JaffaCakes118_40d1757e9c780835836d1810748c2435

resource
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$_0_/Helper.dll
unpack001/Helper.dll

IMPHASH bf95d1fc1d10de18b32654b123ad5e1f
SHA256 d6fd9f8023ea24a97c2e392e2f35c5f8f852a795121dc8b9bc6734a50e36a7e3
MD5 40d1757e9c780835836d1810748c2435
SHA1 369dee05027c3bca1043a2e74a1c481832f4177c
SHA512 28bdcafa515a1261b672fe871d62c77829a8b9e6565100332aea55e6a7eef7d398a3eae1ca454fb6fab6eaa0a0e2b9e4ceb9d83f91894a18bed796d1407d342f
SSDEEP 24576:M0aNNdDEuDbbETLHzQlrnTfvecXz7tcTIlXdtQO6kldiDDUn:MLVDU3HQzeScTIlXdtpjim
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Serial Number

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Subject

Serial Number

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Nov 17, 2006 - Dec 30, 2020

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Serial Number

01

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Timespan

Aug 1, 1996 - Dec 31, 2020

Subject

CN=Bandoo Media Inc,O=Bandoo Media Inc,L=Panama City,ST=Panama,C=PA

Serial Number

59:15:cd:3a:11:3b:9b:2a:e7:b4:97:dd:df:cd:f8:f5

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning

Timespan

Oct 6, 2010 - Oct 5, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Serial Number

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 1, 2012 - Dec 31, 2012

Minor OS version

0

Major OS version

5

Entry point

13289

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/FindProcDLL.dll

IMPHASH e26d7460d0c04056b9226a899477ba4d
SHA256 6eb09ce25c7fc62e44dc2f71761c6d60dd4b2d0c7d15e9651980525103aac0a9
MD5 6f73b00aef6c49eac62128ef3eca677e
SHA1 1b6aff67d570e5ee61af2376247590eb49b728a1
SHA512 678fc4bf7d345eeb99a3420ec7d0071eaba302845e93b48527d9a2a9c406709cc44ec74d6a889e25a8351a463803f8713a833df3a1707a5ad50db05240a32938
SSDEEP 384:DZoRF0XXUuJReQg0Tw67ADWBTgmldIogUD3GLgFmyaX/fVYcWJQCDmrinogRdBl:DZaF0HtTwuz9yu3KgwRX1nWJ1q+noI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6100

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/KillProcDLL.dll

IMPHASH d806a080e21508dd768fa70be247d2ae
SHA256 de1177a4bd1c56c3555f366d40b37d7dd9cb25e16c4973d0a4d22bf9a8af7aed
MD5 1cc87d2b5a79b18f133b4f944e2f2f74
SHA1 98e0ddb727c76e06be1668434d754e5b80a0c154
SHA512 d8fee1c09fef9af4e1f38baaffa3a6d059713b14ecad900815c086cc22855644fcdeacd6bba31ea6e6925831e650f7b0d34e6dea4c57a978fb4f5bf0cd6d72a9
SSDEEP 384:JLmJwO50x66T9JOpOUT38YZvml7xoKdyuwlx8xSiorppugBwUdJopS:JW50hJwwUTsXdPwxvtpDtdJo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 03cd57ab00236c753e7ddeee8ee1c10839ace7c426769982365531042e1f6f8b
MD5 959ea64598b9a3e494c00e8fa793be7e
SHA1 40f284a3b92c2f04b1038def79579d4b3d066ee0
SHA512 5e765e090f712beffce40c5264674f430b08719940d66e3a4d4a516fd4ade859f7853f614d9d6bbb602780de54e11110d66dbb0f9ca20ef6096ede531f9f6d64
SSDEEP 192:sRer7uivwq1XpKs4FVWSjMd8tIg2cREbyCsZ8q2R4Sy+Xe:s67Xws4FVWig86/5eCBqSy+Xe
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10085

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH c4a726be6ec458c19b16bf3893cf4bc1
SHA256 c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
MD5 a88baad3461d2e9928a15753b1d93fd7
SHA1 bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA512 5edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
SSDEEP 192:qP6KdXy+Yo7e1J8qC25a5mDFmCLGUCVGpU6uNck87I0S/TDqwyTq+:q/q3Pgd5mx6VkEck87ILCTN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11694

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError lstrcmpiW GetCurrentThreadId GetProcAddress GetCommandLineW UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent GetVersionExW SetCurrentDirectoryW MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingW CreateEventW lstrlenW GlobalAlloc CreateProcessW GetLastError FormatMessageW LocalFree GlobalFree CloseHandle GetModuleFileNameW lstrcatW GetPrivateProfileIntW GetPrivateProfileStringW DuplicateHandle LoadLibraryA

user32

SetWindowsHookExW DispatchMessageW TranslateMessage IsDialogMessageW PeekMessageW MsgWaitForMultipleObjects DefWindowProcW PostMessageW SetForegroundWindow CreateWindowExW GetWindowThreadProcessId CallWindowProcW SetWindowPos GetWindowRect UnhookWindowsHookEx GetClassNameW CallNextHookEx CharNextW DialogBoxParamW MessageBoxW EndDialog SetWindowLongW LoadImageW GetWindowLongW EnableWindow ShowWindow wsprintfW LoadStringW GetDlgItem SendMessageW DestroyWindow

advapi32

GetUserNameW QueryServiceStatus CloseServiceHandle OpenServiceW OpenSCManagerW LookupPrivilegeValueW GetTokenInformation FreeSid EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges OpenProcessToken

shell32

ShellExecuteExW

ole32

CoInitialize

$PLUGINSDIR/inetc.dll

IMPHASH 917ae9b9adb269abd5543f5bf5676bac
SHA256 10a003f8e01c55d95a72f94ea2c3ae0ce0fd522832d88a51ea40cfcb3e44f907
MD5 31798167b0cfba85d5deca0261596b1d
SHA1 b13525b6cd9dd8ccd0a630644dcdf045ae67befb
SHA512 7ece77c9335651d48890f3bc82eef0fb018856492af91faa170f6510043c47448ee291dd9249e28bc7da58577b10358f0d49e0a797539166f4801465294b2d3a
SSDEEP 384:dZ8mr5/qvsHWqgBf4UGehYpB/7f+jFJDhgRZwcYa9h9nRgw1:D8W5/qc+w1wk7f+RJDhdajdv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14913

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

wcschr _adjust_fdiv malloc _initterm free strlen strchr strrchr wcsrchr wcstoul memset wcsstr wcstol

kernel32

DeleteFileW WideCharToMultiByte CreateFileA CreateThread WaitForSingleObject TerminateThread GetModuleHandleW MulDiv lstrcpyW GlobalAlloc LoadLibraryW GetProcAddress lstrcmpiW lstrlenW WriteFile ReadFile lstrcmpW lstrcpynW GetLastError CreateFileW GlobalFree CloseHandle SleepEx SetFilePointer GetTickCount lstrcatW GetFileSize

user32

MessageBoxW GetParent ShowWindow SetWindowLongW IsWindow SetWindowTextW SendDlgItemMessageW GetDlgItem PostMessageW GetWindowTextW SendMessageW SetDlgItemTextW SetWindowPos SystemParametersInfoW GetClientRect GetWindowRect SetTimer LoadIconW UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindowVisible EnableWindow CreateDialogParamW FindWindowExW wsprintfA wsprintfW GetWindowLongW

wininet

HttpSendRequestW HttpSendRequestExW HttpQueryInfoW FtpCreateDirectoryW FtpOpenFileW InternetGetLastResponseInfoW InternetSetFilePointer InternetSetOptionW InternetQueryOptionW HttpAddRequestHeadersA InternetCloseHandle InternetErrorDlg HttpOpenRequestW HttpAddRequestHeadersW HttpEndRequestW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/modern-header.bmp

SHA256 b336d6cdf362e0a5e4879cb722afd25ed3f56671c6244fbacdf5a7e8b4f7a05e
MD5 aad23e408fc3ef789a35569f04484f3e
SHA1 ff70801973c3a8263a9208db33c0abcef9fff854
SHA512 0fd55ac061705bcdb5e82479b625cdf24964c91a0a96c7930b55dcccc7df81c84cc3844499555efeb3da250eb44f5c92b12590a9fa5cef2c1b77e8b5324a4382
SSDEEP 768:ENQnm7njG/tbxjtMp0PEUKDNT+OaA23qp44jrlCvlkFH:ENQnm7nj0tdjtxwyNq+lkFH
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 2bee549b2816ba29f81c47778d9e299c3a364b81769e43d5255310c2bd146d6e
MD5 f7b92b78f1a00a872c8a38f40afa7d65
SHA1 872522498f69ad49270190c74cf3af28862057f2
SHA512 3ad6afa6269b48f238b48cf09eeefdef03b58bab4e25282c8c2887b4509856cf5cbb0223fbb06c822fb745aeea000dd1eee878df46ad0ba7f2ef520a7a607f79
SSDEEP 192:y1zQhZDqlJcKISw99ioU3MSfwLF/+nhHUisdz:ozoZDGKYw9goWyFGBU7z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 8700d0ebbb41c81ea52718af1ab70a93
SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
MD5 08e9796ca20c5fc5076e3ac05fb5709a
SHA1 07971d52dcbaa1054060073571ced046347177f7
SHA512 02618317d6ab0302324aae4d3c5fca56b21e68c899e211cfa9412cf73820a1f931e56753c904fd7e510c638b4463aedbfe9536790279e096ea0387b67013e0c4
SSDEEP 96:/Uspq2y5jOEEQrhySvUgfj74/vvrTBzfYZA4YF3Telac1nIq/2:/erjOELhySv5f2vvBjiAflaB1nIq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_0_/Helper.dll

IMPHASH 08dc69e1bbbb3b6d87bc0ac64f8a0413
SHA256 d0b3e7f9b304b88fe7de3b81afc1c64f40d7b2237721225a15a564ae62b34e66
MD5 cf0e9192667cdedfacc8646e38bd9686
SHA1 4741ac6de1d309210279795e1c7cd7f21cee6f17
SHA512 b8a47fc2c706822eb0adfa820d24330901454fe37b6c93270f2fc89aa4b05e9e1527820af1f3f674b6d8696ed79722cc51eeb12e7e1762e112e7bad69327d36c
SSDEEP 12288:6atQ0QAsqP85SFuNrC8b+qyPyTlkmn4IiaLgfeC:jtQ06M8Sqy6Tlkmn4IvieC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

424061

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Work\Rabbit\G1\rbin\Helper.pdb

wininet

InternetGetConnectedState InternetCheckConnectionW

wtsapi32

WTSQueryUserToken

kernel32

GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers GetCurrentDirectoryA CreateFileA InitializeCriticalSectionAndSpinCount GetFileInformationByHandle FindResourceW GetConsoleMode GetConsoleCP GetModuleHandleA QueryPerformanceCounter HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings SetStdHandle FindResourceExW WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetTimeZoneInformation WTSGetActiveConsoleSessionId HeapAlloc HeapFree GetProcessHeap PeekNamedPipe FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess GetModuleFileNameA LoadResource LockResource SizeofResource DeleteFileW WriteFile CreateFileW Sleep RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetLastError FlushInstructionCache GetCurrentProcess CloseHandle SetEvent CreateEventA CompareStringA CompareStringW SetEnvironmentVariableA GetFullPathNameA GetFileAttributesW GetStdHandle IsValidCodePage WaitForSingleObject GetTempPathW GetSystemDirectoryW GetVersionExW GetProcAddress GetModuleHandleW VerifyVersionInfoW VerSetConditionMask GetSystemTime GetLocaleInfoW GetSystemDefaultLCID Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess OpenProcess GetLastError GetModuleFileNameW GetSystemInfo LoadLibraryW CreateProcessW LocalFree FormatMessageW FreeLibrary RemoveDirectoryW FindNextFileW FindFirstFileW CreateDirectoryW ReadFile SetFilePointer GetFileSize GetDriveTypeW GetFileSizeEx GetFileTime MoveFileExW CopyFileW GetOEMCP GetFullPathNameW GetLongPathNameW GetShortPathNameW QueryDosDeviceW GetLogicalDriveStringsW FindClose WideCharToMultiByte MultiByteToWideChar CreateSemaphoreA DuplicateHandle ReleaseSemaphore GetTickCount SetThreadPriority GetCurrentThread GetSystemTimeAsFileTime InterlockedCompareExchange InitializeCriticalSection DeleteCriticalSection SleepEx TerminateThread GetExitCodeThread WaitForMultipleObjects CreateMutexA ReleaseMutex ExpandEnvironmentStringsA FormatMessageA InterlockedIncrement InterlockedDecrement InterlockedExchange TlsAlloc TlsFree TlsGetValue GetCurrentProcessId ResetEvent TlsSetValue ResumeThread SystemTimeToFileTime SetWaitableTimer CreateWaitableTimerA LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RtlUnwind FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread CreateThread GetCPInfo LCMapStringA LCMapStringW GetStringTypeW GetACP

user32

CallWindowProcW SendMessageW DefWindowProcW UpdateWindow ShowWindow EnableWindow GetSystemMenu EnableMenuItem PostMessageW EndDialog GetGUIThreadInfo DrawTextW UnregisterClassA EndPaint BeginPaint GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints MoveWindow GetDlgItem SetWindowTextW SetWindowPos SetWindowLongW DialogBoxParamW GetActiveWindow LoadBitmapW CopyRect

gdi32

DeleteDC LineTo MoveToEx CreatePen CreateRectRgn CreateFontW SelectClipRgn SetBkMode BitBlt SelectObject CreateCompatibleDC DeleteObject

shell32

ShellExecuteExW SHGetFolderPathW SHGetSpecialFolderPathW SHFileOperationW

oleaut32

SysFreeString

ws2_32

ioctlsocket select __WSAFDIsSet WSASetLastError gethostbyname send WSAIoctl connect WSAGetLastError htons ntohs getsockname setsockopt recv bind socket getsockopt closesocket WSAStartup WSACleanup

sensapi

IsNetworkAlive

advapi32

GetUserNameW RegQueryValueExW RegOpenKeyExW GetSidSubAuthority GetSidSubAuthorityCount IsValidSid GetTokenInformation OpenProcessToken CreateProcessAsUserW SetTokenInformation SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel RegCreateKeyExW RegSetValueExW RegDeleteValueW InitializeSid GetSidLengthRequired GetLengthSid CopySid RegCloseKey

ole32

CoTaskMemFree StringFromIID CoCreateGuid CoCreateInstance

Name

.text

Size

569KB

Virtual Size

568KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

297KB

Virtual Size

296KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$_0_/license.txt

SHA256 46aefaa17e63ef0fbc4ea1ed1c405bd8d55ce1cc107151404ad79fd78838cd1e
MD5 adc52e4df9473983d7c1bbe0f67b2891
SHA1 70cd5b1954d485c1c5819329c42c2f83f3add182
SHA512 0f00a030b8831c6dddcf093a1b63bd3d5757b8de7c41d7c5560872d6f6900efd9df77f7a9170e03d7b211cd6ca5ee00dcb0b5762870868a3c8c777ca4c71d4bf
SSDEEP 384:LdOmrJYeVR7P5/Udi6f8MWBrK3Kx2P74d0jrrK3Qv6c543Sr4cB/EGy5y06:L9rXP2iQ8Xpx2PMqjrhvsNe/EG2yP
MD5 SHA1 SHA512 SSDEEP

Helper.dll

IMPHASH da64430fa9e1e45430bed58cffc60be7
SHA256 01958a70df5d683d53dac05da2b8d571271299c648d7209be065f6d53cbe8bd2
MD5 08307e144b2eeea7f1e3ef1a7e3ad233
SHA1 d0606a572575ea0ef1f1bca801f996a6eff453bd
SHA512 5fcb5dd8f9b2338f5f84c9e3cdb7407d186a5776acfcfe9a8d0a8228c10df902d480e844c0c032f5d55820e0c5b6e2278e4ffed5a379f7a6f46afefee1b88f81
SSDEEP 12288:DkayrdS8MBwyRpEXtsVsX0xuq3aEnfpOEPzj5SHECY2QNYOKkf+Y3Z:NqdSdzvEXanUEPzj5MdY2mKu+Y
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

425432

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Work\Rabbit\Trunk\rbin\Helper.pdb

wininet

InternetCheckConnectionW InternetGetConnectedState

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

SetStdHandle InitializeCriticalSectionAndSpinCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID FlushFileBuffers GetCurrentDirectoryA WriteConsoleA PeekNamedPipe LockResource GetFullPathNameA GetConsoleMode GetConsoleCP GetModuleHandleA QueryPerformanceCounter HeapCreate GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings LoadResource GetConsoleOutputCP WriteConsoleW SetEndOfFile GetTimeZoneInformation GetSystemDirectoryW HeapAlloc HeapFree GetProcessHeap FindResourceExW FindResourceW CreateFileA FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount ExitProcess GetModuleFileNameA GetStdHandle SizeofResource DeleteFileW WriteFile CreateFileW Sleep RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection SetLastError FlushInstructionCache GetCurrentProcess CloseHandle SetEvent CreateEventA CompareStringA CompareStringW SetEnvironmentVariableA GetFileInformationByHandle IsValidCodePage GetOEMCP WaitForSingleObject GetTempPathW GetVersionExW GetProcAddress GetModuleHandleW VerifyVersionInfoW VerSetConditionMask GetSystemTime GetLocaleInfoW GetSystemDefaultLCID Process32NextW Process32FirstW CreateToolhelp32Snapshot TerminateProcess OpenProcess GetLastError GetModuleFileNameW GetSystemInfo LoadLibraryW CreateProcessW LocalFree FormatMessageW FreeLibrary RemoveDirectoryW FindNextFileW FindFirstFileW CreateDirectoryW ReadFile SetFilePointer GetFileSize GetDriveTypeW GetFileSizeEx GetFileTime MoveFileExW CopyFileW GetFileAttributesW GetACP GetLongPathNameW GetShortPathNameW QueryDosDeviceW GetLogicalDriveStringsW FindClose WideCharToMultiByte MultiByteToWideChar CreateSemaphoreA DuplicateHandle ReleaseSemaphore GetTickCount SetThreadPriority GetCurrentThread GetSystemTimeAsFileTime InterlockedCompareExchange InitializeCriticalSection DeleteCriticalSection SleepEx TerminateThread GetExitCodeThread WaitForMultipleObjects CreateMutexA ReleaseMutex ExpandEnvironmentStringsA FormatMessageA InterlockedIncrement InterlockedDecrement InterlockedExchange TlsAlloc TlsFree TlsGetValue GetCurrentProcessId ResetEvent TlsSetValue ResumeThread SystemTimeToFileTime SetWaitableTimer CreateWaitableTimerA LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapDestroy HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA RtlUnwind FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread CreateThread GetCPInfo LCMapStringA LCMapStringW GetStringTypeW GetFullPathNameW

user32

UnregisterClassA CallWindowProcW SendMessageW DefWindowProcW UpdateWindow ShowWindow EnableWindow GetSystemMenu EnableMenuItem PostMessageW EndDialog LoadBitmapW DrawTextW CopyRect EndPaint BeginPaint GetWindow GetWindowLongW MonitorFromWindow GetMonitorInfoW GetWindowRect GetParent GetClientRect MapWindowPoints MoveWindow GetDlgItem SetWindowTextW SetWindowPos SetWindowLongW DialogBoxParamW GetActiveWindow GetGUIThreadInfo

gdi32

DeleteObject LineTo MoveToEx CreatePen CreateRectRgn CreateFontW SelectClipRgn SetBkMode BitBlt SelectObject CreateCompatibleDC DeleteDC

oleaut32

SysFreeString

ws2_32

ioctlsocket select __WSAFDIsSet WSASetLastError gethostbyname send WSAIoctl connect WSAGetLastError htons ntohs getsockname setsockopt recv bind socket getsockopt closesocket WSAStartup WSACleanup

sensapi

IsNetworkAlive

advapi32

RegQueryValueExW RegCloseKey GetUserNameW GetSidSubAuthority GetSidSubAuthorityCount IsValidSid GetTokenInformation OpenProcessToken CreateProcessAsUserW SetTokenInformation SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel RegCreateKeyExW RegSetValueExW RegDeleteValueW InitializeSid GetSidLengthRequired GetLengthSid CopySid RegOpenKeyExW

shell32

SHGetSpecialFolderPathW SHFileOperationW ShellExecuteExW

ole32

CoTaskMemFree StringFromIID CoCreateGuid CoCreateInstance

Name

.text

Size

570KB

Virtual Size

570KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

32KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

308KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ftalk.ico

SHA256 c018c4ae7e23c12c477cbad98c4a8dfd8499b6abe10f4cb77e42f0867c260a14
MD5 cc902fd067fe0a0686352300711e91e8
SHA1 af73f5be7258fbadf2816d25d740477cadf9db91
SHA512 3b2ee6e661f0732f3613ff62331ab62d7cada67301e05597bd0f49beeadfea26a4852e59b5621b700e0416955eb71620e9c50b16e1b1e9bac5ace8eb74ce5120
SSDEEP 1536:MUwMB6RHmkTyQ6OGx4O9RAlxWu1huT61nrI0QYx0OTSXUt00000004:WmvQ6OGxz9RAlx11slYx0OT5N
MD5 SHA1 SHA512 SSDEEP

uninstall.exe.nsis

SHA256 8248396528a0debe652e6f23b6bd91c1ab0de0c21935d708f82bb883d9a6775f
MD5 aacf86fd4dba21ef2720ac3e00d193a0
SHA1 369c31fa2adf08210d9bf80deae6dc17265b2fb0
SHA512 d31e3dec220d9800a5b84e84cf7076e9ed3a9b10754cc105e83dfc0a7b1fae5f19a3b2055965d607d8b7d81fb4b75c5643a7fa678a78a3fa01ccc069b45d0415
SSDEEP 768:wGg0whw7Jvd88+73zldBvHotarU87N0R0iOCwqsxNtRgsSWkAV1:Fg0whw7JvmDzlXP7X7NGDOCXrsSWkc1
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer