10b3fccb3e2036e795347cb0a36ecccd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

10b3fccb3e2036e795347cb0a36ecccd_JaffaCakes118
Size

545KB
MD5

10b3fccb3e2036e795347cb0a36ecccd
SHA1

0301b5080d34d6647e2a6733158607bdbff76a12
SHA256

bd4b1435c556353eccec9ac2a96c3952f420db81be5703d58441cc46f396d878
SHA512

c8d963a79e73a67450e859710608a2132a2c075ed57c0fde81ed67096572048808c89e9e5e7f2197c0f1b68ac039617a69e3a228994a7922b5e0841b84e48870
SSDEEP

12288:j5fZmO2OoCap4m2KrLJ7km+lEUuyrksTkfU+2bTPpdpRIn86H5:j5fZ8N43Kim+uUuzsL+ATxh6H5

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
10b3fccb3e2036e795347cb0a36ecccd_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$SYSDIR/regsvr32.exe

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

10b3fccb3e2036e795347cb0a36ecccd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

dd1742eadfc6df18ded3c26ae64ad610

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
CloseHandle
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/NaverAXGuide.exe
.exe windows:4 windows x86 arch:x86

b5c1ccdb54bf2c12da61b69e2399a06c

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

50:f1:bf:ed:01:9c:b3:cf:57:01:1f:cd:86:80:49:26
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

27/09/2007, 08:33

Not After

05/10/2009, 11:23

Subject

CN=NHN corp.,OU=Game Team,O=NHN corp.,L=Kangnamgu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

00:5a:9d:b8:36:9b:0a:e4:65:d6:51:b4:99:59:15:34:24:00:bd:e7
Signer

Actual PE Digest

00:5a:9d:b8:36:9b:0a:e4:65:d6:51:b4:99:59:15:34:24:00:bd:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

n:\export\axguide\naxmgr\20090310211839-test\build\src\NaverMgr\Release\NaverSetup.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

SetEnvironmentVariableA
SetCurrentDirectoryA
HeapSize
FatalAppExitA
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetStringTypeA
GetStringTypeW
SetUnhandledExceptionFilter
GetTimeZoneInformation
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
SetStdHandle
IsBadCodePtr
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetConsoleCtrlHandler
GetLocaleInfoW
GetSystemTimeAsFileTime
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
RaiseException
GetLastError
InitializeCriticalSection
DeleteCriticalSection
GetVersion
lstrcmpiA
lstrlenW
lstrcmpiW
lstrlenA
CompareStringA
CompareStringW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetCommandLineA
GetStartupInfoA
IsBadReadPtr
ExitThread
ExitProcess
HeapReAlloc
RtlUnwind
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapAlloc
HeapFree
GetDiskFreeSpaceA
SetErrorMode
GetPrivateProfileStringA
GetPrivateProfileIntA
LocalLock
LocalUnlock
GetOEMCP
GetCPInfo
InterlockedIncrement
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
TlsGetValue
EnterCriticalSection
GlobalHandle
LeaveCriticalSection
GetFileTime
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
FindFirstFileA
FindNextFileA
FindClose
GetTickCount
SuspendThread
ResumeThread
SetThreadPriority
ConvertDefaultLocale
EnumResourceLanguagesA
InterlockedDecrement
GlobalSize
MulDiv
SetLastError
FreeResource
GetCurrentThreadId
GlobalGetAtomNameA
GetStringTypeExA
GetStringTypeExW
SetEvent
SizeofResource
LockResource
LoadResource
FindResourceA
CreateEventA
CloseHandle
CreateThread
WaitForSingleObject
RemoveDirectoryA
OutputDebugStringA
lstrcatA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GetModuleHandleA
UnmapViewOfFile
CreateFileMappingA
MapViewOfFile
GetTempFileNameA
LocalFree
GetCurrentDirectoryA
SetVolumeLabelA
GetDiskFreeSpaceExA
GetDriveTypeA
MoveFileA
GetFileAttributesA
SetFileAttributesA
GetExitCodeThread
GetUserDefaultLangID
CreateDirectoryA
GetWindowsDirectoryA
GetSystemDirectoryA
GetTempPathA
GetLongPathNameA
TerminateProcess
GetCurrentProcessId
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalFree
CreateProcessA
MoveFileExA
GetShortPathNameA
WritePrivateProfileStringA
lstrcpyA
LocalFileTimeToFileTime
lstrcmpA
FileTimeToLocalFileTime
LocalAlloc
SetFileTime
CopyFileA
Sleep
SystemTimeToFileTime
FileTimeToSystemTime
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThread
GetCurrentProcess
WriteFile
DeleteFileA
CreateFileA
ReadFile
GetModuleFileNameA
lstrcpynA
GetLocalTime
FormatMessageA
InterlockedExchange

user32

GetDialogBaseUnits
GetSysColorBrush
GetMenuItemInfoA
IsZoomed
RegisterClipboardFormatA
GetMessageA
TranslateMessage
ValidateRect
ShowOwnedPopups
PostQuitMessage
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
SetCursor
LoadAcceleratorsA
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
SetMenu
TranslateAcceleratorA
InflateRect
MapVirtualKeyA
GetKeyNameTextA
GetActiveWindow
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
GetMenuStringA
AppendMenuA
InsertMenuA
RemoveMenu
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
GetMenuCheckMarkDimensions
ScrollWindowEx
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
CheckRadioButton
CheckDlgButton
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
SendDlgItemMessageA
GetFocus
SetFocus
IsChild
GetWindowTextLengthA
IsClipboardFormatAvailable
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
MessageBoxA
TrackPopupMenuEx
TrackPopupMenu
GetKeyState
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
AdjustWindowRectEx
ScreenToClient
DeferWindowPos
GetScrollInfo
SetScrollInfo
GetClassInfoA
RegisterClassA
SetWindowPlacement
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
SetWindowLongA
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetSystemMetrics
CopyRect
GetWindow
CharToOemBuffA
OemToCharBuffA
GetCursorPos
OffsetRect
DrawFocusRect
GetNextDlgGroupItem
ClientToScreen
WindowFromPoint
GetSysColor
GetWindowLongA
GetDesktopWindow
DrawEdge
GetCapture
ReleaseCapture
MessageBeep
GetTabbedTextExtentA
IsRectEmpty
UnionRect
DeleteMenu
DestroyIcon
PostThreadMessageA
GetDCEx
SetForegroundWindow
RedrawWindow
PeekMessageA
DispatchMessageA
MsgWaitForMultipleObjects
GetDC
ReleaseDC
IsWindow
KillTimer
SetTimer
IsWindowVisible
GetWindowRect
EqualRect
UpdateWindow
LockWindowUpdate
SetCapture
GetSystemMenu
SetParent
GetWindowTextA
SetRect
PtInRect
wsprintfA
wvsprintfA
ExitWindowsEx
LoadIconA
GetParent
InvalidateRect
GetClientRect
SetWindowRgn
PostMessageA
SendMessageA
LoadBitmapA
UnregisterClassA
EnableWindow
CharUpperW
CharUpperA
CharLowerW
CharLowerA
LoadCursorA
RemovePropA
FillRect

gdi32

SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ArcTo
PolyDraw
PolylineTo
PolyBezierTo
ExtSelectClipRgn
CreateDIBPatternBrushPt
CreatePatternBrush
SelectPalette
PlayMetaFileRecord
GetObjectType
Escape
PlayMetaFile
ExtCreatePen
CreateHatchBrush
CopyMetaFileA
CreateDCA
CreateRectRgnIndirect
PatBlt
SetRectRgn
GetMapMode
GetTextMetricsA
GetCharWidthA
StretchDIBits
CreateFontA
GetBkColor
StartPage
EndPage
SetAbortProc
AbortDoc
EndDoc
ExtTextOutA
RectVisible
PtVisible
StartDocA
GetWindowExtEx
GetViewportExtEx
SelectClipPath
GetClipRgn
SetColorAdjustment
SetArcDirection
SetMapperFlags
SetTextCharacterExtra
SetTextJustification
SetTextAlign
MoveToEx
LineTo
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
GetClipBox
GetDCOrgEx
SelectClipRgn
GetStockObject
DPtoLP
CreateDIBSection
ExtCreateRegion
GetDeviceCaps
CreateDIBitmap
GetTextExtentPoint32A
SetPixel
GetPixel
GetBitmapBits
CreateBitmapIndirect
SetBkMode
SelectObject
StretchBlt
DeleteDC
SetTextColor
TextOutA
GetObjectA
CreatePen
DeleteObject
CreateSolidBrush
CreateFontIndirectA
CreateCompatibleBitmap
CreateRectRgn
CombineRgn
EnumMetaFile
BitBlt
CreateCompatibleDC

comdlg32

PageSetupDlgA
GetOpenFileNameA
GetSaveFileNameA
FindTextA
CommDlgExtendedError
PrintDlgA
GetFileTitleA
ReplaceTextA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

advapi32

RegDeleteValueA
RevertToSelf
AccessCheck
IsValidSecurityDescriptor
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
InitializeSecurityDescriptor
AllocateAndInitializeSid
OpenProcessToken
GetFileSecurityA
SetFileSecurityA
RegCreateKeyA
RegQueryValueA
RegOpenKeyA
RegSetValueA
RegQueryInfoKeyA
RegEnumKeyA
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
InitiateSystemShutdownA
LookupAccountSidA
RegSetValueExA
FreeSid
RegEnumValueA
RegEnumKeyExA
RegCreateKeyExA
RegDeleteKeyA
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
GetTokenInformation
EqualSid
ImpersonateSelf
OpenThreadToken

shell32

ExtractIconA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
DragFinish
DragQueryFileA
SHGetMalloc
SHGetFileInfoA

comctl32

ImageList_AddMasked
ImageList_Draw
_TrackMouseEvent
ord17
ord13
ImageList_Read
ImageList_Write
ord14
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA
ImageList_Merge
ImageList_GetImageInfo

shlwapi

PathRemoveExtensionA
PathFindFileNameA
PathStripToRootA
PathFindExtensionA
PathIsUNCA

oledlg

ord8

ole32

ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
CreateStreamOnHGlobal
StringFromCLSID
CoCreateGuid
CLSIDFromString
CoGetClassObject
CoFreeUnusedLibraries
CLSIDFromProgID
OleRun
CoTreatAsClass
CreateBindCtx
CoTaskMemAlloc
ReleaseStgMedium
OleDuplicateData
OleUninitialize
OleInitialize
CoDisconnectObject
CoCreateInstance
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemFree
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
SetConvertStg
OleSetClipboard

oleaut32

SysStringLen
LoadTypeLi
VarBstrFromDate
VarBstrFromCy
VarCyFromStr
VarDecFromStr
VarBstrFromDec
VarDateFromStr
SysReAllocStringLen
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayUnlock
SafeArrayLock
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayCopy
SafeArrayAllocDescriptor
SafeArrayAllocData
VariantCopy
SafeArrayRedim
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringByteLen
SysFreeString
SysAllocStringLen
VariantInit
VariantChangeType
SysAllocStringByteLen
VariantClear

wininet

HttpQueryInfoA
InternetOpenA
InternetCloseHandle
InternetCrackUrlA
InternetReadFile
InternetOpenUrlA

Sections

.text
Size: 552KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 328KB - Virtual size: 324KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$SYSDIR/regsvr32.exe
.exe windows:5 windows x86 arch:x86

7dc87ef66f0ed84345e4cf471a3c3455

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

regsvr32.pdb

Imports

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
exit
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3
__argc
__wargv
_wsplitpath
_wcmdln
wcslen

advapi32

RegQueryValueW
RegCloseKey
RegOpenKeyExW

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GetModuleHandleA
LocalAlloc
FormatMessageW
SetErrorMode
lstrcatA
WideCharToMultiByte
LoadLibraryExW
GetLastError
GetProcAddress
lstrcmpW
GetStartupInfoW
QueryPerformanceCounter
lstrlenW
lstrcpyW
lstrcatW
lstrcpynW
FreeLibrary

user32

LoadStringW
MessageBoxW
wsprintfW

ole32

OleInitialize
OleUninitialize

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$WINDIR/Downloaded Program Files/NaverAXGuide.dll
.dll regsvr32 windows:4 windows x86 arch:x86

1cd99c4d1bc7eccb676eca60e2095f7b

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

50:f1:bf:ed:01:9c:b3:cf:57:01:1f:cd:86:80:49:26
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

27/09/2007, 08:33

Not After

05/10/2009, 11:23

Subject

CN=NHN corp.,OU=Game Team,O=NHN corp.,L=Kangnamgu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:62:13:1a:00:b9:21:57:7c:44:f2:2d:1f:58:62:d7:0c:55:bf:c5
Signer

Actual PE Digest

0a:62:13:1a:00:b9:21:57:7c:44:f2:2d:1f:58:62:d7:0c:55:bf:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

wininet

HttpQueryInfoA
InternetCloseHandle
InternetOpenUrlA
InternetOpenA

kernel32

GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
InterlockedIncrement
InterlockedDecrement
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
lstrcpynA
lstrcpyA
GetModuleFileNameA
lstrcatA
InterlockedExchange
FreeLibrary
LoadLibraryExA
GetModuleHandleA
CloseHandle
GetSystemDirectoryA
GetWindowsDirectoryA
GetTempPathA
GetExitCodeProcess
DeleteFileA
CreateProcessA
LocalAlloc
FormatMessageA
FindClose
FindFirstFileA
WriteFile
lstrcmpA
SetStdHandle
LoadLibraryA
SetFilePointer
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetSystemTimeAsFileTime
GetCurrentProcessId
FlushFileBuffers
TlsFree
TlsSetValue
TlsGetValue
LCMapStringA
LCMapStringW
IsDBCSLeadByte
GetTickCount
QueryPerformanceCounter
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetProcAddress
IsBadWritePtr
VirtualFree
HeapCreate
GetFileType
GetStdHandle
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
LocalFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlUnwind
GetCurrentThreadId
GetCommandLineA
ExitProcess
SetHandleCount

user32

wsprintfA
CharNextA
MsgWaitForMultipleObjects
GetClassInfoExA
RegisterClassExA
CreateWindowExA
DefWindowProcA
DestroyWindow
PeekMessageA
DispatchMessageA

advapi32

RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegEnumValueA

ole32

CLSIDFromString
CoGetClassObject
StringFromGUID2
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

oleaut32

SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VariantClear

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$WINDIR/Downloaded Program Files/NaverAXGuide.inf

Sharing

General

Malware Config

Signatures

Files

dd1742eadfc6df18ded3c26ae64ad610

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 25KB - Virtual size: 24KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

b5c1ccdb54bf2c12da61b69e2399a06c

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

50:f1:bf:ed:01:9c:b3:cf:57:01:1f:cd:86:80:49:26Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

00:5a:9d:b8:36:9b:0a:e4:65:d6:51:b4:99:59:15:34:24:00:bd:e7Signer

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

oledlg

ole32

oleaut32

wininet

Sections

.text Size: 552KB - Virtual size: 549KB

.rdata Size: 152KB - Virtual size: 149KB

.data Size: 20KB - Virtual size: 33KB

.rsrc Size: 328KB - Virtual size: 324KB

7dc87ef66f0ed84345e4cf471a3c3455

Headers

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 25KB - Virtual size: 24KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

50:f1:bf:ed:01:9c:b3:cf:57:01:1f:cd:86:80:49:26
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

00:5a:9d:b8:36:9b:0a:e4:65:d6:51:b4:99:59:15:34:24:00:bd:e7
Signer

.text
Size: 552KB - Virtual size: 549KB

.rdata
Size: 152KB - Virtual size: 149KB

.data
Size: 20KB - Virtual size: 33KB

.rsrc
Size: 328KB - Virtual size: 324KB

.text
Size: 7KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 5KB - Virtual size: 4KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

50:f1:bf:ed:01:9c:b3:cf:57:01:1f:cd:86:80:49:26
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0a:62:13:1a:00:b9:21:57:7c:44:f2:2d:1f:58:62:d7:0c:55:bf:c5
Signer

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 8KB - Virtual size: 6KB