dc349926fb2def3c1d19bd1782368789_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dc349926fb2def3c1d19bd1782368789_JaffaCakes118
Size

5.8MB
MD5

dc349926fb2def3c1d19bd1782368789
SHA1

47301ab5d0a3cc426067d192c7a66adebd6a7b6c
SHA256

ddba13d70d8ae4f198c7782e50d059bd1341ec86425d32d90cd633b118dd4077
SHA512

3fb1b053b049ef356bb009510cbdc55103ee3a15824811a323b943f8e8302f96b17ae42db32d601fba31d0a5034e20ae06a4132e0eddcca44dc3c9564c0cac0c
SSDEEP

98304:aEZho1ht++lwbnvGEpGo6qWiRPuIWEQmzObBBxTzUSOwyQd190ta2gV:av1Xl+GEX6qRQmS/xfqfQdsa2gV

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
dc349926fb2def3c1d19bd1782368789_JaffaCakes118
unpack001/$1
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/$1
unpack001/$TEMP/$2
unpack001/360DrvMgr.exe
unpack001/360net.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

dc349926fb2def3c1d19bd1782368789_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$1
.exe windows:5 windows x86 arch:x86

72935488bf436921e784b9b5a788892a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\build\DriverManager\trunk\DrvMgr\Release\360DrvMgr.pdb

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
CreateMutexW
GetLongPathNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
InterlockedCompareExchange
DeleteCriticalSection
GetModuleHandleW
GetTickCount
FlushInstructionCache
WriteFile
lstrcmpiA
CreateEventW
SetEvent
lstrcmpiW
ExitProcess
GetPrivateProfileStringW
GetWindowsDirectoryW
WaitForMultipleObjects
SetLastError
GetPrivateProfileIntW
WritePrivateProfileStringW
InterlockedDecrement
InterlockedIncrement
GetTempFileNameW
GetTempPathW
LoadLibraryExW
SetUnhandledExceptionFilter
CreateDirectoryW
GetEnvironmentVariableW
GetModuleHandleExW
CloseHandle
GetLastError
FindFirstFileW
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
FindNextFileW
FreeEnvironmentStringsW
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
InitializeCriticalSection
GetModuleFileNameA
GetStdHandle
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
CreateThread
ExitThread
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
OpenThread
TlsSetValue
SetEnvironmentVariableW
TlsGetValue
GetSystemTime
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
GetStartupInfoW
CreateProcessW
GetDiskFreeSpaceExW
WaitForSingleObject
GetExitCodeProcess
QueryDosDeviceW
GetCurrentProcess
OpenProcess
MultiByteToWideChar
lstrlenA
ReadFile
SetFilePointer
FindClose
DeleteFileW
GetCurrentThreadId
WideCharToMultiByte
FindResourceExW
FreeLibrary
lstrlenW
LoadResource
LockResource
SizeofResource
FindResourceW
RaiseException
LocalFree
GetCommandLineW
GetSystemDirectoryW
GetVersionExW
GetModuleFileNameW
GetModuleHandleA
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapDestroy
CreateFileW
DeviceIoControl
GetConsoleCP
GetCurrentProcessId
GetProcAddress
GetEnvironmentStringsW

user32

EnableWindow
GetWindowRect
GetDlgItem
CreateWindowExW
GetParent
UnregisterClassA
SetWindowTextW
MoveWindow
ScreenToClient
InvalidateRect
CopyRect
LoadIconW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CreateDialogParamW
IsWindow
SendMessageTimeoutW
GetClassInfoW
RegisterClassW
SetRect
MessageBoxW
KillTimer
SetTimer
GetWindowPlacement
MonitorFromPoint
DestroyMenu
GetSubMenu
EnableMenuItem
TrackPopupMenu
DeleteMenu
LoadMenuW
DestroyWindow
DialogBoxParamW
IsIconic
SetForegroundWindow
BringWindowToTop
RedrawWindow
PostQuitMessage
SendMessageW
InflateRect
IsDlgButtonChecked
CheckDlgButton
GetWindowTextLengthW
GetWindowTextW
CallWindowProcW
IsDialogMessageW
SetWindowLongW
EndPaint
BeginPaint
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
DestroyIcon
EndDialog
ExitWindowsEx
ShowWindow
GetSystemMetrics
LoadImageW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
FindWindowExW
PostMessageW
RegisterWindowMessageW
FindWindowW
GetShellWindow
GetWindowThreadProcessId
GetDC
ReleaseDC
GetActiveWindow

gdi32

BitBlt
GetTextExtentPointW
SetBkColor
ExtTextOutW
EnumFontFamiliesW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
CreateFontW

advapi32

SetEntriesInAclW
RegEnumKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
GetAclInformation
GetAce
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA

shell32

CommandLineToArgvW
ShellExecuteW
ord165
SHGetSpecialFolderPathW
SHFileOperationW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocStringByteLen

shlwapi

AssocQueryStringW
PathIsRootW
StrCmpIW
SHGetValueA
PathStripPathW
PathAddBackslashW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW
SHSetValueW
StrStrIW
StrStrW
StrCmpW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
SHSetValueA
StrStrA

comctl32

InitCommonControlsEx

iphlpapi

GetIpAddrTable

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

psapi

GetModuleFileNameExW

dbghelp

MiniDumpWriteDump

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

netapi32

Netbios

Sections

.text
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$TEMP/$1
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$2
.dll windows:4 windows x86 arch:x86

8df26927f8978d4eb40ff179c0aa961b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
lstrcmpA
OpenProcess
lstrcpyA
LoadLibraryA
CloseHandle
FreeLibrary
GetVersionExA
lstrlenA
GlobalFree

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360DrvMgr.exe
.exe windows:5 windows x86 arch:x86

72935488bf436921e784b9b5a788892a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\build\DriverManager\trunk\DrvMgr\Release\360DrvMgr.pdb

Imports

kernel32

LeaveCriticalSection
EnterCriticalSection
CreateMutexW
GetLongPathNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
InterlockedCompareExchange
DeleteCriticalSection
GetModuleHandleW
GetTickCount
FlushInstructionCache
WriteFile
lstrcmpiA
CreateEventW
SetEvent
lstrcmpiW
ExitProcess
GetPrivateProfileStringW
GetWindowsDirectoryW
WaitForMultipleObjects
SetLastError
GetPrivateProfileIntW
WritePrivateProfileStringW
InterlockedDecrement
InterlockedIncrement
GetTempFileNameW
GetTempPathW
LoadLibraryExW
SetUnhandledExceptionFilter
CreateDirectoryW
GetEnvironmentVariableW
GetModuleHandleExW
CloseHandle
GetLastError
FindFirstFileW
lstrcmpA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
FindNextFileW
FreeEnvironmentStringsW
FlushFileBuffers
GetStartupInfoA
GetFileType
SetHandleCount
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
GetACP
GetConsoleMode
InitializeCriticalSection
GetModuleFileNameA
GetStdHandle
HeapCreate
GetCPInfo
LCMapStringW
LCMapStringA
CreateThread
ExitThread
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
OpenThread
TlsSetValue
SetEnvironmentVariableW
TlsGetValue
GetSystemTime
FormatMessageW
OutputDebugStringW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
GetStartupInfoW
CreateProcessW
GetDiskFreeSpaceExW
WaitForSingleObject
GetExitCodeProcess
QueryDosDeviceW
GetCurrentProcess
OpenProcess
MultiByteToWideChar
lstrlenA
ReadFile
SetFilePointer
FindClose
DeleteFileW
GetCurrentThreadId
WideCharToMultiByte
FindResourceExW
FreeLibrary
lstrlenW
LoadResource
LockResource
SizeofResource
FindResourceW
RaiseException
LocalFree
GetCommandLineW
GetSystemDirectoryW
GetVersionExW
GetModuleFileNameW
GetModuleHandleA
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapDestroy
CreateFileW
DeviceIoControl
GetConsoleCP
GetCurrentProcessId
GetProcAddress
GetEnvironmentStringsW

user32

EnableWindow
GetWindowRect
GetDlgItem
CreateWindowExW
GetParent
UnregisterClassA
SetWindowTextW
MoveWindow
ScreenToClient
InvalidateRect
CopyRect
LoadIconW
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CreateDialogParamW
IsWindow
SendMessageTimeoutW
GetClassInfoW
RegisterClassW
SetRect
MessageBoxW
KillTimer
SetTimer
GetWindowPlacement
MonitorFromPoint
DestroyMenu
GetSubMenu
EnableMenuItem
TrackPopupMenu
DeleteMenu
LoadMenuW
DestroyWindow
DialogBoxParamW
IsIconic
SetForegroundWindow
BringWindowToTop
RedrawWindow
PostQuitMessage
SendMessageW
InflateRect
IsDlgButtonChecked
CheckDlgButton
GetWindowTextLengthW
GetWindowTextW
CallWindowProcW
IsDialogMessageW
SetWindowLongW
EndPaint
BeginPaint
GetWindow
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
DestroyIcon
EndDialog
ExitWindowsEx
ShowWindow
GetSystemMetrics
LoadImageW
GetClassInfoExW
RegisterClassExW
DefWindowProcW
FindWindowExW
PostMessageW
RegisterWindowMessageW
FindWindowW
GetShellWindow
GetWindowThreadProcessId
GetDC
ReleaseDC
GetActiveWindow

gdi32

BitBlt
GetTextExtentPointW
SetBkColor
ExtTextOutW
EnumFontFamiliesW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
CreateFontW

advapi32

SetEntriesInAclW
RegEnumKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
GetTokenInformation
GetAclInformation
GetAce
GetNamedSecurityInfoW
BuildExplicitAccessWithNameW
SetNamedSecurityInfoW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
DuplicateTokenEx
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA

shell32

CommandLineToArgvW
ShellExecuteW
ord165
SHGetSpecialFolderPathW
SHFileOperationW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW

ole32

CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemRealloc

oleaut32

VarUI4FromStr
SysStringByteLen
SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocStringByteLen

shlwapi

AssocQueryStringW
PathIsRootW
StrCmpIW
SHGetValueA
PathStripPathW
PathAddBackslashW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW
SHSetValueW
StrStrIW
StrStrW
StrCmpW
SHGetValueW
PathCombineW
PathRemoveFileSpecW
PathAppendW
PathFileExistsW
SHSetValueA
StrStrA

comctl32

InitCommonControlsEx

iphlpapi

GetIpAddrTable

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

psapi

GetModuleFileNameExW

dbghelp

MiniDumpWriteDump

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

crypt32

CertGetNameStringW

netapi32

Netbios

Sections

.text
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
360net.dll
.dll windows:5 windows x86 arch:x86

7798693498546131ee99236cc7e4b7d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\360Net_2\Release\360net.pdb

Imports

wininet

InternetQueryOptionW
InternetReadFileExA
InternetCrackUrlW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetConnectW
InternetOpenW
InternetSetStatusCallbackA
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle

kernel32

WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetProcessHeap
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
InitializeCriticalSection
DeleteCriticalSection
MultiByteToWideChar
GetTickCount
lstrlenA
GetFileAttributesW
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
ReleaseMutex
WaitForSingleObject
GetLastError
CreateFileW
CreateEventW
WriteFile
SetEndOfFile
SetFilePointerEx
GetSystemTime
GetLocalTime
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
SetFilePointer
GetFileSizeEx
ReleaseSemaphore
ReadFile
CreateMutexW
CreateSemaphoreW
Sleep
GetLocaleInfoW
ResetEvent
DeleteFileW
GetPrivateProfileStringW
lstrlenW
WaitForMultipleObjects
SetUnhandledExceptionFilter
CreateThread
GetUserDefaultLangID
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
CreateFileA
GetStartupInfoA
SetHandleCount
GetFileType
SetStdHandle
GetModuleHandleA
HeapSize
LCMapStringW
LCMapStringA
GetTimeZoneInformation
SetEnvironmentVariableA
FlushFileBuffers
CompareStringA
CompareStringW
SetEvent
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThread
HeapFree
HeapAlloc
RtlUnwind
RaiseException
GetCommandLineA
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement

user32

PostMessageW
PostThreadMessageW
SetFocus
CreateDialogParamW
ShowWindow
GetWindowLongW
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW
DestroyWindow
GetDlgItemTextW
IsDlgButtonChecked
SetWindowsHookExW
SetWindowTextW
SetDlgItemTextW
GetDlgItem
SendMessageW
CheckDlgButton
GetDesktopWindow
SetForegroundWindow
PostQuitMessage
UnhookWindowsHookEx
IsDialogMessageW
CallNextHookEx
wsprintfW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegSetValueExW

shell32

SHGetSpecialFolderPathW

ws2_32

getpeername
WSAGetLastError

Exports

Exports

HttpCancel
HttpCreateDownloadObj
HttpDeleteDownloadObj
HttpDownload
HttpDownloadExA
HttpDownloadExW
HttpGetAllPeer
HttpGetConnectState
HttpGetContentLength
HttpGetCurrentSpeed
HttpGetLastError
HttpGetLastErrorA
HttpGetLastErrorW
HttpGetMD5
HttpGetReceivedLength
HttpGetResumedLength
HttpGetState
HttpGetStateA
HttpGetStateW
HttpInitDownPara
HttpResetAll
HttpWait

Sections

.text
Size: 218KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 21KB - Virtual size: 20KB

72935488bf436921e784b9b5a788892a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

iphlpapi

version

psapi

dbghelp

wintrust

crypt32

netapi32

Sections

.text Size: 368KB - Virtual size: 367KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 18KB - Virtual size: 35KB

.rsrc Size: 89KB - Virtual size: 89KB

.reloc Size: 16KB - Virtual size: 16KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 21KB - Virtual size: 20KB

.text
Size: 368KB - Virtual size: 367KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 18KB - Virtual size: 35KB

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 172B

.text
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 104B

.text
Size: 368KB - Virtual size: 367KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 18KB - Virtual size: 35KB

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 16KB - Virtual size: 16KB

.text
Size: 218KB - Virtual size: 218KB

.rdata
Size: 29KB - Virtual size: 28KB

.data
Size: 5KB - Virtual size: 13KB