8b150e33b26ac19529d1a8fd7b9038bd_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8b150e33b26ac19529d1a8fd7b9038bd_JaffaCakes118
Size

3.1MB
MD5

8b150e33b26ac19529d1a8fd7b9038bd
SHA1

48e1b5c611cb6f69973aa6764b41f581b00e0060
SHA256

8205f034444dbed99ff0e975568b2ff26d7b00e96df2e5d1dbb617a26eec330b
SHA512

d5fe039dd1b29d1d666ab4a68eea45e9afaa9cafe57e3f81b35994a9aa88ead21acd1973e36fc08f81b608891e3dcf393627d09e6579983974e39c97de753c43
SSDEEP

98304:PKnE+TbRLtu4ICsYq2e4zUJiFIlyh67vCzOi:mEObRLtu4fs2VUYilly

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
8b150e33b26ac19529d1a8fd7b9038bd_JaffaCakes118
unpack001/$3/DjvuApp.exe
unpack001/$APPDATA/DjvuApp/DjvuApp/$APPDATA/DjvuApp/uninstaller.exe
unpack002/$PLUGINSDIR/nsProcess.dll
unpack001/$APPDATA/DjvuApp/DjvuApp/WinDjView.exe
unpack001/$PLUGINSDIR/nsProcess.dll

Files

8b150e33b26ac19529d1a8fd7b9038bd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

e2a592076b17ef8bfb48b7e03965a3fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW

advapi32

RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$3/DjvuApp.exe
.exe windows:5 windows x86 arch:x86

feb8561632d366d4d063e0cbbfa94c2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

ExpandEnvironmentStringsForUserW

shlwapi

AssocQueryStringW

advapi32

SystemFunction036
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW

kernel32

WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
Sleep
GetModuleFileNameW
WaitForSingleObject
LoadLibraryW
CreateThread
GetProcAddress
FreeLibrary
SleepEx
GetCurrentProcess
MultiByteToWideChar
IsWow64Process
InitializeSListHead
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetStringTypeW
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
CreateFileW
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
GetLastError
LoadLibraryExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapReAlloc
HeapFree
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
GetProcessHeap
GetFileType
CloseHandle
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 335KB - Virtual size: 334KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/DjvuApp/DjvuApp/$APPDATA/DjvuApp/uninstaller.exe
.exe windows:4 windows x86 arch:x86

e2a592076b17ef8bfb48b7e03965a3fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetCurrentDirectoryW
GetFileAttributesW
GetFullPathNameW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
MoveFileW
SetFileAttributesW
GetCurrentProcess
ExitProcess
SetEnvironmentVariableW
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
GetVersion
SetErrorMode
lstrlenW
WaitForSingleObject
CopyFileW
CompareFileTime
GlobalLock
CreateThread
GetLastError
CreateDirectoryW
CreateProcessW
RemoveDirectoryW
lstrcmpiA
CreateFileW
GetTempFileNameW
WriteFile
lstrcpyA
lstrcpyW
MoveFileExW
lstrcatW
GetSystemDirectoryW
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalAlloc
GetShortPathNameW
SearchPathW
lstrcmpiW
SetFileTime
CloseHandle
ExpandEnvironmentStringsW
lstrcmpW
GlobalUnlock
lstrcpynW
GetDiskFreeSpaceW
GetExitCodeProcess
FindFirstFileW
FindNextFileW
DeleteFileW
SetFilePointer
ReadFile
FindClose
MulDiv
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetPrivateProfileStringW
WritePrivateProfileStringW
FreeLibrary
LoadLibraryExW
GetModuleHandleW

user32

GetSystemMenu
SetClassLongW
IsWindowEnabled
EnableMenuItem
SetWindowPos
GetSysColor
GetWindowLongW
SetCursor
LoadCursorW
CheckDlgButton
GetMessagePos
LoadBitmapW
CallWindowProcW
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
wsprintfW
ScreenToClient
GetWindowRect
GetSystemMetrics
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharPrevW
CharNextA
wsprintfA
DispatchMessageW
PeekMessageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
LoadImageW
SetTimer
SetWindowTextW
PostQuitMessage
ShowWindow
GetDlgItem
IsWindow
SetWindowLongW
FindWindowExW
TrackPopupMenu
AppendMenuW
CreatePopupMenu
DrawTextW
EndPaint
CreateDialogParamW
SendMessageTimeoutW
SetForegroundWindow

gdi32

SelectObject
SetBkMode
CreateFontIndirectW
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW

advapi32

RegDeleteKeyW
SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyW

comctl32

ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$APPDATA/DjvuApp/DjvuApp/WinDjView.exe
.exe windows:5 windows x64 arch:x64

c16636ce08a6900ef67ddc0f3b449e5d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

shlwapi

PathStripPathW
PathCanonicalizeW
PathRemoveBackslashW
PathAppendW
PathRemoveFileSpecW
PathIsRelativeW
PathIsURLW
PathFileExistsW
PathFindFileNameW
PathFindExtensionW
PathRemoveExtensionW
PathRenameExtensionW
PathIsUNCW
PathStripToRootW
UrlUnescapeW
StrFormatKBSizeW

kernel32

AreFileApisANSI
GetSystemTimeAsFileTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDriveTypeW
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
HeapQueryInformation
SetStdHandle
GetFileType
GetSystemInfo
VirtualAlloc
VirtualQuery
GetStdHandle
GetStartupInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStringTypeW
IsValidCodePage
GetOEMCP
GetCPInfo
IsValidLocale
EnumSystemLocalesW
LCMapStringW
GetConsoleCP
GetConsoleMode
IsDebuggerPresent
SetFilePointerEx
GetTimeZoneInformation
OutputDebugStringW
WriteConsoleW
SizeofResource
LockResource
LoadResource
FindResourceW
GetLocaleInfoW
GetLastError
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CloseHandle
GetFullPathNameW
CreateEventW
ResetEvent
GetCurrentThread
GetThreadPriority
SetThreadPriority
WaitForSingleObject
SetEvent
GetACP
GetTickCount
FindFirstFileW
FindClose
FindNextFileW
GlobalAlloc
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetTempPathW
GetTempFileNameW
CreateFileW
CreateFileMappingW
GetVersionExW
MultiByteToWideChar
LoadLibraryW
GetProcAddress
FreeLibrary
GetCurrentProcessId
lstrlenW
lstrcpyW
lstrcmpiW
GetCurrentThreadId
MulDiv
GetModuleHandleW
FreeResource
GetCommandLineW
SearchPathW
GetProfileIntW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
FindResourceExW
GetCurrentDirectoryW
SetErrorMode
LocalFileTimeToFileTime
GetFileSizeEx
GetFileAttributesExW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
CompareStringW
FileTimeToSystemTime
FileTimeToLocalFileTime
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
VirtualProtect
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CompareStringA
lstrcmpA
ResumeThread
GetProfileStringW
ExitThread
CreateThread
CopyFileW
IsProcessorFeaturePresent
WaitForMultipleObjects
HeapReAlloc
HeapAlloc
GlobalFlags
GetThreadLocale
GetStringTypeExW
MoveFileW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetShortPathNameW
GetFileSize
FlushFileBuffers
DeleteFileW
GetUserDefaultLCID
SystemTimeToFileTime
ReplaceFileW
SetFileTime
GetDiskFreeSpaceW
GlobalGetAtomNameW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleExW
GetSystemDirectoryW
EncodePointer
OutputDebugStringA
SetLastError
FormatMessageW
LocalFree
GlobalSize
Sleep
GlobalFree
GetFullPathNameA
InitializeCriticalSection
CreateDirectoryW
GetFileTime
GetFileAttributesW
ExitProcess
lstrcpynW
GetModuleFileNameW
GlobalAddAtomW
DecodePointer
HeapSize
RaiseException
GetProcessHeap
HeapFree
ReadConsoleW

user32

GetWindowRgn
SubtractRect
GetUpdateRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
CharUpperBuffW
SetMenuDefaultItem
CopyIcon
GetDoubleClickTime
SetClassLongPtrW
SetCursorPos
DestroyAcceleratorTable
CreateAcceleratorTableW
GetKeyboardState
ToUnicodeEx
RegisterClipboardFormatW
MapVirtualKeyExW
IsCharLowerW
GetKeyboardLayout
MonitorFromPoint
UpdateLayeredWindow
IsMenu
DrawStateW
EnumDisplayMonitors
SetLayeredWindowAttributes
IsClipboardFormatAvailable
WaitMessage
LockWindowUpdate
GetMenuDefaultItem
NotifyWinEvent
HideCaret
EnableScrollBar
GetIconInfo
GetNextDlgGroupItem
CreateMenu
CopyAcceleratorTableW
PostThreadMessageW
GetTabbedTextExtentW
DrawIcon
GetSystemMenu
CopyImage
GetSysColorBrush
PostQuitMessage
TranslateMessage
GetMessageW
ShowOwnedPopups
RealChildWindowFromPoint
DestroyCursor
CharUpperW
DestroyIcon
InsertMenuItemW
CreatePopupMenu
TranslateAcceleratorW
LoadAcceleratorsW
GetMenuItemInfoW
FillRect
EndPaint
BeginPaint
GetWindowDC
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
SendDlgItemMessageA
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
IsDialogMessageW
SetWindowTextW
ScrollWindowEx
CheckDlgButton
MapVirtualKeyW
GetKeyNameTextW
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetLastActivePopup
GetClassNameW
GetClassLongPtrW
SetWindowLongW
MapWindowPoints
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
GetMenu
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
RemoveMenu
GetMenuState
GetMenuStringW
SetDlgItemTextW
MoveWindow
MapDialogRect
ShowWindow
CreateWindowExW
GetDlgItem
UnregisterClassW
FrameRect
SetParent
GetAsyncKeyState
ReleaseDC
GetDC
DrawIconEx
SetWindowRgn
AdjustWindowRectEx
SetScrollInfo
CallNextHookEx
SetFocus
UnhookWindowsHookEx
SetWindowsHookExW
IsWindowEnabled
LoadStringW
GetComboBoxInfo
GetCapture
SetRect
SetRectEmpty
DrawEdge
DrawFrameControl
DrawFocusRect
RedrawWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetMenu
DestroyMenu
DrawMenuBar
AppendMenuW
ReuseDDElParam
UnpackDDElParam
IsIconic
IsZoomed
LoadImageW
BringWindowToTop
GetWindowLongW
GetWindow
GetTopWindow
GetWindowThreadProcessId
SystemParametersInfoW
SetForegroundWindow
LoadIconW
GetKeyState
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
ShowCursor
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
IsWindow
IsWindowVisible
EqualRect
UnionRect
MessageBeep
IsChild
WindowFromPoint
GetScrollInfo
KillTimer
PostMessageW
ClientToScreen
TrackMouseEvent
ReleaseCapture
SetCapture
SetCursor
LoadCursorW
ScreenToClient
GetCursorPos
UpdateWindow
DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjects
GetParent
InvalidateRect
SetTimer
IsRectEmpty
GetSysColor
InflateRect
GetFocus
InvertRect
OffsetRect
IntersectRect
DeleteMenu
GetMenuItemCount
InsertMenuW
GetMenuItemID
TrackPopupMenuEx
CheckMenuItem
ModifyMenuW
CopyRect
EnableMenuItem
GetSubMenu
LoadMenuW
PtInRect
LoadBitmapW
GetClientRect
GetSystemMetrics
GetWindowRect
SendMessageW
EnableWindow
ValidateRect

gdi32

CreateHatchBrush
CreatePen
CreatePatternBrush
CreateSolidBrush
ExcludeClipRect
GetClipBox
GetCurrentPositionEx
GetObjectType
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextCharacterExtra
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetViewportOrgEx
SetRectRgn
CreateFontW
GetCharWidthW
CreateRectRgnIndirect
CreateEllipticRgn
Ellipse
LPtoDP
GetROP2
GetBkMode
GetTextMetricsW
GetNearestColor
GetPolyFillMode
GetStretchBltMode
GetTextAlign
GetTextColor
GetWindowOrgEx
GetTextFaceW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
StretchBlt
SetDIBColorTable
CreatePolygonRgn
GetRgnBox
OffsetRgn
CreateRoundRectRgn
RoundRect
FrameRgn
PtInRegion
SetPixelV
ExtFloodFill
SetPaletteEntries
FillRgn
GetBoundsRect
CreateBitmap
OffsetWindowOrgEx
PatBlt
SetTextColor
SetBkColor
CopyMetaFileW
GdiFlush
DPtoLP
Polygon
SetPixel
Polyline
Arc
StretchDIBits
CreateCompatibleDC
CreateDIBSection
EndPath
ExtTextOutW
GetTextExtentPoint32W
BeginPath
SelectObject
CreateFontIndirectW
DeleteDC
CreateCompatibleBitmap
CombineRgn
GetPixel
CreateRectRgn
Rectangle
GetStockObject
Escape
TextOutW
RectVisible
PtVisible
EndDoc
EndPage
StartPage
AbortDoc
StartDocW
CreateDCW
GetObjectW
BitBlt
GetDeviceCaps
GetBkColor
DeleteObject
CreateICW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

winspool.drv

DocumentPropertiesW
DeviceCapabilitiesW
OpenPrinterW
ClosePrinter
GetPrinterW
EnumPrintersW

advapi32

RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegEnumValueW
RegCreateKeyExW
RegEnumKeyW
SetFileSecurityW
GetFileSecurityW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyW
RegSetValueExW
RegQueryValueExW
RegSetValueW
RegQueryValueW

shell32

SHAddToRecentDocs
ShellExecuteW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
DragAcceptFiles
SHChangeNotify
ShellExecuteExW
DragQueryFileW
DragFinish
SHGetFileInfoW
ExtractIconW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage

comctl32

ImageList_Draw
ImageList_GetIconSize
ImageList_AddMasked
ord17

uxtheme

IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
IsAppThemed
DrawThemeParentBackground
DrawThemeText
GetThemeColor

ole32

OleDuplicateData
ReleaseStgMedium
CoCreateGuid
CoCreateInstance
CoInitialize
CoDisconnectObject
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
RevokeDragDrop
RegisterDragDrop
DoDragDrop
OleLockRunning
CoLockObjectExternal
CoInitializeEx
CoUninitialize
CreateStreamOnHGlobal
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
OleGetClipboard

oleaut32

LoadTypeLi
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
OleLoadPicture

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

wininet

InternetCanonicalizeUrlW
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetSetStatusCallbackW
InternetGetLastResponseInfoW
InternetSetOptionExW
InternetQueryOptionW
InternetCrackUrlW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

msimg32

TransparentBlt
AlphaBlend

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1009KB - Virtual size: 1008KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsProcess.dll
.dll windows:5 windows x86 arch:x86

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
OpenProcess
MultiByteToWideChar
lstrlenA
lstrlenW
LoadLibraryA
lstrcmpiW
lstrcpynW
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetVersionExW
GlobalFree
GlobalAlloc

user32

GetWindowThreadProcessId
EnumWindows
wsprintfW
PostMessageW

Exports

Exports

_CloseProcess
_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 927B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2a592076b17ef8bfb48b7e03965a3fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1KB - Virtual size: 171KB

.ndata Size: - Virtual size: 64KB

.rsrc Size: 4KB - Virtual size: 3KB

feb8561632d366d4d063e0cbbfa94c2f

Headers

DLL Characteristics

File Characteristics

Imports

userenv

shlwapi

advapi32

shell32

kernel32

Sections

.text Size: 81KB - Virtual size: 80KB

.rdata Size: 335KB - Virtual size: 334KB

.data Size: 2KB - Virtual size: 6KB

.gfids Size: 512B - Virtual size: 336B

.rsrc Size: 134KB - Virtual size: 133KB

.reloc Size: 7KB - Virtual size: 6KB

e2a592076b17ef8bfb48b7e03965a3fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 1KB - Virtual size: 171KB

.ndata Size: - Virtual size: 64KB

.rsrc Size: 4KB - Virtual size: 3KB

439074d1c01f7b16781bdf060930814a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 927B

.data Size: - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 512B - Virtual size: 254B

c16636ce08a6900ef67ddc0f3b449e5d

Headers

DLL Characteristics

File Characteristics

Imports

version

shlwapi

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 171KB

.ndata
Size: - Virtual size: 64KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 81KB - Virtual size: 80KB

.rdata
Size: 335KB - Virtual size: 334KB

.data
Size: 2KB - Virtual size: 6KB

.gfids
Size: 512B - Virtual size: 336B

.rsrc
Size: 134KB - Virtual size: 133KB

.reloc
Size: 7KB - Virtual size: 6KB

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 1KB - Virtual size: 171KB

.ndata
Size: - Virtual size: 64KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 927B

.data
Size: - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 254B

.text
Size: 2.9MB - Virtual size: 2.9MB

.rdata
Size: 1009KB - Virtual size: 1008KB

.data
Size: 39KB - Virtual size: 111KB

.pdata
Size: 131KB - Virtual size: 131KB

.rsrc
Size: 175KB - Virtual size: 174KB

.reloc
Size: 73KB - Virtual size: 72KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 927B

.data
Size: - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 512B - Virtual size: 254B