dc856427cd60e255078c1c4de4c86127_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

dc856427cd60e255078c1c4de4c86127_JaffaCakes118
Size

408KB
MD5

dc856427cd60e255078c1c4de4c86127
SHA1

9fdd249e93956d968ffb010e390508416e7afea8
SHA256

449b63bb02eba2600e39d7dd152a4884b4cb28aa6a000078ff8995b407dbc47c
SHA512

996b1251a65b63a8a84b3ddccf04de02ab7f0d1a089365ceacf4d4e9efdffc0c86863b690d44e294cc48b221afa080e00bf196372eff94cb7963fb2829041b28
SSDEEP

12288:2lv+OAaMokOZoh7hTfnAKeHAT7MDnHd9A/u1X0yCZC:2lvtMScTfnBeHCCk/u1X0lC

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
dc856427cd60e255078c1c4de4c86127_JaffaCakes118
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$TEMP/credit-card-manager-for-flash-drives-1.01.69.exe
unpack001/$TEMP/windll.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

dc856427cd60e255078c1c4de4c86127_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28a099a911237a28521d8b7ea250f089

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 150KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

826f63babc644cdb846b4d888d102fa0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateFileA
CreateSemaphoreA
CreateThread
DeleteFileA
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetTickCount
GlobalAlloc
GlobalFree
InterlockedDecrement
InterlockedIncrement
MulDiv
ReleaseSemaphore
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForSingleObject
WriteFile
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA

msvcrt

_write
__dllonexit
_errno
_iob
abort
fflush
fputc
fputs
free
fwrite
malloc
memcpy
realloc
strcmp
strcpy
strlen

user32

CallWindowProcA
CharPrevA
CreateWindowExA
DestroyWindow
EnableWindow
FindWindowExA
GetClientRect
GetDlgItem
GetFocus
GetWindowLongA
GetWindowRect
IsWindowVisible
RegisterWindowMessageA
SendMessageA
SetDlgItemTextA
SetWindowLongA
SetWindowTextA
ShowWindow
wsprintfA

ws2_32

WSACleanup
WSAGetLastError
WSAStartup
__WSAFDIsSet
closesocket
connect
gethostbyname
getsockname
htons
inet_addr
ioctlsocket
recv
select
send
shutdown
socket

Exports

Exports

download
download_quiet

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 95B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/credit-card-manager-for-flash-drives-1.01.69.exe
.exe windows:4 windows x86 arch:x86

e45db0faa2d6ea8117244b8eeec66f7d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
GetVersionExA
GetVersion
CompareStringA
GetTimeZoneInformation
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
LCMapStringA
GetDriveTypeA
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentVariableA
GetCommandLineA
GetStartupInfoA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
RemoveDirectoryA
MoveFileA
RtlUnwind
DeleteFileA
SetEnvironmentVariableA
CreateDirectoryA
HeapFree
HeapAlloc
HeapCompact
TerminateProcess
ExitProcess
GetFileAttributesA
SetFileAttributesA
GetCurrentProcess
MoveFileExA
GetModuleHandleA
FormatMessageA
CopyFileA
SetFileTime
OpenFile
SetErrorMode
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTickCount
GetFullPathNameA
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetTempPathA
GetShortPathNameA
GetExitCodeProcess
CompareStringW
GetCurrentDirectoryA
SetCurrentDirectoryA
CreateProcessA
Sleep
lstrcatA
lstrlenA
WinExec
LoadLibraryA
GetProcAddress
FreeLibrary
GetDiskFreeSpaceA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CloseHandle
SetFilePointer
WriteFile
ReadFile
CreateFileA
GetLastError
FindFirstFileA
FindClose
GetWindowsDirectoryA
IsBadWritePtr
GetSystemDirectoryA

user32

ExitWindowsEx
IsIconic
PostQuitMessage
DefWindowProcA
DialogBoxParamA
PostMessageA
EndDialog
CheckDlgButton
SetTimer
BringWindowToTop
GetLastActivePopup
FindWindowA
RegisterClassA
LoadCursorA
SendMessageA
GetWindow
AdjustWindowRectEx
LoadIconA
GetSysColor
ScreenToClient
GetWindowRect
GetDlgItem
EndPaint
BeginPaint
GetClientRect
FillRect
DrawTextA
GetSystemMetrics
KillTimer
SendDlgItemMessageA
GetFocus
GetDlgItemTextA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
IsDlgButtonChecked
CheckRadioButton
SetFocus
GetParent
UpdateWindow
IsWindowVisible
InvalidateRect
CreateDialogParamA
RedrawWindow
PeekMessageA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
SetDlgItemTextA
SetWindowTextA
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
GetWindowLongA
IsWindowEnabled
CallWindowProcA
ValidateRect
SetWindowLongA
GetClassNameA
MessageBoxA
EnableWindow
wsprintfA

gdi32

DeleteDC
GetDeviceCaps
GetSystemPaletteEntries
CreatePalette
DeleteObject
ExtTextOutA
CreateFontIndirectA
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
RealizePalette
SelectPalette
CreateHalftonePalette
CreateDIBPatternBrush
CreateSolidBrush
SetBrushOrgEx
SetStretchBltMode
StretchDIBits
SetTextColor
SetBkMode
AddFontResourceA
SetBkColor
GetStockObject
RemoveFontResourceA

comdlg32

GetOpenFileNameA

advapi32

RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegCreateKeyA
RegEnumKeyExA
RegCloseKey
RegDeleteValueA
RegOpenKeyA
RegSetValueExA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA

shell32

DragQueryFileA
DragFinish
ShellExecuteA
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
DragAcceptFiles

ole32

CoGetMalloc
CoCreateInstance
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
VerFindFileA

comctl32

ord17

Sections

.text
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/windll.dll
.dll regsvr32 windows:4 windows x86 arch:x86

1ead172285f5243c389d04e360a8bfdf

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryA
FileTimeToLocalFileTime
GlobalMemoryStatusEx
FindFirstChangeNotificationW
GetSystemDirectoryA
OpenEventW
GetProfileStringA
GetFileType
FlushConsoleInputBuffer
GetNumberFormatA
FindAtomW
GetShortPathNameA
GetTimeFormatA
lstrcpynA
FindAtomA
SetNamedPipeHandleState
CreateMailslotA
SetProcessShutdownParameters
GetVolumeInformationW
SizeofResource
AreFileApisANSI
AllocConsole
SetDefaultCommConfigW
SetEndOfFile
lstrcatW
VerifyVersionInfoW
GetProfileIntA
GetDiskFreeSpaceExW
EnumUILanguagesW
GetCurrentProcess
GlobalMemoryStatus
GetProfileStringW
GetTempFileNameA
GetStdHandle
PurgeComm
VirtualQueryEx
LocalAlloc
TransactNamedPipe
CompareStringW
GetCPInfo
SetConsoleCtrlHandler
SetComputerNameExW
CreateNamedPipeA
OpenThread
GetDriveTypeW
SearchPathA
FindNextVolumeW
GetEnvironmentStrings
TerminateJobObject
GlobalAddAtomA
SetInformationJobObject
FreeEnvironmentStringsW
FindResourceExA
lstrcmpA
GetAtomNameW
LocalLock
DisconnectNamedPipe
FindResourceExW
PeekNamedPipe
ResetEvent
ReadConsoleA
GetDiskFreeSpaceA
RemoveDirectoryA
IsBadStringPtrW
GetThreadTimes
RaiseException
SetVolumeLabelA
EnumResourceNamesW
SetLastError
IsBadHugeWritePtr
FindCloseChangeNotification
GetFullPathNameW
GetEnvironmentStringsW
LocalReAlloc
CreateRemoteThread
GetConsoleMode
GlobalReAlloc
GetThreadContext
LocalFlags
PostQueuedCompletionStatus
CreateConsoleScreenBuffer
RtlUnwind
GetStringTypeA
SetFileTime
CreateEventW
ResumeThread
CopyFileExW
OpenJobObjectW
GetDateFormatW
SetConsoleCursorPosition
FindNextFileA
GlobalFlags
GetUserDefaultLCID
IsValidLocale
lstrcmpiA
GetVolumeNameForVolumeMountPointW
LCMapStringA
WaitNamedPipeA
WinExec
SetWaitableTimer
FindNextFileW
WriteProcessMemory
PeekConsoleInputA
ConnectNamedPipe
HeapDestroy
LoadResource
RegisterWaitForSingleObjectEx
SetConsoleTextAttribute
CreateWaitableTimerW
HeapCompact
GetStringTypeExW
MultiByteToWideChar
GetStringTypeExA
GetFileInformationByHandle
LocalFileTimeToFileTime
lstrcatA
CreateTimerQueue
IsProcessorFeaturePresent
LockFileEx
CancelWaitableTimer
DeleteFileW
FileTimeToDosDateTime
Beep
GetCurrentProcessId
LocalFree
GetLastError
DeleteFileA
HeapFree
ExpandEnvironmentStringsA
GetModuleHandleA
HeapAlloc
InterlockedIncrement
GetProcAddress
CreateMutexA
LeaveCriticalSection
GetComputerNameA
CreateFileA
CreateDirectoryA
InitializeCriticalSection
GetModuleFileNameA
CopyFileA
MapViewOfFile
LoadLibraryA
CreateThread
InterlockedExchange
Sleep
ProcessIdToSessionId

ole32

CoCreateInstanceEx
OleCreateFromFile
CreateILockBytesOnHGlobal
CoRegisterMessageFilter
PropVariantCopy
CreateAntiMoniker
OleLoadFromStream
CoGetObjectContext
OleDestroyMenuDescriptor
CreatePointerMoniker
CoCreateGuid
OleSetMenuDescriptor
CreateOleAdviseHolder
CoDisableCallCancellation
FreePropVariantArray
OleDuplicateData
OleQueryCreateFromData
ReadFmtUserTypeStg
BindMoniker
StgCreateDocfileOnILockBytes
CreateDataCache
StgOpenStorageOnILockBytes
PropVariantClear
CoRevertToSelf
GetRunningObjectTable
StgCreateDocfile
StringFromGUID2
StgIsStorageFile
CoQueryProxyBlanket
OleGetAutoConvert
OleQueryLinkFromData
MkParseDisplayName
CoFileTimeNow
CoGetCallContext
CoCreateInstance
OleSetContainedObject
CoInitialize

user32

SetRect
ScrollDC
GetWindowTextLengthW
GetScrollInfo
LoadImageW
GetWindowInfo
PeekMessageW
WindowFromPoint
TranslateMDISysAccel
EndDeferWindowPos
ChangeMenuA
RedrawWindow
WaitMessage
ToUnicodeEx
IsDialogMessageA
ChangeDisplaySettingsA
DestroyWindow
LoadStringA
SetDlgItemTextW
CheckMenuItem
AppendMenuW
DefMDIChildProcW
GetAsyncKeyState
UnionRect
UnhookWindowsHook
GetNextDlgTabItem
InternalGetWindowText
SetForegroundWindow
LoadCursorA
GetPropA
DefWindowProcW
GetMessageTime
CloseWindowStation
GetWindowTextA
UnregisterHotKey
SetMenuDefaultItem
SetTimer
MessageBoxIndirectA
SetCursorPos
MessageBeep
GetDC
ReplyMessage
DialogBoxIndirectParamA
DrawStateA
GetKeyNameTextW
CreateDialogParamW
CharPrevW
OpenDesktopW
InvalidateRect
LoadMenuW
GetDlgCtrlID
CreatePopupMenu
SendNotifyMessageW
UnregisterClassA
CreateWindowExW
GetClassInfoExW
IsDlgButtonChecked
TranslateAcceleratorW
EnableMenuItem
CharNextW
OffsetRect
MessageBoxW
TrackMouseEvent
GetDesktopWindow
wvsprintfW
MapVirtualKeyExW
DrawIconEx
CreateCaret
SetWindowLongW
CreateMenu
GetPropW
IsWindowEnabled
CharUpperBuffW
CloseDesktop
CreateDialogIndirectParamW
SetProcessDefaultLayout
BeginPaint
DrawTextW
LoadImageA
ModifyMenuA
SetClassLongW
SetThreadDesktop
TranslateAcceleratorA
SendNotifyMessageA
GetMenuItemInfoW
GetMenuItemRect
AllowSetForegroundWindow
GrayStringW
CallWindowProcA
ShowScrollBar
SetCursor
GetWindowRgn
DrawTextExW
SendInput
IsRectEmpty
HideCaret
LoadIconA
TrackPopupMenuEx
ScrollWindow
CharToOemW
IsWindowVisible
PtInRect
SetWindowsHookExW
GetMessageW
GetDlgItemInt
PackDDElParam
SetMenuItemInfoA
SetScrollPos
OemToCharBuffA
GetWindowThreadProcessId
RegisterClassExA
DefWindowProcA
GetWindowLongA
SendMessageA
CallNextHookEx
PeekMessageA
GetClientRect
GetMessageA
GetClassNameA
DispatchMessageA
UnhookWindowsHookEx
SetWindowsHookExA
FindWindowA

shell32

ShellAboutW
SHGetFileInfoW
SHChangeNotify
SHParseDisplayName
SHGetSpecialFolderLocation
SHPathPrepareForWriteW
SHGetFolderLocation
SHGetPathFromIDListW
SHCreateShellItem
SHGetSpecialFolderPathW
CommandLineToArgvW
SHFileOperationA
ShellExecuteW
ExtractIconW
ShellExecuteExW
SHGetFolderPathA
SHGetFileInfoA

gdi32

CreateDiscardableBitmap
PolyPolygon
CreatePenIndirect
CreateRoundRectRgn
PtInRegion
ScaleViewportExtEx
CloseFigure
CopyEnhMetaFileA
PlayEnhMetaFile
DeleteMetaFile
GetTextMetricsA
EnumMetaFile
GetPaletteEntries
GetCharWidthW
GetCharABCWidthsW
GetKerningPairsA
StretchDIBits
GetSystemPaletteUse
GetCharWidth32W
OffsetViewportOrgEx
GetNearestPaletteIndex
GetClipRgn
GetWindowExtEx
GetCharWidthA
IntersectClipRect
GetRegionData
CloseMetaFile
StartDocW
SetMagicColors
PolylineTo
AddFontResourceW
DescribePixelFormat
CreateEnhMetaFileW
GetGraphicsMode
CreateEnhMetaFileA
BitBlt
EndPath
SetBrushOrgEx
GetMetaFileA
SetMetaFileBitsEx
GetPolyFillMode
EnumFontFamiliesExA
CreateEllipticRgnIndirect
SetTextCharacterExtra
CreateFontIndirectA
PathToRegion
GetTextExtentExPointW
OffsetWindowOrgEx
SetTextColor
GetBkColor
GetTextExtentPoint32W
AnimatePalette
GetROP2
RectVisible
UpdateColors
CreateDIBSection
GetDCOrgEx
GetNearestColor
GetRgnBox
GetCharABCWidthsA
ModifyWorldTransform
CreateDIBPatternBrushPt
GetGlyphOutlineW
AddFontResourceA
StrokePath
CreateRectRgnIndirect
LineTo
CreateICA
GetTextFaceA
SetAbortProc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

28a099a911237a28521d8b7ea250f089

Headers

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

Sections

.text Size: 30KB - Virtual size: 29KB

.data Size: 512B - Virtual size: 144B

.rdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 150KB

.idata Size: 5KB - Virtual size: 4KB

.ndata Size: 1024B - Virtual size: 32KB

.rsrc Size: 2KB - Virtual size: 2KB

826f63babc644cdb846b4d888d102fa0

Headers

File Characteristics

Imports

advapi32

kernel32

msvcrt

user32

ws2_32

Exports

Exports

Sections

.text Size: 43KB - Virtual size: 42KB

.data Size: 16KB - Virtual size: 16KB

.rdata Size: 6KB - Virtual size: 6KB

.bss Size: - Virtual size: 24KB

.edata Size: 512B - Virtual size: 95B

.idata Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 2KB

e45db0faa2d6ea8117244b8eeec66f7d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

version

comctl32

Sections

.text Size: 136KB - Virtual size: 132KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 24KB - Virtual size: 24KB

.rsrc Size: 12KB - Virtual size: 10KB

1ead172285f5243c389d04e360a8bfdf

Headers

File Characteristics

Imports

kernel32

ole32

user32

shell32

gdi32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 78KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 30KB - Virtual size: 29KB

.data
Size: 512B - Virtual size: 144B

.rdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 150KB

.idata
Size: 5KB - Virtual size: 4KB

.ndata
Size: 1024B - Virtual size: 32KB

.rsrc
Size: 2KB - Virtual size: 2KB

.text
Size: 43KB - Virtual size: 42KB

.data
Size: 16KB - Virtual size: 16KB

.rdata
Size: 6KB - Virtual size: 6KB

.bss
Size: - Virtual size: 24KB

.edata
Size: 512B - Virtual size: 95B

.idata
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 136KB - Virtual size: 132KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 12KB - Virtual size: 10KB

.text
Size: 80KB - Virtual size: 78KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 3KB