jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c
Size 883KB
Sample260919-gamnyaxcld
SHA256 b88384469082b643cec175bdb448abbe3112286144ef25c22932786309b216d6
MD5 6d57f4755c870d7be9a5a1f29d827a3c
SHA1 bf4c11ff2c76078a3fb4060b881fa706b6f51f2e
SHA512 0e71fadc71635cdfe0750f282cf5397fd7f6306774bf02ce9fc2ad482db7df36a7155db7e9902f3703e1cbb8b70bccff92cc38973b72a5a0df060936552af603
SSDEEP 12288:QACAwTj7sGwrnf0sySw+RioG8R19afFeyN60tYTViTeyJH36rGfLs2mptPqRD:LCdgGwrn0WRPvofYy65i536rG/0w
TLSH
T12F15238287D55A93ED6187B442E3FE7F2764B3E0E10516220BA039DB162858E493FF5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll

Untrusted Codesign Signers 8 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c
unpack001/$TEMP/~nsis/Cloud-Web_nad_2_70.dll
unpack001/Cloud-Web_2_70.dl_
unpack001/Cloud-Web_mime_2_70.dl_
unpack001/Cloud-Web_nad_2_70.dl_
unpack001/Cloud-Web_run.ex_
unpack001/Cloud-Web_tb_2_70.dl_
unpack001/cloud-web_svc_2_70.ex_

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c

.exe 883KB
$PLUGINSDIR/InstallOptions.dll

.dll 14KB
$PLUGINSDIR/System.dll

.dll 11KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

163KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
$PLUGINSDIR/tmp.ini

512B
$TEMP/~nsis/Cloud-Web_nad_2_70.dll

.dll 531KB
Cloud-Web_2_70.dl_

.dll 123KB
Cloud-Web_mime_2_70.dl_

.dll 210KB
Cloud-Web_nad_2_70.dl_

.dll 531KB
Cloud-Web_run.ex_

.exe 127KB
Cloud-Web_tb_2_70.dl_

.dll 127KB
cloud-web_svc_2_70.ex_

.exe 107KB
cloud_uins.dat.nsis

217KB
uninst.exe.nsis

217KB

jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 b88384469082b643cec175bdb448abbe3112286144ef25c22932786309b216d6
MD5 6d57f4755c870d7be9a5a1f29d827a3c
SHA1 bf4c11ff2c76078a3fb4060b881fa706b6f51f2e
SHA512 0e71fadc71635cdfe0750f282cf5397fd7f6306774bf02ce9fc2ad482db7df36a7155db7e9902f3703e1cbb8b70bccff92cc38973b72a5a0df060936552af603
SSDEEP 12288:QACAwTj7sGwrnf0sySw+RioG8R19afFeyN60tYTViTeyJH36rGfLs2mptPqRD:LCdgGwrn0WRPvofYy65i536rG/0w
TLSH
T12F15238287D55A93ED6187B442E3FE7F2764B3E0E10516220BA039DB162858E493FF5F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

46:78:14:4f:ae:8f:08:51:49:41:c2:78:89:54:07:bc

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 b214d73aea95191f7363ad93cdc12b6fbd50a3a54b0aa891b3d45bc4b7b2aa04
MD5 8f4ac52cb2f7143f29f114add12452ad
SHA1 29dc25f5d69bf129d608b83821c8ec8ab8c8edb3
SHA512 2f9e2c7450557c2b88a12d3a3b4ab999c9f2a4df0d39dcd795b307b89855387bc96fc6d4fb51de8f33de0780e08a3b15fdad43daeaf7373cca71b01d7afdaf0c
SSDEEP 48:6sG7qYBUYBFxhRwYCI0owYlOdkPm4LYZ5sRXEv26vqAa4GEVu:HhYBUYBL0Toa7+Q5sKG4GEV
TLSH
T1FA91767353F961E0C1CB0F72308715E7FB77C87013A6A15E0A63A39556A1597EC2C715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/~nsis/Cloud-Web_nad_2_70.dll

IMPHASH ff3e017e5d26fa0df439db61f0e23601
SHA256 fca90f7d83dfe5933fe3994e3644d1ce10e9b316eb432d75dd6da9be87a766fd
MD5 baa82af11cdf29b93ad09614d51e7407
SHA1 303d4ba397797ce361083ca9f58d1ffa0ad5c519
SHA512 e7e5959a85edfdfeb831e8e2157e306c0ad367f3235aa1248dfd74bc2da71b4272d188b4ac3a2c16d46ced6bc9215b3a496f14fdb5fc981b2ad0a0fd922fac00
SSDEEP 12288:WoxP7ijRDYsZNa8JU7aAlxZoZ4qafiSIjL:fxP70ZrJizboZ4qafiSIjL
TLSH
T1BBC4C630B135ADB7F2AA05B07C7DA514709B2F601740548FA7C6BC292AF3792616CE6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7e:e7:06:e6:c4:e0:21:ef:09:32:53:2d:b0:62:79:13

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

290439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord857 ord5265 ord4998 ord2514 ord6052 ord1775 ord5280 ord4425 ord3597 ord785 ord641 ord518 ord324 ord4234 ord6199 ord6215 ord6197 ord4284 ord4710 ord5594 ord4224 ord4189 ord5710 ord2763 ord6283 ord913 ord3646 ord397 ord699 ord3438 ord4188 ord912 ord5593 ord6663 ord4278 ord6282 ord3706 ord3626 ord2414 ord1641 ord2859 ord4376 ord4853 ord3361 ord326 ord2167 ord5232 ord2393 ord3797 ord2147 ord1180 ord268 ord1568 ord5268 ord1229 ord1175 ord1567 ord2917 ord1979 ord2803 ord958 ord6312 ord4177 ord6385 ord5442 ord3318 ord6010 ord5773 ord2601 ord3180 ord3183 ord3176 ord3507 ord3614 ord665 ord354 ord5208 ord543 ord5186 ord6264 ord5651 ord3127 ord3616 ord350 ord6876 ord3613 ord3610 ord656 ord2784 ord465 ord3402 ord4396 ord1776 ord609 ord6880 ord2575 ord5631 ord6662 ord1572 ord1622 ord551 ord6778 ord536 ord3790 ord690 ord1988 ord5207 ord389 ord3337 ord5356 ord6059 ord6869 ord861 ord3178 ord4204 ord1158 ord640 ord323 ord2405 ord6021 ord3571 ord1640 ord5785 ord795 ord765 ord2302 ord1768 ord6380 ord2688 ord6605 ord2754 ord6379 ord5875 ord4476 ord3721 ord3698 ord2135 ord1949 ord4034 ord3584 ord2107 ord6383 ord5440 ord2841 ord6394 ord5450 ord3663 ord398 ord6143 ord5632 ord3439 ord700 ord6883 ord2764 ord341 ord654 ord922 ord3811 ord5645 ord535 ord413 ord4168 ord858 ord537 ord6302 ord711 ord924 ord2818 ord356 ord940 ord1200 ord939 ord941 ord6467 ord2725 ord1232 ord1247 ord1199 ord1134 ord815 ord561 ord3738 ord4622 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord5861 ord5858 ord860 ord5683 ord4129 ord4277 ord2379 ord6453 ord4275 ord818 ord567 ord3742 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5290 ord4353 ord6374 ord5163 ord2385 ord5241 ord3126 ord4407 ord1116 ord1176 ord1575 ord1168 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord269 ord4078 ord6055 ord3574 ord803 ord2770 ord2781 ord4058 ord3181 ord4202 ord6877 ord1980 ord668 ord541 ord801 ord823 ord1105 ord539 ord2864 ord2086 ord825 ord540 ord2915 ord5572 ord2614 ord800

msvcrt

_adjust_fdiv _initterm ??1type_info@@UAE@XZ _onexit __dllonexit sqrt sprintf strncmp _ftol malloc free isalnum tolower strtol qsort strtoul _except_handler3 memmove atol abs memcpy strstr strncpy strcat memset _mbsicmp _mbscmp atoi __CxxFrameHandler _strnicmp

kernel32

LocalFree SizeofResource GlobalAlloc GlobalLock GlobalUnlock MulDiv GetFileAttributesA SetFileAttributesA CreateProcessA GetExitCodeProcess RemoveDirectoryA GetVersionExA QueryPerformanceFrequency QueryPerformanceCounter GetPrivateProfileSectionA GetPrivateProfileSectionNamesA GetShortPathNameA MoveFileA WideCharToMultiByte FreeLibrary LoadLibraryA OpenProcess GetProcAddress VirtualAllocEx WriteProcessMemory CreateRemoteThread ReadProcessMemory VirtualFreeEx GetExitCodeThread GetLastError LockResource FindResourceA LoadResource FreeResource CreateDirectoryA ExpandEnvironmentStringsA GetTempPathA GetPrivateProfileIntA TerminateProcess SetFilePointer WriteFile ReadFile HeapFree GetProcessHeap HeapAlloc lstrcmpiA CreateFileA DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime InterlockedDecrement InterlockedIncrement GetCurrentThreadId OutputDebugStringA GetCurrentProcess DuplicateHandle TerminateThread LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar GetPrivateProfileStringA lstrcpyA lstrcatA GetCurrentProcessId GetTickCount WritePrivateProfileStringA Sleep DeleteFileA SetEvent ResetEvent ResumeThread WaitForSingleObject lstrlenA CloseHandle GetModuleHandleA GetModuleFileNameA CreateEventA LocalAlloc

user32

GetDC SetWindowRgn PtInRect GetClientRect LoadMenuA GetSubMenu TrackPopupMenu LoadCursorA SetCursor ClientToScreen GetParent ScreenToClient GetWindowRect GetSystemMetrics SetWindowPos ValidateRect LoadIconA SetActiveWindow GetActiveWindow PostMessageA GetFocus GetWindowThreadProcessId IsWindowEnabled GetClassNameA ReleaseDC keybd_event SetFocus GetWindowTextA SetWindowTextA SetClassLongA GetClassLongA RegisterWindowMessageA GetWindowLongA wsprintfA GetMonitorInfoA MonitorFromPoint IsWindow SendMessageA wvsprintfA MessageBoxA EnableWindow GetClassInfoA GetDesktopWindow IsWindowVisible GetCursorPos PeekMessageA UpdateWindow SetTimer EnumChildWindows InvalidateRect KillTimer SetParent DispatchMessageA TranslateMessage LoadBitmapA CopyRect GetMessageA SetWindowLongA CallWindowProcA FindWindowExA

gdi32

GetStockObject GetObjectA GetMapMode CreateRectRgn CreateRoundRectRgn CombineRgn EnumFontFamiliesA StretchBlt BitBlt GetDeviceCaps CreateBitmap CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetOpenFileNameA

advapi32

GetSidIdentifierAuthority RegGetKeySecurity FreeSid SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAce InitializeAcl AllocateAndInitializeSid RegQueryInfoKeyA RegSetKeySecurity CloseServiceHandle QueryServiceStatus OpenServiceA OpenSCManagerA QueryServiceConfigA RegQueryValueExA RegOpenKeyA RegCloseKey RegQueryValueA GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken GetTokenInformation GetLengthSid CopySid RegDeleteKeyA RegDeleteValueA RegSetValueA RegCreateKeyA RegSetValueExA RegOpenKeyExA RegEnumKeyA

shell32

SHGetSpecialFolderPathA SHGetDesktopFolder SHGetFileInfoA

ole32

OleInitialize CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SafeArrayGetElement SafeArrayDestroy SysFreeString SysAllocStringLen VariantClear SafeArrayGetLBound SafeArrayGetUBound SysAllocString

urlmon

URLDownloadToCacheFileA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

wininet

InternetSetCookieA InternetCrackUrlA InternetGetCookieA InternetReadFile FindFirstUrlCacheEntryA DeleteUrlCacheEntry FindNextUrlCacheEntryA FindCloseUrlCache InternetOpenA InternetSetOptionA HttpSendRequestA InternetConnectA HttpOpenRequestA HttpAddRequestHeadersA InternetCloseHandle

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22 ord23 ord20

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmNotifyIME

shlwapi

SHDeleteKeyA

Name

.text

Size

308KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED_M

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud-Web_2_70.dl_

IMPHASH 3349570131fbaa69ef5ccbf0c5cb1ade
SHA256 dd4933880f0b0d8236e0cf35046dbeb87416972223564e87a1335092deb3a474
MD5 f717fa103f18e7a2844f876453bbe567
SHA1 10410f393a29827fca5dd5ae327c298cb29d5308
SHA512 66c176c41372c87febf8cccb9ebe9c0fcb7ddda0f8bedc3c4dd71475d4b8bc3afa228ec9c4f84be148589d0b3b4b4a0541f633641f1ea1542a0a02b25566267f
SSDEEP 3072:TNG0ZeC/azzmWxd/mZQA3PI46eqt0Grktbnx:5tzyKYJmmAMeUro
TLSH
T1E1C36C01B5429135D4EB147D89BE6F26A72EBEB00F5468C3BB983B9C4F782E27D35046
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

23:a0:c4:f9:5a:44:1d:da:29:45:3f:db:d0:90:a0:ad

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

40841

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InterlockedIncrement InterlockedDecrement GetShortPathNameA GetModuleHandleA MultiByteToWideChar lstrlenW SizeofResource LoadResource FindResourceA LoadLibraryExA lstrcpynA WideCharToMultiByte HeapDestroy CloseHandle ReleaseMutex WaitForSingleObject CreateMutexA CompareStringW CompareStringA GetLocaleInfoW GetTimeZoneInformation SetConsoleCtrlHandler GetOEMCP GetACP GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA GetProcAddress GetCurrentThreadId GetCurrentProcessId lstrcatA OutputDebugStringA lstrlenA lstrcmpiA lstrcpyA GetCurrentDirectoryA GetModuleFileNameA SetCurrentDirectoryA LoadLibraryA GetLastError IsDBCSLeadByte FreeLibrary IsValidCodePage IsValidLocale GetCPInfo SetEnvironmentVariableA GetStringTypeW GetStringTypeA UnhandledExceptionFilter IsBadCodePtr IsBadReadPtr WriteFile GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA RtlUnwind RaiseException HeapFree HeapReAlloc HeapAlloc GetCommandLineA GetVersion ExitProcess FatalAppExitA TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread SetUnhandledExceptionFilter Sleep LCMapStringA LCMapStringW GetEnvironmentVariableA GetVersionExA HeapCreate VirtualFree VirtualAlloc IsBadWritePtr TerminateProcess GetCurrentProcess SetHandleCount GetStdHandle GetFileType

user32

wsprintfA DefWindowProcA wvsprintfA SetWindowLongA PostMessageA MessageBoxA CharNextA CallWindowProcA GetWindowLongA

advapi32

RegQueryInfoKeyA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegDeleteValueA RegDeleteKeyA RegQueryValueA RegOpenKeyA RegQueryValueExA RegSetValueA RegCreateKeyA RegSetValueExA RegCloseKey RegEnumValueA

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree CoCreateInstance

oleaut32

VariantCopy SysStringLen LoadRegTypeLi RegisterTypeLi SysAllocString LoadTypeLi VarUI4FromStr VariantClear SysFreeString

Cloud-Web_mime_2_70.dl_

IMPHASH 6a0dcdc1a680ae7d747551d028f559bd
SHA256 6807aee8007988c5409a947a526c187c66e349886399541454800ce2a99c2442
MD5 e03152320af546785839f21cefd28ce1
SHA1 7264e5753bb5313b9ceb69d05c15e000ed938559
SHA512 93681775e96cb80b8cc4b89c788902f5070497c5a0120c0ba965c14e651ab3726387bc0d3f8feeaf315ae45bd7bf40bf37f1e2fd379b89bc812c9dd2fdfefb5e
SSDEEP 3072:6a8sgv0ObRPWecmwdM808YQ1AyygLLdMFktjDVe7IFy4P0ngbSKNrXRenv:6Cgv0q0ecmf806ayyIL+Fujx4Iw4AuFG
TLSH
T1D6247D213642C036D68F11344A3A9B6A6A7DBE710B22D0CB7BD46E7E5E706C19F35B07
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:5 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

9a:c5:f0:e3:42:14:c1:c0:1e:dd:1c:e8:d8:19:62:55

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

76963

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\WonderLand-SEPARATED DLL-LAST VERSION\WonderLandMimePure\Release\WonderLandMime.pdb

kernel32

FindResourceW FindResourceExW GetProcAddress GetModuleHandleW lstrcmpiW WideCharToMultiByte MultiByteToWideChar FreeLibrary LoadLibraryExW GetModuleFileNameW UnmapViewOfFile CloseHandle MapViewOfFile OpenFileMappingW LoadResource EnterCriticalSection LeaveCriticalSection CreateFileMappingW SetThreadLocale GetThreadLocale HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InitializeCriticalSection LockResource SizeofResource lstrlenW InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError ExpandEnvironmentStringsW RaiseException InterlockedCompareExchange SetEnvironmentVariableA CompareStringW CreateFileW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID SetStdHandle WriteConsoleW LoadLibraryW InterlockedExchange GetCurrentProcessId GetTickCount QueryPerformanceCounter SetEndOfFile GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA EncodePointer DecodePointer GetTimeZoneInformation GetSystemTimeAsFileTime GetCPInfo RtlUnwind GetCurrentThreadId GetCommandLineA Sleep ExitProcess WriteFile GetStdHandle HeapCreate UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent LCMapStringW GetStringTypeW GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError SetHandleCount GetFileType GetStartupInfoW GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetACP GetOEMCP IsValidCodePage

user32

CharNextW

advapi32

RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW

ole32

CoGetClassObject CreateStreamOnHGlobal CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoTaskMemFree StringFromGUID2

oleaut32

SysFreeString SysStringLen SysAllocString RegisterTypeLi UnRegisterTypeLi LoadTypeLi VarUI4FromStr

shlwapi

SHCreateStreamOnFileW

urlmon

CoInternetGetSession

Cloud-Web_nad_2_70.dl_

IMPHASH ff3e017e5d26fa0df439db61f0e23601
SHA256 fca90f7d83dfe5933fe3994e3644d1ce10e9b316eb432d75dd6da9be87a766fd
MD5 baa82af11cdf29b93ad09614d51e7407
SHA1 303d4ba397797ce361083ca9f58d1ffa0ad5c519
SHA512 e7e5959a85edfdfeb831e8e2157e306c0ad367f3235aa1248dfd74bc2da71b4272d188b4ac3a2c16d46ced6bc9215b3a496f14fdb5fc981b2ad0a0fd922fac00
SSDEEP 12288:WoxP7ijRDYsZNa8JU7aAlxZoZ4qafiSIjL:fxP70ZrJizboZ4qafiSIjL
TLSH
T1BBC4C630B135ADB7F2AA05B07C7DA514709B2F601740548FA7C6BC292AF3792616CE6F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7e:e7:06:e6:c4:e0:21:ef:09:32:53:2d:b0:62:79:13

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

290439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

msvcrt

kernel32

user32

gdi32

GetStockObject GetObjectA GetMapMode CreateRectRgn CreateRoundRectRgn CombineRgn EnumFontFamiliesA StretchBlt BitBlt GetDeviceCaps CreateBitmap CreateCompatibleBitmap CreateCompatibleDC

comdlg32

GetOpenFileNameA

advapi32

shell32

SHGetSpecialFolderPathA SHGetDesktopFolder SHGetFileInfoA

ole32

OleInitialize CreateStreamOnHGlobal

olepro32

ord251

oleaut32

SafeArrayGetElement SafeArrayDestroy SysFreeString SysAllocStringLen VariantClear SafeArrayGetLBound SafeArrayGetUBound SysAllocString

urlmon

URLDownloadToCacheFileA

rpcrt4

UuidToStringA UuidCreate RpcStringFreeA

wininet

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

dbghelp

MakeSureDirectoryPathExists

cabinet

ord22 ord23 ord20

oleacc

AccessibleObjectFromWindow

imm32

ImmReleaseContext ImmGetContext ImmNotifyIME

shlwapi

SHDeleteKeyA

Name

.text

Size

308KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED_M

Size

4KB

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Cloud-Web_run.ex_

IMPHASH 4fd43891ef6b31f90b7c50305f05e318
SHA256 869be362880f9075d389eef13ad53278cbe0522f58f4dfff10e47329266a20a0
MD5 0972c73f63af6288d601a18d5377650d
SHA1 5481f869e248d91ece4678ac9824258895b3fee5
SHA512 7e0b7d2aa4d5fbdd18fec31826d21e3bfe6cfa7cbbed55fa63770900d0e84b72a5a18c03afc4dc1629a3d325469f09d210e2207f56f1242135b7ee78fcd4d10a
SSDEEP 1536:vKHHEUo+d49J2uSF0/cyqsMYdLY3wvfpxYnp:CH3eB/cyqsMYosYnp
TLSH
T127D34B017C018546C927C5BD9DABCEB42A76AEFE97542F2372B83D9D0876FA0633510E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

19:97:7c:a3:78:79:fa:e7:22:88:f1:e4:18:5c:60:88

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

13770

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

mfc42

ord3136 ord3262 ord2985 ord3081 ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord561 ord815 ord2514 ord800 ord711 ord4168 ord413 ord2764 ord537 ord2621 ord1134 ord641 ord818 ord825 ord5265 ord4376 ord4853 ord4998 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord4465 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord2124 ord5277 ord4627 ord4425 ord3597 ord324 ord6055 ord1776 ord5290 ord3402 ord567 ord2135 ord2302 ord4234 ord2645 ord860 ord4710 ord535 ord941 ord540 ord5572 ord2915 ord755 ord470 ord1168 ord2379 ord1146 ord1949 ord4034 ord823 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord3798 ord4673 ord1576

msvcrt

_except_handler3 __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit ??1type_info@@UAE@XZ _onexit __dllonexit atoi _setmbcp __CxxFrameHandler _controlfp strcat _purecall memset _CxxThrowException

kernel32

GetLastError SetCurrentDirectoryA GetCurrentDirectoryA lstrcpyA lstrcmpiA OutputDebugStringA ExpandEnvironmentStringsA GetCurrentProcessId GetCurrentThreadId CreateProcessA GetModuleHandleA GetStartupInfoA GetModuleFileNameA lstrlenA LoadLibraryA lstrcatA FreeLibrary GetProcAddress

user32

GetClientRect EnableWindow LoadIconA wvsprintfA wsprintfA SendMessageA DrawIcon GetSystemMetrics IsWindow ShowWindow SetForegroundWindow IsIconic

advapi32

RegOpenKeyA RegQueryValueExA RegCloseKey RegQueryValueA

urlmon

URLDownloadToCacheFileA

Cloud-Web_tb_2_70.dl_

IMPHASH 62aae4a780185490b96a2db14f7f901b
SHA256 fe79854d4f9fa9a456fc748bf23cec34d6bb31aadbf20bed839db11c3b08d483
MD5 e78cc86088adc12b428ed14808d28879
SHA1 1e8c4d7423d93e9ec7f71912a9b2708f83052ef9
SHA512 3ec9cc68335b0a903e9f6fdefd070ddb6825213d118259062fa0bfbffce5b9eaf05247cdddcf7af90351a3902ac5d1113b232eed00e954ff62f673cf9ac58879
SSDEEP 3072:1csRZq+GIN/GR/7gkdIIZRZDNtej/p3Ymxs9Dqtnl:qH9geR/7wI1s/xs92r
TLSH
T109D36C017581917AF4EB047E49BA6F3AA72EAE705B6134C3B3443B8D1EB87D2B935047
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

3e:91:a8:e9:2c:87:87:24:a3:06:c0:9d:ba:46:a7:dd

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

33873

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleHandleA MultiByteToWideChar lstrlenW WideCharToMultiByte FreeLibrary SizeofResource LoadResource FindResourceA GetLastError LoadLibraryExA lstrcmpiA lstrcpynA IsDBCSLeadByte GetShortPathNameA GetProcAddress LoadLibraryA lstrcpyA lstrcatA OutputDebugStringA GetCurrentProcessId GetCurrentThreadId SetCurrentDirectoryA GetCurrentDirectoryA CompareStringW CompareStringA GetLocaleInfoW GetTimeZoneInformation InterlockedDecrement InterlockedIncrement DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DisableThreadLibraryCalls GetModuleFileNameA HeapDestroy lstrlenA GetUserDefaultLCID EnumSystemLocalesA GetLocaleInfoA IsValidCodePage IsValidLocale Sleep GetStringTypeW GetStringTypeA LCMapStringW SetEnvironmentVariableA LCMapStringA RtlUnwind HeapFree HeapReAlloc HeapAlloc RaiseException GetCommandLineA GetVersion TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetCurrentThread GetEnvironmentVariableA GetVersionExA HeapCreate VirtualFree VirtualAlloc IsBadWritePtr ExitProcess FatalAppExitA SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW WriteFile IsBadReadPtr IsBadCodePtr UnhandledExceptionFilter GetCPInfo GetACP GetOEMCP SetConsoleCtrlHandler

user32

CharNextA wvsprintfA wsprintfA

advapi32

RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegEnumValueA

ole32

CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc

oleaut32

SysAllocString LoadTypeLi SysFreeString VarUI4FromStr RegisterTypeLi

cloud-web_svc_2_70.ex_

IMPHASH ea0903a4e187f2b1450585614088511f
SHA256 65e935f8c19569df5d38bfe1e876944e0d24dffcae0c40e0169b540794db0564
MD5 cc0880dcf38d15e9bc38f58142ea8f31
SHA1 fd38cce8da1b1176ce9fa6e5a8f07a1b535c02f9
SHA512 4db76acf7b603f9092ac35d75bd034c2244dc564566156de62b99c860bac535f0719894ba2685fcaf1e4e4fdb9f69f81df7b975e683069403136e8148f428767
SSDEEP 3072:M2AruuuKVU/Vb2hz01EhTP8a5GJs1t6inb:M2ArwKVS1ElPl9N
TLSH
T1CCB37C22B1D1C5B6F44A00B246E58F769E3BEF711B0124C3E3F4599259B4BF1963A24F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

59:31:d5:e4:e2:2c:55:69:75:2e:8a:26:5e:8f:33:6f

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=cloudweb Inc,OU=plan team,O=cloudweb Inc,L=Seongdong-gu,ST=Seoul,C=KR

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

37513

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

ResetEvent OutputDebugStringA GetCurrentProcessId GetCurrentThreadId MoveFileA WriteFile CreateFileA GetShortPathNameA CreateProcessA GetVersionExA GetProcAddress GetModuleHandleA ExpandEnvironmentStringsA GetFileAttributesExA FileTimeToSystemTime FileTimeToLocalFileTime SetFilePointer CreateDirectoryA GetLocalTime LoadLibraryA SetEnvironmentVariableA CompareStringW CompareStringA LoadLibraryExA GetPrivateProfileIntA CopyFileA DeleteFileA FreeLibrary CloseHandle GetPrivateProfileStringA Sleep lstrcatA GetLastError GetTickCount SetEvent lstrcpyA GetModuleFileNameA CreateThread CreateEventA WaitForSingleObject TerminateThread lstrcmpiA lstrlenA GetTempPathA SetStdHandle SetConsoleCtrlHandler GetOEMCP GetACP GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA ExitProcess TerminateProcess GetCurrentProcess RtlUnwind GetTimeZoneInformation GetSystemTime HeapFree HeapAlloc GetStartupInfoA GetCommandLineA GetVersion HeapReAlloc HeapSize WideCharToMultiByte GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr MultiByteToWideChar LCMapStringA LCMapStringW UnhandledExceptionFilter FlushFileBuffers

user32

wvsprintfA wsprintfA

advapi32

RegCreateKeyA RegSetValueExA SetServiceStatus RegisterServiceCtrlHandlerA RegOpenKeyExA RegEnumKeyA RegQueryValueA RegOpenKeyA RegQueryValueExA RegCloseKey StartServiceA CreateServiceA ChangeServiceConfig2A StartServiceCtrlDispatcherA OpenSCManagerA OpenServiceA QueryServiceStatus ControlService DeleteService CloseServiceHandle

shell32

SHGetFileInfoA ShellExecuteA

wininet

InternetReadFile HttpQueryInfoA InternetSetOptionA InternetOpenA InternetCloseHandle InternetOpenUrlA

version

VerQueryValueA GetFileVersionInfoSizeA GetFileVersionInfoA

shlwapi

SHDeleteKeyA SHDeleteValueA

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__6d57f4755c870d7be9a5a1f29d827a3c

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsProcess.dll

kernel32

generic

$PLUGINSDIR/tmp.ini

$TEMP/~nsis/Cloud-Web_nad_2_70.dll

PE Signature issue

mfc42

msvcrt

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

olepro32

oleaut32

urlmon

rpcrt4

wininet

iphlpapi

version

dbghelp

cabinet

oleacc

imm32

shlwapi

generic

Cloud-Web_2_70.dl_

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

generic

Cloud-Web_mime_2_70.dl_

PE Signature issue

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

urlmon

generic

Cloud-Web_nad_2_70.dl_

PE Signature issue

mfc42