b4e25e04f65f79ef2e8b5cba3595c3ce_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b4e25e04f65f79ef2e8b5cba3595c3ce_JaffaCakes118
Size

131KB
MD5

b4e25e04f65f79ef2e8b5cba3595c3ce
SHA1

d27259e81fbe0699e3102a491d23df4cb02e2c9b
SHA256

0ea46cd90fdee15000db139d8f8283c2e5d9b1c9da2667f7aa4e24c60a36cbb0
SHA512

baaa3ea416718a19da5b0d3b9fa86aad5efd242cd30dbb3fe672fb36df5994947817e1d716075635e648a61ba7fd619252e98e98256690d0df17dcaf4f640156
SSDEEP

3072:xlNSeMEVXCiHt637OPfD4lgpK8UcdhwkfUBjZJGeeG+//:xloe/M9LSfDkeUcdDUFGeeXX

Score

1^/10

Malware Config

Signatures

Files

b4e25e04f65f79ef2e8b5cba3595c3ce_JaffaCakes118
.cab
Category.dll.C8E4525E_3532_4E1F_8DBD_156E5A6FACF7
.dll regsvr32 windows:4 windows x86 arch:x86

5f702c8a94e618ed761b850b7511132e

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/01/2009, 00:00

Not After

22/01/2011, 23:59

Subject

CN=Business Objects Americas,OU=Secure Application PG,O=Business Objects Americas,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

2b:ef:7d:9a:4f:79:5e:98:8a:ed:ff:86:ee:9d:a4:1d:ab:8e:f0:55
Signer

Actual PE Digest

2b:ef:7d:9a:4f:79:5e:98:8a:ed:ff:86:ee:9d:a4:1d:ab:8e:f0:55

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Titan_FP_SP2_REL\win32_x86\release\pdb\Framework\CorporateCategory.pdb

Imports

cxlibw-4-0

??0STraceParameter@CXLib400@@QAE@I@Z
??0SWCharString@CXLib400@@QAE@PBG@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@@Z
?copyFrom@?$SString_t@G$00@CXLib400@@QAE_NPBG@Z
??0STraceParameter@CXLib400@@QAE@H@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@11@Z
??1?$SString_t@G$00@CXLib400@@QAE@XZ
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@HH@Z
?isEmpty@?$SString_t@G$00@CXLib400@@QBE_NXZ
?releaseBuffer@?$SString_t@G$00@CXLib400@@IAEXXZ
?EmptyBuffer@SSimpleBuffer@CXLib400@@1V_EmptyBuffer@12@A
?LoadResource@SResManager@CXLib400@@SA_NKPBGAAVSSimpleBuffer@2@QAUHINSTANCE__@@@Z
?releaseInternalBuffer@SSimpleBuffer@CXLib400@@IAEXXZ
??1SSimpleBuffer@CXLib400@@UAE@XZ
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@111@Z
?ShouldTrace@SLogger@CXLib400@@YA_NHPBD@Z
??Y?$SString_t@G$00@CXLib400@@QAEAAV01@PBG@Z
??Y?$SString_t@G$00@CXLib400@@QAEAAV01@ABV01@@Z
??0STraceParameter@CXLib400@@QAE@ABVSWCharString@1@@Z
??0STraceParameter@CXLib400@@QAE@PBG@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@1@Z
??0STraceParameter@CXLib400@@QAE@J@Z
??1STraceParameter@CXLib400@@QAE@XZ
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@PBX@Z
??4?$SString_t@G$00@CXLib400@@QAEAAV01@PBG@Z
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@JH@Z
?compareNoCase@?$SString_t@G$00@CXLib400@@QBEHABV12@@Z
??0?$SString_t@G$00@CXLib400@@QAE@PBG@Z
?ThreadUninitialize@SResManager@CXLib400@@SAXK@Z
?ThreadInitialize@SResManager@CXLib400@@SA_NKAAK@Z
?SAssert@CXLib400@@YAXPBDH00@Z
??RSTraceObj@CXLib400@@QAEXPBD@Z
?GetCurrentThreadID@CSIProcess@CXLib400@@SAKXZ
?SAssert@CXLib400@@YAXPBDH0PBG@Z
?ShouldAssert@CXLib400@@YA_NXZ
?SAssert@CXLib400@@YAXPBDH0@Z
?setBuffer@?$SString_t@G$00@CXLib400@@IAEXPAUSStringBuffer@12@@Z
?EmptyBuffer@?$SString_t@G$00@CXLib400@@1V_EmptyBuffer@12@A
?LoadStringW@SResManager@CXLib400@@SA?AVSWCharString@2@KK@Z
??4?$SString_t@G$00@CXLib400@@QAEAAV01@ABV01@@Z
??1SWCharString@CXLib400@@QAE@XZ
?g_traceIsOff@CXLib400@@3_NA
?ShouldTrace_slowpath@CXLib400@@YA_NW4tracelevel@SLogger@1@PBDH@Z
??1CS_Wrapper@CXLib400@@QAE@XZ
?Initialize@SLogger@CXLib400@@YA_NXZ
?Initialize@SResManager@CXLib400@@SA_NXZ
?Terminate@SResManager@CXLib400@@SA_NXZ
?Terminate@SLogger@CXLib400@@YA_NXZ
??_7SSimpleBuffer@CXLib400@@6B@

etc-1-0-12-5

??0JTCAdoptCurrentThread@Etc1001204@@QAE@XZ
??1JTCAdoptCurrentThread@Etc1001204@@QAE@XZ

libocahelperw-4-0

?WP_SI_NEWOBJECT_W@@3QBGB
?ReportSeagateError@Ocalibhelper400@@YAJABU_GUID@@0KABV?$SIArray@VSWCharString@CXLib400@@@CXLib400@@J@Z
?WP_SI_TOTAL_W@@3QBGB
?WP_SI_ID_W@@3QBGB
?WP_SI_PATH_W@@3QBGB
?WP_SI_NUM_FOLDERS_W@@3QBGB
?WP_SI_PARENTID_W@@3QBGB
?WP_SI_DOCUMENTS_W@@3QBGB

kernel32

GetCurrentProcessId
GetThreadLocale
GetLocaleInfoA
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
DisableThreadLibraryCalls
GetModuleFileNameW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemTimeAsFileTime
GetACP
InterlockedExchange
GetVersionExA

user32

UnregisterClassA
LoadImageW
CharNextW

advapi32

RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

ole32

CoTaskMemRealloc
CoCreateFreeThreadedMarshaler
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VariantClear
SysStringByteLen
SysAllocStringByteLen
SafeArrayGetVartype
VarBstrCat
SafeArrayLock
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
OleCreatePictureIndirect
LoadRegTypeLi
SysAllocStringLen
VariantInit
VariantCopy
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayDestroy
SafeArrayUnlock

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

msvcr80

??3@YAXPAX@Z
_decode_pointer
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
malloc
free
memcpy_s
_CxxThrowException
wcscpy_s
wcsncpy_s
wcscat_s
??_V@YAXPAX@Z
_invalid_parameter_noinfo
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_purecall
_recalloc
memset
__RTtypeid
memcpy
__RTDynamicCast
memmove_s
_except_handler4_common
?terminate@@YAXXZ
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_malloc_crt
_encoded_null
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 144KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PersonalCategory.dll.C8E4525E_3532_4E1F_8DBD_156E5A6FACF7
.dll regsvr32 windows:4 windows x86 arch:x86

780c57e0690980e02639d1f5a87742e8

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

22/01/2009, 00:00

Not After

22/01/2011, 23:59

Subject

CN=Business Objects Americas,OU=Secure Application PG,O=Business Objects Americas,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

bc:fd:66:4b:45:e1:26:41:26:49:95:c8:09:54:1b:eb:3a:e4:c1:f6
Signer

Actual PE Digest

bc:fd:66:4b:45:e1:26:41:26:49:95:c8:09:54:1b:eb:3a:e4:c1:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Titan_FP_SP2_REL\win32_x86\release\pdb\Framework\PersonalCategory.pdb

Imports

cxlibw-4-0

??Y?$SString_t@G$00@CXLib400@@QAEAAV01@PBG@Z
?Terminate@SResManager@CXLib400@@SA_NXZ
?Initialize@SResManager@CXLib400@@SA_NXZ
?Initialize@SLogger@CXLib400@@YA_NXZ
?releaseBuffer@?$SString_t@G$00@CXLib400@@IAEXXZ
??1CS_Wrapper@CXLib400@@QAE@XZ
?ShouldTrace_slowpath@CXLib400@@YA_NW4tracelevel@SLogger@1@PBDH@Z
?g_traceIsOff@CXLib400@@3_NA
??1SWCharString@CXLib400@@QAE@XZ
??4?$SString_t@G$00@CXLib400@@QAEAAV01@ABV01@@Z
?LoadStringW@SResManager@CXLib400@@SA?AVSWCharString@2@KK@Z
?EmptyBuffer@?$SString_t@G$00@CXLib400@@1V_EmptyBuffer@12@A
?setBuffer@?$SString_t@G$00@CXLib400@@IAEXPAUSStringBuffer@12@@Z
?SAssert@CXLib400@@YAXPBDH0@Z
??0SWCharString@CXLib400@@QAE@PBG@Z
??0STraceParameter@CXLib400@@QAE@I@Z
?copyFrom@?$SString_t@G$00@CXLib400@@QAE_NPBG@Z
??0STraceParameter@CXLib400@@QAE@H@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@1@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@11@Z
??1?$SString_t@G$00@CXLib400@@QAE@XZ
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@HH@Z
?isEmpty@?$SString_t@G$00@CXLib400@@QBE_NXZ
??_7SSimpleBuffer@CXLib400@@6B@
?EmptyBuffer@SSimpleBuffer@CXLib400@@1V_EmptyBuffer@12@A
?LoadResource@SResManager@CXLib400@@SA_NKPBGAAVSSimpleBuffer@2@QAUHINSTANCE__@@@Z
?releaseInternalBuffer@SSimpleBuffer@CXLib400@@IAEXXZ
??1SSimpleBuffer@CXLib400@@UAE@XZ
??0STraceParameter@CXLib400@@QAE@ABVSWCharString@1@@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@111@Z
?ShouldTrace@SLogger@CXLib400@@YA_NHPBD@Z
?Terminate@SLogger@CXLib400@@YA_NXZ
??Y?$SString_t@G$00@CXLib400@@QAEAAV01@ABV01@@Z
??0STraceParameter@CXLib400@@QAE@PBG@Z
??RSTraceObj@CXLib400@@QAEXPBGABVSTraceParameter@1@@Z
??0STraceParameter@CXLib400@@QAE@J@Z
??1STraceParameter@CXLib400@@QAE@XZ
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@PBX@Z
??4?$SString_t@G$00@CXLib400@@QAEAAV01@PBG@Z
?ToString@SWCharStringConv@CXLib400@@SA?AVSWCharString@2@JH@Z
?compareNoCase@?$SString_t@G$00@CXLib400@@QBEHABV12@@Z
??0?$SString_t@G$00@CXLib400@@QAE@PBG@Z
?ThreadUninitialize@SResManager@CXLib400@@SAXK@Z
?ThreadInitialize@SResManager@CXLib400@@SA_NKAAK@Z
?SAssert@CXLib400@@YAXPBDH00@Z
??RSTraceObj@CXLib400@@QAEXPBD@Z
?GetCurrentThreadID@CSIProcess@CXLib400@@SAKXZ
?SAssert@CXLib400@@YAXPBDH0PBG@Z
?ShouldAssert@CXLib400@@YA_NXZ

libocahelperw-4-0

?WP_SI_NUM_FOLDERS_W@@3QBGB
?WP_SI_TOTAL_W@@3QBGB
?WP_SI_ID_W@@3QBGB
?ReportSeagateError@Ocalibhelper400@@YAJABU_GUID@@0KABV?$SIArray@VSWCharString@CXLib400@@@CXLib400@@J@Z
?WP_SI_PATH_W@@3QBGB
?WP_SI_DOCUMENTS_W@@3QBGB
?WP_SI_NEWOBJECT_W@@3QBGB

etc-1-0-12-5

??1JTCAdoptCurrentThread@Etc1001204@@QAE@XZ
??0JTCAdoptCurrentThread@Etc1001204@@QAE@XZ

kernel32

Sleep
GetThreadLocale
GetLocaleInfoA
GetACP
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetLastError
GetLastError
InterlockedExchange
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
FreeLibrary
DisableThreadLibraryCalls
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
InterlockedCompareExchange

user32

RegisterClassExA
LoadCursorA
GetClassInfoExA
UnregisterClassA

ole32

CoCreateInstance
CoCreateFreeThreadedMarshaler

oleaut32

VariantInit
VariantCopy
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
SafeArrayDestroy
SafeArrayUnlock
SafeArrayGetVartype
SysAllocStringByteLen
SysStringByteLen
OleCreatePictureIndirect
SafeArrayLock
VarBstrCat
SysAllocStringLen
SysFreeString
LoadRegTypeLi
SysStringLen
SysAllocString
VariantClear
LoadTypeLi

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

atl80

ord15
ord61
ord23
ord49
ord64
ord22
ord18
ord58
ord30
ord31
ord32

msvcr80

memset
_CxxThrowException
memcmp
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
_purecall
??_V@YAXPAX@Z
_recalloc
__RTtypeid
memcpy_s
memcpy
__RTDynamicCast
memmove_s
sprintf_s
?terminate@@YAXXZ
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_malloc_crt
_encoded_null
_initterm
_adjust_fdiv
_amsg_exit
_initterm_e
swprintf_s
free
_except_handler4_common
_invalid_parameter_noinfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f702c8a94e618ed761b850b7511132e

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62Certificate

Extended Key Usages

2b:ef:7d:9a:4f:79:5e:98:8a:ed:ff:86:ee:9d:a4:1d:ab:8e:f0:55Signer

Headers

File Characteristics

PDB Paths

Imports

cxlibw-4-0

etc-1-0-12-5

libocahelperw-4-0

kernel32

user32

advapi32

ole32

oleaut32

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 144KB - Virtual size: 140KB

.rdata Size: 48KB - Virtual size: 45KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 16KB - Virtual size: 14KB

780c57e0690980e02639d1f5a87742e8

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62Certificate

Extended Key Usages

bc:fd:66:4b:45:e1:26:41:26:49:95:c8:09:54:1b:eb:3a:e4:c1:f6Signer

Headers

File Characteristics

PDB Paths

Imports

cxlibw-4-0

libocahelperw-4-0

etc-1-0-12-5

kernel32

user32

ole32

oleaut32

msvcp80

atl80

msvcr80

Exports

Exports

Sections

.text Size: 104KB - Virtual size: 100KB

.rdata Size: 44KB - Virtual size: 40KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 16KB - Virtual size: 14KB

.reloc Size: 16KB - Virtual size: 13KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62
Certificate

2b:ef:7d:9a:4f:79:5e:98:8a:ed:ff:86:ee:9d:a4:1d:ab:8e:f0:55
Signer

.text
Size: 144KB - Virtual size: 140KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 16KB - Virtual size: 14KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3c:e0:2f:58:10:5e:28:02:c9:9d:91:8c:4d:76:23:62
Certificate

bc:fd:66:4b:45:e1:26:41:26:49:95:c8:09:54:1b:eb:3a:e4:c1:f6
Signer

.text
Size: 104KB - Virtual size: 100KB

.rdata
Size: 44KB - Virtual size: 40KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 16KB - Virtual size: 14KB

.reloc
Size: 16KB - Virtual size: 13KB