47128e8609aaea6e657dd50fcccd9840_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

47128e8609aaea6e657dd50fcccd9840_JaffaCakes118
Size

9.8MB
MD5

47128e8609aaea6e657dd50fcccd9840
SHA1

088aa4597edab92bbd8895c3abbf2f2db6dbc166
SHA256

a36f0848d8969f0bd7b5ed3fc6467f0c615fb0fcb0a15c13476b7fae6d63634e
SHA512

3519d2e2a6e58974ecf25145a13fd3c620e2cf0d69353932349fe60fb4735668a579c1164601091c05c7f8d132a3845e78ea93df9c41db3e8849e5d4ca12427c
SSDEEP

196608:LyDg0POtXFr+Ioi7E9kCeaQDZLFsBO9fwzj6xUDTizdv7MaErDOS1/mVo:Ly1Or+FSE9k1z4oSzmxfdvIaErDOMeVo

Score

7^/10

pdf link upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/12-Ip-Mask/ip_mask.exe	upx
static1/unpack001/23-Log-Systems/logsys.exe	upx

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/12-Ip-Mask/ip_mask.exe
unpack002/out.upx
unpack003/exe/DiffPlex.dll
unpack003/exe/Hecsit.Matcher.Core.dll
unpack003/exe/Hecsit.Matcher.exe
unpack001/14-Editor/Наймушин/editor14/exe/DiffPlex.dll
unpack001/14-Editor/Наймушин/editor14/exe/Hecsit.Matcher.Core.dll
unpack001/14-Editor/Наймушин/editor14/exe/Hecsit.Matcher.exe
unpack001/22-dynprog/calcdyn.exe
unpack001/23-Log-Systems/logsys.exe
unpack004/out.upx

Files

47128e8609aaea6e657dd50fcccd9840_JaffaCakes118
.rar
12-Ip-Mask/ip_mask.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 228KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 114KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/editor14.zip
.zip
examples/example127.txt
examples/example128.txt
examples/example129.txt
examples/example130.txt
examples/example131.txt
examples/example132.txt
examples/example133.txt
exe/DiffPlex.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Users\andarno\git\diffplex\DiffPlex\obj\Release\DiffPlex.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
exe/Hecsit.Matcher.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\DAT\PROJECTS\BMSTU\Hecsit.Matcher\Hecsit.Matcher.Core\obj\Debug\Hecsit.Matcher.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
exe/Hecsit.Matcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\DAT\PROJECTS\BMSTU\Hecsit.Matcher\Hecsit.Matcher\obj\Debug\Hecsit.Matcher.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
exe/Hecsit.Matcher.exe.config
.xml
exe/System.Net.Http.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Signer

Actual PE Digest

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Dev\WebStack\External\System.Net.Http\obj\Release\System.Net.Http.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
exe/ru/System.Net.Http.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:00:2d:4c:fa:d1:27:15:e3:07:5d:50:f9:a5:1d:99:9c:d4:98:e0
Signer

Actual PE Digest

5a:00:2d:4c:fa:d1:27:15:e3:07:5d:50:f9:a5:1d:99:9c:d4:98:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
___#.doc
.doc windows office2003
14-Editor/Наймушин/editor14/examples/example127.txt
14-Editor/Наймушин/editor14/examples/example128.txt
14-Editor/Наймушин/editor14/examples/example129.txt
14-Editor/Наймушин/editor14/examples/example130.txt
14-Editor/Наймушин/editor14/examples/example131.txt
14-Editor/Наймушин/editor14/examples/example132.txt
14-Editor/Наймушин/editor14/examples/example133.txt
14-Editor/Наймушин/editor14/exe/DiffPlex.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Users\andarno\git\diffplex\DiffPlex\obj\Release\DiffPlex.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 848B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/exe/Hecsit.Matcher.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\DAT\PROJECTS\BMSTU\Hecsit.Matcher\Hecsit.Matcher.Core\obj\Debug\Hecsit.Matcher.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/exe/Hecsit.Matcher.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\DAT\PROJECTS\BMSTU\Hecsit.Matcher\Hecsit.Matcher\obj\Debug\Hecsit.Matcher.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/exe/Hecsit.Matcher.exe.config
.xml
14-Editor/Наймушин/editor14/exe/System.Net.Http.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Signer

Actual PE Digest

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Dev\WebStack\External\System.Net.Http\obj\Release\System.Net.Http.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/exe/ru/System.Net.Http.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:02:92:4a:00:00:00:00:00:20
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:00:2d:4c:fa:d1:27:15:e3:07:5d:50:f9:a5:1d:99:9c:d4:98:e0
Signer

Actual PE Digest

5a:00:2d:4c:fa:d1:27:15:e3:07:5d:50:f9:a5:1d:99:9c:d4:98:e0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 936B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14-Editor/Наймушин/editor14/Рук_Польз_Редактор_С#.doc
.doc windows office2003
17-Euler/solver17.htm
.html .js polyglot
18-Intervals/a10solve.py
22-dynprog/calcdyn.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 213KB - Virtual size: 213KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
23-HTML_solver/solver23.htm
.html .js polyglot
23-Log-Systems/logsys.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 176KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 96KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
23vishn.doc
.doc windows office2003
25(C2)-C-C++/c2_c.zip
.zip
C1_1C.c
C2_11C.c
C2_12C.c
C2_13C.c
C2_14C.c
C2_15C.c
C2_16C.c
C2_17C.c
C2_18C.c
C2_19C.c
C2_20C.c
C2_21C.c
C2_22C.c
C2_23C.c
C2_24C.c
C2_25C.c
C2_26C.c
C2_27C.c
C2_28C.c
C2_29C.c
C2_2C.c
C2_30C.c
C2_31C.c
C2_32C.c
C2_33C.c
C2_34C.c
C2_35C.c
C2_36C.c
C2_37C.c
C2_38C.c
C2_39C.c
C2_3C.c
C2_40C.c
C2_41C.c
C2_42C.c
C2_44C.c
C2_45C.c
C2_46C.c
C2_4C.c
C2_5C.c
C2_6C.c
C2_7C.c
C2_8C.c
C2_9C.c
25(C2)-C-C++/c2_cpp.zip
.zip
C2_10.cpp
C2_13.cpp
C2_14.cpp
C2_15.cpp
C2_16.cpp
C2_17.cpp
C2_19.cpp
C2_2.cpp
C2_20.cpp
C2_23.cpp
C2_24.cpp
C2_25.cpp
C2_27.cpp
C2_28.cpp
C2_3.cpp
C2_30.cpp
C2_31.cpp
C2_32.cpp
C2_33.cpp
C2_35.cpp
C2_36.cpp
C2_4.cpp
C2_5.cpp
C2_6.cpp
C2_7.cpp
C2_8.cpp
C2_9.cpp
26-Stones/stonesC3-2.py
26-Stones/stonesC3-2016.py
26-Stones/stonesC3-2016_real.py
26-Stones/stonesC3-2a.py
26-Stones/stonesC3.py
26-solver/solver26.htm
.html .js polyglot
27(C4)-C#/c4_sharp.zip
.zip
c4_10.cs
c4_11.cs
c4_12.cs
c4_14.cs
c4_16.cs
c4_19.cs
c4_20.cs
c4_23.cs
c4_8.cs
c4_9.cs
4_15.cs
4_22.cs
4_5.cs
27(C4)-Python/c4_python.zip
.zip
0-1.py
0-2.py
1.py
10.py
100.py
101.py
102.py
103.py
104.py
105.py
106.py
107.py
108.py
109.py
11.py
110.py
111.py
112.py
113.py
114.py
12.py
13.py
14.py
15.py
16.py
17.py
18.py
19.py
2.py
20.py
21.py
22.py
23.py
24.py
25.py
26.py
27.py
28.py
29.py
3.py
30.py
31.py
32.py
33.py
34.py
35.py
36.py
37.py
38.py
39.py
4.py
40.py
41.py
42.py
43.py
44.py
45.py
46.py
47.py
48.py
49.py
5.py
50.py
51.py
52.py
53.py
54.py
55.py
56.py
57.py
58.py
59.py
6.py
60.py
61.py
62.py
63.py
64.py
65.py
66.py
67.py
68.py
69.py
69a.py
7.py
70.py
71.py
72.py
73.py
74-2.py
74.py
75.py
76.py
77.py
78.py
79.py
8.py
80.py
81.py
82.py
83.py
84.py
85.py
86.py
87.py
88.py
89.py
9.py
90.py
91.py
92.py
93.py
94.py
95.py
96.py
97.py
98.py
99.py
demo-2014.py
demo-2014a.py
in/0-1.in
in/0-2.in
in/1.in
in/10.in
in/100.in
in/101.in
in/102.in
in/103.in
in/104.in
in/105.in
in/106.in
in/107.in
in/108.in
in/109.in
in/11.in
in/110.in
in/111.in
in/112.in
in/113.in
in/114.in
in/12.in
in/13.in
in/14.in
in/15.in
in/16.in
in/17.in
in/18.in
in/19.in
in/2.in
in/20.in
in/21.in
in/22.in
in/23.in
in/24.in
in/25.in
in/26.in
in/27.in
in/28.in
in/29.in
in/3.in
in/30.in
in/31.in
in/32.in
in/33.in
in/34.in
in/35.in
in/36.in
in/37.in
in/38.in
in/39.in
in/4.in
in/40.in
in/41.in
in/42.in
in/43.in
in/44.in
in/45.in
in/46.in
in/47.in
in/48.in
in/49.in
in/5.in
in/50.in
in/51.in
in/52.in
in/53.in
in/54.in
in/55.in
in/56.in
in/57.in
in/58.in
in/59.in
in/6.in
in/60.in
in/61.in
in/63.in
in/64.in
in/65.in
in/66.in
in/67.in
in/68.in
in/69.in
in/7.in
in/70.in
in/71.in
in/72.in
in/73.in
in/74.in
in/75.in
in/76.in
in/77.in
in/78.in
in/79.in
in/8.in
in/80.in
in/81.in
in/82.in
in/83.in
in/84.in
in/85.in
in/86.in
in/87.in
in/88.in
in/89.in
in/9.in
in/90.in
in/91.in
in/92.in
in/93.in
in/94.in
in/95.in
in/96.in
in/97.in
in/98.in
in/99.in
in/demo-2014.in
in/genc4-1.py
answ24-C1.doc
.doc windows office2003
answ25-C2.doc
.doc windows office2003
answ26-C3.doc
.doc windows office2003
answ27-C4.doc
.doc windows office2003
answers.xls
.xls windows office2003
bitwise2.pdf
.pdf
- http://kpolyakov.spb.ru/download/bitwise.pdf]
ege1.doc
.doc windows office2003
ege10.doc
.doc windows office2003
ege11.doc
.doc windows office2003
ege11c.doc
.doc windows office2003
ege11cpp.doc
.doc windows office2003
ege11py.doc
.doc windows office2003
ege12.doc
.doc windows office2003
ege13.doc
.doc windows office2003
ege14.doc
.doc windows office2003
ege15.doc
.doc windows office2003
ege16.doc
.doc windows office2003
ege17.doc
.doc windows office2003
ege18.doc
.doc windows office2003
ege19.doc
.doc windows office2003
ege19py.doc
.doc windows office2003
ege2.doc
.doc windows office2003
ege20.doc
.doc windows office2003
ege20cpp.doc
.doc windows office2003
ege20py.doc
.doc windows office2003
ege21c.doc
.doc windows office2003
ege21cpp.doc
.doc windows office2003
ege21py.doc
.doc windows office2003
ege22.doc
.doc windows office2003
ege23.doc
.doc windows office2003
ege24-C1.doc
.doc windows office2003
ege24c.doc
.doc windows office2003
ege25-C2.doc
.doc windows office2003
ege25-C2py.doc
.doc windows office2003
ege26-C3.doc
.doc windows office2003
ege27-C4.doc
.doc windows office2003
ege3.doc
.doc windows office2003
ege4-1.doc
.doc windows office2003
ege4-2.doc
.doc windows office2003
ege5.doc
.doc windows office2003
ege6-1.doc
.doc windows office2003
ege6-2.doc
.doc windows office2003
ege7-1.doc
.doc windows office2003
ege7-2.doc
.doc windows office2003
ege8.doc
.doc windows office2003
ege8c.doc
.doc windows office2003
ege8cpp.doc
.doc windows office2003
ege8py.doc
.doc windows office2003
ege9-1.doc
.doc windows office2003
ege9-2.doc
.doc windows office2003
ege9-v.doc
.doc windows office2003
k7data.zip
.zip
k8data.zip
.zip
kanswers.xls
.xls windows office2003
kege1.doc
.doc windows office2003
kege10.doc
.doc windows office2003
kege11.doc
.doc windows office2003
kege2.doc
.doc windows office2003
kege3.doc
.doc windows office2003
kege4.doc
.doc windows office2003
kege5.doc
.doc windows office2003
kege6.doc
.doc windows office2003
kege7.doc
.doc windows office2003
kege8.doc
.doc windows office2003
kege9.doc
.doc windows office2003

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 228KB

UPX1 Size: 114KB - Virtual size: 116KB

.rsrc Size: 7KB - Virtual size: 8KB

Headers

File Characteristics

Sections

CODE Size: 212KB - Virtual size: 211KB

DATA Size: 3KB - Virtual size: 2KB

BSS Size: - Virtual size: 1KB

.idata Size: 7KB - Virtual size: 7KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 15KB - Virtual size: 15KB

.rsrc Size: 77KB - Virtual size: 77KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 15KB - Virtual size: 15KB

.rsrc Size: 1024B - Virtual size: 848B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 21KB - Virtual size: 21KB

.rsrc Size: 1024B - Virtual size: 996B

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 189KB - Virtual size: 189KB

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:02:92:4a:00:00:00:00:00:20Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 168KB - Virtual size: 167KB

.rsrc Size: 1024B - Virtual size: 896B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

UPX0
Size: - Virtual size: 228KB

UPX1
Size: 114KB - Virtual size: 116KB

.rsrc
Size: 7KB - Virtual size: 8KB

CODE
Size: 212KB - Virtual size: 211KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 7KB - Virtual size: 7KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 77KB - Virtual size: 77KB

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1024B - Virtual size: 996B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 189KB - Virtual size: 189KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 512B - Virtual size: 12B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Signer

.text
Size: 168KB - Virtual size: 167KB

.rsrc
Size: 1024B - Virtual size: 896B

.reloc
Size: 512B - Virtual size: 12B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

5a:00:2d:4c:fa:d1:27:15:e3:07:5d:50:f9:a5:1d:99:9c:d4:98:e0
Signer

.text
Size: 11KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 936B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 1024B - Virtual size: 848B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1024B - Virtual size: 996B

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 189KB - Virtual size: 189KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 512B - Virtual size: 12B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:02:92:4a:00:00:00:00:00:20
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

50:75:2b:f8:00:6f:71:1e:d9:81:83:7f:28:8b:b9:3f:31:db:7f:2d
Signer