eaa75dbd974169462e0727a037a00198_JaffaCakes118
- SHA256 496e2ce2cd547220993e14276081e30c3069da1cb3055116fd20424b0668d53d
Overview
overview
7Static
static
7Tradutor B...om.exe
windows7-x64
7Tradutor B...om.exe
windows10-2004-x64
7$PLUGINSDIR/Aero.dll
windows7-x64
7$PLUGINSDIR/Aero.dll
windows10-2004-x64
7$PLUGINSDIR/Delay.dll
windows7-x64
3$PLUGINSDIR/Delay.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...rl.dll
windows7-x64
3$PLUGINSDI...rl.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...l.html
windows7-x64
3$PLUGINSDI...l.html
windows10-2004-x64
3$PLUGINSDI...d.html
windows7-x64
3$PLUGINSDI...d.html
windows10-2004-x64
1$PLUGINSDI...l.html
windows7-x64
3$PLUGINSDI...l.html
windows10-2004-x64
3$PLUGINSDI...flt.js
windows7-x64
3$PLUGINSDI...flt.js
windows10-2004-x64
3$PLUGINSDI...l.html
windows7-x64
3$PLUGINSDI...l.html
windows10-2004-x64
3$PLUGINSDI...oll.js
windows7-x64
3$PLUGINSDI...oll.js
windows10-2004-x64
3$PLUGINSDI...pl0.js
windows7-x64
3$PLUGINSDI...pl0.js
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Tradutor Binary Domain pt-BR baixesoft.com.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tradutor Binary Domain pt-BR baixesoft.com.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Aero.dll
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Aero.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Delay.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Delay.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WebCtrl.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WebCtrl.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PLUGINSDIR/scroll.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PLUGINSDIR/scroll.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
$PLUGINSDIR/tr_data/cred.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/tr_data/cred.html
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/tr_data/legal.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
$PLUGINSDIR/tr_data/legal.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
$PLUGINSDIR/tr_files/scroll.dflt.js
Resource
win7-20240708-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
$PLUGINSDIR/tr_files/scroll.dflt.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/tr_files/scroll.html
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/tr_files/scroll.html
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/tr_files/scroll.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/tr_files/scroll.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/tr_files/scroll.tpl0.js
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/tr_files/scroll.tpl0.js
Resource
win10v2004-20240802-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target eaa75dbd974169462e0727a037a00198_JaffaCakes118
- Size 3.8MB
- Sample240919-fyccfasemd
- SHA256 496e2ce2cd547220993e14276081e30c3069da1cb3055116fd20424b0668d53d
- MD5 eaa75dbd974169462e0727a037a00198
- SHA1 35a043f66063e844bc2a5edc761863a97771e9a5
- SHA512 07fef0e78b33d8cfaad2833c80d0fa07c1d60ed50132d0ce1b4277639f9e1a73a1a17345365c420587d3cf66ffd657855df10cc70962e6d083f0c6982f442383
- SSDEEP 98304:7hFBxV1m5VtG1gVXXLv8jArF9nBFYN8/0oTzkomaCJRxdfjzN:bBxG5VtlJbkjUF9yD2Yd9JXdLzN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/$PLUGINSDIR/Aero.dll acprotect -
resource yara_rule static1/unpack001/Tradutor Binary Domain pt-BR baixesoft.com.exe upx static1/unpack002/$PLUGINSDIR/Aero.dll upx - Unsigned PE 9 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tradutor Binary Domain pt-BR baixesoft.com.exe unpack002/$PLUGINSDIR/Aero.dll unpack003/out.upx unpack002/$PLUGINSDIR/Delay.dll unpack002/$PLUGINSDIR/System.dll unpack002/$PLUGINSDIR/WebCtrl.dll unpack002/$PLUGINSDIR/newadvsplash.dll unpack002/$PLUGINSDIR/nsDialogs.dll unpack002/out.upx - NSIS installer 1 IoCs
resource yara_rule static1/unpack002/out.upx nsis_installer_2
File Explorer
-
eaa75dbd974169462e0727a037a00198_JaffaCakes118.zip 3.8MB
-
Tradutor Binary Domain pt-BR baixesoft.com.exe.exe 3.8MB
-
$PLUGINSDIR/Aero.dll.dll 6KB
-
out.upx.dll 8KB
-
$PLUGINSDIR/Delay.dll.dll 7KB
-
$PLUGINSDIR/System.dll.dll 11KB
-
$PLUGINSDIR/WebCtrl.dll.dll 5KB
-
$PLUGINSDIR/desc.bmp129KB
-
$PLUGINSDIR/modern-wizard.bmp51KB
-
$PLUGINSDIR/newadvsplash.dll.dll 8KB
-
$PLUGINSDIR/nsDialogs.dll.dll 9KB
-
$PLUGINSDIR/scroll.html.html 22KB
-
$PLUGINSDIR/tg_logo.gif.gif 25KB
-
$PLUGINSDIR/tr_data/cred.html.html 33KB
-
$PLUGINSDIR/tr_data/legal.html.html 26KB
-
$PLUGINSDIR/tr_files/scroll.dflt.js171B
-
$PLUGINSDIR/tr_files/scroll.html.js 4KB
-
$PLUGINSDIR/tr_files/scroll.js.js 641B
-
$PLUGINSDIR/tr_files/scroll.tpl0.js.js 1KB
-
$PLUGINSDIR/tr_files/scroll0.css279B
-
$R04KB
-
out.upx.exe 48KB
Tradutor Binary Domain pt-BR baixesoft.com.exe
- SHA256 fcb3c3154b9a317644c73fc6345100531489194dd3244ca980ca828a3109e1f9
- MD5 de44cc672373fafe303d8b4605e70a3b
- SHA1 cb38a5e738322567d7399e3981f126f2a51d6c3e
- SHA512 e2c50db5d6e4778a5327bc01171d33f867fb8155796cefb0b7d7698d0cc8f1b497fd05ee84b6e1cd62b663610dab566cc69fa390112e42530b2c19c10510b569
- SSDEEP 98304:zFv7VNm7P/yh6VXVz1U7ADv7NBpwT+dysjzSKcIyVRdVfjzB:Rv7m7P/f91i7Mv7it2+1DV/VLzB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
254976
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
17KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
18KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/Aero.dll
- SHA256 ab864a3c247e9016414a4a8b26155942b7c3814cc99be6a59b86c456bd22c061
- MD5 5c7408c25f1076eb96908e5bba521bb5
- SHA1 46df8dfd93593360b9b6d2e4ab1892843246228d
- SHA512 9eebf8378a0eab0ab66e70f20aea185392ce0de36e63a37c07ccd93a5d1d8fe95a2ed8c428c63d6aa8c0a5b424e53e412fdeb0e5be2ee57f9eceafa19e03062c
- SSDEEP 96:+k+RX2Fg54iQrKWX09fODXCPbnV767ZJG:8X2FA4iyXNm7Ve7ZJ
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
31424
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Apply
Name
UPX0
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=36, id=1, productName=Unmarked objects,
count=1, id=48, version=9044,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
out.upx
- SHA256 ee34e62c1c4ba583e43f7e44f3280b8a796ada44c08351ee97ff1dda55f8a993
- MD5 17645192f3db5768a215b912e7e2ba98
- SHA1 bccc059e2bba3869838804e8dfce5aa545ae4390
- SHA512 a3f223b0e10266ac8ff8b22e4a663d46bddbda73c4dd875922ad72f6e96e8f3d23d17d583e7e7280fb4bcab6cb1f85c851e7433a8ff9abb267e0ccacf047e8e7
- SSDEEP 96:g/tjEzzMIFrCgN/fNxE+gGSxeB/J6E5BBGk767Z:INEzL9CeN2+pie/QE5BBde7Z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
1
Major OS version
5
Entry point
7620
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
840B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=36, id=1, productName=Unmarked objects,
count=1, id=48, version=9044,
count=1, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
$PLUGINSDIR/Delay.dll
- IMPHASH bb13ae3bcb238d1bf689a931b2a56cd6
- SHA256 b6691bf37f13e37bfc07d45990092fd9398f7eff8cb1bbad05e528def0307c4a
- MD5 4602d9a9ed82d646522ead08a58536a9
- SHA1 b070bad90e13e85c97bd4e530ca7958c22e36a5a
- SHA512 5ebad4e83d411799a25b1e462ac3c7683dd0c973f131eed29131af7a240f92f55e6c60b78f96388bf7c4134941353794d79ef6c91476e8def7e5c803544afec9
- SSDEEP 96:fkcYhKlqWFeJ9DekCN3jPpP4DyGE3qLNf:cXKMJRC5BfGE3qLN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7131
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpynA
GlobalAlloc
Sleep
CloseHandle
user32
GetWindowTextLengthA
SetWindowTextA
EnableWindow
wsprintfA
GetWindowTextA
msvcp60
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
msvcrt
__CxxFrameHandler
_adjust_fdiv
malloc
_initterm
_onexit
_beginthreadex
??2@YAPAXI@Z
atoi
_itoa
free
__dllonexit
DelayButton
Free
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
308B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=1, id=11, version=8047,
count=4, id=4, version=8047,
count=27, id=1, productName=Unmarked objects,
count=5, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$PLUGINSDIR/System.dll
- IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10544
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
520B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=42, version=8803,
count=4, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/WebCtrl.dll
- IMPHASH 38afb22849145136919da4ca045e0de8
- SHA256 f7e1e03c140cc86bb7b259f1882b4b461128d70213e7f030360a9c76d6c51884
- MD5 f134448c6531c16271d776cdc930cff8
- SHA1 6fa6ae69ee46486b33b41f08719319aca5d0382f
- SHA512 c83db0d30e51d5dba4fe4abab562fde9358f9970b32aef729f326f394e744698b936b134e8718afd9a2ac970daf287278b2685b77566c50f733f58897fd0c16d
- SSDEEP 96:EPR9lrwXckwd7NLLd8e1+A39Lji7juoxiApV3ii:EPR99tZd8e133xjkuri
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4368
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpyA
GlobalAlloc
MultiByteToWideChar
user32
GetClientRect
SetWindowLongA
GetWindowLongA
DefWindowProcA
ole32
OleInitialize
OleCreate
OleUninitialize
OleSetContainedObject
oleaut32
VariantInit
SysAllocString
VariantClear
ShowWebInCtrl
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
764B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
360B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
376B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, productName=Unmarked objects (old),
count=10, id=19, version=8022,
count=12, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$PLUGINSDIR/desc.bmp
- SHA256 038149f98d7b304877bd334c95a6773b2c7dd4f7c24f143e830a90b5ab717594
- MD5 0e73a529cb01fe15d58fe6e74ec706a7
- SHA1 982263c01c320dcee946002a7fe04007dd6008ef
- SHA512 98129e289a16ff10df989d532903f2e08c143b37124d9b3df4cb78d151db2e8171a951dc843157170ceb4c1d8f61cdcea86277edb156e5e9226bd49dd8faa4b3
- SSDEEP 3072:+ffbMGvQlIldIzbNFfsPDqagYJNPk2rSFETSHsD1X8HTaTVHLaIcgrXljU/8:eMGvuSI/r8VVk2rSFQSE1X1lXlo/8
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 bd556a37604e5d8b44ee376947490707bc05883160a61f42d19b16497c1e392f
- MD5 6a575d9d89f7da54f57bd521d225c90b
- SHA1 441a9ba067f845df11f0b61fa3bc424df4a00c20
- SHA512 3453e0470bd6fcaf9a7bfd2270862037de58c98e4ecaec83258ad00a9459f0b5a1186e22f271f9d2a2802025beb7f1d195e58685f13896ec2b1b04298771f1a8
- SSDEEP 768:jLfsyG54I1+OaOcej5ovtJIPTkD9PUJGuSL/V3wu4Y1r:jEgvOto//2GT9xZ1
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/newadvsplash.dll
- IMPHASH 2e363db44011ed76701ec6ce62db36f5
- SHA256 53377d0710f551182edbab4150935425948535d11b92bf08a1c2dcf989723bd7
- MD5 7ee14dff57fb6e6c644b318d16768f4c
- SHA1 9a5d5b31ab56ab01e9b0bd76c51b8b4605a8ccce
- SHA512 0565ff2bdbdf044c5f90bd45475d478b48cdbd5e19569976291b1bdd703e61355410c65f29f2c9213faf56251beb16d342c8625288dad6afc670717b9636d51f
- SSDEEP 96:qD5UDaGxZH52QhtZafDP9BTS9nPg83UniV/zRzGEl1DMl1zN6LmeYt4dO:W5UDaGxZH5T0j+9nl3BzG0IZ6LqN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6911
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
CloseHandle
MultiByteToWideChar
lstrcpynA
lstrlenA
GetCurrentThreadId
CreateThread
Sleep
lstrcpyA
lstrcmpiA
GlobalAlloc
GlobalFree
WaitForSingleObject
user32
DefWindowProcA
DestroyWindow
IsWindowVisible
UnregisterClassA
EnumDisplaySettingsA
SendMessageA
wsprintfA
SystemParametersInfoA
BeginPaint
SetWindowPos
LoadCursorA
RegisterClassA
CreateWindowExA
IsWindow
GetMessageA
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetWindowLongA
EndPaint
TranslateMessage
DispatchMessageA
PostMessageA
SetWindowRgn
GetClientRect
gdi32
CombineRgn
GetObjectA
CreateCompatibleDC
SelectObject
GetDIBits
CreateRectRgn
DeleteObject
winmm
timeSetEvent
PlaySoundA
timeKillEvent
oleaut32
OleLoadPicturePath
msvcrt
_lseek
memset
memcmp
_read
memcpy
_close
_open
strtol
hwnd
play
show
stop
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
269B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
598B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=3, id=19, version=8022,
count=58, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
$PLUGINSDIR/nsDialogs.dll
- IMPHASH 1e2884056e655f2b7bc5a904e352fc80
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7410
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA
user32
GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect
gdi32
SetTextColor
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
572B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=53, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=5, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/scroll.html
- SHA256 de324067675b39b96711b09263cc69270c685d6ac3bc611031775ae236348d5f
- MD5 c72424f1826536ad0f60b08cc6e35ce4
- SHA1 8792db36f8e01b5197681e29ffc5908e4e553ca0
- SHA512 eac150ee3948d32f2adb4fa16ec7023da8620205f61f56e5dbe40028cc74722f624585e69693a6a6c4baf59d561443b00efbdf3e891b4c402046d8ea79e80771
- SSDEEP 192:UB8178T5+KHxCHoN+TEMBSX4dOjUNOKi7KRd6ITKzLHxvXtX5GtAPCJza2Aq0Fa0:4y78TsXjY5IAWMFB3
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/tg_logo.gif
- SHA256 99616d738d6718fde19b8408310cf29383a12f315a8a86b521bb93ec5721fc92
- MD5 c7d46a49e9967694f856b566cfcf5e1f
- SHA1 80c17695f4d003070d35b99bd86adf0dabb4fc99
- SHA512 26881525d78eb2f002c643508cddb7eb9429906d50cad3b2a93c459095fe41a0f52ad9b8f0b67d0e7427507e2a15b00f47926989847f00a038b679d6aba1d513
- SSDEEP 384:bNNE3pK/+bmHtlcmmjDAzLLNsROum3xpKWWSgLs49yN1xSidK3mi1n:bg3rk3mPyNYax0WWT9ybxS8K33d
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/tr_data/cred.html
- SHA256 f6f9c61553c94a8134a4c0a1f104aca6cabbb5f5b410aa957a94a5fa228592d9
- MD5 9726c08e9cc36923743434a44e4f24ba
- SHA1 7b2b1a64a5cf6bf89a853aa770fba4a33d829104
- SHA512 dd95ffd5a21ae5e4c17448b01580a740fff1a54ef43e31502c7c8e9f00d46411fad0b39a8903b96a9d7888efb3767340eb84166e45e3d8ac9fe51766872bccb0
- SSDEEP 768:g8n55828G5y5J5W5CtUt4qDF6BHkseGLcBHP5eMHtueMaE/:g4jHdULcWqDF6BHkseGLcBHP5eMHtueW
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/tr_data/legal.html
- SHA256 228cd4bbb92734f1ee76daf0cded20902fb9b7d3ebff857f21ba60a798f3a511
- MD5 2e524a71ac033c0619db0594856ba6d5
- SHA1 450941553b685e48d6fab7b601b4d940ec73337d
- SHA512 444a7bd0d4a2e11675a7b43accda32932b16b727ff31daff56293014d37f0f081480c32034db9603999e7d3223c4407f67b05af577a66e17e3a3ee0df1c32ead
- SSDEEP 192:e78T5+KHxCHoN+TEMBSX4dOjUNOKi7KRd6ITKzLHxvXtX5GtAPCJza2Aq0Faemkd:e78TsujY5c5zJAWoJxly59V
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/tr_files/scroll.dflt.js
- SHA256 fb295cf92b819f9e7d95b62495aeb15e12cd3291add18093c946184127411984
- MD5 46903025390c7274e546ddcf50526cfa
- SHA1 c8cf17d978275fbeb42e040bb0538d212ce28654
- SHA512 94230f5826b8ce67e0b914687224387fe31187c59ecb20e6f1ad8189e6d3bea76de3c7f505b0c2373b2b5c37257e89a3db6d9c544b5b19cfd2c67995968f3ba2
- MD5 SHA1 SHA512
$PLUGINSDIR/tr_files/scroll.html
- SHA256 1d55105e632396f76b046513f1805f8144b8d2dc2a0d75dd78b37cb771be705c
- MD5 fa5e9eb978e1acd9cb8e6cbe2ba76510
- SHA1 a08920b5c81bd559a859757f6555863b1b0b804d
- SHA512 8a156d805f20029ce06e9a78922f21410c0a2b99ec6b9f7d8c26bbc69efefa221c8c9c3c7264a544405eaccac54c259ddeb77384b9ac826720d60ee5a3ef1757
- SSDEEP 96:QD9KskjS+e0nOJOJ3nctYcoUV1FzTOKKInCBsHSM4imf2fy:89LkjS90nmm3U3PFPOCnHmf2fy
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/tr_files/scroll.js
- SHA256 83c74fe20d8cd134c900bc18231311a307fe9d40508bb0a4a3c008333f4755bb
- MD5 451adb9f6bed8859cee8ffe17a356dc6
- SHA1 7606b460525934d666b19c6159167016bfa4ecfa
- SHA512 db4fde5819bef93f4c7709aaeee6ae79c87ae6d8283f408fd420847495ef618da5313b71e2da4afd6e3239b9d6e184856a8694ef201b3cc2d9de08074a6cfb2f
- MD5 SHA1 SHA512
$PLUGINSDIR/tr_files/scroll.tpl0.js
- SHA256 d61df469c5484d3c20ad027e741321dd1921285142cc8acf73cf363d7798e310
- MD5 39133e190f144254ac4a3ba40d8863a6
- SHA1 adb69965c2f4b76b10d029761e5eaa60dee10a5f
- SHA512 1c877ed7c7d76d858f79e1058181b4e77ccede55f782118f1c189dfd9d1a45e6c610154270f026c7c83fbbcd79e3fd96d3d12a3890508e9e420475a38157f36d
- MD5 SHA1 SHA512
$PLUGINSDIR/tr_files/scroll0.css
- SHA256 532b40642e87183ba650d1f719d86385425ccca5d46b21e1a206832e58b36fe9
- MD5 c4b2510ae8a1ef4fa79c026bdacf1bc4
- SHA1 9f770a9631995510ae09ebbfedd81c398682e800
- SHA512 f49f0df5c736e3cc3e17ada2447ddd919f8b35b781f13a7d85d4910e61346c3b8876de79b2c184c836e25417846b60a823a1ce24f3904ad711426067b867866d
- MD5 SHA1 SHA512
$R0
- SHA256 339213d60fb16c1ac4c1b1b1140bed2344bb7dcd672f67969b46429b7f17fd09
- MD5 079b47dc80f47f257942aed3655b8d3b
- SHA1 1e958c7184745c77d23ebbea0ac78c5804e922b2
- SHA512 728682166f9cc5b847e9b92febe6946db03873483c1fcdb3d27a5febf373a2d1a4edbccc2d50a02d3b4e24f2ea323a7ebafd2b5b58ff3054106cd58ec14487a3
- SSDEEP 96:Xb3+rWXmObWN4mU3fCAut7p6rVxDJJy9PPPzW0N:XzB2OKN4DfCAKorXVQPPPzRN
- MD5 SHA1 SHA512 SSDEEP
out.upx
- SHA256 a1ea7709f1775c7c46662cf152544441640985e608cd612389559382b96df23f
- MD5 e8e803cf8a221ef6dbeb2ef45a265206
- SHA1 8fc1be40dcfcda6b0546b6e2a4643af1e50084de
- SHA512 e00afe088c168aff3ace832b1cccc354fd750cc7ba8694a4d2224031266b4b17f1a1ccac85be615a92acfb552e54114ddba285f567fd68336b3a94eb800056e9
- SSDEEP 768:P1cVhpQI2EQK0iPDh84nScF15GYb4a1I4bHcPWXvLmY5rxvvlMxN:dQpQ5EP0ijnRtPPXvLmY5rxiD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
80KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,