dd67d90133abdba6309610d38d38884e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

dd67d90133abdba6309610d38d38884e_JaffaCakes118
Size

1.1MB
MD5

dd67d90133abdba6309610d38d38884e
SHA1

4513f28130a4aa40025bd55caadd4072dc1c298d
SHA256

172f2e6f91fa2a7eea94ee7466c943c11e122e7f07f521c0d7d7ef81426b27ad
SHA512

8105486b4b5583d724d2cf22e2e1bd201dd132e15f5bd45ee590878aecc68158fdae54d6e3ab30c511d7dfa661b779d897f49d3a04d9c449d9a2844eb76a1d78
SSDEEP

24576:miOlrqFE7jtRy3xkvAHc87iyb/RfPqwchVAXhgq1kcG+iBdHFE:miiljUQpyjRfiWgq1rJipE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dd67d90133abdba6309610d38d38884e_JaffaCakes118

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

dd67d90133abdba6309610d38d38884e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9c523d8653da5455667e3f82274f2f88

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
lstrcmpiA
CopyFileA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCurrentProcess

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Baidu/Toolbar/Custom Buttons/custom.xml
$PROFILE/AppData/LocalLow/Baidu/Toolbar/Custom Buttons/custom.xml
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
.dll regsvr32 windows:4 windows x86 arch:x86

dbb6ae12303c20296c693f51a2687989

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
SetFilePointer
GetFileSize
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
OpenProcess
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
SetCurrentDirectoryW
TerminateThread
GetExitCodeThread
OpenMutexW
ReadFile
UnmapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
MapViewOfFile
CreateFileMappingW
Thread32Next
SuspendThread
OpenThread
Thread32First
SetPriorityClass
GetCommandLineW
SwitchToThread
ExpandEnvironmentStringsW
GetPrivateProfileIntW
WritePrivateProfileStringW
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
lstrcmpW
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
SetErrorMode
FileTimeToSystemTime
MoveFileExW
GetLocalTime
GetLocaleInfoW
SetEndOfFile
SetConsoleCtrlHandler
GetOEMCP
GetDriveTypeA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
UnhandledExceptionFilter
SetCurrentDirectoryA
GetCurrentDirectoryA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
HeapSize
GetCurrentThread
FatalAppExitA
ExitProcess
GetCommandLineA
GetFullPathNameW
RaiseException
ExitThread
GetDriveTypeW
FileTimeToLocalFileTime
GetSystemTime
GetTimeZoneInformation
HeapReAlloc
RtlUnwind
GetACP
GetPrivateProfileStringW
SetThreadPriority
ResumeThread
SetFileAttributesW
GetWindowsDirectoryW
DeviceIoControl
GetSystemDirectoryW
CopyFileW
GetVersionExW
CreateThread
CreateMutexW
WaitForSingleObject
GetTempFileNameW
DeleteFileW
ReleaseMutex
CompareStringW
LoadLibraryA
lstrcatW
lstrcpyW
DisableThreadLibraryCalls
TryEnterCriticalSection
HeapDestroy
lstrcpynW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
GetShortPathNameW
FreeLibrary
LocalFree
FindResourceW
LoadResource
LockResource
SizeofResource
CreateFileW
WideCharToMultiByte
WriteFile
CloseHandle
GetTempPathW
CreateDirectoryW
CreateProcessW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
OutputDebugStringA
GetVersion
GetFileAttributesW
GetModuleHandleA
GetProcAddress
SetLastError
GetCurrentThreadId
GetTickCount
Sleep
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetLastError
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
OutputDebugStringW
DebugBreak
GetCurrentProcess
FlushInstructionCache
lstrlenW
InterlockedDecrement
CompareStringA
SetEnvironmentVariableA
GetFileInformationByHandle

user32

GetSysColorBrush
MonitorFromRect
GetMonitorInfoW
SetRect
PostThreadMessageW
DrawIconEx
GetMessageW
WindowFromPoint
InflateRect
FindWindowExW
GetUpdateRect
ClientToScreen
DeleteMenu
GetTopWindow
MenuItemFromPoint
GetMenuItemID
IsRectEmpty
SetDlgItemTextW
CreateDialogParamW
GetDlgItemTextW
GetWindowDC
AdjustWindowRect
LoadIconW
EnumWindows
IsChild
IsDialogMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CharUpperW
CharUpperBuffA
GetAsyncKeyState
CharNextA
WaitForInputIdle
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CharLowerBuffW
CreatePopupMenu
AppendMenuW
CreateMenu
EnableMenuItem
TrackPopupMenu
RemoveMenu
DestroyMenu
CopyRect
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
LoadImageW
RedrawWindow
GetMenuItemInfoW
GetMenuItemCount
InsertMenuItemW
SetScrollPos
SetScrollInfo
GetScrollInfo
SetWindowRgn
GetMenuItemRect
RemovePropW
SetPropW
GetPropW
SetWindowLongA
DefWindowProcW
EndDialog
ShowWindow
SetWindowTextW
LoadStringW
IsWindow
SetWindowLongW
GetDlgItem
EndPaint
BeginPaint
GetDC
CallWindowProcW
GetWindowLongW
wvsprintfW
CharNextW
GetKeyState
CharLowerW
EnableWindow
DestroyIcon
DialogBoxParamW
FindWindowW
MessageBoxW
GetWindowThreadProcessId
GetGUIThreadInfo
IsWindowVisible
GetActiveWindow
AdjustWindowRectEx
MoveWindow
DrawTextW
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
FillRect
IsWindowUnicode
GetWindowLongA
EnumChildWindows
GetMessagePos
MessageBeep
SetMenuItemInfoW
FrameRect
GetSystemMetrics
GetDesktopWindow
ScrollWindow
GetClassLongW
SetClassLongW
CreateIconFromResourceEx
CharLowerBuffA
TrackPopupMenuEx
ModifyMenuW
GetSubMenu
DrawStateW
InsertMenuW
LoadBitmapW
DispatchMessageW
TranslateMessage
PeekMessageW
PostMessageW
DestroyWindow
KillTimer
SetTimer
CreateWindowExW
wsprintfW
LoadCursorW
RegisterClassExW
GetClassInfoExW
IsMenu
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindowRect
GetWindow
GetParent
SendMessageW
RegisterWindowMessageW
PtInRect
SetRectEmpty
ScreenToClient
GetCursorPos
ReleaseCapture
GetCapture
SetCapture
SetFocus
UpdateWindow
SetCursor
InvalidateRect
GetDlgCtrlID
OffsetRect
ReleaseDC
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
CallWindowProcA

gdi32

PatBlt
GetTextColor
Rectangle
CreateRoundRectRgn
FillRgn
CreateRectRgn
ExcludeClipRect
GetDeviceCaps
DPtoLP
SelectObject
MoveToEx
LineTo
DeleteObject
GetClipBox
ExtTextOutW
SaveDC
RestoreDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateBitmap
GetCurrentObject
CreateSolidBrush
GetTextExtentPoint32W
GetPixel
TextOutW
SetTextColor
DeleteDC
CreateFontIndirectW
SetBkMode
SetBkColor
GetStockObject
GetObjectW
CreatePen
SetViewportOrgEx

advapi32

RegCreateKeyW
GetUserNameW
RegSetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegOpenKeyW
SetSecurityInfo
GetSecurityDescriptorSacl
RegEnumKeyW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
CopySid

shell32

DuplicateIcon
DragQueryFileA
ExtractIconW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetFolderPathW

ole32

OleInitialize
OleUninitialize
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
CLSIDFromProgID
StringFromGUID2
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoCreateGuid

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
VariantCopy
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SetErrorInfo
GetErrorInfo
VariantInit
SysFreeString
CreateErrorInfo

shlwapi

SHCopyKeyW
StrStrIW
SHGetValueW
SHDeleteKeyW
PathFileExistsW
SHDeleteValueW
SHSetValueW
UrlCombineW
PathFindFileNameW
PathRemoveExtensionW
StrCmpIW
UrlUnescapeA
StrRetToStrW
StrRetToStrA
PathIsDirectoryA
PathRemoveFileSpecA
UrlUnescapeW
UrlCanonicalizeW
PathIsDirectoryW
PathRemoveFileSpecW

wininet

InternetCanonicalizeUrlW
GetUrlCacheEntryInfoW
InternetCloseHandle
InternetReadFile
InternetSetFilePointer
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
InternetOpenUrlW
HttpSendRequestExW
HttpEndRequestW
InternetGetConnectedState
DeleteUrlCacheEntryW
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetQueryOptionW
InternetGetCookieW
InternetSetCookieW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW

urlmon

URLDownloadToFileW
CoInternetGetSession

rpcrt4

UuidCreate

iphlpapi

GetNetworkParams
GetAdaptersInfo

ws2_32

gethostname
gethostbyname

msimg32

AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
RunOnceRemove
RunOnceUpdate
SVCUninstall
Uninstall
UpdateBaiduToolbar

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduService.exe
.exe windows:4 windows x86 arch:x86

b2e7f59043adad73fe020115daa83498

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

kernel32

GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcpynW
InitializeCriticalSection
lstrcpyW
lstrcatW
InterlockedDecrement
InterlockedIncrement
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
lstrlenW
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WideCharToMultiByte
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetCommandLineW
lstrcmpiW
LoadLibraryW
GetProcAddress
FreeLibrary
GetACP
GetOEMCP
FreeEnvironmentStringsW
GetCurrentProcess
WriteFile
GetStartupInfoA
GetFileType
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
UnhandledExceptionFilter
TerminateProcess
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentStringsW

user32

CharNextW
DispatchMessageW
GetMessageW
ShowWindow
PostThreadMessageW
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
CreateWindowExW
CallWindowProcW
GetWindowLongW
SetWindowLongW
PostQuitMessage
DestroyWindow
DefWindowProcW
FindWindowW
IsWindow
GetWindowThreadProcessId

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumValueW

ole32

CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx
CoTaskMemFree

oleaut32

SysAllocStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
.exe windows:4 windows x86 arch:x86

10c4284ada8f296e35a475657fe1334f

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
lstrlenW
GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcpynW
HeapDestroy
lstrcpyW
lstrcatW
InterlockedIncrement
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
CreateFileW
DeleteFileW
GetTempPathW
OpenThread
GetModuleFileNameA
VirtualQueryEx
WideCharToMultiByte
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringW
WriteFile
CopyFileW
CreateEventW
GetVersionExW
ReadFile
GetFileSize
SetFilePointer
SystemTimeToFileTime
FileTimeToSystemTime
GetFileInformationByHandle
GetLocalTime
GetTickCount
SetStdHandle
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
FlushFileBuffers
HeapCreate
GetVersionExA
CreateThread
WaitForSingleObject
CloseHandle
InterlockedDecrement
SetEvent
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
LeaveCriticalSection
CreateDirectoryW
LocalFree
GetEnvironmentVariableA
ExitProcess
GetVersion
GetStartupInfoW
GetModuleHandleA
RaiseException
GetFileAttributesA
HeapReAlloc
HeapAlloc
HeapFree
RtlUnwind

user32

DispatchMessageW
GetMessageW
DialogBoxParamW
GetActiveWindow
DestroyWindow
EndDialog
SetWindowLongW
wvsprintfW
LoadStringW
CharNextW
LoadImageW
GetSystemMetrics
ShowWindow
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindowRect
GetWindow
GetParent
GetWindowLongW
CharLowerBuffW
GetDesktopWindow
PostThreadMessageW
SendMessageW

advapi32

RegOpenKeyW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyW

shell32

SHGetFolderPathW

ole32

CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
VarUI4FromStr

psapi

GetModuleFileNameExW

dbghelp

SymGetModuleInfo
SymLoadModule
StackWalk
SymFunctionTableAccess
SymInitialize
SymGetOptions
SymSetOptions

wininet

HttpOpenRequestA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCloseHandle

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
.dll windows:4 windows x86 arch:x86

90fb0d3b9147b78e7ee69fa48ce244a0

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c523d8653da5455667e3f82274f2f88

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 110KB

.ndata Size: - Virtual size: 32KB

.rsrc Size: 24KB - Virtual size: 24KB

dbb6ae12303c20296c693f51a2687989

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

setupapi

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

urlmon

rpcrt4

iphlpapi

ws2_32

msimg32

Exports

Exports

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 264KB - Virtual size: 263KB

.data Size: 152KB - Virtual size: 165KB

.Shared Size: 4KB - Virtual size: 4B

.rsrc Size: 264KB - Virtual size: 261KB

.reloc Size: 148KB - Virtual size: 147KB

b2e7f59043adad73fe020115daa83498

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

shell32

shlwapi

kernel32

user32

advapi32

ole32

oleaut32

Sections

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 110KB

.ndata
Size: - Virtual size: 32KB

.rsrc
Size: 24KB - Virtual size: 24KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 264KB - Virtual size: 263KB

.data
Size: 152KB - Virtual size: 165KB

.Shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 264KB - Virtual size: 261KB

.reloc
Size: 148KB - Virtual size: 147KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 96KB - Virtual size: 95KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 68KB - Virtual size: 64KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 44KB - Virtual size: 41KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 208KB - Virtual size: 205KB

.reloc
Size: 4KB - Virtual size: 3KB