56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118
Size 1.1MB
Sample241018-l4vnvstdml
SHA256 72099e272dfcf2052747b328f73624adb9dbb108df44e44d906d75d2d0ebfbcf
MD5 56d65e0bb8b89e73cddb9219f375f70f
SHA1 020a964491608b673d8dc31fe16231f25aa8568b
SHA512 70e84d83f33cdd853f071849f60686aaf3cca39e98de7465e40319dbbf0b7d70b4c6da395e42b9ae4a37f83931aa5e8bb537c9810b9ed3dc56ccb5edade16c01
SSDEEP 24576:x890qAplMw3u1QOAc0cHdCBOD8iWjwIYFWAx10wcbbX0QoKXWvj1LL2/ZvL:x8kpVeaOAcSovWF69xujbbkQ21GR
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 15 IoCs

Checks for missing Authenticode signature.

resource
56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118
unpack001/$PLUGINSDIR/Base64.dll
unpack001/$PLUGINSDIR/BrandingURL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/blowfish.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/ExtMenu.fnr
unpack001/HtmlView.fne
unpack001/dp1.fne
unpack001/eAPI.fne
unpack001/iconv.fne
unpack001/iext.fnr
unpack001/iext2.fne
unpack001/iext3.fne

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118

.exe 1.1MB
$PLUGINSDIR/Base64.dll

.dll 4KB
$PLUGINSDIR/BrandingURL.dll

.dll 4KB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/blowfish.dll

.dll 22KB
$PLUGINSDIR/inetc.dll

.dll 20KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

141KB
ExtMenu.fnr

.dll 188KB
HtmlView.fne

.dll 224KB
dp1.fne

.dll 128KB
eAPI.fne

.dll 332KB
iconv.fne

.dll 916KB
iext.fnr

.dll 216KB
iext2.fne

.dll 480KB
iext3.fne

.dll 129KB

56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 72099e272dfcf2052747b328f73624adb9dbb108df44e44d906d75d2d0ebfbcf
MD5 56d65e0bb8b89e73cddb9219f375f70f
SHA1 020a964491608b673d8dc31fe16231f25aa8568b
SHA512 70e84d83f33cdd853f071849f60686aaf3cca39e98de7465e40319dbbf0b7d70b4c6da395e42b9ae4a37f83931aa5e8bb537c9810b9ed3dc56ccb5edade16c01
SSDEEP 24576:x890qAplMw3u1QOAc0cHdCBOD8iWjwIYFWAx10wcbbX0QoKXWvj1LL2/ZvL:x8kpVeaOAcSovWF69xujbbkQ21GR
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Base64.dll

IMPHASH 1ba6926a1ee4e4cda118768081f528d5
SHA256 7c688940e73022bf526f07cc922a631a1b1db78a19439af6bafbff2a3b46d554
MD5 f0e3845fefd227d7f1101850410ec849
SHA1 3067203fafd4237be0c186ddab7029dfcbdfb53e
SHA512 584ae5a0d1c1639ba4e2187d0c8a0ac7e54c0be0a266029c4689d81c0c64a7f80e7d918da0df5c6344f9f7a114f30d8f2feda253b29e813bae086604731a3d8a
SSDEEP 48:SxSrr7xd14m4bLKwvnvcfDw1hEiauGkDVK+hIg4qT9/3lt:zr7xd14m4qw/vGwrEickDVthcE/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/BrandingURL.dll

IMPHASH 135de77644e2add2fd9dd8176740e7e0
SHA256 bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e
MD5 71c46b663baa92ad941388d082af97e7
SHA1 5a9fcce065366a526d75cc5ded9aade7cadd6421
SHA512 5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 8e287326f1cdd5ef2dcd7a72537c68cbe4299ceb1f820707c5820f3aa6d8206c
MD5 0dc0cc7a6d9db685bf05a7e5f3ea4781
SHA1 5d8b6268eeec9d8d904bc9d988a4b588b392213f
SHA512 814dd17ebb434f4a3356f716c783ab7f569f9ee34ce5274fa50392526925f044798f8006198ac7afe3d1c2ca83a2ca8c472ca53fec5f12bbfbbe0707abacd6b0
SSDEEP 192:n6d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jPK72dwF7dBEnbok:n6UdHXcIiY535zBt2jP+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/blowfish.dll

SHA256 053b4487d22aacf8274bab448ae1d665fe7926102197b47bfba6c7ed5493b3ae
MD5 5afd4a9b7e69e7c6e312b2ce4040394a
SHA1 fbd07adb3f02f866dc3a327a86b0f319d4a94502
SHA512 f78efe9d1fa7d2ffc731d5f878f81e4dcbfaf0c561fdfbf4c133ba2ce1366c95c4672d67cae6a8bd8fcc7d04861a9da389d98361055ac46fc9793828d9776511
SSDEEP 384:yTxz0Cv0hqd+1TjQmd9YWrSUEc//////OD5hF92IJpJgLa0MpoYfAz6S:jCvsqdS3QGBREc//////Q53NgLa1ub
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

17508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1024B

Virtual Size

906B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

89B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

880B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/inetc.dll

IMPHASH 3f1149a3053980fe6b461521d2b55a2c
SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
MD5 50fdadda3e993688401f6f1108fabdb4
SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

14255

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow PostMessageA SetWindowTextA GetWindowTextA IsWindow GetDlgItem SetDlgItemTextA SendDlgItemMessageA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA SetWindowLongA GetWindowLongA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

ExtMenu.fnr

IMPHASH 472b95d04dba8e53958d2b826a76dce5
SHA256 d9adbf90d193cd79cbad1ded212c7735fcc2c32d891fbe7150794f5369244148
MD5 577f423d02d07989ad3cdf27a2032181
SHA1 40fce5f17a93e5710a0968d74c81e32261002d6e
SHA512 ca1fe211bbc93534071db278a474daab2b9b28dc8f5be25ab823de508503d13dc38bf92ce93faa9a545f663e317356d824c2c55726bf96ccd06e73b0bbdb114c
SSDEEP 3072:Rp5dvKS5bulYocgdy3el3comKi89FNozPmdyjxN:LDKhcgNpj1pdQX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

44992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

TerminateProcess HeapSize GetTimeZoneInformation GetACP GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA ExitProcess GetEnvironmentStrings GetEnvironmentStringsW SetUnhandledExceptionFilter LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA RaiseException GetCommandLineA RtlUnwind WritePrivateProfileStringA FileTimeToLocalFileTime FileTimeToSystemTime GetOEMCP GetCPInfo GetProcessVersion GlobalFlags SetErrorMode TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc GlobalFree LocalFree GlobalAlloc GetCurrentThread WideCharToMultiByte InterlockedDecrement InterlockedIncrement GetFileTime GetFileSize GetFileAttributesA GetModuleFileNameA GetFullPathNameA lstrcpynA GetVolumeInformationA FindFirstFileA FindClose MultiByteToWideChar SetEndOfFile UnlockFile LockFile CloseHandle FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA DuplicateHandle GetLastError lstrlenA lstrcmpA GlobalLock SetLastError LoadLibraryA FreeLibrary lstrcatA GetCurrentThreadId GlobalGetAtomNameA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcpyA GetModuleHandleA GetProcAddress GetVersion GetVersionExA HeapFree HeapReAlloc GetProcessHeap HeapAlloc GlobalUnlock GlobalReAlloc GetCurrentProcess FlushInstructionCache FreeEnvironmentStringsW

user32

SetWindowTextA ShowWindow IsWindowEnabled CharUpperA SetCursor ValidateRect GetActiveWindow TranslateMessage GetMessageA GetNextDlgTabItem EnableMenuItem CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState GetMenuCheckMarkDimensions UnregisterClassA GetClassNameA DestroyMenu LoadStringA LoadIconA MapWindowPoints PeekMessageA DispatchMessageA GetFocus SetFocus AdjustWindowRectEx GetTopWindow WinHelpA wsprintfA GetClassInfoA RegisterClassA GetDlgItem GetWindowTextA GetDlgCtrlID GetKeyState DestroyWindow CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA UnhookWindowsHookEx DefWindowProcA GetMessageTime GetLastActivePopup GetForegroundWindow SetForegroundWindow GetWindow SetWindowPos RegisterWindowMessageA IsIconic GetWindowPlacement GrayStringA DrawTextA TabbedTextOutA FillRect WindowFromDC GetWindowLongA SystemParametersInfoA LoadBitmapA GetDesktopWindow GetDC IsMenu GetMenuItemID CopyRect OffsetRect MessageBoxA PostQuitMessage GetMenuItemRect GetWindowRect PtInRect KillTimer GetSubMenu GetMenuItemCount GetMenu ReleaseDC SendMessageA GetMenuItemInfoA DrawMenuBar RemovePropA SetTimer CallWindowProcA GetClientRect ClientToScreen GetCursorPos GetPropA SetWindowLongA GetCapture SetPropA EnableWindow GetSystemMetrics GetSysColor GetParent IsWindowVisible PostMessageA GetSysColorBrush LoadCursorA GetWindowDC GetMessagePos

gdi32

SetBkMode SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowOrgEx SetWindowExtEx ScaleWindowExtEx MoveToEx LineTo GetTextExtentPoint32A GetStockObject GetDeviceCaps CreatePen RestoreDC SaveDC Escape ExtTextOutA TextOutA RectVisible PtVisible SetPixelV GetPixel GetClipBox CreateBitmap CreateCompatibleDC SelectObject BitBlt StretchBlt SetBkColor SetTextColor CreateSolidBrush DeleteObject GetObjectA CreateFontIndirectA CreateCompatibleBitmap DeleteDC

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegCloseKey

comctl32

ord17 ImageList_GetImageCount ImageList_GetImageInfo ImageList_Destroy ImageList_Read ImageList_Draw ImageList_Duplicate

HtmlView.fne

IMPHASH 4dd740d34ccc499f7834e48dc7fd30a4
SHA256 5aa45b6024eae73a509041d0e532afef7a4a7fb5fb7e5efce29ff04313a6977e
MD5 5de3e6de5001ba45853c1824babe0774
SHA1 ce238d98ad066e53810e5872168bc84fc4f325cf
SHA512 3b9945f6671c47cad49ab7e43ee24e430e3ce1b4d761604246c69aea9f4b8449a3133e8a7c8cf9f851e99525e7deedac414381a86f4d95faa80a471b7cb209db
SSDEEP 3072:hlxzJamYkzqUcF3Qg2gEVkzNJNg9IN1EkrL7cDJkwrctohVoPNr35OA+9u+X:dYicF3QuEVkX1pCsgFX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

45779

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapSize GetACP SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate VirtualFree SetUnhandledExceptionFilter VirtualAlloc TerminateProcess LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA ExitProcess GetTimeZoneInformation HeapFree HeapReAlloc HeapAlloc RaiseException GetCommandLineA RtlUnwind GetTickCount WritePrivateProfileStringA FormatMessageA GetFileTime GetFileSize GetFileAttributesA GetOEMCP GetCPInfo GlobalFlags GetProcessVersion SetErrorMode TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc GetCurrentThread FileTimeToLocalFileTime FileTimeToSystemTime WideCharToMultiByte InterlockedDecrement InterlockedIncrement SetLastError GetModuleFileNameA GetThreadLocale GetFullPathNameA lstrcpynA GetVolumeInformationA FindFirstFileA FindClose MultiByteToWideChar SetEndOfFile UnlockFile LockFile CloseHandle FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetLastError lstrcmpA GlobalFree GlobalAlloc GlobalLock LoadLibraryA FreeLibrary FindResourceA LoadResource LockResource GetVersion lstrcatA GetCurrentThreadId GlobalGetAtomNameA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom lstrcpyA GetModuleHandleA GetProcAddress MulDiv lstrlenA GlobalUnlock IsBadWritePtr GlobalReAlloc

user32

MessageBeep GetNextDlgGroupItem SetRect CopyAcceleratorTableA LoadStringA DestroyMenu GetDesktopWindow PtInRect GetClassNameA GetSysColorBrush UnregisterClassA GetMessageA TranslateMessage GetActiveWindow ValidateRect GetCursorPos SetCursor PostQuitMessage MapDialogRect SetWindowContextHelpId CharNextA GrayStringA DrawTextA TabbedTextOutA GetWindowDC ClientToScreen GetDC ReleaseDC IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA CharUpperA LoadIconA PostMessageA UpdateWindow SendDlgItemMessageA MapWindowPoints PeekMessageA DispatchMessageA SetActiveWindow SetFocus AdjustWindowRectEx CopyRect PostThreadMessageA GetTopWindow MessageBoxA IsChild GetSysColor SetWindowLongA GetWindowLongA IsWindow GetClientRect LoadCursorA wsprintfA EnableWindow GetCapture WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetDlgItem GetWindowTextA EndDialog CreateDialogIndirectParamA GetDlgCtrlID GetKeyState DestroyWindow CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA GetNextDlgTabItem GetParent GetFocus EnableMenuItem SendMessageA CheckMenuItem SetMenuItemBitmaps ModifyMenuA GetMenuState LoadBitmapA GetMenuCheckMarkDimensions GetSystemMetrics GetWindowRect GetWindowPlacement IsIconic SystemParametersInfoA OffsetRect RegisterWindowMessageA SetWindowPos GetWindow SetForegroundWindow GetForegroundWindow GetLastActivePopup GetMessagePos GetMessageTime DefWindowProcA IsWindowVisible RegisterClipboardFormatA

gdi32

PtVisible RectVisible TextOutA ExtTextOutA Escape GetTextColor GetMapMode DPtoLP LPtoDP GetWindowExtEx GetViewportExtEx GetDeviceCaps DeleteObject GetBkColor ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SelectObject RestoreDC SaveDC DeleteDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap GetStockObject

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter DocumentPropertiesA OpenPrinterA

advapi32

RegCloseKey RegCreateKeyExA RegOpenKeyExA RegSetValueExA

comctl32

ord17

oledlg

ord8

ole32

OleUninitialize OleInitialize CoFreeUnusedLibraries CoTaskMemAlloc CoTaskMemFree CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject CLSIDFromString CLSIDFromProgID CoRegisterMessageFilter OleIsCurrentClipboard OleFlushClipboard CoRevokeClassObject

olepro32

ord253

oleaut32

SysFreeString VariantClear SysAllocStringLen SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetElemsize SafeArrayGetDim SafeArrayCreate VariantCopy SysAllocString SysAllocStringByteLen VariantChangeType VariantTimeToSystemTime SysStringLen

dp1.fne

IMPHASH a198616942b79e67d7da4241ca14ebce
SHA256 cf002b87a2bc481465cc977630eb7bffd8c65aaaf7a6f7d5b9ff880dc8b8e207
MD5 a29510e1f407b73f6e649a3139dd86e7
SHA1 e53c5ad5205e8639f98d28d8aa407573fbd5d9ce
SHA512 b03b30923ef3073bacdece0301bafd31fc2481a0a122d480500d4282c5d068d9c55355820b1ffddca12aad33e7ace00dd7468f80870d4a781baa7c4ecba4c9d7
SSDEEP 1536:u8ZshM+fWvw1CEb18fNf6T/PLr+UTMoV51oF92w:3Zsu4WvjEbSmrlV51o1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

50818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

eAPI.fne

IMPHASH 427eb39584a9f7cdf9555afee9d5ccff
SHA256 039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9
MD5 3102c454a9543e58fe3ad5f783f5a690
SHA1 dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9
SHA512 5b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807
SSDEEP 6144:eeEzIRqmxNHrx9ojoKEgk1HDaVKnWwQ+X:eeEMYmDoc3FDaAWwQ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

110604

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

iphlpapi

SendARP GetAdaptersInfo

shlwapi

PathAppendA PathFileExistsA SHDeleteValueA SHDeleteKeyA

mpr

WNetAddConnection2A WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetCancelConnection2A

winmm

waveOutGetDevCapsA mciSendStringA waveOutGetNumDevs

ws2_32

inet_ntoa gethostname gethostbyname inet_addr WSAStartup gethostbyaddr WSACleanup closesocket connect htons socket sendto

version

GetFileVersionInfoSizeA VerLanguageNameA VerQueryValueA GetFileVersionInfoA

kernel32

lstrcmpiA lstrcmpA GlobalDeleteAtom GetModuleFileNameA MulDiv lstrcpynA DuplicateHandle FlushFileBuffers LockFile UnlockFile SetEndOfFile GetFullPathNameA GetFileTime LocalAlloc InitializeCriticalSection TlsAlloc DeleteCriticalSection GlobalHandle GetCurrentThread LeaveCriticalSection GlobalReAlloc EnterCriticalSection TlsSetValue LocalReAlloc TlsGetValue SetErrorMode GlobalFlags WritePrivateProfileStringA GetCurrentDirectoryA GlobalFindAtomA GlobalAddAtomA GlobalGetAtomNameA GetProcessVersion FileTimeToSystemTime FileTimeToLocalFileTime GetCPInfo GetOEMCP RtlUnwind RaiseException GetSystemTime GetLocalTime GetCommandLineA ExitProcess HeapSize GetACP GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr SetUnhandledExceptionFilter SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW IsBadReadPtr IsBadCodePtr IsValidLocale IsValidCodePage EnumSystemLocalesA GetUserDefaultLCID SetStdHandle GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA GetCurrentThreadId LocalFree WideCharToMultiByte InterlockedDecrement InterlockedIncrement WinExec lstrcatA WriteProfileStringA SetLastError GetProfileStringA CreateDirectoryA GetSystemDirectoryA EnumResourceNamesA CopyFileA Sleep GetWindowsDirectoryA GetTempPathA GlobalMemoryStatus Module32First Module32Next OpenProcess TerminateProcess InterlockedExchange GetDriveTypeA GetVolumeInformationA GetLastError GetFileSize FindFirstFileA GetFileAttributesA SetFileAttributesA RemoveDirectoryA FindNextFileA FindClose DeleteFileA MultiByteToWideChar HeapFree HeapReAlloc GetProcessHeap HeapAlloc GlobalAlloc LoadLibraryExA FindResourceA LoadResource LockResource SizeofResource lstrcpyA GlobalLock GlobalSize GlobalUnlock GlobalFree CreateToolhelp32Snapshot Process32First Process32Next WriteFile ReadFile SetFilePointer GetLocaleInfoA GetSystemDefaultLangID GetTimeZoneInformation CreateFileA DeviceIoControl CloseHandle lstrlenA GetModuleHandleA GetVersion GetVersionExA LoadLibraryA GetProcAddress GetCurrentProcess FreeLibrary QueryPerformanceCounter QueryPerformanceFrequency TlsFree

user32

IsDialogMessageA SetWindowPos SetFocus GetWindowPlacement IsIconic RegisterWindowMessageA SetForegroundWindow GetForegroundWindow GetMessagePos GetMessageTime DefWindowProcA RemovePropA CallWindowProcA GetPropA SetPropA GetClassLongA CreateWindowExA GetMenuItemID GetSubMenu GetMenu RegisterClassA GetClassInfoA WinHelpA GetCapture GetTopWindow CopyRect GetClientRect AdjustWindowRectEx GetSysColor MapWindowPoints LoadIconA LoadCursorA GetSysColorBrush DestroyMenu CharUpperA UnhookWindowsHookEx GrayStringA DrawTextA TabbedTextOutA ClientToScreen GetMenuCheckMarkDimensions GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetFocus GetNextDlgTabItem GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState CallNextHookEx ValidateRect PeekMessageA SetWindowsHookExA GetLastActivePopup IsWindowEnabled MessageBoxA EnableWindow SetCursor PostMessageA PostQuitMessage WindowFromPoint GetParent GetWindow PtInRect IsWindowVisible GetWindowLongA EnumWindows GetWindowTextA FindWindowExA IsRectEmpty GetCursorPos SetWindowLongA GetDlgItem ShowWindow UpdateWindow SystemParametersInfoA ChangeDisplaySettingsA EnumDisplaySettingsA SendMessageTimeoutA FindWindowA GetWindowThreadProcessId SetCursorPos mouse_event keybd_event OpenClipboard EmptyClipboard SetClipboardData CloseClipboard GetClassNameA IsWindow SendMessageA GetDesktopWindow GetWindowRect ReleaseCapture SetCapture GetSystemMetrics LoadImageA VkKeyScanExA GetDC ReleaseDC GetKeyboardLayout wsprintfA SendDlgItemMessageA GetMenuItemCount SetWindowTextA GetDlgCtrlID LoadStringA UnregisterClassA EndDialog SetActiveWindow CreateDialogIndirectParamA LoadBitmapA DestroyWindow GetKeyboardState

gdi32

Escape DeleteDC BitBlt SelectObject CreateCompatibleDC GetStockObject GetObjectA EnumFontFamiliesExA AddFontResourceA RemoveFontResourceA GetDeviceCaps GetPixel CreateCompatibleBitmap CreateDCA GetDIBits RealizePalette SelectPalette CreateBitmap SaveDC RestoreDC SetBkColor SetTextColor SetMapMode SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx GetClipBox PtVisible RectVisible TextOutA ExtTextOutA DeleteObject

comdlg32

PrintDlgA GetFileTitleA

winspool.drv

GetPrinterA DocumentPropertiesA ClosePrinter SetPrinterA OpenPrinterA EnumPrintersA

advapi32

RegCloseKey SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyA RegEnumKeyA RegQueryInfoKeyA RegSetKeySecurity RegOpenKeyExA CopySid GetLengthSid GetTokenInformation OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority AddAce InitializeAcl FreeSid AllocateAndInitializeSid RegGetKeySecurity RegSetValueExA RegCreateKeyExA GetUserNameA RegDeleteValueA RegDeleteKeyA RegCreateKeyA

shell32

SHGetSpecialFolderPathA SHEmptyRecycleBinA SHChangeNotify ShellExecuteA

comctl32

ord17

ole32

CoCreateGuid CoCreateInstance

wininet

InternetOpenUrlA InternetCloseHandle FindFirstUrlCacheEntryA FindNextUrlCacheEntryA DeleteUrlCacheEntry InternetGetConnectedState InternetOpenA

iconv.fne

IMPHASH 12189ec61e2959d5ede384a32e53c43a
SHA256 c6c3d6e75a9326647df42b3774c89ebe37a2451227267a8160e46ee3fe14ddf2
MD5 529d8638819d16de6634c7441c952507
SHA1 baeb093b41c06be5b1d9837738b035ec18486000
SHA512 c8ddfe69d8bd0f3b0f2ae57578a21484b79e202bcb897dc8e8feb63cffedd13aaa2fa4da90d88b4974130c776adacc86e608825427e7a32f77a23004eeea2b67
SSDEEP 24576:oDBf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLY:oB+s8KuqGaX0ToIBAUZLY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

55086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

iext.fnr

IMPHASH 0e9f86f83fb5d6813b58d277e663a96f
SHA256 7169863abd2e9a59ae706235224222754c44eea12a4304f6ac426ac4a89688a9
MD5 f91cfe6df71fbbbe56ddf70247ab9b49
SHA1 6d6e25569bca49c19f2a4b07675194a1bf055eb4
SHA512 841a0632b0bca43d590f72602a0161e04c77e1e881d5bd6d294edab4f9c5577bb8e46f15dd6a0c831e5774fa53e449397146d57b8575ea04506a64f3842490aa
SSDEEP 3072:edh+tmslaQRiAvBvXo8M360VVQrtPdDMDyowHhcA6anR:9iGK8M36zVdcb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

58919

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

HeapSize GetACP GetTimeZoneInformation VirtualFree VirtualAlloc IsBadWritePtr GetEnvironmentVariableA GetVersionExA HeapDestroy HeapCreate SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings RaiseException LCMapStringA LCMapStringW SetUnhandledExceptionFilter GetStringTypeA GetStringTypeW IsBadReadPtr IsBadCodePtr CompareStringA CompareStringW SetEnvironmentVariableA TerminateProcess ExitProcess GetCommandLineA RtlUnwind FileTimeToLocalFileTime FileTimeToSystemTime GetFileTime GetFileSize GetFileAttributesA GetOEMCP GetCPInfo GetProcessVersion WritePrivateProfileStringA GlobalFlags SetErrorMode TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalFree LocalAlloc GlobalFree GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile HeapAlloc ReadFile CreateFileA GetCurrentProcess DuplicateHandle GetLastError SetLastError lstrcpynA LoadLibraryA FreeLibrary GetVersion lstrcatA GlobalGetAtomNameA GlobalAddAtomA GlobalFindAtomA lstrcpyA GetModuleHandleA GetProcAddress MultiByteToWideChar WideCharToMultiByte lstrlenA InterlockedDecrement InterlockedIncrement CloseHandle GetModuleFileNameA GlobalLock GlobalAlloc GlobalDeleteAtom lstrcmpA lstrcmpiA GetCurrentThread GetCurrentThreadId GlobalUnlock GlobalReAlloc HeapFree HeapReAlloc GetProcessHeap GetEnvironmentStringsW

user32

SetFocus MapWindowPoints LoadIconA SetWindowTextA ShowWindow CharUpperA BeginPaint EndPaint TabbedTextOutA DrawTextA GrayStringA UnregisterClassA GetClassNameA PtInRect GetSysColorBrush LoadStringA DestroyMenu GetCapture WinHelpA wsprintfA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetDlgItem GetWindowTextLengthA GetWindowTextA GetDlgCtrlID AdjustWindowRectEx CreateWindowExA GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos GetForegroundWindow SetForegroundWindow SetWindowPos RegisterWindowMessageA SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics CopyRect ReleaseDC GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem GetNextDlgTabItem GetMessageA TranslateMessage DispatchMessageA GetActiveWindow GetKeyState CallNextHookEx ValidateRect PeekMessageA SetWindowsHookExA GetLastActivePopup IsWindowEnabled MessageBoxA SetCursor PostQuitMessage OffsetRect GetClientRect UpdateWindow SendMessageA GetFocus InvalidateRect GetSysColor SetWindowLongA GetWindowLongA GetTopWindow GetWindow IsWindowVisible GetWindowRect IntersectRect IsRectEmpty RedrawWindow ClientToScreen FillRect DestroyWindow GetParent LoadCursorA KillTimer SetTimer GetCursorPos ScreenToClient PostMessageA IsWindow EnableWindow DestroyIcon GetDC

gdi32

SetWindowExtEx ScaleWindowExtEx DeleteObject ScaleViewportExtEx GetDeviceCaps CreateSolidBrush PtVisible RectVisible TextOutA ExtTextOutA Escape SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetBkMode SelectObject RestoreDC SaveDC DeleteDC GetObjectA SetBkColor SetTextColor GetClipBox CreateBitmap GetCurrentObject GetStockObject CreateFontIndirectA

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegCloseKey

comctl32

ImageList_SetBkColor ImageList_Destroy ImageList_GetImageInfo ImageList_GetIcon ImageList_ReplaceIcon ImageList_Create ImageList_LoadImageA ImageList_Read ord17 ImageList_GetImageCount ImageList_Duplicate

iext2.fne

IMPHASH 7286ba50216c69a37eae6422826c4a4f
SHA256 6cf3add9e8297e2c6e0dd3ecdf7f8500c123c7779e5807a3c58de62aeb19156f
MD5 338c9901d7a5cfeafd5b5a0c502fe96a
SHA1 0caf8271b2ebe5d3bd6fd66223e3a7a1e7d3dbd4
SHA512 45feb22b3fb505cb37ea0eff3494604f04a874ac6e8e2e9b2f2bf4d801f8d79a613967d23a4d69ffe0609d1cdba2c1292e5c8a3ec98df779db51b9be77a02a96
SSDEEP 6144:G8VEQ9ESlMXVKy9RuNRtt1IsHM2UNtQjdurSiyhkre1OjCrZ43KL4Suofl:HTlIUtt7HM2qejdmSHkrmOWrm3Quo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

199648

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvfw32

DrawDibDraw DrawDibClose DrawDibOpen

avifil32

AVIStreamGetFrameClose AVIFileExit AVIStreamInfoA AVIStreamSampleToTime AVIStreamStart AVIStreamLength AVIStreamGetFrameOpen AVIStreamOpenFromFileA AVIStreamRelease AVIStreamGetFrame AVIFileInit

kernel32

UnhandledExceptionFilter SetUnhandledExceptionFilter IsBadCodePtr SetStdHandle CompareStringA CompareStringW SetEnvironmentVariableA GetEnvironmentStringsW GetEnvironmentStrings MulDiv FreeEnvironmentStringsW FreeEnvironmentStringsA GetStringTypeW GetStringTypeA GetStartupInfoA GetFileType GetStdHandle SetHandleCount LCMapStringW LCMapStringA IsBadWritePtr VirtualAlloc VirtualFree HeapCreate HeapDestroy GetVersionExA GetEnvironmentVariableA TerminateProcess ExitProcess GetACP HeapSize ExitThread GetTimeZoneInformation RaiseException GetCommandLineA RtlUnwind WritePrivateProfileStringA GetOEMCP GetCPInfo GetProcessVersion GlobalFlags SetErrorMode GetCurrentThread TlsGetValue LocalReAlloc TlsSetValue EnterCriticalSection LeaveCriticalSection TlsFree GlobalHandle DeleteCriticalSection TlsAlloc InitializeCriticalSection LocalAlloc SuspendThread SetThreadPriority ResumeThread WaitForSingleObject GetFileTime GetFileSize GetFileAttributesA FileTimeToLocalFileTime FileTimeToSystemTime lstrcmpA GetFullPathNameA GetVolumeInformationA FindFirstFileA FindClose SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile CreateFileA GetCurrentProcess DuplicateHandle lstrcpynA GetLastError LocalFree MultiByteToWideChar WideCharToMultiByte InterlockedDecrement InterlockedIncrement SetLastError GetVersion lstrcatA GetCurrentThreadId GlobalGetAtomNameA lstrcmpiA GlobalAddAtomA GlobalFindAtomA GlobalDeleteAtom GetModuleHandleA GlobalReAlloc CreateEventA GetProcAddress ResetEvent SetEvent FreeLibrary LoadLibraryA lstrlenA GlobalAlloc lstrcpyA GlobalUnlock HeapFree HeapReAlloc GetProcessHeap HeapAlloc GlobalSize GlobalLock GlobalFree FindResourceA LoadResource LockResource Sleep CreateThread CloseHandle GetModuleFileNameA OpenFile GetTickCount IsBadReadPtr

user32

LoadStringA DestroyMenu GetSysColorBrush GetClassNameA UnregisterClassA PostQuitMessage TranslateMessage ValidateRect CharUpperA EndDialog CreateDialogIndirectParamA GrayStringA DrawTextA TabbedTextOutA EndPaint BeginPaint GetMenuCheckMarkDimensions LoadBitmapA GetMenuState ModifyMenuA SetMenuItemBitmaps CheckMenuItem EnableMenuItem IsWindowEnabled ShowWindow MoveWindow SetWindowTextA IsDialogMessageA LoadIconA PostMessageA SendDlgItemMessageA MapWindowPoints GetFocus SetActiveWindow SetFocus AdjustWindowRectEx ScreenToClient IsWindowVisible GetTopWindow MessageBoxA WinHelpA GetClassInfoA RegisterClassA GetMenu GetMenuItemCount GetSubMenu GetMenuItemID GetDlgItem GetWindowTextLengthA GetWindowTextA GetDlgCtrlID DestroyWindow CreateWindowExA SetWindowsHookExA CallNextHookEx GetClassLongA SetPropA UnhookWindowsHookEx GetPropA CallWindowProcA RemovePropA DefWindowProcA GetMessageTime GetMessagePos GetLastActivePopup GetForegroundWindow SetForegroundWindow GetWindow SetWindowPos RegisterWindowMessageA SystemParametersInfoA IsIconic GetWindowPlacement GetSystemMetrics SetWindowLongA EnumDisplaySettingsA EqualRect PtInRect IntersectRect SetCursor GetCapture SetCapture GetCursorPos GetMessageA DispatchMessageA ReleaseCapture LoadCursorA OemToCharA CharToOemA MsgWaitForMultipleObjects PeekMessageA DrawStateA CopyRect FrameRect InflateRect GetSysColor DrawFocusRect ClientToScreen WindowFromPoint GetActiveWindow GetNextDlgTabItem GetWindowLongA GetKeyState InvertRect UnionRect IsRectEmpty wsprintfA DestroyIcon SendMessageA SetRect UpdateWindow GetDC ReleaseDC EnableWindow FillRect KillTimer InvalidateRect SetTimer IsWindow GetClientRect GetWindowRect GetParent OffsetRect

gdi32

MoveToEx LineTo Ellipse PtVisible RectVisible ExtTextOutA Escape Rectangle GetCurrentObject RoundRect Pie Chord Arc Polygon GetTextExtentPoint32A GetPixel CreateDIBitmap PatBlt SetBkColor SetStretchBltMode ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SetMapMode SetROP2 SetPolyFillMode RestoreDC SaveDC GetClipBox CreateFontIndirectA CreateBrushIndirect CreateHatchBrush CreatePatternBrush StretchDIBits CreateDIBSection CreateSolidBrush SetBkMode TextOutA GetDIBits CreatePen SetTextColor GetStockObject DeleteObject StretchBlt DeleteDC GetDeviceCaps SelectObject CreateCompatibleBitmap CreateCompatibleDC BitBlt CreateBitmap GetObjectA SetDIBitsToDevice SetPixelV

comdlg32

GetFileTitleA GetSaveFileNameA GetOpenFileNameA

winspool.drv

DocumentPropertiesA ClosePrinter OpenPrinterA

advapi32

RegCloseKey RegEnumKeyA RegOpenKeyA RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegQueryValueExA

shell32

ExtractIconExA ExtractIconA

comctl32

ImageList_SetBkColor ImageList_Draw ImageList_Remove ImageList_GetImageInfo ImageList_GetIcon ImageList_ReplaceIcon ImageList_AddMasked _TrackMouseEvent ImageList_Write ImageList_Destroy ImageList_Create ImageList_Read ImageList_GetImageCount ord17 ImageList_Duplicate

ole32

OleUninitialize OleInitialize

winmm

PlaySoundA

iext3.fne

SHA256 d7ca833f03bc6a6926165a587849930ad73194950e6235af536c311dd0074a13
MD5 564e1af5a893cb9454c3bb6ae22fdadd
SHA1 c1d22a4ad5f1303ea2e4675ae86cd10748689052
SHA512 d025304fe0a2da8679864b6c4eb67d753a6048d31e36c303fe6bfc143ce263385a7a4ade99fbe20c4de3c8cadbbacc3c6176b5d1a4c9389944c73e80db1fed3c
SSDEEP 3072:encP0G1qTbQsnrzF54dimCBuZBEXLoeD0oBE:enc7cTbQet54dimjEd0oE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

141646

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

56d65e0bb8b89e73cddb9219f375f70f_JaffaCakes118

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/Base64.dll

kernel32

msvcr80

generic

$PLUGINSDIR/BrandingURL.dll

kernel32

user32

gdi32

shell32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/blowfish.dll

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

ExtMenu.fnr

msimg32

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

generic

HtmlView.fne

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

comctl32

oledlg

ole32

olepro32

oleaut32

generic

dp1.fne

user32

kernel32

generic

eAPI.fne

iphlpapi

shlwapi