30a470f789c91215618c1ca14230a48c_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

30a470f789c91215618c1ca14230a48c_JaffaCakes118
Size

2.4MB
MD5

30a470f789c91215618c1ca14230a48c
SHA1

566367050494a0c7103e17ac0040516ac7c55e33
SHA256

98a5656e9d648938852a7b5d9e1f4cabb0ea4435ae8a5bdda4aa714830f7e90c
SHA512

22e9f119648788fbf4e5401d6ea35b8736f301529806bea94511e29ba00474577b1379d79da716533c265e9843db2ea3aea342859cdf86a00f1b1b59cd75c053
SSDEEP

24576:uEaZQmfa1YLPVtw8zDhpau3PhP3jYs8XmUHX9vYPiVoy/DnxjhvXS:uZuqPTXzDF/JMs8dHX9/VoyLnxjhv

Score

1^/10

Malware Config

Signatures

Files

30a470f789c91215618c1ca14230a48c_JaffaCakes118
.dll windows:5 windows x86 arch:x86

5391d09a4e33e49d693dc1a99f9d0468

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:06:b5:d2:91:7a:13:5c:04:e2:29:ee:21:44:9a:8d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/02/2017, 00:00

Not After

25/07/2018, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

45:98:a2:8d:fd:dc:bc:31:de:d0:f2:98:07:c5:a7:43
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

05/01/2016, 00:00

Not After

26/07/2018, 23:59

Subject

CN=ShenZhen Thunder Networking Technologies Ltd.,OU=Operate,O=ShenZhen Thunder Networking Technologies Ltd.,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 3,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

39:87:f6:49:a7:06:8e:32:37:b9:e2:ce:e7:33:f0:3c:a6:0c:84:ab:28:04:a6:e8:89:89:52:de:35:dc:79:b8
Signer

Actual PE Digest

39:87:f6:49:a7:06:8e:32:37:b9:e2:ce:e7:33:f0:3c:a6:0c:84:ab:28:04:a6:e8:89:89:52:de:35:dc:79:b8

Digest Algorithm

sha256

PE Digest Matches

true

70:57:e7:0e:44:b3:a7:3d:ad:a7:7e:da:bd:c1:3a:cb:53:a4:5d:c3
Signer

Actual PE Digest

70:57:e7:0e:44:b3:a7:3d:ad:a7:7e:da:bd:c1:3a:cb:53:a4:5d:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\work\xunlei_uiengine\pdb\ProductRelease\XLUE\XLUE.pdb

Imports

xlgraphic

XL_CreateBindBitmap
XL_EnableShadow
XL_SetShadowOffset
XL_SetShadowColor
XL_SetTextEffectType
XL_SetTextLRGap
XL_PaintTexture
XL_GetBitmapBuffer
XL_GetImageCount
XL_GetImageListBitmap
XL_ReleaseImageList
XL_ExtractBitmap
XL_SetImageListBitmap
XL_ReleaseCurve
XL_GetCurveProgress
XL_AddCurveControlPoint
XL_RGB2HSL
XL_AdjustColor
XL_SetPenColor
XL_SetBrushColor
XL_GetLogBrush
XL_ReleasePen
XL_GetLogPen
XL_GetTextureType
XL_GetTextureBitmap
XL_ReleaseTexture
XL_RemoveTextureBlock
XL_AddTextureBlock
XL_SetTextureRect
XL_SetTextureBitmap
XL_ReleaseTextEnv
XL_GetTextBorderWidth
XL_SetTextBorderWidth
XL_GetTextEffectColor
XL_SetTextEffectColor
XL_GetMultilineTextExtent
XL_GetSinglelineTextExtent
XL_GetLineGap
XL_SetLineGap
XL_GetTextCharacterExtra
XL_SetTextCharacterExtra
XL_GetTextAlignment
XL_SetTextAlignment
XL_GetTextFont
XL_SetTextFont
XL_GetBknMode
XL_SetBknMode
XL_GetBknColor
XL_SetBknColor
XL_GetTextColor
XL_SetTextColor
XL_GetTextType
XL_SetTextType
XL_GetLogFont
XL_GetBitmapChanel
XL_GetBitmapMainColor
XL_TabbedTextOut
XL_DrawMultilineText
XL_DrawSinglelineText
XL_DrawEllipse
XL_DrawPolygon
XL_DrawRectangle
XL_DrawLine
XL_StretchBitmap
XL_StretchBlend
XL_GetDefaultFont
XL_DefaultGraphicHint
XL_Blend
XL_IsBitmapOwnerBuffer
XL_GetBitmapInfo
XL_FillBitmap
XL_CloneBitmap
XL_ClipSubBindBitmap
XL_ReleaseMask
XL_CreateSubMask
XL_GetMaskSize
XL_BuildMaskCache
XL_GetMaskSourceChanel
XL_BindMaskSource
XL_GetMaskSource
XL_GetMaskSourceType
XL_ImageSeqAddImage
XL_ImageSeqEndAddImage
XL_ImageSeqBeginAddImage
XL_ImageSeqGetCount
XL_ImageSeqGetImageByIndex
XL_AdjustBitmapColor
XL_TransRect
XL_TransKeepCentreRect
XL_TransGetDestBmpSize
XL_TransPoint
XL_ReleaseTrans
XL_AddSubTrans
XL_SetTransDistDisp2obs
XL_DoTrans
XL_AddRefImageSeq
XL_AddRefBrush
XL_AddRefPen
XL_ReleaseBrush
XL_BindExpObject
XL_BindExpRect
XL_DeleteExp
XL_EqualRect
XL_GetExpValue
XL_CaclExp
XL_CloneEXP
XL_SetExp
XL_CreateExp
XL_GetExpString
XL_GetCurveControlPoint
XL_GetCurveControlPointCount
XL_CloneTrans
XL_SetMaskSize
XL_AddRefMask
XL_SetFreeTypeEnabled
XL_SetConfigFontName
XL_IsSupportFont
XL_GetDefaultFaceName
XL_CreateStretchTrans
XL_CreateTransferTrans
XL_CreateRotateTrans
XL_AddRefTrans
XL_AddRefTextEnv
XL_AddRefImageList
XL_AddRefFont
XL_AddRefTexture
XL_AddRefCurve
XL_AddRefBitmap
XL_CreatePen
XL_CreateBrush
XL_CreateImageList
XL_CreateTexture
XL_CreateTextEnv
XL_CreateTextEnv2
XL_CreateFont
XL_ReleaseFont
XL_CreateCurve
XL_LoadBitmapFromFile
XL_CreateBitmap
XL_ReleaseBitmap
XL_PaintBitmap
XL_SetMaskBmpStretch
XL_CreateImageSeq
XL_DeleteFont
XL_SetTextureOrigin
XL_FillBlend
XL_ReleaseImageSeq
XL_NewMask

xlluaruntime

XLLRT_DebugDesroyStackMemPool
XLLRT_DebugDestroyLogs
XLLRT_DebugLogsPopNextLog
XLLRT_DebugMemPoolGetLogs
XLLRT_DebugCreateLogs
XLLRT_DebugOutputLuaStack
XLLRT_DebugCreateStackMemPool
XLLRT_ReleaseRunTime
XLLRT_GetLuaState
XLLRT_ReleaseEnv
XLLRT_GetRuntime
lua_pcall
XLLRT_RunChunk
XLLRT_AddRefEnv
XLLRT_CreateChunk
XLLRT_CreateChunkFromModule
XLLRT_CreateChunkFromFile
XLLRT_AddRefRunTime
lua_remove
XLLRT_AddRefChunk
XLLRT_DoRegisterClass
XLLRT_GetRuntimeFromLuaState
XLLRT_PrepareChunk
lua_newuserdata
lua_setmetatable
XLLRT_ReleaseChunk
XLLRT_GetEnv
XLLRT_CreateRunTime
XLLRT_CreateEnv
XLLRT_DestroyEnv
XLLRT_DestroyRunTime
lua_gc
lua_pushnil
luaL_checklstring
lua_tolstring
luaL_checkudata
XLLRT_PushXLObject
XLLRT_RegisterGlobalObj
lua_touserdata
lua_pushstring
lua_pushinteger
lua_insert
lua_gettable
lua_tonumber
lua_getmetatable
lua_rawequal
lua_isuserdata
lua_next
lua_getfield
XLLRT_LuaCall
lua_pushthread
XLLRT_RegisterGlobalAPI
lua_createtable
lua_setfield
lua_rawgeti
lua_settop
lua_isstring
lua_gettop
luaL_checknumber
lua_pushnumber
lua_pushlightuserdata
XLLRT_RegisterClass
lua_tointeger
lua_pushvalue
luaL_ref
luaL_unref
lua_type
lua_toboolean
lua_isnumber
lua_pushboolean
luaL_checkinteger

imm32

ImmGetCompositionFontW
ImmSetCompositionWindow
ImmAssociateContext
ImmAssociateContextEx
ImmSetCompositionFontW
ImmGetContext
ImmReleaseContext

xlfsio

XLFS_CloseDirectory
XLFS_UpdateCacheFile
XLFS_MountDir
XLFS_FileExists
XLFS_IsEOF
XLFS_CloseFile
XLFS_OpenFile
XLFS_GetFileSize
XLFS_ReadFile
XLFS_DirExists
XLFS_ReadDirectory
XLFS_OpenDirectory
XLFS_ReleaseStream
XLFS_CreateStreamFromMountFile
XLFS_UnMount
XLFS_Init

kernel32

CreateFileW
SetFilePointer
SetEndOfFile
DeleteFileW
FlushFileBuffers
GetLastError
WriteFile
GetLocalTime
CloseHandle
InitializeCriticalSection
HeapAlloc
VirtualProtect
GetCurrentThreadId
SetLastError
GetCurrentProcess
FlushInstructionCache
GetProcessHeap
GetUserDefaultLCID
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
ResumeThread
SetThreadPriority
FreeLibrary
GetSystemDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
CopyFileW
CreateDirectoryW
GetTempPathW
GetModuleFileNameW
CreateMutexW
WriteProcessMemory
VirtualProtectEx
GetCurrentProcessId
TlsSetValue
TlsGetValue
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
lstrlenW
GlobalFree
GetVersionExW
SizeofResource
LoadResource
FindResourceW
EnumResourceNamesW
SetEvent
ResetEvent
CreateEventW
HeapSetInformation
HeapCreate
HeapDestroy
HeapReAlloc
HeapSize
WideCharToMultiByte
MultiByteToWideChar
IsDebuggerPresent
OutputDebugStringW
DebugBreak
UnmapViewOfFile
VirtualQuery
ReleaseMutex
LocalFree
MapViewOfFileEx
CreateFileMappingW
OpenFileMappingW
GetFileSize
ReadFile
LockResource
FreeResource
AddAtomW
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetTickCount
CreateProcessW
OpenMutexW
TlsAlloc
MulDiv
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
HeapFree
LoadLibraryW

user32

GetClassInfoExW
LoadCursorW
OffsetRect
SetRectEmpty
IntersectRect
IsWindow
ShowWindow
GetFocus
SetFocus
GetWindowDC
ReleaseDC
IsRectEmpty
DefWindowProcW
DestroyWindow
SetWindowLongW
GetWindowLongW
CallWindowProcW
CreateWindowExW
GetWindow
SetCursor
EqualRect
CopyRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
IsChild
PostMessageW
SendMessageW
PtInRect
GetWindowRect
GetCursorPos
TrackMouseEvent
ScreenToClient
IsWindowEnabled
WindowFromPoint
GetMessagePos
SetTimer
KillTimer
MoveWindow
SetWindowPos
SetParent
wsprintfW
GetDC
GetSysColor
RegisterClassExW
GetParent
GetClassNameW
GetAncestor
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetSystemMetrics
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
SetRect
UnionRect
MonitorFromRect
DestroyAcceleratorTable
GetWindowPlacement
MapWindowPoints
GetClientRect
DialogBoxIndirectParamW
EndDialog
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
MonitorFromPoint
GetDoubleClickTime
RedrawWindow
GetWindowRgn
DeferWindowPos
GetClassLongW
PrintWindow
GetWindowTextW
GetWindowTextLengthW
CharNextW
GetMonitorInfoW
RegisterWindowMessageW
InvalidateRect
EndPaint
BeginPaint
GetActiveWindow
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SystemParametersInfoW
SetActiveWindow
SetCapture
GetCapture
ReleaseCapture
ClientToScreen
UpdateLayeredWindow
IsZoomed
IsIconic
EnableWindow
SetWindowTextW
SetLayeredWindowAttributes
SetWindowRgn
BringWindowToTop
GetKeyState
SetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetCaretBlinkTime
UnregisterClassA
CreateAcceleratorTableW

gdi32

GetStockObject
GetObjectW
GetTextMetricsW
CombineRgn
CreateRectRgnIndirect
GetRgnBox
GetCurrentObject
GetDeviceCaps
CopyMetaFileW
CreateSolidBrush
StretchBlt
GetRegionData
SelectClipRgn
SetStretchBltMode
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
SetWindowOrgEx
CreateDIBSection
BitBlt
DeleteObject
ExtCreateRegion
PtInRegion
OffsetRgn
CreateRoundRectRgn
GetClipBox
CreateRectRgn
CreateFontIndirectW
PatBlt

advapi32

GetSecurityDescriptorLength
GetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
MakeSelfRelativeSD
GetSecurityDescriptorSacl

ole32

OleLockRunning
CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitialize
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CoGetClassObject
CLSIDFromString
CreateStreamOnHGlobal
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CoTaskMemFree
OleGetClipboard
OleSetClipboard
CoGetMalloc
StgCreateDocfile

oleaut32

SysAllocStringByteLen
SysStringByteLen
SysFreeString
SysStringLen
SysAllocString
VariantClear
VariantCopy
VarBstrCmp
VariantInit

atl90

ord41
ord43
ord44
ord27
ord30
ord28
ord32
ord59
ord42
ord31

shlwapi

PathCombineW
PathIsDirectoryW
PathIsRelativeW
PathCanonicalizeW
PathFindFileNameW
PathRemoveExtensionW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindExtensionW

msvcp90

?max@?$numeric_limits@I@std@@SAIXZ
?copy@?$char_traits@D@std@@SAPADPADPBDI@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?assign@?$char_traits@_W@std@@SAPA_WPA_WI_W@Z
?find@?$char_traits@_W@std@@SAPB_WPB_WIAB_W@Z
?eq@?$char_traits@_W@std@@SA_NAB_W0@Z
?find@?$char_traits@D@std@@SAPBDPBDIABD@Z
?compare@?$char_traits@_W@std@@SAHPB_W0I@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?_Xlen@_String_base@std@@SAXXZ
?_Xran@_String_base@std@@SAXXZ
?assign@?$char_traits@D@std@@SAXAADABD@Z
?_Copy_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
?_Move_s@?$char_traits@D@std@@SAPADPADIPBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?compare@?$char_traits@D@std@@SAHPBD0I@Z
?assign@?$char_traits@_W@std@@SAXAA_WAB_W@Z
?_Copy_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z
?_Move_s@?$char_traits@_W@std@@SAPA_WPA_WIPB_WI@Z

msvcr90

fopen
fread
fclose
strtol
_wtoi
fabs
__CxxFrameHandler3
_CxxThrowException
memcmp
_recalloc
free
swprintf_s
strncpy
ldiv
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
strncmp
__RTDynamicCast
sprintf
strcmp
_stricmp
strlen
wcscpy
sscanf
atoi
wcslen
memset
memmove_s
wcsncpy
_strnicmp
atol
rand
srand
memcpy
_vswprintf_c_l
swscanf
wcscmp
_wcsicmp
_time64
strcpy
atof
?_query_new_handler@@YAP6AHI@ZXZ
_beginthreadex
?_query_new_mode@@YAHXZ
malloc
memcpy_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
_purecall

libexpat

ord35
ord21
ord63
ord16
ord48
ord2
ord52
ord20
ord12
ord25
ord50

shell32

SHAppBarMessage

gdiplus

GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipDrawImageRectI
GdipDrawImageRectRectI
GdipFree
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateFromHDC
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromGdiDib
GdipAlloc

Exports

Exports

XLI18N_ActiveLocation
XLI18N_GetActiveLocationID
XLI18N_GetLanguagePackage
XLI18N_GetRootDir
XLI18N_GetSupportLocationList
XLI18N_GetTextIDAssertMode
XLI18N_Init
XLI18N_IsSupportLocation
XLI18N_LoadText
XLI18N_LoadTextFromPackage
XLI18N_PreloadLanguagePackage
XLI18N_RegisterLocationChangeEvent
XLI18N_RegisterLuaClass
XLI18N_ReleaseLanguagePackage
XLI18N_RemoveLocationChangeEvent
XLI18N_SetTextIDAssertMode
XLI18N_UnloadLanguagePackage
XLUE_AddObjChild
XLUE_AddRefAnimation
XLUE_AddRefResRealHandle
XLUE_AddRefResource
XLUE_AddXARSearchPath
XLUE_AlphaChagneAniSetKeyAlpha
XLUE_AlphaChangAniBindRenderObj
XLUE_AngleChangeAniBindRenderObj
XLUE_AngleChangeAniSetKeyAngle
XLUE_AngleChangeAniSetKeyRange
XLUE_AniBindCurve
XLUE_AniBindCurveID
XLUE_AniGetCurve
XLUE_AniGetCurveID
XLUE_AsynLoadXAR
XLUE_B3DAniSetBlendMode
XLUE_B3DAniSetCentrePoint
XLUE_B3DAniSetCentrePointMode
XLUE_B3DAniSetDistanceDisp2Obs
XLUE_B3DAniSetPositionMode
XLUE_B3DAniSetSizeLimitMode
XLUE_B3DAniSetZPlane
XLUE_BeginEnumHostWnd
XLUE_BindUIObjectTree
XLUE_CanObjHandleInput
XLUE_CenterHostWnd
XLUE_CheckBitmap
XLUE_CheckBrush
XLUE_CheckColor
XLUE_CheckColor2
XLUE_CheckCurve
XLUE_CheckFont
XLUE_CheckImageList
XLUE_CheckImageSeq
XLUE_CheckMask
XLUE_CheckObject
XLUE_CheckObjectEx
XLUE_CheckPen
XLUE_CheckRes
XLUE_CheckResEx
XLUE_CheckTexture
XLUE_ClearAllXARSearchPath
XLUE_ClearLuaObj
XLUE_CreateAnimation
XLUE_CreateHostWnd
XLUE_CreateObj
XLUE_CreateObjTree
XLUE_DeleteHostWnd
XLUE_DestoryObj
XLUE_DestroyObjTree
XLUE_DoMessageLoopWork
XLUE_EnableObjInputTarget
XLUE_FireExtObjEvent
XLUE_GC
XLUE_GetAnimationClassName
XLUE_GetAnimationRunningTime
XLUE_GetAnimationState
XLUE_GetBindUIObjectTree
XLUE_GetBitmap
XLUE_GetBitmapFromProvider
XLUE_GetBrush
XLUE_GetBrushFromProvider
XLUE_GetColor
XLUE_GetColorFromProvider
XLUE_GetControlObject
XLUE_GetControlObjectEx
XLUE_GetCurve
XLUE_GetCurveFromProvider
XLUE_GetExtHandle
XLUE_GetFont
XLUE_GetFontFromProvider
XLUE_GetGlobalResProvider
XLUE_GetHostWndAppWindow
XLUE_GetHostWndByHandle
XLUE_GetHostWndByID
XLUE_GetHostWndCacheRect
XLUE_GetHostWndClassName
XLUE_GetHostWndCursorID
XLUE_GetHostWndEnable
XLUE_GetHostWndID
XLUE_GetHostWndLayered
XLUE_GetHostWndMaxTrackSize
XLUE_GetHostWndMinTrackSize
XLUE_GetHostWndParent
XLUE_GetHostWndRect
XLUE_GetHostWndTitle
XLUE_GetHostWndToolWindow
XLUE_GetHostWndTopMost
XLUE_GetHostWndVisible
XLUE_GetHostWndWindowHandle
XLUE_GetImageList
XLUE_GetImageListFromProvider
XLUE_GetImageObjBitmap
XLUE_GetImageObjResID
XLUE_GetImageSeq
XLUE_GetImageSeqFromProvider
XLUE_GetKeyAnimationTotalTime
XLUE_GetLayerObjClipSens
XLUE_GetLuaStack
XLUE_GetNextHostWnd
XLUE_GetObjAbsPos
XLUE_GetObjAbsZorder
XLUE_GetObjCaptureMouse
XLUE_GetObjCaretLimitRect
XLUE_GetObjChild
XLUE_GetObjChildByCmd
XLUE_GetObjChildByID
XLUE_GetObjChildCount
XLUE_GetObjChildrenEnable
XLUE_GetObjChildrenVisible
XLUE_GetObjClassName
XLUE_GetObjCursorID
XLUE_GetObjDropEnable
XLUE_GetObjEnable
XLUE_GetObjFather
XLUE_GetObjFatherEnable
XLUE_GetObjFatherVisible
XLUE_GetObjFocus
XLUE_GetObjFocusStrategy
XLUE_GetObjID
XLUE_GetObjInheritMask
XLUE_GetObjLimitRect
XLUE_GetObjMaskBlendType
XLUE_GetObjMaskPos
XLUE_GetObjOwner
XLUE_GetObjPos
XLUE_GetObjPrivateEnable
XLUE_GetObjPrivateVisible
XLUE_GetObjResProvider
XLUE_GetObjTabGroup
XLUE_GetObjTabOrder
XLUE_GetObjTabStop
XLUE_GetObjTree
XLUE_GetObjTreeBindHostWnd
XLUE_GetObjTreeCaptureMouseObj
XLUE_GetObjTreeFocusObj
XLUE_GetObjTreeID
XLUE_GetObjTreeObjectCount
XLUE_GetObjTreeRootObj
XLUE_GetObjVisible
XLUE_GetObjZorder
XLUE_GetOwnerControl
XLUE_GetPen
XLUE_GetPenFromProvider
XLUE_GetRealObjHostWindow
XLUE_GetRealObjWindow
XLUE_GetRenderObjAlpha
XLUE_GetRes
XLUE_GetResExtHandle
XLUE_GetResFromProvider
XLUE_GetResID
XLUE_GetResProviderFromXAR
XLUE_GetResRealHandle
XLUE_GetResType
XLUE_GetTexture
XLUE_GetTextureFromProvider
XLUE_GetUIObject
XLUE_GetUpdateFPS
XLUE_GetWindowBitmap
XLUE_HitTest
XLUE_HostWndCreateWnd
XLUE_HostWndDestroyWnd
XLUE_HostWndDoModal
XLUE_HostWndEndDialog
XLUE_HostWndPtToScreenPt
XLUE_HostWndPtToTreePt
XLUE_HostWndRectToScreenRect
XLUE_HostWndRectToTreeRect
XLUE_Init
XLUE_InitLoader
XLUE_InitLuaHost
XLUE_IsAnimationValid
XLUE_IsChild
XLUE_IsControl
XLUE_IsHostWndValid
XLUE_IsObjLimit
XLUE_IsObjLimitChild
XLUE_IsObjTreeValid
XLUE_IsObjValid
XLUE_IsResProviderValid
XLUE_IsXARInAsynLoading
XLUE_IsXARLoaded
XLUE_KillTimer
XLUE_LoadXAR
XLUE_LoadXLUEApp
XLUE_MaskChangeAniBindMaskObj
XLUE_MaskChangeAniGetBindMaskObj
XLUE_MaskChangeAniSetMaskKeyFrame
XLUE_MaxHostWnd
XLUE_MinHostWnd
XLUE_MoveHostWnd
XLUE_ObjBindLayer
XLUE_ObjGetLayer
XLUE_ObjHitTest
XLUE_ObjPaint
XLUE_ObjProcessInput
XLUE_ObjPushDirtyRect
XLUE_ObjRouteToFather
XLUE_ObjSetDefaultRediretorByEvent
XLUE_ObjSetRediretorByEvent
XLUE_PosChangAniBindLayoutObj
XLUE_PosChangeAniSetKeyPos
XLUE_PosChangeAniSetKeyRect
XLUE_PreRegisterExtType
XLUE_PushBitmap
XLUE_PushBrush
XLUE_PushColor
XLUE_PushColor2
XLUE_PushCurve
XLUE_PushFont
XLUE_PushImageList
XLUE_PushImageSeq
XLUE_PushMask
XLUE_PushObjTreeDirtyRect
XLUE_PushObject
XLUE_PushPen
XLUE_PushRes
XLUE_PushTexture
XLUE_QueryObjFocus
XLUE_QueryTimer
XLUE_RegisterAnimation
XLUE_RegisterExtObj
XLUE_RegisterExtRes
XLUE_RegisterHostWnd
XLUE_RegisterMessageLoopListener
XLUE_RegisterResource
XLUE_RegisterStandardObjects
XLUE_ReleaseAnimation
XLUE_ReleaseResRealHandle
XLUE_ReleaseResource
XLUE_RemoveGlobalHook
XLUE_RemoveObjAllChildren
XLUE_RemoveObjChild
XLUE_RemoveXARSearchPath
XLUE_RenderObject
XLUE_RenderTree
XLUE_ResProviderAttachResEvent
XLUE_ResProviderDetachResEvent
XLUE_RestoreHostWnd
XLUE_ResumeAnimation
XLUE_ScreenPtToHostWndPt
XLUE_ScreenRectToHostWndRect
XLUE_SelectResPackage
XLUE_SetDS
XLUE_SetGlobalHook
XLUE_SetHostWndAppWindow
XLUE_SetHostWndCacheRect
XLUE_SetHostWndCursorID
XLUE_SetHostWndEnable
XLUE_SetHostWndLayered
XLUE_SetHostWndMaxTrackSize
XLUE_SetHostWndMinTrackSize
XLUE_SetHostWndParent
XLUE_SetHostWndTitle
XLUE_SetHostWndToolWindow
XLUE_SetHostWndTopMost
XLUE_SetHostWndVisible
XLUE_SetIDTimer
XLUE_SetImageObjBitmap
XLUE_SetImageObjResID
XLUE_SetKeyAnimationBindObj
XLUE_SetKeyAnimationForceStop
XLUE_SetKeyAnimationLoop
XLUE_SetKeyAnimationTotalTime
XLUE_SetLayerObjClipSens
XLUE_SetLoadStrategy
XLUE_SetObjCaptureMouse
XLUE_SetObjChildrenEnable
XLUE_SetObjChildrenVisible
XLUE_SetObjCursorID
XLUE_SetObjDropEnable
XLUE_SetObjEnable
XLUE_SetObjEnableEx
XLUE_SetObjFocus
XLUE_SetObjFocusEx
XLUE_SetObjFocusStrategy
XLUE_SetObjID
XLUE_SetObjInheritMask
XLUE_SetObjLimit
XLUE_SetObjLimitChild
XLUE_SetObjMaskBlendType
XLUE_SetObjMaskPos
XLUE_SetObjMaskPosExp
XLUE_SetObjMaskPosExp2
XLUE_SetObjPos
XLUE_SetObjPosExp
XLUE_SetObjPosExp2
XLUE_SetObjResProvider
XLUE_SetObjTabGroup
XLUE_SetObjTabOrder
XLUE_SetObjTabStop
XLUE_SetObjTreeRootObj
XLUE_SetObjVisible
XLUE_SetObjZorder
XLUE_SetOnceIDTimer
XLUE_SetOnceTimer
XLUE_SetRealObjWindow
XLUE_SetRenderObjAlpha
XLUE_SetRenderObjAlphaEx
XLUE_SetTextObjectDefaultTextType
XLUE_SetTimer
XLUE_SetTreeMaxClosure
XLUE_SetUpdateFPS
XLUE_ShowHostWnd
XLUE_Stat
XLUE_StopAnimation
XLUE_TreePtToHostWndPt
XLUE_TreeRectToHostWndRect
XLUE_TurnObjectAniBindBackObj
XLUE_TurnObjectAniBindFrontObj
XLUE_TurnObjectAniBindRenderObj
XLUE_TurnObjectAniSetFlag
XLUE_UnbindUIObjectTree
XLUE_Uninit
XLUE_UninitHandleMap
XLUE_UninitLoader
XLUE_UninitLuaHost
XLUE_UnloadAllXAR
XLUE_UnregisterMessageLoopListener
XLUE_UpdateAnimationRunningTime
XLUE_VerifyXAR
XLUE_VerifyXAR2
XLUE_XARExist
XLUE_XML_BeginGetAttribute
XLUE_XML_Free
XLUE_XML_GetChildByIndex
XLUE_XML_GetChildCount
XLUE_XML_GetName
XLUE_XML_GetNextAttribute
XLUE_XML_GetValue

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 401KB - Virtual size: 400KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 182KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uestat
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.uestr
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5391d09a4e33e49d693dc1a99f9d0468

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

75:06:b5:d2:91:7a:13:5c:04:e2:29:ee:21:44:9a:8dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

45:98:a2:8d:fd:dc:bc:31:de:d0:f2:98:07:c5:a7:43Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18Certificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

39:87:f6:49:a7:06:8e:32:37:b9:e2:ce:e7:33:f0:3c:a6:0c:84:ab:28:04:a6:e8:89:89:52:de:35:dc:79:b8Signer

70:57:e7:0e:44:b3:a7:3d:ad:a7:7e:da:bd:c1:3a:cb:53:a4:5d:c3Signer

Headers

File Characteristics

PDB Paths

Imports

xlgraphic

xlluaruntime

imm32

xlfsio

kernel32

user32

gdi32

advapi32

ole32

oleaut32

atl90

shlwapi

msvcp90

msvcr90

libexpat

shell32

gdiplus

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

.rdata Size: 401KB - Virtual size: 400KB

.data Size: 182KB - Virtual size: 196KB

.uestat Size: 512B - Virtual size: 268B

.uestr Size: 2KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 144KB - Virtual size: 143KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

75:06:b5:d2:91:7a:13:5c:04:e2:29:ee:21:44:9a:8d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

45:98:a2:8d:fd:dc:bc:31:de:d0:f2:98:07:c5:a7:43
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

55:45:ca:02:24:61:90:d9:79:ee:b4:0d:b9:ff:bc:18
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

39:87:f6:49:a7:06:8e:32:37:b9:e2:ce:e7:33:f0:3c:a6:0c:84:ab:28:04:a6:e8:89:89:52:de:35:dc:79:b8
Signer

70:57:e7:0e:44:b3:a7:3d:ad:a7:7e:da:bd:c1:3a:cb:53:a4:5d:c3
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 401KB - Virtual size: 400KB

.data
Size: 182KB - Virtual size: 196KB

.uestat
Size: 512B - Virtual size: 268B

.uestr
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 144KB - Virtual size: 143KB