12d07ec5f9476734242fd7f397a8fb18_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

12d07ec5f9476734242fd7f397a8fb18_JaffaCakes118
Size

1.1MB
MD5

12d07ec5f9476734242fd7f397a8fb18
SHA1

b2b6ed2c957772153f6e06894e0fb8c0ab3ed77c
SHA256

42afd26be8201c2fb0f604657c30f9f99949d010866d052721041aa27feab836
SHA512

6a291abfcc23c6688d023837c3af6efd6b24a2c2148a323c2d1804b84316fec28231a3f65cbcac4a80e0b796d78d22f7f4dd1af19c819593b0c438d875e24666
SSDEEP

24576:pAj7E5TduMkwN2aMegfty4McG+9sFNZi/PE8KhLHlH5/XYifs33Z0:KE5nkyEeuSmsFNZmPKhLH03Z0

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsJSON.dll	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
12d07ec5f9476734242fd7f397a8fb18_JaffaCakes118
unpack001/$PLUGINSDIR/DecryptLibrary.dll
unpack001/$PLUGINSDIR/IS.dll
unpack001/$PLUGINSDIR/NET.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack002/out.upx

Files

12d07ec5f9476734242fd7f397a8fb18_JaffaCakes118
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/DecryptLibrary.dll
.dll windows:6 windows x86 arch:x86

9ea8c56cb1502e7af1e2ccbbd907d406

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\TopMedia\SVN\GetPrivateInstaller\DLLs\Plugin.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
EncodePointer
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
GetCommandLineA
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
HeapAlloc
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent
GetProcessHeap
GetStdHandle
GetFileType
ExitProcess
GetModuleHandleExW
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FlushFileBuffers
CloseHandle
HeapSize
GetModuleFileNameW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetACP
IsValidCodePage
GetOEMCP
HeapReAlloc
SetFilePointer
ReadConsoleW
LoadLibraryExW
SetStdHandle
WriteConsoleW
OutputDebugStringW
LoadLibraryW
CreateFileW
SetEndOfFile

Exports

Exports

_decrypt_file_1@12

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GetPrivateInstaller.exe.crypted
$PLUGINSDIR/IS.dll
.dll windows:6 windows x86 arch:x86

43087810d965c117d20dd5225a45da5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\TopMedia\SVN\GetPrivateInstaller\DLLs\InstallerService.pdb

Imports

rpcrt4

RpcStringFreeA
UuidToStringA
UuidCreate

advapi32

RegCloseKey
RegSetValueExA
RegCreateKeyExA

kernel32

SetEndOfFile
WriteConsoleW
GetFileType
GetLastError
HeapFree
WideCharToMultiByte
HeapAlloc
ReadFile
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetFilePointerEx
GetConsoleMode
ReadConsoleW
DeleteCriticalSection
GetStartupInfoW
CloseHandle
HeapSize
Sleep
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
GetStringTypeW
LoadLibraryExW
OutputDebugStringW
LoadLibraryW
CreateFileW
SetStdHandle
FlushFileBuffers
GetConsoleCP
HeapReAlloc
LCMapStringW

Exports

Exports

_GetAdditionalBinaryStr@4
_init_uid_1@8

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NET.dll
.dll windows:6 windows x86 arch:x86

13747ecad4b929762d73c9d1ad62f57f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Work\TopMedia\SVN\GetPrivateInstaller\DLLs\NETWrapper.pdb

Imports

kernel32

LocalAlloc
ReadFile
LocalFree
CloseHandle
GetFileSize
CreateFileA
GetLastError
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
LoadLibraryW
OutputDebugStringW
WideCharToMultiByte
GetCommandLineA
GetCurrentThreadId
EncodePointer
DecodePointer
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
HeapAlloc
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
WriteFile
GetModuleFileNameW
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
LoadLibraryExW
HeapReAlloc
CreateFileW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wininet

HttpQueryInfoA
InternetReadFile
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpSendRequestA
HttpAddRequestHeadersA
HttpOpenRequestA
InternetCloseHandle
InternetAttemptConnect
InternetConnectA
InternetOpenA

Exports

Exports

_call_url_1@4
_post_url@8

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/OCSetupHlp.dll
.dll regsvr32 windows:5 windows x86 arch:x86

bcc9fc26368b3f6e1a5258f41bed8ac8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/01/2011, 00:00

Not After

14/03/2014, 23:59

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

89:40:25:9c:8b:26:a9:bb:37:99:ed:e5:d9:76:87:93:0b:17:f4:00
Signer

Actual PE Digest

89:40:25:9c:8b:26:a9:bb:37:99:ed:e5:d9:76:87:93:0b:17:f4:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetErrorMode
GetFileAttributesW
CreateFileW
GetFileSize
GetCurrentProcessId
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
ReadFile
GetTimeZoneInformation
GetTempPathW
DeleteFileW
WriteFile
ProcessIdToSessionId
HeapAlloc
GetProcessHeap
HeapFree
CreateDirectoryW
ExpandEnvironmentStringsW
WaitForSingleObject
OutputDebugStringW
CreateMutexW
OpenMutexW
ReleaseMutex
UnmapViewOfFile
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
GetShortPathNameW
SetFilePointer
CreateEventW
GlobalFree
ResumeThread
FreeResource
SetEvent
ResetEvent
GetTickCount
GetCurrentThread
CreateProcessW
MoveFileExW
OpenEventW
lstrlenA
WideCharToMultiByte
SetEnvironmentVariableW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetExitCodeProcess
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetFullPathNameW
SetEndOfFile
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
DeleteCriticalSection
CreateFileA
lstrcmpiW
GetProcAddress
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FlushFileBuffers
GetModuleHandleA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringA
ExitProcess
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
HeapCreate
RtlUnwind
GetDriveTypeW
GetFileType
GetConsoleMode
GetConsoleCP
FindFirstFileA
GetDriveTypeA
FileTimeToLocalFileTime
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
FindResourceA
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetFileAttributesExW
CompareFileTime
GetVersion
GetTempFileNameW
ReleaseSemaphore
InitializeCriticalSectionAndSpinCount
CreateSemaphoreW
GetSystemInfo
GetVersionExW
FileTimeToSystemTime
GetSystemDefaultLCID
FormatMessageA
ExpandEnvironmentStringsA
SleepEx
GetThreadLocale
GetLastError
SetThreadLocale
MultiByteToWideChar
GetModuleFileNameW
InitializeCriticalSection
GetModuleHandleW
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
GlobalUnlock
GlobalLock
GlobalAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CloseHandle
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
FreeLibrary
LoadLibraryW
MulDiv
lstrlenW
lstrcpynW
SetLastError
RaiseException
Sleep
CreateThread
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentDirectoryA
GetCurrentProcess

psapi

GetProcessImageFileNameW
EnumProcesses

ws2_32

select
WSACleanup
WSAStartup
closesocket
WSAGetLastError
socket
recv
send
getsockname
ntohs
bind
htons
getsockopt
getpeername
setsockopt
connect
WSASetLastError
__WSAFDIsSet
gethostname
freeaddrinfo
ioctlsocket
getaddrinfo

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

DestroyMenu
SetActiveWindow
DestroyCursor
NotifyWinEvent
FindWindowW
PeekMessageW
TrackPopupMenu
ReleaseCapture
DrawFocusRect
UnregisterClassA
GetCursor
SetCursor
SetWindowLongW
GetWindowLongW
DefWindowProcW
CallWindowProcW
DestroyWindow
LoadCursorW
IsWindow
GetDesktopWindow
MsgWaitForMultipleObjects
GetWindow
MonitorFromWindow
GetSysColor
GetUpdateRect
SetRect
CreateDialogParamW
GetSystemMetrics
CallNextHookEx
UnhookWindowsHookEx
SystemParametersInfoW
SetWindowsHookExW
DrawIconEx
GetIconInfo
SetMenuItemInfoW
IsWindowVisible
PostQuitMessage
KillTimer
SetTimer
PostMessageW
GetWindowTextLengthW
GetWindowTextW
EnumChildWindows
EnumWindows
RegisterClassExW
GetClassInfoExW
CreateWindowExW
GetSysColorBrush
GetDC
SendMessageW
SetFocus
TrackMouseEvent
InvalidateRect
GetClientRect
BeginPaint
EndPaint
GetCursorPos
SetForegroundWindow
SetDlgItemTextW
SendDlgItemMessageW
EnableMenuItem
GetSystemMenu
EnableWindow
LoadImageW
MessageBoxW
MapWindowPoints
GetParent
CharNextW
GetAsyncKeyState
CopyRect
GetMonitorInfoW
MonitorFromPoint
GetForegroundWindow
SetClipboardData
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
SetWindowPos
SetWindowTextW
LoadIconW
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
GetDlgItem
ShowWindow
ReleaseDC
DrawTextW
FillRect
MoveWindow
GetWindowRect
GetAncestor
PtInRect
ScreenToClient

gdi32

SelectObject
SetBkMode
SetTextColor
GetDeviceCaps
DPtoLP
CreateFontIndirectW
CreateSolidBrush
SetViewportOrgEx
GetTextExtentPoint32W
GetObjectW
CreatePatternBrush
SetBkColor
ExtTextOutW
CreateDIBSection
GdiFlush
DeleteDC
GetStockObject
CreateCompatibleBitmap
DeleteObject
CreateCompatibleDC
BitBlt

advapi32

RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
DuplicateTokenEx
LookupAccountSidW
GetUserNameW
CreateProcessAsUserW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW

shell32

Shell_NotifyIconW
SHGetFolderPathW
ShellExecuteW

ole32

CoInitializeSecurity
CreateStreamOnHGlobal
CLSIDFromProgID
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance
CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
StringFromGUID2
CoTaskMemRealloc

oleaut32

LoadTypeLi
UnRegisterTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString
SysStringLen
VariantClear
SysAllocStringLen
VariantChangeType
LoadRegTypeLi
OleLoadPicture
SysAllocString
VariantInit

comctl32

InitCommonControlsEx

uxtheme

DrawThemeBackground
OpenThemeData
CloseThemeData

gdiplus

GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipLoadImageFromFile
GdipCloneImage
GdipDrawImagePointRectI
GdipDrawImageRectRect

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW
InternetGetConnectedStateExW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
OCPRD2007OpenCandy1
OCPRD2007OpenCandy10
OCPRD2007OpenCandy11
OCPRD2007OpenCandy12
OCPRD2007OpenCandy13
OCPRD2007OpenCandy14
OCPRD2007OpenCandy15
OCPRD2007OpenCandy16
OCPRD2007OpenCandy17
OCPRD2007OpenCandy18
OCPRD2007OpenCandy19
OCPRD2007OpenCandy20
OCPRD2007OpenCandy21
OCPRD2007OpenCandy22
OCPRD2007OpenCandy23
OCPRD2007OpenCandy24
OCPRD2007OpenCandy29
OCPRD2007OpenCandy30
OCPRD2007OpenCandy31
OCPRD2007OpenCandy32
OCPRD2007OpenCandy33
OCPRD2007OpenCandy34
OCPRD2007OpenCandy35
OCPRD2007OpenCandy36
OCPRD2007OpenCandy37
OCPRD2007OpenCandy38
OCPRD2007OpenCandy39
OCPRD2007OpenCandy40
OCPRD2007OpenCandy41
OCPRD2007OpenCandy42
OCPRD2007OpenCandy44
OCPRD2007OpenCandy45
OCPRD2007OpenCandy46
OCPRD2007OpenCandy47
OCPRD2007OpenCandy48
OCPRD2007OpenCandy49
OCPRD2007OpenCandy5
OCPRD2007OpenCandy50
OCPRD2007OpenCandy51
OCPRD2007OpenCandy52
OCPRD2007OpenCandy53
OCPRD2007OpenCandy54
OCPRD2007OpenCandy55
OCPRD2007OpenCandy56
OCPRD2007OpenCandy57
OCPRD2007OpenCandy58
OCPRD2007OpenCandy59
OCPRD2007OpenCandy6
OCPRD2007OpenCandy60
OCPRD2007OpenCandy61
OCPRD2007OpenCandy62
OCPRD2007OpenCandy7
OCPRD2007OpenCandy8
OCPRD2007OpenCandy9
_OCPRD2007OpenCandy2@16
_OCPRD2007OpenCandy3@16
_OCPRD2007OpenCandy43@16
_OCPRD2007OpenCandy4@16

Sections

.text
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsJSON.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

Delete
Get
Serialize
Set

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 596B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

be41bf7b8cc010b614bd36bbca606973

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 29KB - Virtual size: 28KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 458KB

.ndata Size: - Virtual size: 1.5MB

.rsrc Size: 135KB - Virtual size: 135KB

.reloc Size: 4KB - Virtual size: 3KB

9ea8c56cb1502e7af1e2ccbbd907d406

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 102KB - Virtual size: 102KB

.rdata Size: 34KB - Virtual size: 33KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 33KB - Virtual size: 32KB

43087810d965c117d20dd5225a45da5d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

rpcrt4

advapi32

kernel32

Exports

Exports

Sections

.text Size: 46KB - Virtual size: 46KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 15KB - Virtual size: 15KB

13747ecad4b929762d73c9d1ad62f57f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

wininet

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 44KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 4KB - Virtual size: 12KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 15KB - Virtual size: 15KB

bcc9fc26368b3f6e1a5258f41bed8ac8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

.text
Size: 29KB - Virtual size: 28KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 458KB

.ndata
Size: - Virtual size: 1.5MB

.rsrc
Size: 135KB - Virtual size: 135KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 102KB - Virtual size: 102KB

.rdata
Size: 34KB - Virtual size: 33KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 33KB - Virtual size: 32KB

.text
Size: 46KB - Virtual size: 46KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 15KB - Virtual size: 15KB

.text
Size: 44KB - Virtual size: 44KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 4KB - Virtual size: 12KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 15KB - Virtual size: 15KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

89:40:25:9c:8b:26:a9:bb:37:99:ed:e5:d9:76:87:93:0b:17:f4:00
Signer

.text
Size: 571KB - Virtual size: 571KB

.rdata
Size: 193KB - Virtual size: 192KB

.data
Size: 11KB - Virtual size: 22KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 35KB - Virtual size: 35KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B