19ba84925f0137a56c883ff5ff51204821115ff2748598aa8bed5fc7f7552402

Sharing

Copy URL Twitter E-mail

General

Target

19ba84925f0137a56c883ff5ff51204821115ff2748598aa8bed5fc7f7552402
Size

858KB
MD5

a19b8550ae85446d397eb6b33fb0e8be
SHA1

832da4cae73274a9af36679106bd421078776f98
SHA256

19ba84925f0137a56c883ff5ff51204821115ff2748598aa8bed5fc7f7552402
SHA512

af56a5e02c6e5f7f567852dcc0d7dee6863b52ae89d8b4f06e0eb16f9fdc17cbf44d675eacdb06d89e26c0ee444db7027969323503b8bc2a9bda19f6750cbacd
SSDEEP

12288:bHFLOEtdNQTLeR28oPasW6c3ptGKP9Rfq0rf+Gp7l/CC+v95+:tNQT6R2VPasFEP9VJC1v90

Score

1^/10

Malware Config

Signatures

Files

19ba84925f0137a56c883ff5ff51204821115ff2748598aa8bed5fc7f7552402
.dll windows:4 windows x86 arch:x86

ea472f6344771374da7701f6979fe343

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:ba
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

18/09/2013, 00:00

Not After

23/06/2015, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

be:47:e7:3c:05:ea:b6:d1:59:2b:56:a2:99:da:49:61:dd:2b:9a:83
Signer

Actual PE Digest

be:47:e7:3c:05:ea:b6:d1:59:2b:56:a2:99:da:49:61:dd:2b:9a:83

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\DownloadLibSrc\Unicode\Product Release\asyn_download_interface.pdb

Imports

ws2_32

inet_addr
inet_ntoa

kernel32

WaitForSingleObject
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentProcessId
OpenMutexW
lstrcpynA
lstrcpynW
FindClose
FindNextFileW
FindFirstFileW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FreeLibrary
OutputDebugStringA
GetProcAddress
LoadLibraryW
ReadFile
GetFileSize
CreateFileW
MultiByteToWideChar
lstrlenA
RaiseException
LocalFree
CreateFileMappingW
CreateMutexW
WideCharToMultiByte
CreateEventW
GetSystemTimeAsFileTime
GetVersionExA
GetFileAttributesW
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
ResumeThread
GetCurrentThreadId
CreateThread
GetModuleHandleW
GetModuleFileNameW
VirtualQuery
IsBadCodePtr
GetCurrentProcess
ReleaseMutex
SetLastError
GetProcessHeap
HeapFree
HeapAlloc
OpenFileMappingA
CreateFileMappingA
GetLastError
MapViewOfFile
UnmapViewOfFile
CloseHandle
GetTickCount
QueryPerformanceCounter
LoadLibraryA
SetFilePointer
GetModuleFileNameA
ExitProcess
DebugBreak

user32

wsprintfW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
AllocateLocallyUniqueId

ole32

CoUninitialize
CoCreateInstance
CoInitialize

msvcp71

?_Nomemory@std@@YAXXZ
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@II@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?width@ios_base@std@@QBEHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??7ios_base@std@@QBE_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXID@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AViterator@12@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

msvcr71

__CppXcptFilter
?terminate@@YAXXZ
__security_error_handler
_itoa
_adjust_fdiv
__CxxFrameHandler
??3@YAXPAX@Z
memcpy
??_V@YAXPAX@Z
memset
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
memcmp
strncpy
wcsncpy
wcscpy
_purecall
memmove
sprintf
isdigit
toupper
sscanf
swscanf
_wcsnicmp
free
malloc
tolower
atoi
rand
_except_handler3
strlen
isspace
wcsrchr
fclose
_wfopen
getc
fgetwc
fseek
fread
_ultoa
_ultow
atol
_wtol
_callnewh
??1type_info@@UAE@XZ
_CRT_RTC_INIT
__dllonexit
_onexit
_initterm

Exports

Exports

accelerate_task
add_dcdn_task
add_emule_server
add_emule_server_byLink
add_emule_server_byLink_u
add_member_cdn_resources
add_no_gcid_peer_resource
add_no_gcid_peer_resource1
add_peer_resource
add_peer_resource1
add_process_to_protected_process_list
add_resources
add_server_resource
add_server_resource_ex
add_server_resource_ex_u
add_server_resource_extendable
add_server_resource_extendable_u
add_server_resource_u
allocate_session_id
asyn_verify_proxy
asyn_verify_proxy_u
cancel_speed_limit
cancel_verify_proxy
clear_upload_data_bytes
close_bt_reimport_task
connect_emule_server
create_continued_bt_task
create_continued_bt_task_u
create_continued_emule_task
create_continued_emule_task_u
create_continued_task
create_continued_task_u
create_magnet_task
create_magnet_task_u
create_new_bt_task
create_new_bt_task_u
create_new_emule_task
create_new_emule_task_u
create_new_task
create_new_task_u
create_predownload_task
create_predownload_task_u
create_upload_bt_task
create_upload_bt_task_u
delete_dcdn_task
delete_emule_server
delete_emule_temp_files
delete_emule_temp_files_u
delete_from_cid_store
delete_from_cid_store_u
delete_task
delete_tempfile
delete_tempfile_u
detect_codepage
discard_member_cdn_resource
discard_no_gcid_peer_resource
discard_peer_resource
discard_resources
emule_tempfile_reimport
emule_tempfile_reimport_u
enable_multi_res_speedup_on_invalid_origin
erase_emule_tempfile_reimport_result
erase_emule_tempfile_reimport_result_u
fix_pre_download_parameter
fix_pre_download_parameter_u
forbid_pipes
get_bt_cfg_file_list
get_bt_cfg_file_list_u
get_bt_data_file_list
get_bt_data_file_list_u
get_data_bytes_of_resource
get_flow_bytes
get_magnet_task_status
get_request_transfer_task_result
get_task_channel_data
get_task_channel_data_ex
get_task_res_stat_data
get_temp_file_list
get_temp_file_list_u
get_tp_process_id
init
init_u
is_bt_tempfile_exist
is_bt_tempfile_exist_u
is_emule_temp_file_exist
is_emule_temp_file_exist_u
is_support_schema
is_tempfile_exist
is_tempfile_exist_u
limit_xl_speed
limit_xl_speed_ex
notify_current_lan_user_count
notify_del_uncomp_task
notify_del_uncomp_task_u
notify_hub_bt_moved
notify_hub_bt_moved_u
notify_hub_deleted
notify_hub_deleted_u
notify_hub_moved
notify_hub_moved_u
parse_ed2k_server_url
parse_ed2k_server_url_u
parse_ed2k_url
parse_ed2k_url_u
parse_filename
parse_filename_u
parse_magnet_url
parse_magnet_url_u
parse_seed_file
parse_seed_file_u
parse_url
parse_url_u
query_bt_file_info
query_bt_p2sp_sub_task_file_indexs
query_bt_reimport_progress
query_bt_task_info
query_bt_task_info_ex
query_bt_task_info_set
query_can_accelerate_task_result
query_create_transfer_task_result
query_current_upload_speed
query_default_listen_port_result
query_dht_status
query_downloaded_blocks
query_emule_status
query_emule_task_info
query_emule_task_info_ex
query_emule_task_info_set
query_emule_task_info_set_u
query_emule_tempfile_reimport_result
query_fetch_server_connection_info_result
query_flow_rate_info
query_get_acc_cdn_info_result
query_get_acc_cdn_res_count_and_gcid_result
query_get_acc_cdn_resource_count_result
query_get_bt_file_id_result
query_get_bt_reimport_root_path_result
query_get_bt_reimport_root_path_result_u
query_get_bt_task_info_set_result
query_get_count_of_resource
query_get_download_data_bytes_result
query_get_dspider_ctrl_flag_result
query_get_ed2k_server_link_result
query_get_emule_server_count_result
query_get_emule_server_info_result
query_get_emule_server_list_result
query_get_emule_task_cid_result
query_get_emule_task_gcid_result
query_get_failure_detail_result
query_get_head_first_status_result
query_get_is_support_dispatch_strategy_result
query_get_limit_speed_firewall_info_result
query_get_local_peer_property_result
query_get_max_bt_temp_filesize_result
query_get_member_res_info_result
query_get_origin_readbytes_result
query_get_p2sp_task_index_info_result
query_get_part_cid_result
query_get_play_id_result
query_get_play_port_result
query_get_protect_process_flow_info_result
query_get_protect_record_list_result
query_get_reimport_ed2k_link_result
query_get_reimport_ed2k_link_result_u
query_get_reimport_file_name_result
query_get_reimport_file_name_result_u
query_get_res_hub_info_result
query_get_rmt_task_status_result
query_get_speed_limit_result
query_get_task_gcid_result
query_get_torrent_file_path_result
query_get_torrent_file_path_result_u
query_get_upload_data_bytes_result
query_get_url_str_result
query_get_url_str_result_u
query_global_info_set
query_import_clients_credit_result
query_is_part_hash_valid_result
query_listen_port_result
query_net_type
query_network_status
query_notify_hub_bt_deleted_result
query_on_playing_result
query_opt_result_long
query_p2sp_task_info
query_p2sp_task_info_ex
query_p2sp_task_info_ex_u
query_p2sp_task_info_set
query_p2sp_task_info_set_u
query_score_and_level_result
query_set_dcdn_quota_result
query_speed_test_result
query_start_bt_reimport_task_result
query_switch_p2sp_sub_task_result
query_upnp_status
query_verify_proxy_result
re_query_task_resource_info
register_callback_func
register_client
release_blocks_info
release_bt_data_file_list
release_bt_data_file_list_u
release_bt_task_result_info_set
release_emule_task_result_info_set
release_emule_task_result_info_set_u
release_global_result_info_set
release_opt_result
release_p2sp_task_result_info_set
release_p2sp_task_result_info_set_u
release_seed_file_info
release_seed_file_info_u
release_temp_file_list
release_temp_file_list_u
remove_process_from_proteced_process_list
remove_server_resource_ex
remove_server_resource_ex_u
reset_bt_task_need_download_file
set_AICH_enable
set_addition_info
set_beyond_global_speed_limit
set_bt_file_download_order
set_bt_task_stat_para
set_bt_task_stat_para_u
set_channel_switch
set_complete_file_name
set_complete_file_name_u
set_compress_enable
set_cookie
set_crypt_option
set_cur_language
set_cur_language_u
set_dap_priority_list
set_dcdn_quota
set_dht_switch
set_dispatch_strategy
set_ed2k_enable
set_emule_crypt_option
set_emule_kad_port
set_emule_listen_port
set_emule_server_priority
set_emule_task_stat_para
set_emule_task_stat_para_u
set_file_name
set_file_name_u
set_global_connection_limit
set_hub_proxy
set_hub_proxy_u
set_jmp_key
set_kad_enable
set_listen_port
set_need_download_video_file_index
set_nichname
set_nichname_u
set_origin_request_header
set_origin_resource_type
set_original_resource_retry_strategy
set_original_url_thread_num
set_over_story_application
set_partner_id
set_play_position
set_process_protect_switch
set_product_flag
set_product_version
set_proxy_info
set_proxy_info_u
set_ref_send_strategy
set_report_strategy
set_res_query_cid
set_res_query_cid_with_size
set_res_use_strategy
set_secureident_option
set_special_url_mark
set_speed_limit
set_speed_limit_mode
set_stat_ref_url
set_stat_ref_url_u
set_syn_connection_limit
set_task_hub_type
set_task_type
set_task_verification_info
set_upload_speed_limit
set_upnp_switch
set_user_agent
set_user_id
set_user_name
set_xl_file_system_bufsize
set_xl_file_system_flush_bufsize
start_predownload_task
start_process_thread
start_speed_test
start_task
stop_emule_server
stop_task
submit_add_no_gcid_peer_resource1_opt
submit_add_no_gcid_peer_resource_opt
submit_add_peer_resource1_opt
submit_add_peer_resource_opt
submit_add_server_resource_ex_u_opt
submit_add_server_resource_extendable_u_opt
submit_can_accelerate_task_opt
submit_create_transfer_task_opt
submit_fetch_server_connection_info_opt
submit_get_acc_cdn_info_opt
submit_get_acc_cdn_res_count_and_gcid_opt
submit_get_acc_cdn_resource_count_opt
submit_get_bt_file_id_opt
submit_get_bt_reimport_root_path_opt
submit_get_bt_task_info_set_opt
submit_get_count_of_resource
submit_get_default_listen_port_opt
submit_get_download_data_bytes_opt
submit_get_dspider_ctrl_flag_opt
submit_get_ed2k_server_link_opt
submit_get_emule_server_count_opt
submit_get_emule_server_info_opt
submit_get_emule_server_list_opt
submit_get_emule_task_cid_opt
submit_get_emule_task_gcid_opt
submit_get_emule_tempfile_reimport_result_opt
submit_get_emule_tempfile_reimport_result_opt_u
submit_get_failure_detail_opt
submit_get_head_first_status_opt
submit_get_is_support_dispatch_strategy_opt
submit_get_limit_speed_firewall_info_opt
submit_get_listen_port_opt
submit_get_local_peer_property_opt
submit_get_max_bt_temp_filesize_opt
submit_get_member_res_info_opt
submit_get_origin_readbytes_opt
submit_get_p2sp_task_index_info_opt
submit_get_part_cid_opt
submit_get_play_id_opt
submit_get_play_port_opt
submit_get_protect_process_flow_info_opt
submit_get_protect_record_list_opt
submit_get_reimport_ed2k_link_opt
submit_get_reimport_ed2k_link_opt_u
submit_get_reimport_file_name_opt
submit_get_reimport_file_name_opt_u
submit_get_res_hub_info_opt
submit_get_rmt_task_status_opt
submit_get_score_and_level_opt
submit_get_speed_limit_opt
submit_get_speed_test_result_opt
submit_get_task_gcid_opt
submit_get_torrent_file_path_opt
submit_get_upload_data_bytes_opt
submit_get_url_str_opt
submit_get_url_str_opt_u
submit_import_clients_credit_opt
submit_import_clients_credit_opt_u
submit_is_part_hash_valid_opt
submit_notify_hub_bt_deleted_opt
submit_notify_hub_bt_deleted_opt_u
submit_on_playing_opt
submit_request_transfer_task_opt
submit_set_dcdn_quota_opt
submit_start_bt_reimport_task_opt
submit_start_bt_reimport_task_opt_u
submit_switch_p2sp_sub_task_opt
switch_dcdn_func
switch_p2p_search_some_kind_of_res
switch_query_dcdn_res_avaliable
uninit
update_datafile
update_datafile_u
url_info_to_str
url_info_to_str_u
write_to_cid_store
write_to_cid_store_u

Sections

.text
Size: 692KB - Virtual size: 691KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ea472f6344771374da7701f6979fe343

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:baCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

be:47:e7:3c:05:ea:b6:d1:59:2b:56:a2:99:da:49:61:dd:2b:9a:83Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

advapi32

ole32

msvcp71

msvcr71

Exports

Exports

Sections

.text Size: 692KB - Virtual size: 691KB

.rdata Size: 96KB - Virtual size: 93KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 48KB - Virtual size: 47KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0c:ff:7b:32:9c:ff:7f:3b:8d:2d:54:2a:b2:58:26:ba
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

be:47:e7:3c:05:ea:b6:d1:59:2b:56:a2:99:da:49:61:dd:2b:9a:83
Signer

.text
Size: 692KB - Virtual size: 691KB

.rdata
Size: 96KB - Virtual size: 93KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 48KB - Virtual size: 47KB