ea3e16dd44435191d9b1395a9af70791_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ea3e16dd44435191d9b1395a9af70791_JaffaCakes118
Size

632KB
MD5

ea3e16dd44435191d9b1395a9af70791
SHA1

d7fe822db1c74848bfb7232b356eda3b61156459
SHA256

7350b25c42de6c4dac0fcf3066aae64a74b509d0f63bcea13ac61f5bb23125b2
SHA512

e3e562d411dc010579b1fbf1137fb7841e50628b4ee763e268ddadda3438d27343f8bb6fe0144ea7db3e0a356f6afd2fbafde8439ac336fad5fe4e8bdbd2e20a
SSDEEP

12288:fEDLH8xDDgjuPCAh7GqQVOZ7oS03OmXj7xZ6VT98i2woBEBgip4ki:ID8xDEOCiaqQVOZ0xPz7xZkCyP4/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/uninstall.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

Files

ea3e16dd44435191d9b1395a9af70791_JaffaCakes118
.rar
Ku6SpeedUpper.exe
.exe windows:4 windows x86 arch:x86

56cd5b43d0640242b7be872862929b3e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6b
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

10/06/2009, 00:00

Not After

10/06/2011, 23:59

Subject

CN=酷溜网(北京)信息技术有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=酷溜网(北京)信息技术有限公司,L=海淀区,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

26:90:27:72:d4:e7:38:6c:85:dd:4e:f7:a7:e9:3a:6f:25:7e:b5:50
Signer

Actual PE Digest

26:90:27:72:d4:e7:38:6c:85:dd:4e:f7:a7:e9:3a:6f:25:7e:b5:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\work\ku6src\clientms\p2p\client\Release\p2pclient.pdb

Imports

kernel32

GetFileAttributesW
GetFileTime
VirtualProtect
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
LocalAlloc
GlobalReAlloc
GlobalHandle
TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
SetErrorMode
GetCurrentDirectoryW
GetStartupInfoW
ExitProcess
RtlUnwind
ExitThread
CreateThread
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
HeapReAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
IsBadWritePtr
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
lstrcmpiW
GlobalFindAtomW
GlobalDeleteAtom
GetModuleHandleA
LoadLibraryA
lstrcatW
lstrcmpW
GetModuleHandleW
GetVersionExA
lstrlenA
SetLastError
GlobalFree
MulDiv
FormatMessageW
lstrcpynW
LocalFree
GetModuleFileNameW
MoveFileExW
WinExec
GetLocalTime
OutputDebugStringW
CreateSemaphoreW
FindResourceExW
FreeResource
GetSystemTime
InterlockedIncrement
RaiseException
GetCurrentProcess
SetProcessWorkingSetSize
FindFirstFileW
FindNextFileW
FindClose
RemoveDirectoryW
GetLastError
GetSystemDirectoryW
CreatePipe
SetPriorityClass
MoveFileW
DeleteFileW
CreateProcessW
GetExitCodeProcess
ResetEvent
PeekNamedPipe
ReadFile
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedDecrement
lstrlenW
GetProcAddress
GetWindowsDirectoryW
LoadLibraryW
FreeLibrary
lstrcpyW
GlobalAddAtomW
SetFileAttributesW
GetTempFileNameW
GetTempPathW
CreateDirectoryW
CreateEventW
WaitForSingleObject
SetThreadPriority
GetCurrentThreadId
GetExitCodeThread
SetEvent
TerminateThread
GetTickCount
GetCurrentProcessId
OpenProcess
TerminateProcess
GetLogicalDrives
GetDriveTypeW
CreateFileW
DeviceIoControl
GetDiskFreeSpaceExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CloseHandle
GetCommandLineW
GetVersion
ReadProcessMemory
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
WritePrivateProfileStructW
GetPrivateProfileStructW
WritePrivateProfileStringW
Sleep
WideCharToMultiByte
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
GetModuleFileNameA
InterlockedExchange

user32

MapDialogRect
GetMessageW
ValidateRect
InvalidateRgn
CopyAcceleratorTableW
SetRect
IsRectEmpty
CharNextW
WindowFromPoint
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
MoveWindow
SetWindowTextW
IsDialogMessageW
EndPaint
BeginPaint
GetWindowDC
DrawTextExW
DrawTextW
TabbedTextOutW
GetActiveWindow
CreateDialogIndirectParamW
IsWindowEnabled
GetNextDlgTabItem
EndDialog
wsprintfW
CharUpperW
WinHelpW
GetCapture
CreateWindowExW
SetWindowsHookExW
CallNextHookEx
GetClassInfoExW
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
SendDlgItemMessageW
SendDlgItemMessageA
GetFocus
SetFocus
IsChild
GetWindowTextLengthW
GetWindowTextW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
PostQuitMessage
MapWindowPoints
GetKeyState
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
GetClassInfoW
RegisterClassW
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
OffsetRect
IntersectRect
SystemParametersInfoA
LoadIconW
RegisterWindowMessageW
LoadMenuW
IsWindow
TrackPopupMenu
GetSubMenu
GetCursorPos
SetForegroundWindow
SetWindowPos
ShowWindow
MessageBoxW
GetWindowPlacement
GetWindow
UnhookWindowsHookEx
GetMenuState
GetMenuItemID
GetMenuItemCount
PeekMessageW
TranslateMessage
DispatchMessageW
UnregisterHotKey
RegisterHotKey
UnregisterClassW
PostThreadMessageW
ExitWindowsEx
FindWindowW
GetAsyncKeyState
GetSystemMetrics
LoadAcceleratorsW
EmptyClipboard
SetClipboardData
CloseClipboard
ShowCursor
TranslateAcceleratorW
SystemParametersInfoW
OpenClipboard
KillTimer
SetTimer
IsWindowVisible
GetNextDlgGroupItem
RegisterClipboardFormatW
GetSysColorBrush
SetWindowContextHelpId
GetMessagePos
GetDesktopWindow
DestroyMenu
SetCursor
PtInRect
InflateRect
SendMessageW
GetWindowRect
GetClientRect
GetDC
ReleaseDC
InvalidateRect
RedrawWindow
SetCapture
GetParent
EnableWindow
ReleaseCapture
GetSysColor
MessageBeep
CopyIcon
LoadCursorW
SetWindowLongW
CopyRect
LockWindowUpdate
GetWindowLongW
SetRectEmpty
PostMessageW
ClientToScreen
ScreenToClient
CheckMenuItem
EnableMenuItem
ModifyMenuW
IsIconic
IsZoomed
SetWindowRgn
BringWindowToTop
GrayStringW

gdi32

GetTextColor
GetRgnBox
GetMapMode
EnumFontFamiliesExW
GetBkColor
CreateRectRgnIndirect
CreateBitmap
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
GetStockObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
SetMapMode
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
BitBlt
CreateCompatibleDC
CombineRgn
CreateRectRgn
CreateCompatibleBitmap
GetTextExtentPoint32W
GetObjectW
CreateFontIndirectW
SelectObject

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegQueryValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyW
RegCloseKey

shell32

Shell_NotifyIconW
ShellExecuteW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
SHGetSpecialFolderPathW

comctl32

ord17
ImageList_Destroy
PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathIsDirectoryW
PathFindFileNameW

oledlg

OleUIBusyW

ole32

CoInitialize
CoCreateGuid
CoInitializeEx
CLSIDFromProgID
CoTaskMemFree
CoCreateInstance
CoUninitialize
OleIsCurrentClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoTaskMemAlloc
CreateILockBytesOnHGlobal
CLSIDFromString
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
CoRegisterMessageFilter
OleFlushClipboard

oleaut32

SysStringLen
SysAllocString
VarDateFromStr
VariantInit
VariantClear
VariantChangeType
SysAllocStringLen
OleCreateFontIndirect
VariantCopy
DispCallFunc
LoadRegTypeLi
SystemTimeToVariantTime
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElemsize
SafeArrayCreate
SysFreeString

urlmon

URLDownloadToFileW

ws2_32

select
accept
recvfrom
htonl
getsockname
WSAIoctl
WSAGetLastError
ntohl
WSACleanup
WSAStartup
ntohs
gethostname
gethostbyname
inet_ntoa
sendto
inet_addr
htons
socket
ioctlsocket
listen
bind
setsockopt
__WSAFDIsSet
connect
send
recv
closesocket

iphlpapi

GetAdaptersInfo

psapi

GetModuleFileNameExW

wininet

InternetSetOptionW
InternetGetCookieW
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
HttpQueryInfoW
InternetReadFile

Sections

.text
Size: 780KB - Virtual size: 776KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ku6SpeedUpper.ini
License.txt
LiveUpdate.ini
Mp4Combiner.dll
.exe windows:4 windows x86 arch:x86

eb87c734f00057896717b35c7887d49e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6b
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

10/06/2009, 00:00

Not After

10/06/2011, 23:59

Subject

CN=酷溜网(北京)信息技术有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=酷溜网(北京)信息技术有限公司,L=海淀区,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

58:6a:24:18:e5:f9:4f:e1:08:65:a0:4c:ec:3b:3a:81:00:41:78:02
Signer

Actual PE Digest

58:6a:24:18:e5:f9:4f:e1:08:65:a0:4c:ec:3b:3a:81:00:41:78:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

fgetc
fputc
fwrite
memmove
_iob
fprintf
vfprintf
_exit
_XcptFilter
exit
__p___initenv
realloc
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_strdup
fflush
setlocale
_filelengthi64
fsetpos
fgetpos
sprintf
strstr
strcat
tmpfile
_ftime
strlen
strcmp
strcpy
memcmp
memcpy
fopen
fread
fclose
free
malloc
memset
__mb_cur_max
_isctype
_pctype
__getmainargs
_ftol
_fileno
_strnicmp
_stricmp

kernel32

FreeLibrary
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetCurrentProcessId
DeleteFileA
UnmapViewOfFile

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

Sections

.text
Size: 148KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
uninstall.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

Files

56cd5b43d0640242b7be872862929b3e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6bCertificate

Extended Key Usages

Key Usages

26:90:27:72:d4:e7:38:6c:85:dd:4e:f7:a7:e9:3a:6f:25:7e:b5:50Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

urlmon

ws2_32

iphlpapi

psapi

wininet

Sections

.text Size: 780KB - Virtual size: 776KB

.rdata Size: 144KB - Virtual size: 142KB

.data Size: 16KB - Virtual size: 33KB

shared Size: 4KB - Virtual size: 4B

.rsrc Size: 232KB - Virtual size: 231KB

eb87c734f00057896717b35c7887d49e

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6bCertificate

Extended Key Usages

Key Usages

58:6a:24:18:e5:f9:4f:e1:08:65:a0:4c:ec:3b:3a:81:00:41:78:02Signer

Headers

File Characteristics

Imports

msvcrt

kernel32

winmm

Sections

.text Size: 148KB - Virtual size: 144KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 2KB

7fa974366048f9c551ef45714595665e

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6b
Certificate

26:90:27:72:d4:e7:38:6c:85:dd:4e:f7:a7:e9:3a:6f:25:7e:b5:50
Signer

.text
Size: 780KB - Virtual size: 776KB

.rdata
Size: 144KB - Virtual size: 142KB

.data
Size: 16KB - Virtual size: 33KB

shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 232KB - Virtual size: 231KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

f1:03:e0:01:8f:a5:66:2e:bf:f6:75:18:36:a0:6e:6b
Certificate

58:6a:24:18:e5:f9:4f:e1:08:65:a0:4c:ec:3b:3a:81:00:41:78:02
Signer

.text
Size: 148KB - Virtual size: 144KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 2KB

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 26KB - Virtual size: 25KB