674df079e60ed3b85017693d56f33cbd

Sharing

Copy URL

Twitter E-mail

General

Target

674df079e60ed3b85017693d56f33cbd
Size

2.3MB
MD5

674df079e60ed3b85017693d56f33cbd
SHA1

7639fb599c67f67972afb546c930b9388d326d8d
SHA256

44fc3ed667e57cd9d3faa9a21b548640a810bebc09b1a47737fcb4b92390bccc
SHA512

cb834385c63931e93c2e3d628e8833cf00646915d08f443ca2b8084444aad74a61a8c60f6fd986df59817e3de0a10cd572037f014e4499bc7b6baf0055979b08
SSDEEP

49152:WonQtK5S8l/zwzcRKrC331JIToe5B8KvtXMnwCI0yqMGZZHbp+RhpkW:WonQt38l/xvJq5Hino0CyZHN+Rhp1

Score

1^/10

Malware Config

Signatures

Files

674df079e60ed3b85017693d56f33cbd
.rar
About.asp
.vbs
Book/add_book.asp
Book/add_book_pass.asp
.vbs
Book/index.asp
.vbs
Book/left.asp
Download.asp
.vbs
Downloads.asp
.vbs
Job.asp
.vbs
News.asp
.vbs
NewsMore.asp
.vbs
Products.asp
.vbs
ShowDownload.asp
.vbs
ShowNews.asp
.vbs
ShowProducts.asp
.vbs
So.asp
.vbs
Sql.Asp
.vbs
TD_sql.asp
.vbs
admin/LoginOut.asp
admin/Manage_backup.asp
.vbs
admin/Resume.asp
.vbs
admin/WebEditor/_example/clientapi.asp
.html
admin/WebEditor/_example/default.asp
.html
admin/WebEditor/_example/dlg_upload.asp
.html .js polyglot
admin/WebEditor/_example/example.css
admin/WebEditor/_example/images/remoteupload.gif
.gif
admin/WebEditor/_example/myeditorarea.css
admin/WebEditor/_example/para_extcss.asp
.html
admin/WebEditor/_example/para_file.asp
.html .js polyglot
admin/WebEditor/_example/popup.asp
.html
admin/WebEditor/_example/remote.asp
.html
admin/WebEditor/_example/retrieve.asp
.asp
admin/WebEditor/_example/standard.asp
.html .vbs polyglot
admin/WebEditor/asp/browse.asp
.vbs
admin/WebEditor/asp/config.asp
admin/WebEditor/asp/upfileclass.asp
.vbs
admin/WebEditor/asp/upload.asp
.vbs
admin/WebEditor/dialog/about.htm
.html .js polyglot
admin/WebEditor/dialog/anchor.htm
.html .js polyglot
admin/WebEditor/dialog/art.htm
.html .js polyglot
admin/WebEditor/dialog/backimage.htm
.html .js polyglot
admin/WebEditor/dialog/browse.htm
.html .js polyglot
admin/WebEditor/dialog/dialog.js
.js
admin/WebEditor/dialog/eWebEditorClient.CAB
.cab
eWebEditorClient.INF
eWebEditorClient.dll
.dll regsvr32 windows:4 windows x86 arch:x86

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23-08-2007 00:00

Not After

22-08-2008 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30-04-2007 00:00

Not After

29-04-2012 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

Actual PE Digest

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaLateMemSt
ord593
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
_CIsin
ord631
ord709
__vbaErase
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaGet4
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord716
ord531
__vbaFPException
__vbaInStrVar
ord532
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord579
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarSetObjAddref
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaCastObj
__vbaForEachVar
__vbaStrVarCopy
ord619
_allmul
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord580

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
admin/WebEditor/dialog/eWebEditorClientInstall.exe
.exe windows:1 windows x86 arch:x86

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23-08-2007 00:00

Not After

22-08-2008 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25-04-2007 00:00

Not After

09-07-2019 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09-07-1999 18:31

Not After

09-07-2019 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30-04-2007 00:00

Not After

29-04-2012 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

Actual PE Digest

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
admin/WebEditor/dialog/emot.htm
.html .js polyglot
admin/WebEditor/dialog/eq.htm
.html .js polyglot
admin/WebEditor/dialog/fieldset.htm
.html .js polyglot
admin/WebEditor/dialog/file.htm
.html .js polyglot
admin/WebEditor/dialog/findreplace.htm
.html .js polyglot
admin/WebEditor/dialog/flash.htm
.html .js polyglot
admin/WebEditor/dialog/fullscreen.htm
.html .js polyglot
admin/WebEditor/dialog/hyperlink.htm
.html .js polyglot
admin/WebEditor/dialog/i_upload.htm
.html .js polyglot
admin/WebEditor/dialog/iframe.htm
.html .js polyglot
admin/WebEditor/dialog/img.htm
.html .js polyglot
admin/WebEditor/dialog/importexcel.htm
.html .js polyglot
admin/WebEditor/dialog/importword.htm
.html .js polyglot
admin/WebEditor/dialog/installactivex.htm
.html .js polyglot
admin/WebEditor/dialog/map.htm
.html .js polyglot
admin/WebEditor/dialog/marquee.htm
.html .js polyglot
admin/WebEditor/dialog/media.htm
.html .js polyglot
admin/WebEditor/dialog/owcexcel.htm
.html .js polyglot
admin/WebEditor/dialog/paragraph.htm
.html .js polyglot
admin/WebEditor/dialog/selcolor.htm
.html .js polyglot
admin/WebEditor/dialog/symbol.htm
.html .js polyglot
admin/WebEditor/dialog/table.htm
.html .js polyglot
admin/WebEditor/dialog/tablecell.htm
.html .js polyglot
admin/WebEditor/dialog/tablecellsplit.htm
.html .js polyglot
admin/WebEditor/dialog/template.htm
.html .js polyglot
admin/WebEditor/ewebeditor.htm
.html .js polyglot
admin/WebEditor/js/buttons.js
.js
admin/WebEditor/js/ewebeditor.js
.js
admin/WebEditor/js/zh-cn.js
admin/WebEditor/popup.htm
.html .js polyglot
admin/WebEditor/skin/office2003/btnchecked.gif
.gif
admin/WebEditor/skin/office2003/btndown.gif
.gif
admin/WebEditor/skin/office2003/btnover.gif
.gif
admin/WebEditor/skin/office2003/buttons.gif
.gif
admin/WebEditor/skin/office2003/dialog.css
admin/WebEditor/skin/office2003/editor.css
admin/WebEditor/skin/office2003/editorarea.code.css
admin/WebEditor/skin/office2003/editorarea.css
admin/WebEditor/skin/office2003/editorarea.edit.css
admin/WebEditor/skin/office2003/editorarea.text.css
admin/WebEditor/skin/office2003/menuarea.css
admin/WebEditor/skin/office2003/menubg.gif
.gif
admin/WebEditor/skin/office2003/tbbg.gif
.gif
admin/WebEditor/skin/office2003/tbhandle.gif
.gif
admin/WebEditor/skin/office2003/tbleft.gif
.gif
admin/WebEditor/skin/office2003/tbright.gif
.gif
admin/WebEditor/style/popup.js
admin/WebEditor/sysimage/Thumbs.db
admin/WebEditor/sysimage/bg/Thumbs.db
admin/WebEditor/sysimage/bg/birthday.gif
.gif
admin/WebEditor/sysimage/bg/christmas.gif
.gif
admin/WebEditor/sysimage/bg/citrus.gif
.gif
admin/WebEditor/sysimage/bg/clear.jpg
.jpg
admin/WebEditor/sysimage/bg/fiesta.jpg
.jpg
admin/WebEditor/sysimage/bg/flower.gif
.gif
admin/WebEditor/sysimage/bg/gathering.jpg
.jpg
admin/WebEditor/sysimage/bg/glacier.jpg
.jpg
admin/WebEditor/sysimage/bg/grid.gif
.gif
admin/WebEditor/sysimage/bg/hearts.gif
.gif
admin/WebEditor/sysimage/bg/ivy.gif
.gif
admin/WebEditor/sysimage/bg/maize.jpg
.jpg
admin/WebEditor/sysimage/bg/nature.jpg
.jpg
admin/WebEditor/sysimage/bg/snow.gif
.gif
admin/WebEditor/sysimage/bg/tech.gif
.gif
admin/WebEditor/sysimage/bold.gif
.gif
admin/WebEditor/sysimage/emot/01.gif
.gif
admin/WebEditor/sysimage/emot/02.gif
.gif
admin/WebEditor/sysimage/emot/03.gif
.gif
admin/WebEditor/sysimage/emot/04.gif
.gif
admin/WebEditor/sysimage/emot/05.gif
.gif
admin/WebEditor/sysimage/emot/06.gif
.gif
admin/WebEditor/sysimage/emot/07.gif
.gif
admin/WebEditor/sysimage/emot/08.gif
.gif
admin/WebEditor/sysimage/emot/09.gif
.gif
admin/WebEditor/sysimage/emot/10.gif
.gif
admin/WebEditor/sysimage/emot/11.gif
.gif
admin/WebEditor/sysimage/emot/12.gif
.gif
admin/WebEditor/sysimage/emot/13.gif
.gif
admin/WebEditor/sysimage/emot/14.gif
.gif
admin/WebEditor/sysimage/emot/15.gif
.gif
admin/WebEditor/sysimage/emot/16.gif
.gif
admin/WebEditor/sysimage/emot/17.gif
.gif
admin/WebEditor/sysimage/emot/18.gif
.gif
admin/WebEditor/sysimage/emot/19.gif
.gif
admin/WebEditor/sysimage/emot/20.gif
.gif
admin/WebEditor/sysimage/emot/21.gif
.gif
admin/WebEditor/sysimage/emot/22.gif
.gif
admin/WebEditor/sysimage/emot/23.gif
.gif
admin/WebEditor/sysimage/emot/24.gif
.gif
admin/WebEditor/sysimage/emot/25.gif
.gif
admin/WebEditor/sysimage/emot/26.gif
.gif
admin/WebEditor/sysimage/emot/27.gif
.gif
admin/WebEditor/sysimage/emot/28.gif
.gif
admin/WebEditor/sysimage/emot/29.gif
.gif
admin/WebEditor/sysimage/emot/30.gif
.gif
admin/WebEditor/sysimage/emot/31.gif
.gif
admin/WebEditor/sysimage/emot/32.gif
.gif
admin/WebEditor/sysimage/emot/33.gif
.gif
admin/WebEditor/sysimage/emot/34.gif
.gif
admin/WebEditor/sysimage/emot/35.gif
.gif
admin/WebEditor/sysimage/emot/36.gif
.gif
admin/WebEditor/sysimage/emot/37.gif
.gif
admin/WebEditor/sysimage/emot/38.gif
.gif
admin/WebEditor/sysimage/emot/39.gif
.gif
admin/WebEditor/sysimage/emot/40.gif
.gif
admin/WebEditor/sysimage/emot/41.gif
.gif
admin/WebEditor/sysimage/emot/42.gif
.gif
admin/WebEditor/sysimage/emot/43.gif
.gif
admin/WebEditor/sysimage/emot/44.gif
.gif
admin/WebEditor/sysimage/emot/45.gif
.gif
admin/WebEditor/sysimage/emot/46.gif
.gif
admin/WebEditor/sysimage/emot/47.gif
.gif
admin/WebEditor/sysimage/emot/48.gif
.gif
admin/WebEditor/sysimage/emot/49.gif
.gif
admin/WebEditor/sysimage/emot/50.gif
.gif
admin/WebEditor/sysimage/emot/Thumbs.db
admin/WebEditor/sysimage/ewebeditor.gif
.gif
admin/WebEditor/sysimage/file/Thumbs.db
admin/WebEditor/sysimage/file/audio.gif
.gif
admin/WebEditor/sysimage/file/avi.gif
.gif
admin/WebEditor/sysimage/file/bmp.gif
.gif
admin/WebEditor/sysimage/file/closedfolder.gif
.gif
admin/WebEditor/sysimage/file/code.gif
.gif
admin/WebEditor/sysimage/file/doc.gif
.gif
admin/WebEditor/sysimage/file/exe.gif
.gif
admin/WebEditor/sysimage/file/folder.gif
.gif
admin/WebEditor/sysimage/file/folderback.gif
.gif
admin/WebEditor/sysimage/file/gif.gif
.gif
admin/WebEditor/sysimage/file/hlp.gif
.gif
admin/WebEditor/sysimage/file/htm.gif
.gif
admin/WebEditor/sysimage/file/jpg.gif
.gif
admin/WebEditor/sysimage/file/mdb.gif
.gif
admin/WebEditor/sysimage/file/mid.gif
.gif
admin/WebEditor/sysimage/file/mp.gif
.gif
admin/WebEditor/sysimage/file/mp3.gif
.gif
admin/WebEditor/sysimage/file/openfolder.gif
.gif
admin/WebEditor/sysimage/file/parentfolder.gif
.gif
admin/WebEditor/sysimage/file/pdf.gif
.gif
admin/WebEditor/sysimage/file/pic.gif
.gif
admin/WebEditor/sysimage/file/ppt.gif
.gif
admin/WebEditor/sysimage/file/rar.gif
.gif
admin/WebEditor/sysimage/file/rm.gif
.gif
admin/WebEditor/sysimage/file/swf.gif
.gif
admin/WebEditor/sysimage/file/txt.gif
.gif
admin/WebEditor/sysimage/file/unknow.gif
.gif
admin/WebEditor/sysimage/file/xls.gif
.gif
admin/WebEditor/sysimage/file/zip.gif
.gif
admin/WebEditor/sysimage/icon16/Thumbs.db
admin/WebEditor/sysimage/icon16/aspx.gif
.gif
admin/WebEditor/sysimage/icon16/audio.gif
.gif
admin/WebEditor/sysimage/icon16/avi.gif
.gif
admin/WebEditor/sysimage/icon16/bmp.gif
.gif
admin/WebEditor/sysimage/icon16/chm.gif
.gif
admin/WebEditor/sysimage/icon16/code.gif
.gif
admin/WebEditor/sysimage/icon16/doc.gif
.gif
admin/WebEditor/sysimage/icon16/exe.gif
.gif
admin/WebEditor/sysimage/icon16/gif.gif
.gif
admin/WebEditor/sysimage/icon16/hlp.gif
.gif
admin/WebEditor/sysimage/icon16/htm.gif
.gif
admin/WebEditor/sysimage/icon16/ico.gif
.gif
admin/WebEditor/sysimage/icon16/jpg.gif
.gif
admin/WebEditor/sysimage/icon16/js.gif
.gif
admin/WebEditor/sysimage/icon16/mdb.gif
.gif
admin/WebEditor/sysimage/icon16/mid.gif
.gif
admin/WebEditor/sysimage/icon16/mp.gif
.gif
admin/WebEditor/sysimage/icon16/mp3.gif
.gif
admin/WebEditor/sysimage/icon16/pdf.gif
.gif
admin/WebEditor/sysimage/icon16/png.gif
.gif
admin/WebEditor/sysimage/icon16/ppt.gif
.gif
admin/WebEditor/sysimage/icon16/rar.gif
.gif
admin/WebEditor/sysimage/icon16/rm.gif
.gif
admin/WebEditor/sysimage/icon16/swf.gif
.gif
admin/WebEditor/sysimage/icon16/txt.gif
.gif
admin/WebEditor/sysimage/icon16/unknow.gif
.gif
admin/WebEditor/sysimage/icon16/xls.gif
.gif
admin/WebEditor/sysimage/icon16/xml.gif
.gif
admin/WebEditor/sysimage/icon16/zip.gif
.gif
admin/WebEditor/sysimage/icon32/Thumbs.db
admin/WebEditor/sysimage/icon32/aspx.gif
.gif
admin/WebEditor/sysimage/icon32/audio.gif
.gif
admin/WebEditor/sysimage/icon32/avi.gif
.gif
admin/WebEditor/sysimage/icon32/bmp.gif
.gif
admin/WebEditor/sysimage/icon32/chm.gif
.gif
admin/WebEditor/sysimage/icon32/code.gif
.gif
admin/WebEditor/sysimage/icon32/doc.gif
.gif
admin/WebEditor/sysimage/icon32/exe.gif
.gif
admin/WebEditor/sysimage/icon32/gif.gif
.gif
admin/WebEditor/sysimage/icon32/hlp.gif
.gif
admin/WebEditor/sysimage/icon32/htm.gif
.gif
admin/WebEditor/sysimage/icon32/ico.gif
.gif
admin/WebEditor/sysimage/icon32/jpg.gif
.gif
admin/WebEditor/sysimage/icon32/js.gif
.gif
admin/WebEditor/sysimage/icon32/mdb.gif
.gif
admin/WebEditor/sysimage/icon32/mid.gif
.gif
admin/WebEditor/sysimage/icon32/mp.gif
.gif
admin/WebEditor/sysimage/icon32/mp3.gif
.gif
admin/WebEditor/sysimage/icon32/pdf.gif
.gif
admin/WebEditor/sysimage/icon32/png.gif
.gif
admin/WebEditor/sysimage/icon32/ppt.gif
.gif
admin/WebEditor/sysimage/icon32/rar.gif
.gif
admin/WebEditor/sysimage/icon32/rm.gif
.gif
admin/WebEditor/sysimage/icon32/swf.gif
.gif
admin/WebEditor/sysimage/icon32/txt.gif
.gif
admin/WebEditor/sysimage/icon32/unknow.gif
.gif
admin/WebEditor/sysimage/icon32/xls.gif
.gif
admin/WebEditor/sysimage/icon32/xml.gif
.gif
admin/WebEditor/sysimage/icon32/zip.gif
.gif
admin/WebEditor/sysimage/italic.gif
.gif
admin/WebEditor/sysimage/loading.gif
.gif
admin/WebEditor/sysimage/rect.gif
.gif
admin/WebEditor/sysimage/rectimg.gif
.gif
admin/WebEditor/sysimage/space.gif
.gif
admin/WebEditor/sysimage/tree/Thumbs.db
admin/WebEditor/sysimage/tree/arrowdown.gif
.gif
admin/WebEditor/sysimage/tree/arrowup.gif
.gif
admin/WebEditor/sysimage/tree/blank.gif
.gif
admin/WebEditor/sysimage/tree/branch1.gif
.gif
admin/WebEditor/sysimage/tree/branch2.gif
.gif
admin/WebEditor/sysimage/tree/dirclose.gif
.gif
admin/WebEditor/sysimage/tree/diropen.gif
.gif
admin/WebEditor/sysimage/tree/folderclose.gif
.gif
admin/WebEditor/sysimage/tree/folderopen.gif
.gif
admin/WebEditor/sysimage/tree/folderparent.gif
.gif
admin/WebEditor/sysimage/tree/line.gif
.gif
admin/WebEditor/sysimage/tree/minus1.gif
.gif
admin/WebEditor/sysimage/tree/minus2.gif
.gif
admin/WebEditor/sysimage/tree/plus1.gif
.gif
admin/WebEditor/sysimage/tree/plus2.gif
.gif
admin/WebEditor/sysimage/tree/root.gif
.gif
admin/WebEditor/template/0.gif
.gif
admin/WebEditor/template/01.htm
admin/WebEditor/template/02.htm
admin/WebEditor/template/03.htm
admin/WebEditor/template/04.htm
admin/WebEditor/template/05.htm
admin/WebEditor/template/06.htm
admin/WebEditor/template/Thumbs.db
admin/WebEditor/template/template.js
admin/add_Job.asp
admin/add_Job_pass.asp
.vbs
admin/add_about.asp
admin/add_about_pass.asp
.vbs
admin/add_administrator_pass.asp
.vbs
admin/add_download.asp
.vbs
admin/add_download_fl_pass.asp
.vbs
admin/add_download_pass.asp
.vbs
admin/add_flash.asp
.vbs
admin/add_js.asp
.vbs
admin/add_link.asp
.js
admin/add_link_pass.asp
.vbs
admin/add_menu_pass.asp
.vbs
admin/add_news.asp
.vbs
admin/add_news_pass.asp
.vbs
admin/add_newsfl_pass.asp
.vbs
admin/add_products.asp
.vbs
admin/add_products_pass.asp
.vbs
admin/admin_Job.asp
.vbs
admin/admin_Resume.asp
.vbs
admin/admin_about.asp
.vbs
admin/admin_add.asp
admin/admin_add_pass.asp
.vbs
admin/admin_administrator.asp
.vbs
admin/admin_count.asp
.vbs
admin/admin_download.asp
.vbs
admin/admin_download_fl.asp
.vbs
admin/admin_flash.asp
.vbs
admin/admin_guanli.asp
.vbs
admin/admin_link_img.asp
.vbs
admin/admin_link_txt.asp
.vbs
admin/admin_ly.asp
.vbs
admin/admin_mail.asp
.vbs
admin/admin_menu.asp
.vbs
admin/admin_news.asp
.vbs
admin/admin_newsfl.asp
.vbs
admin/admin_orders.asp
.vbs
admin/admin_products.asp
.vbs
admin/admin_products_Bigclass.asp
.vbs
admin/admin_products_smallclass.asp
.vbs
admin/admin_sql.asp
.vbs
admin/admin_user.asp
.vbs
admin/admin_xinxisz.asp
.vbs
admin/admin_xtsz.asp
.vbs
admin/adminloginpass.asp
.vbs
admin/images/Deepteach_colorPicker.js
.js
admin/images/M1.css
admin/images/Thumbs.db
admin/images/ajax.js
.js
admin/images/arrow_box.gif
.gif
admin/images/bg.jpg
.jpg
admin/images/bg_list.gif
.gif
admin/images/button_bg.gif
.gif
admin/images/common.js
.js
admin/images/data.js
.js
admin/images/input.js
.js
admin/images/li.gif
.gif
admin/images/list_bg.gif
.gif
admin/images/list_button.gif
.gif
admin/images/list_task.jpg
.jpg
admin/images/list_top.gif
.gif
admin/images/login.gif
.gif
admin/images/login_03.gif
.gif
admin/images/login_04.gif
.gif
admin/images/login_06.gif
.gif
admin/images/login_07.gif
.gif
admin/images/login_08.gif
.gif
admin/images/login_09.gif
.gif
admin/images/login_10.gif
.gif
admin/images/login_11.gif
.gif
admin/images/login_bg.jpg
.jpg
admin/images/menu.js
.js
admin/images/menu_add.gif
.gif
admin/images/menu_bg.jpg
.jpg
admin/images/menu_left.jpg
.jpg
admin/images/menu_list.jpg
.jpg
admin/images/menu_reduce.gif
.gif
admin/images/showimg.gif
.gif
admin/images/style.css
admin/images/top_bg.jpg
.jpg
admin/images/top_lable.jpg
.jpg
admin/images/top_lf.jpg
.jpg
admin/images/top_menu.jpg
.jpg
admin/images/tree_folder3.gif
.gif
admin/index.asp
admin/left.asp
.js
admin/login.asp
.js
admin/main.asp
.vbs
admin/md5.Asp
.vbs
admin/page.asp
.vbs
admin/safecode.asp
.vbs
admin/seeion.asp
.vbs
admin/top.asp
.vbs
admin/updata_Job.asp
.html
admin/updata_about.asp
.vbs
admin/updata_administrator.asp
.vbs
admin/updata_administrator_pass.asp
.vbs
admin/updata_download.asp
.html
admin/updata_flash.asp
.html
admin/updata_ly.asp
.html
admin/updata_news.asp
.html
admin/updata_password.asp
admin/updata_products.asp
admin/updata_user.asp
.html
admin/xiugai_Job.asp
.vbs
admin/xiugai_about.asp
.vbs
admin/xiugai_administrator.asp
.vbs
admin/xiugai_download.asp
.vbs
admin/xiugai_flash.asp
.vbs
admin/xiugai_ly.asp
.vbs
admin/xiugai_news.asp
.vbs
admin/xiugai_orders.asp
.vbs
admin/xiugai_products.asp
.vbs
admin/xiugai_user.asp
.vbs
admin/xiugaipassword.asp
.vbs
admin/新云软件.url
.url
adurl.asp
.vbs
config.asp
.vbs
conn.asp
.vbs
data/data%&$%#123.mdb
foot.asp
images/1.jpg
.jpg
images/3.swf
images/Link_Logo.gif
.gif
images/Login.gif
.gif
images/QQ/Thumbs.db
images/QQ/advclose.gif
.gif
images/QQ/floatadv.js
.js
images/QQ/qq.js
.js
images/Register.gif
.gif
images/Thumbs.db
images/adplay.swf
images/bg.gif
.gif
images/body_bg.gif
.gif
images/bottom_box.gif
.gif
images/centerbg.gif
.gif
images/cptop.gif
.gif
images/download.gif
.gif
images/f1.jpg
.jpg
images/f2.jpg
.jpg
images/goumai.gif
.gif
images/head_01.gif
.gif
images/head_03.gif
.gif
images/ico_catalogue.png
.png
images/images.gif
.gif
images/inc13.gif
.gif
images/inc22.gif
.gif
images/l-bg.gif
.gif
images/lianxi.gif
.gif
images/logo.gif
.gif
images/newstop.gif
.gif
images/noimages.gif
.gif
images/pnew-bg1.gif
.gif
images/style.css
images/tick.gif
.gif
images/title_bg.gif
.gif
images/titlebg.gif
.gif
images/topbg2.gif
.gif
images/topbg3.gif
.gif
images/xx.gif
.gif
index.asp
.vbs
left_Download.asp
.vbs
left_job.asp
.vbs
left_news.asp
left_products.asp
member/Buy.asp
.vbs
member/Buy_order.asp
.vbs
member/LoginOut.asp
member/Register.asp
member/index.asp
.vbs
member/left.asp
member/login.asp
.vbs
member/login_pass.asp
.vbs
member/login_pass2.asp
.vbs
member/md5.Asp
.vbs
member/my_orders.asp
.vbs
member/orders.asp
.vbs
member/register_pass.asp
.vbs
member/safecode.asp
.vbs
member/updata_password.asp
.vbs
member/updata_user.asp
.vbs
member/xiugai_password.asp
.vbs
page.asp
.vbs
path.inc
search.asp
top.asp
.js
uploadfile/20090113/20090113173222185.jpg
.jpg
uploadfile/20090113/Thumbs.db
uploadfile/200911/20091130092013940.jpg
.jpg
uploadfile/200911/20091130092037911.jpg
.jpg
uploadfile/200911/20091130092059754.jpg
.jpg
uploadfile/200911/20091130092120185.jpg
.jpg
uploadfile/200911/20091130092139446.jpg
.jpg
uploadfile/200911/Thumbs.db
uploadfile/201003/20100311172532625.jpg
.jpg
uploadfile/201003/20100311172541498.jpg
.jpg
uploadfile/201003/20100311172547892.jpg
.jpg
uploadfile/201003/Thumbs.db
yp.asp
.vbs
yp_pass.asp
.vbs
安装说明.txt

Sharing

General

Malware Config

Signatures

Files

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cfSigner

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 7KB

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:feSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 36KB

DATA Size: 1024B - Virtual size: 588B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 14KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

.text
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 7KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

CODE
Size: 36KB - Virtual size: 36KB

DATA
Size: 1024B - Virtual size: 588B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 14KB