7361e3b77270ddd14df06223b16efad9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7361e3b77270ddd14df06223b16efad9_JaffaCakes118
Size

2.1MB
MD5

7361e3b77270ddd14df06223b16efad9
SHA1

f71b8f712cd9e2100ca348aee09dca02069bb930
SHA256

4632ab8d71fff77c5443c497f79ee5355046d58f5d6227dc80d580849b282140
SHA512

7f1d0cd2aba3f154db3cc2c48201027d2415ba04f9dad0a8d498ebbed86f97ba0aee83cb87ea11a5acb9cee37fb5d45821ff0fe8088bc36aee528ce99dc437db
SSDEEP

49152:MnJ7R8ItZ3VUzQwaLCOj/mzMLTHE9Cec4:MJ7RvtZ3VUz9aCKSuTHEh

Score

1^/10

Malware Config

Signatures

Files

7361e3b77270ddd14df06223b16efad9_JaffaCakes118
.rar
Class.asp
.vbs
Data/##DatalaoY2.5.mdb
Data/zwck.txt
Editor/asp/browse.asp
.vbs
Editor/asp/config.asp
Editor/asp/upfileclass.asp
.vbs
Editor/asp/upload.asp
.vbs
Editor/dialog/about.htm
.html .js polyglot
Editor/dialog/anchor.htm
.html .js polyglot
Editor/dialog/art.htm
.html .js polyglot
Editor/dialog/backimage.htm
.html .js polyglot
Editor/dialog/browse.htm
.html .js polyglot
Editor/dialog/dialog.js
.js
Editor/dialog/eWebEditorClient.CAB
.cab
eWebEditorClient.INF
eWebEditorClient.dll
.dll regsvr32 windows:4 windows x86 arch:x86

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23/08/2007, 00:00

Not After

22/08/2008, 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

Actual PE Digest

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaLateMemSt
ord593
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
_CIsin
ord631
ord709
__vbaErase
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaGet4
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord716
ord531
__vbaFPException
__vbaInStrVar
ord532
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord579
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarSetObjAddref
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaCastObj
__vbaForEachVar
__vbaStrVarCopy
ord619
_allmul
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord580

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Editor/dialog/eWebEditorClientInstall.exe
.exe windows:1 windows x86 arch:x86

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23/08/2007, 00:00

Not After

22/08/2008, 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

Actual PE Digest

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Editor/dialog/emot.htm
.html .js polyglot
Editor/dialog/eq.htm
.html .js polyglot
Editor/dialog/fieldset.htm
.html .js polyglot
Editor/dialog/file.htm
.html .js polyglot
Editor/dialog/findreplace.htm
.html .js polyglot
Editor/dialog/flash.htm
.html .js polyglot
Editor/dialog/fullscreen.htm
.html .js polyglot
Editor/dialog/hyperlink.htm
.html .js polyglot
Editor/dialog/i_upload.htm
.html .js polyglot
Editor/dialog/iframe.htm
.html .js polyglot
Editor/dialog/img.htm
.html .js polyglot
Editor/dialog/importexcel.htm
.html .js polyglot
Editor/dialog/importword.htm
.html .js polyglot
Editor/dialog/installactivex.htm
.html .js polyglot
Editor/dialog/map.htm
.html .js polyglot
Editor/dialog/marquee.htm
.html .js polyglot
Editor/dialog/media.htm
.html .js polyglot
Editor/dialog/owcexcel.htm
.html .js polyglot
Editor/dialog/paragraph.htm
.html .js polyglot
Editor/dialog/selcolor.htm
.html .js polyglot
Editor/dialog/symbol.htm
.html .js polyglot
Editor/dialog/table.htm
.html .js polyglot
Editor/dialog/tablecell.htm
.html .js polyglot
Editor/dialog/tablecellsplit.htm
.html .js polyglot
Editor/dialog/template.htm
.html .js polyglot
Editor/ewebeditor.htm
.html .js polyglot
Editor/js/buttons.js
.js
Editor/js/ewebeditor.js
.js
Editor/js/zh-cn.js
Editor/popup.htm
.html .js polyglot
Editor/sharefile/image/Thumbs.db
Editor/sharefile/image/back_48.jpg
.jpg
Editor/sharefile/image/book_48.jpg
.jpg
Editor/sharefile/image/book_lock_48.jpg
.jpg
Editor/sharefile/image/book_pencil_48.jpg
.jpg
Editor/sharefile/image/bullet_arrow_48.jpg
.jpg
Editor/sharefile/image/bullet_arrow_v48.jpg
.jpg
Editor/sharefile/image/bullet_email_48.jpg
.jpg
Editor/sharefile/image/bullet_info_48.jpg
.jpg
Editor/sharefile/image/cd_gray_48.jpg
.jpg
Editor/sharefile/image/cd_green_48.jpg
.jpg
Editor/sharefile/image/cd_yellow_48.jpg
.jpg
Editor/sharefile/image/copy_48.jpg
.jpg
Editor/sharefile/image/doc_48.jpg
.jpg
Editor/sharefile/image/doc_faq_48.jpg
.jpg
Editor/sharefile/image/doc_important_48.jpg
.jpg
Editor/sharefile/image/doc_remove_48.jpg
.jpg
Editor/sharefile/image/email_48.jpg
.jpg
Editor/sharefile/image/email_delete_48.jpg
.jpg
Editor/sharefile/image/email_new_48.jpg
.jpg
Editor/sharefile/image/email_open_48.jpg
.jpg
Editor/sharefile/image/email_sent_48.jpg
.jpg
Editor/sharefile/image/folder_48.jpg
.jpg
Editor/sharefile/image/folder_info_48.jpg
.jpg
Editor/sharefile/image/folder_lock_48.jpg
.jpg
Editor/sharefile/image/folder_move_48.jpg
.jpg
Editor/sharefile/image/forward_48.jpg
.jpg
Editor/sharefile/image/mix_clock_48.jpg
.jpg
Editor/sharefile/image/mix_money_48.jpg
.jpg
Editor/sharefile/image/mix_pencil_48.jpg
.jpg
Editor/sharefile/image/mix_world_48.jpg
.jpg
Editor/sharefile/image/paste_48.jpg
.jpg
Editor/sharefile/image/stop_48.jpg
.jpg
Editor/sharefile/image/symbol_faq_48.jpg
.jpg
Editor/sharefile/image/symbols_download_48.jpg
.jpg
Editor/sharefile/image/symbols_info_48.jpg
.jpg
Editor/sharefile/image/symbols_stop_48.jpg
.jpg
Editor/sharefile/image/toolbar_back_48.jpg
.jpg
Editor/sharefile/image/toolbar_buy_48.jpg
.jpg
Editor/sharefile/image/toolbar_calendar_48.jpg
.jpg
Editor/sharefile/image/toolbar_edit_48.jpg
.jpg
Editor/sharefile/image/toolbar_help_48.jpg
.jpg
Editor/sharefile/image/toolbar_login_48.jpg
.jpg
Editor/sharefile/image/toolbar_manual_48.jpg
.jpg
Editor/sharefile/image/toolbar_open_48.jpg
.jpg
Editor/sharefile/image/toolbar_print_48.jpg
.jpg
Editor/sharefile/image/toolbar_remove_48.jpg
.jpg
Editor/sharefile/image/toolbar_save_48.jpg
.jpg
Editor/sharefile/image/toolbar_search_48.jpg
.jpg
Editor/sharefile/image/trash_48.jpg
.jpg
Editor/sharefile/image/trash_arrow_48.jpg
.jpg
Editor/sharefile/image/trash_full_48.jpg
.jpg
Editor/sharefile/image/user_48.jpg
.jpg
Editor/sharefile/image/user_add_48.jpg
.jpg
Editor/sharefile/image/user_delete_48.jpg
.jpg
Editor/sharefile/image/user_info_48.jpg
.jpg
Editor/sharefile/image/weather_clouds_48.jpg
.jpg
Editor/sharefile/image/weather_ray_48.jpg
.jpg
Editor/sharefile/image/weather_sun_48.jpg
.jpg
Editor/sharefile/image/weather_sunny_48.jpg
.jpg
Editor/skin/laoy/btnchecked.gif
.gif
Editor/skin/laoy/btndown.gif
.gif
Editor/skin/laoy/btnover.gif
.gif
Editor/skin/laoy/buttons.gif
.gif
Editor/skin/laoy/dialog.css
Editor/skin/laoy/editor.css
Editor/skin/laoy/editorarea.code.css
Editor/skin/laoy/editorarea.css
Editor/skin/laoy/editorarea.edit.css
Editor/skin/laoy/editorarea.text.css
Editor/skin/laoy/menuarea.css
Editor/skin/laoy/menubg.gif
.gif
Editor/style/laoy.js
Editor/style/user.js
Editor/sysimage/Thumbs.db
Editor/sysimage/bg/birthday.gif
.gif
Editor/sysimage/bg/christmas.gif
.gif
Editor/sysimage/bg/citrus.gif
.gif
Editor/sysimage/bg/clear.jpg
.jpg
Editor/sysimage/bg/fiesta.jpg
.jpg
Editor/sysimage/bg/flower.gif
.gif
Editor/sysimage/bg/gathering.jpg
.jpg
Editor/sysimage/bg/glacier.jpg
.jpg
Editor/sysimage/bg/grid.gif
.gif
Editor/sysimage/bg/hearts.gif
.gif
Editor/sysimage/bg/ivy.gif
.gif
Editor/sysimage/bg/maize.jpg
.jpg
Editor/sysimage/bg/nature.jpg
.jpg
Editor/sysimage/bg/snow.gif
.gif
Editor/sysimage/bg/tech.gif
.gif
Editor/sysimage/bold.gif
.gif
Editor/sysimage/emot/01.gif
.gif
Editor/sysimage/emot/02.gif
.gif
Editor/sysimage/emot/03.gif
.gif
Editor/sysimage/emot/04.gif
.gif
Editor/sysimage/emot/05.gif
.gif
Editor/sysimage/emot/06.gif
.gif
Editor/sysimage/emot/07.gif
.gif
Editor/sysimage/emot/08.gif
.gif
Editor/sysimage/emot/09.gif
.gif
Editor/sysimage/emot/10.gif
.gif
Editor/sysimage/emot/11.gif
.gif
Editor/sysimage/emot/12.gif
.gif
Editor/sysimage/emot/13.gif
.gif
Editor/sysimage/emot/14.gif
.gif
Editor/sysimage/emot/15.gif
.gif
Editor/sysimage/emot/16.gif
.gif
Editor/sysimage/emot/17.gif
.gif
Editor/sysimage/emot/18.gif
.gif
Editor/sysimage/emot/19.gif
.gif
Editor/sysimage/emot/20.gif
.gif
Editor/sysimage/emot/21.gif
.gif
Editor/sysimage/emot/22.gif
.gif
Editor/sysimage/emot/23.gif
.gif
Editor/sysimage/emot/24.gif
.gif
Editor/sysimage/emot/25.gif
.gif
Editor/sysimage/emot/26.gif
.gif
Editor/sysimage/emot/27.gif
.gif
Editor/sysimage/emot/28.gif
.gif
Editor/sysimage/emot/29.gif
.gif
Editor/sysimage/emot/30.gif
.gif
Editor/sysimage/emot/31.gif
.gif
Editor/sysimage/emot/32.gif
.gif
Editor/sysimage/emot/33.gif
.gif
Editor/sysimage/emot/34.gif
.gif
Editor/sysimage/emot/35.gif
.gif
Editor/sysimage/emot/36.gif
.gif
Editor/sysimage/emot/37.gif
.gif
Editor/sysimage/emot/38.gif
.gif
Editor/sysimage/emot/39.gif
.gif
Editor/sysimage/emot/40.gif
.gif
Editor/sysimage/emot/41.gif
.gif
Editor/sysimage/emot/42.gif
.gif
Editor/sysimage/emot/43.gif
.gif
Editor/sysimage/emot/44.gif
.gif
Editor/sysimage/emot/45.gif
.gif
Editor/sysimage/emot/46.gif
.gif
Editor/sysimage/emot/47.gif
.gif
Editor/sysimage/emot/48.gif
.gif
Editor/sysimage/emot/49.gif
.gif
Editor/sysimage/emot/50.gif
.gif
Editor/sysimage/ewebeditor.gif
.gif
Editor/sysimage/file/audio.gif
.gif
Editor/sysimage/file/avi.gif
.gif
Editor/sysimage/file/bmp.gif
.gif
Editor/sysimage/file/closedfolder.gif
.gif
Editor/sysimage/file/code.gif
.gif
Editor/sysimage/file/doc.gif
.gif
Editor/sysimage/file/exe.gif
.gif
Editor/sysimage/file/folder.gif
.gif
Editor/sysimage/file/folderback.gif
.gif
Editor/sysimage/file/gif.gif
.gif
Editor/sysimage/file/hlp.gif
.gif
Editor/sysimage/file/htm.gif
.gif
Editor/sysimage/file/jpg.gif
.gif
Editor/sysimage/file/mdb.gif
.gif
Editor/sysimage/file/mid.gif
.gif
Editor/sysimage/file/mp.gif
.gif
Editor/sysimage/file/mp3.gif
.gif
Editor/sysimage/file/openfolder.gif
.gif
Editor/sysimage/file/parentfolder.gif
.gif
Editor/sysimage/file/pdf.gif
.gif
Editor/sysimage/file/pic.gif
.gif
Editor/sysimage/file/ppt.gif
.gif
Editor/sysimage/file/rar.gif
.gif
Editor/sysimage/file/rm.gif
.gif
Editor/sysimage/file/swf.gif
.gif
Editor/sysimage/file/txt.gif
.gif
Editor/sysimage/file/unknow.gif
.gif
Editor/sysimage/file/xls.gif
.gif
Editor/sysimage/file/zip.gif
.gif
Editor/sysimage/icon16/aspx.gif
.gif
Editor/sysimage/icon16/audio.gif
.gif
Editor/sysimage/icon16/avi.gif
.gif
Editor/sysimage/icon16/bmp.gif
.gif
Editor/sysimage/icon16/chm.gif
.gif
Editor/sysimage/icon16/code.gif
.gif
Editor/sysimage/icon16/doc.gif
.gif
Editor/sysimage/icon16/exe.gif
.gif
Editor/sysimage/icon16/gif.gif
.gif
Editor/sysimage/icon16/hlp.gif
.gif
Editor/sysimage/icon16/htm.gif
.gif
Editor/sysimage/icon16/ico.gif
.gif
Editor/sysimage/icon16/jpg.gif
.gif
Editor/sysimage/icon16/js.gif
.gif
Editor/sysimage/icon16/mdb.gif
.gif
Editor/sysimage/icon16/mid.gif
.gif
Editor/sysimage/icon16/mp.gif
.gif
Editor/sysimage/icon16/mp3.gif
.gif
Editor/sysimage/icon16/pdf.gif
.gif
Editor/sysimage/icon16/png.gif
.gif
Editor/sysimage/icon16/ppt.gif
.gif
Editor/sysimage/icon16/rar.gif
.gif
Editor/sysimage/icon16/rm.gif
.gif
Editor/sysimage/icon16/swf.gif
.gif
Editor/sysimage/icon16/txt.gif
.gif
Editor/sysimage/icon16/unknow.gif
.gif
Editor/sysimage/icon16/xls.gif
.gif
Editor/sysimage/icon16/xml.gif
.gif
Editor/sysimage/icon16/zip.gif
.gif
Editor/sysimage/icon32/aspx.gif
.gif
Editor/sysimage/icon32/audio.gif
.gif
Editor/sysimage/icon32/avi.gif
.gif
Editor/sysimage/icon32/bmp.gif
.gif
Editor/sysimage/icon32/chm.gif
.gif
Editor/sysimage/icon32/code.gif
.gif
Editor/sysimage/icon32/doc.gif
.gif
Editor/sysimage/icon32/exe.gif
.gif
Editor/sysimage/icon32/gif.gif
.gif
Editor/sysimage/icon32/hlp.gif
.gif
Editor/sysimage/icon32/htm.gif
.gif
Editor/sysimage/icon32/ico.gif
.gif
Editor/sysimage/icon32/jpg.gif
.gif
Editor/sysimage/icon32/js.gif
.gif
Editor/sysimage/icon32/mdb.gif
.gif
Editor/sysimage/icon32/mid.gif
.gif
Editor/sysimage/icon32/mp.gif
.gif
Editor/sysimage/icon32/mp3.gif
.gif
Editor/sysimage/icon32/pdf.gif
.gif
Editor/sysimage/icon32/png.gif
.gif
Editor/sysimage/icon32/ppt.gif
.gif
Editor/sysimage/icon32/rar.gif
.gif
Editor/sysimage/icon32/rm.gif
.gif
Editor/sysimage/icon32/swf.gif
.gif
Editor/sysimage/icon32/txt.gif
.gif
Editor/sysimage/icon32/unknow.gif
.gif
Editor/sysimage/icon32/xls.gif
.gif
Editor/sysimage/icon32/xml.gif
.gif
Editor/sysimage/icon32/zip.gif
.gif
Editor/sysimage/italic.gif
.gif
Editor/sysimage/loading.gif
.gif
Editor/sysimage/rect.gif
.gif
Editor/sysimage/rectimg.gif
.gif
Editor/sysimage/space.gif
.gif
Editor/sysimage/tree/arrowdown.gif
.gif
Editor/sysimage/tree/arrowup.gif
.gif
Editor/sysimage/tree/blank.gif
.gif
Editor/sysimage/tree/branch1.gif
.gif
Editor/sysimage/tree/branch2.gif
.gif
Editor/sysimage/tree/dirclose.gif
.gif
Editor/sysimage/tree/diropen.gif
.gif
Editor/sysimage/tree/folderclose.gif
.gif
Editor/sysimage/tree/folderopen.gif
.gif
Editor/sysimage/tree/folderparent.gif
.gif
Editor/sysimage/tree/line.gif
.gif
Editor/sysimage/tree/minus1.gif
.gif
Editor/sysimage/tree/minus2.gif
.gif
Editor/sysimage/tree/plus1.gif
.gif
Editor/sysimage/tree/plus2.gif
.gif
Editor/sysimage/tree/root.gif
.gif
Editor/template/0.gif
.gif
Editor/template/01.htm
Editor/template/02.htm
Editor/template/03.htm
Editor/template/04.htm
Editor/template/05.htm
Editor/template/06.htm
Editor/template/template.js
FORMAT.asp
.vbs
Html/index.asp
.vbs
Images/0.gif
.gif
Images/1.gif
.gif
Images/2.gif
.gif
Images/3.gif
.gif
Images/4.gif
.gif
Images/5.gif
.gif
Images/6.gif
.gif
Images/7.gif
.gif
Images/Css.asp
.vbs
Images/Css1.css
Images/Css10.css
Images/Css2.css
Images/Css3.css
Images/Css4.css
Images/Css5.css
Images/Css6.css
Images/Css8.css
Images/Css9.css
Images/Female.gif
.gif
Images/Male.gif
.gif
Images/Rect.gif
.gif
Images/Thumbs.db
Images/admin_css.css
Images/admintitle.gif
.gif
Images/b2.gif
.gif
Images/b6.gif
.gif
Images/bg9.gif
.gif
Images/blackground.gif
.gif
Images/check_err.gif
.gif
Images/check_right.gif
.gif
Images/close.gif
.gif
Images/css10menubg.png
.png
Images/css8/Thumbs.db
Images/css8/header_head.gif
.gif
Images/css8/title_bg.gif
.gif
Images/d5.gif
.gif
Images/dh.gif
.gif
Images/digest.gif
.gif
Images/first.gif
.gif
Images/getcity.js
.js
Images/index_bg.gif
.gif
Images/input_bg.gif
.gif
Images/kavkill_new.gif
.gif
Images/kavkill_normal.gif
.gif
Images/kavkill_reply.gif
.gif
Images/kavkill_topic.gif
.gif
Images/last.gif
.gif
Images/level/01.gif
.gif
Images/level/02.gif
.gif
Images/level/03.gif
.gif
Images/level/04.gif
.gif
Images/level/05.gif
.gif
Images/level/06.gif
.gif
Images/level/07.gif
.gif
Images/level/08.gif
.gif
Images/level/09.gif
.gif
Images/level/10.gif
.gif
Images/level/11.gif
.gif
Images/level/12.gif
.gif
Images/level/13.gif
.gif
Images/level/14.gif
.gif
Images/level/15.gif
.gif
Images/level/16.gif
.gif
Images/level/17.gif
.gif
Images/level/18.gif
.gif
Images/level/19.gif
.gif
Images/level/20.gif
.gif
Images/level/21.gif
.gif
Images/level/22.gif
.gif
Images/level/23.gif
.gif
Images/level/24.gif
.gif
Images/level/25.gif
.gif
Images/level/26.gif
.gif
Images/level/27.gif
.gif
Images/level/28.gif
.gif
Images/level/29.gif
.gif
Images/level/30.gif
.gif
Images/level/31.gif
.gif
Images/level/Thumbs.db
Images/level/vip.gif
.gif
Images/loading.gif
.gif
Images/logo.gif
.jpg
Images/nav-bg.gif
.gif
Images/nav_icon.gif
.gif
Images/new.gif
.gif
Images/news.gif
.gif
Images/noface.gif
.gif
Images/num/1.gif
.gif
Images/num/10.gif
.gif
Images/num/2.gif
.gif
Images/num/3.gif
.gif
Images/num/4.gif
.gif
Images/num/5.gif
.gif
Images/num/6.gif
.gif
Images/num/7.gif
.gif
Images/num/8.gif
.gif
Images/num/9.gif
.gif
Images/num/Thumbs.db
Images/pop.css
Images/popup_nav.png
.png
Images/pre_01.gif
.gif
Images/pre_02.gif
.gif
Images/rss.gif
.gif
Images/search.jpg
.jpg
Images/selcolor.html
.html .js polyglot
Images/signature_bg.gif
.gif
Images/swfnews.swf
Images/title_bg.gif
.gif
Images/title_bg2.gif
.gif
Images/title_green1.gif
.gif
Images/title_pink1.gif
.gif
Images/vote.gif
.gif
Images/vote/0.gif
.gif
Images/vote/1.gif
.gif
Images/vote/2.gif
.gif
Images/vote/3.gif
.gif
Images/vote/4.gif
.gif
Images/vote/Thumbs.db
Images/votesubmit.jpg
.jpg
Images/votetitle.jpg
.jpg
Images/wq.gif
.gif
Images/wz.js
.js
Images/wz/Thumbs.db
Images/wz/baidu.gif
.gif
Images/wz/google.gif
.gif
Images/wz/hexun.gif
.gif
Images/wz/poco.gif
.gif
Images/wz/qq.gif
.gif
Images/wz/vivi.gif
.gif
Inc.asp
.vbs
Inc/Ajax.js
.js
Inc/AutoKey.asp
.vbs
Inc/Code.asp
.vbs
Inc/Config.asp
.vbs
Inc/Fenye.asp
.vbs
Inc/Function.asp
.vbs
Inc/Function_Page.asp
.vbs
Inc/Main.asp
.js
Inc/SaveImage.asp
.vbs
Inc/Ubb.asp
.vbs
Inc/conn.asp
.asp .vbs polyglot
Inc/md5.asp
.vbs
admin/Admin_Article.asp
.vbs
admin/Admin_Check.asp
.vbs
admin/Admin_Class.asp
.vbs
admin/Admin_Guestbook.asp
.vbs
admin/Admin_Link.asp
.vbs
admin/Admin_Setting.asp
.vbs
admin/Class_Setting.asp
.vbs
admin/EditorAdmin/private.asp
.vbs
admin/EditorAdmin/private.css
admin/EditorAdmin/private.js
.js
admin/EditorAdmin/style.asp
.vbs
admin/EditorAdmin/upload.asp
.vbs
admin/Index.asp
.js
admin/LaoYRSS.asp
.vbs
admin/Main.Asp
.vbs
admin/Upload.asp
.vbs
admin/a.htm
.html
admin/cai/Admin_ItemAddNew.asp
admin/cai/Admin_ItemAddNew2.asp
.vbs
admin/cai/Admin_ItemAddNew3.asp
.vbs
admin/cai/Admin_ItemAddNew4.asp
.vbs
admin/cai/Admin_ItemAddNew5.asp
.vbs
admin/cai/Admin_ItemAttribute.asp
.vbs
admin/cai/Admin_ItemCollecFast.asp
.vbs
admin/cai/Admin_ItemCollection.asp
.vbs
admin/cai/Admin_ItemFilterAdd.asp
.vbs
admin/cai/Admin_ItemFilterModify.asp
.vbs
admin/cai/Admin_ItemFilters.asp
.vbs
admin/cai/Admin_ItemHelp.asp
admin/cai/Admin_ItemHistroly.asp
.vbs
admin/cai/Admin_ItemManage.asp
.vbs
admin/cai/Admin_ItemModify.asp
.vbs
admin/cai/Admin_ItemModify2.asp
.vbs
admin/cai/Admin_ItemModify3.asp
.vbs
admin/cai/Admin_ItemModify4.asp
.vbs
admin/cai/Admin_ItemModify5.asp
.vbs
admin/cai/Admin_ItemStart.asp
.vbs
admin/cai/Admin_ItemSuccess.asp
.vbs
admin/cai/Admin_Itemcopy.asp
.vbs
admin/cai/Admin_Itemlaoy.asp
.vbs
admin/cai/Admin_menu.asp
admin/cai/Database/#Item.mdb
admin/cai/Inc/Admin_ItemManage.asp
.vbs
admin/cai/Inc/Function.asp
.vbs
admin/cai/Inc/clsCache.asp
.vbs
admin/cai/Inc/conn.asp
.vbs
admin/cai/Inc/ubbcode.asp
.vbs
admin/cai/laoycai.mdb
admin/css/admincss.css
admin/css/classad.css
admin/images/210bg.gif
.gif
admin/images/36.png
.png
admin/images/766bg.jpg
.jpg
admin/images/Thumbs.db
admin/images/_c.gif
.gif
admin/images/_h.gif
.gif
admin/images/admin_css.css
admin/images/admintop.gif
.gif
admin/images/bg_120.gif
.gif
admin/images/blank.jpg
.jpg
admin/images/bottom.gif
.gif
admin/images/c.gif
.gif
admin/images/css.css
admin/images/grip.gif
.gif
admin/images/h.gif
.gif
admin/images/icon/Thumbs.db
admin/images/icon/close.gif
.gif
admin/images/icon/del.gif
.gif
admin/images/icon/down.gif
.gif
admin/images/icon/empty.gif
.gif
admin/images/icon/folder.gif
.gif
admin/images/icon/home.gif
.gif
admin/images/icon/ico_2.gif
.gif
admin/images/icon/ico_3.gif
.gif
admin/images/icon/ico_4.gif
.gif
admin/images/icon/jiandao.gif
.gif
admin/images/icon/join.gif
.gif
admin/images/icon/joinbottom.gif
.gif
admin/images/icon/line.gif
.gif
admin/images/icon/minus.gif
.gif
admin/images/icon/minus_bottom.gif
.gif
admin/images/icon/minus_nolines.gif
.gif
admin/images/icon/open.gif
.gif
admin/images/icon/plus.gif
.gif
admin/images/icon/plus_bottom.gif
.gif
admin/images/icon/plus_nolines.gif
.gif
admin/images/img.gif
.gif
admin/images/jiandao.gif
.gif
admin/images/kh.gif
.gif
admin/images/left_logo.gif
.gif
admin/images/left_logo2.gif
.gif
admin/images/left_top.gif
.gif
admin/images/leftbg.jpg
.jpg
admin/images/lg.gif
.gif
admin/images/main.css
admin/images/main.jpg
.jpg
admin/images/man.GIF
.gif
admin/images/mbg.gif
.gif
admin/images/mbg.jpg
.jpg
admin/images/menu.js
.js
admin/images/menubg_1.gif
.gif
admin/images/menubg_2.gif
.gif
admin/images/menubg_3.gif
.gif
admin/images/menubg_4.gif
.gif
admin/images/midbg.jpg
.jpg
admin/images/midbg.png
.png
admin/images/pl.gif
.gif
admin/images/prompt.gif
.gif
admin/images/right_logo.gif
.gif
admin/images/tab_14.gif
.gif
admin/images/title.gif
.gif
admin/images/tj.jpg
.jpg
admin/images/track.gif
.gif
admin/images/tree_empty.gif
.gif
admin/images/tree_folder.gif
.gif
admin/images/tree_line.gif
.gif
admin/images/tree_minusbottom.gif
.gif
admin/images/tree_minusmiddle.gif
.gif
admin/images/txtbg.gif
.gif
admin/js/Jquery.js
.js
admin/js/admin.js
.js
admin/js/menuswitch.js
.js
admin/login.asp
.vbs
admin/ls_list.asp
admin/rz.asp
.vbs
admin/test2.htm
admin/xs_list.asp
admin/zcls.asp
.vbs
admin/zcls_Del.asp
.vbs
admin/zcls_mod.asp
.js
admin/zcls_mod_ok.asp
.vbs
admin/zcxs.asp
.vbs
admin/zxls_del.asp
.vbs
admin/新云软件.url
.url
css.css
denglu.asp
denglu1.asp
.vbs
image/an.jpg
.jpg
image/an1.jpg
.jpg
image/d.jpg
.jpg
image/dh.jpg
.jpg
image/dh1.jpg
.jpg
image/gg.jpg
.jpg
image/ggbj.jpg
.jpg
image/hxx.jpg
.jpg
image/hydl.jpg
.jpg
image/j1.jpg
.jpg
image/j2.jpg
.jpg
image/j3.jpg
.jpg
image/jt.jpg
.jpg
image/logo.gif
.jpg
image/logo.jpg
.jpg
image/qe.jpg
.jpg
image/qe1.jpg
.jpg
image/ss.jpg
.jpg
image/top.jpg
.jpg
image/tu-3.jpg
.jpg
image/tu.jpg
.jpg
image/tu1.jpg
.jpg
image/tu2.jpg
.jpg
image/tu4.jpg
.jpg
image/w.jpg
.jpg
image/xm.jpg
.jpg
image/xxx.jpg
.jpg
image/xxx1.jpg
.jpg
index.asp
.vbs
logout.asp
slist.asp
.vbs
student.asp
.vbs
teacher.asp
.vbs
tlist.asp
.vbs
user/zcls.asp
.js
user/zcls_mod.asp
.js
user/zcls_mod_ok.asp
.vbs
user/zclsok.asp
.vbs
user/zcxs.asp
.js
user/zcxs_mod.asp
.js
user/zcxs_mod_ok.asp
.vbs
user/zcxsok.asp
.vbs
user/zhuce.asp
原版说明.txt

Sharing

General

Malware Config

Signatures

Files

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cfSigner

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 7KB

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:feSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 36KB

DATA Size: 1024B - Virtual size: 588B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 14KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

.text
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 7KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

CODE
Size: 36KB - Virtual size: 36KB

DATA
Size: 1024B - Virtual size: 588B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 14KB