JaffaCakes118_60eff1847960a1cc9a05ce3fcc089948

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_60eff1847960a1cc9a05ce3fcc089948
Size

7.8MB
MD5

60eff1847960a1cc9a05ce3fcc089948
SHA1

edeedf96f8f269371ae8c37bb3be01b35b6da651
SHA256

f403174c2dcf0b43c2eb338dfcc7b44da183ff36a3563bfbe56edd82e77fb69d
SHA512

a7982bc524a091b282569d18253e24d13f4a0db191766a4b8399ee36b3f73f259030e886b7a75f5f05f92ed5a4ce706b0fabedfb3958a22d6133f5ae0248e554
SSDEEP

196608:PPe7CuVqeNECNhxU+E1cDl8sfeXFW4Tov6G9ULgJn:3QlVqyNbUWlbeXg8ovt9U0h

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/3.8.1/Blackshades NET Setup Tutorial.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/3.8.1/client.exe
unpack001/3.8.1/data/CODEJO~1.oca
unpack001/3.8.1/data/CODEJO~2.oca

One or more email addresses in PDF identified
Detects presence of email addresses in PDF files.
pdf

Files

JaffaCakes118_60eff1847960a1cc9a05ce3fcc089948
.rar
3.8.1/Blackshades NET Setup Tutorial.pdf
.pdf
- http://No-IP.com
- http://YourDNS.no-ip.biz:88
- http://dev.mysql.com/downloads/connector/odbc/5.1.html
- http://gmail.com
- http://localhost/security/xamppsecurity.php
- http://no-ip.biz
- http://portforward.com
- http://portforward.com/
- http://www.apachefriends.org/download.ph...-1.7.3.exe
- http://www.apachefriends.org/download.php?xampplite-win32-1.7.3.exe
- http://www.no-ip.com
- http://www.no-ip.com/
- http://yourhost.no-ip.biz
- http://yournick.no-ip.biz
- https://www.no-ip.com/downloads.php
- mailto:[email protected]
- Show all
3.8.1/Blackshades NET User Guide.pdf
.pdf
- http://fileave.com
- http://gmail.com
3.8.1/client.exe
.exe windows:4 windows x86 arch:x86

2b9da892b547812bf239e1d10c989af3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaRefVarAry

user32

MessageBoxA

kernel32

GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

Exports

Exports

^��%��[ :o#��)�8Sq(��fހ�;��q��KJ!Jl~m�|׌�TZ�ѿ��"v�g�_��|�$c<L��WG��0!��5p��O.g_��D��7$KHr��A*`p��:r]�kM��oQ��S�3�a��+'����6��j�ez�Fo�(��\��c�-��=��{��:ٷybV��$qc?~! �=2àL�_i�?��s{�=~l+n�Hm�|��Ѭ�NQ��~�Q׌��ښ+��p��:��%R�`ꭸi�ڝ�[zq]��iA�^|��4+��Ij��"Ѹ� p��3�R��0�=a� l��=��`��-1!}��tq��g�Zm�3�f�q¹��F1� U ]�G�B]g��P��>o��D�� U 54`&��;HU�[E-\-�*�"NA�8aK��8��V��u�/�oE �l��33�[D:85�1K3e�5he0bZw(ed�4�2C��Y��Hq!?��r1Ci��$ehpF��E ^��/��KɆ/��ڌ��!�Ĳ�"��5l�`Ǧik�9�p��5i�s��*|=��^�T��P�V[�� na9��oq��jL�U��E�j��Nw��o�B��l|��Vb�\>�9��bJ'��>y�s��1�h��Ty��0G�F��ǖ�؁��uw9}PG��ƖŅ�� /cq�� ]y�� (oM�At�O�l5��1�ŀ[�Ώ��Q��Vw|C��Xv��e_��C-�W4��y7=��gv�%o��q�>�3ۿVGeU��N��߹:��w�R&�|OƧʻAF >�s��-2�\��y#�J��p|��8�X8v|�:~��'E�}x�? �e�w�L��I.1�p�=�/��+�\��IĎy��B�k��t��w�8�׶�!�O�-y!r�� Wˣ��~�� c��Y?�`>�:dE��MZh�E˕�V��rb�<JJ{��MXg��7V��6p��V�S��B��Cdە굚u�|P�iS��2��Ӳ�* ��8�#�*�f��-05Zo�sԱ��D� ��T9:� F��ǥ!��)��t�+E�'W0�f��4��Q��g��\ ��o� �h�U�N^]%f=��Ty�7�.�}$@��{r9�M��;��Γ��o�1!��0��b��%�w��*�R��|�ǡ˵��Ӆ��R� �9EA9c�G� p"߲� ?�2�@d��o:��ƾ0iǃy�8��->��:�o6:��'��Iqp �{�nP��=�v�W��<�徢3��~y��@��b�� [B��B�#U� g`�Ԫ��"��ΔUcS��i�G.`n�f��o��;-��M��p��(�Xr��C�My�Gl��U��I�6"��I�ݪ�t#J�<��PI�zc�� P �+oC�Ě��ʷ��'��<�2�v��'�� {�|�k5��r]m�ƅȅ �\�m��-c]CI��t _W��_&S�P��`�N�X��]��/��ٌ��q�D��4~oH^i��mDW�8-��/��Gv��.\��3n^��q�{�#��l�6�� !��~��P��i.[6e�E��?��Ά�Z�0��iGk��#Ɛ�"��n��[a��aQ-(u��0Px��s6�4G�� !�+��i,��$<Rx�f��Z�� ѷ��Hgm��߭Ủk;�ڴ�pmigS��U�-S5��2�t��L1��lGf�� )�E�M�YgGA��b��o��@��/�� V��=n��cX�v��dg��~�A��,9�b4x�mH�'09�H�Xs�L-$�4��E]_��]�$��Y#��x�r�[�qF�x`5��_��8PR܈-�:&�� xx��1��~ÎBk:�kj�휓߆�D^we�wJ?�'�Jv��Å7ue�O�N;wE�b>��}*{2 ⱺ,W#��z;�4��$O�a�Ͼ �t�F[�b�H��{r݃�A��>!n�2��>��M��U�󨴾�'.�4��n��y��̱��蝺��;w��/��TG�光��wM�V݇��:ʓ�>U�4uN�:=�*�͊մ�:N��Z�YFAUɗ��Xν/��Y�.z��]�԰��/�u�nk��ح�?��ٵ��"�ȰХ`��cL$@�䐗��v:w�lw@��&j�BO{�dئ�LFsך��$B��{��H(��,�AP�:�D ��JĈVg��1��m��5�f׍�e��1��lplUy�څ��~��,�r�@F�f�ǌeF��En��N�!!�dx��M�g��[�0�U�\��׫�}~#�No��b/�6�\8:j%#��L�R��_��}��5�A��!i.�%��=)� �Ă�!u�[(�ۣ��-\ڋ��"�H��X7��Ij��,¢hf�9.Ϋ_̼h!78�� Q6��޼��>#�7��a�@M"�?��<�&�$��%�)��F�EG�<6�O<ƼviM��( �KhlqaN�슃�W��_dy.��hjk��3Rg�V��;H�8V�JQz~:�D��U�{��X��R��X(3��l W�|;q�6�-*)�:A�uk�d� QDC�4ә��G+�ەO�K�^�X�N�V��f��i3��"9��2��ӱs�Ǔ��.B�GK'��)��7V�T��Uگ�PX=��W yO|}��=M�5˺�+Q��W�X)l��W_��Rk#��S�x*�q��j�=c�Ǒ�UGJ�nVm�p.��ޥv

Sections

.text
Size: - Virtual size: 4.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss0
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss1
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss2
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
3.8.1/data/CODEJO~1.oca
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 377KB - Virtual size: 380KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3.8.1/data/CODEJO~2.oca
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3.8.1/data/Codejock.Controls.Unicode.v12.0.2.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

56accb93af10812d19391799de9a7230

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:77:8f:22:eb:93:3a:28:79:c9:0b:a2:ec:17:18:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

30-11-2006 00:00

Not After

20-10-2008 23:59

Subject

CN=Codejock Technologies\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Codejock Software,O=Codejock Technologies\, LLC,L=Owosso,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:51:1d:1c:93:19:fb:72:0a:df:db:f8:6b:1a:7d:95:23:9d:c2:dc
Signer

Actual PE Digest

b0:51:1d:1c:93:19:fb:72:0a:df:db:f8:6b:1a:7d:95:23:9d:c2:dc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42u

ord5436
ord6379
ord6390
ord4215
ord2576
ord3649
ord2430
ord1173
ord6193
ord6375
ord6376
ord6211
ord6051
ord1768
ord5286
ord3737
ord567
ord818
ord4294
ord6437
ord1230
ord4270
ord755
ord470
ord613
ord289
ord2371
ord6037
ord2444
ord1143
ord1258
ord1560
ord268
ord703
ord603
ord1961
ord2446
ord273
ord403
ord2385
ord1252
ord1763
ord462
ord3110
ord3310
ord3465
ord452
ord6303
ord521
ord4162
ord6153
ord699
ord3933
ord397
ord5589
ord3433
ord6867
ord912
ord4183
ord6489
ord4272
ord6279
ord4273
ord2755
ord4199
ord834
ord836
ord2806
ord4155
ord2805
ord5210
ord1565
ord849
ord850
ord906
ord845
ord537
ord1130
ord2225
ord404
ord957
ord1852
ord5445
ord6389
ord909
ord4200
ord3981
ord1769
ord884
ord886
ord463
ord882
ord876
ord878
ord879
ord2885
ord6568
ord857
ord941
ord6771
ord536
ord6381
ord6385
ord1971
ord5438
ord3313
ord665
ord5180
ord354
ord925
ord927
ord922
ord1203
ord1220
ord2863
ord5571
ord3520
ord433
ord4197
ord5706
ord1637
ord4158
ord1197
ord2914
ord4015
ord2719
ord2722
ord2721
ord1941
ord2144
ord6451
ord6597
ord3792
ord2372
ord2373
ord2559
ord4265
ord1131
ord3000
ord2127
ord3727
ord556
ord809
ord2114
ord1932
ord4282
ord1226
ord5047
ord1787
ord2567
ord4390
ord3397
ord3569
ord609
ord4279
ord4118
ord3084
ord6166
ord6871
ord5781
ord940
ord1147
ord6654
ord1137
ord3605
ord656
ord765
ord6456
ord4474
ord3087
ord2637
ord2100
ord6373
ord2070
ord6195
ord3716
ord795
ord2108
ord6655
ord3693
ord3952
ord2634
ord1863
ord1000
ord5585
ord394
ord696
ord3430
ord4180
ord3625
ord2572
ord4394
ord682
ord1836
ord1841
ord4078
ord1840
ord5801
ord6082
ord1900
ord1683
ord2520
ord5284
ord4433
ord2046
ord4425
ord771
ord2033
ord498
ord1008
ord3470
ord4254
ord5845
ord4709
ord2638
ord5784
ord472
ord4253
ord3714
ord5155
ord5156
ord5154
ord4899
ord4736
ord4942
ord4352
ord4371
ord4848
ord5283
ord4829
ord3694
ord793
ord768
ord489
ord2286
ord2354
ord2294
ord4970
ord6330
ord1764
ord6362
ord2405
ord2016
ord4395
ord692
ord1839
ord3798
ord6190
ord4119
ord1807
ord5857
ord3898
ord1644
ord2862
ord2104
ord6191
ord3515
ord6397
ord3865
ord2455
ord3706
ord783
ord1808
ord4229
ord324
ord2706
ord6004
ord6896
ord2293
ord668
ord2762
ord356
ord1850
ord2644
ord1662
ord4532
ord3525
ord2431
ord1686
ord4336
ord4681
ord4633
ord5670
ord2148
ord4850
ord4914
ord3128
ord5998
ord2129
ord1955
ord5207
ord2948
ord3863
ord5144
ord4699
ord4701
ord2871
ord2993
ord5645
ord4108
ord4655
ord4654
ord4762
ord4644
ord4897
ord4542
ord4515
ord4588
ord4982
ord4919
ord4924
ord4929
ord4653
ord4903
ord4902
ord4662
ord4661
ord4660
ord4642
ord4683
ord5017
ord4648
ord4637
ord4348
ord4774
ord4643
ord4631
ord4630
ord5054
ord4578
ord4365
ord4355
ord4350
ord4733
ord4735
ord4732
ord4403
ord4597
ord4409
ord4986
ord4973
ord2480
ord3399
ord4533
ord4528
ord4943
ord2533
ord2949
ord2376
ord6366
ord2978
ord3143
ord3255
ord4460
ord3264
ord2981
ord3075
ord4076
ord4618
ord5821
ord1202
ord723
ord4244
ord4990
ord4737
ord5884
ord5975
ord6124
ord5569
ord3194
ord5027
ord5570
ord3052
ord4814
ord2558
ord3257
ord812
ord1088
ord5858
ord5606
ord4524
ord4538
ord4517
ord5681
ord3269
ord439
ord736
ord5491
ord5778
ord3915
ord1255
ord1824
ord5647
ord350
ord4028
ord5638
ord1083
ord501
ord1113
ord1112
ord5446
ord3371
ord423
ord1125
ord1607
ord4805
ord1678
ord6036
ord1679
ord3469
ord5002
ord956
ord353
ord6865
ord5679
ord5949
ord3494
ord2507
ord355
ord801
ord541
ord4037
ord2605
ord1699
ord6566
ord729
ord2496
ord2787
ord430
ord2715
ord2382
ord3054
ord5094
ord5097
ord4461
ord4298
ord3345
ord5006
ord975
ord5468
ord3398
ord2874
ord2873
ord4146
ord4072
ord5233
ord5278
ord2641
ord1658
ord4430
ord4421
ord366
ord1834
ord4237
ord4787
ord5248
ord5224
ord1714
ord4583
ord4582
ord4893
ord4364
ord4886
ord4529
ord5070
ord4335
ord4342
ord4881
ord4525
ord4539
ord4537
ord4520
ord4523
ord4518
ord4957
ord4954
ord4103
ord5236
ord3743
ord1718
ord5256
ord4426
ord761
ord480
ord1896
ord4251
ord4888
ord4717
ord5115
ord674
ord5479
ord2488
ord5955
ord3114
ord6038
ord3225
ord3207
ord2896
ord5980
ord3198

msvcrt

_ftol
wcscmp
wcsstr
_wcslwr
_wcsicmp
_wtoi
_purecall
memmove
free
malloc
strchr
swscanf
__CxxFrameHandler
wcslen
wcstod
wcscpy
wcsncpy
calloc
realloc
_wsplitpath
wcstombs
floor
fseek
_fstat
_wfopen
fclose
ftell
fgetws
isprint
swprintf
isxdigit
qsort
sprintf
strncpy
longjmp
fprintf
_iob
abort
_setjmp3
fread
strtod
wcsncmp
_CxxThrowException
wcschr
ceil
wcsrchr
_wcsdup
iswxdigit
iswalnum
iswspace
iswdigit
iswprint
iswalpha
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_CIpow

kernel32

IsDBCSLeadByte
lstrcpyW
InterlockedDecrement
lstrcpynW
GlobalSize
LocalFree
GetPrivateProfileIntW
GetCurrentDirectoryW
GetModuleFileNameW
GetTickCount
GetVersionExW
LoadLibraryA
EnumResourceLanguagesW
EnumResourceTypesW
MultiByteToWideChar
WideCharToMultiByte
WritePrivateProfileStringW
GetFileAttributesW
lstrcmpA
EnumResourceNamesW
FreeLibrary
LeaveCriticalSection
EnterCriticalSection
GlobalAlloc
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
SizeofResource
FindResourceW
LoadResource
LockResource
CreateFileW
ReadFile
CloseHandle
InterlockedIncrement
GetModuleHandleW
GlobalLock
GlobalUnlock
GetModuleHandleA
MulDiv
LoadLibraryW
GetProcAddress
GetCurrentThreadId
LocalAlloc

user32

TabbedTextOutW
GetSubMenu
PeekMessageW
SetRect
SystemParametersInfoW
DefWindowProcW
LoadCursorW
GetForegroundWindow
GetLastActivePopup
GetWindowLongW
GetDialogBaseUnits
IntersectRect
SetCapture
LockWindowUpdate
IsRectEmpty
GetCapture
GetMessageW
ClientToScreen
GetScrollPos
DispatchMessageW
ReleaseCapture
InvertRect
CopyRect
GetClientRect
IsWindow
GetWindowRect
SetRectEmpty
GetCursorPos
ScreenToClient
PtInRect
CallNextHookEx
GetParent
SetWindowsHookExW
UnhookWindowsHookEx
GetDesktopWindow
GetDC
ReleaseDC
GetSysColor
GetWindowPlacement
ShowWindow
DrawTextW
LoadIconW
DeferWindowPos
BeginDeferWindowPos
CreateAcceleratorTableW
wsprintfW
GetDlgItem
EmptyClipboard
CloseClipboard
CheckMenuItem
GetNextDlgTabItem
MessageBeep
PostMessageW
DrawFrameControl
SetCursor
AdjustWindowRectEx
RedrawWindow
GetSysColorBrush
LoadStringW
SetWindowTextW
GetDlgCtrlID
GetWindow
GetClassNameW
DrawFocusRect
FillRect
GetFocus
InflateRect
SetActiveWindow
UpdateWindow
EqualRect
SetWindowPos
SetTimer
InvalidateRect
GetCursor
GetKeyState
KillTimer
IsWindowVisible
GrayStringW
DrawAnimatedRects
FindWindowW
EnumChildWindows
SetForegroundWindow
ValidateRect
SetParent
GetClassLongW
SetClassLongW
WindowFromPoint
GetSystemMetrics
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
LoadMenuW
CopyImage
SetClipboardData
LoadBitmapW
DestroyIcon
CopyIcon
CreateIconIndirect
GetIconInfo
DrawIconEx
DrawStateW
DestroyAcceleratorTable
UnionRect
TranslateMessage
HideCaret
WinHelpW
OpenClipboard
VkKeyScanW
GetDoubleClickTime
IsChild
MoveWindow
DrawEdge
SetScrollPos
GetClipboardData
EnableMenuItem
IsClipboardFormatAvailable
EnableScrollBar
ShowScrollBar
CreateCaret
SetCaretPos
DragDetect
ShowCaret
GetScrollInfo
EndDeferWindowPos
DestroyCaret
CreateIconFromResourceEx
LoadImageW
RegisterClipboardFormatW
SetWindowRgn
GetWindowRgn
CallWindowProcW
RegisterWindowMessageW
IsWindowUnicode
SetWindowLongW
GetWindowLongA
SetWindowLongA
SendMessageW
OffsetRect
EnableWindow

gdi32

CreateDIBSection
DeleteDC
StretchBlt
CreateBitmap
SetTextColor
SetBkColor
SetStretchBltMode
GetDIBits
GetBitmapBits
ExtCreateRegion
GetTextMetricsW
CreatePatternBrush
GetBkColor
GetTextColor
GetTextAlign
SetPixelV
GetWindowOrgEx
CreateFontW
GetCharWidthW
SetBoundsRect
GetRgnBox
CreatePolygonRgn
RoundRect
CombineRgn
GetClipBox
GetViewportOrgEx
GetViewportExtEx
GetWindowExtEx
SetViewportOrgEx
GetClipRgn
IntersectClipRect
ExtSelectClipRgn
MoveToEx
Polyline
Ellipse
LineTo
Rectangle
GetTextExtentPointW
SetBrushOrgEx
CreateRectRgn
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateFontIndirectW
GetTextExtentPoint32W
Polygon
GetStockObject
EnumFontFamiliesExW
SetPixel
PatBlt
CreateSolidBrush
CreatePen
DeleteObject
BitBlt
CreateRectRgnIndirect
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetObjectW
SetBkMode
GetDeviceCaps
GetPixel

advapi32

RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegQueryValueExW

shell32

DragQueryFileW
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW
SHAppBarMessage
Shell_NotifyIconW

comctl32

ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIcon
ImageList_GetIconSize
ImageList_DrawEx
ImageList_ReplaceIcon
ImageList_Add
ImageList_GetImageInfo
ImageList_Create
_TrackMouseEvent
ImageList_Draw
ImageList_AddMasked
ord17

ole32

CoCreateInstance
OleRun
ReleaseStgMedium

olepro32

ord252
ord254
ord253

oleaut32

VarI4FromCy
VarI4FromR4
VarI4FromR8
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
SysFreeString
SysAllocString
VariantChangeTypeEx
OleLoadPicturePath
SafeArrayGetDim
VariantClear
LoadRegTypeLi
SafeArrayCreate

Exports

Exports

?interfaceMap@CWebBrowserSite@@1UAFX_INTERFACEMAP@@B
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 924KB - Virtual size: 922KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3.8.1/data/Codejock.SkinFramework.v12.0.2.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

b97546b32de3f20f9d20a53cbd559da6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:77:8f:22:eb:93:3a:28:79:c9:0b:a2:ec:17:18:f5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

30-11-2006 00:00

Not After

20-10-2008 23:59

Subject

CN=Codejock Technologies\, LLC,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Codejock Software,O=Codejock Technologies\, LLC,L=Owosso,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:73:3f:7c:30:f0:0e:0c:7d:7c:8a:ff:b5:20:eb:6f:8c:73:71:64
Signer

Actual PE Digest

33:73:3f:7c:30:f0:0e:0c:7d:7c:8a:ff:b5:20:eb:6f:8c:73:71:64

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord5825
ord423
ord723
ord5163
ord1614
ord3797
ord4299
ord3474
ord5008
ord800
ord2764
ord6877
ord5572
ord2915
ord2818
ord540
ord939
ord924
ord537
ord1168
ord1567
ord665
ord5442
ord353
ord268
ord6874
ord535
ord3262
ord1206
ord1223
ord2486
ord3237
ord860
ord1601
ord858
ord4278
ord5683
ord2514
ord2385
ord6374
ord4627
ord640
ord4160
ord2450
ord6199
ord1640
ord323
ord641
ord801
ord2640
ord2623
ord541
ord1177
ord6467
ord5861
ord4042
ord2613
ord1706
ord6570
ord1799
ord2723
ord2390
ord3059
ord5100
ord5103
ord4467
ord4303
ord3350
ord5012
ord975
ord5472
ord3403
ord2879
ord2878
ord4151
ord4077
ord5237
ord5282
ord2649
ord1665
ord4436
ord4427
ord366
ord1842
ord4242
ord4793
ord5805
ord2379
ord4123
ord5252
ord2393
ord6197
ord2233
ord5228
ord1721
ord4589
ord4588
ord4899
ord4370
ord4892
ord4535
ord5076
ord4341
ord4348
ord4887
ord4531
ord4545
ord4543
ord4526
ord4529
ord4524
ord4963
ord4960
ord4108
ord5240
ord3748
ord1725
ord5260
ord4432
ord761
ord480
ord1904
ord4256
ord4894
ord3495
ord1140
ord3874
ord5981
ord4723
ord5121
ord3092
ord2859
ord2860
ord6880
ord5575
ord3525
ord433
ord861
ord539
ord674
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord3401
ord3670
ord561
ord3952
ord2724
ord6354
ord1216
ord1227
ord6364
ord3326
ord6365
ord4472
ord5498
ord3278
ord3681
ord446
ord743
ord6440
ord1214
ord4249
ord2687
ord1226
ord1210
ord922
ord3946
ord2956
ord2556
ord3571
ord3626
ord4668
ord1146
ord5314
ord324
ord6030
ord1269
ord3663
ord941
ord668
ord5710
ord3178
ord3181
ord4058
ord2781
ord2770
ord356
ord4277
ord2763
ord2614
ord4624
ord6282
ord536
ord5440
ord6383
ord5450
ord6394
ord2740
ord2801
ord686
ord2096
ord384
ord2971
ord5759
ord6192
ord5756
ord6186
ord4330
ord6189
ord6021
ord6172
ord5873
ord5789
ord5794
ord5678
ord5736
ord5579
ord5571
ord6061
ord5864
ord3596
ord3706
ord5781
ord3693
ord3573
ord2405
ord2753
ord2754
ord6648
ord3138
ord2919
ord3517
ord3619
ord5875
ord764
ord3028
ord2863
ord824
ord826
ord2107
ord2841
ord2452
ord1265
ord703
ord603
ord1969
ord2454
ord273
ord403
ord1259
ord1770
ord462
ord3115
ord3315
ord3470
ord452
ord6307
ord521
ord4167
ord4275
ord3742
ord567
ord818
ord6157
ord699
ord3938
ord397
ord5593
ord3438
ord6876
ord912
ord4188
ord6283
ord4204
ord834
ord836
ord2814
ord2813
ord5216
ord1572
ord849
ord850
ord906
ord845
ord404
ord957
ord1860
ord5449
ord6393
ord909
ord4205
ord3986
ord1777
ord884
ord886
ord463
ord882
ord876
ord878
ord879
ord2890
ord6572
ord857
ord940
ord6779
ord6385
ord6389
ord1979
ord3318
ord5186
ord354
ord926
ord2868
ord4202
ord1644
ord4163
ord805
ord3030
ord2381
ord1153
ord1176
ord6493
ord533
ord923
ord2567
ord1270
ord3402
ord2867
ord6662
ord5631
ord4284
ord4287
ord2714
ord1949
ord4226
ord3884
ord755
ord470
ord3920
ord1229
ord2380
ord3089
ord2862
ord3752
ord3754
ord6194
ord289
ord613
ord1262
ord1132
ord4081
ord1116
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord269
ord3080
ord3376
ord4908
ord4909
ord4659
ord4935
ord4930
ord4925
ord4988
ord4594
ord4521
ord4548
ord4903
ord4650
ord4768
ord4660
ord4661
ord4113
ord5649
ord2998
ord2876
ord4707
ord4705
ord5150
ord3868
ord2953
ord5213
ord1963
ord2137
ord6002
ord3133
ord4920
ord4856
ord2156
ord5674
ord4639
ord4687
ord4342
ord1693
ord2439
ord2986
ord3269
ord4466
ord3260
ord3148
ord2983
ord5277
ord2124
ord2446
ord5261
ord1727
ord5065
ord3749
ord6376
ord2055
ord2648
ord4441
ord4837
ord3798
ord5290
ord4353
ord6370
ord2384
ord5241
ord4407
ord1776
ord4078
ord6055
ord2954
ord2541
ord4949
ord4534
ord4539
ord3404
ord2488
ord4979
ord4992
ord4415
ord4603
ord4409
ord4738
ord4741
ord4739
ord4356
ord4361
ord4371
ord4584
ord5060
ord4636
ord4637
ord4649
ord4780
ord4354
ord4643
ord4654
ord5023
ord4689
ord4648
ord4666
ord4129
ord4667
ord3530
ord1877
ord1133
ord2414
ord1641
ord1099
ord2864
ord562
ord1113
ord816
ord3258
ord1114
ord4021
ord823
ord2729
ord2730
ord2727
ord4003
ord614

msvcrt

_CxxThrowException
_ftol
_mbsrchr
_strdup
free
_mbscmp
wcsncpy
wcslen
_mbsicmp
_CIpow
wcscmp
wcsstr
_wcslwr
atoi
__CxxFrameHandler
malloc
memmove
sscanf
strtod
mbstowcs
strrchr
wcschr
_mbsstr
sprintf
strncpy
longjmp
fprintf
_iob
abort
_setjmp3
fread
??1type_info@@UAE@XZ
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
_purecall

kernel32

LocalSize
OpenProcess
LoadLibraryExW
LoadLibraryExA
LoadLibraryW
CreateThread
VirtualQuery
VirtualProtect
GetSystemInfo
GetCurrentProcessId
GetVersionExA
EnumResourceLanguagesA
EnumResourceTypesA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
EnumResourceNamesA
FreeLibrary
LeaveCriticalSection
LocalFree
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
SizeofResource
FindResourceA
LoadResource
LockResource
CreateFileA
ReadFile
CloseHandle
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetCurrentThreadId
InterlockedDecrement
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
InterlockedIncrement
GetModuleFileNameA
lstrcpyA
GetFileAttributesA
MulDiv
lstrlenA
EnterCriticalSection
LocalAlloc

user32

GetClientRect
SetRectEmpty
GetCursorPos
ScreenToClient
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
GetSysColor
LoadStringA
LoadBitmapA
GetWindowRect
EqualRect
InvalidateRect
SystemParametersInfoA
AdjustWindowRectEx
EnableWindow
SetTimer
KillTimer
GetKeyState
SetRect
CopyRect
OffsetRect
InflateRect
ReleaseCapture
GetParent
GetWindowLongA
SendMessageA
GetSystemMetrics
PtInRect
GetDC
ReleaseDC
GetDesktopWindow
GetSystemMenu
DefMDIChildProcW
DefMDIChildProcA
DefDlgProcW
DefDlgProcA
DefFrameProcW
DefFrameProcA
DefWindowProcW
CallWindowProcW
GetScrollInfo
EnableScrollBar
SetScrollInfo
SetScrollPos
GetSysColorBrush
CallWindowProcA
GetClassNameA
GetClassLongA
FillRect
LoadMenuIndirectA
MoveWindow
DispatchMessageA
LookupIconIdFromDirectoryEx
LoadMenuA
CopyImage
RegisterWindowMessageA
DestroyIcon
CopyIcon
CreateIconIndirect
GetIconInfo
DrawIconEx
DrawStateA
CreateIconFromResourceEx
LoadImageA
RegisterClipboardFormatA
GrayStringA
DrawTextA
TabbedTextOutA
GetMenuState
GetMenu
GetMenuItemCount
IsWindowVisible
GetDoubleClickTime
RegisterClassA
TranslateMessage
SetWindowRgn
SetClassLongA
GetFocus
DrawFocusRect
EnumWindows
GetWindowThreadProcessId
PostMessageA
GetWindow
IsWindowUnicode
GetWindowLongW
SetWindowLongW
SetWindowLongA
EndPaint
BeginPaint
SendMessageTimeoutA
LoadIconA
DrawFrameControl
RegisterClassW
DrawEdge
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
LoadCursorA
IntersectRect
SetCapture
IsRectEmpty
GetCapture
GetMessageA
IsWindow
ClientToScreen

gdi32

Polygon
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
DeleteDC
StretchBlt
CreateBitmap
SetTextColor
SetBkColor
CreateDIBSection
SetStretchBltMode
GetDIBits
CreateDIBitmap
SelectPalette
GetObjectType
GetTextColor
ExtSelectClipRgn
IntersectClipRect
GetClipRgn
CreateRectRgn
GetTextCharsetInfo
CombineRgn
OffsetRgn
SetBrushOrgEx
SetBkMode
CreatePatternBrush
SetPixel
PatBlt
CreateSolidBrush
CreatePen
DeleteObject
CreateCompatibleBitmap
SelectObject
GetPixel
BitBlt
CreateCompatibleDC
GetTextExtentPoint32A
CreateFontIndirectA
CreatePalette
GetObjectA
GetDeviceCaps

advapi32

RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA

shell32

DragQueryFileA

comctl32

ImageList_Add
ImageList_DrawEx
ImageList_GetImageInfo
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_GetIcon
_TrackMouseEvent
FlatSB_GetScrollProp
ImageList_Draw
ImageList_GetBkColor
ImageList_GetIconSize
ImageList_DrawIndirect

ole32

CoCreateInstance
ReleaseStgMedium
OleRun

olepro32

ord254
ord253
ord252

oleaut32

SysAllocString
VariantChangeTypeEx
OleLoadPicturePath
SafeArrayGetDim
SafeArrayCreate
VarI4FromCy
VarI4FromR4
VarI4FromR8
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
VariantClear
LoadRegTypeLi
SysFreeString

imagehlp

ImageDirectoryEntryToData

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 332KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
3.8.1/data/data.ini
3.8.1/data/icons/1.gif
.gif
3.8.1/data/icons/10.gif
.gif
3.8.1/data/icons/100.gif
.gif
3.8.1/data/icons/101.gif
.gif
3.8.1/data/icons/102.gif
.gif
3.8.1/data/icons/103.gif
.gif
3.8.1/data/icons/104.gif
.gif
3.8.1/data/icons/105.gif
.gif
3.8.1/data/icons/106.gif
.gif
3.8.1/data/icons/107.gif
.gif
3.8.1/data/icons/108.gif
.gif
3.8.1/data/icons/109.gif
.gif
3.8.1/data/icons/11.gif
.gif
3.8.1/data/icons/110.gif
.gif
3.8.1/data/icons/111.gif
.gif
3.8.1/data/icons/112.gif
.gif
3.8.1/data/icons/113.gif
.gif
3.8.1/data/icons/114.gif
.gif
3.8.1/data/icons/115.gif
.gif
3.8.1/data/icons/116.gif
.gif
3.8.1/data/icons/117.gif
.gif
3.8.1/data/icons/118.gif
.gif
3.8.1/data/icons/119.gif
.gif
3.8.1/data/icons/12.gif
.gif
3.8.1/data/icons/120.gif
.gif
3.8.1/data/icons/121.gif
.gif
3.8.1/data/icons/122.gif
.gif
3.8.1/data/icons/123.gif
.gif
3.8.1/data/icons/124.gif
.gif
3.8.1/data/icons/125.gif
.gif
3.8.1/data/icons/126.gif
.gif
3.8.1/data/icons/127.gif
.gif
3.8.1/data/icons/128.gif
.gif
3.8.1/data/icons/129.gif
.gif
3.8.1/data/icons/13.gif
.gif
3.8.1/data/icons/130.gif
.gif
3.8.1/data/icons/131.gif
.gif
3.8.1/data/icons/132.gif
.gif
3.8.1/data/icons/133.gif
.gif
3.8.1/data/icons/134.gif
.gif
3.8.1/data/icons/135.gif
.gif
3.8.1/data/icons/136.gif
.gif
3.8.1/data/icons/137.gif
.gif
3.8.1/data/icons/138.gif
.gif
3.8.1/data/icons/139.gif
.gif
3.8.1/data/icons/14.gif
.gif
3.8.1/data/icons/140.gif
.gif
3.8.1/data/icons/141.gif
.gif
3.8.1/data/icons/142.gif
.gif
3.8.1/data/icons/143.gif
.gif
3.8.1/data/icons/144.gif
.gif
3.8.1/data/icons/145.gif
.gif
3.8.1/data/icons/146.gif
.gif
3.8.1/data/icons/147.gif
.gif
3.8.1/data/icons/148.gif
.gif
3.8.1/data/icons/149.gif
.gif
3.8.1/data/icons/15.gif
.gif
3.8.1/data/icons/150.gif
.gif
3.8.1/data/icons/151.gif
.gif
3.8.1/data/icons/152.gif
.gif
3.8.1/data/icons/153.gif
.gif
3.8.1/data/icons/154.gif
.gif
3.8.1/data/icons/155.gif
.gif
3.8.1/data/icons/156.gif
.gif
3.8.1/data/icons/157.gif
.gif
3.8.1/data/icons/158.gif
.gif
3.8.1/data/icons/159.gif
.gif
3.8.1/data/icons/16.gif
.gif
3.8.1/data/icons/160.gif
.gif
3.8.1/data/icons/161.gif
.gif
3.8.1/data/icons/162.gif
.gif
3.8.1/data/icons/163.gif
.gif
3.8.1/data/icons/164.gif
.gif
3.8.1/data/icons/165.gif
.gif
3.8.1/data/icons/166.gif
.gif
3.8.1/data/icons/167.gif
.gif
3.8.1/data/icons/168.gif
.gif
3.8.1/data/icons/169.gif
.gif
3.8.1/data/icons/17.gif
.gif
3.8.1/data/icons/170.gif
.gif
3.8.1/data/icons/171.gif
.gif
3.8.1/data/icons/172.gif
.gif
3.8.1/data/icons/173.gif
.gif
3.8.1/data/icons/174.gif
.gif
3.8.1/data/icons/175.gif
.gif
3.8.1/data/icons/176.gif
.gif
3.8.1/data/icons/177.gif
.gif
3.8.1/data/icons/178.gif
.gif
3.8.1/data/icons/179.gif
.gif
3.8.1/data/icons/18.gif
.gif
3.8.1/data/icons/180.gif
.gif
3.8.1/data/icons/181.gif
.gif
3.8.1/data/icons/182.gif
.gif
3.8.1/data/icons/183.gif
.gif
3.8.1/data/icons/184.gif
.gif
3.8.1/data/icons/185.gif
.gif
3.8.1/data/icons/186.gif
.gif
3.8.1/data/icons/187.gif
.gif
3.8.1/data/icons/188.gif
.gif
3.8.1/data/icons/189.gif
.gif
3.8.1/data/icons/19.gif
.gif
3.8.1/data/icons/190.gif
.gif
3.8.1/data/icons/191.gif
.gif
3.8.1/data/icons/192.gif
.gif
3.8.1/data/icons/193.gif
.gif
3.8.1/data/icons/194.gif
.gif
3.8.1/data/icons/195.gif
.gif
3.8.1/data/icons/196.gif
.gif
3.8.1/data/icons/197.gif
.gif
3.8.1/data/icons/198.gif
.gif
3.8.1/data/icons/199.gif
.gif
3.8.1/data/icons/2.gif
.gif
3.8.1/data/icons/20.gif
.gif
3.8.1/data/icons/200.gif
.gif
3.8.1/data/icons/201.gif
.gif
3.8.1/data/icons/202.gif
.gif
3.8.1/data/icons/203.gif
.gif
3.8.1/data/icons/204.gif
.gif
3.8.1/data/icons/205.gif
.gif
3.8.1/data/icons/206.gif
.gif
3.8.1/data/icons/207.jpg
.jpg
3.8.1/data/icons/208.gif
.gif
3.8.1/data/icons/209.gif
.gif
3.8.1/data/icons/21.gif
.gif
3.8.1/data/icons/210.gif
.gif
3.8.1/data/icons/211.gif
.gif
3.8.1/data/icons/212.gif
.gif
3.8.1/data/icons/213.gif
.gif
3.8.1/data/icons/214.gif
.gif
3.8.1/data/icons/215.gif
.gif
3.8.1/data/icons/216.gif
.gif
3.8.1/data/icons/217.gif
.gif
3.8.1/data/icons/218.gif
.gif
3.8.1/data/icons/219.gif
.gif
3.8.1/data/icons/22.gif
.gif
3.8.1/data/icons/220.gif
.gif
3.8.1/data/icons/221.gif
.gif
3.8.1/data/icons/222.gif
.gif
3.8.1/data/icons/223.gif
.gif
3.8.1/data/icons/224.gif
.gif
3.8.1/data/icons/225.gif
.gif
3.8.1/data/icons/226.gif
.gif
3.8.1/data/icons/227.gif
.gif
3.8.1/data/icons/228.gif
.gif
3.8.1/data/icons/229.gif
.gif
3.8.1/data/icons/23.gif
.gif
3.8.1/data/icons/230.gif
.gif
3.8.1/data/icons/231.gif
.gif
3.8.1/data/icons/232.gif
.gif
3.8.1/data/icons/233.gif
.gif
3.8.1/data/icons/234.gif
.gif
3.8.1/data/icons/235.gif
.gif
3.8.1/data/icons/236.gif
.gif
3.8.1/data/icons/237.gif
.gif
3.8.1/data/icons/238.gif
.gif
3.8.1/data/icons/239.gif
.gif
3.8.1/data/icons/24.gif
.gif
3.8.1/data/icons/240.gif
.gif
3.8.1/data/icons/241.gif
.gif
3.8.1/data/icons/25.gif
.gif
3.8.1/data/icons/26.gif
.gif
3.8.1/data/icons/27.gif
.gif
3.8.1/data/icons/28.gif
.gif
3.8.1/data/icons/29.gif
.gif
3.8.1/data/icons/3.gif
.gif
3.8.1/data/icons/30.gif
.gif
3.8.1/data/icons/31.gif
.gif
3.8.1/data/icons/32.gif
.gif
3.8.1/data/icons/33.gif
.gif
3.8.1/data/icons/34.gif
.gif
3.8.1/data/icons/35.gif
.gif
3.8.1/data/icons/36.gif
.gif
3.8.1/data/icons/37.gif
.gif
3.8.1/data/icons/38.gif
.gif
3.8.1/data/icons/39.gif
.gif
3.8.1/data/icons/4.gif
.gif
3.8.1/data/icons/40.gif
.gif
3.8.1/data/icons/41.gif
.gif
3.8.1/data/icons/42.gif
.gif
3.8.1/data/icons/43.gif
.gif
3.8.1/data/icons/44.gif
.gif
3.8.1/data/icons/45.gif
.gif
3.8.1/data/icons/46.gif
.gif
3.8.1/data/icons/47.gif
.gif
3.8.1/data/icons/48.gif
.gif
3.8.1/data/icons/49.gif
.gif
3.8.1/data/icons/5.gif
.gif
3.8.1/data/icons/50.gif
.gif
3.8.1/data/icons/51.gif
.gif
3.8.1/data/icons/52.gif
.gif
3.8.1/data/icons/53.gif
.gif
3.8.1/data/icons/54.gif
.gif
3.8.1/data/icons/55.gif
.gif
3.8.1/data/icons/56.gif
.gif
3.8.1/data/icons/57.gif
.gif
3.8.1/data/icons/58.gif
.gif
3.8.1/data/icons/59.gif
.gif
3.8.1/data/icons/6.gif
.gif
3.8.1/data/icons/60.gif
.gif
3.8.1/data/icons/61.gif
.gif
3.8.1/data/icons/62.gif
.gif
3.8.1/data/icons/63.gif
.gif
3.8.1/data/icons/64.gif
.gif
3.8.1/data/icons/65.gif
.gif
3.8.1/data/icons/66.gif
.gif
3.8.1/data/icons/67.gif
.gif
3.8.1/data/icons/68.gif
.gif
3.8.1/data/icons/69.gif
.gif
3.8.1/data/icons/7.gif
.gif
3.8.1/data/icons/70.gif
.gif
3.8.1/data/icons/71.gif
.gif
3.8.1/data/icons/72.gif
.gif
3.8.1/data/icons/73.gif
.gif
3.8.1/data/icons/74.gif
.gif
3.8.1/data/icons/75.gif
.gif
3.8.1/data/icons/76.gif
.gif
3.8.1/data/icons/77.gif
.gif
3.8.1/data/icons/78.gif
.gif
3.8.1/data/icons/79.gif
.gif
3.8.1/data/icons/8.gif
.gif
3.8.1/data/icons/80.gif
.gif
3.8.1/data/icons/81.gif
.gif
3.8.1/data/icons/82.gif
.gif
3.8.1/data/icons/83.gif
.gif
3.8.1/data/icons/84.gif
.gif
3.8.1/data/icons/85.gif
.gif
3.8.1/data/icons/86.gif
.gif
3.8.1/data/icons/87.gif
.gif
3.8.1/data/icons/88.gif
.gif
3.8.1/data/icons/89.gif
.gif
3.8.1/data/icons/9.gif
.gif
3.8.1/data/icons/90.gif
.gif
3.8.1/data/icons/91.gif
.gif
3.8.1/data/icons/92.gif
.gif
3.8.1/data/icons/93.gif
.gif
3.8.1/data/icons/94.gif
.gif
3.8.1/data/icons/95.gif
.gif
3.8.1/data/icons/96.gif
.gif
3.8.1/data/icons/97.gif
.gif
3.8.1/data/icons/98.gif
.gif
3.8.1/data/icons/99.gif
.gif
3.8.1/data/icons/group.png
.png
3.8.1/data/icons/user.png
.png
3.8.1/data/icons/user_gray.png
.png

Sharing

General

Malware Config

Signatures

Files

2b9da892b547812bf239e1d10c989af3

Headers

File Characteristics

Imports

msvbvm60

user32

kernel32

Exports

Exports

Sections

.text Size: - Virtual size: 4.3MB

.data Size: - Virtual size: 123KB

.bss0 Size: 40KB - Virtual size: 36KB

.bss1 Size: - Virtual size: 1.4MB

.tls Size: 4KB - Virtual size: 24B

.bss2 Size: 2.6MB - Virtual size: 2.6MB

.rsrc Size: 40KB - Virtual size: 36KB

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.bss Size: - Virtual size: 4KB

.rsrc Size: 377KB - Virtual size: 380KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size:

Headers

File Characteristics

Sections

.text Size: 512B - Virtual size: 4KB

.bss Size: - Virtual size: 4KB

.rsrc Size: 15KB - Virtual size: 16KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size:

56accb93af10812d19391799de9a7230

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

7c:77:8f:22:eb:93:3a:28:79:c9:0b:a2:ec:17:18:f5Certificate

Extended Key Usages

Key Usages

b0:51:1d:1c:93:19:fb:72:0a:df:db:f8:6b:1a:7d:95:23:9d:c2:dcSigner

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

olepro32

oleaut32

Exports

Exports

Sections

.text Size: 924KB - Virtual size: 922KB

.rdata Size: 204KB - Virtual size: 201KB

.data Size: 56KB - Virtual size: 70KB

.rsrc Size: 332KB - Virtual size: 331KB

.reloc Size: 96KB - Virtual size: 95KB

b97546b32de3f20f9d20a53cbd559da6

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

.text
Size: - Virtual size: 4.3MB

.data
Size: - Virtual size: 123KB

.bss0
Size: 40KB - Virtual size: 36KB

.bss1
Size: - Virtual size: 1.4MB

.tls
Size: 4KB - Virtual size: 24B

.bss2
Size: 2.6MB - Virtual size: 2.6MB

.rsrc
Size: 40KB - Virtual size: 36KB

.text
Size: 512B - Virtual size: 4KB

.bss
Size: - Virtual size: 4KB

.rsrc
Size: 377KB - Virtual size: 380KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size:

.text
Size: 512B - Virtual size: 4KB

.bss
Size: - Virtual size: 4KB

.rsrc
Size: 15KB - Virtual size: 16KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size:

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7c:77:8f:22:eb:93:3a:28:79:c9:0b:a2:ec:17:18:f5
Certificate

b0:51:1d:1c:93:19:fb:72:0a:df:db:f8:6b:1a:7d:95:23:9d:c2:dc
Signer

.text
Size: 924KB - Virtual size: 922KB

.rdata
Size: 204KB - Virtual size: 201KB

.data
Size: 56KB - Virtual size: 70KB

.rsrc
Size: 332KB - Virtual size: 331KB

.reloc
Size: 96KB - Virtual size: 95KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

7c:77:8f:22:eb:93:3a:28:79:c9:0b:a2:ec:17:18:f5
Certificate

33:73:3f:7c:30:f0:0e:0c:7d:7c:8a:ff:b5:20:eb:6f:8c:73:71:64
Signer

.text
Size: 332KB - Virtual size: 330KB

.rdata
Size: 72KB - Virtual size: 69KB

.data
Size: 24KB - Virtual size: 30KB

.rsrc
Size: 40KB - Virtual size: 38KB

.reloc
Size: 36KB - Virtual size: 32KB