ef9c80ba22bfbdf1e17692eea8ccc2e6_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

ef9c80ba22bfbdf1e17692eea8ccc2e6_JaffaCakes118
Size

1.6MB
MD5

ef9c80ba22bfbdf1e17692eea8ccc2e6
SHA1

235bda7539d2b4dcca94916ede2327e6ba283791
SHA256

c14ac291f1e47b79c3f967ff017945e59a50f90a3b1273cd2726504ec6b4e758
SHA512

04fad6dba5b1221e8e6a721f319d2c69e985f2c421dc13255568f723a9a36ec47299a251496dee4a019b58d8267328cee63797e9a184d54230659755a107bcee
SSDEEP

24576:WqH85THtZ8WKh8HG1y633VG4xHaJFcuKVvBaDiOuEluBbEqwXLlpbB:VcZtWWK+HOy633P6JFvdDi5EsNEqqlp9

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TotalRecorder Pro v5.2 正式注册版/DrvTR95L.dll
unpack001/TotalRecorder Pro v5.2 正式注册版/DrvTrNTl.dll
unpack001/TotalRecorder Pro v5.2 正式注册版/DrvTrNTm.dll
unpack001/TotalRecorder Pro v5.2 正式注册版/TotRecSched.exe
unpack001/TotalRecorder Pro v5.2 正式注册版/TotalRecorder.exe
unpack001/TotalRecorder Pro v5.2 正式注册版/WmpClipInfoForTrVis.dll
unpack001/TotalRecorder Pro v5.2 正式注册版/_shfoldr.dll
unpack001/TotalRecorder Pro v5.2 正式注册版/setup.exe

Files

ef9c80ba22bfbdf1e17692eea8ccc2e6_JaffaCakes118
.rar
TotalRecorder Pro v5.2 正式注册版/DRINST.EXE
TotalRecorder Pro v5.2 正式注册版/DRVTR95.INF
TotalRecorder Pro v5.2 正式注册版/DrvTR95.vxd
TotalRecorder Pro v5.2 正式注册版/DrvTR95L.dll
.dll windows:4 windows x86 arch:x86

8fc06be81771bbabb84b641d24aed229

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

UnmapViewOfFile
ReleaseSemaphore
WaitForSingleObject
Sleep
CloseHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateSemaphoreA
CreateFileMappingA
MapViewOfFile
GetLastError
SetLastError
UnMapSLFixArray
ThunkConnect32
K32Thk1632Prolog
K32Thk1632Epilog
MapSLFix
GetLocalTime
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
RaiseException
LoadLibraryA
HeapFree
ReadFile
ExitProcess
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
SetFilePointer
HeapAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
HeapReAlloc
UnmapViewOfFile
ReleaseSemaphore
WaitForSingleObject
Sleep
CloseHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
CreateSemaphoreA
CreateFileMappingA
MapViewOfFile
GetLastError
SetLastError
UnMapSLFixArray
ThunkConnect32
K32Thk1632Prolog
K32Thk1632Epilog
MapSLFix
GetLocalTime
GetCommandLineA
GetProcAddress
GetModuleHandleA
GetVersion
RaiseException
LoadLibraryA
HeapFree
ReadFile
ExitProcess
HeapCreate
HeapDestroy
SetHandleCount
GetFileType
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
WriteFile
SetFilePointer
HeapAlloc
SetStdHandle
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
HeapReAlloc

user32

FindWindowExA
SendMessageTimeoutA
PostMessageA
RegisterWindowMessageA

advapi32

RegCloseKey
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExA

Exports

Exports

MapMessage
drv_ThunkData32

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/DrvTR95M.drv
TotalRecorder Pro v5.2 正式注册版/DrvTrNTl.dll
.dll windows:4 windows x86 arch:x86

58d07a2a45c40f846221dfef2ecaae8c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MapViewOfFile
CreateFileMappingW
CreateSemaphoreW
UnmapViewOfFile
WideCharToMultiByte
WaitForSingleObject
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReleaseSemaphore
OpenProcess
CloseHandle
GetLastError
SetLastError
GetTimeZoneInformation
GetSystemTime
GetLocalTime
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
HeapFree
InitializeCriticalSection
ReadFile
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
InterlockedDecrement
InterlockedIncrement
SetFilePointer
MultiByteToWideChar
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
LoadLibraryA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW

user32

IsWindow
PostMessageW
RegisterWindowMessageW

advapi32

RegCloseKey
RegQueryValueExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW

Exports

Exports

DllMain
GetCommArAddr
LockoutStream
MapMessage
ReadRegValues

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/DrvTrNTm.dll
.dll windows:4 windows x86 arch:x86

51bffaf6b1932f0ed5fcfb3b9ae03d78

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateMutexW
GetTickCount
GetCurrentThreadId
_lclose
_lread
OpenFile
Sleep
LeaveCriticalSection
EnterCriticalSection
GetShortPathNameW
GetCurrentProcess
WaitForSingleObject
InitializeCriticalSection
GetProcAddress
LoadLibraryW
WideCharToMultiByte
GetModuleFileNameW
GetVersionExW
DeleteCriticalSection
FreeLibrary
DisableThreadLibraryCalls
ReleaseMutex
CreateFileW
GetLastError
SetFilePointer
WriteFile
CloseHandle
FindFirstFileW
FindClose
lstrcpynW
MoveFileW
DeleteFileW
GetCurrentProcessId

user32

DestroyWindow
PeekMessageW
DispatchMessageW
GetDesktopWindow
RegisterClassW
CreateWindowExW
SetWindowLongW
RegisterWindowMessageW
DefWindowProcW
SetTimer
KillTimer
PostMessageW

advapi32

GetTokenInformation
RegQueryValueExW
RegOpenKeyW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
FreeSid
EqualSid
AllocateAndInitializeSid
OpenProcessToken
RegCloseKey

winmm

waveOutGetNumDevs
waveInGetNumDevs
mixerGetNumDevs
waveOutGetDevCapsW
waveInGetDevCapsW
mixerGetDevCapsW
DriverCallback
mixerOpen
mixerClose
mixerGetLineInfoW
mixerSetControlDetails
mixerGetControlDetailsW
mixerGetLineControlsW
waveOutUnprepareHeader
waveOutSetVolume
waveOutSetPlaybackRate
waveOutSetPitch
waveOutPrepareHeader
waveOutGetVolume
waveOutGetPlaybackRate
waveOutGetPitch
waveOutBreakLoop
waveOutRestart
waveOutPause
waveOutWrite
waveOutReset
waveOutGetPosition
waveInUnprepareHeader
waveInPrepareHeader
waveInStart
waveInStop
waveInAddBuffer
waveInReset
waveInGetPosition
waveOutClose
waveInClose
waveOutOpen
waveInOpen
DefDriverProc

ntdll

wcschr
memcpy
memset
wcslen
strcpy
wcscmp
wcscpy
_wcsicmp
wcsrchr
memcmp
wcscat
wcsncmp
wcsncpy

Exports

Exports

DllMain
DriverProc
mxdMessage
widMessage
wodMessage

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 155B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/License.txt
TotalRecorder Pro v5.2 正式注册版/OEMSETUP.INF
TotalRecorder Pro v5.2 正式注册版/Registration.txt
TotalRecorder Pro v5.2 正式注册版/SN.txt
TotalRecorder Pro v5.2 正式注册版/TotRecSched.exe
.exe windows:4 windows x86 arch:x86

0e6a43d9c79d09d501eb8391d6eec4a1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateMutexA
GetTickCount
FormatMessageA
LocalFree
CreateSemaphoreA
CreateProcessA
GetDateFormatA
GetTimeFormatA
GetLocalTime
WaitForSingleObject
GetLastError
ReleaseSemaphore
ExpandEnvironmentStringsA
lstrcpynA
HeapFree
GetEnvironmentVariableA
GetModuleFileNameA
SetStdHandle
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetFilePointer
WriteFile
FlushFileBuffers
RtlUnwind
HeapAlloc
CloseHandle
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapReAlloc
TerminateProcess
GetCurrentProcess
HeapSize
GetCPInfo
GetACP
GetOEMCP
GetFileType
RaiseException
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetProcAddress
WideCharToMultiByte
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle

user32

MessageBoxA
SetTimer
KillTimer
DefWindowProcA
PostQuitMessage
DispatchMessageA
TranslateMessage
GetMessageA
PostMessageA
CreateWindowExA
RegisterClassExA
RegisterWindowMessageA
wsprintfA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey
RegEnumValueA
RegQueryInfoKeyA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

winmm

waveOutGetErrorTextA

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/TotalRecorder.cnt
TotalRecorder Pro v5.2 正式注册版/TotalRecorder.exe
.exe windows:4 windows x86 arch:x86

01c8c03af526f4fd430c6e0e694ac558

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

FindResourceExA
SetErrorMode
GetOEMCP
RtlUnwind
HeapFree
HeapAlloc
ExitProcess
TerminateProcess
GetProcessVersion
GetCPInfo
GetCommandLineA
HeapReAlloc
SetStdHandle
GetFileType
CreateThread
ExitThread
HeapSize
GetStartupInfoA
GetEnvironmentVariableA
HeapDestroy
RaiseException
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
IsBadCodePtr
SetEnvironmentVariableA
GlobalFlags
ResumeThread
TlsGetValue
LocalReAlloc
TlsSetValue
GlobalReAlloc
TlsFree
GlobalHandle
TlsAlloc
LocalAlloc
GetTempFileNameA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetThreadLocale
GetStringTypeExA
UnlockFile
LockFile
DuplicateHandle
SetFileTime
LocalFileTimeToFileTime
lstrcmpA
SuspendThread
IsBadWritePtr
GetProcAddress
InitializeCriticalSection
IsBadReadPtr
GetModuleFileNameA
GetModuleHandleA
GetCurrentProcessId
OpenProcess
CloseHandle
EnterCriticalSection
FreeLibrary
LeaveCriticalSection
DeleteFileA
GetLastError
GetTickCount
SetEvent
FindFirstFileA
FindNextFileA
FindClose
GetFileTime
GetCurrentDirectoryA
SetCurrentDirectoryA
GetFullPathNameA
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetDateFormatA
GetTimeFormatA
lstrcpynA
GetLocalTime
FindResourceA
LoadResource
LockResource
SizeofResource
GetFileAttributesA
WaitForSingleObject
ResetEvent
TerminateThread
GetProfileStringA
MulDiv
GetVersion
lstrcatA
GlobalGetAtomNameA
GlobalAddAtomA
GlobalDeleteAtom
lstrcpyA
lstrlenA
CreateEventA
InterlockedDecrement
InterlockedIncrement
GetACP
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalFindAtomA
UnmapViewOfFile
GetVolumeInformationA
GetDriveTypeA
GetDiskFreeSpaceA
CreateFileMappingA
MapViewOfFile
GetShortPathNameA
GetSystemDirectoryA
ExpandEnvironmentStringsA
CreateMutexA
ReleaseMutex
FormatMessageA
VirtualFree
VirtualAlloc
DeviceIoControl
FlushFileBuffers
ReadFile
SetEndOfFile
GetFileSize
CreateProcessA
lstrcmpiA
GetCurrentThread
WideCharToMultiByte
CreateDirectoryA
CreateSemaphoreA
ReleaseSemaphore
SetLastError
LocalFree
GetCurrentThreadId
SystemTimeToFileTime
GetCurrentProcess
SetThreadPriority
WaitForMultipleObjects
MoveFileA
GetTimeZoneInformation
GetVersionExA
CreateFileA
SetFilePointer
WriteFile
Sleep
GetSystemTime
GlobalUnlock
GlobalLock
GlobalSize
SearchPathA
DeleteCriticalSection
LoadLibraryA
HeapCreate

user32

TranslateMessage
GetMessageA
ValidateRect
GetAsyncKeyState
MapDialogRect
CreateDialogIndirectParamA
EndDialog
CharUpperA
PostQuitMessage
InsertMenuA
DeleteMenu
SetWindowContextHelpId
CharNextA
GetNextDlgGroupItem
GetDCEx
LockWindowUpdate
PostThreadMessageA
SetParent
UnpackDDElParam
ReuseDDElParam
SetMenu
DestroyMenu
ReleaseCapture
MoveWindow
IsDialogMessageA
SetDlgItemInt
GetDlgItemInt
MapWindowPoints
DispatchMessageA
AdjustWindowRectEx
DeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
ShowScrollBar
GetScrollRange
GetTopWindow
MessageBoxA
IsChild
GetClassInfoA
RegisterClassA
TrackPopupMenu
DefWindowProcA
DestroyWindow
CreateWindowExA
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetLastActivePopup
SetWindowLongA
IntersectRect
IsIconic
KillTimer
SetTimer
GetDesktopWindow
GetWindowThreadProcessId
ExitWindowsEx
DrawTextA
WaitMessage
WindowFromPoint
GetWindowDC
GetSystemMenu
SetCursor
LoadCursorA
ClientToScreen
GetScrollPos
SetScrollRange
SetScrollPos
LoadStringA
SendDlgItemMessageA
SetDlgItemTextA
SetActiveWindow
FindWindowA
FillRect
GetMenuItemRect
SetCaretPos
GetDlgCtrlID
SetWindowPlacement
FindWindowExA
BringWindowToTop
GetWindowTextA
LoadMenuA
GetWindowLongA
SetForegroundWindow
GetActiveWindow
GetWindowPlacement
UnhookWindowsHookEx
DestroyIcon
SetWindowsHookExA
LoadImageA
GetForegroundWindow
CallNextHookEx
GetKeyState
CopyRect
UpdateWindow
ShowOwnedPopups
SetCursorPos
IsRectEmpty
OffsetRect
SystemParametersInfoA
SetRect
SetRectEmpty
MessageBeep
GetFocus
LoadAcceleratorsA
PeekMessageA
EnumWindows
GetClassNameA
GetClipboardData
RegisterClipboardFormatA
SetClipboardData
OpenClipboard
EmptyClipboard
CloseClipboard
GetClipboardOwner
IsClipboardFormatAvailable
RegisterWindowMessageA
SetFocus
WinHelpA
IsMenu
ShowWindow
SetWindowPos
GetMenuState
RemoveMenu
EnableMenuItem
CheckMenuItem
GetDC
ReleaseDC
IsWindowEnabled
GetWindow
TranslateAcceleratorA
ModifyMenuA
GrayStringA
TabbedTextOutA
EndPaint
BeginPaint
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
GetNextDlgTabItem
DestroyCursor
SetCapture
GetWindowTextLengthA
wsprintfA
SendMessageTimeoutA
DestroyAcceleratorTable
CreateAcceleratorTableA
MapVirtualKeyA
GetKeyNameTextA
UnregisterHotKey
RegisterHotKey
GetMenu
GetMenuItemCount
GetMenuItemID
GetMenuStringA
GetSubMenu
CopyAcceleratorTableA
GetDlgItem
SetWindowTextA
CreatePopupMenu
AppendMenuA
SetMenuDefaultItem
GetCursorPos
ScreenToClient
PtInRect
GetSysColor
LoadBitmapA
EnableWindow
RedrawWindow
GetSystemMetrics
GetDialogBaseUnits
LoadIconA
SendMessageA
BeginDeferWindowPos
InvalidateRect
EndDeferWindowPos
InflateRect
GetWindowRect
GetParent
EqualRect
GetCapture
GetClientRect
IsWindowVisible
PostMessageA
IsWindow
GetSysColorBrush
GetMessagePos
ShowCaret
ExcludeUpdateRgn
HideCaret
DefDlgProcA
IsWindowUnicode
DrawFocusRect
UnregisterClassA

gdi32

GetTextExtentPoint32A
GetTextExtentPointA
OffsetViewportOrgEx
GetObjectA
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
CreateRectRgn
SetViewportOrgEx
GetViewportExtEx
GetWindowExtEx
CreateSolidBrush
CreatePatternBrush
PtVisible
RectVisible
Escape
LPtoDP
DPtoLP
CreateRectRgnIndirect
GetMapMode
SetRectRgn
CombineRgn
GetTextColor
GetBkColor
GetTextMetricsA
EnumFontFamiliesExA
BitBlt
SetMapMode
SelectPalette
RestoreDC
SaveDC
SetViewportExtEx
PatBlt
GetClipBox
CreatePalette
RealizePalette
StretchDIBits
CreateDIBitmap
GetCharWidth32A
GetCharWidthA
GetStockObject
GetDeviceCaps
TextOutA
GetDIBits
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetBkColor
SetTextColor
ExtTextOutA
SetBkMode
CreateFontA
DeleteDC
DeleteObject
CreateFontIndirectA
CreateDCA
CreateBitmap

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetFileTitleA
GetSaveFileNameA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegCreateKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegQueryValueExA
RegEnumValueA
RegDeleteValueA
SetFileSecurityA
RegOpenKeyA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetFileSecurityA
RegSetValueA
RegQueryValueA

shell32

ExtractIconA
SHGetFileInfoA
DragAcceptFiles
SHGetSpecialFolderLocation
ShellExecuteA
DragQueryFileA
DragFinish
Shell_NotifyIconA
SHGetMalloc
SHBrowseForFolderA
SHGetPathFromIDListA

comctl32

ImageList_Create
ImageList_Destroy
ImageList_AddMasked
ord8
ord17
DestroyPropertySheetPage
CreatePropertySheetPageA
ImageList_LoadImageA
PropertySheetA

oledlg

ord8

ole32

StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleInitialize
OleUninitialize
CLSIDFromProgID
CoInitialize
CoUninitialize
CoCreateInstance
OleIsCurrentClipboard
CLSIDFromString
CoRevokeClassObject
OleFlushClipboard
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoGetClassObject
CoTaskMemAlloc
CoTaskMemFree

olepro32

ord253

oleaut32

VariantTimeToSystemTime
SysStringLen
SysAllocStringByteLen
VariantChangeType
SysAllocString
SysAllocStringLen
VariantClear
VariantCopy
SysFreeString

Sections

.text
Size: 1.8MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 244KB - Virtual size: 241KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 96KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 188KB - Virtual size: 187KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/TotalRecorder.hlp
TotalRecorder Pro v5.2 正式注册版/TotalRecorder.reg
TotalRecorder Pro v5.2 正式注册版/WmpClipInfoForTrVis.dll
.dll regsvr32 windows:4 windows x86 arch:x86

6634de888282b7c4abd7560a8df732e7

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExA
SizeofResource
lstrcpynA
IsDBCSLeadByte
FindResourceA
LoadResource
GetModuleHandleA
DisableThreadLibraryCalls
DeleteCriticalSection
HeapDestroy
lstrlenW
MultiByteToWideChar
lstrlenA
SetLastError
GetLastError
FreeLibrary
GetModuleFileNameA
InterlockedIncrement
GetShortPathNameA
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrcmpiA
GetEnvironmentVariableA
TlsGetValue
SetStdHandle
GetStringTypeW
GetStringTypeA
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
SetFilePointer
IsBadCodePtr
IsBadReadPtr
CloseHandle
FlushFileBuffers
WideCharToMultiByte
HeapCreate
GetVersionExA
GetCPInfo
RtlUnwind
HeapAlloc
HeapFree
HeapReAlloc
GetCommandLineA
GetVersion
ExitProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetUnhandledExceptionFilter
LCMapStringW
GetFileType
VirtualFree
VirtualAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
LCMapStringA

user32

SetWindowTextA
CharNextA
CreateWindowExA
RegisterClassExA
FindWindowA
PostQuitMessage
DefWindowProcA
DrawTextA
FillRect
LoadStringA
ReleaseDC
GetClientRect
GetDC
wsprintfW
PostMessageA
RegisterWindowMessageA

gdi32

SetBkColor
CreateSolidBrush
SelectObject
BitBlt
CreateCompatibleDC
DeleteDC
CreateCompatibleBitmap
SetTextColor
DeleteObject

advapi32

RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance

oleaut32

LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/_shfoldr.dll
.dll windows:5 windows x86 arch:x86

95f81563369971605fb978131e2f7f51

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

EnumResourceLanguagesW
EnumResourceNamesW
lstrcatA
lstrcpyA
CompareStringW
CreateDirectoryA
CreateDirectoryW
GetLastError
FindResourceExW
GetSystemDefaultLangID
GetFileAttributesA
GetFileAttributesW
GetSystemDirectoryA
GetSystemDirectoryW
IsBadWritePtr
DisableThreadLibraryCalls
GlobalAlloc
GlobalFree
GetWindowsDirectoryW
LoadResource
LockResource
lstrlenA
GetWindowsDirectoryA
ExpandEnvironmentStringsW
GetVersionExA
lstrlenW
MultiByteToWideChar
GetProcAddress
LoadLibraryA
FreeLibrary
ExpandEnvironmentStringsA
WideCharToMultiByte
lstrcpynW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
InitializeAcl
GetAce
SetFileSecurityW
AddAccessAllowedAce
RegSetValueExA
LookupAccountSidW
RegCreateKeyExA
RegOpenKeyA
RegSetValueExW
RegQueryValueExA
RegCloseKey
RegQueryValueExW

Exports

Exports

SHGetFolderPathA
SHGetFolderPathW

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 476B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/players.txt
TotalRecorder Pro v5.2 正式注册版/readme.txt
TotalRecorder Pro v5.2 正式注册版/setup.exe
.exe windows:4 windows x86 arch:x86

63c8012299b682eee8cd2395950ae86c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

SendDriverMessage
CloseDriver
OpenDriver
waveOutGetDevCapsA
waveOutMessage
waveInGetDevCapsA
waveInOpen
waveInMessage
waveOutGetNumDevs
waveOutOpen
mixerGetNumDevs
waveOutClose
waveInClose
waveOutGetErrorTextA
mixerGetDevCapsA
waveInGetNumDevs

kernel32

GetCurrentThread
lstrcmpA
GlobalAlloc
LocalAlloc
TlsAlloc
GetCurrentProcess
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
SizeofResource
FindResourceExA
GetProcessVersion
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
WritePrivateProfileStringA
RtlUnwind
HeapFree
HeapAlloc
RaiseException
TlsFree
GlobalHandle
GlobalUnlock
GetCommandLineA
HeapSize
HeapReAlloc
GetACP
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
MulDiv
GlobalLock
GetCurrentThreadId
GetVersion
lstrcatA
GlobalFindAtomA
GlobalGetAtomNameA
lstrcmpiA
GlobalDeleteAtom
lstrcpyA
LockResource
FindResourceA
LoadResource
lstrlenA
GlobalFree
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
FindNextFileA
CreateMutexA
RemoveDirectoryA
Sleep
CreateDirectoryA
FileTimeToSystemTime
GetLocalTime
GetTimeZoneInformation
SetLastError
GetTempPathA
GetModuleHandleA
GetWindowsDirectoryA
MultiByteToWideChar
GetSystemDirectoryA
GetFileAttributesA
WriteFile
MoveFileExA
ExitProcess
GetModuleFileNameA
SetFileAttributesA
GetProfileStringA
FormatMessageA
GetFullPathNameA
MoveFileA
DeleteFileA
SetEndOfFile
FlushFileBuffers
SetCurrentDirectoryA
SetFilePointer
FindClose
lstrcpynA
FindFirstFileA
CreateProcessA
WaitForSingleObject
GetExitCodeProcess
GetProcAddress
ExpandEnvironmentStringsA
LoadLibraryA
LocalFree
FreeLibrary
GetVersionExA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GlobalAddAtomA
LeaveCriticalSection
CopyFileA
TerminateProcess
GetStartupInfoA
CreateFileA
GetTickCount
WinExec
CloseHandle
ReadFile
GetLastError
GetFileSize

user32

CopyRect
IsWindowVisible
DispatchMessageA
AdjustWindowRectEx
GetSysColor
MapWindowPoints
SendDlgItemMessageA
GetNextDlgTabItem
CheckMenuItem
SetMenuItemBitmaps
PeekMessageA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
ModifyMenuA
EndDialog
IsDialogMessageA
ClientToScreen
CreateDialogIndirectParamA
TabbedTextOutA
DrawTextA
GrayStringA
LoadStringA
WindowFromPoint
DestroyMenu
TranslateMessage
GetMessageA
PostQuitMessage
GetClassNameA
PtInRect
InvalidateRect
EndPaint
BeginPaint
ValidateRect
GetKeyState
DefWindowProcA
DestroyWindow
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
CallWindowProcA
RemovePropA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
SetWindowLongA
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
MapDialogRect
ShowWindow
GetCapture
GetActiveWindow
GetAsyncKeyState
GetFocus
SetFocus
UnhookWindowsHookEx
SendMessageTimeoutA
FindWindowExA
IsWindow
IsWindowEnabled
GetWindow
GetWindowDC
LoadIconA
GetSystemMenu
EnableMenuItem
LoadImageA
GetSystemMetrics
GetCursorPos
SetCursor
LoadCursorA
GetWindowTextLengthA
GetWindowTextA
GetDC
ReleaseDC
GetClientRect
GetWindowLongA
SetWindowPos
GetParent
GetWindowRect
ScreenToClient
RegisterWindowMessageA
SetTimer
KillTimer
UpdateWindow
SendMessageA
GetSysColorBrush
SetDlgItemTextA
GetDlgItem
SetWindowTextA
EnableWindow
PostMessageA
GetSubMenu
MessageBoxA
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetTopWindow
GetDlgCtrlID
GetMenuItemID
GetMenuItemCount
SetActiveWindow
wsprintfA
OffsetRect
InflateRect
ExcludeUpdateRgn
DrawFocusRect
DefDlgProcA
ShowCaret
CharNextA
HideCaret
UnregisterClassA
IsWindowUnicode

gdi32

PatBlt
GetTextExtentPointA
CreateCompatibleDC
GetObjectA
CreateFontIndirectA
SelectObject
DeleteObject
GetStockObject
GetTextExtentPoint32A
SetTextColor
SetBkColor
GetClipBox
DeleteDC
CreateBitmap
RestoreDC
SaveDC
SetBkMode
SetMapMode
SetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
OffsetViewportOrgEx
SetWindowExtEx
IntersectClipRect
CreateDIBitmap
BitBlt
GetDeviceCaps
CreateSolidBrush
RectVisible
TextOutA
PtVisible
Escape
ExtTextOutA
ScaleWindowExtEx
EnumFontFamiliesExA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

SetSecurityDescriptorDacl
RegQueryInfoKeyA
InitializeSecurityDescriptor
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA
RegEnumValueA
RegCloseKey
FreeSid
RegOpenKeyExA

shell32

SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteA
SHGetMalloc

comctl32

PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord17

ole32

CoUninitialize
CoCreateInstance
CoInitialize

Sections

.text
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
TotalRecorder Pro v5.2 正式注册版/中国破解联盟-木蚂蚁社区.url
.url
TotalRecorder Pro v5.2 正式注册版/使用说明.txt
TotalRecorder Pro v5.2 正式注册版/汉化说明.txt
TotalRecorder Pro v5.2 正式注册版/注册说明.htm
.html .js polyglot

Sharing

General

Malware Config

Signatures

Files

8fc06be81771bbabb84b641d24aed229

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 98KB - Virtual size: 98KB

.rdata Size: 1024B - Virtual size: 772B

.data Size: 6KB - Virtual size: 12KB

.idata Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

58d07a2a45c40f846221dfef2ecaae8c

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 80KB - Virtual size: 79KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

51bffaf6b1932f0ed5fcfb3b9ae03d78

Headers

File Characteristics

Imports

kernel32

user32

advapi32

winmm

ntdll

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 36KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 6KB - Virtual size: 30KB

.edata Size: 512B - Virtual size: 155B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

0e6a43d9c79d09d501eb8391d6eec4a1

Headers

File Characteristics

Imports

kernel32

user32

advapi32

winmm

Sections

.text Size: 48KB - Virtual size: 47KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1KB

01c8c03af526f4fd430c6e0e694ac558

Headers

File Characteristics

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

.text
Size: 98KB - Virtual size: 98KB

.rdata
Size: 1024B - Virtual size: 772B

.data
Size: 6KB - Virtual size: 12KB

.idata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 80KB - Virtual size: 79KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 36KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 6KB - Virtual size: 30KB

.edata
Size: 512B - Virtual size: 155B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1KB

.text
Size: 1.8MB - Virtual size: 1.7MB

.rdata
Size: 244KB - Virtual size: 241KB

.data
Size: 96KB - Virtual size: 124KB

.rsrc
Size: 188KB - Virtual size: 187KB

.text
Size: 48KB - Virtual size: 47KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 8KB - Virtual size: 5KB

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 92B

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 512B - Virtual size: 476B

.text
Size: 164KB - Virtual size: 163KB

.rdata
Size: 40KB - Virtual size: 36KB

.data
Size: 24KB - Virtual size: 40KB

.rsrc
Size: 120KB - Virtual size: 116KB