ed5a7491d26a7d1621150eee7d77a97b_JaffaCakes118
- SHA256 71916efd98ebad32e60025ebb48cbc3bb8556d60a82260143580fa2b3f90c72c
Overview
overview
10Static
static
3SnSetup1.7.exe
windows7-x64
7SnSetup1.7.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Data/regis...US.htm
windows7-x64
3Data/regis...US.htm
windows10-2004-x64
3Data/regis...CN.htm
windows7-x64
3Data/regis...CN.htm
windows10-2004-x64
3Data/regis...TW.htm
windows7-x64
3Data/regis...TW.htm
windows10-2004-x64
3SerialNull.exe
windows7-x64
10SerialNull.exe
windows10-2004-x64
10SnBus.sys
windows7-x64
1SnBus.sys
windows10-2004-x64
1SnSerial.sys
windows7-x64
1SnSerial.sys
windows10-2004-x64
1install.exe
windows7-x64
5install.exe
windows10-2004-x64
5ȿ˶.url
windows7-x64
1ȿ˶.url
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SnSetup1.7.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
SnSetup1.7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20241010-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
Data/register-en-US.htm
Resource
win7-20240903-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Data/register-en-US.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
Data/register-zh-CN.htm
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
Data/register-zh-CN.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Data/register-zh-TW.htm
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
Data/register-zh-TW.htm
Resource
win10v2004-20241007-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SerialNull.exe
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
SerialNull.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
SnBus.sys
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SnBus.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
SnSerial.sys
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
SnSerial.sys
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
install.exe
Resource
win7-20241010-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
install.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral19
Sample
ȿ˶.url
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ȿ˶.url
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target ed5a7491d26a7d1621150eee7d77a97b_JaffaCakes118
- Size 564KB
- Sample241214-afpbdstmgr
- SHA256 71916efd98ebad32e60025ebb48cbc3bb8556d60a82260143580fa2b3f90c72c
- MD5 ed5a7491d26a7d1621150eee7d77a97b
- SHA1 54181f2ddf8951f79a824a3dcf6e34540f1dc9cf
- SHA512 6c94d147c5c1187f5a8ce46654c9d181adc1e58ac85d72398e1cdf2073c80aecb663e2dfc73655e8bcee6cbd8b3cae17208c1dcec475167162813a9dcbf154fe
- SSDEEP 12288:9L4ceXBm45rsS3308qPvMwiM4VBBk0YMrIGB0uERVr4+aOotP/eLJk:N4ceXBm4qyk8q34M47YMrIpzr4+aOI/F
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/SnSetup1.7.exe unpack002/$PLUGINSDIR/LangDLL.dll unpack002/SerialNull.exe unpack002/SnBus.sys unpack002/SnSerial.sys unpack002/install.exe - NSIS installer 1 IoCs
resource yara_rule static1/unpack001/SnSetup1.7.exe nsis_installer_1
File Explorer
-
ed5a7491d26a7d1621150eee7d77a97b_JaffaCakes118.zip 564KB
-
SnSetup1.7.exe.exe 601KB
-
$PLUGINSDIR/BtmImg.bmp41KB
-
$PLUGINSDIR/Header.bmp27KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/LeftImg.bmp25KB
-
Data/register-en-US.htm.html 7KB
-
Data/register-zh-CN.htm.html 11KB
-
Data/register-zh-TW.htm.html 12KB
-
Language/snchs.ini3KB
-
Language/sncht.ini3KB
-
Language/sneng.ini2KB
-
License.txt3KB
-
SerialNull.exe.exe 193KB
-
SnBus.inf1KB
-
SnBus.sys.sys 30KB
-
SnSerial.inf1KB
-
SnSerial.sys.sys 33KB
-
install.exe.exe 57KB
-
ȿ˶.url.url 174B
SnSetup1.7.exe
- IMPHASH 9b89b73a2bd2f3c9338530bbd4a212f0
- SHA256 91f02fafb1a3ab7a20761d308d7a1f224e889cb0bc43daadf9d9cb5d5c6e65e3
- MD5 bfe8e9072c8e530229f4984f4e64c534
- SHA1 cf95d3be5395744e696d9cf0484915d185a3eaab
- SHA512 a83b872c670c54839842f0e246e8a6739f8b5aab8a23e2678c999e891a8caf21fec7a4ad84e7691dbd0072db01215e88b120be526adf5bc8ea01130d757adf84
- SSDEEP 12288:0zWyF45rsw9308qtvMwiM4HZS/dfLhaIGn0uERTtIiaO+tP/etJz:0zWyF4qQk8qh4M4Hk99aI1ttIiaOG/eX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
14307
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
GetWindowsDirectoryA
CompareFileTime
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
SetFileTime
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
MulDiv
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA
user32
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
SystemParametersInfoA
RegisterClassA
EndDialog
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CreateDialogParamA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
InvalidateRect
CreateWindowExA
GetWindowLongA
DrawFocusRect
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
TrackPopupMenu
wsprintfA
SendMessageA
CallWindowProcA
MapWindowPoints
GetWindowRect
ScreenToClient
PtInRect
LoadCursorA
SetCursor
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
EnableWindow
gdi32
SetBkColor
GetDeviceCaps
GetCurrentObject
GetObjectA
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegEnumKeyA
RegEnumValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
280KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
43KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=165, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=9, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/BtmImg.bmp
- SHA256 bc525fbdb37a19cc10397206afed0bf73d4978d2b875866cd2cb0a14139338f5
- MD5 de22c708a35f69b114d60b9841b07995
- SHA1 aaf24820abdd2cc93f9c3b16a69477238939379c
- SHA512 c7879181ed9eac264f7b238a172fbeee0e0ec7d2588f039ab4e811ff60961a51624088a2be3682bf8ecd59a0f0e409319f07029af2436bc23b1ddaad7646c5db
- SSDEEP 12:eLTgq6TNRBoeZTqDw7xos9iwFByGhj3wv4NPkXnfttTm0ynqKx1VBx:eHXwl77umiWByGNwA6fiVqK/x
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/Header.bmp
- SHA256 46fbe97a281202d59414e0ca9a68009b8423ff5fdbc0027f4a309b588c9af7ec
- MD5 f12f2234e5496f8518390223324d8b1c
- SHA1 6e470e2b41ad38422a5beb4e7f4d28b721dcf2a5
- SHA512 d83aed727d741e1e7d036a2c4021195b46ec474e021486d5f699b2a651d27287af5aabab9772232ee57c6856670d128b21db356f061396ebf779ceaca0af36d7
- SSDEEP 24:4J/8Sq8eVc/tMibi5b4ZII7kGS5AXBGba:4J9q/KtvbiE
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/LangDLL.dll
- IMPHASH 2db813254ea8b4d2a92d703ecb659f39
- SHA256 da006773e11871b8834036c30acab8fabcce2c9e9f52bb2b425f947bdf33f7c6
- MD5 83c5a8e90cd10cb31a9215eb4421341f
- SHA1 52ddbbfa955936f87516c52b2bb679a6b4363e22
- SHA512 46c20fd762a643028f3c4287ed3dbd762bc1cd17ee5ad1d90cbad23f15901fbab14b726d7f3e45eeb370fb6a2ee5268a2e9ebaae7ab6067c855361d24fc806a4
- SSDEEP 48:SHGGPtcWCeM7etAo1UurdGl4A0h2TpXHWFv+wewzpv1XP3GhaEJOof2ynh1:E1cWxfzrrh2cFvWwFtSh
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5415
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpynA
lstrcmpA
lstrlenA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
user32
SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC
gdi32
CreateFontIndirectA
GetDeviceCaps
DeleteObject
LangDialog
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
254B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/LeftImg.bmp
- SHA256 c3bda69e330c9a131d1b1b0c6914927a76bca0ba1d21b2b0b310581e2fdcdcd4
- MD5 8bf504e130497e770b16e6eb6d167ced
- SHA1 1520054eec7fa71550fb136b824a6808dd152b18
- SHA512 31ae1491a0759967739ec4a8e48effd26570620e8387ceb6f3fffa89e644508a190dcf409405091ff5d617ba8066b8b4337c8ce27a417e9662ad97c58a9a4a48
- SSDEEP 384:P6Y4OEzpFhgTREWM2EJEKp6oVfPJ/JHp2:P6YePhCEWM2vKPVfPJhJ2
- MD5 SHA1 SHA512 SSDEEP
Data/register-en-US.htm
- SHA256 c98dacf548332f440e75e3fd419c19faf2ff66d4cfae453e9afc9e2a944e2889
- MD5 7f5cc2de62d3cfded6df11c12ba29bef
- SHA1 794d28fb01c64307ffb4d11cdb5f0e5ade25764a
- SHA512 42fa96d52762eb5c2e8c94c392bcef08f56c5ce8dec0960f9847a7bce1a36073386c4646311c55cf2e0a96b773c0c99794e6cee64fce4795bf27d7c652fbe5f9
- SSDEEP 192:wQF/w/oV90Wz6vODX0vh9epP6836mY2efYGqJfgTauvUrFcJB:/LBf6FyCT/OFcJB
- MD5 SHA1 SHA512 SSDEEP
Data/register-zh-CN.htm
- SHA256 f7efbed02bea5432387cf8dcc6f1a59eca4b91c26db36d50ced0e070e31b88ac
- MD5 d635ec9c62de6f0d8d72ce36fe08b7bb
- SHA1 30b814eaf61ffe8b8309456adbea947eb046b22d
- SHA512 244d1033a8091d9a9fbc6a3407c534ce7e586e67cc56273efd618422646238e3a4473e4663d0828ca8907c8952421b7a2902afb88aff1e574c927b2cbce8ffc3
- SSDEEP 192:9F/w/oEKPj0VlSk8vVPzYYj1qnPsTTniQiTHVlJ+TlB:XrjNPz5aPsTTn8VlJ+TlB
- MD5 SHA1 SHA512 SSDEEP
Data/register-zh-TW.htm
- SHA256 abceb3e0851e769983f69dd7fc32e951fdbc1b07498649d6b8106691dedb7489
- MD5 74906a9d26f06dea02d4c2129c34b000
- SHA1 47eed5eccc4feb0bedb81f222a91914970395011
- SHA512 081d55b6cc5eaad96f874e46b249fc9ab8b4a33f3522a47f57d79e1b52c4a0824082f1f53c3c127e60a8988410ae1ad21dc94f280544ca6681701a9f1dcbf03f
- SSDEEP 384:4vE+YYg5qTuhQw+wSwoC2+FwkwZw6wsSxZTokYYDDTlgA:KbgkTuhQw+wSwot+FwkwZw6wsmZEkYY/
- MD5 SHA1 SHA512 SSDEEP
Language/snchs.ini
- SHA256 3df179ccaf287dcb0e1897834f792bf86c2ff507b099f49ce6d9beb08c7b0978
- MD5 a2377f4a8980fa572426118f55ce694d
- SHA1 24026c00bd07fe70b2df26c674e8b98178da6316
- SHA512 b92715cd4fafd763697808ae469cf20d06ffda4794771347a7fe4439acd03c6405ebae6b5c427cb9754f07bf933f00f2493347746c1601a03af2536fce2bb932
- MD5 SHA1 SHA512
Language/sncht.ini
- SHA256 16c35c8012582677a04769bc89ba80924ac1360849f33de8efc1b146259b6dcb
- MD5 4711344b5f55d0650835588568f3e015
- SHA1 35f55e0dc8466157cb0a3e630a8bbf5a7a4a24e2
- SHA512 4e5f43d2bfc93e20566eb4fd7ad575cd3e91cd9042aa4e521ac66ccc32e8b8efabdb7d6ab78c7d4b64cc0fa317270241ccda5316c93c7c01a169e8b320d54afd
- MD5 SHA1 SHA512
Language/sneng.ini
- SHA256 03cc4aa19dcb5cc6039d95a20a3cd82a56852db6e80b8504f828ede50609f5a4
- MD5 0c0ee7f15f92b4fa370048fd03fc0f63
- SHA1 246d0330598935497a95f0a7c600c3545b7a36f1
- SHA512 36fd4b16d6220f3eaef66f31f816c66b636c6f746c02e2fb6a568da8198f3b746411a863d4b8a32d881debe47763168e81cd7bb09f8f8113502d5f14999cfba0
- MD5 SHA1 SHA512
License.txt
- SHA256 73b3c836b57554d1583662305aa570c6fd1bf8b60c2e79c06c6e48346148f00b
- MD5 dc90c272d8f5b89e05213cc1fc4d25e3
- SHA1 7a8de0c60e941a240186302c6dc691d6c19c039e
- SHA512 d149686d5eea54ed719cff76bb5e553d965d9d0bf3d63bba78c1b8994ebfeaab43fe617ccf588adf720ea26ecaf5c4444720db8b2fcafad99ca2b86eb5639dd3
- MD5 SHA1 SHA512
SerialNull.exe
- SHA256 502f20ca9cf7259a73217d3144fdd2aefb697b997717b5a16e9c92a2d276afc9
- MD5 cfe544e042b57980bdc5c044e64d06a3
- SHA1 38057e44e41d5eeb706e2e27b35b8e8d87d0fb24
- SHA512 f741ac253760e579d9d0a10667863987ae35fbd806bbea9bef36f1062a7fea24358336d778970f44390576702568355c768453a9188ef9a9c13b84f88efd3e50
- SSDEEP 3072:qZqXhUiJFdGI2qelyDDwfd6U8vHlNQALmis4f+nFYZw2sOPJOBjmeeI+DLJO:qMRU0FDIYUd6UAjXumZCOhW4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
392528
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
Virtual Size
256KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
68KB
Virtual Size
68KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, productName=Unmarked objects (old),
count=8, id=95, version=2190,
count=10, id=11, version=8047,
count=28, id=14, version=7299,
count=150, id=10, version=8047,
count=91, id=11, version=8569,
count=1, id=96, version=2190,
count=551, id=1, productName=Unmarked objects,
count=33, id=93, version=2179,
count=22, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
SnBus.inf
- SHA256 3804a768e956d3f30666258972b3215b738fdd58383b8ea808d31042f4fda439
- MD5 96d0078ea02ed681f67d8c8e6409473c
- SHA1 a45fad9dc80b4e74b0ec31af2187b0e4b6cfee3b
- SHA512 e53e058248544cdbcf219130ba4ec3dce6e6885745064e8da52174490b348952b72addb7bc45625d73521fea7c290f1698adc1efeada744a8eda08f7008247b3
- MD5 SHA1 SHA512
SnBus.sys
- IMPHASH 75bd93a2c83716cb25065f3f01226502
- SHA256 1334fa696d2b1ecfb6ce7d3b0fa7f1144f79887a654bcbc6628e71c58c63dc38
- MD5 4b7f3be8378dd0e8a41e97b74eedc7c3
- SHA1 9692d5dfc81a23dfe1df529403dac57165520159
- SHA512 d223b5b0995f078c4052f3f78237973250d6c8365ccf943e2bd817e00c92a403c24a14f0e4da0e490578908c4a8000402662d5a949282f5082b9dbcf4138e295
- SSDEEP 384:RfInDYki9jR+Tozwr4N5DkgTM1uz5wnOHTHpngz7YInCpij3gf8rxFd:Rf1ki9djX9kgTKOHjpngz7YICIZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
25708
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\winddk\3790~1.121\vser\busenum\disk\fre_wxp_x86\i386\SnBus.pdb
ntoskrnl.exe
IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStack
IoRegisterDeviceInterface
KeInitializeEvent
IoCreateDevice
PoSetPowerState
IoSetDeviceInterfaceState
IoInvalidateDeviceRelations
IoRequestDeviceEject
KeWaitForSingleObject
IofCallDriver
ObfReferenceObject
PoCallDriver
PoStartNextPowerIrp
wcslen
ObfDereferenceObject
ExAllocatePoolWithTag
IoGetAttachedDeviceReference
IoWMIRegistrationControl
RtlInitUnicodeString
sprintf
KeQuerySystemTime
_alldiv
ZwClose
ZwCreateKey
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
KeTickCount
KeBugCheckEx
RtlCopyUnicodeString
IofCompleteRequest
KeSetEvent
KeClearEvent
IoBuildSynchronousFsdRequest
ExFreePoolWithTag
MmGetSystemRoutineAddress
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFreeUnicodeString
RtlAnsiCharToUnicodeChar
hal
ExAcquireFastMutex
ExReleaseFastMutex
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Name
.text
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=67, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=32, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
SnSerial.inf
- SHA256 392e836b5a9cdbba0f9b4eb8346a6c0281c134c070a40d99a2c71ad0d2362520
- MD5 c2aeabdadd719d5ff4097c4fe2995af7
- SHA1 39cca12c94d4ba8aa41a6560a00b031de6899606
- SHA512 7854dce413a860dde871d143480fc21ddbd2441516d9a913f568883aec726f0d45d5385dc2ac9fdf449babef2c72715378d683b097f869fd4f6ec6fe54281d38
- MD5 SHA1 SHA512
SnSerial.sys
- IMPHASH d4e8612aed4006c68ebc992646db0ff1
- SHA256 8b4a26a387f2fa4f11dc90a3fc83aad2bcdd7afe0a1c7137928619060773774f
- MD5 370e64094afd499d27540bf163297a56
- SHA1 c0dc27c448c21f874e496277393a34ae1d2b4a4c
- SHA512 60a11f3a7982751e1f6fed4dbde68771e599e8ca1715515251e94c73d55e9e4d359f5f5b367fddca75dea044699c852f523b7ac911a836fe1fd204a7cf3c498d
- SSDEEP 768:iTkxyzR73rtXtvjKagtPr9O/boPZWXsEC9gjWWWkB6vUwKN:ilR7JX5ktPr9sEPAXuKzEn+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
29957
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\winddk\3790~1.121\vser\snserialnew\driver\objfre_wxp_x86\i386\SnSerial.pdb
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
KeInsertQueueDpc
KeSetEvent
KeWaitForSingleObject
IofCallDriver
KeInitializeEvent
IoAcquireCancelSpinLock
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoDeleteSymbolicLink
RtlDeleteRegistryValue
IoSetDeviceInterfaceState
IoRegisterDeviceInterface
RtlWriteRegistryValue
IoCreateSymbolicLink
RtlIntegerToUnicodeString
RtlFreeUnicodeString
IoDeleteDevice
IoAttachDeviceToDeviceStack
PoSetPowerState
IoAllocateWorkItem
KeInitializeDpc
KeInitializeTimer
KeInitializeSpinLock
IoCreateDevice
IoIsWdmVersionAvailable
RtlCopyUnicodeString
ExAllocatePoolWithQuotaTag
KefReleaseSpinLockFromDpcLevel
KeCancelTimer
KefAcquireSpinLockAtDpcLevel
IoReleaseCancelSpinLock
KeSetTimer
memmove
KeQuerySystemTime
KeClearEvent
PoRequestPowerIrp
ExFreePoolWithTag
ObfDereferenceObject
IoBuildSynchronousFsdRequest
IoGetAttachedDeviceReference
IoDetachDevice
PoStartNextPowerIrp
PoCallDriver
IoQueueWorkItem
IoFreeWorkItem
KeTickCount
KeBugCheckEx
RtlUnwind
hal
KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=65, id=1, productName=Unmarked objects,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=22, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
install.exe
- IMPHASH 0cf7b0f4740237244f2063135ebe568e
- SHA256 0d03931dae04b1d6cae8d3745c3aff6315e0df8c6b0bb2589fe77b50580e88f6
- MD5 242b49803d0dc2c25486ab866d8516cb
- SHA1 8d4302a242f4e3be1678e21e9bf79cc27f123e7d
- SHA512 02ba717114ac8fe22898356403065203d719e97b6bc4ececaf849fb21e02529bf54f367bd3468103045cc63a60c77935d8efa04fec67f6d80b60e43067966577
- SSDEEP 768:/Y9BR4QkHgaYpYnqL6n/RwilMARtPvevxHs4gZWk:mzlkHgNxc58ARtP2xHeW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23608
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\winddk\3790~1.121\vser\devcon\objfre_wxp_x86\i386\install.pdb
kernel32
FreeEnvironmentStringsW
GetEnvironmentVariableW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
CreateFileW
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetFullPathNameW
GetFileAttributesW
LoadLibraryW
GetProcAddress
FreeLibrary
lstrcpynW
FileTimeToSystemTime
GetDateFormatW
GetModuleFileNameW
lstrcpyW
lstrlenW
CloseHandle
GetLastError
GetCurrentProcess
GetCurrentProcessId
msvcrt
fputs
_iob
??3@YAXPAX@Z
??2@YAPAXI@Z
wcschr
towlower
towupper
iswalpha
_wcsnicmp
_wcsicmp
swprintf
printf
wcsrchr
wprintf
wcscmp
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
wcscat
advapi32
RegQueryValueExW
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey
RegDeleteValueW
RegSetValueExW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
CreateServiceW
DeleteService
ControlService
AdjustTokenPrivileges
user32
LoadStringW
MessageBoxW
CharNextW
ExitWindowsEx
setupapi
SetupDiGetDeviceInfoListDetailW
SetupDiGetClassDevsExW
CM_Connect_MachineW
CM_Locate_DevNode_ExW
CM_Reenumerate_DevNode_Ex
CM_Disconnect_Machine
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiCreateDeviceInfoW
SetupDiSetDeviceRegistryPropertyW
SetupDiSetClassInstallParamsW
SetupDiBuildClassInfoListExW
SetupDiClassNameFromGuidExW
SetupDiGetClassDescriptionExW
SetupDiOpenClassRegKeyExW
SetupDiGetDriverInstallParamsW
SetupDiSetSelectedDriverW
SetupOpenFileQueue
SetupDiCallClassInstaller
SetupScanFileQueueW
SetupCloseFileQueue
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiOpenDevRegKey
SetupDiGetDriverInfoDetailW
SetupDiDestroyDriverInfoList
CM_Get_First_Log_Conf_Ex
CM_Free_Log_Conf_Handle
CM_Get_Next_Res_Des_Ex
CM_Free_Res_Des_Handle
CM_Get_Res_Des_Data_Size_Ex
CM_Get_Res_Des_Data_Ex
CM_Get_DevNode_Status_Ex
SetupDiInstallClassW
SetupCopyOEMInfW
SetupDiClassGuidsFromNameExW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
CM_Get_Device_ID_ExW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
shlwapi
PathRemoveFileSpecW
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=15, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=122, id=1, productName=Unmarked objects,
count=15, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=94, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=90, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
ȿ˶.url
- SHA256 6ffc24ba95d4fb28807b1748c76ef597c299a580bf2d43f1567f65b9fb897a93
- MD5 b4f682d95ca18141304d88346dcb32dd
- SHA1 cfd612d9edc6926485ae4b9111ef282a75c81aab
- SHA512 4cc117b053edc374e83a294e070e5a1748aa5b48a33e755e321716df1c7a2d6d4281a5b6f30cbbd07bfb331bbfee31973bea7561300f249a12052f543609ad08
- MD5 SHA1 SHA512