34afc63bde64c57e5f0fd8e9714c013a_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

34afc63bde64c57e5f0fd8e9714c013a_JaffaCakes118
Size

137KB
MD5

34afc63bde64c57e5f0fd8e9714c013a
SHA1

61710db8e0a61bad34c19062624365c77360eea1
SHA256

5b74b6f070d1c95c92ce2c4def40aa0f4526c549a079ce2dffa72dec80aa6f88
SHA512

580e46f3858dd84cea721cd58832840834a8c27cc55da05dacbae3d16148c543f2cfee13d809354a7ca5f0484c18e277ab7c3a2239fcc3e66955f3f9ab600740
SSDEEP

3072:AhBG3AwFat/mclL+ovHRoQ6ZgsHbrATbN/iPU/jqThoieNe:5wwy+cQEtqHQNSlzeg

Score

1^/10

Malware Config

Signatures

Files

34afc63bde64c57e5f0fd8e9714c013a_JaffaCakes118
.rar
ForceKill.exe
.exe windows:4 windows x86 arch:x86

5f3868ac4901176642e59a8aed85cde3

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

20-10-2008 08:01

Not After

20-10-2010 08:01

Subject

CN=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,OU=Secure Application Development,O=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42u

ord3744
ord5059
ord1720
ord5257
ord2438
ord2116
ord5273
ord4621
ord4419
ord3592
ord324
ord4229
ord2574
ord4396
ord3365
ord3635
ord2579
ord4400
ord3389
ord3724
ord2403
ord2015
ord4213
ord2570
ord6051
ord1768
ord4392
ord5286
ord3397
ord3577
ord1143
ord1165
ord567
ord2294
ord2634
ord3087
ord4219
ord6211
ord4279
ord4294
ord2078
ord6871
ord3991
ord6777
ord6195
ord4155
ord2858
ord4704
ord2371
ord755
ord470
ord3312
ord5949
ord1105
ord668
ord3176
ord4053
ord2773
ord2762
ord356
ord6898
ord3993
ord940
ord537
ord4124
ord4272
ord5679
ord6654
ord4078
ord6372
ord1634
ord2406
ord3658
ord3621
ord1771
ord3614
ord922
ord925
ord2756
ord6868
ord1972
ord3173
ord6278
ord4199
ord6919
ord6920
ord6918
ord2755
ord927
ord2606
ord4273
ord3579
ord711
ord413
ord543
ord803
ord5579
ord860
ord2047
ord2640
ord4435
ord4831
ord3793
ord5276
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord1767
ord4073
ord6048
ord4992
ord4847
ord4370
ord5261
ord1131
ord2613
ord2506
ord641
ord693
ord616
ord804
ord815
ord561
ord3733
ord4418
ord4616
ord4075
ord6375
ord6193
ord2108
ord1941
ord4312
ord283
ord3649
ord2576
ord4215
ord1854
ord6266
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord540
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5710
ord5285
ord5303
ord4692
ord4074
ord2717
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord4667
ord2810
ord4197
ord535
ord6655
ord6403
ord861
ord942
ord858
ord538
ord533
ord2558
ord2447
ord2706
ord4118
ord5778
ord3566
ord609
ord4390
ord2567
ord1787
ord4262
ord1929
ord5777
ord4282
ord1637
ord2914
ord5188
ord5461
ord6921
ord823
ord1989
ord798
ord800
ord825
ord3568
ord5568
ord2070
ord2862
ord6238
ord2430
ord3701
ord941
ord2854
ord3792
ord5785
ord5790
ord3871
ord5871
ord6168
ord2859
ord323
ord1633
ord2855
ord5781
ord640
ord4270
ord795
ord3716
ord1921
ord1569

msvcrt

_wcslwr
_wtoi
fclose
free
fwrite
_wcsicmp
??0exception@@QAE@ABV0@@Z
_CxxThrowException
malloc
fopen
strrchr
atoi
strncpy
strstr
wcslen
sscanf
remove
_except_handler3
wcsncpy
wcscmp
time
srand
rand
_wsplitpath
_purecall
__CxxFrameHandler
sprintf
wcscat
_strnicmp
vswprintf
swprintf
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit

kernel32

WaitForSingleObject
SetFileAttributesW
MoveFileExW
RemoveDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
DeleteFileW
FreeLibrary
Sleep
CreateProcessW
CloseHandle
GetModuleFileNameW
GetSystemDirectoryW
GetCurrentThreadId
ReadFile
GetFileSize
CreateFileW
GetTempFileNameW
GetTempPathW
GetFileAttributesW
GetPrivateProfileStringW
GetFullPathNameW
WideCharToMultiByte
GetTickCount
OutputDebugStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetExitCodeThread
TerminateThread
lstrlenW
DeviceIoControl
GetModuleHandleW
GetVersionExW
HeapFree
HeapAlloc
GetProcessHeap
SetLastError
GetLastError
GetStartupInfoW
GetProcAddress
CreateDirectoryW
LoadLibraryW

user32

DrawIcon
GetClientRect
GetSystemMetrics
IsIconic
InvalidateRect
EnableWindow
DispatchMessageW
TranslateMessage
PeekMessageW
GetSystemMenu
AppendMenuW
SendMessageW
LoadCursorW
GetSysColor
GetParent
DrawTextW
RedrawWindow
ReleaseDC
GetDC
SetCursor
KillTimer
SetTimer
DrawEdge
CallWindowProcW
GetWindowRect
IsZoomed
LoadBitmapW
SystemParametersInfoW
PostMessageW
PtInRect
ScreenToClient
GetWindow
CallNextHookEx
SetWindowLongW
GetWindowLongW
SetWindowsHookExW
UnhookWindowsHookEx
GetClassNameW
GetMenuStringW
GetMenuItemCount
LoadMenuW
DrawIconEx
OffsetRect
ModifyMenuW
GetMenuItemID
GetMenuState
GetSubMenu
FillRect
SetForegroundWindow
CopyRect
SetWindowRgn
LoadIconW

gdi32

CreateSolidBrush
CreateDIBSection
FillRgn
CreateBitmap
SetBkColor
SetTextColor
DeleteDC
CombineRgn
CreatePolygonRgn
CreateRectRgn
SetStretchBltMode
SetBrushOrgEx
StretchBlt
FrameRgn
DeleteObject
CreateRoundRectRgn
SetBkMode
SelectObject
CreateCompatibleBitmap
BitBlt
TextOutW
GetTextExtentPoint32W
CreateCompatibleDC
GetObjectW
CreateFontW

advapi32

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shell32

ShellExecuteW
SHGetSpecialFolderPathW

msvcp60

??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0logic_error@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z

shlwapi

PathFileExistsW

ws2_32

closesocket
recv
send
htons
getsockname
WSAStartup
WSACleanup
__WSAFDIsSet
WSAGetLastError
select
WSAAsyncSelect
bind
inet_addr
gethostbyname
ioctlsocket
connect
accept
socket
setsockopt
listen

iphlpapi

GetAdaptersInfo

comctl32

_TrackMouseEvent

Sections

.text
Size: 120KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ForceKill/ForceKill.dll
.dll windows:4 windows x86 arch:x86

c87b21529bb14085e15ed2cac7c50311

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

20-10-2008 08:01

Not After

20-10-2010 08:01

Subject

CN=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,OU=Secure Application Development,O=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetSystemDirectoryW
Sleep
SetFilePointer
SizeofResource
FreeResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
WaitForSingleObject
CreateProcessW
GetStartupInfoW
GetTempPathW
TerminateProcess
Process32NextW
OpenProcess
Process32FirstW
WriteFile
GetFullPathNameW
Module32NextW
Module32FirstW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentDirectoryW
GetDriveTypeW
GetLogicalDrives
OutputDebugStringW
DeleteFileW
GetLastError
DeviceIoControl
GetCurrentProcess
CreateFileW
GetFileSize
ReadFile
CloseHandle
GetVersionExW
MultiByteToWideChar
CreateToolhelp32Snapshot
WideCharToMultiByte
LCMapStringW
LCMapStringA
GetStringTypeW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapFree
HeapAlloc
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
ExitProcess
SetUnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapReAlloc
HeapSize
SetStdHandle
FlushFileBuffers
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetProcAddress
LoadLibraryA
GetStringTypeA

user32

TranslateMessage
DispatchMessageW
wsprintfA
wsprintfW
PeekMessageW

advapi32

StartServiceW
RegDeleteKeyW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
DeleteService
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW

psapi

GetModuleFileNameExW

shlwapi

StrStrA
StrCmpIW
StrCmpNIW
StrStrIW

Exports

Exports

GetManager
VerifyDo

Sections

.text
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ForceKill/ForceKill.sys
.sys windows:5 windows x86 arch:x86

2895872937061fcf09e514d6306ce1fb

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01-08-1996 00:00

Not After

31-12-2020 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06-08-2003 00:00

Not After

05-08-2013 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

20-10-2008 08:01

Not After

20-10-2010 08:01

Subject

CN=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,OU=Secure Application Development,O=ShenZhen DaChengTianXia Information Technology Co.\, Ltd.,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dCAi\MYPROJ~1\FuckFile\FuckFile\objchk_wnet_x86\i386\FuckFile.pdb

Imports

ntoskrnl.exe

IoFreeIrp
KeSetEvent
KeWaitForSingleObject
IofCallDriver
RtlAssert
KeGetCurrentThread
KeInitializeEvent
ObfDereferenceObject
IoAllocateIrp
IoGetRelatedDeviceObject
ObReferenceObjectByHandle
RtlInitUnicodeString
ZwClose
DbgPrint
_except_handler3
IofCompleteRequest
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
IoFileObjectType
IoCreateFile

hal

KeGetCurrentIrql

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 452B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ForceKill/config.ini
ForceKill/site.lib
ForceKill/新云软件.url
.url
Readme.txt
超级巡警.url
.url
问题咨询.url
.url

Sharing

General

Malware Config

Signatures

Files

5f3868ac4901176642e59a8aed85cde3

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72Certificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

mfc42u

msvcrt

kernel32

user32

gdi32

advapi32

shell32

msvcp60

shlwapi

ws2_32

iphlpapi

comctl32

Sections

.text Size: 120KB - Virtual size: 118KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 8KB - Virtual size: 6KB

.rsrc Size: 92KB - Virtual size: 90KB

c87b21529bb14085e15ed2cac7c50311

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72Certificate

Extended Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

psapi

shlwapi

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 41KB

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 16KB - Virtual size: 19KB

.rsrc Size: 100KB - Virtual size: 97KB

.reloc Size: 8KB - Virtual size: 5KB

2895872937061fcf09e514d6306ce1fb

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

.text
Size: 120KB - Virtual size: 118KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 92KB - Virtual size: 90KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

.text
Size: 44KB - Virtual size: 41KB

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 16KB - Virtual size: 19KB

.rsrc
Size: 100KB - Virtual size: 97KB

.reloc
Size: 8KB - Virtual size: 5KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2c:fb:c2:fa:fd:4d:b3:60:fd:52:ce:64:fe:f4:57:72
Certificate

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 452B

.data
Size: 512B - Virtual size: 24B

INIT
Size: 1024B - Virtual size: 692B

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 512B - Virtual size: 216B