6c557afab720026057a6c6e89f5b540e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6c557afab720026057a6c6e89f5b540e_JaffaCakes118
Size

1.7MB
MD5

6c557afab720026057a6c6e89f5b540e
SHA1

1aa08091b8825e86ec018d905093287f49dcf85e
SHA256

c828d89875c3d7835e8600c897e7d62b00102a2552bf1d3d5a7c8ad9f46bdce1
SHA512

1befbd722b3a38dfa5478cf9caf0bc712d46d712ef282f00a78bf04f55498d05b0bfb03c1e56701c744627077b464ffd49a865df675a89c7b72f9650fd57272f
SSDEEP

49152:enznoqNIrL5zs+44LYVn/ATlAsK4q4Ul1:2noqNIrL5zs+44k5/h

Score

1^/10

Malware Config

Signatures

Files

6c557afab720026057a6c6e89f5b540e_JaffaCakes118
.dll windows:5 windows x86 arch:x86

1b3c2749004929136b0e6feeb332b973

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

26:f7:d9:5c:5b:27:8c:db:26:58:80:5e:08:76:75:ff
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28/06/2018, 00:00

Not After

27/08/2019, 23:59

Subject

CN=Alibaba (China) Network Technology Co.\,Ltd.,OU=RDC,O=Alibaba (China) Network Technology Co.\,Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:a9:31:8d:11:5f:7c:a2:5c:65:ce:4d:48:dd:2c:cf
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

29/06/2018, 00:00

Not After

28/08/2019, 23:59

Subject

CN=Alibaba (China) Network Technology Co.\,Ltd.,OU=RDC,O=Alibaba (China) Network Technology Co.\,Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4b:f5:9b:03:75:d9:f1:48:91:04:28:ab:5b:03:99:db:cf:9f:e4:08:4d:02:d0:b5:c1:79:20:29:d6:f7:26:95
Signer

Actual PE Digest

4b:f5:9b:03:75:d9:f1:48:91:04:28:ab:5b:03:99:db:cf:9f:e4:08:4d:02:d0:b5:c1:79:20:29:d6:f7:26:95

Digest Algorithm

sha256

PE Digest Matches

true

d5:08:e8:40:d0:09:87:35:80:1d:e7:7f:01:bb:9d:fe:36:4d:3c:f8
Signer

Actual PE Digest

d5:08:e8:40:d0:09:87:35:80:1d:e7:7f:01:bb:9d:fe:36:4d:3c:f8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SVN\install.v3\src\iku_git_v7.0_fabu\build_module_vs2013\bin\Publish\lib\download.pdb

Imports

gdi32

GetDeviceCaps

psapi

GetProcessMemoryInfo

ku_openapi

set_openapi_external
OpenApiRequest

ku_http

?GetResponseCode@CCurlWrapper@@QAEJXZ
??1CCurlWrapper@@QAE@XZ
??0CCurlWrapper@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?get_partner@log_util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
ku_http_get
?report_monitor_downloadinfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000000_N@Z
?FollowLocation@CCurlWrapper@@QAEAAV1@H@Z
?EasyPerform@CCurlWrapper@@IAEHXZ
?MaxSpeed@CCurlWrapper@@QAEAAV1@I@Z
?StartCookieEngine@CCurlWrapper@@QAEAAV1@XZ

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

kernel32

PostQueuedCompletionStatus
TlsAlloc
TlsFree
GetTickCount
GetSystemTimeAsFileTime
GetProcAddress
GetModuleHandleA
WideCharToMultiByte
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LoadLibraryW
DecodePointer
FreeLibrary
HeapDestroy
HeapReAlloc
HeapSize
GetProcessHeap
HeapFree
SetWaitableTimer
TlsGetValue
SleepEx
CreateEventW
HeapAlloc
CreateWaitableTimerW
UnmapViewOfFile
QueryPerformanceCounter
MultiByteToWideChar
ResetEvent
Sleep
GetCurrentProcess
CreateJobObjectW
SetInformationJobObject
CreateProcessW
AssignProcessToJobObject
OutputDebugStringW
OutputDebugStringA
SystemTimeToFileTime
GetSystemTime
GetProcessTimes
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
LocalFree
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
GetCurrentProcessId
TlsSetValue
CreateIoCompletionPort
VerifyVersionInfoW
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
InterlockedCompareExchange
SetLastError
FreeResource
LockResource
GlobalMemoryStatusEx
LoadResource
SizeofResource
GetLogicalDrives
DeviceIoControl
GetSystemInfo
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GetModuleHandleW
FindResourceW
GetDriveTypeW
GetSystemDirectoryW
GetTempPathW
GetDiskFreeSpaceExW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
FindFirstFileA
CopyFileW
MoveFileExW
GetACP
SetConsoleCtrlHandler
AllocConsole
FreeConsole
SetConsoleTitleW
SetConsoleOutputCP
GlobalAlloc
GlobalFree
GetFileSize
WriteFile
SetFilePointer
InitializeCriticalSection
FormatMessageA
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
FindResourceExW
GetCurrentDirectoryW
CreateDirectoryW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
OpenEventA
InterlockedExchangeAdd
EnterCriticalSection
GetLastError
InterlockedExchange
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
SetEvent
GetCurrentThreadId
CreateEventA
WaitForSingleObject
CloseHandle
ReleaseSemaphore
ResumeThread
CreateWaitableTimerA
CreateSemaphoreA
DuplicateHandle
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
lstrlenA

user32

wsprintfW
GetDC
ReleaseDC
ExitWindowsEx
PostMessageW

advapi32

RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
OpenProcessToken
RegCreateKeyExW
CheckTokenMembership
CreateWellKnownSid
GetTokenInformation
RegQueryValueExA
SetNamedSecurityInfoA
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCloseKey

shell32

ord680
SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoInitializeEx
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

msvcp120

?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
??_7?$basic_ios@_WU?$char_traits@_W@std@@@std@@6B@
?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AAVios_base@2@_WPBUtm@@PB_W4@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Mtx_destroy
_Mtx_init
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?id@?$numpunct@D@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
??_7facet@locale@std@@6B@
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_BADOFF@std@@3_JB
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?good@ios_base@std@@QBE_NXZ
?width@ios_base@std@@QAE_J_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?flags@ios_base@std@@QBEHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?width@ios_base@std@@QBE_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
_FNan
_FInf
??Bios_base@std@@QBE_NXZ
?setf@ios_base@std@@QAEHHH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?flags@ios_base@std@@QAEHH@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??_7?$basic_ostream@_WU?$char_traits@_W@std@@@std@@6B@
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
_Mbrtowc
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?exceptions@ios_base@std@@QAEXH@Z
?unsetf@ios_base@std@@QAEXH@Z
?precision@ios_base@std@@QAE_J_J@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@DD@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
_Inf
_Nan
?id@?$codecvt@DDH@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?clog@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?_Xbad_function_call@std@@YAXXZ
?widen@?$ctype@_W@std@@QBE_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??_7_Facet_base@std@@6B@
_Mtx_lock

ws2_32

select
connect
htonl
ntohs
getsockopt
ioctlsocket
setsockopt
getpeername
bind
freeaddrinfo
recvfrom
sendto
gethostname
getaddrinfo
htons
socket
getsockname
WSACleanup
WSAStartup
WSAAddressToStringW
WSAGetLastError
WSASetLastError
ntohl
closesocket
WSAStringToAddressW
listen
accept
recv
__WSAFDIsSet
WSAIoctl
send

msvcr120

_wtoi
_close
_strnicmp
_write
_read
_wcsnicmp
_strdup
_except_handler4_common
_except1
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_malloc_crt
_amsg_exit
__CppXcptFilter
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
iswdigit
_aligned_malloc
_aligned_free
??3@YAXPAX@Z
??2@YAPAXI@Z
memmove
_time64
srand
rand
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_purecall
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??_V@YAXPAX@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_gmtime64
memchr
sprintf
free
malloc
_beginthreadex
fprintf
__iob_func
fopen
fread
fclose
?terminate@@YAXXZ
vsprintf_s
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??8type_info@@QBE_NABV0@@Z
??0exception@std@@QAE@XZ
isspace
isdigit
tolower
_localtime64
_wrmdir
_wfopen_s
fwrite
_wfopen
sprintf_s
atoi
_fseeki64
strncmp
strncpy
strtol
strstr
strchr
realloc
sscanf
swprintf_s
_localtime64_s
toupper
printf
_ftelli64
strpbrk
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
modf
fseek
calloc
ftell
strtoul
fflush
fgetc
fgetpos
fputc
freopen
fsetpos
setvbuf
ungetc
_vswprintf_c_l
_wremove
_lock_file
_unlock_file
memcmp
memcpy_s
strcmp
strlen
strrchr
wcscmp
wcscpy_s
wcslen
_wcsicmp
abs
atof
_strtoui64
_wchdir
_wmkdir
_waccess
_wrename
_wfindfirst64i32
_wfindnext64i32
?before@type_info@@QBE_NABV1@@Z
_findclose
__RTDynamicCast
isalnum
wcscat_s
_itow_s
_open
_wtoi64
feof
ferror
_wcsdup
fgets
fputs
qsort
strtoll
wcschr
wcsncpy
_errno
isalpha
isxdigit
strcpy
strerror
__sys_nerr
_lseeki64
_fstat64
_stat64
isupper
islower
isprint
isgraph
memmove_s
_recalloc
wprintf
wcsnlen
wmemcpy_s
_stricmp
abort

shlwapi

PathAppendW
PathFileExistsW
PathRemoveFileSpecW

iphlpapi

GetAdaptersInfo

wininet

InternetTimeFromSystemTimeA
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetFilePointer
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
HttpQueryInfoW
InternetSetCookieA
InternetTimeToSystemTimeA

Exports

Exports

IKUStartup

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 245KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b3c2749004929136b0e6feeb332b973

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

26:f7:d9:5c:5b:27:8c:db:26:58:80:5e:08:76:75:ffCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5c:a9:31:8d:11:5f:7c:a2:5c:65:ce:4d:48:dd:2c:cfCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

4b:f5:9b:03:75:d9:f1:48:91:04:28:ab:5b:03:99:db:cf:9f:e4:08:4d:02:d0:b5:c1:79:20:29:d6:f7:26:95Signer

d5:08:e8:40:d0:09:87:35:80:1d:e7:7f:01:bb:9d:fe:36:4d:3c:f8Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

psapi

ku_openapi

ku_http

version

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp120

ws2_32

msvcr120

shlwapi

iphlpapi

wininet

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 245KB - Virtual size: 245KB

.data Size: 55KB - Virtual size: 58KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 71KB - Virtual size: 70KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

26:f7:d9:5c:5b:27:8c:db:26:58:80:5e:08:76:75:ff
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5c:a9:31:8d:11:5f:7c:a2:5c:65:ce:4d:48:dd:2c:cf
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

4b:f5:9b:03:75:d9:f1:48:91:04:28:ab:5b:03:99:db:cf:9f:e4:08:4d:02:d0:b5:c1:79:20:29:d6:f7:26:95
Signer

d5:08:e8:40:d0:09:87:35:80:1d:e7:7f:01:bb:9d:fe:36:4d:3c:f8
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 245KB - Virtual size: 245KB

.data
Size: 55KB - Virtual size: 58KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 71KB - Virtual size: 70KB