45792a53cd23046281f8b5c5839250b7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
45792a53cd23046281f8b5c5839250b7_JaffaCakes118
Size 367KB
Sample241015-ddnhvsvdqq
SHA256 4e85005577b1ff875c7d3004dd290ffda262afb02b3d4129553a4232c290e5e4
MD5 45792a53cd23046281f8b5c5839250b7
SHA1 b39a5feab3b7fee43df4fe0e0dba8aa5a196692a
SHA512 a47b114705f258e5c4385d07d499e6c622ad8702ac025fe9db5b0daeca1d8e2f24290830669f1193f2559c9536d5056acea233d47d59c3e7850f975fc0a5a3c3
SSDEEP 6144:okNRExR6FlaosTtw9fies2ydIY8Q7Pr7fARK/+RpRit9Ut963oxNa0SbveBwumh:oWRiYB4twIeodIYlvrULfO3Cazbvex
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/GetVersion.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack003/$PLUGINSDIR/NSISdl.dll
unpack004/$PLUGINSDIR/NSISdl.dll
unpack005/$PLUGINSDIR/NSISdl.dll
unpack006/$PLUGINSDIR/NSISdl.dll

NSIS installer 11 IoCs

installer

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderDDLR.exe	nsis_installer_1
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderDDLR.exe	nsis_installer_2
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER0.exe	nsis_installer_1
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER0.exe	nsis_installer_2
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER1.exe	nsis_installer_1
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER1.exe	nsis_installer_2
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER2.exe	nsis_installer_1
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER2.exe	nsis_installer_2
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderSTUB.exe	nsis_installer_1
static1/unpack001/$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderSTUB.exe	nsis_installer_2

File Explorer

45792a53cd23046281f8b5c5839250b7_JaffaCakes118

.exe 367KB
$PLUGINSDIR/GetVersion.dll

.dll 9KB
$PLUGINSDIR/NSISdl.dll

.dll 96KB
$PLUGINSDIR/Processes.dll

.dll 35KB
$PLUGINSDIR/nsExec.dll

.dll 8KB
$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderDDLR.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER0.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER1.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER2.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderSTUB.exe

.exe 58KB
$PLUGINSDIR/NSISdl.dll

.dll 14KB
$TEMP/30602584caa012822e932dd66bc8dbe3/preinstaller.exe

.exe 241KB

45792a53cd23046281f8b5c5839250b7_JaffaCakes118

IMPHASH 28a099a911237a28521d8b7ea250f089
SHA256 4e85005577b1ff875c7d3004dd290ffda262afb02b3d4129553a4232c290e5e4
MD5 45792a53cd23046281f8b5c5839250b7
SHA1 b39a5feab3b7fee43df4fe0e0dba8aa5a196692a
SHA512 a47b114705f258e5c4385d07d499e6c622ad8702ac025fe9db5b0daeca1d8e2f24290830669f1193f2559c9536d5056acea233d47d59c3e7850f975fc0a5a3c3
SSDEEP 6144:okNRExR6FlaosTtw9fies2ydIY8Q7Pr7fARK/+RpRit9Ut963oxNa0SbveBwumh:oWRiYB4twIeodIYlvrULfO3Cazbvex
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

17235

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectA DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileA CreateDirectoryA CreateFileA CreateProcessA CreateThread DeleteFileA ExitProcess ExpandEnvironmentStringsA FindClose FindFirstFileA FindNextFileA FreeLibrary GetCommandLineA GetCurrentProcess GetDiskFreeSpaceA GetExitCodeProcess GetFileAttributesA GetFileSize GetFullPathNameA GetLastError GetModuleFileNameA GetModuleHandleA GetPrivateProfileStringA GetProcAddress GetShortPathNameA GetSystemDirectoryA GetTempFileNameA GetTempPathA GetTickCount GetVersion GetWindowsDirectoryA GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryA LoadLibraryExA MoveFileA MulDiv MultiByteToWideChar ReadFile RemoveDirectoryA SearchPathA SetCurrentDirectoryA SetErrorMode SetFileAttributesA SetFilePointer SetFileTime Sleep WaitForSingleObject WriteFile WritePrivateProfileStringA lstrcatA lstrcmpA lstrcmpiA lstrcpynA lstrlenA

ole32

CoCreateInstance CoTaskMemFree OleInitialize OleUninitialize

shell32

SHBrowseForFolderA SHFileOperationA SHGetFileInfoA SHGetPathFromIDListA SHGetSpecialFolderLocation ShellExecuteA

user32

AppendMenuA BeginPaint CallWindowProcA CharNextA CharPrevA CheckDlgButton CloseClipboard CreateDialogParamA CreatePopupMenu CreateWindowExA DefWindowProcA DestroyWindow DialogBoxParamA DispatchMessageA DrawTextA EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExA GetClassInfoA GetClientRect GetDC GetDlgItem GetDlgItemTextA GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongA GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadBitmapA LoadCursorA LoadImageA MessageBoxIndirectA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ScreenToClient SendMessageA SendMessageTimeoutA SetClassLongA SetClipboardData SetCursor SetDlgItemTextA SetForegroundWindow SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow SystemParametersInfoA TrackPopupMenu wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

Name

.text

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

1024B

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

$PLUGINSDIR/GetVersion.dll

IMPHASH fb1aa2bbc159c94cb45792330366bd5f
SHA256 ecfcbe30f5b248673f9cbebb734b9981ed14b06380ea787c563d67b30e2d069e
MD5 225f776172f1baccd2721a6e5d512b36
SHA1 2dbbc86f7b0285682880a627b56a75de09f4bed6
SHA512 4b99a5ac68122501a5913cf54bd3ae99d851d57656b0e136980122739cceef739fa2d5ea097f2442068b9489a4c25ea0884653c41d85f27f25996792bf6c21bb
SSDEEP 192:MMr/9XGqK7s/AlHdJZBi46AQ5VuNxHA8/:MsXGqM93Bi46AQ5Vujg8/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

7247

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH 9ba9bc6867bc30d6e7600633f9cabe23
SHA256 30dc225ef4a4e084ee65c0912d07abdd939d5a49fb3fda535d6c41ac6b112f0b
MD5 da5be8a2066d67c93265dcd6a9c9dddf
SHA1 8fe968e27e259530dfb435511b1dbe4d167bfda4
SHA512 d7a98903adca16124c538a12ae912432d6ebc1874e9beaddf394004e96a33a58ab68f5f2e2771b83c56cfc53e05e314d4ab79d5c034459d7bcfd31090fd4bf97
SSDEEP 1536:8/fL6f67dFj7xWkdX+zHK7K2h9PORs7dR0h1UgDH40NF:8nL6f67dhxWW00tYwK1UgT46
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14216

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileA CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA EnterCriticalSection FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetSystemTimeAsFileTime GetTickCount GlobalAlloc GlobalFree InitializeCriticalSection InterlockedCompareExchange LeaveCriticalSection LoadLibraryA LoadLibraryW MulDiv QueryPerformanceCounter ReleaseSemaphore SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForSingleObject WriteFile lstrcatA lstrcmpiA lstrcpyA lstrcpynA lstrlenA

msvcrt

_write __dllonexit _amsg_exit _initterm _iob _lock _onexit _unlock _winmajor abort calloc fputc fputs free fwrite malloc memcmp memcpy realloc sprintf strcmp strcpy strlen strncmp vfprintf

user32

CallWindowProcA CharPrevA CreateWindowExA DestroyWindow EnableWindow FindWindowExA GetClientRect GetDlgItem GetFocus GetWindowLongA GetWindowRect IsWindowVisible RegisterWindowMessageA SendMessageA SetDlgItemTextA SetWindowLongA SetWindowTextA ShowWindow wsprintfA

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect gethostbyname getsockname htons inet_addr ioctlsocket recv select send shutdown socket

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

95B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/Processes.dll

IMPHASH f5edecae12589e705677a6e272ad0394
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

6899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 06e07a9e2c8ec78ec44f1a538a1bd2a2
SHA256 7298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
MD5 249ae678f0dac4c625c6de6aca53823a
SHA1 6ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA512 66e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7
SSDEEP 192:r/QeHNWSvUTfWdXw08LYKFaynLb3MRlbOVlR:7jBvwudT8LJxnnMRlyVlR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4406

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

108B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderDDLR.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER0.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER1.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER2.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderSTUB.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
MD5 c7f6ed56312c8fbb58ae6ed445c38df4
SHA1 e2dba94ef052db774478b9f7198c1a2298b334e5
SHA512 ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
SSDEEP 1536:tLXB65939tY6HBg4sXJhweErCi/S8qcy4PLv:tLk395hYXJh0C6jy4z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/NSISdl.dll

IMPHASH 9cce555dd3ff1b6c7dc92d64c794c51a
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

8903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/30602584caa012822e932dd66bc8dbe3/preinstaller.exe

IMPHASH dcd4f584cea06b9085635499b2756e76
SHA256 f33b7419880c7c90c999970e4c21febaaf6d39fdb02f9d9deafa8f8d97f3b3eb
MD5 9d8fe8bcc4c493b2fd1da8d2b07ba57c
SHA1 aa9366eb9210c8a5398b5e55921c92ce8970df5b
SHA512 3fd58a0d7c870e8b07eb17f8f088d505ad98c7101733972f486a2946d18babfe0e4866ae28a16fe2481e006c26cbdf2d3eb1a2dd71bb44c084bbf14fea475216
SSDEEP 6144:gLZpiirZUwURUebtBGVBpBwXVUTL7E97IkXQxBRUoz0iYvF:4NYEVjBwXVwM9vylz3YvF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

Major OS version

Entry point

4740

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

gdi32

CreateCompatibleBitmap CreateCompatibleDC CreateFontA DeleteDC DeleteObject GetStockObject SelectObject SetBkColor SetBkMode SetTextColor

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromStream GdipCreateFromHDC GdipDeleteGraphics GdipDisposeImage GdipDrawImageI GdipFree GdiplusShutdown GdiplusStartup

kernel32

AddAtomA CloseHandle CreateMutexA CreateSemaphoreA DeleteCriticalSection EnterCriticalSection ExitProcess FindAtomA FindResourceA GetAtomNameA GetCommandLineA GetCommandLineW GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitializeCriticalSection InterlockedDecrement InterlockedIncrement LeaveCriticalSection LoadResource LocalFree LockResource ReleaseMutex ReleaseSemaphore SetLastError SetUnhandledExceptionFilter SizeofResource Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WaitForSingleObject

msvcrt

_write __getmainargs __p__environ __p__fmode __set_app_type _assert _cexit _iob _onexit _setmode abort atexit calloc fputc fputs free fwrite malloc realloc signal sprintf strcmp strcpy vfprintf

ole32

CreateStreamOnHGlobal

shell32

CommandLineToArgvW SHBrowseForFolderA SHGetFolderPathA SHGetPathFromIDListA ShellExecuteA

user32

BeginPaint ClientToScreen CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA EndPaint GetCapture GetDC GetMessageA GetSystemMetrics LoadCursorA LoadIconA MessageBoxExA PostQuitMessage RegisterClassExA ReleaseCapture ReleaseDC SendMessageA SetCapture SetCursor SetTimer SetWindowLongA SetWindowPos SetWindowTextA ShowWindow TranslateMessage wsprintfA

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

45792a53cd23046281f8b5c5839250b7_JaffaCakes118

PE Signature issue

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

generic

$PLUGINSDIR/GetVersion.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

kernel32

msvcrt

user32

ws2_32

generic

$PLUGINSDIR/Processes.dll

kernel32

user32

generic

$PLUGINSDIR/nsExec.dll

advapi32

kernel32

user32

generic

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderDDLR.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER0.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/NSISdl.dll

kernel32

user32

advapi32

ws2_32

generic

$TEMP/30602584caa012822e932dd66bc8dbe3/downloaderOFFER1.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32