53db0ead82fc24fb57c39ee6b05ef1ba_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

53db0ead82fc24fb57c39ee6b05ef1ba_JaffaCakes118
Size

2.8MB
MD5

53db0ead82fc24fb57c39ee6b05ef1ba
SHA1

91babc6c22ea181ca71d054abf6be1ae8d06a6b3
SHA256

f0dadff29d683f39bf3ed8caf04a02532029d518c9f911a35b7bd29d7c84030a
SHA512

5c465292a544dba73a009576374433c1ce54d545c027faec5cef1735ce8bc55ad1ba9118786e646988af242ee9f5aca5dcdd6b8b1b3242094e1647a465db90f7
SSDEEP

49152:Ia/AmKNQbuZ89z6X7QJih0eUptUZh/ahUIYIEwrBrT+Fl/u6FGWEWX9wm8bsmD:IeVXuCQ7Cih0eUptUzyL5EmpT+7/rFGL

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/KospArsivi_seriMinor_Combo_MultiKo_/1733 Multi Client/MultiClient.exe
unpack001/KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/Koxp Frmstar.com.exe
unpack001/KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/Project1.exe
unpack001/KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/Seri Minor.exe
unpack001/KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/dinput8.dll

Files

53db0ead82fc24fb57c39ee6b05ef1ba_JaffaCakes118
.rar
KospArsivi_seriMinor_Combo_MultiKo_/1733 Multi Client/MultiClient.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KospArsivi_seriMinor_Combo_MultiKo_/1733 Multi Client/Settings.ini
KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/Koxp Frmstar.com.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/ProcessExplorer.zip
.zip
Eula.txt
procexp.chm
.chm
procexp.exe
.exe windows:5 windows x86 arch:x86

2babbdb0f47a25d9e8c4c0c241bdf7f3

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:64:0f:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/01/2009, 01:58

Not After

20/03/2010, 02:08

Subject

CN=Microsoft Corporation,OU=AOC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6e:e0:76:b4:fe:d9:a8:da:f5:71:80:58:fe:9b:bc:57:c4:0a:ae:23
Signer

Actual PE Digest

6e:e0:76:b4:fe:d9:a8:da:f5:71:80:58:fe:9b:bc:57:c4:0a:ae:23

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\ProcExp\exe\Release\procexp.pdb

Imports

ws2_32

getservbyport
htons
ntohs
ntohl
WSAStartup
gethostbyaddr
htonl

mpr

WNetGetConnectionA

comctl32

ImageList_ReplaceIcon
ImageList_DrawEx
ImageList_Destroy
InitCommonControlsEx
CreateToolbarEx
CreatePropertySheetPageA
ord6
ImageList_Create
ord17
PropertySheetA

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

kernel32

GetLocaleInfoA
FormatMessageA
OutputDebugStringA
TerminateProcess
GetProcessWorkingSetSize
DeviceIoControl
GetDriveTypeA
GetCurrentDirectoryA
GetFileTime
GetExitCodeThread
TerminateThread
DuplicateHandle
VirtualFree
VirtualAlloc
GetPriorityClass
GetThreadContext
ResetEvent
MultiByteToWideChar
GlobalAddAtomA
GetSystemInfo
InterlockedExchange
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
QueryPerformanceCounter
GetEnvironmentStringsW
SetProcessWorkingSetSize
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
HeapSize
GetConsoleMode
GetConsoleCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
HeapDestroy
HeapCreate
FatalAppExitA
GetStartupInfoA
GetCurrentThreadId
RaiseException
HeapReAlloc
RtlUnwind
CreateThread
ResumeThread
ExitThread
lstrlenW
GlobalReAlloc
GlobalLock
GlobalAlloc
GlobalUnlock
CreateEventA
SetEnvironmentVariableA
FindFirstFileA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
FindClose
SetPriorityClass
GetCurrentProcessId
SetErrorMode
WaitForMultipleObjects
GlobalMemoryStatus
PulseEvent
CreateFileMappingA
MapViewOfFile
IsBadReadPtr
UnmapViewOfFile
FreeLibrary
ReadFile
SetFilePointer
OpenProcess
VirtualQueryEx
ReadProcessMemory
GetCommandLineA
DeleteFileA
WaitForSingleObject
GetCurrentThread
SetThreadAffinityMask
Sleep
GetProcessAffinityMask
GetSystemDirectoryA
GetVersion
lstrcpynA
WideCharToMultiByte
GetNumberFormatA
GetFileAttributesA
SearchPathA
ExpandEnvironmentStringsA
CreateProcessA
MulDiv
GetEnvironmentVariableA
lstrcmpiA
lstrcmpA
SetEvent
GetDateFormatA
InterlockedDecrement
GetProcessHeap
HeapAlloc
lstrcpyA
HeapFree
lstrcatA
GetTickCount
InterlockedIncrement
OpenEventA
GetCommandLineW
LoadLibraryA
GetModuleHandleA
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
CloseHandle
IsBadStringPtrA
lstrlenA
InitializeCriticalSection
GetSystemTimeAsFileTime
DeleteCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTimeFormatA
EnterCriticalSection
LeaveCriticalSection
GetLastError
LocalFree
LocalAlloc
GetModuleFileNameA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetLocaleInfoW
GetTimeZoneInformation
SetEndOfFile
CompareStringA
CompareStringW
FreeEnvironmentStringsW
GetUserDefaultLCID

user32

CheckRadioButton
GetKeyState
SetUserObjectSecurity
GetUserObjectSecurity
GetWindow
SendMessageTimeoutA
GetDlgCtrlID
EnumWindows
RegisterWindowMessageA
CreateMenu
RemoveMenu
DrawMenuBar
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
ExitWindowsEx
RedrawWindow
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
TranslateMessage
IsDialogMessageA
DispatchMessageA
CreateDialogParamA
ReleaseCapture
GetDlgItemTextA
CheckMenuRadioItem
CheckMenuItem
PostQuitMessage
DrawIconEx
LoadMenuA
InsertMenuA
TrackPopupMenu
GetCapture
SetCapture
DrawEdge
DrawFrameControl
BeginDeferWindowPos
EnumChildWindows
MsgWaitForMultipleObjects
UnionRect
GetClassNameA
DeferWindowPos
wsprintfA
IsZoomed
GetMenuCheckMarkDimensions
SetForegroundWindow
GetDesktopWindow
FindWindowExA
IsIconic
GetWindowThreadProcessId
GetWindowDC
SetMenuItemInfoA
SetClassLongA
SetPropA
FillRect
CallWindowProcA
GetWindowTextA
DeleteMenu
EnableWindow
CheckDlgButton
IsDlgButtonChecked
GetWindowPlacement
ModifyMenuA
OffsetRect
CreatePopupMenu
TrackPopupMenuEx
AppendMenuA
GetMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
EnableMenuItem
GetPropA
DestroyIcon
FrameRect
GetDoubleClickTime
ScreenToClient
InvalidateRgn
MessageBoxA
PeekMessageA
ScrollWindowEx
SetScrollInfo
GetScrollInfo
IntersectRect
GetUpdateRgn
GetClassLongA
EndDeferWindowPos
SetFocus
SetTimer
GetCursorPos
PtInRect
WindowFromPoint
KillTimer
LoadStringA
LoadIconA
LoadImageA
RegisterClassExA
RegisterClassA
FindWindowA
PostMessageA
SetWindowPlacement
UpdateWindow
DialogBoxIndirectParamA
SetWindowTextA
InflateRect
SendMessageA
DefDlgProcA
DefFrameProcA
DefMDIChildProcA
GetWindowLongA
SetWindowLongA
BeginPaint
EndPaint
ShowWindow
ClientToScreen
GetSystemMetrics
SystemParametersInfoA
SetWindowPos
DefWindowProcA
GetClientRect
CreateIconIndirect
MapWindowPoints
DestroyWindow
CreateWindowExA
GetParent
IsWindowVisible
GetFocus
DrawTextA
GetDC
ReleaseDC
DialogBoxParamA
EndDialog
GetDlgItem
GetWindowRect
MoveWindow
SetDlgItemTextA
LoadCursorA
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
ShowWindowAsync

gdi32

CreateCompatibleBitmap
LineTo
SaveDC
SetROP2
CreatePen
Rectangle
RestoreDC
SetTextAlign
ExtTextOutA
GetTextExtentPoint32A
MoveToEx
GetTextMetricsA
EndPage
Polyline
GetBkColor
SelectClipRgn
CreateRectRgnIndirect
RectInRegion
CreateRectRgn
Ellipse
SelectObject
SetTextColor
CreateSolidBrush
GetDeviceCaps
SetMapMode
StartDocA
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
EndDoc
SetBkColor
BitBlt
CreateDIBSection
CreateCompatibleDC
DeleteDC
DeleteObject
StartPage

comdlg32

GetOpenFileNameA
ChooseColorA
GetSaveFileNameA
FindTextA
ChooseFontA
PrintDlgA

advapi32

SetServiceObjectSecurity
LookupAccountNameA
LookupPrivilegeNameA
IsValidSecurityDescriptor
SetKernelObjectSecurity
GetKernelObjectSecurity
OpenSCManagerA
QueryServiceStatus
CloseServiceHandle
StartServiceA
ControlService
CreateProcessAsUserA
RegConnectRegistryA
AllocateAndInitializeSid
SetTokenInformation
GetSecurityInfo
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
SetSecurityInfo
FreeSid
LookupPrivilegeValueW
GetTokenInformation
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
EqualSid
LookupAccountSidA
GetLengthSid
CopySid
RegEnumValueA
OpenServiceA
QueryServiceConfigA
RegOpenKeyA
RegCreateKeyExA
RegDeleteValueA
RegCreateKeyA
RegSetValueExA
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
MapGenericMask
QueryServiceObjectSecurity

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteExA
Shell_NotifyIconA
ShellExecuteA
SHGetFileInfoA

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
VariantInit
SysAllocStringByteLen
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo

Sections

.text
Size: 462KB - Virtual size: 461KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KospArsivi_seriMinor_Combo_MultiKo_/Game Hacker v1733/kullanım kılavuzu.txt
KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/Project1.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/Settings.ini
KospArsivi_seriMinor_Combo_MultiKo_/Kobot 1733/SkillKodlari.txt
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/Seri Minor.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 64KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KospArsivi_seriMinor_Combo_MultiKo_/combo-seri minor/dinput8.dll
.dll regsvr32 windows:5 windows x86 arch:x86

0f59d0be33614ade19fa8de73d0b9e82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

dinput8.pdb

Imports

msvcrt

malloc
free
strchr
iswctype
towupper
_wsplitpath
_snwprintf
_wcsnicmp
_ftol
_except_handler3

kernel32

LeaveCriticalSection
SetEvent
DeleteCriticalSection
ResetEvent
WideCharToMultiByte
GetCurrentProcessId
IsBadReadPtr
IsBadWritePtr
lstrcpyW
lstrcmpW
FreeLibraryAndExitThread
WaitForSingleObject
FreeLibrary
GetLastError
WaitForMultipleObjects
SetThreadPriority
CreateThread
CreateEventW
LoadLibraryW
GetTickCount
lstrcmpiW
ReadFileEx
DuplicateHandle
GetCurrentProcess
LoadLibraryExW
ReleaseMutex
MulDiv
EnterCriticalSection
LocalAlloc
LocalReAlloc
SleepEx
ResumeThread
GetProcAddress
DisableThreadLibraryCalls
UnmapViewOfFile
MultiByteToWideChar
lstrlenA
IsBadCodePtr
CompareFileTime
lstrcpynW
GetSystemDirectoryW
GetPrivateProfileStringW
GetWindowsDirectoryW
WriteFileEx
Sleep
DeviceIoControl
SystemTimeToFileTime
GetLocalTime
HeapFree
HeapAlloc
GetProcessHeap
MapViewOfFile
CreateFileMappingW
CreateMutexW
LoadResource
FindResourceW
CreateProcessW
InitializeCriticalSection
GetVersionExW
CreateFileA
GetFullPathNameA
QueryPerformanceCounter
TerminateProcess
GetCurrentThreadId
SetUnhandledExceptionFilter
lstrlenW
GetSystemTimeAsFileTime
CreateFileW
ReadFile
SetFilePointer
GetFileSize
CloseHandle
GetModuleHandleW
GetModuleFileNameW
GetFullPathNameW
InterlockedExchange
LocalFree
InterlockedDecrement
InterlockedIncrement
GetVersion
UnhandledExceptionFilter

advapi32

SetEntriesInAclW
GetSecurityInfo
RegEnumValueW
RegDeleteKeyW
GetUserNameW
RegCreateKeyExW
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAceEx
SetSecurityDescriptorControl
FreeSid
RegEnumKeyExW
RegSetKeySecurity
RegCreateKeyW
RegOpenKeyW
RegQueryValueW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl

user32

CallWindowProcW
IsWindow
ToUnicodeEx
MapVirtualKeyExW
GetKeyboardLayout
GetActiveWindow
GetKeyNameTextW
GetKeyboardType
GetRawInputDeviceInfoW
GetRawInputDeviceList
PostMessageW
wsprintfW
CharUpperW
UnhookWindowsHookEx
GetWindowThreadProcessId
IsIconic
GetForegroundWindow
GetWindowLongW
CallNextHookEx
SetWindowsHookExW
PostThreadMessageW
MsgWaitForMultipleObjects
DefWindowProcW
CreateWindowExW
RegisterClassW
LoadIconW
LoadCursorW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
SetTimer
GetInputState
SystemParametersInfoW
IntersectRect
GetWindowRect
GetDesktopWindow
MapWindowPoints
GetClientRect
ReleaseCapture
SetCursorPos
mouse_event
GetAsyncKeyState
SetCapture
ClipCursor
ShowCursor
GetMessageTime
SendNotifyMessageW
GetCursorPos
GetSystemMetrics
MapVirtualKeyW
LoadStringW
keybd_event
IsRectEmpty
SubtractRect
RegisterWindowMessageW
SetWindowLongW
GetPropW
SetPropW
RemovePropW

Exports

Exports

DirectInput8Create
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

.text Size: 64KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 24KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 72KB - Virtual size: 72KB

Headers

File Characteristics

Sections

.text Size: 64KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 24KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 72KB - Virtual size: 72KB

2babbdb0f47a25d9e8c4c0c241bdf7f3

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:01:64:0f:00:00:00:00:00:0bCertificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

6e:e0:76:b4:fe:d9:a8:da:f5:71:80:58:fe:9b:bc:57:c4:0a:ae:23Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

mpr

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 462KB - Virtual size: 461KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 17KB - Virtual size: 137KB

.rsrc Size: 2.8MB - Virtual size: 2.8MB

.reloc Size: 37KB - Virtual size: 37KB

Headers

File Characteristics

Sections

.text Size: 64KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 24KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 72KB - Virtual size: 72KB

Headers

File Characteristics

Sections

.text Size: 64KB - Virtual size: 68KB

.data Size: 2KB - Virtual size: 24KB

.idata Size: 3KB - Virtual size: 4KB

.rsrc Size: 12KB - Virtual size: 12KB

0f59d0be33614ade19fa8de73d0b9e82

Headers

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

.text
Size: 64KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 24KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 72KB - Virtual size: 72KB

.text
Size: 64KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 24KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 72KB - Virtual size: 72KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:64:0f:00:00:00:00:00:0b
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

6e:e0:76:b4:fe:d9:a8:da:f5:71:80:58:fe:9b:bc:57:c4:0a:ae:23
Signer

.text
Size: 462KB - Virtual size: 461KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 17KB - Virtual size: 137KB

.rsrc
Size: 2.8MB - Virtual size: 2.8MB

.reloc
Size: 37KB - Virtual size: 37KB

.text
Size: 64KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 24KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 72KB - Virtual size: 72KB

.text
Size: 64KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 24KB

.idata
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 12KB - Virtual size: 12KB

.text
Size: 137KB - Virtual size: 137KB

.data
Size: 1KB - Virtual size: 38KB

.rsrc
Size: 34KB - Virtual size: 33KB

.reloc
Size: 6KB - Virtual size: 6KB