1afe186bee980790a4cfde35c4ac016f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

1afe186bee980790a4cfde35c4ac016f_JaffaCakes118
Size

323KB
MD5

1afe186bee980790a4cfde35c4ac016f
SHA1

565ffc32420a77059ae86197fed04a41aaa41a60
SHA256

968bda985015ce75357321a8e69c8729e4859a8442c845b03b848db6014305e3
SHA512

cc377d6b5c3fcdd37253c8f91ab1a86d2e1711550b5e9f527fb0205f1ecccbe238f9ab4d2e064ec6d5b22029e60e3b3ca99774c109947d9b06dc23288b40dbff
SSDEEP

6144:ZUMcOTnGZ4Rt+tMFi3hnuHtFRDoWDpg1vX81b9+:Zx7gIt2VuFDoW9CvsC

Score

1^/10

Malware Config

Signatures

Files

1afe186bee980790a4cfde35c4ac016f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

2b235885ef9cdfb92d35484a81bec10f

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:0d:fc:c3:6d:de:fd:25:1d:c2:41:dd:75:cc:01:0a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

03/11/2016, 00:00

Not After

03/11/2017, 23:59

Subject

CN=AITI ALYANS LLC,OU=Software development,O=AITI ALYANS LLC,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

62:83:f1:91:60:90:94:98:d5:2a:e6:dd:df:7f:14:61:18:0e:f3:69
Signer

Actual PE Digest

62:83:f1:91:60:90:94:98:d5:2a:e6:dd:df:7f:14:61:18:0e:f3:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

user32

GetWindow
GetDesktopWindow
CopyRect
GetDlgCtrlID
GetWindowRect

comdlg32

FindTextA
GetFileTitleA
GetFileTitleW
GetOpenFileNameA
GetOpenFileNameW
PageSetupDlgA
ChooseColorW
PrintDlgA
ReplaceTextA
ReplaceTextW
GetSaveFileNameA
ChooseFontA
GetSaveFileNameW
ChooseFontW
FindTextW
ChooseColorA
PageSetupDlgW
PrintDlgW
CommDlgExtendedError

advapi32

RegDeleteValueA
GetSecurityDescriptorLength
SetAclInformation
CryptDestroyKey
IsTextUnicode
OpenServiceA
GetPrivateObjectSecurity
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetTokenInformation
RegQueryValueExW
CloseEncryptedFileRaw
AddAuditAccessObjectAce
StartServiceA
RegCreateKeyExW
LookupPrivilegeValueA
RegReplaceKeyW
SetServiceObjectSecurity
RegQueryInfoKeyA
ClearEventLogA
AccessCheckByTypeResultListAndAuditAlarmByHandleW
RegConnectRegistryA
RegQueryInfoKeyW
AddAuditAccessAce
ObjectCloseAuditAlarmW
CryptGetProvParam
CryptDestroyHash
GetSecurityDescriptorOwner
RegEnumKeyExA
GetSidIdentifierAuthority
CreateProcessWithLogonW
CryptGetDefaultProviderA
OpenEncryptedFileRawA
RegSetValueA
RegOpenKeyExA
DuplicateTokenEx
RegOpenKeyExW
FileEncryptionStatusW
CryptCreateHash
QueryServiceLockStatusA
ReadEventLogA
GetSecurityDescriptorGroup
SetFileSecurityW
AddAccessDeniedAce
SetSecurityDescriptorSacl
QueryServiceObjectSecurity
RegLoadKeyA
ChangeServiceConfig2W
EnumServicesStatusA
DecryptFileW
NotifyBootConfigStatus
RegEnumKeyA
CryptSetKeyParam
IsValidSecurityDescriptor
GetAclInformation
SetServiceStatus
AbortSystemShutdownW
ClearEventLogW
InitiateSystemShutdownW
AccessCheckByTypeResultList
RegUnLoadKeyW
IsValidSid
LookupPrivilegeDisplayNameA
DecryptFileA
IsValidAcl
AccessCheckAndAuditAlarmW
ChangeServiceConfig2A
CryptSetHashParam
AccessCheckByTypeResultListAndAuditAlarmA
RegDeleteKeyW
GetOldestEventLogRecord
CreateProcessAsUserW
CreateProcessAsUserA
OpenBackupEventLogA
RevertToSelf
CryptSignHashA
LookupPrivilegeDisplayNameW
ReportEventW
AccessCheck
LookupPrivilegeNameW
GetSidSubAuthority
GetSecurityDescriptorSacl
AddAccessAllowedAceEx
RegFlushKey
AbortSystemShutdownA
AreAllAccessesGranted
GetSidLengthRequired
RegCreateKeyA
CryptEnumProvidersA
RegQueryValueA
OpenBackupEventLogW
StartServiceCtrlDispatcherW
ConvertToAutoInheritPrivateObjectSecurity
RegQueryMultipleValuesA
ReadEventLogW
CryptDecrypt
CryptGetUserKey
LookupAccountNameA
AccessCheckAndAuditAlarmA
RegDeleteKeyA
CreateWellKnownSid
GetSecurityDescriptorControl
CryptContextAddRef
RegisterServiceCtrlHandlerW
QueryServiceStatus
QueryServiceConfig2W
CryptVerifySignatureW
ObjectDeleteAuditAlarmW
RegDisablePredefinedCache
CryptSetProviderA
AdjustTokenPrivileges
RegEnumKeyW
CreatePrivateObjectSecurityEx
RegSetValueExW
CloseServiceHandle
RegOpenUserClassesRoot
RegSaveKeyA
RegEnumValueA
AllocateAndInitializeSid
GetSecurityDescriptorRMControl
RegReplaceKeyA
RegisterEventSourceW
SetKernelObjectSecurity
CryptAcquireContextW
GetUserNameA
FreeSid
MakeAbsoluteSD2
GetUserNameW
RegLoadKeyW
InitiateSystemShutdownA
OpenThreadToken
CryptVerifySignatureA
QueryServiceConfigA
QueryServiceLockStatusW
LookupAccountSidA
InitiateSystemShutdownExA
GetLengthSid
RegSaveKeyW
AdjustTokenGroups
ObjectDeleteAuditAlarmA
AddAccessDeniedObjectAce
GetSidSubAuthorityCount
CryptGetHashParam
RegQueryValueW
CryptExportKey
ObjectOpenAuditAlarmW
GetWindowsAccountDomainSid
RegRestoreKeyA
CreateRestrictedToken
ObjectPrivilegeAuditAlarmA
GetFileSecurityW
DestroyPrivateObjectSecurity
QueryServiceConfig2A
CryptEncrypt
AddAccessAllowedObjectAce
InitializeSid
EqualPrefixSid
CloseEventLog
RegEnumValueW
CreateServiceA
EnumServicesStatusExW
DeleteService
CryptEnumProviderTypesW
MakeSelfRelativeSD
GetServiceKeyNameA
OpenEventLogA
StartServiceW
OpenEncryptedFileRawW
QueryServiceStatusEx
RegCreateKeyW
RegSetKeySecurity
AccessCheckByTypeResultListAndAuditAlarmByHandleA
CreateServiceW
AddAccessDeniedAceEx
ReadEncryptedFileRaw
SetSecurityDescriptorDacl
GetServiceKeyNameW
SetTokenInformation
EqualSid
RegOverridePredefKey
AddAce
SetFileSecurityA
LookupPrivilegeValueW
RegisterServiceCtrlHandlerExW
ReportEventA
RegOpenKeyA
StartServiceCtrlDispatcherA
InitializeAcl
ImpersonateSelf
NotifyChangeEventLog
AccessCheckByTypeAndAuditAlarmW
RegQueryMultipleValuesW
OpenSCManagerW
OpenProcessToken
IsTokenRestricted
CryptSetProviderExA
GetCurrentHwProfileA
InitiateSystemShutdownExW
CryptEnumProviderTypesA
RegisterEventSourceA
AccessCheckByTypeAndAuditAlarmA
InitializeSecurityDescriptor
ImpersonateNamedPipeClient
CryptSetProviderW
GetServiceDisplayNameA
FindFirstFreeAce
GetAce
CryptImportKey
RegGetKeySecurity
CryptSignHashW
CryptAcquireContextA
GetEventLogInformation
RegNotifyChangeKeyValue
ChangeServiceConfigA
QueryServiceConfigW
CryptDuplicateKey
RegCloseKey
BackupEventLogA
GetCurrentHwProfileW
DeleteAce
CheckTokenMembership
CryptSetProvParam
SetPrivateObjectSecurityEx
LockServiceDatabase
EnumDependentServicesW
GetSecurityDescriptorDacl
GetKernelObjectSecurity
OpenSCManagerA
DuplicateToken
CryptGenKey
CryptHashData
RegOpenCurrentUser
GetFileSecurityA
CryptDeriveKey
RegisterServiceCtrlHandlerA
ObjectCloseAuditAlarmA
MapGenericMask
ChangeServiceConfigW
CreatePrivateObjectSecurity
RegCreateKeyExA
PrivilegeCheck
PrivilegedServiceAuditAlarmW
RegConnectRegistryW
ControlService
CryptGenRandom
ObjectOpenAuditAlarmA
AllocateLocallyUniqueId
RegisterServiceCtrlHandlerExA
AreAnyAccessesGranted
IsWellKnownSid
LogonUserW
CryptReleaseContext
RegSetValueExA
EnumDependentServicesA
ObjectPrivilegeAuditAlarmW
LookupAccountSidW
RegRestoreKeyW
LookupPrivilegeNameA
UnlockServiceDatabase
CryptGetKeyParam
RegUnLoadKeyA
DeregisterEventSource
AddAccessAllowedAce
RegOpenKeyW
RegEnumKeyExW
CryptDuplicateHash
MakeAbsoluteSD
CryptGetDefaultProviderW
SetThreadToken
RegDeleteValueW
OpenServiceW
PrivilegedServiceAuditAlarmA
EnumServicesStatusExA
EqualDomainSid
GetNumberOfEventLogRecords
BackupEventLogW
EncryptFileW
CryptHashSessionKey
SetSecurityDescriptorControl
AccessCheckByTypeResultListAndAuditAlarmW
CryptSetProviderExW
CryptEnumProvidersW
EnumServicesStatusW
LogonUserA
RegQueryValueExA
AddAuditAccessAceEx
GetServiceDisplayNameW
EncryptFileA
CopySid
SetSecurityDescriptorRMControl
SetPrivateObjectSecurity
RegSetValueW
WriteEncryptedFileRaw
AccessCheckByType
LookupAccountNameW
OpenEventLogW
ImpersonateLoggedOnUser
FileEncryptionStatusA
ImpersonateAnonymousToken

comctl32

FlatSB_GetScrollPos
ord16
ImageList_LoadImageW
ImageList_DragLeave
ord13
FlatSB_ShowScrollBar
ImageList_Create
ImageList_DragShowNolock
ImageList_Replace
InitMUILanguage
ord4
DrawStatusTextW
ImageList_SetIconSize
ImageList_DrawIndirect
ImageList_DrawEx
PropertySheetW
ImageList_GetDragImage
ImageList_GetImageInfo
FlatSB_EnableScrollBar
ImageList_Merge
FlatSB_SetScrollPos
FlatSB_SetScrollRange
ord17
CreateStatusWindowW
FlatSB_SetScrollProp
FlatSB_SetScrollInfo
ImageList_GetImageCount
InitCommonControlsEx
ImageList_SetImageCount
ImageList_Duplicate
ord5
PropertySheetA
InitializeFlatSB
ord6
ImageList_ReplaceIcon
GetMUILanguage
ord14
ImageList_Add
UninitializeFlatSB
ImageList_SetBkColor
ImageList_GetIconSize
DestroyPropertySheetPage
ord2
ImageList_GetIcon
FlatSB_GetScrollInfo
ImageList_EndDrag
ImageList_DragEnter
ImageList_SetOverlayImage
ImageList_LoadImageA
ord15
ImageList_Copy
ImageList_Draw
CreatePropertySheetPageA
FlatSB_GetScrollRange
ImageList_GetBkColor
ImageList_BeginDrag
ord8
CreatePropertySheetPageW
ImageList_DragMove
ImageList_SetDragCursorImage
ImageList_Destroy
FlatSB_GetScrollProp
ImageList_AddMasked
ord3
ImageList_Remove

gdi32

GetDIBits
GetGlyphOutlineW
ChoosePixelFormat
GetFontUnicodeRanges
GetPolyFillMode
PolyBezierTo
EnumICMProfilesW
UpdateColors
GetMapMode
SetROP2
GetWindowExtEx
CreateICW
SetDIBits
SetBrushOrgEx
GetSystemPaletteUse
DrawEscape
SelectClipPath
GetCharWidthW
GetNearestPaletteIndex
CopyEnhMetaFileW
StretchDIBits
SetPixel
CombineTransform
GetWindowOrgEx
CreateScalableFontResourceW
SetWindowExtEx
PolyPolygon
GetNearestColor
GetCharABCWidthsI
ExtTextOutA
SetBkMode
GetTextCharacterExtra
SetAbortProc
SetMetaRgn
CreateMetaFileW
WidenPath
PolyDraw
GetDeviceGammaRamp
GdiGetBatchLimit
UnrealizeObject
GetStretchBltMode
CancelDC
RemoveFontMemResourceEx
CreateEllipticRgnIndirect
SetColorSpace
ColorMatchToTarget
CreateHalftonePalette
GetEnhMetaFileDescriptionA
ExtCreateRegion
GetTextAlign
GetMetaFileA
CreateDIBPatternBrush
PolyTextOutW
PathToRegion
StrokeAndFillPath
SetEnhMetaFileBits
GetICMProfileA
SetICMProfileA
SetDCBrushColor
GetCharacterPlacementW
GetArcDirection
DeleteDC
GetBitmapBits
ExtCreatePen
DescribePixelFormat
RestoreDC
SelectPalette
SetWorldTransform
CheckColorsInGamut
EnumObjects
PtVisible
CreateFontIndirectA
GetCharWidthI
SetMapMode
StrokePath
SetArcDirection
SetTextJustification
TranslateCharsetInfo
FrameRgn
SetWinMetaFileBits
CloseFigure
GetFontData
CreateDIBPatternBrushPt
GetBrushOrgEx
SetPaletteEntries
GetGraphicsMode
GetRandomRgn
GetCharWidthFloatA
CreateBrushIndirect
GetEnhMetaFileHeader
CreateCompatibleBitmap
FillRgn
CreateColorSpaceW
GetPixel
GetCharWidth32A
PolyPolyline
GetTextCharsetInfo
CreateRectRgn
FlattenPath
SetGraphicsMode
ExtTextOutW
CreatePalette
RealizePalette
GetObjectA
GetBitmapDimensionEx
ScaleWindowExtEx
SetLayout
ScaleViewportExtEx
CombineRgn
StartDocA
EnumFontsW
GetCharABCWidthsFloatW
GetICMProfileW
PlayMetaFile
SetDCPenColor
EnumFontFamiliesW
EnumFontsA
SetBitmapBits
GetCharWidthFloatW
ExtSelectClipRgn
GdiFlush
SetTextCharacterExtra
LineTo
Escape
GetColorSpace
IntersectClipRect
PatBlt
GetTextExtentPoint32A
BeginPath
GetMiterLimit
GetTextCharset
CreateBitmapIndirect
EndDoc
EnumFontFamiliesExW
Polygon
EnumICMProfilesA
CreatePolygonRgn
GetClipBox
GetKerningPairsW
OffsetClipRgn
GetStockObject
EnumFontFamiliesA
GetTextExtentPointA
AbortDoc
ArcTo
GetBkColor
SetPolyFillMode
GetTextFaceW
CreateScalableFontResourceA
GdiSetBatchLimit
GetOutlineTextMetricsA
GetEnhMetaFileDescriptionW
EnumFontFamiliesExA
CreateDCA
PlayMetaFileRecord
CreateDIBSection
AbortPath
ExtFloodFill
GdiComment
GetLogColorSpaceA
PaintRgn
CreateFontA
CreateFontIndirectW
AddFontResourceExW
FillPath
GetColorAdjustment
CreateICA
RectVisible
AnimatePalette
StartPage
Ellipse
MoveToEx
GetEnhMetaFileW
GetDIBColorTable
GetMetaFileBitsEx
GetWorldTransform
SaveDC
GetWinMetaFileBits
OffsetViewportOrgEx
StartDocW
CreateBitmap
GetRasterizerCaps
DeleteObject
SetMapperFlags
GetCurrentObject
SetPixelV
GetClipRgn
GetEnhMetaFileA
CreateMetaFileA
ResetDCA
ModifyWorldTransform
GetMetaFileW
CreateDCW
GetGlyphIndicesA
CopyEnhMetaFileA
GetTextColor
RemoveFontResourceW
CreatePenIndirect
CloseMetaFile
FloodFill
PolyBezier
BitBlt
GetTextFaceA
MaskBlt
GetDCPenColor
GetEnhMetaFilePixelFormat
GetLayout
CreateSolidBrush
SetColorAdjustment
CreateFontIndirectExA
CreateEnhMetaFileA
PlayEnhMetaFileRecord
CreateDIBitmap
DeleteEnhMetaFile
TextOutA
GetBoundsRect
CreateRoundRectRgn
LineDDA
GetSystemPaletteEntries
UpdateICMRegKeyW
CreateFontW
CopyMetaFileA
Pie
SetTextColor
AddFontResourceExA
SetRectRgn
CreateRectRgnIndirect
GetPath
GetROP2
GetFontLanguageInfo
EnumMetaFile
GetMetaRgn
GetKerningPairsA
ResetDCW
GetEnhMetaFileBits
GetCharacterPlacementA
PtInRegion
EnumEnhMetaFile
GetLogColorSpaceW
PlayEnhMetaFile
GetDCBrushColor
GetCurrentPositionEx
PlgBlt
PolylineTo
GetRegionData
GetTextExtentExPointI
GetGlyphOutlineA
TextOutW
ResizePalette
CreateFontIndirectExW
SetTextAlign
StretchBlt
InvertRgn
SetStretchBltMode
SetBitmapDimensionEx
GetObjectType
SetMetaFileBitsEx
GetTextExtentPointI
CloseEnhMetaFile
AddFontResourceA
GetEnhMetaFilePaletteEntries
GetTextMetricsA
CopyMetaFileW
DPtoLP
GetDCOrgEx
CreateEnhMetaFileW
GetCharWidthA
Polyline
CreatePen
SetViewportOrgEx
Rectangle
RemoveFontResourceA
SetBkColor
GetTextExtentExPointW
GetTextExtentPointW
SetSystemPaletteUse
GetTextExtentPoint32W
SelectClipRgn
EqualRgn
RemoveFontResourceExA
GetTextMetricsW
GetCharABCWidthsA
GetAspectRatioFilterEx
GetTextExtentExPointA
CreateDiscardableBitmap
RoundRect
SwapBuffers
GetOutlineTextMetricsW
GetCharABCWidthsFloatA
ExtEscape
Arc
GetGlyphIndicesW
CreateColorSpaceA
DeleteMetaFile
GetCharABCWidthsW
CreateCompatibleDC
SetDIBColorTable
EndPath
GetViewportOrgEx
AngleArc
Chord
AddFontMemResourceEx
SelectObject
GetViewportExtEx
OffsetRgn
FixBrushOrgEx
SetICMProfileW
CreatePolyPolygonRgn
OffsetWindowOrgEx
GetPaletteEntries
SetWindowOrgEx
SetBoundsRect
RectInRegion
GetDeviceCaps
RemoveFontResourceExW
SetPixelFormat
GetRgnBox
SetICMMode
GetBkMode
ColorCorrectPalette
CreateHatchBrush
EndPage
SetMiterLimit
LPtoDP
SetViewportExtEx
GetPixelFormat
CreateEllipticRgn
SetDeviceGammaRamp
GetObjectW
CreatePatternBrush
SetDIBitsToDevice
ExcludeClipRect
PolyTextOutA
AddFontResourceW
GetCharWidth32W
UpdateICMRegKeyA
DeleteColorSpace

msvcrt

_itoa
memcpy

shlwapi

PathIsRootA
PathAddExtensionA
StrRStrIA
PathCanonicalizeW
ord16
SHRegDuplicateHKey
StrStrA
StrStrNW
SHDeleteKeyW
SHRegGetBoolUSValueA
SHRegWriteUSValueW
SHReleaseThreadRef
SHRegEnumUSKeyW
PathCompactPathW
PathRemoveFileSpecA
ChrCmpIA
PathFindFileNameA
PathGetCharTypeW
PathFindExtensionW
StrCmpNA
SHEnumValueW
StrStrIW
PathMatchSpecA
StrCatBuffW
PathIsUNCServerShareA
StrTrimA
ord487
PathMatchSpecW
StrCmpNIA
PathIsDirectoryEmptyW
PathIsURLA
SHRegSetPathW
SHDeleteValueA
StrStrW
AssocQueryKeyA
PathUndecorateA
PathFindSuffixArrayW
StrCmpNW
SHAutoComplete
AssocQueryStringA
StrPBrkA
PathCommonPrefixW
SHRegCloseUSKey
ord515
StrStrIA
UrlCreateFromPathA
UrlCanonicalizeW
PathCommonPrefixA
PathFindNextComponentA
PathCompactPathExW
PathGetDriveNumberW
PathSetDlgItemPathW
SHEnumValueA
SHRegDeleteUSValueW
PathStripPathW
StrChrW
StrRetToBufW
StrToIntExA
AssocQueryStringByKeyW
StrDupW
PathRemoveArgsW
PathMakeSystemFolderW
PathMakePrettyA
PathFileExistsA
SHRegDeleteUSValueA
AssocQueryKeyW
SHGetInverseCMAP
PathMakePrettyW
SHDeleteKeyA
PathUnExpandEnvStringsA
SHRegCreateUSKeyW
AssocQueryStringByKeyA
StrCSpnW
PathSearchAndQualifyA
PathGetCharTypeA
SHRegGetUSValueA
SHEnumKeyExW
SHRegWriteUSValueA
StrToInt64ExW
StrChrIW
PathIsURLW
UrlCanonicalizeA
SHDeleteEmptyKeyA
PathFindFileNameW
StrPBrkW
StrCmpW
PathQuoteSpacesA
PathCombineW
PathIsUNCServerA
StrFormatByteSizeW
PathIsRelativeA
UrlCreateFromPathW
StrRetToBufA
PathSetDlgItemPathA
StrCatW
StrRChrA
UrlCombineW
PathParseIconLocationA
SHRegCreateUSKeyA
PathAppendW
StrCmpIW
SHQueryInfoKeyW
SHSetValueA
SHStrDupW
SHDeleteValueW
PathFindOnPathA
SHGetValueA
PathSkipRootA
PathUnmakeSystemFolderW
StrFromTimeIntervalW
PathRemoveArgsA
StrToIntExW
PathIsDirectoryA
PathIsSystemFolderW
SHCreateStreamOnFileW
UrlApplySchemeW
SHQueryInfoKeyA
PathIsNetworkPathA
StrNCatA
SHRegGetUSValueW
PathIsSameRootW
StrIsIntlEqualA
StrRChrIA
UrlEscapeA
SHRegSetPathA
PathRenameExtensionW
SHRegOpenUSKeyA
UrlGetPartA
SHRegDeleteEmptyUSKeyW
PathUnExpandEnvStringsW
StrRStrIW
PathStripToRootW
IntlStrEqWorkerA
SHRegOpenUSKeyW
StrCatBuffA
PathFindSuffixArrayA
SHSetThreadRef
SHOpenRegStream2A
SHRegGetPathW
SHQueryValueExW
PathFindOnPathW
PathCanonicalizeA
StrCmpNIW
PathAppendA
SHRegGetPathA
PathGetArgsA
PathIsUNCServerW
PathFindNextComponentW
SHCreateStreamOnFileEx
SHEnumKeyExA
PathRemoveExtensionW
StrRetToStrW
UrlApplySchemeA
UrlEscapeW
StrToIntA
PathGetDriveNumberA
SHRegEnumUSValueA
PathRemoveBlanksA
PathCompactPathExA
StrFromTimeIntervalA
PathRemoveFileSpecW
StrRetToBSTR
StrChrA
StrChrNW
SHSetValueW
SHGetValueW
PathSearchAndQualifyW
PathIsSystemFolderA
PathStripPathA
PathStripToRootA
PathFindExtensionA
SHRegQueryInfoUSKeyA
StrCmpLogicalW
PathIsDirectoryW
IntlStrEqWorkerW
StrRChrW
StrCpyNW
PathRemoveBackslashW
SHOpenRegStreamA
SHOpenRegStreamW
PathRemoveExtensionA
PathIsLFNFileSpecA
PathIsUNCServerShareW
StrCatChainW
StrRetToStrA
StrToIntW
UrlCompareA
StrCpyW
StrFormatByteSizeA
PathIsPrefixA
UrlCompareW
AssocCreate
SHOpenRegStream2W
StrSpnW
SHQueryValueExA
StrCSpnA
StrStrNIW
PathIsFileSpecW
PathUnmakeSystemFolderA
SHRegSetUSValueW
ChrCmpIW
PathIsUNCW
SHDeleteEmptyKeyW
PathAddExtensionW
StrToInt64ExA
ColorAdjustLuma
PathIsPrefixW
SHRegGetBoolUSValueW
PathIsDirectoryEmptyA
SHRegEnumUSValueW
StrCSpnIW
SHCreateShellPalette
SHRegQueryUSValueW
SHRegQueryUSValueA
StrNCatW
PathAddBackslashW
SHCopyKeyW
PathAddBackslashA
PathRemoveBackslashA
PathCreateFromUrlA
PathIsRootW
ColorHLSToRGB
PathIsFileSpecA
SHCreateStreamOnFileA
PathBuildRootA
ColorRGBToHLS
StrRChrIW
SHRegSetUSValueA
PathIsRelativeW
SHStrDupA
PathIsSameRootA
PathRemoveBlanksW
PathRelativePathToA
PathCombineA
StrCSpnIA
StrDupA
StrFormatKBSizeW
StrChrNIW
SHGetThreadRef
StrChrIA
PathBuildRootW
PathUnquoteSpacesW
SHCopyKeyA
PathCompactPathA
UrlGetLocationW
GetMenuPosFromID
StrFormatByteSize64A
PathIsNetworkPathW
PathUnquoteSpacesA
SHRegEnumUSKeyA
PathCreateFromUrlW
PathIsContentTypeA
UrlCombineA
PathQuoteSpacesW
SHRegQueryInfoUSKeyW
PathMakeSystemFolderA
HashData
PathIsUNCA
SHIsLowMemoryMachine
SHSkipJunction
StrFormatKBSizeA
PathGetArgsW
PathIsContentTypeW
StrIsIntlEqualW
AssocQueryStringW
PathUndecorateW
UrlGetLocationA
PathRelativePathToW
PathSkipRootW
PathFileExistsW
StrSpnA
PathIsLFNFileSpecW
PathRenameExtensionA
PathParseIconLocationW
StrTrimW
SHRegDeleteEmptyUSKeyA

kernel32

EnumResourceLanguagesW
LocalReAlloc
EndUpdateResourceW
SetUnhandledExceptionFilter
EnumCalendarInfoW
EnumDateFormatsA
GetUserDefaultLangID
MultiByteToWideChar
EnumUILanguagesA
GetThreadLocale
FreeUserPhysicalPages
FlushInstructionCache
FindNextFileA
GetSystemPowerStatus
CreateFileMappingW
SetFilePointerEx
IsBadWritePtr
TryEnterCriticalSection
BuildCommDCBA
WaitForMultipleObjects
FindVolumeClose
AllocConsole
GetPrivateProfileSectionA
CallNamedPipeW
GetConsoleTitleA
GetTempPathW
OpenFileMappingA
UpdateResourceW
AreFileApisANSI
InterlockedCompareExchange
GetPrivateProfileSectionNamesW
GlobalReAlloc
SetLocaleInfoA
GetProfileStringW
OpenJobObjectA
GetStringTypeW
UnhandledExceptionFilter
GetDevicePowerState
GlobalAddAtomA
WaitForSingleObject
EnumDateFormatsExA
GetFileAttributesExW
SetCommConfig
FindNextVolumeA
GetFullPathNameW
DuplicateHandle
SetProcessPriorityBoost
LoadResource
SetFileAttributesW
VirtualFree
SetThreadPriorityBoost
BackupWrite
SetDefaultCommConfigA
SetTimerQueueTimer
lstrcmpW
GetSystemInfo
SetComputerNameW
lstrlenW
InitAtomTable
LocalShrink
GetWriteWatch
GetDefaultCommConfigA
GetThreadTimes
FillConsoleOutputCharacterW
BackupSeek
FindResourceA
LockFile
SetProcessAffinityMask
SetThreadIdealProcessor
WriteConsoleOutputCharacterA
DefineDosDeviceW
LocalUnlock
GetDiskFreeSpaceA
MoveFileWithProgressA
GetCommModemStatus
GetWindowsDirectoryW
TlsFree
SetConsoleWindowInfo
SetComputerNameExA
WritePrivateProfileSectionW
GlobalDeleteAtom
InterlockedDecrement
GetCommandLineA
VerLanguageNameW
FreeConsole
HeapSetInformation
SetFilePointer
LocalLock
RequestDeviceWakeup
VirtualLock
GetFileType
GetConsoleFontSize
GetVolumeNameForVolumeMountPointW
RemoveDirectoryA
ReleaseSemaphore
DeleteAtom
SuspendThread
WaitForDebugEvent
FreeLibrary
ReadConsoleOutputCharacterA
CancelIo
GlobalFlags
HeapWalk
ReadConsoleOutputW
GetProcessPriorityBoost
UnregisterWait
CreateConsoleScreenBuffer
FlushFileBuffers
OpenMutexW
PurgeComm
WaitCommEvent
WriteConsoleW
ReplaceFileW
GetLocalTime
GetProfileStringA
SetThreadExecutionState
EndUpdateResourceA
OpenSemaphoreA
IsValidLanguageGroup
GetComputerNameExW
GetNumberFormatW
EnumResourceLanguagesA
VirtualAlloc
ReadFileEx
IsProcessorFeaturePresent
ReadFile
GetOEMCP
GlobalAlloc
SetNamedPipeHandleState
CreateRemoteThread
BuildCommDCBAndTimeoutsA
IsSystemResumeAutomatic
GetCurrencyFormatW
SetVolumeLabelW
GetEnvironmentVariableW
GetProfileSectionW
FreeLibraryAndExitThread
HeapCreate
GetExitCodeProcess
GetTapeParameters
FreeResource
WriteFile
FindFirstVolumeW
BeginUpdateResourceA
DebugActiveProcess
GlobalCompact
SetThreadLocale
IsValidLocale
TransmitCommChar
RegisterWaitForSingleObject
_hwrite
WriteConsoleOutputCharacterW
GetCurrentThread
EnumDateFormatsExW
LoadLibraryA
CreateNamedPipeA
SetFileApisToANSI
VirtualQueryEx
Sleep
InitializeCriticalSection
GetStartupInfoW
GlobalFix
CancelTimerQueueTimer
WriteTapemark
ExitProcess
GetProcessTimes
WriteProfileSectionW
SetConsoleMode
HeapAlloc
PeekNamedPipe
CreateHardLinkA
GetHandleInformation
ReadConsoleW
FlushConsoleInputBuffer
PostQueuedCompletionStatus
GetOverlappedResult
WritePrivateProfileStringW
GetTimeFormatW
SetCurrentDirectoryW
SystemTimeToFileTime
OpenFileMappingW
GetProcessShutdownParameters
PeekConsoleInputW
GetComputerNameA
GetThreadPriorityBoost
VirtualUnlock
SetWaitableTimer
QueryInformationJobObject
SleepEx
WriteConsoleOutputAttribute
GlobalFree
ResumeThread
SetupComm
WideCharToMultiByte
FoldStringW
GetACP
BuildCommDCBW
GetCompressedFileSizeA
DisableThreadLibraryCalls
GetVersion
HeapValidate
LocalHandle
CreateFileW
GetEnvironmentStringsW
CreateTapePartition
CopyFileW
DebugBreak
ReadConsoleInputW
WriteConsoleOutputA
CreateMailslotA
GetQueuedCompletionStatus
CreateFileA
GetSystemDirectoryW
GetCurrentConsoleFont
FormatMessageA
WriteConsoleOutputW
FindNextVolumeMountPointA
GenerateConsoleCtrlEvent
GetModuleFileNameA
FindFirstVolumeMountPointA
GetCurrentDirectoryA
SetConsoleTextAttribute
_lopen
GetCommState
EnumResourceNamesA
SetConsoleTitleW
QueryPerformanceCounter
GetTapePosition
CompareStringA
CreateNamedPipeW
GetStringTypeExA
CreateDirectoryA
FoldStringA
GetConsoleOutputCP
EnumSystemLocalesA
GlobalFindAtomA
ReleaseMutex
CreateHardLinkW
TlsGetValue
TlsAlloc
GetWindowsDirectoryA
LCMapStringW
OutputDebugStringA
GetDateFormatA
FillConsoleOutputCharacterA
GetCurrentDirectoryW
GetVolumePathNameA
CreateFiber
EraseTape
WaitNamedPipeW
ScrollConsoleScreenBufferA
WriteProfileSectionA
QueueUserWorkItem
GetStartupInfoA
SetTimeZoneInformation
CompareFileTime
GetTempPathA
QueryDosDeviceW
EnumSystemCodePagesA
SetVolumeLabelA
PrepareTape
SystemTimeToTzSpecificLocalTime
GetVolumeInformationW
CreatePipe
CopyFileA
GetFileAttributesA
SetConsoleScreenBufferSize
ContinueDebugEvent
WaitForMultipleObjectsEx
EnumCalendarInfoExW
GlobalSize
FindNextVolumeW
CreateEventA
WritePrivateProfileSectionA
QueueUserAPC
BindIoCompletionCallback
GetLocaleInfoW
FindNextVolumeMountPointW
ReadProcessMemory
GetLogicalDriveStringsW
GetProcessWorkingSetSize
GetLogicalDriveStringsA
CreateWaitableTimerA
SetErrorMode
RequestWakeupLatency
ChangeTimerQueueTimer
ReadConsoleA
ConvertDefaultLocale
CallNamedPipeA
VirtualFreeEx
TerminateProcess
BackupRead
LoadLibraryExA
SetMailslotInfo
CreateDirectoryExW
LCMapStringA
OpenFile
GlobalWire
SetLocalTime
GetCurrencyFormatA
BeginUpdateResourceW
SetComputerNameA
CreateFileMappingA
EscapeCommFunction
OpenWaitableTimerA
VirtualQuery
CommConfigDialogA
UnlockFile
_hread
WriteProcessMemory
SetCommState
GetLargestConsoleWindowSize
SetSystemPowerState
SetDefaultCommConfigW
GetSystemDirectoryA
EnumUILanguagesW
GetBinaryTypeW
CancelWaitableTimer
CreateJobObjectA
GetExitCodeThread
LoadLibraryW
GetTempFileNameW
SetProcessShutdownParameters
GetCurrentProcess
GetPrivateProfileStructA
GetCommConfig
SetFileTime
WriteFileGather
CreateThread
IsDebuggerPresent
DnsHostnameToComputerNameW
MapViewOfFile
InterlockedExchange
CreateProcessW
GetVersionExW
GetDiskFreeSpaceExW
SetTapePosition
HeapCompact
FindFirstVolumeMountPointW
UnmapViewOfFile
GetNumberOfConsoleInputEvents
OpenSemaphoreW
CopyFileExA
SetEvent
DosDateTimeToFileTime
lstrcmpA
ReadConsoleOutputA
FindResourceW
CreateSemaphoreW
SetLocaleInfoW
PulseEvent
FileTimeToSystemTime
GetSystemDefaultLCID
FatalExit
GetThreadContext
FormatMessageW
VirtualAllocEx
CreateIoCompletionPort
SetCommBreak
GetCPInfoExW
LocalFlags
ResetWriteWatch
FindFirstChangeNotificationA
GetFileSize
LocalCompact
TerminateThread
ConnectNamedPipe
CreateMutexW
IsBadCodePtr
EnumResourceTypesA
OpenWaitableTimerW
GetSystemDefaultUILanguage
CreateFiberEx
TerminateJobObject
OpenProcess
EnumSystemLanguageGroupsA
GetProfileSectionA
ExpandEnvironmentStringsW
GetDriveTypeW
SetConsoleCtrlHandler
HeapUnlock
FindNextChangeNotification
GetVolumePathNameW
FindResourceExW
GetNumberOfConsoleMouseButtons
GetThreadSelectorEntry
lstrcpynW
RemoveDirectoryW
EnumCalendarInfoExA
HeapLock
GetFileSizeEx
GetEnvironmentStrings
GlobalLock
EnumDateFormatsW
UnregisterWaitEx
GetFullPathNameA
CreateEventW
GetFileAttributesW
FindCloseChangeNotification
LeaveCriticalSection
VerifyVersionInfoW
SetFileAttributesA
GetTimeFormatA
GetCPInfo
GetProcessAffinityMask
HeapDestroy
EnumCalendarInfoA
CancelDeviceWakeupRequest
SetCommMask
SetSystemTimeAdjustment
SetVolumeMountPointA
FindFirstVolumeA
TlsSetValue
GetSystemTimeAdjustment
lstrcatW
WriteConsoleInputW
FindAtomA
SetVolumeMountPointW
GetModuleFileNameW
lstrcpynA
GetCommTimeouts
SizeofResource
MapViewOfFileEx
GetConsoleTitleW
OutputDebugStringW
_lcreat
GetTimeZoneInformation
FindClose
GetModuleHandleW
FindFirstFileW
GetEnvironmentVariableA
OpenEventW
GetConsoleMode
CopyFileExW
lstrcpyW
SetEndOfFile
GetDefaultCommConfigW
GetFileTime
GetPrivateProfileSectionW
FindAtomW
CreateMutexA
SetCalendarInfoW
SetHandleCount
SwitchToThread
GetDiskFreeSpaceW
GetProcessHeaps
GetFileAttributesExA
GetCommandLineW
GetConsoleDisplayMode
LoadModule
GetVolumeNameForVolumeMountPointA
FindFirstFileExA
PeekConsoleInputA
GetComputerNameW
DefineDosDeviceA
UnlockFileEx
ReadConsoleOutputCharacterW
SearchPathA
lstrcmpiW
CreateDirectoryExA
GetStringTypeExW
OpenThread
GlobalUnlock
MoveFileExA
IsBadHugeWritePtr
HeapQueryInformation
SetTapeParameters
GetUserDefaultLCID
GetProcessHeap
LocalAlloc
GetLogicalDrives
GetFileInformationByHandle
GetDiskFreeSpaceExA
SetProcessWorkingSetSize
GetCPInfoExA
FillConsoleOutputAttribute
GetVolumeInformationA
SetThreadPriority
GlobalHandle
LockResource
GetPrivateProfileIntW
GlobalMemoryStatus
CreateDirectoryW
GetCalendarInfoW
CreateProcessA
DeleteTimerQueue
EnumLanguageGroupLocalesA
UpdateResourceA
IsDBCSLeadByte
GetAtomNameA
ScrollConsoleScreenBufferW
MulDiv
LocalFileTimeToFileTime
DeleteTimerQueueEx
SetConsoleActiveScreenBuffer
QueryPerformanceFrequency
CreateJobObjectW
GetBinaryTypeA
GetLongPathNameA
GetProcAddress

Sections

.text
Size: 174KB - Virtual size: 173KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.crt1
Size: 512B - Virtual size: 10B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.qdata
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ATNT+.
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

nwNymn,
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

P._O-6
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crt0
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

1 HI
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

2b235885ef9cdfb92d35484a81bec10f

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0d:0d:fc:c3:6d:de:fd:25:1d:c2:41:dd:75:cc:01:0aCertificate

Extended Key Usages

Key Usages

62:83:f1:91:60:90:94:98:d5:2a:e6:dd:df:7f:14:61:18:0e:f3:69Signer

Headers

File Characteristics

Imports

user32

comdlg32

advapi32

comctl32

gdi32

msvcrt

shlwapi

kernel32

Sections

.text Size: 174KB - Virtual size: 173KB

.crt1 Size: 512B - Virtual size: 10B

.qdata Size: 46KB - Virtual size: 46KB

.data Size: 11KB - Virtual size: 13KB

ATNT+. Size: 5KB - Virtual size: 4KB

nwNymn, Size: 6KB - Virtual size: 5KB

P._O-6 Size: 46KB - Virtual size: 46KB

.crt0 Size: 7KB - Virtual size: 6KB

DATA Size: 8KB - Virtual size: 7KB

1 HI Size: 14KB - Virtual size: 13KB

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0d:0d:fc:c3:6d:de:fd:25:1d:c2:41:dd:75:cc:01:0a
Certificate

62:83:f1:91:60:90:94:98:d5:2a:e6:dd:df:7f:14:61:18:0e:f3:69
Signer

.text
Size: 174KB - Virtual size: 173KB

.crt1
Size: 512B - Virtual size: 10B

.qdata
Size: 46KB - Virtual size: 46KB

.data
Size: 11KB - Virtual size: 13KB

ATNT+.
Size: 5KB - Virtual size: 4KB

nwNymn,
Size: 6KB - Virtual size: 5KB

P._O-6
Size: 46KB - Virtual size: 46KB

.crt0
Size: 7KB - Virtual size: 6KB

DATA
Size: 8KB - Virtual size: 7KB

1 HI
Size: 14KB - Virtual size: 13KB