7628efc5849c4d32130a44b2f7efa024_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7628efc5849c4d32130a44b2f7efa024_JaffaCakes118
Size

3.6MB
MD5

7628efc5849c4d32130a44b2f7efa024
SHA1

c08a0b853b038c1a2c23ce83a5060c89db32f843
SHA256

8ea0999da5946d26b92a5dccd33ffc896f683cfbcd5cd6d72b5418d8b6a2928c
SHA512

c65db82fd25e741e1b9a5ae7aace891785ce732827a35fe9588f656130f0e7ff2f1f5509385740584f218e7c6f11b8cac1ef1bb8e90555a8153fb766a49b6021
SSDEEP

49152:coa/9QsKgJzIxYGI9vYn6jvqxkMQfpBbW4D7mT35H6NMazAPYsG9QeIHj2Ih:coa/VKKzIxYGI9wngvwQh1PyIiYM

Score

1^/10

Malware Config

Signatures

Files

7628efc5849c4d32130a44b2f7efa024_JaffaCakes118
.exe windows:5 windows x86 arch:x86

11312555b1f6b6eee4f217158672ec34

Code Sign

60:bc:17:a0:63:d1:09:a9:0e:f3:61:6b:5f:10:53:3d
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Not Before

06/04/2016, 03:19

Not After

06/01/2018, 03:19

Subject

CN=合一网络技术（北京）有限公司,O=合一网络技术（北京）有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Class 3 Code Signing CA,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1f:6f:04:d2:13:44:d0:37:09:e8:c1:9c:c7:ed:12:b5
Certificate

Issuer

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Not Before

06/04/2016, 03:28

Not After

06/01/2018, 03:28

Subject

CN=合一网络技术（北京）有限公司,O=合一网络技术（北京）有限公司,L=北京市,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftKernelCodeSigning

Key Usages

KeyUsageDigitalSignature

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/11/2014, 00:58

Not After

08/11/2029, 00:58

Subject

CN=WoSign Class 3 Code Signing CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:78:b9:18:63:31:f8:d5:be:32:56:c5:3a:2b:c6:20:36:e1:8f:f5:8e:dc:2f:66:93:b8:7a:b3:6b:c1:3c:47
Signer

Actual PE Digest

0e:78:b9:18:63:31:f8:d5:be:32:56:c5:3a:2b:c6:20:36:e1:8f:f5:8e:dc:2f:66:93:b8:7a:b3:6b:c1:3c:47

Digest Algorithm

sha256

PE Digest Matches

true

5c:05:cb:51:89:a8:20:49:28:6b:cc:0a:96:54:ce:7c:29:a2:18:bd
Signer

Actual PE Digest

5c:05:cb:51:89:a8:20:49:28:6b:cc:0a:96:54:ce:7c:29:a2:18:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVN\install.v3\src\ikucmc_v700\build_vs2013\bin\Publish\YoukuDesktop.pdb

Imports

user32

GetSystemMetrics
LoadStringA
SendMessageTimeoutW
PostThreadMessageW
PeekMessageW
GetMessageW
ExitWindowsEx
PostMessageW
FindWindowW
wsprintfW

psapi

GetModuleFileNameExW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW

advapi32

CheckTokenMembership
GetTokenInformation
RegOpenKeyA
RegDeleteValueA
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExA
RegSetValueA
GetUserNameA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegQueryValueExA
SetNamedSecurityInfoA
CreateWellKnownSid

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHChangeNotify
ord680
ShellExecuteW

ole32

CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

msvcp120

?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?eof@ios_base@std@@QBE_NXZ
?fail@ios_base@std@@QBE_NXZ
?bad@ios_base@std@@QBE_NXZ
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@_W@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
_Mbrtowc
?id@?$numpunct@_W@std@@2V0locale@2@A
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??_7?$codecvt@_WDH@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7codecvt_base@std@@6B@
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?do_length@?$codecvt@_WDH@std@@MBEHAAHPBD1I@Z
??1?$codecvt@_WDH@std@@MAE@XZ
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Orphan_all@_Container_base12@std@@QAEXXZ
??1_Container_base12@std@@QAE@XZ
_FInf
_FNan
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?get@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?ws@std@@YAAAV?$basic_istream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
?_Xbad_function_call@std@@YAXXZ
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy
_Mtx_init
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setf@ios_base@std@@QAEHH@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0_Container_base12@std@@QAE@XZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setf@ios_base@std@@QAEHHH@Z
?flags@ios_base@std@@QAEHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_BADOFF@std@@3_JB
_Nan
_Inf
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?precision@ios_base@std@@QAE_J_J@Z
?unsetf@ios_base@std@@QAEXH@Z
?flags@ios_base@std@@QBEHXZ
?exceptions@ios_base@std@@QAEXH@Z
?good@ios_base@std@@QBE_NXZ
??Bios_base@std@@QBE_NXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?uncaught_exception@std@@YA_NXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
??0id@locale@std@@QAE@I@Z
??Bid@locale@std@@QAEIXZ
?_Incref@facet@locale@std@@UAEXXZ
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?classic@locale@std@@SAABV12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xlength_error@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Winerror_map@std@@YAPBDH@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z

ws2_32

WSAAddressToStringW
shutdown
WSAStringToAddressW
gethostname
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
ntohs
getsockname
getpeername
ioctlsocket
WSASend
WSAGetLastError
setsockopt
WSASetLastError
closesocket
WSAStartup
WSACleanup
getsockopt
htons
select
WSASocketW
WSARecv
htonl
bind
__WSAFDIsSet
inet_ntoa
inet_addr
recv
socket
gethostbyname
send
connect
ntohl

msvcr120

_open
_wcsdup
fgets
fputs
qsort
strtoll
wcschr
wcsncpy
_errno
isalpha
isxdigit
strtoul
__sys_nerr
_lseeki64
_fstat64
_stat64
isupper
islower
isprint
_ftelli64
modf
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
_except1
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
_onexit
calloc
strtol
strchr
ispunct
_wcsnicmp
__dllonexit
_calloc_crt
_unlock
_lock
strncpy_s
_wtol
wcstod
strcpy
_set_invalid_parameter_handler
iswdigit
_vscprintf
iswspace
towlower
getenv
_strnicmp
_findfirst64i32
_wsplitpath
wcsstr
_findnext64i32
vswprintf_s
isdigit
isspace
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
??0exception@std@@QAE@XZ
_stricmp
strerror
strcat_s
wcscat_s
_strdup
_vsnprintf_s
_atoi64
?terminate@@YAXXZ
strftime
fopen
ferror
realloc
feof
strncmp
sprintf
fprintf
_localtime64_s
ftell
_wtoi64
_wtoi
_itow_s
wcscpy
wcscat
__RTDynamicCast
sprintf_s
_findclose
_time64
_localtime64
tolower
toupper
_wfindnext64i32
_wfindfirst64i32
_wrename
_waccess
_wrmdir
_wmkdir
_wchdir
malloc
free
srand
rand
_strtoui64
atoi
atof
abs
_wcsicmp
wcscpy_s
wcscmp
strrchr
strncpy
memcpy_s
_unlock_file
_lock_file
_wremove
_wfopen_s
_vswprintf_c_l
swprintf_s
ungetc
sscanf
setvbuf
printf
fwrite
_fseeki64
fseek
fsetpos
freopen
fread
fputc
fgetpos
fgetc
fflush
fclose
__iob_func
__CxxFrameHandler3
_CxxThrowException
isalnum
memset
vsprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
strcmp
strcpy_s
??_V@YAXPAX@Z
_beginthreadex
vsprintf_s
_wassert
wcslen
_exit
memchr
strstr
strlen
memcmp
memmove
??8type_info@@QBE_NABV0@@Z
_gmtime64
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
memcpy
_vsnprintf
_read
_write
_close
isgraph

iphlpapi

GetAdaptersInfo
NotifyAddrChange

oleaut32

VariantInit
SysStringLen
SysAllocString
VariantClear
SysFreeString

wininet

InternetOpenW
InternetCloseHandle
InternetTimeToSystemTimeA
InternetTimeFromSystemTimeA
InternetReadFile
InternetConnectW
InternetSetCookieA
HttpQueryInfoW
HttpQueryInfoA
HttpSendRequestW
HttpOpenRequestW
InternetSetOptionW
InternetSetFilePointer

kernel32

CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
SystemTimeToFileTime
GetSystemTime
SetFilePointer
WriteFile
GetFileSize
GlobalFree
GlobalAlloc
VerifyVersionInfoW
TlsSetValue
WaitForMultipleObjects
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
QueueUserAPC
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
TerminateThread
InterlockedCompareExchange
VerSetConditionMask
LoadLibraryA
OpenMutexW
CreateMutexW
ReadProcessMemory
GetCurrentProcessId
GetProcessHeap
HeapFree
HeapAlloc
SetConsoleOutputCP
SetConsoleTitleW
FreeConsole
AllocConsole
SetConsoleCtrlHandler
GetACP
SetInformationJobObject
AssignProcessToJobObject
CreateJobObjectW
MoveFileExW
CopyFileW
FindNextFileW
FindFirstFileW
FindFirstFileA
CreateFileW
GetDiskFreeSpaceExW
GetTempPathW
GetSystemDirectoryW
GetDriveTypeW
FindResourceW
OutputDebugStringW
CreateProcessW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
FileTimeToSystemTime
FileTimeToLocalFileTime
FindClose
DeviceIoControl
GetLogicalDrives
SizeofResource
LoadResource
Sleep
LockResource
OpenFileMappingA
GetLocalTime
MultiByteToWideChar
GetSystemInfo
CloseHandle
TlsAlloc
OutputDebugStringA
GetCurrentThreadId
CreateToolhelp32Snapshot
CreateWaitableTimerW
Process32NextW
Module32FirstW
PostQueuedCompletionStatus
CreateEventW
InterlockedExchangeAdd
Process32FirstW
EnterCriticalSection
GetProcAddress
GetLastError
InterlockedExchange
TerminateProcess
LeaveCriticalSection
GetSystemTimeAsFileTime
SetEvent
WaitForSingleObject
GetCurrentProcess
CreateEventA
LoadLibraryW
OpenProcess
SleepEx
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
SetWaitableTimer
FreeLibrary
TlsGetValue
GetVersionExA
QueryPerformanceFrequency
ReleaseMutex
DeleteFileA
GetModuleHandleA
GetEnvironmentVariableW
GetThreadContext
GetFileAttributesW
GetEnvironmentVariableA
GetModuleFileNameA
GetCurrentDirectoryA
ExpandEnvironmentStringsA
PeekNamedPipe
GetStdHandle
GetFileType
GetThreadLocale
DuplicateHandle
CreateSemaphoreA
LocalFree
SuspendThread
ResumeThread
FormatMessageA
OpenEventA
ReleaseSemaphore
ResetEvent
CreateWaitableTimerA
FreeResource
DeleteFileW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
GetVersionExW
IsWow64Process
lstrcatW
ReadFile
GetExitCodeProcess
GetStartupInfoW
CreatePipe
EncodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
lstrlenA
CreateFileA
LCMapStringA
GetUserDefaultLCID
GetStringTypeExA
DecodePointer
GlobalMemoryStatus
VirtualQuery
SetUnhandledExceptionFilter
GetCurrentThread
TlsFree
WideCharToMultiByte
InitializeCriticalSection

shlwapi

PathCanonicalizeA

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 590KB - Virtual size: 589KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 98KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 359KB - Virtual size: 359KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

11312555b1f6b6eee4f217158672ec34

Code Sign

60:bc:17:a0:63:d1:09:a9:0e:f3:61:6b:5f:10:53:3dCertificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79Certificate

Extended Key Usages

Key Usages

1f:6f:04:d2:13:44:d0:37:09:e8:c1:9c:c7:ed:12:b5Certificate

Extended Key Usages

Key Usages

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54Certificate

Extended Key Usages

Key Usages

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4cCertificate

Extended Key Usages

Key Usages

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91Certificate

Key Usages

0e:78:b9:18:63:31:f8:d5:be:32:56:c5:3a:2b:c6:20:36:e1:8f:f5:8e:dc:2f:66:93:b8:7a:b3:6b:c1:3c:47Signer

5c:05:cb:51:89:a8:20:49:28:6b:cc:0a:96:54:ce:7c:29:a2:18:bdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

psapi

version

advapi32

shell32

ole32

msvcp120

ws2_32

msvcr120

iphlpapi

oleaut32

wininet

kernel32

shlwapi

Sections

.text Size: 2.5MB - Virtual size: 2.5MB

.rdata Size: 590KB - Virtual size: 589KB

.data Size: 98KB - Virtual size: 116KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 359KB - Virtual size: 359KB

.reloc Size: 116KB - Virtual size: 116KB

60:bc:17:a0:63:d1:09:a9:0e:f3:61:6b:5f:10:53:3d
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

46:bb:b3:40:fa:b9:c1:79:28:93:8c:93:da:10:86:79
Certificate

1f:6f:04:d2:13:44:d0:37:09:e8:c1:9c:c7:ed:12:b5
Certificate

37:a6:0e:92:5f:23:f8:0c:fd:cd:97:65:92:98:c3:54
Certificate

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

0e:78:b9:18:63:31:f8:d5:be:32:56:c5:3a:2b:c6:20:36:e1:8f:f5:8e:dc:2f:66:93:b8:7a:b3:6b:c1:3c:47
Signer

5c:05:cb:51:89:a8:20:49:28:6b:cc:0a:96:54:ce:7c:29:a2:18:bd
Signer

.text
Size: 2.5MB - Virtual size: 2.5MB

.rdata
Size: 590KB - Virtual size: 589KB

.data
Size: 98KB - Virtual size: 116KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 359KB - Virtual size: 359KB

.reloc
Size: 116KB - Virtual size: 116KB