jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209
Size 593KB
Sample260919-kcdqlazz9m
SHA256 732e684db464ddbaedae1ae6596f7b29249e99b34d320b9f55280ca261ffd61b
MD5 84c9e2cec8a7cbedf672a45f363bf209
SHA1 d7acefcc74fb2d4f3490e2266095e319a236b3db
SHA512 789e3ebfd8dad78378d80588a1d54e4dd8c4f989e5eb7de626a743f488065332a334c41af5a50133ef41f0f35b0a54399b6101d628a1f40e19aaa815f5668f0c
SSDEEP 12288:tUwvNzkkqK+ZkMbEvRAbgh5DWFzLFAHKs3bQk5qXlOz:tUwvNz9qK+ZjmAbg76zLFAHKIbv5q1Oz
TLSH
T1CCD423417722D00ACC750B386A6D88EBEE912F11EA00624377927F4F7F2799753A81E7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/bdtmp/InstDll.dll
unpack001/baidubar.dll

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

File Explorer

jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209

.exe 593KB
$PLUGINSDIR/InstallOptions.dll

.dll 12KB
$PLUGINSDIR/System.dll

.dll 10KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

47KB
$PROGRAM_FILES/Baidu/bar/Buttons/custom.xml

.xml 3KB
$TEMP/bdtmp/InstDll.dll

.dll 4KB
BaiduBar.dat

28KB
baidubar.dll

.dll 1.5MB
img/imglist.bmp

27KB
img/logo.bmp

2KB

jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209

IMPHASH 1bed3305885b0ca596d9cbba22baf78a
SHA256 732e684db464ddbaedae1ae6596f7b29249e99b34d320b9f55280ca261ffd61b
MD5 84c9e2cec8a7cbedf672a45f363bf209
SHA1 d7acefcc74fb2d4f3490e2266095e319a236b3db
SHA512 789e3ebfd8dad78378d80588a1d54e4dd8c4f989e5eb7de626a743f488065332a334c41af5a50133ef41f0f35b0a54399b6101d628a1f40e19aaa815f5668f0c
SSDEEP 12288:tUwvNzkkqK+ZkMbEvRAbgh5DWFzLFAHKs3bQk5qXlOz:tUwvNz9qK+ZjmAbg76zLFAHKIbv5q1Oz
TLSH
T1CCD423417722D00ACC750B386A6D88EBEE912F11EA00624377927F4F7F2799753A81E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

62:92:93:55:28:47:5e:83:df:a9:84:76:cc:d5:25:59

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

14178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA lstrcatA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep CreateFileA GetFileSize GetModuleFileNameA GetTickCount GetCurrentProcess CopyFileA ExitProcess lstrcpynA SetFileTime GetWindowsDirectoryA GetTempPathA GetUserDefaultLangID GetDiskFreeSpaceA GlobalUnlock GlobalLock GlobalAlloc CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA SetEndOfFile UnmapViewOfFile MapViewOfFile CreateFileMappingA lstrcpyA lstrlenA GetSystemDirectoryA CloseHandle lstrcmpiA GetEnvironmentVariableA ExpandEnvironmentStringsA GlobalFree WaitForSingleObject GetExitCodeProcess SetErrorMode GetModuleHandleA LoadLibraryA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA MulDiv WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCommandLineA

user32

SystemParametersInfoA RegisterClassA EndDialog ScreenToClient GetWindowRect SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA LoadCursorA SetCursor CheckDlgButton GetAsyncKeyState IsDlgButtonChecked GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard CreateWindowExA EmptyClipboard OpenClipboard TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxA CharPrevA wvsprintfA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA SendMessageTimeoutA FindWindowExA GetDlgItem GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx CreateDialogParamA SetClipboardData DestroyWindow SetWindowLongA LoadImageA GetDC EnableWindow PeekMessageA DispatchMessageA InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetMalloc SHGetPathFromIDListA SHBrowseForFolderA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH 9d433976e02d79532f0d635ee81d0b20
SHA256 8203ae1589a50e6ff012e5d27bdd4f8ed7506077ca9b052827f5e90aaeb98519
MD5 1e8f2fefe3ce893b117b26948b8978cb
SHA1 59cfc6c3f5716e91609e54ca80ae8b06c93ef8ab
SHA512 b3c36e1aa5d3ee5f482f4175a7d6fe10cf2bf3bd3423ab4266d11c4181cfbc7e3f66a30855034a8ec026a4d5987598f0116e98519b7445d9e5687bcbab2c0e5c
SSDEEP 192:qzixixDOHhG9db9rd+oSVPECMlh3I8tqDyng7hwbbHF1QuCb:qOx0DOHqrdwTY6+ng72bbMum
TLSH
T135421A622384DCF3E789423AB45236136B96962679516ED1C7330FC67A230897EF6353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10288

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
SHA256 7a24883bdbf08ce90938094b6ab6f09a842af10b18b8ae4d70da2e6b806490b8
MD5 10c44246d99a1c2e5f5e6b52b111a63d
SHA1 0f41da79c3e789f4ae38738e3a5d73c538f8af4f
SHA512 e5b0fa27cd02a67be5eb9c63646621d3e9ccfada98659c50dee8310a58ce12e1a6a059788b85f0f440067ed7e281a0e1a526b9403993b9000f91a51bfbb50da3
SSDEEP 192:rOSsJI/rqmIDNLU0dq51EgAiNbubv6rLZ:lHQQ0d01Egbq76r
TLSH
T12F225C51426442F3DD55823C08A739272F787B249EA18EC3CF9364466F199BABC7D33A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

10319

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/bdtmp/InstDll.dll

IMPHASH e44f82ce77eec687f2bd1fd452dd3940
SHA256 5a449a8daf50957499e3a623d85f9d13c0bee446bd1389ab09c62dc711f7b83c
MD5 884b680357ba59a512dda26c1032922d
SHA1 55c99c30fe77ea79826bc78d74e830024365479b
SHA512 69add831d940cebc74352131705c673537d960063ce8f5c4ba76bec421af4ece8bae4bfbdac3491854da2acb3b6cf4872b141a19f091faa260ba8bcf00cc6426
SSDEEP 48:KVhJ6t/YHDJcmCqbcGIAHHzFjZ5jdp6tbN6oBB1xbz:KhI1YBCqcYTFjZVYbNfBBPz
TLSH
T132A1B7632AC4DFBAE3DD2331069F121F616928600AD2044FAB5C4E4A8D63D5B8375F47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9434

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

baidubar.dll

IMPHASH 55028093f8bd5816ead60fd512d82d8b
SHA256 d710cef1798dbae5492705027390b16ff535b415d052fd0e5ef8325f8b39b5e2
MD5 cdad50b363135c9d6fa591657638764e
SHA1 6d34a83fbbcc0cb1c7c40ba36797afd66cb97be0
SHA512 1dfdcd341266edacb5e736aa686f6ae17ffd9d588a7227ff64586c1c8f9b7527b39bec8e0f7de1471892f631479a3afab71c9a5b57d6495926c1832b907748c6
SSDEEP 24576:ivBjUPZeDApAS0738x/922WxuSGKtguodqp5laUr5LUi1OQl4o8g6jq:OjUBeDAp5m8F2LxuSG4Ud6a+E5jq
TLSH
T139758D303EC4C126D9AE0276CF696BDE95A9CE340F2045CB29443E9E1E35BD39936DC9
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

901116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetFileAttributesA GlobalFree GlobalAlloc GetACP GetCurrentProcessId lstrcmpA LockResource CompareStringA GetFileAttributesA SetFilePointer WritePrivateProfileSectionA GetPrivateProfileSectionA SetErrorMode GetEnvironmentVariableA ReadProcessMemory VirtualProtect OpenProcess Process32Next Process32First CreateToolhelp32Snapshot LocalFree FormatMessageA GetVolumeInformationA TerminateThread DeviceIoControl CopyFileA IsBadStringPtrW FreeResource TerminateProcess GetExitCodeProcess HeapFree TlsAlloc TlsFree TlsSetValue TlsGetValue SystemTimeToFileTime GetCurrentDirectoryA LocalFileTimeToFileTime SetFileTime SwitchToThread SetEvent ResumeThread FileTimeToSystemTime GetFileInformationByHandle MapViewOfFile CreateFileMappingA UnmapViewOfFile GetLocalTime VirtualQuery GetExitCodeThread MoveFileExA RemoveDirectoryA CreateDirectoryA WritePrivateProfileStringA GetVersionExA FindFirstFileA FindNextFileA FindClose DeleteFileA GetTickCount CreateFileA CreateProcessA WaitForSingleObject CreateMutexA GetTempFileNameA ReleaseMutex GlobalLock GlobalUnlock lstrcatA lstrcpyA DeleteCriticalSection HeapDestroy InitializeCriticalSection DisableThreadLibraryCalls GetWindowsDirectoryA GetSystemDirectoryA GetTempPathA IsDBCSLeadByte lstrcpynA lstrcmpiA LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary GetModuleFileNameA GetShortPathNameA FlushInstructionCache EnterCriticalSection LeaveCriticalSection GetCurrentThreadId Sleep lstrlenW GetCurrentProcess WriteProcessMemory IsBadStringPtrA CreateThread WideCharToMultiByte GetFileSize GetProcessHeap HeapAlloc ReadFile CloseHandle MultiByteToWideChar WriteFile LoadLibraryA InterlockedDecrement GetModuleFileNameW LoadLibraryW OutputDebugStringA GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA GetLastError SetLastError GetPrivateProfileIntA GetPrivateProfileStringA InterlockedIncrement lstrlenA OpenMutexA

user32

AdjustWindowRectEx LoadBitmapA SetTimer GetGUIThreadInfo GetWindowThreadProcessId IsRectEmpty EndDialog SetWindowTextA IsWindow ClientToScreen InsertMenuA GetDlgItem CheckMenuItem RedrawWindow CloseClipboard SetClipboardData EmptyClipboard OpenClipboard GetAsyncKeyState GetSubMenu GetClassNameA EnumChildWindows IsChild UnhookWindowsHookEx DefWindowProcA DestroyWindow GetFocus SetFocus PostMessageA SetWindowsHookExA wsprintfA LoadCursorA RegisterClassExA GetClassInfoExA CallWindowProcA CreateWindowExA GetActiveWindow DialogBoxParamA BeginPaint SetWindowLongA GetWindowLongA SendMessageA EndPaint CharNextA LoadStringA DestroyIcon CharLowerA SetWindowPos MapWindowPoints GetClientRect SystemParametersInfoA GetWindowRect GetWindow DeleteMenu GetParent IsWindowVisible IsMenu GetMenuItemID EnableMenuItem ShowWindow LoadImageA AdjustWindowRect SetRect UpdateWindow LoadMenuA DestroyMenu GetKeyState MessageBoxA CreatePopupMenu AppendMenuA GetMenuItemCount EnableWindow SetCursor GetWindowTextA GetWindowTextLengthA SetRectEmpty ScreenToClient GetCursorPos ReleaseCapture GetCapture SetCapture PtInRect InvalidateRect FillRect OffsetRect DrawTextA GetDC DrawFocusRect ReleaseDC DispatchMessageA TranslateMessage KillTimer GetDesktopWindow GetScrollInfo SetScrollInfo ScrollWindow CharLowerBuffA CallWindowProcW IsWindowUnicode SetWindowLongW CharNextW GetMenuItemRect GetMessageA PostThreadMessageA CreateIconFromResourceEx GetPropA SetPropA RemovePropA FindWindowExA InflateRect CreateDialogParamA SetDlgItemTextA GetDlgItemTextA EnumWindows IsDialogMessageA CharUpperA InsertMenuItemA GetMenuState SetForegroundWindow GetForegroundWindow AttachThreadInput CopyImage PeekMessageA CallNextHookEx DrawStateA GetSystemMetrics RegisterWindowMessageA TrackPopupMenuEx GetMessagePos GetSysColorBrush FrameRect GetMenuItemInfoA SetMenuItemInfoA IsWindowEnabled MessageBeep GetTopWindow MenuItemFromPoint GetClassInfoA GetWindowPlacement GetDlgCtrlID GetWindowDC GetMenuStringA ModifyMenuA WindowFromPoint FindWindowA LoadIconA CopyRect DrawIconEx GetSysColor MoveWindow

gdi32

ExcludeClipRect GetClipBox SetViewportOrgEx GetDeviceCaps DPtoLP SaveDC RestoreDC CreateBitmap GetTextColor GetCurrentObject ExtTextOutA Rectangle BitBlt CreateCompatibleDC CreateCompatibleBitmap CreateSolidBrush GetPixel TextOutA CreateFontA DeleteDC SetTextColor GetObjectA CreateFontIndirectA SetBkMode SetBkColor GetStockObject CreatePen SelectObject MoveToEx LineTo GetTextExtentPoint32A DeleteObject

advapi32

RegDeleteKeyA GetUserNameA RegSetKeySecurity AllocateAndInitializeSid InitializeAcl AddAce InitializeSecurityDescriptor SetSecurityDescriptorDacl FreeSid RegGetKeySecurity GetSidIdentifierAuthority GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken GetTokenInformation GetLengthSid CopySid EnumDependentServicesA ControlService OpenSCManagerA OpenServiceA StartServiceA QueryServiceStatus ChangeServiceConfigA CloseServiceHandle RegCreateKeyA RegEnumKeyA RegEnumValueA RegQueryInfoKeyA RegSetValueExA RegEnumKeyExA RegOpenKeyExA RegCloseKey RegQueryValueExA RegOpenKeyA RegCreateKeyExA RegDeleteValueA

shell32

DragQueryFileA SHGetFileInfoA SHGetFileInfoW SHGetSpecialFolderLocation SHGetPathFromIDListA SHGetMalloc ExtractIconA ShellExecuteA SHGetSpecialFolderPathA SHGetDesktopFolder SHBrowseForFolderA

ole32

ReleaseStgMedium GetHGlobalFromStream CoInitialize OleInitialize RevokeDragDrop CoGetClassObject CreateStreamOnHGlobal OleUninitialize RegisterDragDrop CoCreateGuid StringFromGUID2 OleRun CoUninitialize CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

CreateErrorInfo SetErrorInfo GetErrorInfo SysStringByteLen SafeArrayCreate SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy OleLoadPicture SysAllocStringByteLen SysStringLen LoadRegTypeLi RegisterTypeLi LoadTypeLi VarUI4FromStr VariantChangeType VariantInit VariantCopy SysAllocString SysAllocStringLen VariantClear SysFreeString

shlwapi

PathIsDirectoryA PathRemoveFileSpecA UrlCanonicalizeA SHDeleteKeyA PathFileExistsA PathFindFileNameA PathRemoveExtensionA SHSetValueA SHDeleteValueA UrlUnescapeA UrlEscapeA StrRetToStrW StrRetToStrA StrStrIA SHCopyKeyA SHGetValueA

oleacc

AccessibleObjectFromPoint

rpcrt4

UuidCreate

imm32

ImmGetDefaultIMEWnd

urlmon

CoInternetGetSession URLDownloadToFileA

msimg32

TransparentBlt AlphaBlend

msvcrt

_strcmpi _stricmp _wcsnicmp _wcsupr _adjust_fdiv _initterm ?terminate@@YAXXZ ??1type_info@@UAE@XZ _onexit __dllonexit _endthreadex strncmp _memicmp strtol _beginthread _endthread _local_unwind2 _mbspbrk tolower strncat bsearch qsort _fullpath printf _vsnprintf _CxxThrowException _strnicmp toupper strstr isxdigit isalnum _wstat fputs fseek ftell _mbsnbcmp __RTDynamicCast strtod atol abs fwrite fread _ftol _mbsnbcpy _mbsicoll sscanf fopen fprintf fclose _beginthreadex calloc localtime atof _snwprintf wcsncpy wcsstr wcschr _wcsicmp iswdigit swscanf iswalpha _mbstok _mbsrchr strcat malloc memmove strcmp wcscmp memset strncpy strrchr _stat _snprintf srand rand memcmp strcpy strchr _mbschr _ismbcspace _mbsnbicmp _except_handler3 free realloc _mbsicmp _mbscmp _purecall time atoi _ismbcdigit wcslen sprintf strlen vsprintf ??2@YAPAXI@Z memcpy __CxxFrameHandler _mbsstr

wininet

InternetSetStatusCallback FtpOpenFileA InternetAttemptConnect FindFirstUrlCacheGroup DeleteUrlCacheGroup FindNextUrlCacheGroup DeleteUrlCacheEntry InternetCrackUrlA InternetCanonicalizeUrlA InternetConnectA InternetConnectW HttpOpenRequestA HttpOpenRequestW HttpSendRequestA HttpQueryInfoA HttpSendRequestW HttpQueryInfoW InternetCloseHandle InternetSetStatusCallbackA InternetSetStatusCallbackW InternetReadFile InternetOpenUrlA InternetSetOptionA InternetOpenA GetUrlCacheEntryInfoA InternetQueryDataAvailable InternetSetFilePointer InternetSetCookieA InternetGetCookieA HttpAddRequestHeadersA HttpEndRequestA InternetWriteFile HttpSendRequestExA InternetQueryOptionA InternetGetConnectedState FindNextUrlCacheEntryA FindFirstUrlCacheEntryA FindCloseUrlCache

setupapi

SetupIterateCabinetA

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

iphlpapi

GetAdaptersInfo GetNetworkParams

ws2_32

gethostname gethostbyname

Name

.text

Size

952KB

Virtual Size

950KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

76KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Shared

Size

4KB

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

252KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118__84c9e2cec8a7cbedf672a45f363bf209

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PROGRAM_FILES/Baidu/bar/Buttons/custom.xml

$TEMP/bdtmp/InstDll.dll

kernel32

msvcrt

shlwapi

generic

BaiduBar.dat

baidubar.dll

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

oleacc

rpcrt4

imm32

urlmon

msimg32

msvcrt

wininet

setupapi

version

iphlpapi

ws2_32

generic

img/imglist.bmp

img/logo.bmp