28c1e71ae33bc0e923685bf9bb062e47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

28c1e71ae33bc0e923685bf9bb062e47_JaffaCakes118
Size

420KB
MD5

28c1e71ae33bc0e923685bf9bb062e47
SHA1

709aef6d97f9db18e77f3702bb31907f168b03da
SHA256

7547dd4280f9c0fcbcd60b90e58f858e5db5e079c66cbe941b4d573d51de642a
SHA512

9d6cdb4fdf886026e3b33d437c31e53973afb3e4b9f7c7c5d4bd77f0dda2d1b2301687b441c4f8dcd1bb7086546e52a8b7ac1d007402db9d68cfd82ac3f3b674
SSDEEP

12288:e+fndE4t5nOGx04XJ2zFc2gW6ysGHLe6GF5:JfdVBFVXJ2zFc2gWFFHQT

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
28c1e71ae33bc0e923685bf9bb062e47_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

28c1e71ae33bc0e923685bf9bb062e47_JaffaCakes118
.exe windows:4 windows x86 arch:x86

9bca2c7cb3bba360100a3a7a510fe11d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleA
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
CompareFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
GetCurrentProcessId
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryA
GetSystemDirectoryA
CreateProcessA
GetTempFileNameA
lstrlenA
lstrcatA
GetVersion
RemoveDirectoryA
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

LoadCursorA
CheckDlgButton
ScreenToClient
GetMessagePos
CallWindowProcA
IsWindowVisible
LoadBitmapA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuA
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetCursor
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetWindowLongA
GetSysColor
RegisterWindowMessageA
CharNextA
ExitWindowsEx
SetWindowPos
PostMessageA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumValueA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 200KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/EstUrl.dll
.dll windows:4 windows x86 arch:x86

eeb38f232fa753bbd4952f6a14cefac5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/01/2018, 00:00

Not After

11/04/2020, 23:59

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:5f:bb:b4:06:8a:43:a7:c9:d4:bf:6b:7e:bb:46:57:a1:0b:07:69
Signer

Actual PE Digest

14:5f:bb:b4:06:8a:43:a7:c9:d4:bf:6b:7e:bb:46:57:a1:0b:07:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Source\svn\aldev-svn\common\NSIS\bin\2.46-NEW\Release-alupdate-svc\includeESTsoft\Projects\pdb\EstUrl.pdb

Imports

kernel32

HeapAlloc
GetProcessHeap
Sleep
lstrcatA
GlobalUnlock
GlobalLock
GetExitCodeProcess
WaitForSingleObject
CloseHandle
CreateProcessA
GetVersion
GetCurrentThreadId
WideCharToMultiByte
GetLastError
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
FreeLibrary
LoadLibraryW
GetVersionExA
GetSystemInfo
CreateMutexA
OutputDebugStringA
ReleaseMutex
OpenMutexA
MulDiv
CompareStringW
CompareStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
GetConsoleMode
GetConsoleCP
SetFilePointer
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
HeapFree
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
RtlUnwind
InitializeCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
GetCurrentThread
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
HeapDestroy
HeapReAlloc
VirtualAlloc
VirtualFree
lstrcmpiA
lstrcpyA
GetModuleHandleA
GetProcAddress
GetLogicalDrives
GetDriveTypeA
lstrcmpA
ExitProcess
GlobalAlloc
lstrcpynA
GlobalFree
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
GetCommandLineA
MultiByteToWideChar
lstrlenA
GetStringTypeA
SetEnvironmentVariableA

user32

GetParent
EnableWindow
CallNextHookEx
SetWindowLongA
MessageBoxA
CallWindowProcA
InvalidateRect
GetMessagePos
GetMessageA
UnregisterClassA
GetForegroundWindow
AttachThreadInput
LoadImageA
GetWindowTextA
GetDC
DrawTextA
ReleaseDC
RegisterClassA
FindWindowA
EnumWindows
GetWindowThreadProcessId
GetClassNameA
IsWindowVisible
SetForegroundWindow
SetActiveWindow
LoadBitmapA
ShowWindow
GetClientRect
CreateWindowExA
GetWindowLongA
GetWindowRect
ScreenToClient
SetWindowPos
SetWindowsHookExA
WaitForInputIdle
DialogBoxParamA
EndDialog
LoadIconA
SetWindowTextA
GetTopWindow
GetWindow
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
EmptyClipboard
SetClipboardData
CloseClipboard
GetDlgCtrlID
SetFocus
IsWindow
LoadCursorA
SetCursor
FindWindowExA
PeekMessageA
PostQuitMessage
TranslateMessage
DispatchMessageA
DefWindowProcA
GetDlgItem
SendMessageA
wsprintfA
CheckRadioButton
IsWindowEnabled
BringWindowToTop

gdi32

DeleteObject
GetDeviceCaps
GetStockObject
SelectObject

advapi32

RegDeleteKeyA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA

shell32

ShellExecuteExA
ShellExecuteA
SHGetSpecialFolderPathA

ole32

IIDFromString

oleaut32

SysAllocStringLen
SysFreeString

shlwapi

PathRelativePathToA
PathStripToRootA
PathRemoveBackslashA
PathCanonicalizeA
PathRemoveFileSpecA
StrStrA
PathRemoveBlanksA
PathStripPathA
PathSearchAndQualifyA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

comctl32

ImageList_Create
ImageList_AddMasked

Exports

Exports

AddPerInstaller
ChangeMainFont
CheckVersion
CheckVersion2
CreateControl
CreateFindWindow
CreateMtx
DllVersionCompare
FindAndActiveWindow
FitCheckBoxWidth
FolderMangling
FreeMem
GetDPIPoint
GetIEVersionString
GetMutex
GetOSVersionString
GetParamValue
GetParentPath
GetProductTypeFromCode
GetPropertyFromSNCode
GroupMangling
InitBannerCtrl
InsertProductType
IsCorrectSerial
IsCorrectSerial2
LaunchProcess
Load
MessageBoxN
MessagePumping
Operator
PathIsSystemFile
ReadRegForMultiStr
ReleaseMtx
RemoveExclameStr
RemoveFileSpec
RemoveItemFromRegMultiStr
SetALPassPath
SetBitmap
SetInstalled
ShowALYacCheckDlg
StrFind
StrFindDomain
SubClassALPass
SubClassBanner
SubClassCorpPage
SubClassCorpWithoutSNPage
SubClassMainDlg
SubClassMainFrame
ThreadAttach
TreeAddItem
TreeAddItem2
TreeGetItemState
TreeGroupRefresh
TreeSubClassing
TrimString
UnSubClassBanner
UnSubClassCorpPage
Unload
ValidPath
ValidRoot
VerifyUI
WaitExecute
WaitUntilIdle

Sections

.text
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

88d8a4a9c21e345682f6b1fac45c4679

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect
MultiByteToWideChar
FreeLibrary

user32

wsprintfA

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 743B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 737B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/workerExtension.dll
.dll windows:4 windows x86 arch:x86

e4781cfad6de451d1604134f6718d380

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8f
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/01/2018, 00:00

Not After

11/04/2020, 23:59

Subject

CN=ESTsoft Corp.,O=ESTsoft Corp.,L=Seocho-gu,ST=Seoul,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:77:63:f3:3b:b4:7a:44:5f:7f:f7:96:ad:99:29:29:82:28:d2:ad
Signer

Actual PE Digest

60:77:63:f3:3b:b4:7a:44:5f:7f:f7:96:ad:99:29:29:82:28:d2:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\source\altools\common\altools-nsis\includeESTsoft\Projects\pdb\workerExtension.pdb

Imports

kernel32

SetFileAttributesA
GetSystemDefaultLangID
CreateFileA
GetPrivateProfileStringA
ReadFile
ProcessIdToSessionId
SetLastError
GetTickCount
Process32Next
GetModuleFileNameW
OutputDebugStringA
Process32First
lstrcpyA
CreateToolhelp32Snapshot
lstrcpynA
GlobalAlloc
GlobalFree
GetModuleFileNameA
WaitForSingleObject
FreeLibrary
OpenProcess
TerminateProcess
GetCurrentProcessId
RemoveDirectoryA
FindFirstFileA
GetThreadLocale
SetCurrentDirectoryA
FindClose
GetCurrentDirectoryA
FindNextFileA
MoveFileExA
WritePrivateProfileStringA
GetProcAddress
GetVersionExA
DeleteFileA
CreateDirectoryA
LoadLibraryA
GetCurrentProcess
GetModuleHandleA
SizeofResource
LockResource
FindResourceA
LoadResource
CompareStringW
InterlockedExchange
CreateFileW
WideCharToMultiByte
LocalAlloc
GetLastError
GetVersion
FileTimeToLocalFileTime
lstrcmpA
lstrlenA
CompareStringA
MultiByteToWideChar
CloseHandle
LocalFree
FileTimeToSystemTime
SetEnvironmentVariableA
FormatMessageA
GlobalUnlock
GlobalLock
InterlockedDecrement
WriteFile
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
DuplicateHandle
GetVolumeInformationA
GetFullPathNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
SetErrorMode
InterlockedIncrement
GlobalGetAtomNameA
GetFileAttributesA
GetFileTime
lstrcmpW
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalFlags
GetLocaleInfoA
GetCPInfo
GetOEMCP
HeapFree
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
VirtualAlloc
GetCommandLineA
GetProcessHeap
RtlUnwind
RaiseException
HeapSize
SetStdHandle
GetFileType
ExitProcess
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
HeapDestroy
HeapCreate
VirtualFree
GetStdHandle
SetHandleCount
GetStartupInfoA
Sleep
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW

user32

GetClassInfoA
GetClassInfoExA
PostMessageA
GetMenu
GetClientRect
SetForegroundWindow
MapWindowPoints
GetMessagePos
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
GetForegroundWindow
IsWindow
RemovePropA
GetPropA
SetPropA
GetClassNameA
GetClassLongA
GetCapture
WinHelpA
LoadIconA
RegisterWindowMessageA
SetWindowTextA
ClientToScreen
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
RegisterClassA
DestroyMenu
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
GetParent
GetWindowThreadProcessId
GetWindowTextA
GetLastActivePopup
LoadBitmapA
IsWindowEnabled
EnableWindow
LoadCursorA
GetSysColor
GetSysColorBrush
GetWindowLongA
UnregisterClassA
SetWindowsHookExA
CallNextHookEx
DispatchMessageA
GetKeyState
PeekMessageA
SystemParametersInfoA
CharUpperA
wsprintfW
SetWindowLongA
DefWindowProcA
SendMessageA
ValidateRect
GetSystemMetrics
CreateWindowExA
CallWindowProcA
MessageBoxA
GetDC
ReleaseDC
IsIconic
GetWindowPlacement
GetSubMenu
GetMenuItemCount
GetMenuItemID
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
SetWindowPos
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
GetMenuState
UnhookWindowsHookEx
GetWindowRect
PostQuitMessage
GetWindow

gdi32

PtVisible
RectVisible
TextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ExtTextOutA
SetWindowExtEx
ScaleWindowExtEx
SetMapMode
ScaleViewportExtEx
GetDeviceCaps
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
GetStockObject
DeleteDC

advapi32

GetSidIdentifierAuthority
IsValidSid
GetSidSubAuthority
LookupAccountSidA
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
LookupAccountNameA
RegCreateKeyExA
RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegEnumKeyExA

shell32

ShellExecuteA
SHGetFolderPathA
SHGetSpecialFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

VariantChangeType
VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
VariantInit

shlwapi

PathIsDirectoryA
PathRemoveFileSpecA
SHDeleteKeyA
PathFileExistsA
PathStripToRootA
PathIsUNCA
UrlUnescapeA
PathFindFileNameA
PathFindExtensionA
PathRemoveFileSpecW

crypt32

CryptMsgClose
CertFindCertificateInStore
CertGetNameStringA
CryptMsgGetParam
CertOpenStore
CertFreeCertificateContext
CryptDecodeObject
CertCloseStore
CryptQueryObject

wintrust

WinVerifyTrustEx

imagehlp

ImageEnumerateCertificates
ImageGetCertificateData

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

wininet

InternetCrackUrlA
InternetCanonicalizeUrlA
InternetQueryDataAvailable
HttpQueryInfoA
InternetCloseHandle
InternetGetLastResponseInfoA
InternetOpenA
InternetSetStatusCallback
InternetSetFilePointer
InternetWriteFile
InternetReadFile
HttpSendRequestA
InternetConnectA
HttpOpenRequestA

oleacc

LresultFromObject
CreateStdAccessibleObject

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

comdlg32

GetFileTitleA

Exports

Exports

CheckStartPage
CreateCheckbox
CreateRichEdit
DLL_GetVisibleCampaignName
DLL_InitSetterFile
DLL_SetInitPromotion
DWORD_CallExternalDll_stringw
DoCrash
DoInstalledExt
ElevateNonRun
ElevateRun
EndECRSC
GetLogParam
GetPVLogParam
GetParentProcName
GetPreInstInfoParam
GetPreVersion
GetSignerName
GetStateValue
InitSetterFile
IsDebugMode
IsDebugModeForBanner
KillProcess
LoadRTF
MoveStartMenuItems
ProceedExtPreInstall
RemoveLicense
RunEventItemsByIds
RunMediumIntergrityLevel
SaveLicense
SetInitPromotion
SetNsisVersion
SetStateValue
StartECRSC
SubClassLicenseDlgForRichEdit2
SubClassMultiCheckbox
VerifyFile
VersionCompare
WaitProcess
qwer
void_CallExternalDll_stringw

Sections

.text
Size: 388KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9bca2c7cb3bba360100a3a7a510fe11d

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 1.6MB

.ndata Size: - Virtual size: 200KB

.rsrc Size: 123KB - Virtual size: 122KB

eeb38f232fa753bbd4952f6a14cefac5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8fCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

14:5f:bb:b4:06:8a:43:a7:c9:d4:bf:6b:7e:bb:46:57:a1:0b:07:69Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

comctl32

Exports

Exports

Sections

.text Size: 132KB - Virtual size: 128KB

.rdata Size: 20KB - Virtual size: 16KB

.data Size: 8KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 2KB

.reloc Size: 8KB - Virtual size: 6KB

88d8a4a9c21e345682f6b1fac45c4679

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 816B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 516B

afa8e526425f3585465337467d0b5909

Headers

DLL Characteristics

File Characteristics

Imports

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 1.6MB

.ndata
Size: - Virtual size: 200KB

.rsrc
Size: 123KB - Virtual size: 122KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8f
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

14:5f:bb:b4:06:8a:43:a7:c9:d4:bf:6b:7e:bb:46:57:a1:0b:07:69
Signer

.text
Size: 132KB - Virtual size: 128KB

.rdata
Size: 20KB - Virtual size: 16KB

.data
Size: 8KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 2KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 816B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 516B

.text
Size: 1024B - Virtual size: 743B

.rdata
Size: 1024B - Virtual size: 737B

.data
Size: - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 190B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

42:1a:69:d2:23:d9:91:08:02:7b:f8:c6:7d:47:2a:8f
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

60:77:63:f3:3b:b4:7a:44:5f:7f:f7:96:ad:99:29:29:82:28:d2:ad
Signer

.text
Size: 388KB - Virtual size: 387KB

.rdata
Size: 96KB - Virtual size: 93KB

.data
Size: 12KB - Virtual size: 25KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 36KB - Virtual size: 34KB