f398a66f4c05e80c806fcc3219c641ee_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

f398a66f4c05e80c806fcc3219c641ee_JaffaCakes118
Size

720KB
MD5

f398a66f4c05e80c806fcc3219c641ee
SHA1

0df95d1a931b451a7bc36b3a886bfd82ab285921
SHA256

6644594ef86dbda72f851e8fe1df44fdec9f08b9b61f7b15ea34f4303d238aa8
SHA512

d79555bc928a99c57893ff6bc527233ee7464dbf89990af0d5ddf68db85e7883e86cc0ec55084f0b0021ed5752cbc9816b18909c75083483b165ab287bdb9b2c
SSDEEP

6144:hQ/FeQ8nkS940yLgVi9EJkkLOi7wa5GJcibpAlXlrCDJG6dgXoqG4VuvQNIyvx90:qehkS940QgokCNQGJ7dAjsVE6wpNIyD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f398a66f4c05e80c806fcc3219c641ee_JaffaCakes118

Files

f398a66f4c05e80c806fcc3219c641ee_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

??0Invocation@XMLConfiguration@@QAE@ABV01@@Z
??0Invocation@XMLConfiguration@@QAE@XZ
??0NameValueBase@@QAE@ABV0@@Z
??0NameValueBase@@QAE@PBD@Z
??0NameValueUnsignedInt@@QAE@ABV0@@Z
??0NameValueUnsignedInt@@QAE@PBD@Z
??0NameValueUnsignedInt@@QAE@PBDI@Z
??0NameValueXMLString@@QAE@ABV0@@Z
??0NameValueXMLString@@QAE@PBDPBE@Z
??0Predicate@XMLNode@@QAE@ABV01@@Z
??0Predicate@XMLNode@@QAE@XZ
??0XMLConfiguration@@QAE@ABV0@@Z
??0XMLConfiguration@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0XMLDocument@@QAE@ABV0@@Z
??0XMLDocument@@QAE@PBD@Z
??0XMLNode@@QAE@ABV0@@Z
??0XMLNode@@QAE@PAU_xmlNode@@@Z
??0XMLNode@@QAE@XZ
??1Invocation@XMLConfiguration@@QAE@XZ
??1NameValueBase@@UAE@XZ
??1NameValueUnsignedInt@@UAE@XZ
??1NameValueXMLString@@UAE@XZ
??1Predicate@XMLNode@@UAE@XZ
??1XMLConfiguration@@QAE@XZ
??1XMLDocument@@QAE@XZ
??4Invocation@XMLConfiguration@@QAEAAV01@ABV01@@Z
??4NameValueBase@@QAEAAV0@ABV0@@Z
??4NameValueUnsignedInt@@QAEAAV0@ABV0@@Z
??4NameValueXMLString@@QAEAAV0@ABV0@@Z
??4Predicate@XMLNode@@QAEAAV01@ABV01@@Z
??4XMLConfiguration@@QAEAAV0@ABV0@@Z
??4XMLNode@@QAEAAV0@ABV0@@Z
??BXMLNode@@QBEPAU_xmlNode@@XZ
??RPredicate@XMLNode@@UBE_NABU_xmlNode@@@Z
??_7NameValueBase@@6B@
??_7NameValueUnsignedInt@@6B@
??_7NameValueXMLString@@6B@
??_7Predicate@XMLNode@@6B@
?AddErrorMessage@XMLDocument@@SAXPAXPBDZZ
?AffinityMask@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?AffinityMask@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Children@XMLNode@@QBE?AV?$list@VXMLNode@@V?$allocator@VXMLNode@@@std@@@std@@ABVPredicate@1@@Z
?ConsoleApp@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ConsoleApp@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Debug@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?DebugLogFile@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?DebugLogFile@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?DebuggingEnabled@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?DebuggingEnabled@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Delay@Invocation@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@4@AAV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z
?Delay@Invocation@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Dependencies@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Description@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Description@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?DisplayName@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?DisplayName@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?Environment@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Environment@XMLConfiguration@@QBEABV?$vector@U?$pair@VNameValueXMLString@@V1@@std@@V?$allocator@U?$pair@VNameValueXMLString@@V1@@std@@@2@@std@@XZ
?Error@NameValueBase@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Errors@XMLConfiguration@@QBEABV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?Errors@XMLDocument@@QBEABV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@XZ
?Executable@Invocation@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@4@AAV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z
?Executable@Invocation@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?ForceReplace@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ForceReplace@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?GroupDependents@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?GroupDependents@XMLConfiguration@@QBEABV?$vector@VNameValueXMLString@@V?$allocator@VNameValueXMLString@@@std@@@std@@XZ
?HasValue@NameValueBase@@QBE_NXZ
?InteractWithDesktop@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?InteractWithDesktop@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?IsValid@XMLConfiguration@@QBE_NXZ
?IsValid@XMLDocument@@QBE_NXZ
?JobType@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?JobType@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?LoadOrderGroup@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?LoadOrderGroup@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?Monitoring@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Monitoring@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?MonitoringFrequency@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?MonitoringFrequency@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Name@NameValueBase@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?Name@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Name@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?Options@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Parameters@Invocation@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@4@AAV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z
?Parameters@Invocation@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?Populate@XMLConfiguration@@AAE_NABVXMLNode@@ABUElementNode@1@@Z
?PostService@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PostService@XMLConfiguration@@QBEABVInvocation@1@XZ
?PostServiceDelay@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PostServiceExecutable@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PostServiceParameters@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PostServiceWorkingDir@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PreService@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PreService@XMLConfiguration@@QBEABVInvocation@1@XZ
?PreServiceDelay@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PreServiceExecutable@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PreServiceParameters@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?PreServiceWorkingDir@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Priority@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Priority@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Program@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Read@XMLConfiguration@@AAE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?RootElement@XMLDocument@@QBE?BVXMLNode@@XZ
?SMF@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Service@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?Service@XMLConfiguration@@QBEABVInvocation@1@XZ
?ServiceDelay@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ServiceDependents@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ServiceDependents@XMLConfiguration@@QBEABV?$vector@VNameValueXMLString@@V?$allocator@VNameValueXMLString@@@std@@@std@@XZ
?ServiceExecutable@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ServiceParameters@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ServiceWorkingDir@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?SetValue@NameValueUnsignedInt@@UAE_NPBE@Z
?SetValue@NameValueXMLString@@UAE_NPBE@Z
?ShowWindow@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?ShowWindow@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Siblings@XMLNode@@QBE?AV?$list@VXMLNode@@V?$allocator@VXMLNode@@@std@@@std@@ABVPredicate@1@@Z
?StartUpMode@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?StartUpMode@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?UponExit@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?UponExit@XMLConfiguration@@QBEABVNameValueUnsignedInt@@XZ
?Variable@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@3@@Z
?WorkingDir@Invocation@XMLConfiguration@@AAE_NABV?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@ABV?$vector@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@V?$allocator@U?$pair@V?$basic_string@EU?$char_traits@E@std@@V?$allocator@E@2@@std@@V12@@std@@@2@@4@AAV?$list@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@@Z
?WorkingDir@Invocation@XMLConfiguration@@QBEABVNameValueXMLString@@XZ
?always_true@XMLNode@@2VPredicate@1@A
LoadXMLFile
PrintSvcAdminVersion
ServiceInstall
ServiceUninstall

Sections

.text
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text1
Size: 292KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.adata
Size: 52KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data1
Size: 44KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc1
Size: 20KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.pdata
Size: 272KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

.text Size: - Virtual size: 58KB

.rdata Size: 32KB - Virtual size: 28KB

.data Size: - Virtual size: 9KB

.reloc Size: - Virtual size: 4KB

.text1 Size: 292KB - Virtual size: 320KB

.adata Size: 52KB - Virtual size: 64KB

.data1 Size: 44KB - Virtual size: 64KB

.reloc1 Size: 20KB - Virtual size: 64KB

.pdata Size: 272KB - Virtual size: 320KB

.rsrc Size: 4KB - Virtual size: 4KB

.text
Size: - Virtual size: 58KB

.rdata
Size: 32KB - Virtual size: 28KB

.data
Size: - Virtual size: 9KB

.reloc
Size: - Virtual size: 4KB

.text1
Size: 292KB - Virtual size: 320KB

.adata
Size: 52KB - Virtual size: 64KB

.data1
Size: 44KB - Virtual size: 64KB

.reloc1
Size: 20KB - Virtual size: 64KB

.pdata
Size: 272KB - Virtual size: 320KB

.rsrc
Size: 4KB - Virtual size: 4KB