0b3d758fd111ac77b29b6c9c1b6e6b2f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0b3d758fd111ac77b29b6c9c1b6e6b2f_JaffaCakes118
Size

2.3MB
MD5

0b3d758fd111ac77b29b6c9c1b6e6b2f
SHA1

246877348ded928fb8fddd613a947383e0d3d9a8
SHA256

f7ff76e9336ba38f0262d7d2c58631559d4c768b22d4fe8c4e989b765b980bdf
SHA512

7f4d1da60fb924c9cfefdf8dfe34e0b32297660703b21bee32eb39693fdf44d6f94a099b357f7d0c1e6e97ed873accd498916151d9fe03776b6f715712ab0750
SSDEEP

49152:Xvzg6TdFULH3MJGf/LiyWhL+XjtQ8VGcXWvg7v5rjzkW/43jDruu6vyPMuK/wmxP:Xvc6TbubVUP4Q+

Score

1^/10

Malware Config

Signatures

Files

0b3d758fd111ac77b29b6c9c1b6e6b2f_JaffaCakes118
.dll windows:6 windows x64 arch:x64

6c584d23640c9e02b169e0ddfb72dcbf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2b:20:eb:33:80:79:2a:b0:11:f6:62:c0:64:fd:b4:73
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

29/07/2015, 00:00

Not After

27/08/2017, 23:59

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

98:37:fd:ce:7a:84:48:3e:72:0b:c1:7f:fd:27:fd:1b:9e:38:55:d2
Signer

Actual PE Digest

98:37:fd:ce:7a:84:48:3e:72:0b:c1:7f:fd:27:fd:1b:9e:38:55:d2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\BWA\1444815472-iAdCoreWin-813.30.8.3\srcroot\Core\Windows\iAdCore\Release\x64\iAdCore.pdb

Imports

corefoundation

CFArrayCreateMutable
CFNumberGetValue
CFArrayAppendValue
CFStringCreateWithCString
CFAbsoluteTimeGetCurrent
CFArrayRemoveAllValues
CFNumberCreate
CFStringGetCString
CFArrayRemoveValueAtIndex
__CFStringMakeConstantString
CFStringCreateWithFormat
CFDictionarySetValue
CFNumberGetTypeID
CFDictionaryGetTypeID
CFURLGetString
kCFPreferencesCurrentUser
CFErrorCreate
CFDictionaryRemoveValue
kCFPreferencesAnyApplication
kCFErrorDescriptionKey
CFPreferencesSetValue
kCFBooleanFalse
CFErrorGetCode
kCFBooleanTrue
kCFPreferencesCurrentHost
CFErrorCreateWithUserInfoKeysAndValues
CFStringCreateMutableCopy
kCFAbsoluteTimeIntervalSince1970
CFSetContainsValue
CFStringCreateWithFormatAndArguments
CFBooleanGetTypeID
CFBooleanGetValue
CFURLCopyScheme
CFDictionaryGetCount
CFStringFindAndReplace
CFDictionaryApplyFunction
CFSetAddValue
CFTimeZoneCopySystem
CFTimeZoneGetSecondsFromGMT
CFSetRemoveValue
CFStringGetTypeID
kCFTypeSetCallBacks
CFSetCreateMutable
CFCalendarCopyCurrent
CFCalendarDecomposeAbsoluteTime
CFArrayGetValues
CFArrayGetTypeID
CFPreferencesGetAppBooleanValue
CFURLCopyHostName
CFDataGetTypeID
CFPreferencesAppSynchronize
CFPreferencesSetAppValue
CFPreferencesCopyAppValue
CFURLCopyNetLocation
CFDataGetBytePtr
CFNumberFormatterCreateStringWithNumber
CFStringAppendFormat
CFAllocatorReallocate
CFPropertyListCreateData
CFNotificationCenterAddObserver
CFStringGetCharactersPtr
CFUUIDCreateString
CFNotificationCenterRemoveObserver
CFLocaleCreate
CFDataCreateMutableCopy
CFNumberFormatterCreate
CFDateGetTypeID
CFStringGetCharacters
CFArrayCreateCopy
CFSetGetTypeID
CFStringCreateWithBytes
CFStringAppend
CFDataCreateCopy
CFNotificationCenterPostNotification
_CFURLCreateFromComponents
CFUUIDCreate
CFCopyDescription
CFCopyTypeIDDescription
CFNotificationCenterGetLocalCenter
CFDataCreate
CFStringCreateCopy
CFDataGetLength
CFStringCreateWithCStringNoCopy
CFPropertyListCreateWithData
CFStringCreateMutable
_CFURLCopyComponents
CFPreferencesCopyValue
CFStringGetIntValue
CFStringCreateExternalRepresentation
kCFAllocatorDefault
CFRunLoopGetMain
kCFRunLoopCommonModes
CFDataAppendBytes
CFStringFind
CFStringCreateFromExternalRepresentation
CFLocaleGetIdentifier
CFLocaleCopyCurrent
CFErrorGetDomain
CFStringGetFastestEncoding
CFStringGetDoubleValue
kCFNull
CFNullGetTypeID
CFStringReplaceAll
CFStringFindCharacterFromSet
CFStringReplace
CFStringTrimWhitespace
CFCharacterSetCreateInvertedSet
CFStringCreateWithSubstring
CFStringCreateWithCharacters
CFStringInsert
CFStringGetCharacterAtIndex
CFCharacterSetCreateWithCharactersInString
CFStringFindWithOptions
CFURLCreateCopyAppendingPathComponent
CFURLCopyFileSystemPath
CFDataGetBytes
CFDataCreateMutable
CFDataCreateWithBytesNoCopy
kCFAllocatorNull
CFURLCreateCopyAppendingPathExtension
CFDictionaryGetKeysAndValues
CFURLCopyPathExtension
CFURLWriteDataAndPropertiesToResource
CFURLDestroyResource
CFDictionaryCreateMutableCopy
CFURLCreateDataAndPropertiesFromResource
kCFCopyStringDictionaryKeyCallBacks
CFDateFormatterCreateStringWithDate
CFDateCreate
CFURLCopyPath
CFStringHasSuffix
CFDateFormatterSetFormat
CFDateFormatterSetProperty
CFDateFormatterCreate
kCFErrorLocalizedDescriptionKey
kCFDateFormatterTimeZone
CFDictionaryCreate
kCFTypeDictionaryKeyCallBacks
CFArrayAppendArray
CFArrayInsertValueAtIndex
CFArrayGetValueAtIndex
CFDictionaryGetValue
CFRetain
CFStringGetLength
CFSetGetCount
kCFTypeDictionaryValueCallBacks
CFSetGetValues
CFGetTypeID
CFDictionaryCreateMutable
CFArrayGetCount
CFURLCreateWithString
CFRelease
CFStringGetMaximumSizeForEncoding
CFArrayCreateMutableCopy
CFStringCompare
CFAllocatorAllocate
kCFTypeArrayCallBacks

cfnetwork

CFURLConnectionStart
CFHTTPMessageGetResponseStatusCode
CFURLConnectionScheduleWithRunLoop
CFHTTPMessageSetBody
CFURLResponseGetHTTPResponse
CFHTTPMessageSetHeaderFieldValue
CFURLConnectionCancel
CFURLConnectionCreate
CFHTTPMessageCopyAllHeaderFields
CFHTTPMessageCreateRequest
CFURLRequestCreateMutableHTTPRequest
kCFHTTPVersion1_1

libdispatch

dispatch_suspend
dispatch_release
dispatch_semaphore_signal
dispatch_async_f
dispatch_semaphore_wait
dispatch_semaphore_create
dispatch_once_f
dispatch_resume
dispatch_sync_f
dispatch_queue_get_label
dispatch_after_f
dispatch_time
_dispatch_queue_attr_concurrent
dispatch_queue_create
dispatch_get_global_queue

ws2_32

htonl
ntohl

sqlite3

sqlite3_open
sqlite3_free
sqlite3_bind_text
sqlite3_reset
sqlite3_bind_parameter_index
sqlite3_close
sqlite3_exec
sqlite3_prepare_v2
sqlite3_column_double
sqlite3_step
sqlite3_finalize
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_bind_null
sqlite3_bind_double
sqlite3_errmsg
sqlite3_bind_blob

kernel32

RtlPcToFileHeader
CreateFileW
WriteConsoleW
SetStdHandle
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
HeapReAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetOEMCP
GetACP
IsValidCodePage
HeapSize
GetModuleFileNameW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CloseHandle
FreeLibrary
SignalObjectAndWait
LoadLibraryA
ReleaseMutex
WaitForSingleObject
GetProcAddress
SetEvent
ResetEvent
CreateMutexA
CreateEventA
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
GetProcessHeap
EnumSystemLocalesW
WideCharToMultiByte
EncodePointer
DecodePointer
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
GetCPInfo
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID

advapi32

CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA

Exports

Exports

ADAdBatchRequestCopyDescription
ADAdBatchRequestValidate
ADAdBatchResponseCopyDescription
ADAdBatchResponseValidate
ADAdBatchResponse_AdErrorCodeGetStringForValue
ADAdConnectionGetStringForValue
ADAdDataCopyDescription
ADAdDataUpdateCopyDescription
ADAdDataUpdateValidate
ADAdDataValidate
ADAdData_AdIdentifier
ADAdData_ClickActionGetStringForValue
ADAdData_CreativeType
ADAdData_StoryboardOrientationGetStringForValue
ADAdData_TransitionTypeGetStringForValue
ADAdEventCopyDescription
ADAdEventValidate
ADAdManifestCopyDescription
ADAdManifestValidate
ADAdPolicyEngineConfigureClient
ADAdPolicyEngineDisableClient
ADAdPolicyEngineOptimalTransmissionWindowDidOpen
ADAdPolicyEngineReportListeningPresenceEvent
ADAdPolicyEngineReportStationTileImpression
ADAdPolicyEngineSetSponsoredStationIDs
ADAdPolicyEngineSetStationAndInitialTrackData
ADAdPolicyEngineSetVisuallyEngaged
ADAdPolicyEngine_AdFailed
ADAdPolicyEngine_AdFinished
ADAdPolicyEngine_AdPaused
ADAdPolicyEngine_AdResumed
ADAdPolicyEngine_AdScheduled
ADAdPolicyEngine_AdStarted
ADAdPolicyEngine_CancelScheduledAd
ADAdPolicyEngine_ConfigureAdSchedulingHandlers
ADAdPolicyEngine_CopyGatewayEnabledStationIDs
ADAdPolicyEngine_DidBeginPlayback
ADAdPolicyEngine_DidEnterStation
ADAdPolicyEngine_DidFinishAdSlot
ADAdPolicyEngine_DidStopPlayback
ADAdPolicyEngine_ReportClientEvent
ADAdPolicyEngine_ReportListeningPresenceEvent
ADAdPolicyEngine_RequestAdsForSlot
ADAdPolicyEngine_ReturnAd
ADAdPolicyEngine_SetServerURLForTestStations
ADAdPolicyEngine_SongBegan
ADAdPolicyEngine_SongSkipped
ADAdPolicyEngine_SongStopped
ADAdPolicyEngine_UpdateInitialTrackDataForCurrentStation
ADAdPolicyEngine_WillBeginAdSlot
ADAdServerAcceptAdData
ADAdServerAccumulatedVisibleTimeForAd
ADAdServerAdShouldImpress
ADAdServerCancelRequest
ADAdServerClearCaches
ADAdServerConfirmClickOnAd
ADAdServerCopyHeartbeatToken
ADAdServerDidHideAd
ADAdServerDidShowAd
ADAdServerEnableBatchedEvents
ADAdServerFlushAdEventsForAd
ADAdServerFlushEvents
ADAdServerInitialize
ADAdServerJingleRequestCompleted
ADAdServerRejectAdData
ADAdServerReportAdEvent
ADAdServerReportAssetMetricForAd
ADAdServerReportClickOnAd
ADAdServerReportContentErrorForAd
ADAdServerReportNetworkRequestBandwidth
ADAdServerReportNetworkRequestLatency
ADAdServerReportRewardResultForAd
ADAdServerReportServerErrorForAd
ADAdServerReportStoryboardDismissalForAd
ADAdServerReportStoryboardPresentationForAd
ADAdServerReportSystemEventForAd
ADAdServerRequestAd
ADAdServerRequestManifest
ADAdServerRequestPropertiesBecameAvailable
ADAdServerRequestReward
ADAdServerResetAllBackoff
ADAdServerReturnImpression
ADAdServerSetAdSpaceTypeForAd
ADAdServerSetAdValidationCallback
ADAdServerSetAssertCallback
ADAdServerSetBackoffGain
ADAdServerSetBannerCustomMetadataForAd
ADAdServerSetCacheDirectory
ADAdServerSetConnectionType
ADAdServerSetCurrentUser
ADAdServerSetDefaultAdServerURL
ADAdServerSetLoggingCallback
ADAdServerSetRequestCompleteCallback
ADAdServerSetSecureStorageCallbacks
ADAdServerTimeUntilAdCycle
ADAdServerTimeUntilAdExpiration
ADAdServer_ActivateClient
ADAdServer_CopyHeartbeatToken
ADAdServer_DeactivateClient
ADAdServer_EvictAd
ADAdServer_Initialize
ADAdServer_MarkPlaybackStartForAd
ADAdServer_MarkPlaybackStopAndAccrueTimeForAd
ADAdServer_RegisterClient
ADAdServer_ReportPassEvent
ADAdServer_RequestAd
ADAdServer_RequestAdForContext
ADAdServer_RequestedLocationAccuracy
ADAdServer_SetAuditTokenForClient
ADAdServer_SetClickSourceForAd
ADAdServer_SetCurrentLocation
ADAdServer_SetImpressionSourceForAd
ADAdServer_SetPropertiesForAdRequest
ADAdServer_SetTagContextForClient
ADAdServer_UpdateStartTimeForClient
ADAdSizeCopyDescription
ADAdSizeValidate
ADAdSlotRequestCopyDescription
ADAdSlotRequestValidate
ADAdSlotResponseCopyDescription
ADAdSlotResponseValidate
ADAdSpaceTypeGetStringForValue
ADAdSpecificationCopyDescription
ADAdSpecificationValidate
ADAggregateDistributionMetricCopyDescription
ADAggregateDistributionMetricValidate
ADAggregateScalarMetricCopyDescription
ADAggregateScalarMetricValidate
ADAssetMetricCopyDescription
ADAssetMetricValidate
ADCachedAdCopyDescription
ADCachedAdValidate
ADClickLocationCopyDescription
ADClickLocationValidate
ADClickSourceGetStringForValue
ADCopyiAdIDForDSID
ADCoreAnalytics_ReportDistributionMetricForClient
ADCoreAnalytics_ReportScalarMetricForClient
ADCreativeManifestCopyDescription
ADCreativeManifestValidate
ADCreativeTypeGetStringForValue
ADDeviceOrientationGetStringForValue
ADGeofenceCopyDescription
ADGeofenceValidate
ADHeartbeatTokenRequestCopyDescription
ADHeartbeatTokenRequestValidate
ADHeartbeatTokenResponseCopyDescription
ADHeartbeatTokenResponseValidate
ADImpressionSourceGetStringForValue
ADListeningPresenceEventCopyDescription
ADListeningPresenceEventValidate
ADListeningPresenceEvent_EventTypeGetStringForValue
ADLogAdContentErrorRequestCopyDescription
ADLogAdContentErrorRequestValidate
ADLogAdContentErrorRequest_ContentErrorTypeGetStringForValue
ADLogAdContentErrorResponseCopyDescription
ADLogAdContentErrorResponseValidate
ADLogAdEventRequestCopyDescription
ADLogAdEventRequestValidate
ADLogAdEventResponseCopyDescription
ADLogAdEventResponseValidate
ADLogAggregateMetricsRequestCopyDescription
ADLogAggregateMetricsRequestValidate
ADLogAggregateMetricsResponseCopyDescription
ADLogAggregateMetricsResponseValidate
ADLogImpressionRequestCopyDescription
ADLogImpressionRequestValidate
ADLogImpressionResponseCopyDescription
ADLogImpressionResponseValidate
ADLogListeningEventsRequestCopyDescription
ADLogListeningEventsRequestValidate
ADLogListeningEventsResponseCopyDescription
ADLogListeningEventsResponseValidate
ADLogMetaDataCopyDescription
ADLogMetaDataValidate
ADLogPassEventRequestCopyDescription
ADLogPassEventRequestValidate
ADLogPassEventRequest_EventTypeGetStringForValue
ADLogPassEventResponseCopyDescription
ADLogPassEventResponseValidate
ADLogStationClientEventRequestCopyDescription
ADLogStationClientEventRequestValidate
ADLogStationClientEventResponseCopyDescription
ADLogStationClientEventResponseValidate
ADLogSysEventRequestCopyDescription
ADLogSysEventRequestValidate
ADLogSysEventRequest_AdSystemEventTypeGetStringForValue
ADLogSysEventResponseCopyDescription
ADLogSysEventResponseValidate
ADLogTileImpressionEventRequestCopyDescription
ADLogTileImpressionEventRequestValidate
ADLogTileImpressionEventResponseCopyDescription
ADLogTileImpressionEventResponseValidate
ADLogUnfilledSlotAdsRequestCopyDescription
ADLogUnfilledSlotAdsRequestValidate
ADLogUnfilledSlotAdsResponseCopyDescription
ADLogUnfilledSlotAdsResponseValidate
ADMescalSignSAPSetupCertificateRequestCopyDescription
ADMescalSignSAPSetupCertificateRequestValidate
ADMescalSignSAPSetupCertificateResponseCopyDescription
ADMescalSignSAPSetupCertificateResponseValidate
ADMescalSignSAPSetupRequestCopyDescription
ADMescalSignSAPSetupRequestValidate
ADMescalSignSAPSetupResponseCopyDescription
ADMescalSignSAPSetupResponseValidate
ADOptOutRequestCopyDescription
ADOptOutRequestValidate
ADOptOutResponseCopyDescription
ADOptOutResponseValidate
ADParameterCopyDescription
ADParameterValidate
ADParseMessageFromString
ADPowerLogWithObjectsAndKeys
ADProtocolGetNameForRequestType
ADProtocolGetURLSuffixForRequestType
ADProtocolRequestCopyDescription
ADProtocolRequestCopyDictionary
ADProtocolRequestCreateForType
ADProtocolRequestCreateWithData
ADProtocolRequestTypeForURL
ADProtocolRequestValidate
ADProtocolResponseCopyData
ADProtocolResponseCopyDescription
ADProtocolResponseCopyDictionary
ADProtocolResponseCreateForType
ADProtocolResponseValidate
ADRequestOptedInStatusForDSID
ADRequestPropertiesCopyDescription
ADRequestPropertiesValidate
ADResetiAdIDRecords
ADResourceCacheClearCache
ADResourceCacheConfigureCacheDirectory
ADResourceCacheConfigureLimits
ADResourceCacheCopyCachedDataForURL
ADResourceCacheDiskSpaceRequestResponse
ADResourceCacheEntryCopyDescription
ADResourceCacheEntryValidate
ADResourceCacheSetDataForURL
ADResourceCacheSetDiskSpaceRequestHandler
ADRewardRequestCopyDescription
ADRewardRequestValidate
ADRewardResponseCopyDescription
ADRewardResponseValidate
ADRewardsCodeResultRequestCopyDescription
ADRewardsCodeResultRequestValidate
ADRewardsCodeResultResponseCopyDescription
ADRewardsCodeResultResponseValidate
ADRunStateGetStringForValue
ADSegmentUpdateRequestCopyDescription
ADSegmentUpdateRequestValidate
ADSegmentUpdateResponseCopyDescription
ADSegmentUpdateResponseValidate
ADSerializeMessageToString
ADServerErrorRequestCopyDescription
ADServerErrorRequestValidate
ADServerErrorRequest_ClientErrorCodeGetStringForValue
ADServerErrorResponseCopyDescription
ADServerErrorResponseValidate
ADServerManifestRequestCopyDescription
ADServerManifestRequestValidate
ADServerManifestResponseCopyDescription
ADServerManifestResponseValidate
ADSetAdvertisingIdentifier
ADSetDeviceIdentifier
ADSetFastSegmentRefreshEnabled
ADSetJingleRequestCallback
ADSetOptedInStatusForDSID
ADSetiAdIDCompositionCallback
ADTagSetCopyDescription
ADTagSetValidate
ADTagTransformationCopyDescription
ADTagTransformationValidate
ADThirdPartySegmentUpdateRequestCopyDescription
ADThirdPartySegmentUpdateRequestValidate
ADThirdPartySegmentUpdateResponseCopyDescription
ADThirdPartySegmentUpdateResponseValidate
ADUnfilledAdSpaceCopyDescription
ADUnfilledAdSpaceValidate
ADVideoAssetCopyDescription
ADVideoAssetValidate
ADiADID_ReportCurrentDSID
ADiAdIDManagerSetOSVersionAndBuildString
ADiAdIDSetDeviceIsOptedOutCallback
ADiAdID_AcquireMatchSlotIfNecessary
ADiAdID_AddActiveRecordToThirdPartySegments
ADiAdID_RemoveRecordForDSID
ADiAdID_ReportiAdIDForCurrentDSID
kADAdPolicyEngine_GatewayEnabledStationIDsDidChangeNotification
kADAdServer_AudioRoute_Bluetooth
kADAdServer_AudioRoute_BluetoothA2DP
kADAdServer_AudioRoute_BluetoothHFP
kADAdServer_AudioRoute_BluetoothLE
kADAdServer_AudioRoute_CarAudio
kADAdServer_AudioRoute_Headphones
kADAdServer_AudioRoute_Speaker
kADAdServer_AudioRoute_USB
kADAdServer_CarKitEnabledTag
kADAdServer_ClientState_Background
kADAdServer_ClientState_Foreground
kADAdServer_LocationUnavailable
kADAdServer_Motion_Driving
kADAdServer_Motion_Running
kADAdServer_Motion_Walking
kADAdServer_RequestedLocationAccuracyDidChangeNotification
kADiAdID_OptInStatusDidChangeNotification
kADiAdID_OptInStatusDidChange_DSIDKey
kADiAdID_OptInStatusDidChange_OptInStatusKey

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 474KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c584d23640c9e02b169e0ddfb72dcbf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2b:20:eb:33:80:79:2a:b0:11:f6:62:c0:64:fd:b4:73Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

98:37:fd:ce:7a:84:48:3e:72:0b:c1:7f:fd:27:fd:1b:9e:38:55:d2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

corefoundation

cfnetwork

libdispatch

ws2_32

sqlite3

kernel32

advapi32

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 474KB - Virtual size: 474KB

.data Size: 75KB - Virtual size: 88KB

.pdata Size: 66KB - Virtual size: 66KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 12KB - Virtual size: 12KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2b:20:eb:33:80:79:2a:b0:11:f6:62:c0:64:fd:b4:73
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

98:37:fd:ce:7a:84:48:3e:72:0b:c1:7f:fd:27:fd:1b:9e:38:55:d2
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 474KB - Virtual size: 474KB

.data
Size: 75KB - Virtual size: 88KB

.pdata
Size: 66KB - Virtual size: 66KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 12KB - Virtual size: 12KB