4cd0e17bc3cf783fc11a8e175162802d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4cd0e17bc3cf783fc11a8e175162802d_JaffaCakes118
Size

5.4MB
MD5

4cd0e17bc3cf783fc11a8e175162802d
SHA1

780225aeda66d73b4c672b5f509ba62f72a07c4b
SHA256

0babd37a55e29dcd93a9dfdca46e0c9f0b49189733f848f33969b09fe4e7af69
SHA512

1993230fb08a2f96c169551420a7ea4651254f5ae61b152540b442135c4f697110ca4bc1d7ac195a7ecee18f42d7739b0e919894089a5578055d8c61d6155c40
SSDEEP

98304:P8SdA0jzh9TuwCah+7NBJ3rgY0JfzwnkCBUCvMbcGbISNiJuSNJGd0nSAfqezKga:P8kdjTuqoBreJfzwnkCB90bcGsCohT0H

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/29a-6/29A-6.EXE
unpack005/DOB.EXE
unpack006/DOTNET.EXE
unpack006/GOAT.EXE
unpack006/GOAT2.EXE
unpack007/KETAMINE.EXE
unpack008/NEXT.EXE
unpack009/universe.EXE
unpack009/utils/bin2inc.EXE
unpack009/utils/cryptkey.EXE
unpack009/utils/encr.exe
unpack009/utils/telock51/telock51.EXE
unpack001/29a-6/Config/SECRET.DLL
unpack001/29a-6/XAUDIO.DLL

Files

4cd0e17bc3cf783fc11a8e175162802d_JaffaCakes118
.zip
29a-6/29A-6.EXE
.exe windows:4 windows x86 arch:x86

e2c53d427eaa3fd5a9071ee2782c70f3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

xaudio

player_delete
control_message_send
control_win32_params_to_message
player_new
xaudio_get_version
player_new_ext

kernel32

OpenFile
CloseHandle
VirtualAlloc
VirtualFree
ReadFile
lstrcpyA
GetPrivateProfileStringA
WritePrivateProfileStringA
LoadLibraryA
GetCurrentDirectoryA
FreeLibrary
GetProcAddress
GetPrivateProfileIntA
GetTickCount
GetVersionExA
Sleep
CreateFileA
GetFileSize
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringA
MultiByteToWideChar
GetOEMCP
GetACP
GetCPInfo
SetFilePointer
GetLastError
IsBadCodePtr
IsBadReadPtr
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsBadWritePtr
HeapReAlloc
LCMapStringW
HeapDestroy
GetEnvironmentVariableA
FlushFileBuffers
SetUnhandledExceptionFilter
ExitProcess
GetModuleFileNameA
GetCommandLineA
GetStartupInfoA
GetVersion
HeapAlloc
HeapFree
GetModuleHandleA
RtlUnwind
SetStdHandle
RaiseException
HeapCreate

user32

InvalidateRect
MessageBoxA
GetWindowLongA
SetWindowLongA
DefWindowProcA
UnregisterClassA
CreateWindowExA
RegisterClassA
GetMessageA
DestroyWindow
DispatchMessageA
LoadCursorA
TranslateMessage
PeekMessageA
UpdateWindow
LoadIconA
ShowWindow
GetWindowPlacement
DrawIcon
EndDialog
GetDlgItemTextA
GetUpdateRect
SetWindowTextA
SetWindowPos
GetSystemMenu
AppendMenuA
CallWindowProcA
LoadImageA
GetDC
ReleaseDC
IsWindowVisible
BringWindowToTop
BeginPaint
GetClientRect
EndPaint
PostQuitMessage
SendMessageA
EnableWindow
SetFocus
DialogBoxParamA
SystemParametersInfoA

gdi32

CreateSolidBrush
DeleteDC
DeleteObject
CreateHalftonePalette
CreatePalette
GetDIBColorTable
SelectObject
CreateCompatibleDC
GetObjectA
BitBlt
StretchBlt
RealizePalette
SelectPalette
GetDeviceCaps
CreateCompatibleBitmap
GetClipBox
CreateFontIndirectA

comctl32

ImageList_Create
ImageList_SetBkColor
ImageList_ReplaceIcon
ord17

shell32

Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
29a-6/29A-6.IDX
29a-6/Articles/29A-6.001
29a-6/Articles/29A-6.002
29a-6/Articles/29A-6.003
29a-6/Articles/29A-6.004
29a-6/Articles/29A-6.005
29a-6/Articles/29A-6.006
29a-6/Articles/29A-6.007
.vbs
29a-6/Articles/29A-6.008
29a-6/Articles/29A-6.009
29a-6/Articles/29A-6.010
29a-6/Articles/29A-6.011
29a-6/Articles/29A-6.012
29a-6/Articles/29A-6.013
.js
29a-6/Articles/29A-6.014
.vbs
29a-6/Articles/29A-6.015
29a-6/Articles/29A-6.016
29a-6/Articles/29A-6.017
29a-6/Articles/29A-6.018
29a-6/Articles/29A-6.019
.vbs
29a-6/Articles/29A-6.020
29a-6/Articles/29A-6.021
29a-6/Articles/29A-6.022
.js
29a-6/Articles/29A-6.023
29a-6/Articles/29A-6.024
29a-6/Articles/29A-6.025
29a-6/Articles/index.html
.html
29a-6/Articles/index16c1.html
.html
29a-6/Articles/index2846.html
.html
29a-6/Articles/index5272.html
.html
29a-6/Articles/index79c2.html
.html
29a-6/Articles/index7e6f.html
.html
29a-6/Articles/index864c.html
.html
29a-6/Articles/indexb3a7.html
.html
29a-6/Articles/indexcaa7.html
.html
29a-6/Binaries/Anonymous/HASHES.RAR
.rar
gost_hash.inc
gosthash.asm
haval.asm
ihash-pl-src.rar
.rar
base/ihash.c
base/make.bat
plugins-eng.fmt
plugins-rus.fmt
plugins/GOSTHASH/gosthash-pl.c
plugins/GOSTHASH/gosthash-pl.def
plugins/GOSTHASH/gosthash.asm
plugins/GOSTHASH/makeall.bat
plugins/HAVAL/haval-pl.c
plugins/HAVAL/haval-pl.def
plugins/HAVAL/haval.asm
plugins/HAVAL/makeall.bat
plugins/MD2/makeall.bat
plugins/MD2/md2-pl.c
plugins/MD2/md2-pl.def
plugins/MD2/md2hash.asm
plugins/MD4/makeall.bat
plugins/MD4/md4-pl.c
plugins/MD4/md4-pl.def
plugins/MD4/md4hash.asm
plugins/MD5/makeall.bat
plugins/MD5/md5-pl.c
plugins/MD5/md5-pl.def
plugins/MD5/md5hash.asm
plugins/RIPEMD/makeall.bat
plugins/RIPEMD/ripemd128.asm
plugins/RIPEMD/ripemd160.asm
plugins/RIPEMD/rmd128-pl.c
plugins/RIPEMD/rmd128.def
plugins/RIPEMD/rmd160-pl.c
plugins/RIPEMD/rmd160.def
plugins/SHA/makeall.bat
plugins/SHA/sha160.asm
plugins/SHA/sha160_pl.def
plugins/SHA/sha235.c
plugins/SHA/sha235.h
plugins/SHA/sha235_plugin.c
plugins/SHA/sha235_plugin.h
plugins/SHA/sha235_test.c
plugins/SHA/sha256_pl.def
plugins/SHA/sha384_pl.def
plugins/SHA/sha512_pl.def
md2_hash.inc
md2hash.asm
md4_hash.inc
md4hash.asm
md5_hash.inc
md5hash.asm
ripemd-128.inc
ripemd128.asm
ripemd160.asm
sha160.asm
sha160.inc
shf_hash.inc
shfhash.asm
29a-6/Binaries/Anonymous/MWORM.ZIP
.zip
MHTTPD
.elf linux x86
MWORM
.elf linux x86
29a-6/Binaries/Anonymous/index.html
.html
29a-6/Binaries/Anonymous/index16c1.html
.html
29a-6/Binaries/Anonymous/index2846.html
.html
29a-6/Binaries/Anonymous/index5272.html
.html
29a-6/Binaries/Anonymous/index79c2.html
.html
29a-6/Binaries/Anonymous/index7e6f.html
.html
29a-6/Binaries/Anonymous/index864c.html
.html
29a-6/Binaries/Anonymous/indexb3a7.html
.html
29a-6/Binaries/Anonymous/indexcaa7.html
.html
29a-6/Binaries/Benny/DOB.ZIP
.zip
DOB.EXE
.exe windows:1 windows x86 arch:x86

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

ExitProcess

Sections

CODE
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
29a-6/Binaries/Benny/DOTNET.ZIP
.zip
DOTNET.EXE
.exe windows:1 windows x86 arch:x86

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

ExitProcess

Sections

CODE
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
GOAT.EXE
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
GOAT2.EXE
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\temp1\samples\QuickStart\howto\samples\CompMod\CodeDom\ListBuilder\CS\ListBuilder.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
29a-6/Binaries/Benny/KETAMINE.ZIP
.zip
KETAMINE.EXE
.exe windows:1 windows x86 arch:x86

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

ExitProcess

Sections

CODE
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
29a-6/Binaries/Benny/NEXT.ZIP
.zip
NEXT.EXE
.exe windows:1 windows x86 arch:x86

500ff1538958cc73738bf0c262a1773f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA

user32

MessageBoxA

Sections

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 7KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
NEXT.RES
29a-6/Binaries/Benny/UNIVERSE.RAR
.rar
compile.bat
dll/dllz.def
dll/feedback.DLL
dll/feedback.asm
dll/mail.DLL
dll/mail.asm
dll/mirc.DLL
dll/mirc.asm
dll/payload.DLL
dll/payload.asm
dll/rar.DLL
dll/rar.asm
dll/universe.b64
key.inc
key_pp.inc
universe.EXE
.exe windows:1 windows x86 arch:x86

5b50c62fb0f4364c2d15e846bc2ba9a3

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetProcAddress
GetModuleHandleA
LoadLibraryA
ExitProcess
VirtualAlloc
VirtualFree
CreateMutexA

user32

MessageBoxA

Sections

UnIvErSe
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UnIvErSe
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UnIvErSe
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UnIvErSe
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
universe.asm
universe.def
universe.res
universe.txt
useful.inc
utils/bin2inc.EXE
.exe windows:1 windows x86 arch:x86

489df1680b4077e756545d3eb62b6a82

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

CreateFileA
ExitProcess
GetCommandLineA
GetFileSize
ReadFile
WriteFile
CloseHandle

Sections

CODE
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
utils/bin2inc.asm
utils/crypt.key
utils/crypt_pp.key
utils/cryptkey.EXE
.exe windows:1 windows x86 arch:x86

ce772902500f931adf43710a80932780

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

advapi32

CryptExportKey
CryptGetUserKey
CryptGenKey
CryptAcquireContextA

kernel32

CreateFileA
ExitProcess
CloseHandle
WriteFile

Sections

CODE
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
utils/cryptkey.asm
utils/encr.asm
utils/encr.exe
.exe windows:1 windows x86 arch:x86

d44bf7e9ca908ce1cac83460a15f3ebb

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

MapViewOfFile
GetFileSize
UnmapViewOfFile
CloseHandle
CreateFileA
CreateFileMappingA
ExitProcess
GetCommandLineA

advapi32

CryptImportKey
CryptEncrypt
CryptGetUserKey
CryptAcquireContextA

Sections

CODE
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
utils/telock51/ReadMe.txt
utils/telock51/file_id.diz
utils/telock51/telock.ini
utils/telock51/telock51.EXE
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.upx
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.upx
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
win32api.inc
29a-6/Binaries/Benny/WINUX.ZIP
.zip
29a-6/Binaries/Benny/index.html
.html
29a-6/Binaries/Benny/index16c1.html
.html
29a-6/Binaries/Benny/index2846.html
.html
29a-6/Binaries/Benny/index5272.html
.html
29a-6/Binaries/Benny/index79c2.html
.html
29a-6/Binaries/Benny/index7e6f.html
.html
29a-6/Binaries/Benny/index864c.html
.html
29a-6/Binaries/Benny/indexb3a7.html
.html
29a-6/Binaries/Benny/indexcaa7.html
.html
29a-6/Binaries/Bumblebee/BEEFREE.ZIP
.zip
29a-6/Binaries/Bumblebee/BRSHWORM.ZIP
.zip
29a-6/Binaries/Bumblebee/DOCWORM.ZIP
.zip
29a-6/Binaries/Bumblebee/LILDEVIL.ZIP
.zip
29a-6/Binaries/Bumblebee/MINIR3B.ZIP
.zip
29a-6/Binaries/Bumblebee/SOLARIS.ZIP
.zip
29a-6/Binaries/Bumblebee/index.html
.html
29a-6/Binaries/Bumblebee/index16c1.html
.html
29a-6/Binaries/Bumblebee/index2846.html
.html
29a-6/Binaries/Bumblebee/index5272.html
.html
29a-6/Binaries/Bumblebee/index79c2.html
.html
29a-6/Binaries/Bumblebee/index7e6f.html
.html
29a-6/Binaries/Bumblebee/index864c.html
.html
29a-6/Binaries/Bumblebee/indexb3a7.html
.html
29a-6/Binaries/Bumblebee/indexcaa7.html
.html
29a-6/Binaries/DoxtorL/P-ADIC19.ZIP
.zip
29a-6/Binaries/DoxtorL/index.html
.html
29a-6/Binaries/DoxtorL/index16c1.html
.html
29a-6/Binaries/DoxtorL/index2846.html
.html
29a-6/Binaries/DoxtorL/index5272.html
.html
29a-6/Binaries/DoxtorL/index79c2.html
.html
29a-6/Binaries/DoxtorL/index7e6f.html
.html
29a-6/Binaries/DoxtorL/index864c.html
.html
29a-6/Binaries/DoxtorL/indexb3a7.html
.html
29a-6/Binaries/DoxtorL/indexcaa7.html
.html
29a-6/Binaries/GWI/EXAMPLES.ZIP
.zip
29a-6/Binaries/GWI/index.html
.html
29a-6/Binaries/GWI/index16c1.html
.html
29a-6/Binaries/GWI/index2846.html
.html
29a-6/Binaries/GWI/index5272.html
.html
29a-6/Binaries/GWI/index79c2.html
.html
29a-6/Binaries/GWI/index7e6f.html
.html
29a-6/Binaries/GWI/index864c.html
.html
29a-6/Binaries/GWI/indexb3a7.html
.html
29a-6/Binaries/GWI/indexcaa7.html
.html
29a-6/Binaries/GriYo/Yello Fever.ZIP
.zip
29a-6/Binaries/GriYo/index.html
.html
29a-6/Binaries/GriYo/index16c1.html
.html
29a-6/Binaries/GriYo/index2846.html
.html
29a-6/Binaries/GriYo/index5272.html
.html
29a-6/Binaries/GriYo/index79c2.html
.html
29a-6/Binaries/GriYo/index7e6f.html
.html
29a-6/Binaries/GriYo/index864c.html
.html
29a-6/Binaries/GriYo/indexb3a7.html
.html
29a-6/Binaries/GriYo/indexcaa7.html
.html
29a-6/Binaries/Ivan/VAMPIRO.ZIP
.zip
29a-6/Binaries/Ivan/index.html
.html
29a-6/Binaries/Ivan/index16c1.html
.html
29a-6/Binaries/Ivan/index2846.html
.html
29a-6/Binaries/Ivan/index5272.html
.html
29a-6/Binaries/Ivan/index79c2.html
.html
29a-6/Binaries/Ivan/index7e6f.html
.html
29a-6/Binaries/Ivan/index864c.html
.html
29a-6/Binaries/Ivan/indexb3a7.html
.html
29a-6/Binaries/Ivan/indexcaa7.html
.html
29a-6/Binaries/LiteSys/PLEXAR.ZIP
.zip
29a-6/Binaries/LiteSys/RUDRA.ZIP
.zip
29a-6/Binaries/LiteSys/index.html
.html
29a-6/Binaries/LiteSys/index16c1.html
.html
29a-6/Binaries/LiteSys/index2846.html
.html
29a-6/Binaries/LiteSys/index5272.html
.html
29a-6/Binaries/LiteSys/index79c2.html
.html
29a-6/Binaries/LiteSys/index7e6f.html
.html
29a-6/Binaries/LiteSys/index864c.html
.html
29a-6/Binaries/LiteSys/indexb3a7.html
.html
29a-6/Binaries/LiteSys/indexcaa7.html
.html
29a-6/Binaries/Mental Driller/METAPHOR.ZIP
.zip
29a-6/Binaries/Mental Driller/index.html
.html
29a-6/Binaries/Mental Driller/index16c1.html
.html
29a-6/Binaries/Mental Driller/index2846.html
.html
29a-6/Binaries/Mental Driller/index5272.html
.html
29a-6/Binaries/Mental Driller/index79c2.html
.html
29a-6/Binaries/Mental Driller/index7e6f.html
.html
29a-6/Binaries/Mental Driller/index864c.html
.html
29a-6/Binaries/Mental Driller/indexb3a7.html
.html
29a-6/Binaries/Mental Driller/indexcaa7.html
.html
29a-6/Binaries/NBK/AVEXP.ZIP
.zip
29a-6/Binaries/NBK/BINLADEN.ZIP
.zip
29a-6/Binaries/NBK/index.html
.html
29a-6/Binaries/NBK/index16c1.html
.html
29a-6/Binaries/NBK/index2846.html
.html
29a-6/Binaries/NBK/index5272.html
.html
29a-6/Binaries/NBK/index79c2.html
.html
29a-6/Binaries/NBK/index7e6f.html
.html
29a-6/Binaries/NBK/index864c.html
.html
29a-6/Binaries/NBK/indexb3a7.html
.html
29a-6/Binaries/NBK/indexcaa7.html
.html
29a-6/Binaries/Necr0mancer/SOCIETY.ZIP
.zip
29a-6/Binaries/Necr0mancer/index.html
.html
29a-6/Binaries/Necr0mancer/index16c1.html
.html
29a-6/Binaries/Necr0mancer/index2846.html
.html
29a-6/Binaries/Necr0mancer/index5272.html
.html
29a-6/Binaries/Necr0mancer/index79c2.html
.html
29a-6/Binaries/Necr0mancer/index7e6f.html
.html
29a-6/Binaries/Necr0mancer/index864c.html
.html
29a-6/Binaries/Necr0mancer/indexb3a7.html
.html
29a-6/Binaries/Necr0mancer/indexcaa7.html
.html
29a-6/Binaries/PETERS/HUNTING.ZIP
.zip
29a-6/Binaries/PETERS/index.html
.html
29a-6/Binaries/PETERS/index16c1.html
.html
29a-6/Binaries/PETERS/index2846.html
.html
29a-6/Binaries/PETERS/index5272.html
.html
29a-6/Binaries/PETERS/index79c2.html
.html
29a-6/Binaries/PETERS/index7e6f.html
.html
29a-6/Binaries/PETERS/index864c.html
.html
29a-6/Binaries/PETERS/indexb3a7.html
.html
29a-6/Binaries/PETERS/indexcaa7.html
.html
29a-6/Binaries/Pavel/A.ZIP
.zip
29a-6/Binaries/Pavel/ELFWRSEC.ZIP
.zip
29a-6/Binaries/Pavel/index.html
.html
29a-6/Binaries/Pavel/index16c1.html
.html
29a-6/Binaries/Pavel/index2846.html
.html
29a-6/Binaries/Pavel/index5272.html
.html
29a-6/Binaries/Pavel/index79c2.html
.html
29a-6/Binaries/Pavel/index7e6f.html
.html
29a-6/Binaries/Pavel/index864c.html
.html
29a-6/Binaries/Pavel/indexb3a7.html
.html
29a-6/Binaries/Pavel/indexcaa7.html
.html
29a-6/Binaries/PetiK/MALOTEYA.ZIP
.zip
29a-6/Binaries/PetiK/index.html
.html
29a-6/Binaries/PetiK/index16c1.html
.html
29a-6/Binaries/PetiK/index2846.html
.html
29a-6/Binaries/PetiK/index5272.html
.html
29a-6/Binaries/PetiK/index79c2.html
.html
29a-6/Binaries/PetiK/index7e6f.html
.html
29a-6/Binaries/PetiK/index864c.html
.html
29a-6/Binaries/PetiK/indexb3a7.html
.html
29a-6/Binaries/PetiK/indexcaa7.html
.html
29a-6/Binaries/RTC/SONIA.ZIP
.zip
29a-6/Binaries/RTC/index.html
.html
29a-6/Binaries/RTC/index16c1.html
.html
29a-6/Binaries/RTC/index2846.html
.html
29a-6/Binaries/RTC/index5272.html
.html
29a-6/Binaries/RTC/index79c2.html
.html
29a-6/Binaries/RTC/index7e6f.html
.html
29a-6/Binaries/RTC/index864c.html
.html
29a-6/Binaries/RTC/indexb3a7.html
.html
29a-6/Binaries/RTC/indexcaa7.html
.html
29a-6/Binaries/Radix16/grifin.zip
.zip
29a-6/Binaries/Radix16/index.html
.html
29a-6/Binaries/Radix16/index16c1.html
.html
29a-6/Binaries/Radix16/index2846.html
.html
29a-6/Binaries/Radix16/index5272.html
.html
29a-6/Binaries/Radix16/index79c2.html
.html
29a-6/Binaries/Radix16/index7e6f.html
.html
29a-6/Binaries/Radix16/index864c.html
.html
29a-6/Binaries/Radix16/indexb3a7.html
.html
29a-6/Binaries/Radix16/indexcaa7.html
.html
29a-6/Binaries/Ratter/JOSS.ZIP
.zip
29a-6/Binaries/Ratter/TAICHI.ZIP
.zip
29a-6/Binaries/Ratter/index.html
.html
29a-6/Binaries/Ratter/index16c1.html
.html
29a-6/Binaries/Ratter/index2846.html
.html
29a-6/Binaries/Ratter/index5272.html
.html
29a-6/Binaries/Ratter/index79c2.html
.html
29a-6/Binaries/Ratter/index7e6f.html
.html
29a-6/Binaries/Ratter/index864c.html
.html
29a-6/Binaries/Ratter/indexb3a7.html
.html
29a-6/Binaries/Ratter/indexcaa7.html
.html
29a-6/Binaries/Rohitab/BLACKBAT.ZIP
.zip
29a-6/Binaries/Rohitab/index.html
.html
29a-6/Binaries/Rohitab/index16c1.html
.html
29a-6/Binaries/Rohitab/index2846.html
.html
29a-6/Binaries/Rohitab/index5272.html
.html
29a-6/Binaries/Rohitab/index79c2.html
.html
29a-6/Binaries/Rohitab/index7e6f.html
.html
29a-6/Binaries/Rohitab/index864c.html
.html
29a-6/Binaries/Rohitab/indexb3a7.html
.html
29a-6/Binaries/Rohitab/indexcaa7.html
.html
29a-6/Binaries/Roy/CHTHON.ZIP
.zip
29a-6/Binaries/Roy/EFISHNC.ZIP
.zip
29a-6/Binaries/Roy/GEMINI.ZIP
.zip
29a-6/Binaries/Roy/OU812.ZIP
.zip
29a-6/Binaries/Roy/SHRUG.ZIP
.zip
29a-6/Binaries/Roy/index.html
.html
29a-6/Binaries/Roy/index16c1.html
.html
29a-6/Binaries/Roy/index2846.html
.html
29a-6/Binaries/Roy/index5272.html
.html
29a-6/Binaries/Roy/index79c2.html
.html
29a-6/Binaries/Roy/index7e6f.html
.html
29a-6/Binaries/Roy/index864c.html
.html
29a-6/Binaries/Roy/indexb3a7.html
.html
29a-6/Binaries/Roy/indexcaa7.html
.html
29a-6/Binaries/Siilex/VC.ZIP
.zip
29a-6/Binaries/Siilex/index.html
.html
29a-6/Binaries/Siilex/index16c1.html
.html
29a-6/Binaries/Siilex/index2846.html
.html
29a-6/Binaries/Siilex/index5272.html
.html
29a-6/Binaries/Siilex/index79c2.html
.html
29a-6/Binaries/Siilex/index7e6f.html
.html
29a-6/Binaries/Siilex/index864c.html
.html
29a-6/Binaries/Siilex/indexb3a7.html
.html
29a-6/Binaries/Siilex/indexcaa7.html
.html
29a-6/Binaries/Spanska/OPENGL.ZIP
.zip
29a-6/Binaries/Spanska/SPRITES.ZIP
.zip
29a-6/Binaries/Spanska/index.html
.html
29a-6/Binaries/Spanska/index16c1.html
.html
29a-6/Binaries/Spanska/index2846.html
.html
29a-6/Binaries/Spanska/index5272.html
.html
29a-6/Binaries/Spanska/index79c2.html
.html
29a-6/Binaries/Spanska/index7e6f.html
.html
29a-6/Binaries/Spanska/index864c.html
.html
29a-6/Binaries/Spanska/indexb3a7.html
.html
29a-6/Binaries/Spanska/indexcaa7.html
.html
29a-6/Binaries/Vecna/LEXO32.ZIP
.zip
29a-6/Binaries/Vecna/MUAZZIN.ZIP
.zip
29a-6/Binaries/Vecna/RAMONES.RAR
.rar
29a-6/Binaries/Vecna/index.html
.html
29a-6/Binaries/Vecna/index16c1.html
.html
29a-6/Binaries/Vecna/index2846.html
.html
29a-6/Binaries/Vecna/index5272.html
.html
29a-6/Binaries/Vecna/index79c2.html
.html
29a-6/Binaries/Vecna/index7e6f.html
.html
29a-6/Binaries/Vecna/index864c.html
.html
29a-6/Binaries/Vecna/indexb3a7.html
.html
29a-6/Binaries/Vecna/indexcaa7.html
.html
29a-6/Binaries/WhiteHead/CGAGF.ZIP
.zip
29a-6/Binaries/WhiteHead/index.html
.html
29a-6/Binaries/WhiteHead/index16c1.html
.html
29a-6/Binaries/WhiteHead/index2846.html
.html
29a-6/Binaries/WhiteHead/index5272.html
.html
29a-6/Binaries/WhiteHead/index79c2.html
.html
29a-6/Binaries/WhiteHead/index7e6f.html
.html
29a-6/Binaries/WhiteHead/index864c.html
.html
29a-6/Binaries/WhiteHead/indexb3a7.html
.html
29a-6/Binaries/WhiteHead/indexcaa7.html
.html
29a-6/Binaries/Z0MBiE/ADE202.ZIP
.zip
29a-6/Binaries/Z0MBiE/AVP4SRU.ZIP
.zip
29a-6/Binaries/Z0MBiE/EXAMPLO.ZIP
.zip
29a-6/Binaries/Z0MBiE/IISLOG.ZIP
.zip
29a-6/Binaries/Z0MBiE/INFISO.ZIP
.zip
29a-6/Binaries/Z0MBiE/INMEM.ZIP
.zip
29a-6/Binaries/Z0MBiE/KME552.ZIP
.zip
29a-6/Binaries/Z0MBiE/MISTFALL.ZIP
.zip
29a-6/Binaries/Z0MBiE/PGN2B30.RAR
.rar
29a-6/Binaries/Z0MBiE/TFTPSERV.ZIP
.zip
29a-6/Binaries/Z0MBiE/WSOCKLOG.ZIP
.zip
29a-6/Binaries/Z0MBiE/Z10D.ZIP
.zip
29a-6/Binaries/Z0MBiE/ZFTP.ZIP
.zip
29a-6/Binaries/Z0MBiE/index.html
.html
29a-6/Binaries/Z0MBiE/index16c1.html
.html
29a-6/Binaries/Z0MBiE/index2846.html
.html
29a-6/Binaries/Z0MBiE/index5272.html
.html
29a-6/Binaries/Z0MBiE/index79c2.html
.html
29a-6/Binaries/Z0MBiE/index7e6f.html
.html
29a-6/Binaries/Z0MBiE/index864c.html
.html
29a-6/Binaries/Z0MBiE/indexb3a7.html
.html
29a-6/Binaries/Z0MBiE/indexcaa7.html
.html
29a-6/Binaries/Zert/EXAMPLES.ZIP
.zip
29a-6/Binaries/Zert/index.html
.html
29a-6/Binaries/Zert/index16c1.html
.html
29a-6/Binaries/Zert/index2846.html
.html
29a-6/Binaries/Zert/index5272.html
.html
29a-6/Binaries/Zert/index79c2.html
.html
29a-6/Binaries/Zert/index7e6f.html
.html
29a-6/Binaries/Zert/index864c.html
.html
29a-6/Binaries/Zert/indexb3a7.html
.html
29a-6/Binaries/Zert/indexcaa7.html
.html
29a-6/Binaries/ZhugeJin/LIME-GEN.ZIP
.zip
29a-6/Binaries/ZhugeJin/index.html
.html
29a-6/Binaries/ZhugeJin/index16c1.html
.html
29a-6/Binaries/ZhugeJin/index2846.html
.html
29a-6/Binaries/ZhugeJin/index5272.html
.html
29a-6/Binaries/ZhugeJin/index79c2.html
.html
29a-6/Binaries/ZhugeJin/index7e6f.html
.html
29a-6/Binaries/ZhugeJin/index864c.html
.html
29a-6/Binaries/ZhugeJin/indexb3a7.html
.html
29a-6/Binaries/ZhugeJin/indexcaa7.html
.html
29a-6/Binaries/index.html
.html
29a-6/Binaries/index16c1.html
.html
29a-6/Binaries/index2846.html
.html
29a-6/Binaries/index5272.html
.html
29a-6/Binaries/index79c2.html
.html
29a-6/Binaries/index7e6f.html
.html
29a-6/Binaries/index864c.html
.html
29a-6/Binaries/indexb3a7.html
.html
29a-6/Binaries/indexcaa7.html
.html
29a-6/Config/BG.BMP
29a-6/Config/MUSIC.MP3
29a-6/Config/SDATA.29A
29a-6/Config/SECRET.DLL
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SecretAreaClose
SecretAreaDraw
SecretAreaInit
SecretAreaKey
SecretAreaTick

Sections

Size: 15KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
29a-6/Config/index.html
.html
29a-6/Config/index16c1.html
.html
29a-6/Config/index2846.html
.html
29a-6/Config/index5272.html
.html
29a-6/Config/index79c2.html
.html
29a-6/Config/index7e6f.html
.html
29a-6/Config/index864c.html
.html
29a-6/Config/indexb3a7.html
.html
29a-6/Config/indexcaa7.html
.html
29a-6/Config/reader.ini
29a-6/Editorial/29A-6.001
29a-6/Editorial/29A-6.002
29a-6/Editorial/29A-6.003
29a-6/Editorial/29A-6.004
29a-6/Editorial/29A-6.005
29a-6/Editorial/29A-6.006
29a-6/Editorial/29A-6.007
29a-6/Editorial/29A-6.008
29a-6/Editorial/29A-6.009
29a-6/Editorial/29A-6.010
.js
29a-6/Editorial/29A-6.011
29a-6/Editorial/29A-6.012
29a-6/Editorial/index.html
.html
29a-6/Editorial/index16c1.html
.html
29a-6/Editorial/index2846.html
.html
29a-6/Editorial/index5272.html
.html
29a-6/Editorial/index79c2.html
.html
29a-6/Editorial/index7e6f.html
.html
29a-6/Editorial/index864c.html
.html
29a-6/Editorial/indexb3a7.html
.html
29a-6/Editorial/indexcaa7.html
.html
29a-6/FILE_ID.DIZ
29a-6/Utilities/29A-6.001
.vbs
29a-6/Utilities/29A-6.002
29a-6/Utilities/29A-6.003
29a-6/Utilities/29A-6.004
.vbs
29a-6/Utilities/29A-6.005
29a-6/Utilities/29A-6.006
.js
29a-6/Utilities/29A-6.007
29a-6/Utilities/29A-6.008
29a-6/Utilities/29A-6.009
29a-6/Utilities/29A-6.010
29a-6/Utilities/29A-6.011
29a-6/Utilities/29A-6.012
29a-6/Utilities/29A-6.013
29a-6/Utilities/29A-6.014
29a-6/Utilities/29A-6.015
.vbs
29a-6/Utilities/29A-6.016
29a-6/Utilities/29A-6.017
29a-6/Utilities/29A-6.018
29a-6/Utilities/29A-6.019
29a-6/Utilities/index.html
.html
29a-6/Utilities/index16c1.html
.html
29a-6/Utilities/index2846.html
.html
29a-6/Utilities/index5272.html
.html
29a-6/Utilities/index79c2.html
.html
29a-6/Utilities/index7e6f.html
.html
29a-6/Utilities/index864c.html
.html
29a-6/Utilities/indexb3a7.html
.html
29a-6/Utilities/indexcaa7.html
.html
29a-6/Viruses/Misc/29A-6.001
29a-6/Viruses/Misc/29A-6.002
.vbs
29a-6/Viruses/Misc/29A-6.003
29a-6/Viruses/Misc/29A-6.004
29a-6/Viruses/Misc/29A-6.005
29a-6/Viruses/Misc/29A-6.006
29a-6/Viruses/Misc/29A-6.007
29a-6/Viruses/Misc/29A-6.008
29a-6/Viruses/Misc/29A-6.009
.vbs
29a-6/Viruses/Misc/29A-6.010
29a-6/Viruses/Misc/29A-6.011
29a-6/Viruses/Misc/29A-6.012
.vbs
29a-6/Viruses/Misc/29A-6.013
29a-6/Viruses/Misc/29A-6.014
29a-6/Viruses/Misc/index.html
.html
29a-6/Viruses/Misc/index16c1.html
.html
29a-6/Viruses/Misc/index2846.html
.html
29a-6/Viruses/Misc/index5272.html
.html
29a-6/Viruses/Misc/index79c2.html
.html
29a-6/Viruses/Misc/index7e6f.html
.html
29a-6/Viruses/Misc/index864c.html
.html
29a-6/Viruses/Misc/indexb3a7.html
.html
29a-6/Viruses/Misc/indexcaa7.html
.html
29a-6/Viruses/Win32/29A-6.001
.vbs
29a-6/Viruses/Win32/29A-6.002
29a-6/Viruses/Win32/29A-6.003
29a-6/Viruses/Win32/29A-6.004
29a-6/Viruses/Win32/29A-6.005
.vbs
29a-6/Viruses/Win32/29A-6.006
29a-6/Viruses/Win32/29A-6.007
29a-6/Viruses/Win32/29A-6.008
.vbs
29a-6/Viruses/Win32/29A-6.009
29a-6/Viruses/Win32/29A-6.010
29a-6/Viruses/Win32/29A-6.011
29a-6/Viruses/Win32/29A-6.012
29a-6/Viruses/Win32/29A-6.013
29a-6/Viruses/Win32/29A-6.014
.vbs
29a-6/Viruses/Win32/29A-6.015
29a-6/Viruses/Win32/29A-6.016
29a-6/Viruses/Win32/29A-6.017
29a-6/Viruses/Win32/29A-6.018
29a-6/Viruses/Win32/index.html
.html
29a-6/Viruses/Win32/index16c1.html
.html
29a-6/Viruses/Win32/index2846.html
.html
29a-6/Viruses/Win32/index5272.html
.html
29a-6/Viruses/Win32/index79c2.html
.html
29a-6/Viruses/Win32/index7e6f.html
.html
29a-6/Viruses/Win32/index864c.html
.html
29a-6/Viruses/Win32/indexb3a7.html
.html
29a-6/Viruses/Win32/indexcaa7.html
.html
29a-6/Viruses/Win9x/29A-6.001
29a-6/Viruses/Win9x/29A-6.002
29a-6/Viruses/Win9x/29A-6.003
29a-6/Viruses/Win9x/29A-6.004
29a-6/Viruses/Win9x/29A-6.005
29a-6/Viruses/Win9x/29A-6.006
29a-6/Viruses/Win9x/29A-6.007
29a-6/Viruses/Win9x/index.html
.html
29a-6/Viruses/Win9x/index16c1.html
.html
29a-6/Viruses/Win9x/index2846.html
.html
29a-6/Viruses/Win9x/index5272.html
.html
29a-6/Viruses/Win9x/index79c2.html
.html
29a-6/Viruses/Win9x/index7e6f.html
.html
29a-6/Viruses/Win9x/index864c.html
.html
29a-6/Viruses/Win9x/indexb3a7.html
.html
29a-6/Viruses/Win9x/indexcaa7.html
.html
29a-6/Viruses/WinNT/29A-6.001
.vbs
29a-6/Viruses/WinNT/29A-6.002
.vbs
29a-6/Viruses/WinNT/29A-6.003
29a-6/Viruses/WinNT/29A-6.004
29a-6/Viruses/WinNT/index.html
.html
29a-6/Viruses/WinNT/index16c1.html
.html
29a-6/Viruses/WinNT/index2846.html
.html
29a-6/Viruses/WinNT/index5272.html
.html
29a-6/Viruses/WinNT/index79c2.html
.html
29a-6/Viruses/WinNT/index7e6f.html
.html
29a-6/Viruses/WinNT/index864c.html
.html
29a-6/Viruses/WinNT/indexb3a7.html
.html
29a-6/Viruses/WinNT/indexcaa7.html
.html
29a-6/Viruses/index.html
.html
29a-6/Viruses/index16c1.html
.html
29a-6/Viruses/index2846.html
.html
29a-6/Viruses/index5272.html
.html
29a-6/Viruses/index79c2.html
.html
29a-6/Viruses/index7e6f.html
.html
29a-6/Viruses/index864c.html
.html
29a-6/Viruses/indexb3a7.html
.html
29a-6/Viruses/indexcaa7.html
.html
29a-6/XAUDIO.DLL
.dll windows:4 windows x86 arch:x86

fabdab54ef4d4a6befc9aa0ff00b2460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringA
SetThreadPriority
CloseHandle
WaitForSingleObject
GetCurrentThreadId
GetCurrentThread
CreateEventA
SetEvent
GetModuleHandleA
GetThreadPriority
GetExitCodeThread
CreateThread
LoadLibraryA
GetProcAddress
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
GetLastError
TlsSetValue
ExitThread
EnterCriticalSection
LeaveCriticalSection
GetTimeZoneInformation
GetSystemTimeAsFileTime
ExitProcess
TerminateProcess
GetCurrentProcess
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
InitializeCriticalSection
RtlUnwind
UnhandledExceptionFilter
ReadFile
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetACP
GetOEMCP
CreateFileA
FlushFileBuffers
SetStdHandle
MultiByteToWideChar
Sleep
LCMapStringW
GetStringTypeA
GetStringTypeW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
FileTimeToLocalFileTime
GetFileInformationByHandle
FileTimeToSystemTime
PeekNamedPipe

user32

SetWindowLongA
CreateWindowExA
RegisterClassA
PostThreadMessageA
DestroyWindow
PostMessageA
DispatchMessageA
TranslateMessage
GetMessageA
MsgWaitForMultipleObjects
PeekMessageA
UnregisterClassA
DefWindowProcA
GetWindowLongA

winmm

waveOutGetVolume
waveOutUnprepareHeader
waveOutReset
waveOutSetPlaybackRate
waveOutRestart
mixerGetLineControlsA
mixerGetLineInfoA
mixerClose
waveOutGetNumDevs
mixerOpen
mixerSetControlDetails
waveOutSetVolume
mixerGetDevCapsA
mixerGetControlDetailsA
waveOutWrite
waveOutPrepareHeader
waveOutGetPosition
waveOutGetDevCapsA
waveOutOpen
waveOutClose
waveOutPause

wsock32

htonl
recvfrom
select
ntohl
ntohs
getsockname
closesocket
accept
listen
bind
recv
htons
socket
gethostbyname
WSAGetLastError
connect
sendto
send
WSACleanup
WSAStartup

Exports

Exports

audio_output_module_register
control_message_get
control_message_send
control_message_send_I
control_message_send_II
control_message_send_III
control_message_send_IIII
control_message_send_IPI
control_message_send_N
control_message_send_P
control_message_send_S
control_message_send_SI
control_message_send_SS
control_message_to_win32_params
control_message_wait
control_procedure_delete
control_procedure_new
control_procedure_set_priority
control_win32_params_to_message
decoder_add_environment_listener
decoder_codec_get_channels
decoder_codec_get_equalizer
decoder_codec_get_quality
decoder_codec_module_register
decoder_codec_set_channels
decoder_codec_set_equalizer
decoder_codec_set_quality
decoder_decode
decoder_delete
decoder_get_environment_integer
decoder_get_environment_string
decoder_input_add_filter
decoder_input_close
decoder_input_delete
decoder_input_filters_list
decoder_input_module_query
decoder_input_module_register
decoder_input_new
decoder_input_open
decoder_input_read
decoder_input_remove_filter
decoder_input_seek_to_offset
decoder_input_seek_to_position
decoder_input_seek_to_time
decoder_input_seek_to_timecode
decoder_input_send_message
decoder_new
decoder_output_add_filter
decoder_output_close
decoder_output_delete
decoder_output_filters_list
decoder_output_get_control
decoder_output_module_query
decoder_output_module_register
decoder_output_new
decoder_output_open
decoder_output_remove_filter
decoder_output_send_message
decoder_output_set_control
decoder_output_write
decoder_play
decoder_remove_environment_listener
decoder_set_environment_integer
decoder_set_environment_string
decoder_unset_environment
event_forwarder_feedback_handler_module_register
fft_analyzer_delete
fft_analyzer_get_spectrum
fft_analyzer_interpolate_samples_signed
fft_analyzer_interpolate_samples_unsigned
fft_analyzer_new
fft_analyzer_set_samples
file_input_module_register
file_output_module_register
memory_input_module_register
mpeg_codec_module_register
player_delete
player_get_priority
player_new
player_new_ext
player_set_priority
properties_get_integer
properties_get_list
properties_get_string
stream_input_module_register
xaudio_error_string
xaudio_get_version

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2c53d427eaa3fd5a9071ee2782c70f3

Headers

File Characteristics

Imports

xaudio

kernel32

user32

gdi32

comctl32

shell32

Sections

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 22KB

.rsrc Size: 8KB - Virtual size: 4KB

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

Imports

kernel32

Sections

CODE Size: 512B - Virtual size: 4KB

DATA Size: 3KB - Virtual size: 4KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

Imports

kernel32

Sections

CODE Size: 5KB - Virtual size: 8KB

DATA Size: - Virtual size: 4KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

Imports

mscoree

Sections

.text Size: 2KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 840B

.reloc Size: 4KB - Virtual size: 8KB

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 6KB - Virtual size: 6KB

.rsrc Size: 1024B - Virtual size: 832B

.reloc Size: 4KB - Virtual size: 8KB

f9ade0aa18f660a34a4fa23392e21838

Headers

File Characteristics

Imports

kernel32

Sections

CODE Size: 1KB - Virtual size: 4KB

DATA Size: - Virtual size: 4KB

.idata Size: 512B - Virtual size: 4KB

.reloc Size: 512B - Virtual size: 4KB

500ff1538958cc73738bf0c262a1773f

Headers

File Characteristics

Imports

kernel32

user32

Sections

Size: 2KB - Virtual size: 4KB

Size: 512B - Virtual size: 4KB

Size: 512B - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 4KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 22KB

.rsrc
Size: 8KB - Virtual size: 4KB

CODE
Size: 512B - Virtual size: 4KB

DATA
Size: 3KB - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

CODE
Size: 5KB - Virtual size: 8KB

DATA
Size: - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

.text
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 840B

.reloc
Size: 4KB - Virtual size: 8KB

.text
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 1024B - Virtual size: 832B

.reloc
Size: 4KB - Virtual size: 8KB

CODE
Size: 1KB - Virtual size: 4KB

DATA
Size: - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

UnIvErSe
Size: 1024B - Virtual size: 4KB

UnIvErSe
Size: 512B - Virtual size: 8KB

UnIvErSe
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 4KB

UnIvErSe
Size: 8KB - Virtual size: 12KB

CODE
Size: 512B - Virtual size: 4KB

DATA
Size: 512B - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

CODE
Size: 512B - Virtual size: 4KB

DATA
Size: - Virtual size: 8KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

CODE
Size: 512B - Virtual size: 4KB

DATA
Size: 512B - Virtual size: 4KB

.idata
Size: 512B - Virtual size: 4KB

.reloc
Size: 512B - Virtual size: 4KB

.upx
Size: - Virtual size: 60KB

.upx
Size: 25KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 4KB

.data
Size: 45KB - Virtual size: 48KB

.data
Size: - Virtual size: 4KB