08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118
Size 5.4MB
Sample241002-ejzczswdmj
SHA256 61e4d701e2e08bff206ec405ac27ea3fce687165b85c5bdac6cdf48d066dbe9c
MD5 08c3b4a6961c962a3371c6bcdb0aa6e0
SHA1 449f66ade3c79892488d1a51167fc9dff1a8f912
SHA512 7d35c131611ca8b8f9b49bf041fe7091155a189c939674bde41128c7a4cf87f218130d75e5af214a443f5598472aa7f2f5afd7e65abc7544dd50a173855bcc3a
SSDEEP 98304:U1k8VO82XHfzqEKn7QSNak6VyhDLYnWO2XJ4tpx69BIMYMqjO97vbNnLlt:G2XHfOEKsniMn92Xitpx6DzYMSCvbNh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118
unpack001/$PLUGINSDIR/InstallerStuff.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/setup_cr.exe
unpack003/$PLUGINSDIR/InstallerUtils.dll
unpack003/$PLUGINSDIR/StdUtils.dll
unpack003/$PLUGINSDIR/System.dll
unpack001/DownLite.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/setup_cr.exe	nsis_installer_2

File Explorer

08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118

.exe 5.4MB
$PLUGINSDIR/InstallerStuff.dll

.dll 115KB
$PLUGINSDIR/OCSetupHlp.dll

.dll 848KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsJSON.dll

.dll 6KB
out.upx

.dll 9KB
$PLUGINSDIR/setup_cr.exe

.exe 3.2MB
$PLUGINSDIR/InstallerUtils.dll

.dll 104KB
$PLUGINSDIR/Ivqyxeeikmjuu.tmp

3.1MB
$PLUGINSDIR/StdUtils.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/welcome.bmp

153KB
DownLite.exe

.exe 2.1MB
uninstall.exe.nsis

750B

08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 61e4d701e2e08bff206ec405ac27ea3fce687165b85c5bdac6cdf48d066dbe9c
MD5 08c3b4a6961c962a3371c6bcdb0aa6e0
SHA1 449f66ade3c79892488d1a51167fc9dff1a8f912
SHA512 7d35c131611ca8b8f9b49bf041fe7091155a189c939674bde41128c7a4cf87f218130d75e5af214a443f5598472aa7f2f5afd7e65abc7544dd50a173855bcc3a
SSDEEP 98304:U1k8VO82XHfzqEKn7QSNak6VyhDLYnWO2XJ4tpx69BIMYMqjO97vbNnLlt:G2XHfOEKsniMn92Xitpx6DzYMSCvbNh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallerStuff.dll

IMPHASH b07f91f7e65b795fb4d8e7b2673e3928
SHA256 77ecf5896f33bbc002f00dd4742c00a20981bbc618563e49f34ea8f740da890d
MD5 bcbacda49fb2c44fee595cbc82036242
SHA1 a33356996c7b3e032693bb373bbde2acf72cc469
SHA512 18c44cedb9b0fbd301ad9cbe5ebafe66d16380090baa41697f3224a5086313c61420730e8a5050fa7de31e2f47dbd21259d6758cf84557e0c34b901a93c4ddc0
SSDEEP 1536:zF/lMOy6cWef0K9CWGHyAkeW2Ku+odcI9sWjcdJlBD+4p4iq5:VlMnTIpSAkeuu+oenBD+4p4ii
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

21049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\TopMedia\SVN\DownLiteInstaller\new\DLLs\InstallerStuff.pdb

rpcrt4

UuidCreateSequential RpcStringFreeA UuidToStringA

kernel32

WriteFile CloseHandle GetLastError GetStringTypeW CreateFileW WriteConsoleW SetFilePointerEx LCMapStringW HeapReAlloc GetConsoleCP FlushFileBuffers SetStdHandle HeapFree HeapAlloc ReadFile EncodePointer DecodePointer GetCommandLineA GetCurrentThreadId RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetProcessHeap InterlockedDecrement ExitProcess GetModuleHandleExW GetProcAddress AreFileApisANSI MultiByteToWideChar GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetFilePointer SetEndOfFile GetConsoleMode ReadConsoleW GetFileType DeleteCriticalSection GetStartupInfoW HeapSize Sleep InterlockedIncrement IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte SetLastError GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW OutputDebugStringW LoadLibraryW

advapi32

RegOpenKeyExW RegSetValueExA RegCreateKeyExA RegQueryValueExA RegOpenKeyExA RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW

wininet

HttpQueryInfoA HttpAddRequestHeadersA InternetCrackUrlA InternetGetConnectedState HttpSendRequestA HttpOpenRequestA InternetConnectA InternetOpenA InternetCloseHandle InternetReadFile

$PLUGINSDIR/OCSetupHlp.dll

IMPHASH 93bd1585ffbc730c763e71e0c6c896b3
SHA256 4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
MD5 9e4e850e12f2f4f869b2491dbbb17ceb
SHA1 bd89581a89604b601c817ea680c2a224b46737f8
SHA512 9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
SSDEEP 12288:w3RHConJZh6lVfdxrHtgFl2nMLlKT2OIPL8mKqSTSTpz4cB8:wkuMV1xrHaF8nMI2RPL8STpz4cB8
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

62:df:9b:00:a0:2e:95:b2:8b:f9:8a:ae:08:ca:c4:3c:13:76:de:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Chains

Jun 24, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Serial Number

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2011 - Mar 14, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

Major OS version

Entry point

451236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetErrorMode GetFileAttributesW CreateFileW GetFileSize GetCurrentProcessId GetEnvironmentVariableW FindFirstFileW FindNextFileW FindClose ReadFile GetTimeZoneInformation GetSystemTimeAsFileTime GetTickCount GetTempPathW DeleteFileW WriteFile ProcessIdToSessionId HeapAlloc GetProcessHeap HeapFree CreateDirectoryW ExpandEnvironmentStringsW WaitForSingleObject OutputDebugStringW CreateMutexW OpenMutexW ReleaseMutex UnmapViewOfFile MapViewOfFileEx CreateFileMappingW OpenFileMappingW GetShortPathNameW SetFilePointer CreateEventW GlobalFree ResumeThread FreeResource SetEvent ResetEvent GetCurrentThread CreateProcessW MoveFileExW OpenEventW lstrlenA WideCharToMultiByte SetEnvironmentVariableW SetEnvironmentVariableA CompareStringW CompareStringA GetExitCodeProcess GetStringTypeW GetStringTypeA GetLocaleInfoA GetFullPathNameW SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA DeleteCriticalSection GetCurrentDirectoryA CreateFileA lstrcmpiW GetProcAddress PeekNamedPipe GetFileInformationByHandle GetFullPathNameA FlushFileBuffers GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount LCMapStringA ExitProcess LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle HeapCreate RtlUnwind GetDriveTypeW GetFileType GetConsoleMode GetConsoleCP FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime GetCommandLineA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange FindResourceA GlobalMemoryStatusEx GetDiskFreeSpaceExW GetFileAttributesExW CompareFileTime GetVersion GetTempFileNameW ReleaseSemaphore InitializeCriticalSectionAndSpinCount CreateSemaphoreW GetSystemInfo GetVersionExW FileTimeToSystemTime GetSystemDefaultLCID FormatMessageA ExpandEnvironmentStringsA SleepEx GetThreadLocale GetLastError SetThreadLocale MultiByteToWideChar GetModuleFileNameW InitializeCriticalSection GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadLibraryExW GlobalUnlock GlobalLock GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot CloseHandle OpenProcess GetUserDefaultUILanguage GetLocaleInfoW FreeLibrary LoadLibraryW MulDiv lstrlenW lstrcpynW SetLastError RaiseException Sleep CreateThread FindResourceExW FindResourceW LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FlushInstructionCache GetCurrentProcess

psapi

GetProcessImageFileNameW EnumProcesses

ws2_32

select WSACleanup WSAStartup closesocket WSAGetLastError socket recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect WSASetLastError __WSAFDIsSet gethostname freeaddrinfo ioctlsocket getaddrinfo

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

DestroyMenu SetActiveWindow DestroyCursor SetCursor FindWindowW PeekMessageW MsgWaitForMultipleObjects GetWindow TrackPopupMenu ReleaseCapture DrawFocusRect UnregisterClassA GetCursor NotifyWinEvent SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow LoadCursorW IsWindow GetDesktopWindow MonitorFromWindow GetUpdateRect SetRect CreateDialogParamW GetSystemMetrics CallNextHookEx UnhookWindowsHookEx SystemParametersInfoW SetWindowsHookExW DrawIconEx GetIconInfo SetMenuItemInfoW IsWindowVisible SetForegroundWindow SetDlgItemTextW SendDlgItemMessageW PostQuitMessage KillTimer SetTimer PostMessageW GetWindowTextLengthW GetWindowTextW EnumChildWindows EnumWindows RegisterClassExW GetClassInfoExW CreateWindowExW GetSysColor GetSysColorBrush GetDC SendMessageW SetFocus GetForegroundWindow TrackMouseEvent InvalidateRect GetClientRect BeginPaint EnableMenuItem GetSystemMenu EnableWindow LoadImageW MessageBoxW MapWindowPoints GetParent CharNextW SetClipboardData CloseClipboard EmptyClipboard OpenClipboard GetWindowThreadProcessId SetWindowPos SetWindowTextW LoadIconW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW GetDlgItem ShowWindow ReleaseDC DrawTextW FillRect GetAsyncKeyState CopyRect GetMonitorInfoW MonitorFromPoint MoveWindow GetWindowRect GetAncestor DrawFrameControl PtInRect ScreenToClient GetCursorPos EndPaint IntersectRect

gdi32

SetViewportOrgEx CreateCompatibleDC DeleteObject BitBlt SetBkMode SetTextColor GetDeviceCaps DeleteDC CreateFontIndirectW CreateSolidBrush GetStockObject GetTextExtentPoint32W GetObjectW CreatePatternBrush SetBkColor DPtoLP CreateCompatibleBitmap ExtTextOutW CreateDIBSection SelectObject GdiFlush

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx LookupAccountSidW CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW

shell32

Shell_NotifyIconW SHGetFolderPathW ShellExecuteW

ole32

CoInitializeSecurity CreateStreamOnHGlobal CLSIDFromProgID CoInitialize CoUninitialize CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid CoTaskMemAlloc StringFromGUID2 CoTaskMemRealloc

oleaut32

LoadTypeLi UnRegisterTypeLi VarUI4FromStr RegisterTypeLi SysFreeString SysStringLen VariantClear SysAllocStringLen VariantChangeType LoadRegTypeLi OleLoadPicture SysAllocString VariantInit

comctl32

InitCommonControlsEx

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipLoadImageFromFile GdipCloneImage GdipDrawImagePointRectI GdipDrawImageRectRect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW InternetGetConnectedStateExW

DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer OCPID974OpenCandy1 OCPID974OpenCandy10 OCPID974OpenCandy11 OCPID974OpenCandy12 OCPID974OpenCandy13 OCPID974OpenCandy14 OCPID974OpenCandy15 OCPID974OpenCandy16 OCPID974OpenCandy17 OCPID974OpenCandy18 OCPID974OpenCandy19 OCPID974OpenCandy20 OCPID974OpenCandy21 OCPID974OpenCandy22 OCPID974OpenCandy23 OCPID974OpenCandy24 OCPID974OpenCandy29 OCPID974OpenCandy30 OCPID974OpenCandy31 OCPID974OpenCandy32 OCPID974OpenCandy33 OCPID974OpenCandy34 OCPID974OpenCandy35 OCPID974OpenCandy36 OCPID974OpenCandy37 OCPID974OpenCandy38 OCPID974OpenCandy39 OCPID974OpenCandy40 OCPID974OpenCandy41 OCPID974OpenCandy42 OCPID974OpenCandy44 OCPID974OpenCandy45 OCPID974OpenCandy46 OCPID974OpenCandy47 OCPID974OpenCandy48 OCPID974OpenCandy49 OCPID974OpenCandy5 OCPID974OpenCandy50 OCPID974OpenCandy51 OCPID974OpenCandy52 OCPID974OpenCandy53 OCPID974OpenCandy54 OCPID974OpenCandy55 OCPID974OpenCandy56 OCPID974OpenCandy57 OCPID974OpenCandy58 OCPID974OpenCandy59 OCPID974OpenCandy6 OCPID974OpenCandy60 OCPID974OpenCandy61 OCPID974OpenCandy62 OCPID974OpenCandy64 OCPID974OpenCandy65 OCPID974OpenCandy7 OCPID974OpenCandy8 OCPID974OpenCandy9 _GET_IS_REQUIRED_63 _OCPID974OpenCandy2@16 _OCPID974OpenCandy3@16 _OCPID974OpenCandy43@16 _OCPID974OpenCandy4@16

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

SHA256 18f2b2f20c65a022a1c8aaf776b4c9be6c193b73c2079d9d65d56b802fcadfb5
MD5 292aa9f95a7f081625056c497078159a
SHA1 72076f3eb146ab7ea2b3dd0ef6a63c06f86d64f1
SHA512 87f83c3bbcfedd98364b5d0209f912e66c72d43eb887438ad9735c078e6d1f6ea12566a75f0b652602bbd9f0608ce7148dc1703821f2ab6b366f061b8a58d910
SSDEEP 96:u2r8Z0x0OOG+2tOgdC+qzf+Sdv9wMxOHKCt6qZZLAL5EICN9r7HcnrDn:uHI+2e9zf++viMot6qZFYEIC7jcrL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

36144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 7ad0284242b7f225e48b4431682d90a820012b42cdecc314bc5b1826dab80ada
MD5 9dad35d2709e0c612f6ae1cf0bb44143
SHA1 32501f426fa8e849ac8006506ccc72867634033d
SHA512 afc39ec9a5ae7245ae0e996687d87757e455c9ad36fbdafa0b5449224a4aabaca3840c9491ef889eae609208d12bcd230a1c659a8333e465032bc447a2fd19dc
SSDEEP 192:u+DCOLS0XUgyNajZbCw8hKQH10xHYAjcr:unOLS0XUg0OZbv8hKnxlc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7635

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/setup_cr.exe

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 6df47c38d9452173201fb301c3a7225221d4cafeaf07a3edc1dae9ea6135b86d
MD5 ca023e6709a718a4917df6f3f2c8bbf7
SHA1 f9b989d482562796c8c95d124e52bd9e4643d32e
SHA512 23e813a6ac93394102b9448a3b5b3e41cf7eeb7eb683edaaf56335bd4ff3ac45884c6e0e10c7c0a9d8cd7f472e58b45e57d32fdcac819659c22e3dd547ae4d03
SSDEEP 98304:2NtKKGFdJNUujVhvCIu3WC2Z84tS+/83y:2nKK8wV/3p2ZttS+/yy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17191

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

140B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/InstallerUtils.dll

IMPHASH bd93dafddad5d317991cd88e0498a778
SHA256 4618571c27877641f83bfb312aa5b66ebe4a8954dc898ce4e640aeaea4dc0693
MD5 156e15e3dfcc2f2ff2dbcc373fc11f53
SHA1 5ff52623dedd7efefac54dbd31b5d1bdf0f3e799
SHA512 d4930f0b49dae5386a92124b954d1b82921e07da2a9ffd9d854f6ab6f03473e591d3b67f0aa8ea19f83b480be705d829797e62825fda50ffb074bd4734b265b4
SSDEEP 1536:amDdAXB7tPhDhHkb2p0H9YdYKgHn7IYHsrt2yHu8WGNnRzYkm6gxzSSSSSSSSUm:PDdAx7tJ1kqUKC7FK2yO8WG3O6gxF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

25379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

shlwapi

ord176

wininet

InternetCrackUrlA InternetConnectA HttpOpenRequestA HttpSendRequestA InternetCloseHandle HttpQueryInfoA InternetOpenA

kernel32

SetEnvironmentVariableA CompareStringW LCMapStringW GetProcessHeap SetEndOfFile GetStringTypeW CloseHandle Process32Next CreateToolhelp32Snapshot GetVersionExA InterlockedDecrement GetProcAddress LoadLibraryA GetLastError GetCurrentProcess FreeLibrary OpenProcess Sleep WaitForSingleObject MultiByteToWideChar lstrlenA WideCharToMultiByte LocalFree GlobalFree lstrcpynA GlobalAlloc CreateFileW LoadLibraryW HeapReAlloc IsValidCodePage GetOEMCP TerminateProcess HeapAlloc GetACP GetCPInfo CreateFileA WriteConsoleW SetFilePointer FlushFileBuffers SetStdHandle HeapSize GetModuleFileNameW GetCurrentProcessId GetSystemTimeAsFileTime RaiseException RtlUnwind GetCurrentThreadId DecodePointer GetCommandLineA HeapFree EncodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection ReadFile WriteFile GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetTimeZoneInformation ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoW DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount

user32

wsprintfA EnumWindows GetWindowThreadProcessId PostMessageA FindWindowExA EnumChildWindows GetClassNameA

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges OpenProcessToken

ole32

CoCreateInstance

oleaut32

SysAllocString VariantClear SysFreeString

$PLUGINSDIR/StdUtils.dll

IMPHASH 6aa1fb50f909cdf4bea3d3523348e900
SHA256 0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16
MD5 21010df9bc37daffcc0b5ae190381d85
SHA1 a8ba022aafc1233894db29e40e569dfc8b280eb9
SHA512 95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e
SSDEEP 192:OFb8Y8oqy2mqZc9hGBQHRx39oRxmMvURkB/Fs:qb8Y8nKqohGBKxox9vURw/a
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

11072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DownLite.exe

IMPHASH 012d17dcdd80c23d701dd02dd2d9fce5
SHA256 7126b3a28108726ee7d07024bce3611ed2d68f7fe75494124a04b9314488e605
MD5 84d44cc04348df5226b733eba1b64eb6
SHA1 3cc6d1a7aa6dcccf665c0c777af596d551fd953a
SHA512 40f11d74b158188b5d948d014ee82d70bd1b4a78710d7e596f961dd13fe212e6435ce2069ff4f483be3d8d23f8bf4fe478264b1c90f840660fcf4f7e0ded24b5
SSDEEP 49152:0gSxAEDE727h0VKMPh3UWUZQLamNg5/U6l:Q82zMPh3bUqamWc6l
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

711840

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

oleaut32

SysFreeString SysReAllocStringLen SysAllocStringLen GetErrorInfo SysFreeString SafeArrayPtrOfIndex SafeArrayGetUBound SafeArrayGetLBound SafeArrayCreate VariantChangeType VariantCopy VariantClear VariantInit

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW RegFlushKey RegCreateKeyExW RegCloseKey

user32

LoadStringW MessageBoxA CharNextW CreateWindowExW WindowFromPoint WaitMessage UpdateWindow UnregisterClassW UnhookWindowsHookEx TranslateMessage TranslateMDISysAccel TrackPopupMenu SystemParametersInfoW ShowWindow ShowScrollBar ShowOwnedPopups SetWindowsHookExW SetWindowTextW SetWindowPos SetWindowPlacement SetWindowLongW SetTimer SetScrollRange SetScrollPos SetScrollInfo SetRect SetPropW SetParent SetMenuItemInfoW SetMenu SetForegroundWindow SetFocus SetCursorPos SetCursor SetClipboardData SetClassLongW SetCapture SetActiveWindow SendMessageA SendMessageW ScrollWindow ScreenToClient RemovePropW RemoveMenu ReleaseDC ReleaseCapture RegisterWindowMessageW RegisterClipboardFormatW RegisterClassW RedrawWindow PostQuitMessage PostMessageW PeekMessageA PeekMessageW OpenClipboard OffsetRect MsgWaitForMultipleObjectsEx MsgWaitForMultipleObjects MessageBoxW MessageBeep MapWindowPoints MapVirtualKeyW LoadStringW LoadKeyboardLayoutW LoadIconW LoadCursorW LoadBitmapW KillTimer IsZoomed IsWindowVisible IsWindowUnicode IsWindowEnabled IsWindow IsIconic IsDialogMessageA IsDialogMessageW IsChild InvalidateRect IntersectRect InsertMenuItemW InsertMenuW InflateRect GetWindowThreadProcessId GetWindowTextW GetWindowRect GetWindowPlacement GetWindowLongW GetWindowDC GetTopWindow GetSystemMetrics GetSystemMenu GetSysColorBrush GetSysColor GetSubMenu GetScrollRange GetScrollPos GetScrollInfo GetPropW GetParent GetWindow GetMessagePos GetMessageExtraInfo GetMenuStringW GetMenuState GetMenuItemInfoW GetMenuItemID GetMenuItemCount GetMenu GetLastActivePopup GetKeyboardState GetKeyboardLayoutNameW GetKeyboardLayoutList GetKeyboardLayout GetKeyState GetKeyNameTextW GetIconInfo GetForegroundWindow GetFocus GetDesktopWindow GetDCEx GetDC GetCursorPos GetCursor GetClipboardData GetClientRect GetClassLongW GetClassInfoW GetCapture GetActiveWindow FrameRect FindWindowExW FindWindowW FillRect EnumWindows EnumThreadWindows EnumChildWindows EndPaint EnableWindow EnableScrollBar EnableMenuItem EmptyClipboard DrawTextExW DrawTextW DrawMenuBar DrawIconEx DrawIcon DrawFrameControl DrawFocusRect DrawEdge DispatchMessageA DispatchMessageW DestroyWindow DestroyMenu DestroyIcon DestroyCursor DeleteMenu DefWindowProcW DefMDIChildProcW DefFrameProcW CreatePopupMenu CreateMenu CreateIcon CloseClipboard ClientToScreen CheckMenuItem CharUpperBuffW CharNextW CharLowerBuffW CharLowerW CallWindowProcW CallNextHookEx BeginPaint AdjustWindowRectEx ActivateKeyboardLayout

kernel32

lstrcmpiA LoadLibraryA LocalFree LocalAlloc GetACP Sleep VirtualFree VirtualAlloc GetSystemInfo GetTickCount QueryPerformanceCounter GetVersion GetCurrentThreadId VirtualQuery WideCharToMultiByte MultiByteToWideChar lstrlenW lstrcpynW LoadLibraryExW IsValidLocale GetSystemDefaultUILanguage GetStartupInfoA GetProcAddress GetModuleHandleW GetModuleFileNameW GetUserDefaultUILanguage GetLocaleInfoW GetLastError GetCommandLineW FreeLibrary FindFirstFileW FindClose ExitProcess ExitThread CreateThread CompareStringW WriteFile UnhandledExceptionFilter RtlUnwind RaiseException GetStdHandle DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle TlsSetValue TlsGetValue LocalAlloc GetModuleHandleW lstrcpyW WriteFile WideCharToMultiByte WaitForSingleObject WaitForMultipleObjectsEx VirtualQueryEx VirtualQuery VirtualFree VirtualAlloc SwitchToThread SuspendThread SizeofResource SignalObjectAndWait SetThreadPriority SetThreadLocale SetLastError SetFilePointer SetEvent SetErrorMode SetEndOfFile ResumeThread ResetEvent ReadFile MultiByteToWideChar MulDiv LockResource LoadResource LoadLibraryW LeaveCriticalSection InitializeCriticalSection GlobalUnlock GlobalLock GlobalFree GlobalFindAtomW GlobalDeleteAtom GlobalAlloc GlobalAddAtomW GetVersionExW GetVersion GetTickCount GetThreadPriority GetThreadLocale GetStdHandle GetProcAddress GetModuleHandleW GetModuleFileNameW GetLocaleInfoW GetLocalTime GetLastError GetFullPathNameW GetFileAttributesW GetExitCodeThread GetDiskFreeSpaceW GetDateFormatW GetCurrentThreadId GetCurrentThread GetCurrentProcessId GetCurrentProcess GetCPInfo FreeResource InterlockedExchangeAdd InterlockedExchange InterlockedCompareExchange FreeLibrary FormatMessageW FindResourceW EnumCalendarInfoW EnterCriticalSection DeleteCriticalSection CreateThread CreateFileW CreateEventW CreateDirectoryW CompareStringW CloseHandle Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject StretchBlt SetWindowOrgEx SetWinMetaFileBits SetViewportOrgEx SetTextColor SetStretchBltMode SetROP2 SetPixel SetEnhMetaFileBits SetDIBits SetDIBColorTable SetBrushOrgEx SetBkMode SetBkColor SelectPalette SelectObject SaveDC RoundRect RestoreDC Rectangle RectVisible RealizePalette Polyline Polygon PolyBezierTo PolyBezier PlayEnhMetaFile Pie PatBlt MoveToEx MaskBlt LineTo IntersectClipRect GetWindowOrgEx GetWinMetaFileBits GetTextMetricsW GetTextExtentPointW GetTextExtentPoint32W GetSystemPaletteEntries GetStockObject GetRgnBox GetPixel GetPaletteEntries GetObjectW GetEnhMetaFilePaletteEntries GetEnhMetaFileHeader GetEnhMetaFileDescriptionW GetEnhMetaFileBits GetDeviceCaps GetDIBits GetDIBColorTable GetDCOrgEx GetCurrentPositionEx GetClipBox GetBrushOrgEx GetBitmapBits FrameRgn ExtTextOutW ExtFloodFill ExcludeClipRect EnumFontFamiliesExW Ellipse DeleteObject DeleteEnhMetaFile DeleteDC CreateSolidBrush CreateRectRgn CreatePenIndirect CreatePalette CreateHalftonePalette CreateFontIndirectW CreateDIBitmap CreateDIBSection CreateCompatibleDC CreateCompatibleBitmap CreateBrushIndirect CreateBitmap CopyEnhMetaFileW Chord BitBlt Arc

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

ole32

OleUninitialize OleInitialize CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize IsEqualGUID

comctl32

InitializeFlatSB FlatSB_SetScrollProp FlatSB_SetScrollPos FlatSB_SetScrollInfo FlatSB_GetScrollPos FlatSB_GetScrollInfo _TrackMouseEvent ImageList_SetIconSize ImageList_GetIconSize ImageList_Write ImageList_Read ImageList_GetDragImage ImageList_DragShowNolock ImageList_DragMove ImageList_DragLeave ImageList_DragEnter ImageList_EndDrag ImageList_BeginDrag ImageList_Remove ImageList_DrawEx ImageList_Draw ImageList_GetBkColor ImageList_SetBkColor ImageList_Add ImageList_SetImageCount ImageList_GetImageCount ImageList_Destroy ImageList_Create

shell32

ShellExecuteW SHGetSpecialFolderLocation SHGetPathFromIDListW SHGetMalloc

Name

.text

Size

686KB

Virtual Size

685KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

1024B

Virtual Size

806B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

60B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

08c3b4a6961c962a3371c6bcdb0aa6e0_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallerStuff.dll

rpcrt4

kernel32

advapi32

wininet

generic

$PLUGINSDIR/OCSetupHlp.dll

PE Signature issue

kernel32

psapi

ws2_32

msimg32

shlwapi

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

uxtheme

gdiplus

version

urlmon

wininet

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsJSON.dll

generic

out.upx

generic

$PLUGINSDIR/setup_cr.exe

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/InstallerUtils.dll

shlwapi

wininet

kernel32

user32

advapi32

ole32

oleaut32

generic

$PLUGINSDIR/Ivqyxeeikmjuu.tmp

$PLUGINSDIR/StdUtils.dll

msvcrt