6315fc7d55c46a8a5442d85995f911e5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6315fc7d55c46a8a5442d85995f911e5_JaffaCakes118
Size

6.6MB
MD5

6315fc7d55c46a8a5442d85995f911e5
SHA1

0af3ea4186de6f10f32d0632e849326f4a2440ff
SHA256

914fc421ed19fa3703f6b3ff588a789496b8f9dde03645ddc5acab9cf22c9b8c
SHA512

535328294c0d3835888d212857506754fd8c4ab4ed8785fe3857aa3ec38521de62b69e2ef17f69b4ef175b7b87a56aa4946098a8722ce1116720d8f3f6730768
SSDEEP

98304:+aGuYzj+I9Uy8s47r7iZHGpBv5YQwQeNKQLJcQzTk4UF0l08tHAcG2nzVvQwr:Yz+XwcniWBvqjQJaJfTk4O0zHK2D

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/PseudoData_V0.9.2/CPUId.exe
unpack001/PseudoData_V0.9.2/MSVCR71.dll
unpack001/PseudoData_V0.9.2/PseudoData.exe
unpack001/PseudoData_V0.9.2/w9xpopen.exe

Files

6315fc7d55c46a8a5442d85995f911e5_JaffaCakes118
.rar
PseudoData_V0.9.2/CPUId.exe
.exe windows:4 windows x86 arch:x86

3922438d7eb1823b8b6241a77b1b2f76

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

_except_handler3
__set_app_type
_onexit
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
__p___initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
realloc
bsearch
qsort
setbuf
getenv
atoi
malloc
free
_snprintf
strncmp
strrchr
fprintf
_iob
__dllonexit
strncpy
_stricmp
_strdup

kernel32

IsBadReadPtr
SetLastError
GetProcessHeap
HeapFree
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibrary
GetModuleHandleA
OutputDebugStringA
GetFullPathNameA
LoadLibraryA
GetProcAddress
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingA
CloseHandle
MapViewOfFile
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetLastError
FormatMessageA
LocalFree
HeapAlloc

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PseudoData_V0.9.2/MSVCR71.dll
.dll windows:4 windows x86 arch:x86

7acc8c379c768a1ecd81ec502ff5f33e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr71.pdb

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
GetCurrentThreadId
GetCommandLineA
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
SetLastError
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
HeapAlloc
HeapFree
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
MultiByteToWideChar
GetCommandLineW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
InitializeCriticalSection
RtlUnwind
UnhandledExceptionFilter
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetConsoleCtrlHandler
InterlockedExchange
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetLocaleInfoW
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
HeapSize
VirtualProtect
GetSystemInfo
FlushFileBuffers
SetFilePointer
SetStdHandle
CompareStringA
CompareStringW
Sleep
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
IsBadReadPtr
SetUnhandledExceptionFilter
IsBadCodePtr
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
CreateProcessA
CreateProcessW
HeapValidate
HeapCompact
HeapWalk
ReadConsoleA
SetConsoleMode
GetConsoleMode
IsDBCSLeadByteEx
GetConsoleCP
ReadConsoleW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreateFileA
CreatePipe
ReadFile
CreateFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
SetLocalTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@@QAE@ABV0@@Z
??0__non_rtti_object@@QAE@PBD@Z
??0bad_cast@@AAE@PBQBD@Z
??0bad_cast@@QAE@ABQBD@Z
??0bad_cast@@QAE@ABV0@@Z
??0bad_cast@@QAE@PBD@Z
??0bad_typeid@@QAE@ABV0@@Z
??0bad_typeid@@QAE@PBD@Z
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1__non_rtti_object@@UAE@XZ
??1bad_cast@@UAE@XZ
??1bad_typeid@@UAE@XZ
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
??4__non_rtti_object@@QAEAAV0@ABV0@@Z
??4bad_cast@@QAEAAV0@ABV0@@Z
??4bad_typeid@@QAEAAV0@ABV0@@Z
??4exception@@QAEAAV0@ABV0@@Z
??8type_info@@QBEHABV0@@Z
??9type_info@@QBEHABV0@@Z
??_7__non_rtti_object@@6B@
??_7bad_cast@@6B@
??_7bad_typeid@@6B@
??_7exception@@6B@
??_Fbad_cast@@QAEXXZ
??_Fbad_typeid@@QAEXXZ
??_U@YAPAXI@Z
??_V@YAXPAX@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDXZ
?raw_name@type_info@@QBEPBDXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPAGIPBGPAD@Z
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CxxThrowException
_EH_prolog
_Getdays
_Getmonths
_Gettnames
_HUGE
_Strftime
_XcptFilter
__CppXcptFilter
__CxxCallUnwindDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__buffer_overrun
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__dllonexit
__doserrno
__fpecode
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv_init
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__amblksiz
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fileinfo
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__security_error_handler
__set_app_type
__set_buffer_overrun_handler
__setlc_active
__setusermatherr
__threadhandle
__threadid
__toascii
__unDName
__unDNameEx
__uncaught_exception
__unguarded_readlc_active
__wargv
__wcserror
__wgetmainargs
__winitenv
_abnormal_termination
_access
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_realloc
_amsg_exit
_assert
_atodbl
_atoi64
_atoldbl
_beep
_beginthread
_beginthreadex
_c_exit
_cabs
_callnewh
_cexit
_cgets
_cgetws
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_clearfp
_close
_commit
_commode
_control87
_controlfp
_copysign
_cprintf
_cputs
_cputws
_creat
_cscanf
_ctime64
_cwait
_cwprintf
_cwscanf
_daylight
_dstbias
_dup
_dup2
_ecvt
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fcloseall
_fcvt
_fdopen
_fgetchar
_fgetwchar
_filbuf
_fileinfo
_filelength
_filelengthi64
_fileno
_findclose
_findfirst
_findfirst64
_findfirsti64
_findnext
_findnext64
_findnexti64
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fputchar
_fputwchar
_fsopen
_fstat
_fstat64
_fstati64
_ftime
_ftime64
_ftol
_fullpath
_futime
_futime64
_gcvt
_get_heap_handle
_get_osfhandle
_get_sbh_threshold
_getch
_getche
_getcwd
_getdcwd
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getsystime
_getw
_getwch
_getwche
_getws
_global_unwind2
_gmtime64
_heapadd
_heapchk
_heapmin
_heapset
_heapused
_heapwalk
_hypot
_i64toa
_i64tow
_initterm
_inp
_inpd
_inpw
_iob
_isatty
_isctype
_ismbbalnum
_ismbbalpha
_ismbbgraph
_ismbbkalnum
_ismbbkana
_ismbbkprint
_ismbbkpunct
_ismbblead
_ismbbprint
_ismbbpunct
_ismbbtrail
_ismbcalnum
_ismbcalpha
_ismbcdigit
_ismbcgraph
_ismbchira
_ismbckata
_ismbcl0
_ismbcl1
_ismbcl2
_ismbclegal
_ismbclower
_ismbcprint
_ismbcpunct
_ismbcspace
_ismbcsymbol
_ismbcupper
_ismbslead
_ismbstrail
_isnan
_itoa
_itow
_j0
_j1
_jn
_kbhit
_lfind
_loaddll
_local_unwind2
_localtime64
_lock
_locking
_logb
_longjmpex
_lrotl
_lrotr
_lsearch
_lseek
_lseeki64
_ltoa
_ltow
_makepath
_mbbtombc
_mbbtype
_mbcasemap
_mbccpy
_mbcjistojms
_mbcjmstojis
_mbclen
_mbctohira
_mbctokata
_mbctolower
_mbctombb
_mbctoupper
_mbctype
_mbsbtype
_mbscat
_mbschr
_mbscmp
_mbscoll
_mbscpy
_mbscspn
_mbsdec
_mbsdup
_mbsicmp
_mbsicoll
_mbsinc
_mbslen
_mbslwr
_mbsnbcat
_mbsnbcmp
_mbsnbcnt
_mbsnbcoll
_mbsnbcpy
_mbsnbicmp
_mbsnbicoll
_mbsnbset
_mbsncat
_mbsnccnt
_mbsncmp
_mbsncoll
_mbsncpy
_mbsnextc
_mbsnicmp
_mbsnicoll
_mbsninc
_mbsnset
_mbspbrk
_mbsrchr
_mbsrev
_mbsset
_mbsspn
_mbsspnp
_mbsstr
_mbstok
_mbstrlen
_mbsupr
_memccpy
_memicmp
_mkdir
_mktemp
_mktime64
_msize
_nextafter
_onexit
_open
_open_osfhandle
_osplatform
_osver
_outp
_outpd
_outpw
_pclose
_pctype
_pgmptr
_pipe
_popen
_purecall
_putch
_putenv
_putw
_putwch
_putws
_pwctype
_read
_resetstkoflw
_rmdir
_rmtmp
_rotl
_rotr
_safe_fdiv
_safe_fdivr
_safe_fprem
_safe_fprem1
_scalb
_scprintf
_scwprintf
_searchenv
_seh_longjmp_unwind
_set_SSE2_enable
_set_error_mode
_set_purecall_handler
_set_sbh_threshold
_set_security_error_handler
_seterrormode
_setjmp
_setjmp3
_setmaxstdio
_setmbcp
_setmode
_setsystime
_sleep
_snprintf
_snscanf
_snwprintf
_snwscanf
_sopen
_spawnl
_spawnle
_spawnlp
_spawnlpe
_spawnv
_spawnve
_spawnvp

Sections

.text
Size: 228KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PseudoData_V0.9.2/PseudoData.exe
.exe windows:4 windows x86 arch:x86

3922438d7eb1823b8b6241a77b1b2f76

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcr71

_except_handler3
__set_app_type
_onexit
_controlfp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_amsg_exit
__p___initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
realloc
bsearch
qsort
setbuf
getenv
atoi
malloc
free
_snprintf
strncmp
strrchr
fprintf
_iob
__dllonexit
strncpy
_stricmp
_strdup

kernel32

IsBadReadPtr
SetLastError
GetProcessHeap
HeapFree
VirtualFree
VirtualProtect
VirtualAlloc
FreeLibrary
GetModuleHandleA
OutputDebugStringA
GetFullPathNameA
LoadLibraryA
GetProcAddress
UnmapViewOfFile
CreateFileA
GetFileSize
CreateFileMappingA
CloseHandle
MapViewOfFile
FindResourceA
LoadResource
LockResource
GetModuleFileNameA
GetLastError
FormatMessageA
LocalFree
HeapAlloc

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PseudoData_V0.9.2/common.zip
PseudoData_V0.9.2/dbinsert.xls
.xls windows office2003
PseudoData_V0.9.2/fastload.xls
.xls windows office2003
PseudoData_V0.9.2/license.txt
PseudoData_V0.9.2/readme.doc
.xls .doc windows office2003
PseudoData_V0.9.2/sqlldr.xls
.xls windows office2003
PseudoData_V0.9.2/tcl/tcl8.4/auto.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/encoding/ascii.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/big5.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1250.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1251.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1252.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1253.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1254.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1255.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1256.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1257.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp1258.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp437.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp737.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp775.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp850.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp852.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp855.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp857.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp860.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp861.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp862.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp863.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp864.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp865.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp866.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp869.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp874.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp932.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp936.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp949.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/cp950.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/dingbats.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/ebcdic.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/euc-cn.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/euc-jp.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/euc-kr.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/gb12345.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/gb1988.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/gb2312-raw.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/gb2312.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso2022-jp.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso2022-kr.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso2022.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-1.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-10.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-13.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-14.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-15.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-16.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-2.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-3.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-4.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-5.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-6.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-7.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-8.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/iso8859-9.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/jis0201.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/jis0208.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/jis0212.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/koi8-r.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/koi8-u.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/ksc5601.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macCentEuro.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macCroatian.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macCyrillic.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macDingbats.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macGreek.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macIceland.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macJapan.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macRoman.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macRomania.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macThai.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macTurkish.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/macUkraine.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/shiftjis.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/symbol.enc
PseudoData_V0.9.2/tcl/tcl8.4/encoding/tis-620.enc
PseudoData_V0.9.2/tcl/tcl8.4/history.tcl
PseudoData_V0.9.2/tcl/tcl8.4/http1.0/http.tcl
.ps1
PseudoData_V0.9.2/tcl/tcl8.4/http1.0/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tcl8.4/http2.5/http.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/http2.5/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tcl8.4/init.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/ldAout.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/msgcat1.3/msgcat.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/msgcat1.3/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tcl8.4/opt0.4/optparse.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/opt0.4/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tcl8.4/package.tcl
.vbs
PseudoData_V0.9.2/tcl/tcl8.4/parray.tcl
PseudoData_V0.9.2/tcl/tcl8.4/safe.tcl
.ps1
PseudoData_V0.9.2/tcl/tcl8.4/tclIndex
PseudoData_V0.9.2/tcl/tcl8.4/tcltest2.2/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tcl8.4/tcltest2.2/tcltest.tcl
.ps1
PseudoData_V0.9.2/tcl/tcl8.4/word.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/bgerror.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/button.tcl
PseudoData_V0.9.2/tcl/tk8.4/choosedir.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/clrpick.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/comdlg.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/console.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/README
PseudoData_V0.9.2/tcl/tk8.4/demos/arrow.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/bind.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/bitmap.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/browse
.sh .ps1 linux polyglot
PseudoData_V0.9.2/tcl/tk8.4/demos/button.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/check.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/clrpick.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/colors.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/cscroll.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/ctext.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/dialog1.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/dialog2.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/entry1.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/entry2.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/entry3.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/filebox.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/floor.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/form.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/hello
.sh linux
PseudoData_V0.9.2/tcl/tk8.4/demos/hscale.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/icon.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/image1.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/image2.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/images/earth.gif
PseudoData_V0.9.2/tcl/tk8.4/demos/images/earthris.gif
PseudoData_V0.9.2/tcl/tk8.4/demos/images/face.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/flagdown.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/flagup.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/gray25.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/letters.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/noletter.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/pattern.bmp
PseudoData_V0.9.2/tcl/tk8.4/demos/images/tcllogo.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/demos/images/teapot.ppm
PseudoData_V0.9.2/tcl/tk8.4/demos/items.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/ixset
.sh linux
PseudoData_V0.9.2/tcl/tk8.4/demos/label.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/labelframe.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/license.terms
PseudoData_V0.9.2/tcl/tk8.4/demos/menu.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/menubu.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/msgbox.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/paned1.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/paned2.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/plot.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/puzzle.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/radio.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/rmt
.sh .vbs linux polyglot
PseudoData_V0.9.2/tcl/tk8.4/demos/rolodex
.sh linux
PseudoData_V0.9.2/tcl/tk8.4/demos/ruler.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/sayings.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/search.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/spin.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/square
.sh linux
PseudoData_V0.9.2/tcl/tk8.4/demos/states.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/style.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/tclIndex
PseudoData_V0.9.2/tcl/tk8.4/demos/tcolor
.sh .vbs linux polyglot
PseudoData_V0.9.2/tcl/tk8.4/demos/text.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/timer
.sh linux
PseudoData_V0.9.2/tcl/tk8.4/demos/twind.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/unicodeout.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/demos/vscale.tcl
PseudoData_V0.9.2/tcl/tk8.4/demos/widget
.sh .vbs linux polyglot
PseudoData_V0.9.2/tcl/tk8.4/dialog.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/entry.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/focus.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/images/README
PseudoData_V0.9.2/tcl/tk8.4/images/logo.eps
PseudoData_V0.9.2/tcl/tk8.4/images/logo100.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/logo64.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/logoLarge.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/logoMed.gif
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo.eps
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo100.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo150.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo175.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo200.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/pwrdLogo75.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/images/tai-ku.gif
.gif
PseudoData_V0.9.2/tcl/tk8.4/license.terms
PseudoData_V0.9.2/tcl/tk8.4/listbox.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/menu.tcl
.ps1
PseudoData_V0.9.2/tcl/tk8.4/mkpsenc.tcl
PseudoData_V0.9.2/tcl/tk8.4/msgbox.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/msgs/cs.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/de.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/el.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/en.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/en_gb.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/eo.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/es.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/es_ES.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/fr.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/it.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/nl.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/pl.msg
PseudoData_V0.9.2/tcl/tk8.4/msgs/ru.msg
PseudoData_V0.9.2/tcl/tk8.4/obsolete.tcl
PseudoData_V0.9.2/tcl/tk8.4/optMenu.tcl
PseudoData_V0.9.2/tcl/tk8.4/palette.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/panedwindow.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/pkgIndex.tcl
PseudoData_V0.9.2/tcl/tk8.4/safetk.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/scale.tcl
PseudoData_V0.9.2/tcl/tk8.4/scrlbar.tcl
PseudoData_V0.9.2/tcl/tk8.4/spinbox.tcl
PseudoData_V0.9.2/tcl/tk8.4/tclIndex
PseudoData_V0.9.2/tcl/tk8.4/tearoff.tcl
PseudoData_V0.9.2/tcl/tk8.4/text.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/tk.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/tkfbox.tcl
.vbs
PseudoData_V0.9.2/tcl/tk8.4/unsupported.tcl
PseudoData_V0.9.2/tcl/tk8.4/xmfbox.tcl
.vbs
PseudoData_V0.9.2/text.xls
.xls windows office2003
PseudoData_V0.9.2/w9xpopen.exe
.exe windows:4 windows x86 arch:x86

3fa43cf6494afaa362b5996b590f5baa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetFileType
GetStdHandle
GetModuleHandleA

user32

MessageBoxA

msvcr71

__getmainargs
free
strchr
malloc
fprintf
_iob
_c_exit
_exit
_XcptFilter
_controlfp
exit
__p___initenv
_amsg_exit
_cexit
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
__dllonexit
_onexit

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PseudoData_V0.9.2/业务数据伪造系统.ppt
.pps .ppt windows office2003
PseudoData_V0.9.2/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

3922438d7eb1823b8b6241a77b1b2f76

Headers

File Characteristics

Imports

msvcr71

kernel32

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 4KB - Virtual size: 3KB

7acc8c379c768a1ecd81ec502ff5f33e

Headers

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 228KB - Virtual size: 226KB

.rdata Size: 68KB - Virtual size: 64KB

.data Size: 24KB - Virtual size: 26KB

.rsrc Size: 4KB - Virtual size: 952B

.reloc Size: 12KB - Virtual size: 10KB

3922438d7eb1823b8b6241a77b1b2f76

Headers

File Characteristics

Imports

msvcr71

kernel32

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 3KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 7KB

3fa43cf6494afaa362b5996b590f5baa

Headers

File Characteristics

Imports

kernel32

user32

msvcr71

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 56B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 228KB - Virtual size: 226KB

.rdata
Size: 68KB - Virtual size: 64KB

.data
Size: 24KB - Virtual size: 26KB

.rsrc
Size: 4KB - Virtual size: 952B

.reloc
Size: 12KB - Virtual size: 10KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 7KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 56B