404f4911de8252e489f9178e1f9e7bea_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

404f4911de8252e489f9178e1f9e7bea_JaffaCakes118
Size

775KB
MD5

404f4911de8252e489f9178e1f9e7bea
SHA1

a1638c567fdf04d51c91f7efa34452f864aff9c2
SHA256

f7947b438322583ec92d00b0596baa2444b8cf7fe7b0e54f32dcf6c4c0fa97a8
SHA512

585c18a2f813dca9a6d556926c39bbbae19ee9a1c42a68d8486d400a282afc0476178eaaeaeda9a83e55792433786da5456f8bbaba69b61f64c0d3901fe4cac1
SSDEEP

12288:vuhrtJSLRGhCRuyyGGXEKGqYqyjLwgplxjLmYV7jQ:vuhrtJSecuyyZ0qowgpLj7s

Score

1^/10

Malware Config

Signatures

Files

404f4911de8252e489f9178e1f9e7bea_JaffaCakes118
.dll regsvr32 windows:4 windows x86 arch:x86

c442c3a8d6ca55a3f4016523336d9743

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

04/02/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

28/01/2016, 00:00

Not After

28/03/2019, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=研发管理部,O=Tencent Technology(Shenzhen) Company Limited,L=Shenzhen,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:e1:2e:9d:2e:9a:33:cb:8e:5c:c6:9d:82:c4:19:6a:09:62:9b:83:61:d0:55:e2:8a:40:ad:07:1c:62:03:e1
Signer

Actual PE Digest

f1:e1:2e:9d:2e:9a:33:cb:8e:5c:c6:9d:82:c4:19:6a:09:62:9b:83:61:d0:55:e2:8a:40:ad:07:1c:62:03:e1

Digest Algorithm

sha256

PE Digest Matches

true

63:45:db:41:dd:dd:0e:a3:c8:67:18:88:12:ff:a6:15:7e:12:08:fa
Signer

Actual PE Digest

63:45:db:41:dd:dd:0e:a3:c8:67:18:88:12:ff:a6:15:7e:12:08:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

f:\QQLive_Dailybuild\src\symbol\MediaCtrl.pdb

Imports

common

?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?ConvertToPureFile@FS@@YA?AVCTXStringW@@PB_W@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
??M@YA_NABVCTXStringA@@0@Z
??0CTXStringA@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringW@@QAE@UtagEN@@PBDH@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??7CTXStringW@@QBE_NXZ
??0CTXBSTR@@QAE@PB_W@Z
?IsEmpty@CTXBSTR@@QAEHXZ
??ICTXBSTR@@QAEPAPA_WXZ
??BCTXBSTR@@QBEPA_WXZ
??1CTXBSTR@@QAE@XZ
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??1CTXStringW@@QAE@XZ
??BCTXStringW@@QBEPB_WXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??0CTXStringW@@QAE@PB_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?TXAssert@@YAHPB_W0H@Z
??1CTXStringA@@QAE@XZ

gf

?FreeData@Metadata@Util@@YAJAAPA_W@Z
?ScreenPoint2ClientPoint@GF@Util@@YAXPAUIGFFrame@@AAUtagPOINT@@@Z
?AdviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@PAUITXWebBrowserEvents@@PAPAUIUnknown@@AAK@Z
?DispatchFrameMsg@GF@Util@@YAJPAUIGFFrame@@PAUtagBaseArg@@PAHPAJH@Z
?UnadviseWebBrowser@IEEvent@Util@@YAHPAUIWebBrowser2@@K@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?Get@Metadata@Util@@YAJPAUITXData@@PA_WPAPA_W@Z
?GetBOOL@Metadata@Util@@YAJPAUITXData@@PA_WPAH@Z
?Get@Metadata@Util@@YAJPAUITXData@@PA_WPAH@Z

ximage

?Destroy@CxImage@@QAE_NXZ
?GetWidth@CxImage@@QBEKXZ
?Load@CxImage@@QAE_NPB_WK@Z
??0CxImage@@QAE@K@Z
?GetHeight@CxImage@@QBEKXZ
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z

tinyxml

??1TiXmlDocument@@UAE@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
??0TiXmlDocument@@QAE@XZ
?LoadXML@TiXmlDocument@@QAE_NPADHW4TiXmlEncoding@@@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z

kernel32

WaitForSingleObject
GetDriveTypeW
FindClose
FindFirstFileW
DeviceIoControl
CreateFileW
SetFileAttributesW
CreateDirectoryW
DeleteFileW
GetTickCount
MoveFileW
GetDiskFreeSpaceExW
GetLogicalDrives
CreateProcessW
GetExitCodeProcess
WriteFile
SetFilePointer
GetLocaleInfoA
GetProcAddress
FreeLibrary
SetThreadLocale
GetThreadLocale
VirtualAlloc
VirtualFree
HeapSize
HeapReAlloc
HeapAlloc
HeapDestroy
GetVersionExA
GetVersionExW
LoadLibraryW
lstrlenA
MultiByteToWideChar
VirtualQuery
GetPrivateProfileIntW
WideCharToMultiByte
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
Sleep
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetFileAttributesW
GetModuleHandleW
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
lstrcmpiW
GetLastError
DeleteCriticalSection
RaiseException
InitializeCriticalSection
CloseHandle
GetModuleFileNameW
lstrlenW
InterlockedDecrement
InterlockedIncrement
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
InterlockedExchange
GetACP

user32

IsWindow
GetWindowLongW
SetWindowPos
CreateWindowExW
DestroyWindow
SetWindowTextW
DefWindowProcW
CallWindowProcW
CharNextW
TrackMouseEvent
GetFocus
IsZoomed
IsWindowVisible
IsIconic
SystemParametersInfoW
GetDesktopWindow
CopyRect
PtInRect
IsRectEmpty
UpdateWindow
SendMessageTimeoutW
SetTimer
KillTimer
IsWindowEnabled
ShowCursor
ReleaseDC
GetDC
GetCursorPos
GetSystemMetrics
GetKeyNameTextW
MapVirtualKeyW
SetFocus
SetCursor
BringWindowToTop
PostMessageW
RegisterWindowMessageW
IntersectRect
EqualRect
FindWindowW
MessageBoxW
UnregisterClassA
FindWindowExW
SetRectEmpty
OffsetRect
LoadCursorW
RegisterClassExW
MoveWindow
GetWindowRect
SetWindowLongW
ShowWindow
SendMessageW

gdi32

RestoreDC
ExtSelectClipRgn
CreateRectRgnIndirect
GetWindowOrgEx
GetViewportOrgEx
SaveDC
GetDIBits
GetObjectW
DeleteDC
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
DeleteObject

comdlg32

GetOpenFileNameW

advapi32

RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
ShellExecuteExW
SHGetFileInfoW
SHGetPathFromIDListW

ole32

CoCreateInstance
CoTaskMemFree
StringFromCLSID
StringFromIID

oleaut32

SysFreeString
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysAllocString
VariantInit
VariantClear
VariantCopy
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
VarUI4FromStr
VarBstrCmp
SysAllocStringLen

livelog

?GetCommuInst@@YAJPAPAUIQQLiveCommand@@_K@Z
?GetFullScreenRect@@YA?AUtagRECT@@PAUHWND__@@@Z
?GetVFormatBandwidth@@YAJJ@Z
?SetFavouriteVFormat@@YAXK@Z
?GetQQLivePlayerDlgHwnd@@YAPAUHWND__@@XZ
?GetFullKeyCode@@YAKIJ@Z
?BitsToHexString2@@YA?AVCComBSTR@ATL@@PBEH@Z
?GetConfigDword@@YAKV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0KW4tagQQLIVE_CONFIG_TYPE@@@Z
?HexStringToBits@@YA_NPBDPAEAAH@Z
?URLDecodeUTF8@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@2@@Z
?QQ_OpenURLUsingIEW@@YAJPB_W@Z
?GetQQLiveDlgHwnd@@YAPAUHWND__@@XZ
?QQ_GetServerGuid@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?QQ_GetStaisicBasicInfo@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?QQ_GetVideoStoreTab@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?QQ_CheckURLIsInWhiteList@@YAHV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetWindowWorkArea@@YA?AUtagRECT@@PAUHWND__@@@Z
?GetOnLine@@YAHXZ
?GetLiveServerUrl@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PB_W@Z
?LogToFile@@YAXPB_WZZ
?IsDoLog@@YAHXZ
?WriteConfigDword@@YAXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0KW4tagQQLIVE_CONFIG_TYPE@@@Z
?FormUrlEncode@@YAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABI@Z
?UrlDecode@@YAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0@Z
?WriteConfigInt@@YAXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0JW4tagQQLIVE_CONFIG_TYPE@@@Z
?QQ_GetProtocolVersion@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?Utf8ToWS@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z
?Utf8FromWS@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@PB_WH@Z
?GetVFormatChineseName@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@J@Z
?GetFolderByPath@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABV12@@Z
?GetLiveVFSimpleName@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V12@@Z
?Set_curPageContinusPlayNum@@YAXH@Z
?SetFavouriteLiveFormat@@YAXPB_W@Z
?GetClientOsVersion@@YAEXZ
?GetMac@@YAXAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AsynOpenSSO@@YAXPB_W@Z
?FormUrlEncode@@YAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?QQ_GetProtocolVersionNumber@@YAJXZ
?IsNumber@@YAHPB_W@Z
?GetVFormatEnglishName@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@J@Z
?GetDeviceGuidStr@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetOSVersion@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?QQ_GetVersionDescription@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?Utf8ToWS@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBDH@Z
?GetExeFolder@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?GetUserGuid@@YAXPADAAH@Z
?IsWindowsVista@@YAHXZ
?GetNoRealStatInst@@YAJPAPAUINoRealStat@@_K@Z
?RemoveMMGFWindow@@YAXPAUHWND__@@@Z
?AddMMGFWindow@@YAXPAUHWND__@@PAUIUnknown@@@Z
?GetMMGFWindow@@YAHPAUHWND__@@PAPAUIUnknown@@@Z
?GetKeyValue@@YAHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0AAV12@_W@Z
?NavigateURL@@YAHPB_WH@Z
?GetQQLiveDaemonWnd@@YAPAUHWND__@@XZ
?CheckAdvise@@YAXPB_W@Z
?GetChannelMgrInst@@YAJPAPAUIChannelSMgr@@_K@Z
?CheckUnadvise@@YAXPB_W@Z
?CheckFileExist@@YAHPB_W@Z
?FileCoCreateInstance@@YAJPB_WABU_GUID@@PAUIUnknown@@K1PAPAXPAUHINSTANCE__@@@Z
?OpenQQLive@@YAHPB_W@Z
?GetConfigInt@@YAJV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@0JW4tagQQLIVE_CONFIG_TYPE@@@Z
?GetConfigString@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V12@00W4tagQQLIVE_CONFIG_TYPE@@@Z
?CheckDirectoryExist@@YAHPB_W@Z
?CreateAllDirectory@@YAHPB_W@Z
?GetAppDataPath@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?WriteConfigString@@YAXV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@00W4tagQQLIVE_CONFIG_TYPE@@@Z

atl80

ord11
ord10
ord42
ord31
ord58
ord30
ord48
ord23
ord61
ord15
ord18
ord22
ord64
ord32

shlwapi

PathRemoveFileSpecW
PathAppendW

msvcp80

?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?length@?$char_traits@D@std@@SAIPBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?length@?$char_traits@_W@std@@SAIPB_W@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?eof@?$char_traits@_W@std@@SAGXZ
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z

logmanager

QQLogOutToFileW

msvcr80

wcschr
wcsncpy_s
wcscpy_s
malloc
memcpy
wcstoul
memcmp
free
_recalloc
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_purecall
memmove_s
__CxxFrameHandler3
??0exception@std@@QAE@XZ
abs
calloc
wcscpy
wcsstr
_itow_s
ldiv
_byteswap_ulong
rand
fclose
fwrite
_wfopen_s
wcscat_s
strlen
srand
_wcsicmp
wcsrchr
_wcslwr_s
strtol
acos
sqrt
labs
fabs
_resetstkoflw
atoi
wcstol
sprintf_s
sscanf
strcmp
modf
strpbrk
?terminate@@YAXXZ
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
??3@YAXPAX@Z
memcpy_s
_CxxThrowException
_invalid_parameter_noinfo
wcscmp
_vscwprintf
vswprintf_s
wcslen
memset
swprintf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
_wtoi
??1exception@std@@UAE@XZ

xgraphic32

SetTextureMode
GetTextureSize
CreateCanvas
SetCanvasFilter
CanvasToTexture
GetCanvasHandle

httpmodule

??0CDownloadMgrProxy@@QAE@XZ
?RemoveTask@CDownloadMgrProxy@@QAEHH@Z
?StartTask@CDownloadMgrProxy@@QAEHH@Z
?AddTask@CDownloadMgrProxy@@QAEHPAUIHttpEventWndCallback@@PB_W1IK@Z
?AddHttpHeader@CDownloadMgrProxy@@QAEHHABV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
??1CDownloadMgrProxy@@UAE@XZ

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 348KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 280KB - Virtual size: 277KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c442c3a8d6ca55a3f4016523336d9743

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5aCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77Certificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

f1:e1:2e:9d:2e:9a:33:cb:8e:5c:c6:9d:82:c4:19:6a:09:62:9b:83:61:d0:55:e2:8a:40:ad:07:1c:62:03:e1Signer

63:45:db:41:dd:dd:0e:a3:c8:67:18:88:12:ff:a6:15:7e:12:08:faSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

common

gf

ximage

tinyxml

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

livelog

atl80

shlwapi

msvcp80

logmanager

msvcr80

xgraphic32

httpmodule

Exports

Exports

Sections

.text Size: 348KB - Virtual size: 344KB

.rdata Size: 280KB - Virtual size: 277KB

.data Size: 36KB - Virtual size: 34KB

.rsrc Size: 16KB - Virtual size: 15KB

.reloc Size: 76KB - Virtual size: 72KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

52:04:8b:9c:8a:67:e2:8f:0c:c8:cc:75:81:3d:dc:5a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

0b:d5:15:37:03:d8:d5:f8:1f:ef:76:19:69:00:9a:14
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

f1:e1:2e:9d:2e:9a:33:cb:8e:5c:c6:9d:82:c4:19:6a:09:62:9b:83:61:d0:55:e2:8a:40:ad:07:1c:62:03:e1
Signer

63:45:db:41:dd:dd:0e:a3:c8:67:18:88:12:ff:a6:15:7e:12:08:fa
Signer

.text
Size: 348KB - Virtual size: 344KB

.rdata
Size: 280KB - Virtual size: 277KB

.data
Size: 36KB - Virtual size: 34KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 76KB - Virtual size: 72KB