67806bd2c339c675fb1658f4ecd791d9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

67806bd2c339c675fb1658f4ecd791d9_JaffaCakes118
Size

4.0MB
MD5

67806bd2c339c675fb1658f4ecd791d9
SHA1

bc8a75a85c52fa66f19f559d954f4d8725748706
SHA256

dcea5450f97c7a9b9dc902dc98502e5fa4090505febbeac19c632b3a84c532e6
SHA512

2762ad9d75042a2d357d77665662d8788444aa757398d632a3e167f437e119e0a02a28825fbc617acfb4a656e5ab8d1ce1cc7b840df8e6e90f7f6e023a13ddda
SSDEEP

98304:OXX+w7YHF8+hJtsaGj/0leFZ3yzbHFT16k/:OXE7hsDclsZ3yzbHh1N/

Score

7^/10

aspackv2 upx

Malware Config

Signatures

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/TubeMasterPlus-v1.317/Updater.exe	aspack_v212_v242
static1/unpack001/TubeMasterPlus-v1.317/utils/downmp3.exe	aspack_v212_v242
static1/unpack001/TubeMasterPlus-v1.317/utils/extract.bin	aspack_v212_v242
static1/unpack001/TubeMasterPlus-v1.317/utils/save.bin	aspack_v212_v242

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/TubeMasterPlus-v1.317/utils/ffmpeg_tm.exe	upx
static1/unpack001/TubeMasterPlus-v1.317/utils/save.bin	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/TubeMasterPlus-v1.317/TMPlus.exe
unpack001/TubeMasterPlus-v1.317/Updater.exe
unpack001/TubeMasterPlus-v1.317/utils/downmp3.exe
unpack001/TubeMasterPlus-v1.317/utils/extract.bin
unpack001/TubeMasterPlus-v1.317/utils/ffmpeg_tm.exe
unpack002/out.upx
unpack001/TubeMasterPlus-v1.317/utils/pthreadGC2.dll
unpack001/TubeMasterPlus-v1.317/utils/save.bin

Files

67806bd2c339c675fb1658f4ecd791d9_JaffaCakes118
.rar
TubeMasterPlus-v1.317/ChangeLog.txt
TubeMasterPlus-v1.317/TMPlus.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

Size: 357KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 19KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 165KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 260KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/Updater.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 208KB - Virtual size: 512KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/lang/Brazilian-Portuguese.tmlang
TubeMasterPlus-v1.317/lang/Chinese-Simplified.tmlang
TubeMasterPlus-v1.317/lang/Chinese-Traditional.tmlang
TubeMasterPlus-v1.317/lang/Deutsch.tmlang
TubeMasterPlus-v1.317/lang/Dutch.tmlang
TubeMasterPlus-v1.317/lang/English.tmlang
TubeMasterPlus-v1.317/lang/French.tmlang
TubeMasterPlus-v1.317/lang/Italiano.tmlang
TubeMasterPlus-v1.317/lang/Korean.tmlang
TubeMasterPlus-v1.317/lang/Melayu.tmlang
TubeMasterPlus-v1.317/lang/Polish.tmlang
TubeMasterPlus-v1.317/lang/Romana.tmlang
TubeMasterPlus-v1.317/lang/Spanish.tmlang
TubeMasterPlus-v1.317/lang/Swedish.tmlang
TubeMasterPlus-v1.317/utils/downmp3.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 142KB - Virtual size: 336KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/utils/extract.bin
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Exports

Exports

GetUnzDllPrivVersion
GetUnzDllVersion
UnzDllExec
___CPPdebugHook

Sections

.text
Size: 39KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/utils/ffmpeg_tm.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

UPX0
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 989KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/utils/pthreadGC2.dll
.dll windows:4 windows x86 arch:x86

4ed4b97c004af0f3c95aeb69c247d60b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddAtomA
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindAtomA
FreeLibrary
GetAtomNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessAffinityMask
GetThreadContext
GetThreadPriority
InitializeCriticalSection
InterlockedDecrement
InterlockedExchangeAdd
LeaveCriticalSection
LoadLibraryA
OpenProcess
ReleaseSemaphore
ResetEvent
ResumeThread
SetEvent
SetLastError
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForMultipleObjects
WaitForSingleObject

msvcrt

__dllonexit
_beginthreadex
_endthreadex
_errno
_ftime
_setjmp
abort
calloc
exit
fflush
free
longjmp
malloc

wsock32

WSAGetLastError
WSASetLastError

Exports

Exports

pthreadCancelableTimedWait
pthreadCancelableWait
pthread_attr_destroy
pthread_attr_getdetachstate
pthread_attr_getinheritsched
pthread_attr_getschedparam
pthread_attr_getschedpolicy
pthread_attr_getscope
pthread_attr_getstackaddr
pthread_attr_getstacksize
pthread_attr_init
pthread_attr_setdetachstate
pthread_attr_setinheritsched
pthread_attr_setschedparam
pthread_attr_setschedpolicy
pthread_attr_setscope
pthread_attr_setstackaddr
pthread_attr_setstacksize
pthread_barrier_destroy
pthread_barrier_init
pthread_barrier_wait
pthread_barrierattr_destroy
pthread_barrierattr_getpshared
pthread_barrierattr_init
pthread_barrierattr_setpshared
pthread_cancel
pthread_cond_broadcast
pthread_cond_destroy
pthread_cond_init
pthread_cond_signal
pthread_cond_timedwait
pthread_cond_wait
pthread_condattr_destroy
pthread_condattr_getpshared
pthread_condattr_init
pthread_condattr_setpshared
pthread_create
pthread_delay_np
pthread_detach
pthread_equal
pthread_exit
pthread_getconcurrency
pthread_getschedparam
pthread_getspecific
pthread_getw32threadhandle_np
pthread_join
pthread_key_create
pthread_key_delete
pthread_kill
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_timedlock
pthread_mutex_trylock
pthread_mutex_unlock
pthread_mutexattr_destroy
pthread_mutexattr_getkind_np
pthread_mutexattr_getpshared
pthread_mutexattr_gettype
pthread_mutexattr_init
pthread_mutexattr_setkind_np
pthread_mutexattr_setpshared
pthread_mutexattr_settype
pthread_num_processors_np
pthread_once
pthread_rwlock_destroy
pthread_rwlock_init
pthread_rwlock_rdlock
pthread_rwlock_timedrdlock
pthread_rwlock_timedwrlock
pthread_rwlock_tryrdlock
pthread_rwlock_trywrlock
pthread_rwlock_unlock
pthread_rwlock_wrlock
pthread_rwlockattr_destroy
pthread_rwlockattr_getpshared
pthread_rwlockattr_init
pthread_rwlockattr_setpshared
pthread_self
pthread_setcancelstate
pthread_setcanceltype
pthread_setconcurrency
pthread_setschedparam
pthread_setspecific
pthread_spin_destroy
pthread_spin_init
pthread_spin_lock
pthread_spin_trylock
pthread_spin_unlock
pthread_testcancel
pthread_timechange_handler_np
pthread_win32_process_attach_np
pthread_win32_process_detach_np
pthread_win32_test_features_np
pthread_win32_thread_attach_np
pthread_win32_thread_detach_np
ptw32_get_exception_services_code
ptw32_pop_cleanup
ptw32_push_cleanup
sched_get_priority_max
sched_get_priority_min
sched_getscheduler
sched_setscheduler
sched_yield
sem_close
sem_destroy
sem_getvalue
sem_init
sem_open
sem_post
sem_post_multiple
sem_timedwait
sem_trywait
sem_unlink
sem_wait

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 368B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 740B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/utils/save.bin
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

AdpAsyncRequest
AdpAsyncSend
AdpAsyncSendEx
AdpCfgGetAccessibleState
AdpCfgGetAdapterDescriptionA
AdpCfgGetAdapterDescriptionW
AdpCfgGetAdapterNameA
AdpCfgGetAdapterNameW
AdpCfgGetAdapterType
AdpCfgGetDhcpState
AdpCfgGetIpA
AdpCfgGetIpCount
AdpCfgGetIpDhcpA
AdpCfgGetIpDhcpCount
AdpCfgGetIpDhcpW
AdpCfgGetIpDnsA
AdpCfgGetIpDnsCount
AdpCfgGetIpDnsW
AdpCfgGetIpGatewayA
AdpCfgGetIpGatewayCount
AdpCfgGetIpGatewayW
AdpCfgGetIpW
AdpCfgGetMACAddrSize
AdpCfgGetMACAddress
AdpCfgGetMACHeaderSize
AdpCfgGetMaxPacketSize
AdpCfgGetSubnetMaskA
AdpCfgGetSubnetMaskW
AdpCfgGetZeroBroadcastState
AdpCfgUpdate
AdpCloseAdapter
AdpCreate
AdpDestroy
AdpGetAcceptCount
AdpGetAsyncStatistics
AdpGetConfig
AdpGetConnectStatus
AdpGetLinkSpeed
AdpGetMacFilter
AdpGetMaxThreadCount
AdpGetMissed
AdpGetOpenTime
AdpGetProcessCount
AdpGetReceiveQueue
AdpGetRecvCount
AdpGetRecvWithErr
AdpGetRecvWithoutErr
AdpGetRejectCount
AdpGetThreadCount
AdpGetTranWithErr
AdpGetTranWithoutErr
AdpGetUseDontLoopBack
AdpGetUseFastUserFilter
AdpGetUseHighPrecisionTime
AdpGetUserFilter
AdpGetUserFilterActive
AdpIsOpened
AdpOpenAdapter
AdpSetConfig
AdpSetMacFilter
AdpSetOnAsyncRequest
AdpSetOnAsyncSend
AdpSetOnPacketRecv
AdpSetOnStateChange
AdpSetOnStatistics
AdpSetOnThreadBegin
AdpSetOnThreadEnd
AdpSetReceiveQueue
AdpSetThreadCount
AdpSetUseDontLoopBack
AdpSetUseFastUserFilter
AdpSetUseHighPrecisionTime
AdpSetUserFilter
AdpSetUserFilterActive
AdpSyncRequest
AdpSyncSend
AdpSyncSendEx
AdpUpdateAdapterStatistics
AdpUpdateUserStatistics
BpfAddCmd
BpfAddJmp
BpfCheckFilter
BpfCheckPacket
BpfClear
BpfCompileBPFAsmFromFileA
BpfCompileBPFAsmFromFileW
BpfCompileBPFAsmFromStr
BpfCompileBPFDefinesFromFileA
BpfCompileBPFDefinesFromFileW
BpfCompileBPFDefinesFromStr
BpfCompileToFastBPF
BpfCreate
BpfDecompileBPFAsmToFileA
BpfDecompileBPFAsmToFileW
BpfDecompileBPFAsmToStr
BpfDestroy
BpfGetErrInstruction
BpfGetInstructionsCount
BpfGetProgrammSize
BpfGetUseFastBPF
BpfLoadFromFileA
BpfLoadFromFileW
BpfLoadFromMemory
BpfSaveToFileA
BpfSaveToFileW
BpfSaveToMemory
BpfSetOnBPFAsmError
BpfSetUseFastBPF
FAdpCloseFile
FAdpCreate
FAdpCreateFileA
FAdpCreateFileW
FAdpDestroy
FAdpGetAcceptCount
FAdpGetAutoMode
FAdpGetCapFormat
FAdpGetFileSize
FAdpGetMaxPacketSize
FAdpGetMediumType
FAdpGetNextPacket
FAdpGetOpenTime
FAdpGetProcessCount
FAdpGetQueue
FAdpGetRecvCount
FAdpGetRejectCount
FAdpGetSizeLimit
FAdpGetUseFastUserFilter
FAdpGetUserFilter
FAdpGetUserFilterActive
FAdpIsOpened
FAdpOpenFileA
FAdpOpenFileW
FAdpRewindFile
FAdpSetAutoMode
FAdpSetCapFormat
FAdpSetMaxPacketSize
FAdpSetMediumType
FAdpSetOnFileClose
FAdpSetOnPacketRecv
FAdpSetOnThreadBegin
FAdpSetOnThreadEnd
FAdpSetQueue
FAdpSetSizeLimit
FAdpSetUseFastUserFilter
FAdpSetUserFilter
FAdpSetUserFilterActive
FAdpSyncSend
FAdpSyncSendEx
LbAdpAddFilterTcpPort
LbAdpAddFilterUdpPort
LbAdpCloseAdapter
LbAdpCreate
LbAdpDestroy
LbAdpGetCaptureTcp
LbAdpGetCaptureUdp
LbAdpGetOpenTime
LbAdpGetProcessFileByIdA
LbAdpGetProcessFileByIdW
LbAdpGetProcessNameByIdA
LbAdpGetProcessNameByIdW
LbAdpGetUseTcpPortFilters
LbAdpGetUseUdpPortFilters
LbAdpOpenAdapter
LbAdpRemoveAllTcpPortFilters
LbAdpRemoveAllUdpPortFilters
LbAdpRemoveFilterTcpPort
LbAdpRemoveFilterUdpPort
LbAdpSetCaptureTcp
LbAdpSetCaptureUdp
LbAdpSetOnConnect
LbAdpSetOnDisconnect
LbAdpSetOnTcpPacketRecv
LbAdpSetOnThreadBegin
LbAdpSetOnThreadEnd
LbAdpSetOnUdpPacketRecv
LbAdpSetUseTcpPortFilters
LbAdpSetUseUdpPortFilters
LbHstGetAddrType
LbHstGetLocalIPv4
LbHstGetLocalPort
LbHstGetRemoteIPv4
LbHstGetRemotePort
LbSesGetCloseTime
LbSesGetCreateTime
LbSesGetDirection
LbSesGetHosts
LbSesGetLocalDataSize
LbSesGetProcessId
LbSesGetRemoteDataSize
LbSesGetUserData
LbSesSetUserData
MgrAbout
MgrCreate
MgrDestroy
MgrGetAdaptersCfgCount
MgrGetBuildA
MgrGetBuildW
MgrGetFirstAdapterCfg
MgrGetNextAdapterCfg
MgrGetVersionA
MgrGetVersionW
MgrGetWanMonitorState
MgrInitialize
MgrInstallLoopBackA
MgrInstallLoopBackW
MgrInstallProtocolA
MgrInstallProtocolW
MgrIsInitialized
MgrIsLoopBackInstalled
MgrIsProtocolInstalled
MgrRefreshAdapterList
MgrSetOnConfigChange
MgrSetWanMonitorState
MgrUninstallLoopBackA
MgrUninstallLoopBackW
MgrUninstallProtocolA
MgrUninstallProtocolW
MgrUnloadProtocolNtDriver
PktCopyPacketToPacket
PktCreate
PktDestroy
PktGetId
PktGetIncPacketSize
PktGetMaxPacketSize
PktGetMediumType
PktGetPacketData
PktGetPacketSize
PktGetTimeStamp
PktGetUserData
PktIPGenerate
PktInetCheckSum
PktSetId
PktSetIncPacketSize
PktSetMediumType
PktSetPacketSize
PktSetTimeStamp
PktSetUserData
PktTCPGenerate
PktTransportCheckSum
PktUDPGenerate
QueAllocItems
QueCreate
QueDestroy
QueFreeItems
QueGetAllocatedSize
QueGetFreeCount
QueGetFreeItem
QueGetFreeItems
QueGetFullCount
QueGetFullItem
QueGetFullItems
QueGetItemsCount
QueGetMaxPacketSize
QueGetOrderingById
QueGetReceiveManyAtOnce
QueIsStarted
QueReturnFreeItem
QueReturnFreeItems
QueReturnFullItem
QueReturnFullItems
QueSetItemsCount
QueSetMaxPacketSize
QueSetOnDeleteItems
QueSetOnPacketRecv
QueSetOnPacketsRecv
QueSetOnThreadBegin
QueSetOnThreadEnd
QueSetOrderingById
QueSetReceiveManyAtOnce
QueStart
QueStop
QueUnblockWaitFree
QueUnblockWaitFull
TcpMgrCloseSession
TcpMgrCreate
TcpMgrDeleteSession
TcpMgrDestroy
TcpMgrGetCheckIpSum
TcpMgrGetCheckTcpSum
TcpMgrGetInvaderMode
TcpMgrGetMaxSessionsCount
TcpMgrGetPendingPacketsCount
TcpMgrGetSessionsCount
TcpMgrGetVirtualMode
TcpMgrProcessPacket
TcpMgrResetOnTimeOut
TcpMgrResetSessions
TcpMgrSetCheckIpSum
TcpMgrSetCheckTcpSum
TcpMgrSetInvaderMode
TcpMgrSetMaxSessionsCount
TcpMgrSetOnClient
TcpMgrSetOnClose
TcpMgrSetOnConnect
TcpMgrSetOnCreate
TcpMgrSetOnDelete
TcpMgrSetOnReturn
TcpMgrSetOnServer
TcpMgrSetVirtualMode
TcpSesGetClientDataSize
TcpSesGetClientIP
TcpSesGetClientIPv6
TcpSesGetClientPacketsCount
TcpSesGetClientPort
TcpSesGetCloseReason
TcpSesGetCreateTime
TcpSesGetLastPacketTime
TcpSesGetServerDataSize
TcpSesGetServerIP
TcpSesGetServerIPv6
TcpSesGetServerPacketsCount
TcpSesGetServerPort
TcpSesGetState
TcpSesGetType
TcpSesGetUserData
TcpSesSetUserData
TcpSesSwapClientServer

Sections

.text
Size: 87KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 89KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.UPX
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
TubeMasterPlus-v1.317/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

Size: 357KB - Virtual size: 936KB

Size: 19KB - Virtual size: 32KB

Size: - Virtual size: 8KB

Size: 11KB - Virtual size: 16KB

Size: - Virtual size: 4KB

Size: 512B - Virtual size: 4KB

Size: - Virtual size: 64KB

.rsrc Size: 165KB - Virtual size: 1.1MB

Size: 512B - Virtual size: 4KB

.data Size: 260KB - Virtual size: 264KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 208KB - Virtual size: 512KB

DATA Size: 5KB - Virtual size: 16KB

BSS Size: - Virtual size: 8KB

.idata Size: 3KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 40KB

.rsrc Size: 33KB - Virtual size: 84KB

.aspack Size: 30KB - Virtual size: 32KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

CODE Size: 142KB - Virtual size: 336KB

DATA Size: 2KB - Virtual size: 8KB

BSS Size: - Virtual size: 4KB

.idata Size: 3KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 24KB

.rsrc Size: 22KB - Virtual size: 88KB

.aspack Size: 27KB - Virtual size: 28KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 84KB

.data Size: 9KB - Virtual size: 36KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 1024B - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 4KB

.reloc Size: 3KB - Virtual size: 4KB

.aspack Size: 4KB - Virtual size: 8KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 5.5MB

UPX1 Size: 2.5MB - Virtual size: 2.5MB

UPX2 Size: 512B - Virtual size: 4KB

Headers

File Characteristics

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.data Size: 192KB - Virtual size: 191KB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.rodata Size: 11KB - Virtual size: 11KB

.bss Size: - Virtual size: 989KB

.idata Size: 4KB - Virtual size: 3KB

4ed4b97c004af0f3c95aeb69c247d60b

Headers

File Characteristics

Imports

kernel32

msvcrt

.rsrc
Size: 165KB - Virtual size: 1.1MB

.data
Size: 260KB - Virtual size: 264KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 208KB - Virtual size: 512KB

DATA
Size: 5KB - Virtual size: 16KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 3KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 40KB

.rsrc
Size: 33KB - Virtual size: 84KB

.aspack
Size: 30KB - Virtual size: 32KB

.adata
Size: - Virtual size: 4KB

CODE
Size: 142KB - Virtual size: 336KB

DATA
Size: 2KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 24KB

.rsrc
Size: 22KB - Virtual size: 88KB

.aspack
Size: 27KB - Virtual size: 28KB

.adata
Size: - Virtual size: 4KB

.text
Size: 39KB - Virtual size: 84KB

.data
Size: 9KB - Virtual size: 36KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 1024B - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 4KB

.reloc
Size: 3KB - Virtual size: 4KB

.aspack
Size: 4KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

UPX0
Size: - Virtual size: 5.5MB

UPX1
Size: 2.5MB - Virtual size: 2.5MB

UPX2
Size: 512B - Virtual size: 4KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.data
Size: 192KB - Virtual size: 191KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.rodata
Size: 11KB - Virtual size: 11KB

.bss
Size: - Virtual size: 989KB

.idata
Size: 4KB - Virtual size: 3KB

.text
Size: 25KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 128B

.bss
Size: - Virtual size: 368B

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 740B

.text
Size: 87KB - Virtual size: 204KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 89KB - Virtual size: 104KB

.rsrc
Size: 30KB - Virtual size: 32KB

.reloc
Size: 8KB - Virtual size: 16KB

.UPX
Size: 4KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB