3eb89f6621cd3f5c757bb5cb8f5a1877_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

3eb89f6621cd3f5c757bb5cb8f5a1877_JaffaCakes118
Size

7.5MB
MD5

3eb89f6621cd3f5c757bb5cb8f5a1877
SHA1

aa67e93f89af6ec582c4cca375f1c3ee22efb651
SHA256

5821d51f3804ec29a857cee22d98b461f26ef980395df07221866fcd655029ab
SHA512

9f22434ad4aebf9391d4541b03c8ca6dff908b532e845905b9c4eb38b6fb7ec2c3ced4351843e0b9ceb60e869778bd0df122f5360bea00943ded55c0b30f32f5
SSDEEP

196608:XImLO7dc8+tsvNgAKArtl04DHt5XF5V5QZTzE9uT:FOW8ysvNFxK4D/ryXE9s

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/everestultimate_build_1201/everest_cpuid.dll	acprotect
static1/unpack001/everestultimate_build_1201/everest_icons.dll	acprotect
static1/unpack001/everestultimate_build_1201/everest_xpicons.dll	acprotect
static1/unpack001/everestultimate_build_1201/everest_zipdll.dll	acprotect

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/everestultimate_build_1201/everest.exe	upx
static1/unpack001/everestultimate_build_1201/everest_cpuid.dll	upx
static1/unpack001/everestultimate_build_1201/everest_diskbench.dll	upx
static1/unpack001/everestultimate_build_1201/everest_icons.dll	upx
static1/unpack001/everestultimate_build_1201/everest_mondiag.dll	upx
static1/unpack001/everestultimate_build_1201/everest_xpicons.dll	upx
static1/unpack001/everestultimate_build_1201/everest_zipdll.dll	upx

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack001/everestultimate_build_1201/everest_bench.dll
unpack001/everestultimate_build_1201/everest_cpl.cpl
unpack001/everestultimate_build_1201/everest_cpuid.dll
unpack001/everestultimate_build_1201/everest_diskbench.dll
unpack001/everestultimate_build_1201/everest_icons.dll
unpack001/everestultimate_build_1201/everest_lglcd.dll
unpack001/everestultimate_build_1201/everest_mondiag.dll
unpack001/everestultimate_build_1201/everest_xpicons.dll
unpack001/everestultimate_build_1201/everest_zipdll.dll
unpack009/out.upx

Files

3eb89f6621cd3f5c757bb5cb8f5a1877_JaffaCakes118
.rar
everestultimate_build_1201/everest.chm
.chm
everestultimate_build_1201/everest.dat
everestultimate_build_1201/everest.exe
.exe windows:4 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/10/2006, 00:00

Not After

17/10/2008, 23:59

Subject

CN=LAVALYS,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Licensing Department,O=LAVALYS,L=Laval,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2c:da:2e:97:f9:e9:32:b6:32:97:ee:a2:c4:56:52:12:a2:c0:b8:85
Signer

Actual PE Digest

2c:da:2e:97:f9:e9:32:b6:32:97:ee:a2:c4:56:52:12:a2:c0:b8:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 7.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 312KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest.exe.manifest
.xml
everestultimate_build_1201/everest.mem
everestultimate_build_1201/everest.web
.html
everestultimate_build_1201/everest_bench.dll
.exe windows:4 windows x86 arch:x86

c03df46d892c83bc942ebd71a757f0d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\Dev3\BenchMarks\Release\Benchmarks.pdb

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

WideCharToMultiByte
VirtualFree
SetEvent
InterlockedDecrement
VirtualAlloc
Sleep
SetThreadAffinityMask
GetCurrentThread
CloseHandle
WaitForMultipleObjects
ResumeThread
CreateThread
CreateEventA
InterlockedCompareExchange
GetTempPathA
DeleteFileA
GetVersionExA
GetLastError
ExitProcess
GetHandleInformation
GetProcessAffinityMask
GetCurrentProcess
GetSystemInfo
GlobalMemoryStatus
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
SetPriorityClass
GetPriorityClass
SetProcessAffinityMask
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
InterlockedExchangeAdd
SetEndOfFile
GetLocaleInfoA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCommandLineA
GetProcessHeap
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetModuleHandleA
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
ReadFile
RtlUnwind
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
DeleteCriticalSection
HeapDestroy
HeapCreate
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
GetTickCount
GetCurrentProcessId
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
CreateFileA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW

user32

RegisterWindowMessageA
PostMessageA
RegisterClassA
CreateWindowExA
DefWindowProcA
DispatchMessageA
PeekMessageA
MsgWaitForMultipleObjects

Sections

.text
Size: 364KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

segm1
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 568KB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

segm2
Size: 4KB - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
everestultimate_build_1201/everest_cpl.cpl
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

CPlApplet

Sections

CODE
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
everestultimate_build_1201/everest_cpuid.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 460KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest_diskbench.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 576KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 247KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest_icons.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 336KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 91KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest_lglcd.dll
.dll windows:4 windows x86 arch:x86

085890e3dfda6ce6f707551f14630d2e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\work\visualc\everest_lglcd\release\everest_lglcd.pdb

Imports

kernel32

GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
FreeLibrary
LoadLibraryA
VirtualFree
GetProcAddress

advapi32

RegQueryValueExA
RegCloseKey
RegOpenKeyExA

Exports

Exports

zlgLcdClose
zlgLcdConnectA
zlgLcdConnectW
zlgLcdDeInit
zlgLcdDisconnect
zlgLcdEnumerate
zlgLcdInit
zlgLcdOpen
zlgLcdReadSoftButtons
zlgLcdUpdateBitmap

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
everestultimate_build_1201/everest_mondiag.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 980KB - Virtual size: 980KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest_vsb.vsb
.zip
EVEREST.Gadget/bkbottom_black.png
.png
EVEREST.Gadget/bkbottom_blue.png
.png
EVEREST.Gadget/bkbottom_dblue.png
.png
EVEREST.Gadget/bkbottom_dgreen.png
.png
EVEREST.Gadget/bkbottom_gold.png
.png
EVEREST.Gadget/bkbottom_gray.png
.png
EVEREST.Gadget/bkbottom_green.png
.png
EVEREST.Gadget/bkbottom_orange.png
.png
EVEREST.Gadget/bkbottom_red.png
.png
EVEREST.Gadget/bkbottom_silver.png
.png
EVEREST.Gadget/bkbottom_white.png
.png
EVEREST.Gadget/bkloop_black.png
.png
EVEREST.Gadget/bkloop_blue.png
.png
EVEREST.Gadget/bkloop_dblue.png
.png
EVEREST.Gadget/bkloop_dgreen.png
.png
EVEREST.Gadget/bkloop_gold.png
.png
EVEREST.Gadget/bkloop_gray.png
.png
EVEREST.Gadget/bkloop_green.png
.png
EVEREST.Gadget/bkloop_orange.png
.png
EVEREST.Gadget/bkloop_red.png
.png
EVEREST.Gadget/bkloop_silver.png
.png
EVEREST.Gadget/bkloop_white.png
.png
EVEREST.Gadget/bktop_black.png
.png
EVEREST.Gadget/bktop_blue.png
.png
EVEREST.Gadget/bktop_dblue.png
.png
EVEREST.Gadget/bktop_dgreen.png
.png
EVEREST.Gadget/bktop_gold.png
.png
EVEREST.Gadget/bktop_gray.png
.png
EVEREST.Gadget/bktop_green.png
.png
EVEREST.Gadget/bktop_nblack.png
.png
EVEREST.Gadget/bktop_nblue.png
.png
EVEREST.Gadget/bktop_ndblue.png
.png
EVEREST.Gadget/bktop_ndgreen.png
.png
EVEREST.Gadget/bktop_ngold.png
.png
EVEREST.Gadget/bktop_ngray.png
.png
EVEREST.Gadget/bktop_ngreen.png
.png
EVEREST.Gadget/bktop_norange.png
.png
EVEREST.Gadget/bktop_nred.png
.png
EVEREST.Gadget/bktop_nsilver.png
.png
EVEREST.Gadget/bktop_nwhite.png
.png
EVEREST.Gadget/bktop_orange.png
.png
EVEREST.Gadget/bktop_red.png
.png
EVEREST.Gadget/bktop_silver.png
.png
EVEREST.Gadget/bktop_white.png
.png
EVEREST.Gadget/everest.html
.html
EVEREST.Gadget/everest.js
.js
EVEREST.Gadget/gadget.xml
.xml
EVEREST.Gadget/ueicon.png
.png
everestultimate_build_1201/everest_xpicons.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 276KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/everest_zipdll.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ChuLKUnzipAllFolder
ChuLKUnzipSingleFile
ChuLKZipFolderRecursive
ChuLKZipMultipleFiles
ChuLKZipSingleFile
FolderProperties
MultipleFilesProperties

Sections

UPX0
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
everestultimate_build_1201/kerneld.amd64
.sys windows:6 windows x64 arch:x64

14075e605bff546182d682f41afefea2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/10/2006, 00:00

Not After

17/10/2008, 23:59

Subject

CN=LAVALYS,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Licensing Department,O=LAVALYS,L=Laval,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:9b:cd:90:cf:7b:f8:99:96:29:bd:f6:f8:7d:fe:71:4d:81:ba:2b
Signer

Actual PE Digest

c5:9b:cd:90:cf:7b:f8:99:96:29:bd:f6:f8:7d:fe:71:4d:81:ba:2b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

e:\work\visualc\llkd\driver.nt\amd64\LLKD.pdb

Imports

ntoskrnl.exe

IoGetDeviceObjectPointer
MmMapIoSpace
IofCompleteRequest
KeWaitForSingleObject
PsGetVersion
IoCreateSymbolicLink
MmIsAddressValid
ObfDereferenceObject
IoCreateDevice
IofCallDriver
IoBuildDeviceIoControlRequest
IoDeleteSymbolicLink
RtlAnsiStringToUnicodeString
RtlInitUnicodeString
IoDeleteDevice
strchr
KeInitializeEvent
RtlInitAnsiString
MmUnmapIoSpace
RtlFreeUnicodeString
KeBugCheckEx

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 380B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
everestultimate_build_1201/kerneld.ia64
everestultimate_build_1201/kerneld.w9x
everestultimate_build_1201/kerneld.wnt
.sys windows:6 windows x86 arch:x86

979b25d6d6d7537749348f2dd1880321

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

18/10/2006, 00:00

Not After

17/10/2008, 23:59

Subject

CN=LAVALYS,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Software Licensing Department,O=LAVALYS,L=Laval,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:1b:85:c9:fd:f0:73:f7:d1:34:53:b2:ab:23:40:39:d0:4b:36:de
Signer

Actual PE Digest

cf:1b:85:c9:fd:f0:73:f7:d1:34:53:b2:ab:23:40:39:d0:4b:36:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\work\visualc\llkd\driver.nt\i386\LLKD.pdb

Imports

ntoskrnl.exe

IofCompleteRequest
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
KeInitializeEvent
strchr
RtlFreeUnicodeString
ObfDereferenceObject
MmIsAddressValid
IoGetDeviceObjectPointer
PsGetVersion
RtlInitAnsiString
memcpy
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
IoCreateSymbolicLink
IoCreateDevice
memset
KeTickCount
KeBugCheckEx
MmMapIoSpace
RtlAnsiStringToUnicodeString
MmUnmapIoSpace

hal

KfLowerIrql
KfRaiseIrql

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 209B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 774B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 450B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
everestultimate_build_1201/lang_aa.txt
everestultimate_build_1201/lang_al.txt
everestultimate_build_1201/lang_bg.txt
everestultimate_build_1201/lang_bs.txt
everestultimate_build_1201/lang_by.txt
everestultimate_build_1201/lang_ca.txt
everestultimate_build_1201/lang_cn.txt
everestultimate_build_1201/lang_cz.txt
everestultimate_build_1201/lang_de.txt
everestultimate_build_1201/lang_dk.txt
everestultimate_build_1201/lang_es.txt
everestultimate_build_1201/lang_fi.txt
everestultimate_build_1201/lang_fr.txt
everestultimate_build_1201/lang_hr.txt
everestultimate_build_1201/lang_hu.txt
everestultimate_build_1201/lang_id.txt
everestultimate_build_1201/lang_it.txt
everestultimate_build_1201/lang_jp.txt
everestultimate_build_1201/lang_kr.txt
everestultimate_build_1201/lang_lt.txt
everestultimate_build_1201/lang_lv.txt
everestultimate_build_1201/lang_mk.txt
everestultimate_build_1201/lang_nl.txt
everestultimate_build_1201/lang_no.txt
everestultimate_build_1201/lang_pl.txt
everestultimate_build_1201/lang_pt.txt
everestultimate_build_1201/lang_ro.txt
everestultimate_build_1201/lang_ru.txt
everestultimate_build_1201/lang_se.txt
everestultimate_build_1201/lang_si.txt
everestultimate_build_1201/lang_sk.txt
everestultimate_build_1201/lang_src.txt
everestultimate_build_1201/lang_srl.txt
everestultimate_build_1201/lang_tr.txt
everestultimate_build_1201/lang_tw.txt
everestultimate_build_1201/lang_ua.txt
everestultimate_build_1201/license.txt
everestultimate_build_1201/pkey.txt
everestultimate_build_1201/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

2c:da:2e:97:f9:e9:32:b6:32:97:ee:a2:c4:56:52:12:a2:c0:b8:85Signer

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 7.3MB

UPX1 Size: 1.6MB - Virtual size: 1.6MB

.rsrc Size: 312KB - Virtual size: 316KB

c03df46d892c83bc942ebd71a757f0d9

Headers

File Characteristics

PDB Paths

Imports

version

kernel32

user32

Sections

.text Size: 364KB - Virtual size: 362KB

segm1 Size: 52KB - Virtual size: 48KB

.rdata Size: 72KB - Virtual size: 70KB

.data Size: 568KB - Virtual size: 2.6MB

segm2 Size: 4KB - Virtual size: 528B

.rsrc Size: 4KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 110KB - Virtual size: 109KB

DATA Size: 2KB - Virtual size: 2KB

BSS Size: - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.edata Size: 512B - Virtual size: 76B

.reloc Size: 9KB - Virtual size: 8KB

.rsrc Size: 31KB - Virtual size: 31KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 460KB

UPX1 Size: 1.1MB - Virtual size: 1.1MB

.rsrc Size: 8KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 576KB

UPX1 Size: 247KB - Virtual size: 248KB

.rsrc Size: 29KB - Virtual size: 32KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 336KB

UPX1 Size: 91KB - Virtual size: 92KB

.rsrc Size: 25KB - Virtual size: 28KB

085890e3dfda6ce6f707551f14630d2e

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

Exports

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

2c:da:2e:97:f9:e9:32:b6:32:97:ee:a2:c4:56:52:12:a2:c0:b8:85
Signer

UPX0
Size: - Virtual size: 7.3MB

UPX1
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 312KB - Virtual size: 316KB

.text
Size: 364KB - Virtual size: 362KB

segm1
Size: 52KB - Virtual size: 48KB

.rdata
Size: 72KB - Virtual size: 70KB

.data
Size: 568KB - Virtual size: 2.6MB

segm2
Size: 4KB - Virtual size: 528B

.rsrc
Size: 4KB - Virtual size: 1KB

CODE
Size: 110KB - Virtual size: 109KB

DATA
Size: 2KB - Virtual size: 2KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.edata
Size: 512B - Virtual size: 76B

.reloc
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 31KB - Virtual size: 31KB

UPX0
Size: - Virtual size: 460KB

UPX1
Size: 1.1MB - Virtual size: 1.1MB

.rsrc
Size: 8KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 576KB

UPX1
Size: 247KB - Virtual size: 248KB

.rsrc
Size: 29KB - Virtual size: 32KB

UPX0
Size: - Virtual size: 336KB

UPX1
Size: 91KB - Virtual size: 92KB

.rsrc
Size: 25KB - Virtual size: 28KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 176B

.reloc
Size: 4KB - Virtual size: 3KB

UPX0
Size: - Virtual size: 1.2MB

UPX1
Size: 980KB - Virtual size: 980KB

.rsrc
Size: 27KB - Virtual size: 28KB

UPX0
Size: - Virtual size: 276KB

UPX1
Size: 140KB - Virtual size: 140KB

.rsrc
Size: 12KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 76KB

UPX1
Size: 45KB - Virtual size: 48KB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 72KB - Virtual size: 71KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 16KB - Virtual size: 22KB

.reloc
Size: 8KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

1b:41:7b:a2:cd:ab:80:10:ec:fc:5a:d9:dd:4b:af:33
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

c5:9b:cd:90:cf:7b:f8:99:96:29:bd:f6:f8:7d:fe:71:4d:81:ba:2b
Signer

.text
Size: 10KB - Virtual size: 9KB

.rdata
Size: 512B - Virtual size: 380B

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 512B - Virtual size: 96B