ord932
ord6759
ord5933
ord3880
ord3425
ord3054
ord6716
ord6692
ord3797
ord3055
ord3056
ord3296
ord2862
ord3754
ord3914
ord3297
ord4125
ord3803
ord4060
ord2937
ord3920
ord3293
ord6762
ord6678
ord4123
ord6696
ord6734
ord3546
ord3766
ord861
ord273
ord603
ord3693
ord2713
ord6157
ord6605
ord4023
ord5785
ord2841
ord2107
ord5450
ord6394
ord559
ord812
ord5862
ord6144
ord3566
ord2975
ord3757
ord3481
ord1168
ord1176
ord3752
ord1949
ord5440
ord1116
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord826
ord269
ord860
ord800
ord537
ord823
ord858
ord540
ord539
ord6467
ord825
ord909
ord394
ord4185
ord5628
ord535
ord4191
ord3435
ord3441
ord5860
ord5606
ord5678
ord5794
ord5873
ord6021
ord6189
ord4330
ord6186
ord5756
ord6192
ord5759
ord2971
ord289
ord613
ord3571
ord5781
ord696
ord3643
ord472
ord2380
ord1641
ord2414
ord3626
ord3706
ord323
ord1640
ord2714
ord2450
ord640
ord6880
ord702
ord912
ord5593
ord5683
ord5596
ord400
ord3649
ord5634
ord915
ord4188
ord879
ord4204
ord4129
ord5710
ord6662
ord2740
ord4275
ord2379
ord939
ord755
ord5875
ord6172
ord5789
ord470
ord2860
ord2864
ord3646
ord397
ord699
ord2818
ord665
ord1979
ord1969
ord3438
ord5572
ord6383
ord2915
ord2801
ord882
ord5651
ord3127
ord3616
ord404
ord3663
ord924
ord5186
ord350
ord354
ord703
ord2846

msvcrt

_strnicmp
_wcsnset
_stricmp
_strcmpi
_mbscmp
__CxxFrameHandler
_purecall
_CxxThrowException
atoi
_except_handler3
free
wcscmp
malloc
__RTDynamicCast
strstr
strncmp
wcschr
mbstowcs
swprintf
wcslen
wcscpy
_itow
_ftol
toupper
wcsstr
_snprintf
printf
rand
isdigit
_strupr
srand
sscanf
strncpy
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ

kernel32

LocalReAlloc
InterlockedExchange
HeapFree
GetProcessHeap
HeapAlloc
GetVersion
MulDiv
GetLastError
GetUserDefaultLangID
FindResourceExA
GetTimeFormatW
GetDateFormatW
GetLocaleInfoW
GetLocalTime
LocalFree
RaiseException
lstrcpyA
lstrcmpA
LoadLibraryW
GetModuleHandleA
FreeLibrary
LoadLibraryA
GetProcAddress
GlobalAlloc
GlobalFree
LocalAlloc
GetVersionExA
lstrcmpiA
lstrlenA
LoadResource
SizeofResource
GlobalLock
GlobalUnlock
Sleep
OutputDebugStringA
LocalSize
LocalLock
LocalUnlock
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte

user32

GetWindowTextW
GetWindowTextLengthW
CallWindowProcW
DrawStateA
GetSubMenu
AppendMenuA
RemoveMenu
WindowFromPoint
LoadIconA
GetIconInfo
TrackMouseEvent
DestroyWindow
RegisterClassA
GetClassInfoA
CreateWindowExA
DefWindowProcA
MessageBoxA
GetMenu
IsMenu
GetActiveWindow
SetRectEmpty
GetAncestor
InvalidateRect
SetCapture
ClientToScreen
ReleaseCapture
IsZoomed
LockWindowUpdate
GetCursorPos
GetWindowRgn
GetCapture
SetWindowRgn
GrayStringA
DrawTextA
TabbedTextOutA
EnableScrollBar
IsWindowEnabled
GetWindowLongA
GetTopWindow
GetForegroundWindow
RedrawWindow
SetWindowPos
GetWindow
IsWindow
RemovePropA
SetPropA
IsWindowUnicode
SetWindowLongW
SetWindowLongA
GetWindowTextLengthA
GetPropA
WindowFromDC
GetDC
ReleaseDC
GetSystemMetrics
GetMenuStringW
SetForegroundWindow
SetActiveWindow
GetWindowPlacement
SetWindowPlacement
CopyRect
IsRectEmpty
SetRect
GetWindowRect
OffsetRect
CopyImage
PtInRect
SetCursor
GetParent
SendMessageA
LoadCursorA
GetClientRect
GetClassNameA
PostMessageA
GetClassLongA
SetClassLongA
EnumThreadWindows
EnumChildWindows
GetMessagePos
KillTimer
SetTimer
EndPaint
MapWindowPoints
CallWindowProcA
BeginPaint
DrawEdge
GetSysColorBrush
GetWindowDC
DestroyIcon
EqualRect
UnionRect
GetScrollPos
FillRect
FrameRect
InflateRect
InvertRect
GetDlgCtrlID
IntersectRect
SubtractRect
DrawIconEx
UpdateWindow
GetSysColor
DrawFrameControl
DrawFocusRect
SystemParametersInfoA
IsWindowVisible
GetWindowTextA
GetMenuItemRect
SetMenuItemInfoA
GetMenuItemInfoA
GetMenuItemCount
GetMenuItemID
GetMenuState
GetDlgItem
SetFocus
GetNextDlgTabItem
DrawTextW
GetFocus
SendMessageW
GetMenuStringA
SystemParametersInfoW
ShowScrollBar
SetScrollInfo
SetScrollPos
ShowWindow
HideCaret
ShowCaret
GetCaretPos
SetCaretPos
GetKeyState
GetScrollInfo
CallNextHookEx
GetDesktopWindow
SetWindowsHookExA
UnhookWindowsHookEx
AdjustWindowRect
GetMenuBarInfo
PeekMessageA
DispatchMessageA
GetMessageA
GetDCEx
AdjustWindowRectEx
GetSystemMenu
DrawMenuBar
ScreenToClient
TrackPopupMenu
IsIconic

gdi32

RestoreDC
SetDIBColorTable
GetDIBColorTable
CreatePalette
CreateHalftonePalette
SelectPalette
RealizePalette
GetPaletteEntries
CreateDIBSection
GetObjectW
GetDeviceCaps
IntersectClipRect
GetClipRgn
GetTextMetricsA
ExtTextOutW
CreateFontIndirectW
SetStretchBltMode
GetClipBox
StretchBlt
Rectangle
CreatePatternBrush
SetBrushOrgEx
UnrealizeObject
SelectClipRgn
GetTextExtentPoint32A
PlayEnhMetaFile
SetPixel
CreateSolidBrush
Arc
Ellipse
GetTextExtentPoint32W
SetWindowOrgEx
SaveDC
CreatePen
GetObjectA
CreateFontIndirectA
GetPixel
GetTextExtentPointW
GetTextExtentPointA
GetTextMetricsW
SetBoundsRect
ExcludeClipRect
CreateRoundRectRgn
CreateEllipticRgn
PtInRegion
GetStockObject
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetViewportOrgEx
ExtSelectClipRgn
PatBlt
GetBkMode
GetTextColor
GetBkColor
GetCurrentObject
SetBkMode
SetTextColor
CreateRectRgn
OffsetRgn
GetRegionData
ExtCreateRegion
BeginPath
MoveToEx
LineTo
EndPath
WidenPath
PathToRegion
GetRgnBox
CreateRectRgnIndirect
CombineRgn
CreateCompatibleDC
SelectObject
CreateBitmap
CreateCompatibleBitmap
BitBlt
SetBkColor
DeleteObject
DeleteDC

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA

shell32

ShellExecuteA

comctl32

ImageList_GetIcon
ImageList_Draw
ImageList_GetImageInfo
ImageList_GetIconSize
ImageList_DrawEx
UninitializeFlatSB
InitializeFlatSB
ImageList_SetBkColor

ole32

GetHGlobalFromStream
CreateStreamOnHGlobal

oleaut32

SysAllocStringLen
VariantClear
SysFreeString
SysAllocString

oleacc

AccessibleObjectFromWindow

Exports

Exports

AboutSkinCrafter
AddAdditionalThread
AddDrawImage
AddDrawText
AddSkinFromFile
ApplyAddedSkin
ApplySkin
ClearSkin
ClearWnd
DeInitDecoration
DecorateAs
DefineLanguage
DeleteAddedSkin
DeleteAdditionalThread
DoDecorate
DoNotDecorate
ExcludeThreadWindows
ExcludeWnd
GetSkinCopyRight
GetUserData
GetUserDataSize
IncludeThreadWindows
IncludeWnd
InitDecoration
InitLicenKeys
LoadSkinFromData
LoadSkinFromFile
LoadSkinFromResource
RemoveAddedSkin
RemoveDrawItem
RemoveSkin
SetAddedCustomScrollbars
SetAddedCustomSkinWnd
SetCustomScrollbars
SetCustomSkinWnd
SetDecorationMode
UpdateControl
UpdateWnd

Sections

.text
Size: 368KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
animate.gif
.gif
animate2.gif
.gif
skin.skf

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

08:a9:eb:b2:b8:04:c8:9d:58:d1:22:9a:a3:ab:19:98Certificate

Extended Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 60KB

.rsrc Size: 19KB - Virtual size: 18KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 320B

0615854a8bf9998cbbbcc756d6e6d4bf

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

08:a9:eb:b2:b8:04:c8:9d:58:d1:22:9a:a3:ab:19:98
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 60KB

.rsrc
Size: 19KB - Virtual size: 18KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 320B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f6:a9:3d:fd:83:11:ae:f1:45:ae:a6:b4:6f:66:0f:bd:01:2f:d6:57
Signer

.text
Size: 507KB - Virtual size: 506KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 38KB - Virtual size: 38KB

.reloc
Size: 30KB - Virtual size: 30KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB