45088e041ff040ceacae4bfe41ee2e8f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

45088e041ff040ceacae4bfe41ee2e8f_JaffaCakes118
Size

2.8MB
MD5

45088e041ff040ceacae4bfe41ee2e8f
SHA1

3c076e6b556df566a4389115b6a75c4cac49bc73
SHA256

45cc6d2c70241d76da2a214b5dbaeb8e79f85c2ef791ae88e17cf6c8901f2a3f
SHA512

c3867a1103d77822dea662a507839a3fb9cdfbec54aad825c152e0411c5ffe2a5682b83b23e4974101374bc9f219c2654d383e244a190dc614efe8ca1cc3040d
SSDEEP

49152:cXM4KcegH3La9rQFX9ik3pTuo2BM4nRTcwaTtVKXd/zf58hyBJN2WbXLJxE:204Cr+buoaM41cXEdtSyBrTLw

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/cvery.comdel06011434242343/Com/SeekEngineIntf/DemogodyouStudio_Xiaolei_Neotoma.dll.1.0
unpack001/cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.dll
unpack001/cvery.comdel06011434242343/Neotoma.dll
unpack001/cvery.comdel06011434242343/Neotoma.exe
unpack001/cvery.comdel06011434242343/Registor/Neotoma.dll
unpack001/cvery.comdel06011434242343/Registor/Registor.exe
unpack001/cvery.comdel06011434242343/Tools/ChatRoom.exe
unpack001/cvery.comdel06011434242343/Tools/LOGO.exe

Files

45088e041ff040ceacae4bfe41ee2e8f_JaffaCakes118
.rar
cvery.comdel06011434242343/About.dcu
cvery.comdel06011434242343/About.ddp
cvery.comdel06011434242343/About.dfm
cvery.comdel06011434242343/About.pas
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutBoxManagerIntf.dcu
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutBoxManagerIntf.pas
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutBoxManagerIntf.~pas
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.dcu
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.ddp
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.dfm
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.pas
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.~ddp
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.~dfm
cvery.comdel06011434242343/Com/AboutBoxManagerIntf/AboutDialogForNeotoma/About.~pas
cvery.comdel06011434242343/Com/SeekEngineIntf/DemogodyouStudio_Xiaolei_Neotoma.dll.1.0
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 436KB - Virtual size: 435KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 193B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 142KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Com/SeekEngineIntf/SeekEngine.dcu
cvery.comdel06011434242343/Com/SeekEngineIntf/SeekEngine.pas
cvery.comdel06011434242343/Com/SeekEngineIntf/SeekEngineIntf.dcu
cvery.comdel06011434242343/Com/SeekEngineIntf/SeekEngineIntf.pas
cvery.comdel06011434242343/Com/SeekEngineIntf/SeekEngineIntf.~pas
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.cfg
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.dll
.dll regsvr32 windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

CODE
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.dof
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.dpr
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.res
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.tlb
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.~dpr
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma.~tlb
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma_TLB.dcu
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma_TLB.pas
cvery.comdel06011434242343/Com/SeekEngineIntf/Xiaolei_Neotoma_TLB.~pas
cvery.comdel06011434242343/Config/Bookmarks.ini
cvery.comdel06011434242343/Config/Emails.ini
cvery.comdel06011434242343/Config/Notice.ini
cvery.comdel06011434242343/Config/UIConfig.ini
cvery.comdel06011434242343/DM_NeotomaCall.dcu
cvery.comdel06011434242343/DM_NeotomaCall.dfm
cvery.comdel06011434242343/DM_NeotomaCall.pas
cvery.comdel06011434242343/DefaultKB.xml
.xml
cvery.comdel06011434242343/Dlg_InputQuery.dcu
cvery.comdel06011434242343/Dlg_InputQuery.ddp
cvery.comdel06011434242343/Dlg_InputQuery.dfm
cvery.comdel06011434242343/Dlg_InputQuery.pas
cvery.comdel06011434242343/EMailSender/Config/Emails.ini
cvery.comdel06011434242343/EMailSender/EMailSender.cfg
cvery.comdel06011434242343/EMailSender/EMailSender.dof
cvery.comdel06011434242343/EMailSender/EMailSender.dpr
cvery.comdel06011434242343/EMailSender/EMailSender.res
cvery.comdel06011434242343/EMailSender/EMailSender.~dpr
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.dcu
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.ddp
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.dfm
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.pas
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.~ddp
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.~dfm
cvery.comdel06011434242343/EMailSender/Frm_EMailSender.~pas
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.dcu
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.ddp
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.dfm
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.pas
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.~ddp
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.~dfm
cvery.comdel06011434242343/EMailSender/Frm_NewEMailAddress.~pas
cvery.comdel06011434242343/EMailSender/Thread_EMailSender.dcu
cvery.comdel06011434242343/EMailSender/Thread_EMailSender.pas
cvery.comdel06011434242343/EMailSender/Thread_EMailSender.~pas
cvery.comdel06011434242343/Frame_SetUserInfo.dcu
cvery.comdel06011434242343/Frame_SetUserInfo.dfm
cvery.comdel06011434242343/Frame_SetUserInfo.pas
cvery.comdel06011434242343/Frm_AddAttribute.dcu
cvery.comdel06011434242343/Frm_AddAttribute.ddp
cvery.comdel06011434242343/Frm_AddAttribute.dfm
cvery.comdel06011434242343/Frm_AddAttribute.pas
cvery.comdel06011434242343/Frm_AttrManager.dcu
cvery.comdel06011434242343/Frm_AttrManager.ddp
cvery.comdel06011434242343/Frm_AttrManager.dfm
cvery.comdel06011434242343/Frm_AttrManager.pas
cvery.comdel06011434242343/Frm_AttributePage.dcu
cvery.comdel06011434242343/Frm_AttributePage.ddp
cvery.comdel06011434242343/Frm_AttributePage.dfm
cvery.comdel06011434242343/Frm_AttributePage.pas
cvery.comdel06011434242343/Frm_BuildNotice.dcu
cvery.comdel06011434242343/Frm_BuildNotice.ddp
cvery.comdel06011434242343/Frm_BuildNotice.dfm
cvery.comdel06011434242343/Frm_BuildNotice.pas
cvery.comdel06011434242343/Frm_Neotoma.dcu
cvery.comdel06011434242343/Frm_Neotoma.ddp
cvery.comdel06011434242343/Frm_Neotoma.dfm
cvery.comdel06011434242343/Frm_Neotoma.pas
cvery.comdel06011434242343/Frm_NeotomaCall.dcu
cvery.comdel06011434242343/Frm_NeotomaCall.ddp
cvery.comdel06011434242343/Frm_NeotomaCall.dfm
cvery.comdel06011434242343/Frm_NeotomaCall.pas
cvery.comdel06011434242343/Frm_SetUserInfo.dcu
cvery.comdel06011434242343/Frm_SetUserInfo.dfm
cvery.comdel06011434242343/Frm_SetUserInfo.pas
cvery.comdel06011434242343/Frm_SplashWindow.dcu
cvery.comdel06011434242343/Frm_SplashWindow.ddp
cvery.comdel06011434242343/Frm_SplashWindow.dfm
cvery.comdel06011434242343/Frm_SplashWindow.pas
cvery.comdel06011434242343/GlobalTypes.dcu
cvery.comdel06011434242343/GlobalTypes.pas
cvery.comdel06011434242343/InternetUtils.dcu
cvery.comdel06011434242343/InternetUtils.pas
cvery.comdel06011434242343/KBTree.dcu
cvery.comdel06011434242343/KBTree.pas
cvery.comdel06011434242343/MSNForm.dcu
cvery.comdel06011434242343/MSNForm.ddp
cvery.comdel06011434242343/MSNForm.dfm
cvery.comdel06011434242343/MSNForm.pas
cvery.comdel06011434242343/Neotoma.cfg
cvery.comdel06011434242343/Neotoma.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetHDSerialNumber
OK_SN_PartFour
OK_SN_PartOne
OK_SN_PartThree
OK_SN_PartTwo

Sections

CODE
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Neotoma.dof
cvery.comdel06011434242343/Neotoma.dpr
cvery.comdel06011434242343/Neotoma.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 64B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 865KB - Virtual size: 865KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Neotoma.ico
cvery.comdel06011434242343/Neotoma.res
cvery.comdel06011434242343/NeotomaHelpCenter.chm
.chm
cvery.comdel06011434242343/NeotomaMessage.dcu
cvery.comdel06011434242343/NeotomaMessage.pas
cvery.comdel06011434242343/Registor/Frm_Registor.dcu
cvery.comdel06011434242343/Registor/Frm_Registor.ddp
cvery.comdel06011434242343/Registor/Frm_Registor.dfm
cvery.comdel06011434242343/Registor/Frm_Registor.pas
cvery.comdel06011434242343/Registor/Neotoma.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetHDSerialNumber
OK_SN_PartFour
OK_SN_PartOne
OK_SN_PartThree
OK_SN_PartTwo

Sections

CODE
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 186B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Registor/Registor.cfg
cvery.comdel06011434242343/Registor/Registor.dof
cvery.comdel06011434242343/Registor/Registor.dpr
cvery.comdel06011434242343/Registor/Registor.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 423KB - Virtual size: 422KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Registor/Registor.res
cvery.comdel06011434242343/RollInfoGetter.dcu
cvery.comdel06011434242343/RollInfoGetter.pas
cvery.comdel06011434242343/SN/SN.dcu
cvery.comdel06011434242343/SN/SN.pas
cvery.comdel06011434242343/SeekEngine.dcu
cvery.comdel06011434242343/SeekEngine.pas
cvery.comdel06011434242343/Seekor.dcu
cvery.comdel06011434242343/Seekor.pas
cvery.comdel06011434242343/Temp/NeotomaCall.txt
.txt .rtf
cvery.comdel06011434242343/Temp/RichEditToImage.bmp
cvery.comdel06011434242343/Thread_KBTreeSeekor.dcu
cvery.comdel06011434242343/Thread_KBTreeSeekor.pas
cvery.comdel06011434242343/Tools/ChatRoom.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 568KB - Virtual size: 568KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Tools/LOGO.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 391KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
cvery.comdel06011434242343/Unit1.pas
cvery.comdel06011434242343/Utils.dcu
cvery.comdel06011434242343/Utils.pas
cvery.comdel06011434242343/Welcome to you.url
cvery.comdel06011434242343/Welcome.mht
.eml
email-html-1.txt
.html
cvery.comdel06011434242343/_Neotoma.exe.manifest
.xml
cvery.comdel06011434242343/下载说明.htm
.html .js polyglot
cvery.comdel06011434242343/说明.txt

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 436KB - Virtual size: 435KB

DATA Size: 7KB - Virtual size: 6KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 9KB

.edata Size: 512B - Virtual size: 193B

.reloc Size: 27KB - Virtual size: 26KB

.rsrc Size: 142KB - Virtual size: 142KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 348KB - Virtual size: 347KB

DATA Size: 5KB - Virtual size: 4KB

BSS Size: - Virtual size: 3KB

.idata Size: 9KB - Virtual size: 8KB

.edata Size: 512B - Virtual size: 172B

.reloc Size: 24KB - Virtual size: 24KB

.rsrc Size: 24KB - Virtual size: 24KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 28KB - Virtual size: 27KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 1KB

.edata Size: 512B - Virtual size: 186B

.reloc Size: 3KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 1.3MB - Virtual size: 1.3MB

DATA Size: 14KB - Virtual size: 13KB

BSS Size: - Virtual size: 4KB

.idata Size: 12KB - Virtual size: 11KB

.tls Size: - Virtual size: 64B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 91KB - Virtual size: 90KB

.rsrc Size: 865KB - Virtual size: 865KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 28KB - Virtual size: 27KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 1KB

.edata Size: 512B - Virtual size: 186B

.reloc Size: 3KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 423KB - Virtual size: 422KB

DATA Size: 7KB - Virtual size: 6KB

BSS Size: - Virtual size: 2KB

.idata Size: 8KB - Virtual size: 8KB

.tls Size: - Virtual size: 16B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: 26KB - Virtual size: 25KB

.rsrc Size: 56KB - Virtual size: 56KB

Headers

File Characteristics

Sections

CODE Size: 568KB - Virtual size: 568KB

DATA Size: 8KB - Virtual size: 7KB

CODE
Size: 436KB - Virtual size: 435KB

DATA
Size: 7KB - Virtual size: 6KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.edata
Size: 512B - Virtual size: 193B

.reloc
Size: 27KB - Virtual size: 26KB

.rsrc
Size: 142KB - Virtual size: 142KB

CODE
Size: 348KB - Virtual size: 347KB

DATA
Size: 5KB - Virtual size: 4KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 172B

.reloc
Size: 24KB - Virtual size: 24KB

.rsrc
Size: 24KB - Virtual size: 24KB

CODE
Size: 28KB - Virtual size: 27KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 186B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

CODE
Size: 1.3MB - Virtual size: 1.3MB

DATA
Size: 14KB - Virtual size: 13KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 12KB - Virtual size: 11KB

.tls
Size: - Virtual size: 64B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 91KB - Virtual size: 90KB

.rsrc
Size: 865KB - Virtual size: 865KB

CODE
Size: 28KB - Virtual size: 27KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 186B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 4KB

CODE
Size: 423KB - Virtual size: 422KB

DATA
Size: 7KB - Virtual size: 6KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 26KB - Virtual size: 25KB

.rsrc
Size: 56KB - Virtual size: 56KB

CODE
Size: 568KB - Virtual size: 568KB

DATA
Size: 8KB - Virtual size: 7KB

BSS
Size: - Virtual size: 3KB

.idata
Size: 9KB - Virtual size: 9KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 43KB - Virtual size: 43KB

.rsrc
Size: 34KB - Virtual size: 34KB

CODE
Size: 391KB - Virtual size: 391KB

DATA
Size: 7KB - Virtual size: 6KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 8KB - Virtual size: 8KB

.tls
Size: - Virtual size: 16B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: 23KB - Virtual size: 23KB

.rsrc
Size: 128KB - Virtual size: 128KB