7cf7a0587ec36918a555f9658669d011_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7cf7a0587ec36918a555f9658669d011_JaffaCakes118
Size

760KB
MD5

7cf7a0587ec36918a555f9658669d011
SHA1

10b5cc8705eb22b00decdb84c19e359d54d93066
SHA256

caa3a3a20b6aa87b1634c043aff1e0fd0930830c5bacacffa3f88aa5cae569eb
SHA512

3d9346a29b98b1268ce092eeb2658393b8d52b6ffca302994718caaae1f5225d06a5f6303209dbefcc1ef7857da8a50c99a6d18aa27e592719873af3b9da9697
SSDEEP

12288:kyQBaG0fYWGjdJb8RkR2Rb0c0116UcKrPfTQJnmjvNeqNsLF:kbBfWGj7bcx011DTgnmjoqNsLF

Score

1^/10

Malware Config

Signatures

Files

7cf7a0587ec36918a555f9658669d011_JaffaCakes118
.dll windows:5 windows x86 arch:x86

3e196e61449ee01f7d55c8b0664afa2c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3a:fd:d7:b0:5c:64:a7:9a:6c:12:9c:da:89:de:21:a2
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/06/2016, 00:00

Not After

16/07/2018, 23:59

Subject

CN=Alibaba (China) Network Technology Co.\,Ltd.,OU=RDC,O=Alibaba (China) Network Technology Co.\,Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6f:0f:67:05:ac:03:84:65:e9:d0:f3:aa:79:0a:68:93
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/06/2016, 00:00

Not After

16/07/2018, 23:59

Subject

CN=Alibaba (China) Network Technology Co.\,Ltd.,OU=RDC,O=Alibaba (China) Network Technology Co.\,Ltd.,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c6:ff:00:92:8d:4a:5f:a2:a3:b6:ee:55:09:7e:1e:6c:f2:a7:0e:bd:76:f0:06:3d:7d:25:5a:b5:5f:2b:9a:55
Signer

Actual PE Digest

c6:ff:00:92:8d:4a:5f:a2:a3:b6:ee:55:09:7e:1e:6c:f2:a7:0e:bd:76:f0:06:3d:7d:25:5a:b5:5f:2b:9a:55

Digest Algorithm

sha256

PE Digest Matches

true

60:83:9d:53:be:37:08:25:4d:84:b0:5f:df:4e:61:61:39:48:30:7e
Signer

Actual PE Digest

60:83:9d:53:be:37:08:25:4d:84:b0:5f:df:4e:61:61:39:48:30:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SVN\install.v3\src\iku_git_v7.0_fabu\build_module_vs2013\bin\Publish\lib\ku_http.pdb

Imports

kernel32

GetProcAddress
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
WaitForSingleObject
SystemTimeToFileTime
GetTickCount
GetModuleHandleA
OutputDebugStringA
CreateFileA
FileTimeToSystemTime
GetLocalTime
LoadLibraryA
GetFileTime
GlobalAlloc
GlobalFree
VerSetConditionMask
GetCurrentProcess
VerifyVersionInfoW
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
GetCurrentThreadId
DeviceIoControl
GetModuleHandleW
RemoveDirectoryW
CreateFileW
DeleteFileW
QueryPerformanceCounter
GetCurrentProcessId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
InterlockedCompareExchange
TerminateThread
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
QueueUserAPC
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsSetValue
SetWaitableTimer
GetFileSize
WriteFile
SetFilePointer
InitializeCriticalSection
SleepEx
FormatMessageA
GetFileType
GetStdHandle
ReadFile
PeekNamedPipe
ExpandEnvironmentStringsA
LocalFree
OpenEventA
ResetEvent
ResumeThread
CreateWaitableTimerA
EncodePointer
HeapFree
HeapAlloc
GetProcessHeap
LoadLibraryW
GlobalMemoryStatusEx
GetModuleFileNameW
GetSystemTimeAsFileTime
Sleep
OutputDebugStringW
TlsGetValue
TlsFree
CloseHandle
TlsAlloc
PostQueuedCompletionStatus
InterlockedExchangeAdd
EnterCriticalSection
GetLastError
InterlockedExchange
LeaveCriticalSection
SetEvent
CreateEventA
InterlockedDecrement
InterlockedIncrement
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
GetFileAttributesW
AreFileApisANSI

user32

PostMessageW
GetSystemMetrics

advapi32

CryptDestroyHash
RegOpenKeyExW
RegCloseKey
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCreateKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysFreeString
SysAllocString

msvcp120

?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$numpunct@D@std@@2V0locale@2@A
?_Throw_C_error@std@@YAXH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
??_7facet@locale@std@@6B@
_Mtx_destroy
_Mtx_unlock
??_7_Facet_base@std@@6B@
_Mtx_lock
_Mtx_init
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
_Strcoll
_Strxfrm
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?uncaught_exception@std@@YA_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??_7?$codecvt@_WDH@std@@6B@
?_BADOFF@std@@3_JB
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Winerror_map@std@@YAPBDH@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A

ws2_32

recv
select
__WSAFDIsSet
WSAGetLastError
WSAIoctl
WSAStartup
WSACleanup
send
bind
closesocket
connect
getsockname
getsockopt
htons
ntohs
setsockopt
socket
WSASetLastError
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
htonl
ntohl
gethostname
getpeername

msvcr120

_strdup
_stricmp
_read
_write
_strnicmp
_close
_open
ferror
__clean_type_info_names_internal
_except_handler4_common
_except1
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_initterm_e
_initterm
_malloc_crt
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
memmove
??_V@YAXPAX@Z
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
_gmtime64
sprintf_s
sscanf
memchr
vswprintf_s
vsprintf_s
tolower
wcsrchr
_localtime64
_time64
_ftime64
_wfopen_s
_fseeki64
fread
fclose
strncmp
free
strchr
atoi
realloc
malloc
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
wcscat_s
wcscpy_s
isalnum
__iob_func
fflush
fgetc
fgetpos
fputc
fsetpos
fseek
fwrite
setvbuf
ungetc
_lock_file
_unlock_file
memcpy_s
strncpy
strrchr
strstr
rand
srand
_wmkdir
_waccess
_wfindfirst64i32
_wfindnext64i32
_findclose
ftell
_localtime64_s
_itow_s
_wtoi
_wtoi64
isxdigit
strlen
strtoul
_wcsdup
calloc
strcpy
isdigit
sprintf
strtol
strcmp
fgets
fopen
fputs
qsort
strtoll
wcschr
wcslen
wcsncpy
_errno
isalpha
memcmp
isspace
strerror
__sys_nerr
_beginthreadex
_lseeki64
_fstat64
getenv
_stat64
isupper
islower
isprint
isgraph
?terminate@@YAXXZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit

wininet

InternetOpenW
InternetTimeToSystemTimeA
InternetCloseHandle
InternetConnectW
InternetReadFile
InternetSetOptionW
HttpOpenRequestW
HttpSendRequestW
HttpQueryInfoA
HttpQueryInfoW

iphlpapi

GetAdaptersInfo

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

??0CCurlWrapper@@QAE@ABV0@@Z
??0CCurlWrapper@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0CCurlWrapper@@QAE@XZ
??0KErrorReportHelper@ku_http@@QAE@XZ
??0big_data_Log@@QAE@ABV0@@Z
??0big_data_Log@@QAE@XZ
??0youku_file_downloader@@QAE@XZ
??1CCurlWrapper@@QAE@XZ
??1KErrorReportHelper@ku_http@@QAE@XZ
??1big_data_Log@@UAE@XZ
??1youku_file_downloader@@QAE@XZ
??4?$Singleton@Vbig_data_Log@@@common@ku@@QAEAAV012@ABV012@@Z
??4CCurlWrapper@@QAEAAV0@ABV0@@Z
??4KErrorReportHelper@ku_http@@QAEAAV01@ABV01@@Z
??4big_data_Log@@QAEAAV0@ABV0@@Z
??4youku_file_downloader@@QAEAAV0@ABV0@@Z
??BCCurlWrapper@@QBEPAXXZ
??_7CCurlWrapper@@6B@
??_7big_data_Log@@6B@
?AddHeader@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?AddResolve@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ConnectionTimeout@CCurlWrapper@@QAEAAV1@J@Z
?EasyPerform@CCurlWrapper@@IAEHXZ
?FileMD5@youku_file_downloader@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@@Z
?FollowLocation@CCurlWrapper@@QAEAAV1@H@Z
?GetCookie@CCurlWrapper@@QAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?GetErrorCode@CCurlWrapper@@QAEHXZ
?GetResponseCode@CCurlWrapper@@QAEJXZ
?HeaderFunction@youku_file_downloader@@KAIPAXII0@Z
?HeaderFunctionCallback@CCurlWrapper@@KAIPAXII0@Z
?MaxSpeed@CCurlWrapper@@QAEAAV1@I@Z
?NoSignal@CCurlWrapper@@QAEAAV1@XZ
?PostBinary@CCurlWrapper@@QAEAAV1@PBDH@Z
?PostFields@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?ProgressFunction@youku_file_downloader@@KAHPAXNNNN@Z
?ProgressFunctionCallback@CCurlWrapper@@KAHPAXNNNN@Z
?SetAccept@CCurlWrapper@@QAEAAV1@XZ
?SetAcceptGZip@CCurlWrapper@@QAEAAV1@XZ
?SetCookie@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetJson@CCurlWrapper@@QAEAAV1@XZ
?SetMAXREDIRS@CCurlWrapper@@QAEAAV1@H@Z
?SetProxy@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetRange@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetReferer@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?SetResolve@CCurlWrapper@@QAEAAV1@XZ
?SetupHeaderFunction@CCurlWrapper@@QAEAAV1@XZ
?SetupProgressFunction@CCurlWrapper@@QAEAAV1@XZ
?SetupSSLFunction@CCurlWrapper@@QAEAAV1@_N@Z
?SetupWriteFunction@CCurlWrapper@@QAEAAV1@XZ
?SockoptCallback@CCurlWrapper@@KAHPAXIW4curlsocktype@@@Z
?StartCookieEngine@CCurlWrapper@@QAEAAV1@XZ
?StartCookieEngineEX@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Timeout@CCurlWrapper@@QAEAAV1@J@Z
?UserAgent@CCurlWrapper@@QAEAAV1@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?WriteFunction@youku_file_downloader@@KAIPAXII0@Z
?WriteFunctionCallback@CCurlWrapper@@KAIPAXII0@Z
?__autoclassinit2@CCurlWrapper@@QAEXI@Z
?__autoclassinit2@big_data_Log@@QAEXI@Z
?add_qplay_dot_time@ku_http@@YAXW4QPlayDotTimeState@ku_qplay_track@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add_qplay_dot_time@ku_http@@YAXW4QPlayDotTimeState@ku_qplay_track@@_KABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?add_qplay_span_time@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_K@Z
?add_qplay_span_time@ku_http@@YAXW4QPlaySpanTimeState@ku_qplay_track@@_K@Z
?build_common_param@KErrorReportHelper@ku_http@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?calc_md5@KErrorReportHelper@ku_http@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV34@@Z
?change_user_flag@big_data_Log@@QAEXXZ
?download@youku_file_downloader@@QAEXV?$shared_ptr@UDownloadParam@ku_downloader@@@std@@@Z
?errordeal_report@KErrorReportHelper@ku_http@@SAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000@Z
?errordealdll_handle@KErrorReportHelper@ku_http@@2PAXA
?errordealdll_reporterror_fun@KErrorReportHelper@ku_http@@2P6AHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000@ZA
?finish_report@big_data_Log@@QAEXXZ
?get_already_send_show@big_data_Log@@QAE_NXZ
?get_avail_mem@log_util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_cache_file@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBD@Z
?get_cpu@log_util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_iku_pid@KErrorReportHelper@ku_http@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_iku_rid@KErrorReportHelper@ku_http@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_loc_mac_addr@KErrorReportHelper@ku_http@@KA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_mem@log_util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?get_partner@log_util@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PB_W@Z
?get_reg_table@big_data_Log@@QAE_NXZ
?get_show_desktop@big_data_Log@@QAE_NXZ
?get_start_reason@big_data_Log@@QAE?AW4STARTREASON@@XZ
?instance@?$Singleton@Vbig_data_Log@@@common@ku@@SAPAVbig_data_Log@@XZ
?instance@?$Singleton@Vbig_data_Log@@@common@ku@@SAXPAVbig_data_Log@@_N@Z
?ku_report_event_info_logex@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@0_N@Z
?mutex_@KErrorReportHelper@ku_http@@2Vrecursive_mutex@std@@A
?object_mutex_@?$Singleton@Vbig_data_Log@@@common@ku@@1Vmutex@std@@A
?remove_cache_file@@YAXPBD@Z
?report_bigdata_capture@big_data_Log@@QAEXAAUCaptureInformation@@_N@Z
?report_bigdata_initial@big_data_Log@@QAEXW4LOGTYPE@@W4APPNAME@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N22W4STARTREASON@@23@Z
?report_crash_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@_N@Z
?report_download_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000000_N@Z
?report_event_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000_N@Z
?report_event_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@_N@Z
?report_ikulog_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V34@_N@Z
?report_interface_error@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000000_N@Z
?report_monitor_downloadinfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000000_N@Z
?report_monitor_eventinfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000_N@Z
?report_monitor_eventinfo_to_golden_arrow@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z
?report_monitor_feedback@KErrorReportHelper@ku_http@@SA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@0_N@Z
?report_monitor_feedback@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@0_N@Z
?report_monitor_ikuloginfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V23@_N@Z
?report_monitor_playinfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000000_N@Z
?report_monitor_upload@KErrorReportHelper@ku_http@@SA_NABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@_N@Z
?report_monitor_upload@ku_http@@YAXABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@_N@Z
?report_monitro_crashinfo@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z
?report_play_info_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@000000_N@Z
?report_qplay_event_track_log@KErrorReportHelper@ku_http@@SAHABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@_N@Z
?report_qplay_event_track_log@ku_http@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0000000ABV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@_N@Z
?report_ut_initial@big_data_Log@@QAEXW4LOGTYPE@@W4APPNAME@@_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@3W4STARTREASON@@32V?$function@$$A6AXV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@0@Z@5@@Z
?save_initial_to_localfile@big_data_Log@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?send_initial_localfile@big_data_Log@@QAEXXZ
?setNewPostFlag@CCurlWrapper@@QAEXH@Z
?set_already_send_show@big_data_Log@@QAEX_N@Z
?set_ans_loc_get_func@ku_http@@YAXP6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@Z
?set_api_user_agent@ku_http@@YAXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_peerid_get_func@ku_http@@YAXP6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z@Z
?set_player_ver@big_data_Log@@QAEXV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_qplay_state@ku_http@@YAX_N0@Z
?set_reg_table@big_data_Log@@QAEX_N@Z
?set_show_desktop@big_data_Log@@QAEX_N@Z
?set_ssl_get_func@@YAXP6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@2@ABI2_N@Z@Z
?set_ssl_post_func@@YAXP6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV12@0ABV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@2@ABI2_N@Z@Z
?set_start_reason@big_data_Log@@QAEXW4STARTREASON@@@Z
?singleton_@?$Singleton@Vbig_data_Log@@@common@ku@@1V?$Smart_Pointer@Vbig_data_Log@@@23@A
?strLocation@KErrorReportHelper@ku_http@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@A
ku_http_download
ku_http_get
ku_http_get_async
ku_http_post
ku_http_post_async
report_event_info_logex
report_monitro_error
set_iku_mver

Sections

.text
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e196e61449ee01f7d55c8b0664afa2c

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7Certificate

Key Usages

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14Certificate

Extended Key Usages

Key Usages

3a:fd:d7:b0:5c:64:a7:9a:6c:12:9c:da:89:de:21:a2Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

6f:0f:67:05:ac:03:84:65:e9:d0:f3:aa:79:0a:68:93Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

c6:ff:00:92:8d:4a:5f:a2:a3:b6:ee:55:09:7e:1e:6c:f2:a7:0e:bd:76:f0:06:3d:7d:25:5a:b5:5f:2b:9a:55Signer

60:83:9d:53:be:37:08:25:4d:84:b0:5f:df:4e:61:61:39:48:30:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

msvcp120

ws2_32

msvcr120

wininet

iphlpapi

version

Exports

Exports

Sections

.text Size: 573KB - Virtual size: 572KB

.rdata Size: 131KB - Virtual size: 131KB

.data Size: 9KB - Virtual size: 11KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 31KB - Virtual size: 30KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

3a:fd:d7:b0:5c:64:a7:9a:6c:12:9c:da:89:de:21:a2
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

6f:0f:67:05:ac:03:84:65:e9:d0:f3:aa:79:0a:68:93
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

c6:ff:00:92:8d:4a:5f:a2:a3:b6:ee:55:09:7e:1e:6c:f2:a7:0e:bd:76:f0:06:3d:7d:25:5a:b5:5f:2b:9a:55
Signer

60:83:9d:53:be:37:08:25:4d:84:b0:5f:df:4e:61:61:39:48:30:7e
Signer

.text
Size: 573KB - Virtual size: 572KB

.rdata
Size: 131KB - Virtual size: 131KB

.data
Size: 9KB - Virtual size: 11KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 31KB - Virtual size: 30KB