7ff647cc2b30ee79dae8ba7838806284_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7ff647cc2b30ee79dae8ba7838806284_JaffaCakes118
Size

2.6MB
MD5

7ff647cc2b30ee79dae8ba7838806284
SHA1

1300bdd8c4bf793ebfb809a3f8c2ea57ac5479a6
SHA256

8a321a6d2c288d6694b9a89d5fd6a91a32b71678a4b2760246f11a0499c6fa52
SHA512

69ed88620e88a44a1106d50e315beafc4cbbffd36b310be759ccd6aafb5712d4bd8ad84c2b3dff0ae805571e0b70a695e5fd26930d9b26fd6d9d3f8cc88447fa
SSDEEP

24576:Vwl50mZAHWX/OVrnuFNLkvfu3KNjA/h6IgTG1AaMLmvIvimy4MRFsh9Q:GEdrjuFKu3KN07gTGejyvIvBy3RFsh9Q

Score

1^/10

Malware Config

Signatures

Files

7ff647cc2b30ee79dae8ba7838806284_JaffaCakes118
.exe regsvr32 windows:4 windows x86 arch:x86

3a1ea4f3cca5af8662ac1949d1813a91

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

70:be:76:8a:40:b6:9f:8f:81:bf:31:fe:04:7f:1c:cb:46:61:01:94
Signer

Actual PE Digest

70:be:76:8a:40:b6:9f:8f:81:bf:31:fe:04:7f:1c:cb:46:61:01:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\jenkins\workspace\Main_Build_ReservedNum\qqpcmgr_proj\Basic\Output\BinFinal\QQPCMgr.pdb

Imports

ximage

?GetHeight@CxImage@@QBEKXZ
?GetWidth@CxImage@@QBEKXZ
?Encode@CxImage@@QAE_NPAVCxFile@@K@Z
?Resample@CxImage@@QAE_NJJHPAV1@@Z
??0CxImage@@QAE@PB_WK@Z
?Save@CxImage@@QAE_NPB_WK@Z
??0CxImage@@QAE@K@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z
?IsValid@CxImage@@QBE_NXZ
?GetType@CxImage@@QBEKXZ
?Destroy@CxImage@@QAE_NXZ

tinyxml

?Print@TiXmlElement@@UBEXPAU_iobuf@@H@Z
??1TiXmlDocument@@UAE@XZ
??0TiXmlDocument@@QAE@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?InsertEndChild@TiXmlNode@@QAEPAV1@ABV1@@Z
?RemoveChild@TiXmlNode@@QAE_NPAV1@@Z
?Value@TiXmlNode@@QBEPBDXZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?Next@TiXmlAttribute@@QAEPAV1@XZ
?Value@TiXmlAttribute@@QBEPBDXZ
?Name@TiXmlAttribute@@QBEPBDXZ
?FirstAttribute@TiXmlElement@@QAEPAVTiXmlAttribute@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
??1TiXmlElement@@UAE@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?LinkEndChild@TiXmlNode@@QAEPAV1@PAV1@@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?SaveFile@TiXmlDocument@@QBE_NPB_W@Z
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToElement@TiXmlElement@@UBEPBV1@XZ
?ToElement@TiXmlElement@@UAEPAV1@XZ
?ToDocument@TiXmlNode@@UBEPBVTiXmlDocument@@XZ
?SetAttribute@TiXmlElement@@QAEXPBD0@Z
?ToDocument@TiXmlNode@@UAEPAVTiXmlDocument@@XZ
??0TiXmlElement@@QAE@PBD@Z
?Parse@TiXmlElement@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@PBD@Z
?Accept@TiXmlElement@@UBE_NPAVTiXmlVisitor@@@Z
?Clone@TiXmlElement@@UBEPAVTiXmlNode@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?ReplaceChild@TiXmlNode@@QAEPAV1@PAV1@ABV1@@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z

ws2_32

WSAStartup
closesocket
ioctlsocket
setsockopt
socket
sendto

common

?OnUninitCom@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?ValidateBugReport@TXBugReport@@YAXXZ
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?GetPlatformTpc@CoreCenter@Util@@YAHPAPAUITXDataRead@@@Z
?GetPlatformCore@CoreCenter@Util@@YAHPAPAUITXPlatformCore@@@Z
?GetLocalePath@TXI18N@@YA?AVCTXStringW@@PB_W@Z
?TrimLeft@CTXStringW@@QAEAAV1@PB_W@Z
?SplitQNC@FS@@YAHPB_WAAVCTXStringW@@1@Z
?GetDays@CTXTimeSpan@@QBE_JXZ
?GetTickCount@CTXTime@@SA?AV1@XZ
??0CTXTime@@QAE@_J@Z
?NotifyIdle@TXTimer@@YAXXZ
?DelIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
?AddIdleCallback@Window@Util@@YAJPAVVTXMsgLoopIdleCallback@@@Z
??1CTXStringW@@QAE@XZ
?GetBuffer@CTXStringW@@QAEPA_WXZ
??0CTXStringW@@QAE@PB_W@Z
??0CTXStringW@@QAE@XZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
?Format@CTXStringW@@QAAXPB_WZZ
?Compare@CTXStringW@@QBEHPB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??4CTXStringW@@QAEAAV0@ABVCTXBSTR@@@Z
??ICTXBSTR@@QAEPAPA_WXZ
??0CTXBSTR@@QAE@XZ
??4CTXStringW@@QAEAAV0@PB_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
??BCTXStringW@@QBEPB_WXZ
??0CTXBSTR@@QAE@PB_W@Z
?IsEmpty@CTXStringW@@QBE_NXZ
?Empty@CTXStringW@@QAEXXZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
??YCTXStringW@@QAEAAV0@_W@Z
??ACTXStringW@@QBE_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?Left@CTXStringW@@QBE?AV1@H@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??0CTXStringW@@QAE@PA_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?IsEmpty@CTXBSTR@@QAEHXZ
?GetParentDir@File@Util@@YA?AVCTXStringW@@ABV3@@Z
??YCTXStringW@@QAEAAV0@ABV0@@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
?Replace@CTXStringW@@QAEHPB_W0@Z
??0CTXStringW@@QAE@ABV0@@Z
??M@YA_NABVCTXStringW@@0@Z
?CreateFileW@FS@@YAHPB_WKPAPAUITXFile@@@Z
?IsFileSystemFile@FS@@YAHPB_W@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??0CTXBSTR@@QAE@ABV0@@Z
?CreateTXBuffer@Data@Util@@YAHPAPAUITXBuffer@@@Z
??8CTXBSTR@@QBE_NPB_W@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?GetTime@CTXTime@@QBE_JXZ
?GetDay@CTXTime@@QBEHXZ
??4CTXTime@@QAEAAV0@_J@Z
??4CTXBSTR@@QAEAAV0@PB_W@Z
?CreateTXData@Data@Util@@YAHPAPAUITXData@@@Z
?CombinePath@FS@Util@@YA?AVCTXStringW@@ABV3@0@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
??1CTXStringA@@QAE@XZ
??BCTXStringA@@QBEPBDXZ
?GetLength@CTXStringA@@QBEHXZ
??YCTXStringA@@QAEAAV0@PBD@Z
??0CTXStringA@@QAE@PBDH@Z
?FormatV@CTXStringW@@QAEXPB_WPAD@Z
??8@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??0CTXTimeSpan@@QAE@_J@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
ord33
??8@YA_NPB_WABVCTXBSTR@@@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
??0CTXStringW@@QAE@H@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??8@YA_NABVCTXStringW@@PB_W@Z
?Copy@CTXBSTR@@QBEPA_WXZ
?CombineQNC@FS@@YA?AVCTXStringW@@PB_W0@Z
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
?GetFileSuffix@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
?Empty@CTXBSTR@@QAEXXZ
??MCTXBSTR@@QBE_NABV0@@Z
??1CTXFileDialog@@QAE@XZ
?GetFileFullName@CTXFileDialog@@QBE?AVCTXStringW@@XZ
?DoModal@CTXFileDialog@@QAEHXZ
??0CTXFileDialog@@QAE@HPB_W00K0PAUHWND__@@HPAVVFileDialgCallback@@@Z
??0CTXBSTR@@QAE@H@Z
??8CTXBSTR@@QBE_NPA_W@Z
??8@YA_NPA_WABVCTXBSTR@@@Z
?Encode16@Encode@Util@@YA?AVCTXStringW@@PBXI@Z
?GetBuffer@CTXStringA@@QAEPADH@Z
??0CTXStringA@@QAE@UtagEN@@PB_WH@Z
?Format@CTXTime@@QBE?AVCTXStringW@@PB_W@Z
?CreateDirectoryW@FS@@YAHPB_W@Z
?DeleteDirectory@FS@@YAHPB_W@Z
?IsFileExist@FS@@YAHPB_W@Z
?AddFileSystem@FS@@YAJW4FILESYSTEM_TYPE@@PB_W1HHH@Z
?IsFileSystemExist@FS@@YAHPB_W@Z
?Length@CTXBSTR@@QBEIXZ
?LoadXmlByName@FS@Util@@YAHPB_WPAPAUIXMLDOMDocument@@@Z
?Detach@CTXBSTR@@QAEPA_WXZ
?Encode16@Encode@Util@@YA?AVCTXStringW@@ABVCTXBuffer@@@Z
?GetFileHash@FS@Util@@YAHPB_WAAVCTXBuffer@@AAK@Z
??9CTXBSTR@@QBE_NPB_W@Z
?ConvertXMLToTXData@Convert@Util@@YAHPA_WPAPA_WPAUITXData@@0@Z
??9CTXBSTR@@QBE_NPA_W@Z
ord34
?ConvertTXDataToXML@Convert@Util@@YAHPA_WPAUITXDataRead@@0@Z
?CreateTXArray@Data@Util@@YAHPAPAUITXArray@@@Z
?GetFileName@FS@Util@@YA?AVCTXStringW@@ABV3@@Z
ord26
?IsDirectoryExist@FS@@YAHPB_W@Z
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
?TXAssert@@YAXPB_W0H@Z
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
?InitPluginFileSystem@Boot@Util@@YAHPA_W@Z
?InitPluginI18NConfig@Boot@Util@@YAHPA_W@Z
?InitPluginGFConfig@Boot@Util@@YAHPA_W@Z
?Find@CTXStringW@@QBEH_WH@Z
?EnablePlugin@CoreCenter@Util@@YAHPA_W@Z
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Mid@CTXStringW@@QBE?AV1@H@Z
??8@YA_NPB_WABVCTXStringW@@@Z
?ToLower@CTXBSTR@@QAEJXZ
?QueryPluginCore@CoreCenter@Util@@YAHPA_WPAPAUITXPluginCore@@@Z
??4CTXBSTR@@QAEAAV0@ABVCTXStringW@@@Z
??YCTXBSTR@@QAEAAV0@PB_W@Z
??YCTXBSTR@@QAEAAV0@ABV0@@Z
?RemoveFileSystem@FS@@YAHPB_W@Z
?AddPlugin@CoreCenter@Util@@YAHPA_WPAUITXData@@@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?Record@Perf@Util@@YAJPB_WHH00@Z
??YCTXStringW@@QAEAAV0@PB_W@Z

gf

?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
?RawInitGFElementByXtml@GF@Util@@YAJPA_WPAUIGFElement@@10H@Z
?GetService@GF@Util@@YAJABU_GUID@@PA_WPAPAX@Z
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z

xgraphic32

GetTextureMode
ARGBtoAHSL
AHSLtoARGB
SetTextureMode
FillSolidRect
CreateCanvas
SetCanvasFilter
DrawTexture
CanvasToTexture
GetTextureSize
GetTextureFilter
CreateTexture
LockTextureBits
UnlockTextureBits
SetTextureFilter
DeleteTexture

mfc80u

ord2640
ord909
ord764
ord266
ord762
ord1176
ord1178
ord1182
ord1079
ord1908
ord265
ord3327
ord4255
ord4475
ord3943
ord2638
ord3703
ord3713
ord3712
ord2984
ord2527
ord2534
ord2832
ord2708
ord4301
ord2829
ord2725
ord2531
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord3826
ord5378
ord6215
ord5096
ord1007
ord5579
ord2009
ord2054
ord4320
ord6274
ord3795
ord6272
ord4008
ord4032
ord577
ord283
ord2366
ord566
ord757
ord1121
ord1049
ord2239
ord3800
ord1198

msvcr80

wcslen
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_memicmp
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
strrchr
_vsnprintf
_snprintf_s
swscanf_s
putchar
putwchar
ldiv
_wcsupr
ftell
fread
wcstok_s
_wtoi64
_wfullpath
_mktime64
_wsplitpath_s
sscanf
wcsstr
_purecall
memcpy
_beginthreadex
__CxxFrameHandler3
wcsrchr
_difftime64
_time64
malloc
free
wcscpy_s
wcsncpy_s
_wcsicmp
__wargv
__argc
memset
wcsncat
_wtoi
_wcsnicmp
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_recalloc
_snwprintf
_snprintf
exit
_get_heap_handle
_snwprintf_s
wcsncpy
realloc
memmove
??0exception@std@@QAE@XZ
_localtime64
rename
fseek
fopen
fclose
fflush
fwrite
memmove_s
memcpy_s
_except_handler3
vswprintf_s
wcscat_s
swprintf_s
towlower
wcsncmp
wcstoul
wcsncat_s
_vsnwprintf_s
swscanf
sscanf_s
_itow
tolower
wcschr
strchr
calloc
atof
_wtof
_wtol
_wfopen
fwprintf
strlen
wcstol
setlocale
_unlink
strncpy_s
_wfopen_s

kernel32

HeapDestroy
GetVersionExA
HeapReAlloc
HeapSize
LocalAlloc
HeapAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
GetStartupInfoW
MoveFileW
LoadLibraryA
VirtualQuery
OpenFileMappingW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetOverlappedResult
ConnectNamedPipe
CreateNamedPipeW
SetNamedPipeHandleState
WaitNamedPipeW
OutputDebugStringW
InterlockedExchangeAdd
GetLocaleInfoA
GetTimeFormatW
GetDateFormatW
GetCurrencyFormatW
GetNumberFormatW
GetLocaleInfoW
FileTimeToLocalFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateThread
QueueUserAPC
GetACP
FormatMessageW
ResetEvent
InitializeCriticalSectionAndSpinCount
DeleteTimerQueueTimer
WaitForMultipleObjects
MapViewOfFile
OpenEventW
GetProcessTimes
ExpandEnvironmentStringsW
HeapFree
lstrlenA
FindClose
FindNextFileW
FindFirstFileW
GetPrivateProfileStringW
CreateDirectoryW
CopyFileW
GetTempFileNameW
GetSystemTime
FileTimeToSystemTime
QueryPerformanceCounter
OpenProcess
GetVersionExW
GetSystemInfo
MultiByteToWideChar
GetTempPathW
GetCommandLineW
GetSystemTimeAsFileTime
UnmapViewOfFile
CreateFileMappingW
MapViewOfFileEx
SetFilePointer
WriteFile
GetCPInfo
IsDBCSLeadByte
WideCharToMultiByte
WritePrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
lstrcpynW
GetFileAttributesW
GetLongPathNameW
GetFileSize
GetThreadLocale
SetThreadLocale
DeleteFileW
GetExitCodeProcess
UnhandledExceptionFilter
ResumeThread
GetSystemDirectoryW
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
OpenMutexW
IsBadReadPtr
FreeLibrary
ReleaseMutex
SetDllDirectoryW
GetProcessHeap
HeapSetInformation
SetThreadPriority
GetSystemDefaultLangID
GetSystemDefaultUILanguage
GetCurrentProcessId
ProcessIdToSessionId
InterlockedDecrement
GetCurrentThreadId
GetCurrentThread
DuplicateHandle
CreateToolhelp32Snapshot
Process32FirstW
lstrcmpiW
Process32NextW
lstrlenW
GetModuleFileNameW
CreateProcessW
SleepEx
CreateMutexW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
DeleteCriticalSection
ReadFile
InitializeCriticalSection
RaiseException
LoadLibraryW
GetProcAddress
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
SwitchToThread
CreateEventW
GetTickCount
SetLastError
GetLastError
Sleep
SetEvent
WaitForSingleObject
CloseHandle
LeaveCriticalSection
EnterCriticalSection

user32

UpdateWindow
WaitMessage
FindWindowA
PeekMessageW
MsgWaitForMultipleObjectsEx
GetWindow
GetClassNameW
GetClientRect
BeginPaint
GetClassLongW
EndPaint
GetParent
BringWindowToTop
SetFocus
RegisterClassExW
LoadCursorW
IsIconic
EnumThreadWindows
GetWindowThreadProcessId
GetKeyState
SetRect
MonitorFromRect
GetMonitorInfoW
InflateRect
FindWindowExW
GetDC
DrawTextW
ReleaseDC
GetDesktopWindow
MoveWindow
SetTimer
IsWindowVisible
EnableWindow
KillTimer
WindowFromPoint
GetAsyncKeyState
GetWindowRect
ScreenToClient
SystemParametersInfoW
PtInRect
GetWindowLongW
CallWindowProcW
GetCursorPos
SetCursorPos
FindWindowW
RegisterWindowMessageW
GetMessageW
IsWindowEnabled
DispatchMessageW
LoadStringW
MessageBoxW
SetWindowPos
IsWindow
PostMessageW
PostThreadMessageW
CharNextW
DestroyWindow
CreateWindowExW
SetWindowLongW
DefWindowProcW
IsZoomed
ShowWindow
RedrawWindow
SetForegroundWindow
SendMessageW
SendMessageTimeoutW
UnregisterClassA
GetActiveWindow
FillRect
TranslateMessage

gdi32

SelectObject
CreateSolidBrush
DeleteObject
GetStockObject

advapi32

RegEnumKeyExW
OpenSCManagerW
CheckTokenMembership
CreateWellKnownSid
GetTokenInformation
OpenProcessToken
RegCloseKey
RegCreateKeyExW
StartServiceW
RegDeleteKeyW
OpenServiceW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
IsTextUnicode
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CloseServiceHandle

shell32

ord680
ShellExecuteW
SHFileOperationW
SHCreateDirectoryExW
CommandLineToArgvW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFileInfoW

shlwapi

wnsprintfW
SHGetValueW
StrStrIW
StrCmpIW
PathAddBackslashW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathFindFileNameW
StrFormatByteSizeW
StrFormatKBSizeW
PathIsDirectoryW
StrFromTimeIntervalW
PathIsRelativeW
PathIsRootW

oleaut32

SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VariantInit
SysFreeString
VariantClear
SysAllocString
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen

atl80

ord31
ord61
ord23
ord64
ord22
ord18
ord15
ord30
ord58
ord32

msvcp80

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II_W@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??_D?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_istringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@H@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAK@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?str@strstreambuf@std@@QAEPADXZ
?freeze@strstreambuf@std@@QAEX_N@Z
??1strstreambuf@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0strstreambuf@std@@QAE@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z

psapi

GetModuleFileNameExW
GetModuleBaseNameW
EnumProcessModules
EnumProcesses

imm32

ImmAssociateContext
ImmDisableIME

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

comctl32

InitCommonControlsEx

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 600KB - Virtual size: 596KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 748KB - Virtual size: 746KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 148KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3a1ea4f3cca5af8662ac1949d1813a91

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

70:be:76:8a:40:b6:9f:8f:81:bf:31:fe:04:7f:1c:cb:46:61:01:94Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ximage

tinyxml

ws2_32

common

gf

xgraphic32

mfc80u

msvcr80

kernel32

user32

gdi32

advapi32

shell32

shlwapi

oleaut32

atl80

msvcp80

psapi

imm32

version

comctl32

Exports

Exports

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 600KB - Virtual size: 596KB

.data Size: 92KB - Virtual size: 107KB

.rsrc Size: 748KB - Virtual size: 746KB

.reloc Size: 148KB - Virtual size: 146KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

70:be:76:8a:40:b6:9f:8f:81:bf:31:fe:04:7f:1c:cb:46:61:01:94
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 600KB - Virtual size: 596KB

.data
Size: 92KB - Virtual size: 107KB

.rsrc
Size: 748KB - Virtual size: 746KB

.reloc
Size: 148KB - Virtual size: 146KB