27a90009f1017cb627bfed1530d1470b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

27a90009f1017cb627bfed1530d1470b_JaffaCakes118
Size

5.0MB
MD5

27a90009f1017cb627bfed1530d1470b
SHA1

c72f7345ba460bba496c4698c65a47b8a69c7454
SHA256

69b9d7264d7ed07a0085d12c644d6f84f2ac3f1c9c86471e1f2aa095f3d9e53f
SHA512

da0878b166d29385963039740a5db66c6fe6e57ceac4255076fbffb38832bcd1c03741bcd7057b625b7b7b58925a279e9a6f3dfd9aa301913b051bd1c71b2e1d
SSDEEP

98304:alUePtPMMT5/N2GIam4VfBJAvwUR69drunZIVVQIMRzAl3sSM7Y/oM:ckwadiZei9driEVIR8lZM0/oM

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect
static1/unpack001/chm.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack001/chm.dll	upx

Unsigned PE 19 IoCs

Checks for missing Authenticode signature.

resource
27a90009f1017cb627bfed1530d1470b_JaffaCakes118
unpack001/$PLUGINSDIR/DcryptDll.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/locate.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/xml.dll
unpack001/Hha.dll
unpack001/Itcc.dll
unpack001/chm.dll
unpack003/out.upx
unpack001/dhtmled.ocx
unpack001/triedit.dll
unpack001/uninst.exe
unpack001/winchm.chs
unpack001/winchm.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

27a90009f1017cb627bfed1530d1470b_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/DcryptDll.dll
.dll windows:4 windows x86 arch:x86

5e1d3f49e5b7590e18325930cd3084f1

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
CreateFileA
lstrlenA
DeleteFileA
WriteFile
ReadFile
lstrcmpA
CloseHandle
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc

Exports

Exports

Decrypt
HexDecoder
HexEncoder
LoadStr
MD5Hash

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 470B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 730B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/locate.dll
.dll windows:4 windows x86 arch:x86

7f8181c74f882a780c7cd485241e8b51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
MultiByteToWideChar
lstrlenW
lstrlenA
GetWindowsDirectoryW
WideCharToMultiByte
CompareFileTime
FindNextFileA
FindNextFileW
FileTimeToSystemTime
RemoveDirectoryA
RemoveDirectoryW
FindFirstFileA
FindFirstFileW
FindClose
SystemTimeToFileTime
FileTimeToLocalFileTime

user32

SetWindowTextA
SetWindowTextW
GetDlgItem
FindWindowExA
MessageBoxW

Exports

Exports

_Close
_Find
_GetSize
_Open
_RMDirEmpty
_Unload

Sections

.text
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

d83f71e61ee459ee63ca3e829966a9dc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
lstrcpyA
lstrcpynA
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
PeekNamedPipe
GetTickCount
CreateProcessA
GetStartupInfoA
CreatePipe
GetVersionExA
GetModuleHandleA
DeleteFileA
lstrcmpiA
lstrlenA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
GetProcAddress
GlobalLock
GetCurrentProcess

user32

SendMessageA
OemToCharBuffA
CharNextA
wsprintfA
CharPrevA
FindWindowExA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 410B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsRandom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetRandom

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/xml.dll
.dll windows:4 windows x86 arch:x86

b5ed5b3a951d4443ce56e5453702d536

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpynA
lstrcmpA
lstrcmpiA
lstrcpyA
RtlUnwind
GetModuleFileNameA
RaiseException
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
HeapReAlloc
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
GetLastError
LoadLibraryA
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
CloseHandle
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
SetUnhandledExceptionFilter
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
CreateFileA
VirtualProtect
GetSystemInfo
VirtualQuery
SetStdHandle
GetLocaleInfoA
InterlockedExchange
SetEndOfFile

Exports

Exports

_CloneNode
_Coordinate
_CreateNode
_CreateText
_CurrentAttribute
_DeclarationEncoding
_DeclarationStandalone
_DeclarationVersion
_ElementPath
_FindCloseElement
_FindNextElement
_FirstAttribute
_FirstChild
_FirstChildElement
_FreeNode
_GetAttribute
_GetNodeValue
_GetText
_GotoHandle
_GotoPath
_InsertAfterNode
_InsertBeforeNode
_InsertEndChild
_IsCDATA
_LastAttribute
_LastChild
_LoadFile
_NextAttribute
_NextSibling
_NextSiblingElement
_NoChildren
_NodeHandle
_NodeType
_Parent
_PreviousAttribute
_PreviousSibling
_RemoveAllChild
_RemoveAttribute
_RemoveNode
_ReplaceNode
_RootElement
_SaveFile
_SetAttribute
_SetAttributeName
_SetAttributeValue
_SetCDATA
_SetCondenseWhiteSpace
_SetEncoding
_SetNodeValue
_SetText
_Unload
_XPathAttribute
_XPathNode
_XPathString

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/key.lky
Dictionaries/american.adm
Dictionaries/british.adm
Dictionaries/french.adm
Dictionaries/german-gt3.adm
Dictionaries/spanish.adm
Hha.dll
.dll windows:4 windows x86 arch:x86

969d3807d966bc686a2e4719c377ca96

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

HeapAlloc
HeapFree
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
ExitProcess
RaiseException
GetCurrentThreadId
GetCurrentProcess
GetLocalTime
GetCommandLineA
HeapCreate
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
SetUnhandledExceptionFilter
GetModuleHandleA
SetHandleCount
GetFileType
GetStdHandle
GetTimeZoneInformation
GetSystemTime
TlsSetValue
GetACP
GetOEMCP
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsBadWritePtr
IsBadCodePtr
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle
GetLocaleInfoW
CompareStringW
SetEnvironmentVariableA
GetPrivateProfileStringA
_lread
GlobalHandle
GlobalLock
GlobalFree
FreeLibrary
GlobalMemoryStatus
GetCurrentProcessId
SetEndOfFile
GetWindowsDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
lstrcmpiA
LCMapStringA
VirtualAlloc
VirtualFree
ExitThread
WaitForSingleObject
Sleep
SetFilePointer
CreateSemaphoreA
CreateThread
ReleaseSemaphore
WriteFile
LocalAlloc
CreateDirectoryA
GetFileAttributesA
GetModuleFileNameA
GetSystemDefaultLangID
SetCurrentDirectoryA
lstrlenA
MulDiv
GetLastError
FormatMessageA
LocalFree
GetVolumeInformationA
OpenFile
_lwrite
_lclose
GetUserDefaultLCID
FatalAppExitA
GetVersion
IsDBCSLeadByte
CompareStringA
ReadFile
CloseHandle
CreateFileA
LoadLibraryA
GetProcAddress
GetLocaleInfoA
WritePrivateProfileStringA
IsBadReadPtr
lstrcatA
lstrcpyA
GetFileSize
GetTempPathA
GetTempFileNameA
DeleteFileA
GetSystemTimeAsFileTime
LocalReAlloc
FindNextFileA
FindFirstFileA
FindClose
InterlockedDecrement
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DisableThreadLibraryCalls
GetVersionExA
SearchPathA
SetLastError
_llseek
_lopen
MultiByteToWideChar
WideCharToMultiByte
lstrcpynA
lstrlenW
CreateFileMappingA
MapViewOfFile
GetTickCount
DebugBreak
GetSystemDirectoryA
GlobalAlloc
GetStartupInfoA
FlushFileBuffers
GetCPInfo

user32

BeginPaint
DeleteMenu
GetMenuItemID
InsertMenuA
DefWindowProcA
IsIconic
RegisterClassA
SetRect
CharUpperA
FillRect
WinHelpA
EnableWindow
CreateWindowExA
OffsetRect
CharPrevA
SetWindowPos
LoadCursorA
SetCursor
LoadStringA
MessageBoxA
CharLowerA
CharNextA
GetSysColor
EndPaint
GetDlgItemInt
LoadBitmapA
GetClientRect
GetParent
SetDlgItemInt
UnhookWindowsHookEx
ClientToScreen
SetTimer
GetCursorPos
ScreenToClient
CallWindowProcA
GetClassNameA
CreateDialogParamA
ShowWindow
SendDlgItemMessageA
wsprintfA
SetFocus
SetWindowTextA
GetWindowTextLengthA
GetWindowTextA
GetWindowLongA
PostMessageA
EndDialog
SetWindowLongA
GetDC
ReleaseDC
GetDlgItem
GetSystemMetrics
InvalidateRect
CallNextHookEx
GetDesktopWindow
GetWindowRect
SystemParametersInfoA
MoveWindow
DialogBoxParamA
IsWindow
DestroyWindow
SendMessageA
EnumChildWindows
SetWindowsHookExA
FindWindowA
wvsprintfA
GetWindowPlacement
KillTimer
ReleaseCapture
SetCapture
PtInRect

gdi32

SelectClipRgn
PatBlt
GetTextMetricsA
GetDeviceCaps
CreateFontA
DeleteObject
GetObjectA
GetTextExtentPointA
ExtTextOutA
SetBkColor
SetTextColor
BitBlt
CreateFontIndirectA
SetMapMode
CreateCompatibleDC
CreateDCA
CreateICA
DeleteDC
SelectPalette
RealizePalette
CreatePen
CreateSolidBrush
CreateCompatibleBitmap
CreatePalette
GetDIBits
StretchDIBits
CreateDIBSection
GetPaletteEntries
CreateHalftonePalette
RestoreDC
PlayMetaFile
SetBkMode
SetViewportExtEx
SetViewportOrgEx
SaveDC
DeleteMetaFile
SetMetaFileBitsEx
CreateRectRgnIndirect
SelectObject
CreateBitmap
CreatePatternBrush

advapi32

RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyA

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

comdlg32

GetOpenFileNameA

comctl32

ord15
ord14
CreatePropertySheetPageA
PropertySheetA

version

VerQueryValueA
GetFileVersionInfoA

ole32

CoGetClassObject
CoCreateInstance

Exports

Exports

?LoadJpeg@@YG?AW4FSERR@@PBDPAUIMAGE@@@Z
EditHhCtrlObject
EditHhCtrlScript
FreeFilterDIB
HHA_CompileHHP
LoadFilterImage

Sections

.text
Size: 391KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Itcc.dll
.dll regsvr32 windows:5 windows x86 arch:x86

8fc17f38bab8bbc866f938baa2ab7c7a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

GetTempPathA
WriteFile
GetTempFileNameA
CreateFileA
DeleteFileA
UnmapViewOfFile
GlobalAlloc
HeapDestroy
GlobalFree
lstrcatA
CloseHandle
lstrcpyA
GetLastError
GetCurrentProcess
GetModuleHandleA
lstrcmpiA
GetModuleFileNameA
EnterCriticalSection
GetCurrentThreadId
lstrlenA
LeaveCriticalSection
lstrlenW
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
InterlockedIncrement
DeleteCriticalSection
DisableThreadLibraryCalls
GetACP
GetOEMCP
TlsAlloc
TlsFree
GlobalFlags
GlobalLock
GlobalUnlock
GetFileSize
IsBadWritePtr
GlobalHandle
lstrcpynA
GetWindowsDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
OpenFile
ReadFile
GetStartupInfoA
GetCPInfo
SetFilePointer
SetStdHandle
GetLocaleInfoW
FlushFileBuffers
GetLocaleInfoA
GetStringTypeW
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
TlsSetValue
CreateFileMappingA
GlobalReAlloc
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeA
VirtualFree
MapViewOfFile
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapCreate
GetProcAddress
VirtualAlloc
LoadLibraryA
LCMapStringA
LCMapStringW

user32

LoadStringA
CharNextA
wsprintfA
GetActiveWindow
GetWindowLongA
CharUpperA

advapi32

RegEnumKeyExA
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA

ole32

CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoGetClassObject
CLSIDFromProgID

oleaut32

LoadTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Language.dat
charset.dat
chm.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

CompileHHP

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dhtmled.ocx
.dll regsvr32 windows:5 windows x86 arch:x86

be4799fbff678b16a75936a2fcc2d4ba

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_wcsnicmp
wcscpy
wcschr
wcscmp
malloc
_itow
_wcsicmp
vswprintf
_itoa
wcslen
wcsncpy
_wcslwr
wcsncmp
free
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
wcscat
wcstok
_wcsrev
realloc
_initterm
_adjust_fdiv

urlmon

URLOpenBlockingStreamW
URLOpenBlockingStreamA
CoInternetCreateSecurityManager
CreateURLMoniker
CoInternetCombineUrl
CoInternetParseUrl
CoInternetGetSession

wininet

InternetOpenA
InternetReadFile
InternetOpenW
InternetOpenUrlA
InternetOpenUrlW
InternetCreateUrlA
InternetCreateUrlW
InternetCrackUrlA
InternetCrackUrlW
DeleteUrlCacheEntryA
DeleteUrlCacheEntryW
InternetCloseHandle

oleaut32

VariantInit
SysAllocString
SysFreeString
SafeArrayCopy
VariantClear
SafeArrayDestroy
SafeArrayPutElement
VariantChangeType
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreateVector
SysStringLen
SysReAllocString
DispGetParam
SysAllocStringLen
VariantCopy
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
VarI4FromStr
SafeArrayGetElement
SafeArrayCreate
VariantCopyInd
OleCreatePropertyFrame

ole32

OleSaveToStream
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CoCreateInstance
CoTaskMemFree
GetHGlobalFromStream
OleRun
CreateBindCtx
ReleaseStgMedium
CreateOleAdviseHolder
OleRegEnumVerbs
WriteClassStm
CreateStreamOnHGlobal
OleLoadFromStream
CoTaskMemRealloc
CoTaskMemAlloc

kernel32

DisableThreadLibraryCalls
HeapFree
GetProcessHeap
GetLastError
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
HeapAlloc
CloseHandle
HeapDestroy
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
SizeofResource
LoadResource
GetFileSize
WriteFile
GlobalFree
ReadFile
GetVersionExA
lstrcmpiA
CreateFileA
CreateFileW
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
lstrcmpiW
lstrcpynW
IsBadWritePtr
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection

gdi32

CreateMetaFileW
CreateMetaFileA
CreateDCW
CreateDCA
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
GetDeviceCaps
CreateRectRgnIndirect
GetStockObject
Rectangle

user32

SetWindowLongW
wvsprintfW
CharNextW
PtInRect
UnionRect
ShowWindow
DestroyWindow
FillRect
DestroyMenu
TrackPopupMenu
CreatePopupMenu
ScreenToClient
IsWindow
GetClientRect
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetParent
GetClassInfoExW
SetFocus
InvalidateRect
SetParent
GetKeyState
GetFocus
AppendMenuA
AppendMenuW
CallWindowProcA
CallWindowProcW
CreateWindowExA
CreateWindowExW
DefWindowProcA
DefWindowProcW
GetWindowLongA
GetWindowLongW
LoadCursorA
LoadCursorW
PostMessageA
PostMessageW
RegisterClassExA
RegisterClassExW
SetWindowLongA

comdlg32

GetSaveFileNameA
GetOpenFileNameW
GetOpenFileNameA
GetSaveFileNameW

advapi32

RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
install.cmd
options.ini
sample/Add new topics in to Table of Contents.htm
.html
sample/CHM files cannot work.htm
.html
sample/Command-line execution.htm
.html
sample/Create PDF files with Word 2007.htm
.html
sample/How create an Index.htm
.html
sample/How to add existing html files to an existing project.htm
.html
sample/How to change the interface of chm.htm
.html
sample/How to change the order of topics.htm
.html
sample/How to create a new project.htm
sample/How to get Adobe PDF files.htm
.html
sample/How to get Microsoft Word Documents.htm
.html
sample/How to launch a CHM file.htm
.html
sample/How to launch a chm file with a specified topic.htm
.html
sample/How to use templates.htm
sample/Introduction.htm
sample/Key features.htm
sample/Other softwares.htm
.html
sample/Register.htm
.html
sample/Spell checker.htm
.html
sample/Use Word as HTML editor.htm
.html
sample/Welcome.htm
.html
sample/ieprint.png
.png
sample/images/1.PNG
.png
sample/images/2.PNG
.png
sample/images/3.PNG
.png
sample/images/4.PNG
.png
sample/images/ActionCanceled.png
.png
sample/images/abbbb.bmp
sample/images/add.gif
sample/images/addexisting.gif
.gif
sample/images/addnewtopics.gif
.gif
sample/images/addnewtopics2.gif
.gif
sample/images/addprebuilttemplate.gif
.gif
sample/images/cover.gif
sample/images/keywords.gif
sample/images/keywords2.gif
sample/images/moveitem.gif
.gif
sample/images/moveitem2.gif
.gif
sample/images/moveitemchild.gif
.gif
sample/images/moveitemchild2.gif
.gif
sample/images/new.gif
sample/images/newproject.gif
sample/images/register.gif
sample/images/save.gif
sample/images/save2.gif
sample/images/selecthtmlfiles.gif
sample/images/temp1.bmp
sample/images/temp3.bmp
sample/images/visualdesigner.gif
sample/pdf.gif
.gif
sample/sample.wcp
sample/saveashtml.gif
sample/temp2.bmp
sample/template/btn_next_g.gif
.gif
sample/template/btn_next_n.gif
.gif
sample/template/btn_prev_g.gif
.gif
sample/template/btn_prev_n.gif
.gif
sample/template/fixedtop.htm
sample/template/winchm_template_style.css
sample/template1/btn_next_n.gif
.gif
sample/template1/btn_prev_n.gif
.gif
sample/template1/standard.htm
sample/template2/btn_next_n.gif
.gif
sample/template2/btn_prev_n.gif
.gif
sample/template2/hgrad.gif
.gif
sample/template2/logo.gif
.gif
sample/template2/main.gif
.gif
sample/template2/msn.htm
.html
sample/word.gif
templates/Snap1.bmp
templates/fixedtop.bmp
templates/fixedtop/btn_next_g.gif
.gif
templates/fixedtop/btn_next_n.gif
.gif
templates/fixedtop/btn_prev_g.gif
.gif
templates/fixedtop/btn_prev_n.gif
.gif
templates/fixedtop/fixedtop.htm
.html
templates/fixedtop/winchm_template_style.css
templates/msn.bmp
templates/msn/btn_next_n.gif
.gif
templates/msn/btn_prev_n.gif
.gif
templates/msn/hgrad.gif
.gif
templates/msn/logo.gif
.gif
templates/msn/msn.htm
.html
templates/simplest.bmp
templates/simplest/simplest.htm
.html
templates/standard.bmp
templates/standard/btn_next_n.gif
.gif
templates/standard/btn_prev_n.gif
.gif
templates/standard/standard.htm
.html
templates/templates.ini
triedit.dll
.dll regsvr32 windows:5 windows x86 arch:x86

98eb5070fc378af00ff27c9c1be1b370

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

triedit.pdb

Imports

msvcrt

_wcsrev
wcslen
_wcsnicmp
??2@YAPAXI@Z
wcsstr
wcstok
iswspace
_wcslwr
wcschr
wcspbrk
wcsrchr
memmove
wcsncpy
wcscpy
_itow
iswupper
_wcsupr
wcsncmp
_adjust_fdiv
_initterm
qsort
??3@YAXPAX@Z
free
realloc
malloc
wcstoul
wcscat
iswdigit
_wcsicmp
time
srand
rand
_wtoi
_purecall

oleaut32

VariantClear
VariantChangeTypeEx
VariantInit
VariantCopy
SysAllocString
SysFreeString
SysStringLen
SysAllocStringLen
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantChangeType
LoadRegTypeLi
SetErrorInfo
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
VarI4FromStr

ole32

CoTaskMemRealloc
CoTaskMemAlloc
OleRegGetUserType
StringFromCLSID
CoTaskMemFree
CreateStreamOnHGlobal
GetHGlobalFromStream
CoCreateInstance

kernel32

GetCurrentProcess
HeapDestroy
DisableThreadLibraryCalls
FreeLibrary
SizeofResource
LoadResource
GetVersionExA
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryExA
LoadLibraryExW
lstrcmpiA
lstrcmpiW
lstrcmpA
lstrcmpW
lstrcpynW
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
GlobalSize
GetLastError
MultiByteToWideChar
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
GlobalFree
SetLastError

gdi32

CreatePatternBrush
DeleteObject
SelectObject
SetWindowOrgEx
PatBlt

user32

SetRect
InvalidateRect
InflateRect
SetCursor
GetKeyState
ReleaseDC
GetDC
PtInRect
GetClientRect
ScreenToClient
SetFocus
IsWindow
GetParent
GetWindowLongA
GetWindowLongW
IsCharAlphaNumericA
IsCharAlphaNumericW
IsCharAlphaA
IsCharAlphaW
LoadBitmapA
LoadBitmapW
LoadCursorA
LoadCursorW
LoadStringA
LoadStringW
CharNextW

advapi32

RegEnumKeyExW
RegEnumKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExW
RegSetValueExA
RegQueryInfoKeyW
RegQueryInfoKeyA
RegOpenKeyExW
RegOpenKeyExA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
webhelp/bg/back1.jpg
.jpg
webhelp/bg/back2.jpg
.jpg
webhelp/bg/back3.jpg
.jpg
webhelp/bg/back4.jpg
.jpg
webhelp/bg/back5.jpg
.jpg
webhelp/bg/back6.jpg
.jpg
webhelp/bg/back7.jpg
.jpg
webhelp/bg/back8.jpg
.jpg
webhelp/bg/back9.jpg
.jpg
webhelp/icons/1.gif
.gif
webhelp/icons/10.gif
.gif
webhelp/icons/11.gif
.gif
webhelp/icons/12.gif
.gif
webhelp/icons/13.gif
.gif
webhelp/icons/14.gif
.gif
webhelp/icons/15.gif
.gif
webhelp/icons/16.gif
.gif
webhelp/icons/17.gif
.gif
webhelp/icons/18.gif
.gif
webhelp/icons/19.gif
.gif
webhelp/icons/2.gif
.gif
webhelp/icons/20.gif
.gif
webhelp/icons/21.gif
.gif
webhelp/icons/22.gif
.gif
webhelp/icons/23.gif
.gif
webhelp/icons/24.gif
.gif
webhelp/icons/25.gif
.gif
webhelp/icons/26.gif
.gif
webhelp/icons/27.gif
.gif
webhelp/icons/28.gif
.gif
webhelp/icons/29.gif
.gif
webhelp/icons/3.gif
.gif
webhelp/icons/30.gif
.gif
webhelp/icons/31.gif
.gif
webhelp/icons/32.gif
.gif
webhelp/icons/33.gif
.gif
webhelp/icons/34.gif
.gif
webhelp/icons/35.gif
.gif
webhelp/icons/36.gif
.gif
webhelp/icons/37.gif
.gif
webhelp/icons/38.gif
.gif
webhelp/icons/39.gif
.gif
webhelp/icons/4.gif
.gif
webhelp/icons/40.gif
.gif
webhelp/icons/41.gif
.gif
webhelp/icons/42.gif
.gif
webhelp/icons/5.gif
.gif
webhelp/icons/6.gif
.gif
webhelp/icons/7.gif
.gif
webhelp/icons/8.gif
.gif
webhelp/icons/9.gif
.gif
webhelp/images/hideall.gif
.gif
webhelp/images/next.gif
.gif
webhelp/images/previous.gif
.gif
webhelp/images/print.gif
.gif
webhelp/images/showall.gif
.gif
webhelp/imgs/arrowdn.gif
.gif
webhelp/imgs/arrowrt.gif
.gif
webhelp/imgs/blank.gif
.gif
webhelp/imgs/cminus.gif
.gif
webhelp/imgs/cplus.gif
.gif
webhelp/imgs/daminus.gif
.gif
webhelp/imgs/daplus.gif
.gif
webhelp/imgs/downangle.gif
.gif
webhelp/imgs/line.gif
.gif
webhelp/imgs/minus.gif
.gif
webhelp/imgs/plus.gif
.gif
webhelp/imgs/sline.gif
.gif
webhelp/imgs/sminus.gif
.gif
webhelp/imgs/splus.gif
.gif
webhelp/imgs/tminus.gif
.gif
webhelp/imgs/tplus.gif
.gif
webhelp/imgs/tshaped.gif
.gif
webhelp/imgs/uaminus.gif
.gif
webhelp/imgs/uaplus.gif
.gif
webhelp/imgs/upangle.gif
.gif
webhelp/index.htm
.html .js polyglot
webhelp/indexh.htm
.html
webhelp/languages.js
.js
webhelp/ricons/1.gif
.gif
webhelp/ricons/11.gif
.gif
webhelp/ricons/2.gif
.gif
webhelp/style.css
webhelp/webhelpbookmark.htm
.js
webhelp/webhelpcontents.htm
.html .js polyglot
webhelp/webhelpframe.htm
.html .js polyglot
webhelp/webhelpindex.htm
.js
webhelp/webhelpleft.htm
.html
webhelp/webhelplefth.htm
.html
webhelp/webhelpsearch.htm
.js
webhelp/webhelptoolbar.htm
webhelp/webhelptop.htm
.js
webhelp/webhelptoph.htm
.html
winchm.chm
.chm
winchm.chs
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 36B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
winchm.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 36B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
winchm_chs.chm
.chm
.cmd

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 80KB

.rsrc Size: 12KB - Virtual size: 12KB

5e1d3f49e5b7590e18325930cd3084f1

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 9KB

.rdata Size: 512B - Virtual size: 470B

.data Size: 2KB - Virtual size: 7KB

.reloc Size: 1024B - Virtual size: 730B

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 80KB

.rsrc
Size: 12KB - Virtual size: 12KB

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 512B - Virtual size: 470B

.data
Size: 2KB - Virtual size: 7KB

.reloc
Size: 1024B - Virtual size: 730B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 13KB - Virtual size: 13KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 6KB

.reloc
Size: 1024B - Virtual size: 848B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 410B

UPX0
Size: - Virtual size: 44KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 28KB - Virtual size: 28KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 11KB

.reloc
Size: 7KB - Virtual size: 7KB