2e307f505f7a8d571508197fb2608ee2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2e307f505f7a8d571508197fb2608ee2_JaffaCakes118
Size

2.1MB
MD5

2e307f505f7a8d571508197fb2608ee2
SHA1

036b3428be87fc387062e6341246d7a7f19a6a85
SHA256

abede0db93348c83e3c5b0aaeeb40b815a0dbce8b95ea8e718465a86d63f9ee2
SHA512

61943010ace041ad00e2c89338023be42c4c009e21201386ba5e2f94d40c884fa1bdc8814e68417ea3444ef98289f05474d91b86f9c5d1a9020df8dc970162a7
SSDEEP

49152:XncH51ay+vF1CoVLQSEm/IB6NsznZETncwU:W5qt1CoXVNUZUFU

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/ipconfig.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/processwork.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

2e307f505f7a8d571508197fb2608ee2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2012, 00:00

Not After

23/05/2013, 23:59

Subject

CN=Elf Network Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=QQAPP,O=Elf Network Co.\,Ltd,L=TianMen,ST=HUBEI,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fe:0b:e9:b0:65:e6:62:0f:58:92:49:f1:80:8f:95:02:d9:79:79:7e
Signer

Actual PE Digest

fe:0b:e9:b0:65:e6:62:0f:58:92:49:f1:80:8f:95:02:d9:79:79:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Exec.bmp
$PLUGINSDIR/Home.bmp
$PLUGINSDIR/Left.bmp
$PLUGINSDIR/Log.bmp
$PLUGINSDIR/Soft.bmp
$PLUGINSDIR/SucaiBar.bmp
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bg.bmp
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ipconfig.dll
.dll windows:5 windows x86 arch:x86

891e128d9bd0ba51661a3a8a0557191a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Works\QQClone\Src\BHO\product\win32d\IpConfig.pdb

Imports

kernel32

lstrcpynA
SystemTimeToTzSpecificLocalTime
MapViewOfFileEx
GlobalAlloc
Sleep
FileTimeToSystemTime
GetLastError
GlobalFree
CreateFileMappingA
UnmapViewOfFile
GetFileTime
CloseHandle
LocalFree
lstrcpyA
lstrlenA
FlushFileBuffers
SetEnvironmentVariableA
CompareStringW
CompareStringA
CreateFileA
GetModuleFileNameA
GetProcAddress
LoadLibraryW
lstrcatA
DeviceIoControl
CreateFileW
GetSystemWindowsDirectoryW
GetVersionExW
HeapFree
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
GetTimeZoneInformation
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
HeapSize
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
MultiByteToWideChar
LCMapStringW
WriteFile
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
ReadFile
GetCommandLineW

user32

IsWindow
wsprintfW
PostMessageA
wsprintfA

shell32

CommandLineToArgvW

iphlpapi

GetAdaptersInfo

advapi32

RegOpenKeyExA

Exports

Exports

CloseQZClone
CompareFileLastWriteTime
GetFNN
GetFNQ
GetNetworkKey
GetNetworkMid
HaveCommandLine
TodayDayoff
UnInstall

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/processwork.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CloseProcess
ExistsProcess
KillProcess
QuitProcess

Sections

CODE
Size: 200KB - Virtual size: 200KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 147B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 47B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AutoUpdate.exe
.exe windows:5 windows x86 arch:x86

1fa981d42f50448e2c7a1a7a3825d6fe

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2012, 00:00

Not After

23/05/2013, 23:59

Subject

CN=Elf Network Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=QQAPP,O=Elf Network Co.\,Ltd,L=TianMen,ST=HUBEI,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:a4:a2:fc:ea:bb:4a:17:92:6b:3c:65:c8:2a:d2:c9:81:ab:c3:cf
Signer

Actual PE Digest

4f:a4:a2:fc:ea:bb:4a:17:92:6b:3c:65:c8:2a:d2:c9:81:ab:c3:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateDirectoryA
GetVersionExA
GetTempFileNameA
GetTempPathA
CreateProcessA
WaitForSingleObject
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
GetDriveTypeA
FindClose
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SleepEx
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
CreateFileA
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetPrivateProfileStringA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GlobalAlloc
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
LCMapStringW
LCMapStringA
ExitProcess
HeapCreate
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleFileNameA
GetStdHandle
WriteFile
GetModuleHandleA
GetStartupInfoW
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ResumeThread
ExitThread
RtlUnwind
VirtualAlloc
GetPrivateProfileIntA
CopyFileA
DeleteFileA
Sleep
LoadLibraryA
SetEvent
CreateEventW
GetCommandLineW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
lstrcmpiW
LoadLibraryExW
lstrlenW
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
SetLastError
GetCurrentProcess
FlushInstructionCache
WideCharToMultiByte
FindResourceExW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrlenA
MultiByteToWideChar
GetLastError
GetModuleHandleW
RaiseException
DeleteCriticalSection
GetProcAddress
FreeLibrary
SetFilePointer
LoadLibraryW
GlobalLock
GlobalUnlock
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
CreateFileW
GetFileSize
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
ReadFile
CloseHandle
GetVersion
GetFileType
GetCurrentThreadId

user32

GetSystemMetrics
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
UnregisterClassA
MonitorFromWindow
GetWindowLongW
GetWindowRect
GetWindow
GetParent
ReleaseDC
GetDC
LoadBitmapW
LoadImageW
DefWindowProcW
DestroyWindow
SendMessageW
ShowWindow
GetDlgItem
CopyRect
InflateRect
CreateWindowExW
MoveWindow
SetRect
InvalidateRect
SetWindowLongW
GetClassInfoExW
LoadCursorW
RegisterClassExW
CharNextW
GetDesktopWindow
GetKeyState
IsWindowEnabled
GetWindowTextW
GetWindowTextLengthW
DrawTextW
GetWindowDC
SetActiveWindow
EnableWindow
GetActiveWindow
IsWindow
PostThreadMessageW
SetCursor
IsWindowVisible
GetDlgCtrlID
DrawIconEx
DrawFrameControl
DestroyIcon
LoadIconW
PostMessageW
PtInRect
OffsetRect
EqualRect
ClientToScreen
SetWindowRgn
BeginPaint
EndPaint
SetCapture
ReleaseCapture
PostQuitMessage
FrameRect
RegisterWindowMessageA
SendMessageTimeoutA
GetClassNameW
FindWindowA
FindWindowExA
EnumChildWindows
ScreenToClient
SetFocus
SetForegroundWindow
CallWindowProcW

gdi32

OffsetRgn
CombineRgn
SetRectRgn
CreateRectRgnIndirect
GetTextExtentPoint32W
TextOutW
RoundRect
LineTo
MoveToEx
GetClipRgn
RectInRegion
SetBkMode
CreateRectRgn
CreatePen
ExtTextOutW
Rectangle
SelectClipRgn
RestoreDC
SaveDC
CreateCompatibleBitmap
CreateBitmap
StretchBlt
SetBkColor
SetTextColor
CreateDIBSection
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
CreateFontIndirectW
DeleteObject
CreateSolidBrush

advapi32

RegSetValueExW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegOpenKeyExW

shell32

SHGetFolderPathA
ShellExecuteExA
ShellExecuteA
SHGetFileInfoA
ShellExecuteW

ole32

CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

SHSetValueA
PathIsRelativeA
PathRemoveFileSpecW
PathIsDirectoryA
StrToIntA
StrToIntW
PathFileExistsA
PathFindFileNameA
SHGetValueA

comctl32

ImageList_Destroy
ImageList_Create
InitCommonControlsEx
_TrackMouseEvent

gdiplus

GdipFree
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipAlloc
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipDrawImageI
GdipGetImageHeight
GdipDisposeImage
GdipCloneImage
GdipGetImageWidth

ws2_32

listen
__WSAFDIsSet
select
ioctlsocket
gethostname
htons
bind
ntohs
getsockname
setsockopt
sendto
send
recv
WSAGetLastError
WSAStartup
accept
recvfrom
getsockopt
getaddrinfo
freeaddrinfo
WSASetLastError
connect
socket
closesocket
getpeername
WSACleanup

wldap32

ord200
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord30
ord26
ord50
ord60
ord143
ord211
ord22
ord46

Sections

.text
Size: 544KB - Virtual size: 543KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QZoneClone.db
QZoneClone.dll
.dll regsvr32 windows:5 windows x86 arch:x86

38d1e26ad06a59f8fb3621bbbae20796

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2012, 00:00

Not After

23/05/2013, 23:59

Subject

CN=Elf Network Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=QQAPP,O=Elf Network Co.\,Ltd,L=TianMen,ST=HUBEI,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ba:59:da:aa:a5:2f:60:6e:0d:1d:8c:1a:49:b5:ba:d2:bb:2d:d0:e4
Signer

Actual PE Digest

ba:59:da:aa:a5:2f:60:6e:0d:1d:8c:1a:49:b5:ba:d2:bb:2d:d0:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetTickCount
CreateMutexA
CreateMutexW
DeleteFileW
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
lstrcmpiW
DisableThreadLibraryCalls
FreeLibrary
GlobalLock
WaitForSingleObject
CreateThread
SetEvent
GetPrivateProfileStringW
CreateEventW
SetCurrentDirectoryW
Sleep
GetTempFileNameW
GetTempPathW
lstrcpyA
GetSystemWindowsDirectoryW
DeviceIoControl
lstrcatA
LoadLibraryW
LoadLibraryExW
GlobalUnlock
LoadLibraryA
VirtualProtect
IsBadReadPtr
GetFileSize
GetCurrentProcess
GetModuleFileNameW
SetEndOfFile
CreateFileA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
TlsFree
TlsSetValue
TlsAlloc
MulDiv
lstrcmpW
SetLastError
GetCurrentThreadId
lstrlenA
lstrlenW
ReleaseMutex
CloseHandle
WideCharToMultiByte
FlushInstructionCache
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
WriteFile
ExitProcess
HeapCreate
VirtualQuery
GetSystemInfo
GetCPInfo
GetCommandLineA
ResumeThread
ExitThread
ReadFile
CreateFileW
GetModuleFileNameA
GetVersionExW
ResetEvent
GetPrivateProfileIntA
GetTempFileNameA
GetTempPathA
DeleteFileA
CopyFileA
InterlockedCompareExchange
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
IsBadWritePtr
WaitForMultipleObjects
InterlockedExchange
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetModuleHandleA

user32

EnumChildWindows
GetClassNameA
DestroyWindow
GetParent
LoadCursorW
GetClassInfoExW
IsWindow
KillTimer
SetTimer
ShowWindow
GetWindowLongW
SetWindowLongW
DefWindowProcW
CharLowerBuffW
UnregisterClassA
wsprintfA
GetWindowTextA
GetPropW
IsWindowUnicode
SetWindowLongA
CallWindowProcA
DefWindowProcA
RegisterClassExW
MoveWindow
CallWindowProcW
GetDesktopWindow
SetPropW
PostMessageW
RemovePropW
FindWindowExW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
IsWindowVisible
CreateAcceleratorTableW
SendMessageW
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
wsprintfW
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
CharNextW
GetSysColor
CreateWindowExW

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

advapi32

RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExA

shell32

ShellExecuteW
SHGetFolderPathA

ole32

CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoTaskMemRealloc
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
CoInitialize
StringFromGUID2

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VariantInit
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
SysStringLen
DispCallFunc
VarBstrCmp
SysAllocStringByteLen
SysStringByteLen

shlwapi

SHSetValueW
PathFileExistsW
SHGetValueA
SHSetValueA
PathFindFileNameA
SHGetValueW
PathRemoveFileSpecW

urlmon

URLDownloadToFileA

wininet

InternetSetOptionW
InternetCheckConnectionW
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCrackUrlA
InternetOpenUrlA
InternetOpenUrlW

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 457KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
QZoneClone.exe
.exe windows:5 windows x86 arch:x86

113fecbe2c2b31c8dd2108615640a5a9

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2012, 00:00

Not After

23/05/2013, 23:59

Subject

CN=Elf Network Co.\,Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=QQAPP,O=Elf Network Co.\,Ltd,L=TianMen,ST=HUBEI,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c2:39:03:56:cc:6f:97:5d:28:96:24:15:a6:55:d8:59:d9:93:77:79
Signer

Actual PE Digest

c2:39:03:56:cc:6f:97:5d:28:96:24:15:a6:55:d8:59:d9:93:77:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileMappingW
lstrcmpW
MulDiv
LoadLibraryExW
lstrcmpiW
UnmapViewOfFile
GetVersionExW
TlsAlloc
TlsFree
CreateEventW
SetEvent
GetExitCodeThread
TerminateThread
FindClose
FindNextFileW
FindFirstFileW
ResetEvent
CreateMutexW
OpenFileMappingA
GetPrivateProfileStringW
DeleteFileW
WriteFile
ResumeThread
CopyFileW
CreateThread
GetPrivateProfileIntA
GetPrivateProfileStringA
CopyFileA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetFilePointer
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
GetFileAttributesW
SetFileTime
UnlockFileEx
UnlockFile
SetEndOfFile
QueryPerformanceCounter
LockFileEx
LockFile
LocalFree
LoadLibraryA
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExA
GetTempPathW
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetFullPathNameW
GetFullPathNameA
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FormatMessageW
FormatMessageA
FlushFileBuffers
CreateFileA
AreFileApisANSI
InterlockedCompareExchange
FreeEnvironmentStringsA
GetLastError
MoveFileA
VirtualQuery
VirtualProtect
FindFirstFileA
MapViewOfFileEx
GetFileInformationByHandle
FileTimeToLocalFileTime
RaiseException
GetExitCodeProcess
QueryPerformanceFrequency
OutputDebugStringA
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
SleepEx
CreatePipe
CreateProcessA
SetEnvironmentVariableA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetTimeZoneInformation
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
ExitProcess
IsValidCodePage
GetOEMCP
GetACP
GetModuleHandleA
TlsSetValue
TlsGetValue
GetStdHandle
GetCPInfo
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitThread
RtlUnwind
LCMapStringW
LCMapStringA
GetStringTypeExW
GetStringTypeExA
GetUserDefaultLCID
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetProcessHeap
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
GetVersion
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
GetProcAddress
GetModuleFileNameW
GetTempPathA
GetTempFileNameA
MoveFileExA
CreateDirectoryW
CreateFileMappingA
MapViewOfFile
FlushViewOfFile
lstrcpyW
InterlockedExchange
GetPrivateProfileIntW
GetTickCount
LoadLibraryW
FreeLibrary
CreateProcessW
WaitForSingleObject
OutputDebugStringW
InterlockedDecrement
InterlockedIncrement
IsBadWritePtr
Sleep
DeleteCriticalSection
SetLastError
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
FindResourceExW
WideCharToMultiByte
lstrlenW
FindResourceW
SizeofResource
LoadResource
LockResource
FreeResource
CreateFileW
GetFileSize
ReadFile
CloseHandle
lstrlenA
GetDriveTypeA
MultiByteToWideChar
DeleteFileA
GetCurrentDirectoryA
GetEnvironmentStrings

user32

UnregisterClassA
LoadStringW
CharLowerBuffW
GetParent
GetWindow
GetWindowRect
GetWindowLongW
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
ShowWindow
GetActiveWindow
RedrawWindow
GetClassNameW
CharNextW
CreateAcceleratorTableW
ScreenToClient
InvalidateRgn
GetWindowDC
EnableWindow
PostThreadMessageW
LoadStringA
FillRect
IsChild
GetSysColor
wsprintfA
PostQuitMessage
InvalidateRect
SendMessageW
SetCursor
LoadCursorW
ReleaseDC
GetDC
GetDesktopWindow
DrawTextW
IsWindowVisible
GetDlgCtrlID
IsWindow
GetDlgItem
DrawIconEx
DrawFrameControl
DestroyIcon
LoadImageW
LoadIconW
PostMessageW
ClientToScreen
SetWindowRgn
CreateWindowExW
BeginPaint
EndPaint
SetCapture
ReleaseCapture
DefWindowProcW
MoveWindow
GetKeyState
IsWindowEnabled
FrameRect
CopyRect
PtInRect
SetRect
InflateRect
OffsetRect
EqualRect
SetWindowLongW
CallWindowProcW
DestroyWindow
GetClassInfoExW
RegisterClassExW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
GetWindowTextW
GetWindowTextLengthW
GetFocus
SetWindowTextW
SetWindowTextA
SetTimer
KillTimer
FindWindowExW
SetForegroundWindow
SetActiveWindow
GetSystemMetrics
SetFocus
IsIconic
MessageBoxW
wsprintfW
LoadBitmapW
DestroyAcceleratorTable

gdi32

LineTo
MoveToEx
CreatePen
SetBkMode
CreateCompatibleBitmap
CreateBitmap
StretchBlt
SetTextColor
CreateDIBSection
CreateCompatibleDC
BitBlt
DeleteDC
CreateSolidBrush
OffsetRgn
CombineRgn
SetRectRgn
Rectangle
CreateRectRgn
GetTextExtentPoint32W
TextOutW
RoundRect
SelectClipRgn
GetClipRgn
RestoreDC
SaveDC
SelectObject
RectInRegion
ExtTextOutW
SetBkColor
DeleteObject
GetStockObject
GetObjectW
CreateFontIndirectW
GetDeviceCaps
CreateRectRgnIndirect
EnumFontFamiliesW

advapi32

RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegQueryValueExW
GetTokenInformation
OpenProcessToken
RegOpenKeyExA
RegDeleteValueW

shell32

ShellExecuteW
SHGetFileInfoA
ShellExecuteExW
SHGetFolderPathW
ShellExecuteA

ole32

CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoTaskMemRealloc
CoGetMalloc
StringFromCLSID
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoUninitialize
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
OleUninitialize
CreateStreamOnHGlobal
StringFromIID
CoInitialize

oleaut32

SysStringLen
SysAllocStringLen
VariantClear
VariantInit
SysAllocString
SysFreeString
LoadTypeLi
DispCallFunc
OleCreateFontIndirect
VarUI4FromStr
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
LoadRegTypeLi

shlwapi

PathIsRelativeA
StrToIntW
PathFileExistsW
PathIsDirectoryA
PathFindFileNameA
StrToIntA
PathIsRelativeW
SHGetValueW
SHSetValueW
PathRemoveFileSpecW
SHGetValueA
SHSetValueA
SHDeleteKeyA
SHDeleteKeyW
PathFileExistsA

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipCloneImage
GdipDisposeImage
GdipFree
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipAlloc
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDrawImageI
GdipDeleteGraphics
GdipCreateFromHDC

ws2_32

connect
accept
gethostname
ioctlsocket
recvfrom
sendto
getaddrinfo
freeaddrinfo
WSASetLastError
getpeername
getsockopt
bind
ntohs
getsockname
select
__WSAFDIsSet
setsockopt
shutdown
WSAGetLastError
gethostbyname
socket
htons
listen
closesocket
send
recv
WSACleanup
WSAStartup

wldap32

ord41
ord46
ord27
ord22
ord211
ord301
ord33
ord143
ord60
ord50
ord26
ord30
ord32
ord35
ord79
ord200

wininet

InternetOpenUrlW
InternetCrackUrlW
InternetCrackUrlA
InternetOpenUrlA
InternetSetCookieW
InternetGetCookieW
InternetReadFile
InternetAttemptConnect
InternetOpenW
InternetCloseHandle
HttpQueryInfoA
InternetConnectW
HttpOpenRequestW
HttpSendRequestA

urlmon

URLDownloadToFileA

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 61KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.exe.nsis

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cfCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

fe:0b:e9:b0:65:e6:62:0f:58:92:49:f1:80:8f:95:02:d9:79:79:7eSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 56KB

.rsrc Size: 31KB - Virtual size: 30KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

891e128d9bd0ba51661a3a8a0557191a

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

iphlpapi

advapi32

Exports

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

fe:0b:e9:b0:65:e6:62:0f:58:92:49:f1:80:8f:95:02:d9:79:79:7e
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 56KB

.rsrc
Size: 31KB - Virtual size: 30KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 96KB - Virtual size: 96KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 4KB - Virtual size: 36KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

CODE
Size: 200KB - Virtual size: 200KB

DATA
Size: 4KB - Virtual size: 4KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.edata
Size: 512B - Virtual size: 147B

.rdata
Size: 512B - Virtual size: 47B

.reloc
Size: 13KB - Virtual size: 12KB

.rsrc
Size: 5KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:b8:e3:5b:53:60:1a:f5:36:c5:c4:f8:ec:98:28:cf
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

4f:a4:a2:fc:ea:bb:4a:17:92:6b:3c:65:c8:2a:d2:c9:81:ab:c3:cf
Signer