947213b593b26cd57911bbd2029c2790_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

947213b593b26cd57911bbd2029c2790_JaffaCakes118
Size

208KB
MD5

947213b593b26cd57911bbd2029c2790
SHA1

7479ec7a57e17aa27f27f3f52717aee3f191d0c1
SHA256

62484e63a2c90cffd7ec0980b7d3df98e0af4cfd217df48467a24629075d7ce0
SHA512

cd6900ad559b54cd794881c8d2e35bf8851846c8f8ae2a84bc6e838230a80673f59b5fb5a245eda96d26be2abc1ebdcd89a8bcf71abdc8bb5a1825a5c2c1db01
SSDEEP

3072:a8xpIJBtl0WuTKcPOeIrZPrh9m5xqjL5L5AsHW+YIRsbPb5l3zC7h8C6SbH+RimL:c903KcWe8ZPrh9m5snAbOg/3Eo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
947213b593b26cd57911bbd2029c2790_JaffaCakes118

Files

947213b593b26cd57911bbd2029c2790_JaffaCakes118
.dll windows:4 windows x86 arch:x86

accaf2f9011ffb1dd7c6ebf00aa8eb35

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

gethostname
WSASetLastError
ntohs
getservbyport
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr

wininet

DetectAutoProxyUrl
InternetOpenUrlW
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
HttpAddRequestHeadersW
HttpSendRequestExW
HttpEndRequestW
InternetErrorDlg
InternetQueryOptionW
InternetWriteFile
InternetQueryDataAvailable
HttpQueryInfoW
InternetCloseHandle
InternetReadFile

kernel32

GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedCompareExchange
Sleep
QueryPerformanceCounter
GetProcAddress
GetTempPathW
GetTempFileNameW
GetPrivateProfileIntW
GetPrivateProfileStringW
DeleteFileW
CreateFileW
WriteFile
CloseHandle
LoadLibraryW
GetVersionExW
lstrlenA
lstrcpyA
GetSystemDirectoryA
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetLastError
FreeLibrary
InterlockedExchange
LoadLibraryA

user32

GetDesktopWindow

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

xmempoollib91

CyMemAlloc
CyMemFree

xbasiclib91

?ProcessMessageMap@Cy_Object@@UAEJPAXAAH@Z
?Init@Cy_Object@@UAEXXZ
?SetDefault@Cy_Object@@UAEXXZ
?ChkDefault@Cy_Object@@UBEHXZ
?Load@Cy_Object@@UAEJABVCy_XString@@0@Z
?Load@Cy_Object@@UAEJABVCy_XString@@@Z
?Save@Cy_Object@@UBEJAAVCy_XString@@ABV2@@Z
?Save@Cy_Object@@UBEJAAVCy_XString@@@Z
?SerializeXML@Cy_Object@@UAEJPAVCy_XmlNode@@@Z
?SerializeXML_Properties@Cy_Object@@UAEJPAVCy_XmlNode@@@Z
?SerializeXML_ChildObject@Cy_Object@@UAEJPAVCy_XmlNode@@ABVCy_XString@@PAV1@H@Z
?SerializeXML_StyleProperties@Cy_Object@@UAEJPAVCy_XmlNode@@@Z
?SerializeXML_Contents@Cy_Object@@UAEJPAVCy_XmlNode@@@Z
?GetPropertyMapList@Cy_Object@@SAABVCy_ObjectMapPtr@@XZ
?GetMethodMapList@Cy_Object@@SAABVCy_ObjectMapPtr@@XZ
?_CyNullNamedStr@Cy_NamedStr@@2V1@A
?Left@Cy_XString@@QBE?AV1@H@Z
?ReverseFind@Cy_XString@@QBEHPBDH@Z
?Find@Cy_XString@@QBEHPBDH@Z
?GetNextEnumerable@Cy_ArrayObject@@UBEHHAAVCy_XString@@H@Z
?IsArrayObject@Cy_ArrayObject@@UBEHXZ
?_TypeName@Cy_ArrayObject@@SAPBDXZ
?_TypeCode@Cy_ArrayObject@@SAIXZ
?EncodeBase64@Cy_Buffer@@QBE?AVCy_XString@@XZ
?AppendStr@Cy_Buffer@@QAEAAV1@ABVCy_XString@@I@Z
?Format@Cy_XString@@QAAPBDPBDZZ
?_CyNullString@Cy_XString@@2V1@A
?_TypeName@Cy_NamedStrArrayObject@@SAPBDXZ
?_TypeCode@Cy_NamedStrArrayObject@@SAIXZ
?UnQuoteStr@Cy_XString@@QBE?AV1@XZ
?FindQuoteEnd@Cy_ParseUtil@@SAHPBDH@Z
?FindWordEnd@Cy_ParseUtil@@SAHPBDH@Z
?cy_findskip@@YAHPBDH@Z
??0Cy_Buffer@@QAE@PBEH@Z
?DecodeBase64@Cy_XString@@QBE?AVCy_Buffer@@XZ
?ConcatInPlace@Cy_XString@@IAEXPBDH@Z
??H@YG?AVCy_XString@@PBDABV0@@Z
?GetAt@Cy_XString@@QBE?BDH@Z
?Set@Cy_Variant@@QAEXABV1@@Z
?ConvToString@Cy_ObjectArrayObject@@UBEHAAVCy_XString@@@Z
?ConvToLocaleString@Cy_ObjectArrayObject@@UBEHAAVCy_XString@@PBD@Z
?LoadChildItem@Cy_ObjectArrayObject@@UAEJPBDAAVCy_XmlNode@@@Z
?InvokeMethod@Cy_Object@@UAEJPAU_OBJECTMETHODINFO@1@PBVCy_Variant@@HAAV3@@Z
?GetNextEnumerable@Cy_ObjectArrayObject@@UBEHHAAVCy_XString@@H@Z
?GetObjPropMapCount@Cy_ObjectArrayObject@@UBEHXZ
?GetObjPropInfo@Cy_ObjectArrayObject@@UBEPAU_MAP_OBJPROP_INFO@@H@Z
?FindObjPropInfo@Cy_ObjectArrayObject@@UBEPAU_MAP_OBJPROP_INFO@@PBD@Z
?GetObjMethodMapCount@Cy_ObjectArrayObject@@UBEHXZ
?GetObjMethodInfo@Cy_ObjectArrayObject@@UBEPAU_MAP_OBJMETHOD_INFO@@H@Z
?FindObjMethodInfo@Cy_ObjectArrayObject@@UBEPAU_MAP_OBJMETHOD_INFO@@PBD@Z
?method_get_item@Cy_ObjectArrayObject@@UAEJPBVCy_Variant@@HAAV2@@Z
?method_set_item@Cy_ObjectArrayObject@@UAEJPBVCy_Variant@@HAAV2@@Z
?_TypeName@Cy_ObjectArrayObject@@SAPBDXZ
?_TypeCode@Cy_ObjectArrayObject@@SAIXZ
?GetPropertyMapList@Cy_ObjectArrayObject@@SAABVCy_ObjectMapPtr@@XZ
?GetMethodMapList@Cy_ObjectArrayObject@@SAABVCy_ObjectMapPtr@@XZ
?SetValue@Cy_Variant@@QAEXABV1@@Z
?_TypeName@Cy_Object@@SAPBDXZ
?_TypeName@Cy_VariableArrayObject@@SAPBDXZ
?_TypeCode@Cy_VariableArrayObject@@SAIXZ
?Trim@Cy_XString@@QAEXXZ
?Parse@Cy_XStrArrayBase@@QAEHPBDH0DHHHHH@Z
?GetAt@Cy_Buffer@@QBEEH@Z
?Set@Cy_XString@@QAEABV1@PB_WH@Z
?ToInt32@Cy_XString@@QBEJHH@Z
?Close@Cy_File@@QAEHXZ
?IsOpen@Cy_File@@QBEHXZ
??H@YG?AVCy_XString@@ABV0@PBD@Z
?Mid@Cy_XString@@QBE?AV1@HH@Z
??0Cy_EventInfo@@QAE@XZ
?ToString@Cy_Variant@@QBEXAAVCy_XString@@@Z
??YCy_XString@@QAEABV0@J@Z
?EncodeUrl@Cy_XString@@QBE?AV1@H@Z
?Read@Cy_File@@QAEHPADAAH@Z
?GetSize@Cy_File@@QBEHXZ
?Append@Cy_Buffer@@QAEAAV1@PBEH@Z
??1Cy_File@@UAE@XZ
?Open@Cy_File@@QAEHPBD0@Z
??0Cy_File@@QAE@XZ
?_TypeName@Cy_XStrArrayObject@@SAPBDXZ
?_TypeCode@Cy_XStrArrayObject@@SAIXZ
?_TypeName@Cy_ObjectMapObject@@SAPBDXZ
?_TypeCode@Cy_ObjectMapObject@@SAIXZ
?FromInteger@Cy_XString@@SA?AV1@J@Z
?GetClassObjectBase@Cy_EventObject@@UBEPAVCy_ClassObjectBase@@XZ
?SetClassObjectBase@Cy_EventObject@@UAEXPBVCy_ClassObjectBase@@@Z
?GetName@Cy_EventObject@@UBEPBDXZ
?SetName@Cy_EventObject@@UAEXPBD@Z
?GetObjPropMapCount@Cy_EventObject@@UBEHXZ
?GetObjPropInfo@Cy_EventObject@@UBEPAU_MAP_OBJPROP_INFO@@H@Z
?FindObjPropInfo@Cy_EventObject@@UBEPAU_MAP_OBJPROP_INFO@@PBD@Z
?GetObjMethodMapCount@Cy_EventObject@@UBEHXZ
?GetObjMethodInfo@Cy_EventObject@@UBEPAU_MAP_OBJMETHOD_INFO@@H@Z
?FindObjMethodInfo@Cy_EventObject@@UBEPAU_MAP_OBJMETHOD_INFO@@PBD@Z
?_TypeName@Cy_EventObject@@SAPBDXZ
?_TypeCode@Cy_EventObject@@SAIXZ
?GetPropertyMapList@Cy_EventObject@@SAABVCy_ObjectMapPtr@@XZ
?GetMethodMapList@Cy_EventObject@@SAABVCy_ObjectMapPtr@@XZ
?ConvToString@Cy_ObjectHashArrayObject@@UBEHAAVCy_XString@@@Z
?ConvToLocaleString@Cy_ObjectHashArrayObject@@UBEHAAVCy_XString@@PBD@Z
?LoadChildItem@Cy_ObjectHashArrayObject@@UAEJPBDAAVCy_XmlNode@@@Z
?OnDestroy@Cy_ObjectHashArrayObject@@MAEXXZ
?GetNextEnumerable@Cy_ObjectHashArrayObject@@UBEHHAAVCy_XString@@H@Z
?GetObjPropMapCount@Cy_ObjectHashArrayObject@@UBEHXZ
?GetObjPropInfo@Cy_ObjectHashArrayObject@@UBEPAU_MAP_OBJPROP_INFO@@H@Z
?FindObjPropInfo@Cy_ObjectHashArrayObject@@UBEPAU_MAP_OBJPROP_INFO@@PBD@Z
?GetObjMethodMapCount@Cy_ObjectHashArrayObject@@UBEHXZ
?GetObjMethodInfo@Cy_ObjectHashArrayObject@@UBEPAU_MAP_OBJMETHOD_INFO@@H@Z
?FindObjMethodInfo@Cy_ObjectHashArrayObject@@UBEPAU_MAP_OBJMETHOD_INFO@@PBD@Z
?method_get_item@Cy_ObjectHashArrayObject@@UAEJPBVCy_Variant@@HAAV2@@Z
?method_set_item@Cy_ObjectHashArrayObject@@UAEJPBVCy_Variant@@HAAV2@@Z
?GetPropertyMapList@Cy_ObjectHashArrayObject@@SAABVCy_ObjectMapPtr@@XZ
?GetMethodMapList@Cy_ObjectHashArrayObject@@SAABVCy_ObjectMapPtr@@XZ
??1Cy_Socket@@UAE@XZ
?Find@Cy_XString@@QBEH_WH@Z
?Set@Cy_XString@@QAEABV1@IPBDH@Z
?CyGetLocaleCP@@YAIXZ
?SetObject@Cy_Variant@@QAEXPBVCy_Object@@H@Z
??0Cy_Socket@@QAE@XZ
?FireEvent@Cy_EventObject@@QBEJPBVCy_Object@@PAV2@H@Z
?Open@Cy_File@@QAEHPBDKKKH@Z
?Set@Cy_Variant@@QAEXABVCy_XString@@@Z
?CySysErrorStr@@YA?AVCy_XString@@H@Z
?Open@Cy_File@@QAEHPBDHH@Z
?ToString@Cy_Buffer@@QAE?AVCy_XString@@I@Z
?Set@Cy_Buffer@@QAEABV1@PBEH@Z
?IsExist@Cy_Dir@@SAHPBD@Z
?MakeDir@Cy_Dir@@SAHPBD@Z
?Write@Cy_File@@QAEHPBDH@Z
?ConvertCodePageTo@Cy_XString@@QBE?AVCy_AString@@I@Z
?ToString@Cy_DateTime@@QBE?AVCy_XString@@PBD@Z
?GetCurrentLocalTime@Cy_DateTime@@SA?AV1@XZ
?Delete@Cy_File@@SAHPBD@Z
??YCy_XString@@QAEABV0@PB_W@Z
?Right@Cy_XString@@QBE?AV1@H@Z
??0Cy_AString@@QAE@IPBDH@Z
?Findi@Cy_XString@@QBEHPBDH@Z
?CyDebugMsg@@YAXPBDZZ
?Set@Cy_AString@@QAEABV1@PBDH@Z
?ToDouble@Cy_XString@@QBENHH@Z
?Remove@Cy_XString@@QAEH_W@Z
?InvokeSetProperty@Cy_Object@@UAEJPAU_OBJECTPROPINFO@1@ABVCy_Variant@@@Z
?InvokeGetProperty@Cy_Object@@UBEJPAU_OBJECTPROPINFO@1@AAVCy_Variant@@@Z
?OnScriptErrorVA@Cy_Object@@UAEXHPBDHABVCy_XString@@ABVCy_VariantArray@@H@Z
?OnScriptErrorVV@Cy_Object@@UAEXHPBDHABVCy_XString@@ABVCy_Variant@@2H@Z
?OnScriptErrorV@Cy_Object@@UAEXHPBDHABVCy_XString@@ABVCy_Variant@@H@Z
?GetNextEnumerable@Cy_Object@@UBEHHAAVCy_XString@@H@Z
?OnCreate@Cy_Object@@MAEJPAV1@PAVCy_XmlNode@@PBVCy_Variant@@H@Z
?GetInnerObject@Cy_Object@@UBEPAXXZ
?CreateUserClassObject@Cy_Object@@UAEPAVCy_ClassObjectBase@@PBD@Z
?ImplementCanvas@Cy_Object@@UAEJABVCy_PVOIDArray@@@Z
?GetBindableProperties@Cy_Object@@UAE?AVCy_Variant@@XZ
?NotifyBindColumn@Cy_Object@@UAEHVCy_XString@@PAV1@HHH@Z
?TerminateScript@Cy_Object@@UAEXXZ
?IsShouldTerminate@Cy_Object@@UBEHXZ
?GetCanvas@Cy_Object@@UAEPAV1@XZ
?IsValidBase@Cy_Object@@UBEHXZ
?IsUrlLoaded@Cy_Object@@UBEHXZ
?SetZOrder@Cy_Object@@UAEJH@Z
?SetTabOrder@Cy_Object@@UAEJH@Z
?GetZOrder@Cy_Object@@UBEHXZ
?GetTabOrder@Cy_Object@@UBEHXZ
?DeleteChild@Cy_Object@@UAEJH@Z
?DeleteChild@Cy_Object@@UAEJPBV1@@Z
?GetChildCount@Cy_Object@@UBEHXZ
?GetChildPos@Cy_Object@@UBEHPBV1@@Z
?GetChild@Cy_Object@@UBEPAV1@H@Z
?AddChild@Cy_Object@@UAEHPBDPAV1@@Z
?GetChildObjectID@Cy_Object@@UBEPBDH@Z
?GetChildObject@Cy_Object@@UBEPAV1@PBD@Z
?SetParentObject@Cy_Object@@UAEXPBV1@@Z
?GetParentObject@Cy_Object@@UBEPAV1@XZ
?CreateChildObject@Cy_Object@@UAEPAV1@PBD@Z
?LoadContents@Cy_Object@@UAEJAAVCy_XmlNode@@@Z
?LoadChildItem@Cy_Object@@UAEJPBDAAVCy_XmlNode@@@Z
?LoadPropertyItem@Cy_Object@@UAEJPBD0@Z
?DelVariable@Cy_Object@@UAEJABVCy_XString@@@Z
?AddVariable@Cy_Object@@UAEJABVCy_XString@@ABVCy_Variant@@H@Z
?AddVariable@Cy_Object@@UAEJABVCy_XString@@ABVCy_Variant@@@Z
?AddVariable@Cy_Object@@UAEJABVCy_XString@@@Z
?SetVariable@Cy_Object@@UAEJABVCy_XString@@ABVCy_Variant@@@Z
?GetVariable@Cy_Object@@UBEJABVCy_XString@@AAVCy_Variant@@H@Z
?CallMethod@Cy_Object@@UAEJABVCy_XString@@PBVCy_Variant@@HAAV3@@Z
?SetProperty@Cy_Object@@UAEJABVCy_XString@@ABVCy_Variant@@@Z
?GetProperty@Cy_Object@@UBEJABVCy_XString@@AAVCy_Variant@@@Z
?GetObjectByName@Cy_Object@@UBEHABVCy_XString@@PAVCy_Variant@@AAT_InvokeFuncInfo@1@W4CY_OBJECT_RELATION@@@Z
?ConvToStream@Cy_Object@@UBEHAAVCy_Buffer@@@Z
?ConvToString@Cy_Object@@UBEHAAVCy_XString@@@Z
?ConvToNumber@Cy_Object@@UBEHAAVCy_Variant@@@Z
?ConvToValue@Cy_Object@@UBEHAAVCy_Variant@@@Z
?FromObject@Cy_Object@@UAEXPBV1@@Z
?IsContext@Cy_Object@@UBEHXZ
?IsDerivedFrom@Cy_Object@@UBEHPBD@Z
?IsDerivedFrom@Cy_Object@@UBEHI@Z
?IsInstanceOf@Cy_Object@@UBEHPBD@Z
?IsInstanceOf@Cy_Object@@UBEHI@Z
?GetTypeName@Cy_Object@@UBEPBDXZ
?Set@Cy_XString@@QAEABV1@PBDH@Z
?Set@Cy_WString@@QAEABV1@PBDH@Z
?GetSafeDataBuffer@Cy_SharedBufferObj@@IAEPAEHH@Z
?OnDestroy@Cy_ObjectArrayObject@@MAEXXZ

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

_wtoi
strcat_s
sprintf_s
strtoul
strncpy_s
free
calloc
strcpy_s
_wtol
strtol
_encode_pointer
_lock
rand
strpbrk
strchr
??0exception@std@@QAE@ABV01@@Z
_strnicmp
_stricmp
_CxxThrowException
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
__CxxFrameHandler3
memmove
memset
?terminate@@YAXXZ
_unlock
strrchr
__dllonexit
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_decode_pointer
_onexit
_strupr

Exports

Exports

??0Cy_Cookie@@QAE@XZ
??0Cy_CookieItem@@QAE@XZ
??0Cy_CookieManager@@QAE@XZ
??0Cy_CookiePath@@QAE@XZ
??0Cy_Http@@QAE@XZ
??0Cy_HttpAuthBasic@@QAE@XZ
??0Cy_HttpAuthProxyBasic@@QAE@XZ
??0Cy_HttpAuthProxyNTLM@@QAE@XZ
??0Cy_HttpContents@@QAE@XZ
??0Cy_HttpWininet@@QAE@XZ
??0Cy_Https@@QAE@XZ
??0Cy_HttpsWininet@@QAE@XZ
??1Cy_Cookie@@UAE@XZ
??1Cy_CookieItem@@UAE@XZ
??1Cy_CookieManager@@UAE@XZ
??1Cy_CookiePath@@UAE@XZ
??1Cy_Http@@UAE@XZ
??1Cy_HttpAuthProxyNTLM@@UAE@XZ
??1Cy_HttpContents@@QAE@XZ
??1Cy_HttpWininet@@UAE@XZ
??1Cy_Https@@UAE@XZ
??1Cy_HttpsWininet@@UAE@XZ
?AddContents@Cy_HttpContents@@QAEXABVCy_Buffer@@@Z
?AddContents@Cy_HttpContents@@QAEXPBEH@Z
?AddCookie@Cy_CookieManager@@QAEHABVCy_XString@@00@Z
?AddField@Cy_Http@@QAEHVCy_XString@@0PAX@Z
?AddFilenameField@Cy_Http@@QAEHVCy_Buffer@@VCy_XString@@111PAX@Z
?AddHeader@Cy_Http@@QAEXABVCy_XString@@0H@Z
?AddSharedtoCookie@Cy_Http@@QAEJAAVCy_XString@@AAVCy_VariableArray@@@Z
?Clear@Cy_CookieManager@@QAEXXZ
?Clear@Cy_HttpAuth@@UAEXXZ
?Clear@Cy_HttpAuthProxyNTLM@@UAEXXZ
?Clear@Cy_HttpContents@@QAEXXZ
?ClearContents@Cy_HttpContents@@QAEXXZ
?ClearHeader@Cy_Http@@QAEXH@Z
?Close@Cy_Http@@UAEXXZ
?Close@Cy_HttpWininet@@UAEXXZ
?Close@Cy_Https@@UAEXXZ
?Close@Cy_HttpsWininet@@UAEXXZ
?CompareDomain@Cy_Url@@SAHABVCy_XString@@0H@Z
?CutContents@Cy_HttpContents@@QAEXH@Z
?DelHeader@Cy_Http@@QAEXABVCy_XString@@@Z
?EncodeQueryStr@Cy_Http@@QAE?AVCy_XString@@XZ
?ExtractDomain@Cy_Url@@SA?AVCy_XString@@ABV2@@Z
?ExtractDomainEx@Cy_Url@@SA?AVCy_XString@@ABV2@@Z
?ExtractPageUrl@Cy_Url@@SA?AVCy_XString@@ABV2@@Z
?ExtractPort@Cy_Url@@SA?AVCy_XString@@ABV2@@Z
?ExtractProtocol@Cy_Url@@SA?AVCy_XString@@ABV2@@Z
?FindMimeType@Cy_Http@@QAE?AVCy_XString@@V2@@Z
?GenerateBoundary@Cy_Http@@QAEXXZ
?GetAgent@Cy_Http@@QBEABVCy_XString@@XZ
?GetBoundary@Cy_Http@@QAE?AVCy_XString@@XZ
?GetContentLength@Cy_Http@@QAEHVCy_XStrArray@@00VCy_XString@@0HH@Z
?GetContents@Cy_HttpContents@@QBEABVCy_Buffer@@XZ
?GetContentsEncodingType@Cy_HttpContents@@QBEABVCy_XString@@XZ
?GetContentsLength@Cy_HttpContents@@QBEHXZ
?GetContentsType@Cy_HttpContents@@QBEABVCy_XString@@XZ
?GetCookie@Cy_CookieManager@@QAEHABVCy_XString@@0AAV2@@Z
?GetCookie@Cy_CookieManager@@QAEHABVCy_XString@@AAVCy_VariableArray@@@Z
?GetHeaderCount@Cy_Http@@QBEHXZ
?GetHeaderStr@Cy_Http@@QAE?AVCy_XString@@PBDH@Z
?GetHeaderValue@Cy_Http@@QBEABVCy_XString@@ABV2@@Z
?GetHostStr@Cy_Http@@QAE?AVCy_XString@@XZ
?GetRecvContentsLength@Cy_Http@@QBEHXZ
?GetRecvLocationField@Cy_Http@@QAE?AVCy_XString@@XZ
?GetReturnCode@Cy_Http@@QBEHXZ
?Init@Cy_Http@@QAEHHHHHH@Z
?IsDomain@Cy_Url@@SAHABVCy_XString@@@Z
?IsKeepAlive@Cy_Http@@QAEHXZ
?LoadCookie@Cy_CookieManager@@QAE?AVCy_XString@@ABV2@@Z
?MakeAuthRequestHeader@Cy_HttpAuthBasicBase@@UAE?AVCy_XString@@PBD0@Z
?MakeAuthRequestHeader@Cy_HttpAuthProxyNTLM@@UAE?AVCy_XString@@PBD0@Z
?MakeDefaultHeaderList@Cy_Http@@QAEXXZ
?MakeHttpAuthHeader@Cy_Http@@QAEHABVCy_XString@@00AAVCy_ObjectPtr@@@Z
?MakeIDString@Cy_HttpAuth@@QAEABVCy_XString@@XZ
?MakeProxyAuthHeader@Cy_Http@@QAEHABVCy_XString@@00AAVCy_ObjectPtr@@@Z
?MakeReturnCode@Cy_Http@@IAEHPBD@Z
?Open@Cy_Http@@UAEHABVCy_XString@@0ABVCy_Buffer@@HH@Z
?Open@Cy_HttpWininet@@UAEHABVCy_XString@@0ABVCy_Buffer@@HH@Z
?Open@Cy_Https@@UAEHABVCy_XString@@0ABVCy_Buffer@@HH@Z
?Open@Cy_HttpsWininet@@UAEHABVCy_XString@@0ABVCy_Buffer@@HH@Z
?ParseHeader@Cy_Http@@IAEHABVCy_XString@@@Z
?ParseUrl@Cy_Http@@QAEJPBD@Z
?Read@Cy_Http@@UAEHH@Z
?Read@Cy_HttpWininet@@UAEHH@Z
?Read@Cy_Https@@UAEHH@Z
?Read@Cy_HttpsWininet@@UAEHH@Z
?ReadStep@Cy_Http@@UAEHH@Z
?ReadStep@Cy_HttpWininet@@UAEHH@Z
?ReadStep@Cy_Https@@UAEHH@Z
?ReadStep@Cy_HttpsWininet@@UAEHH@Z
?ReservedMethod@Cy_Http@@UAEJHPAXHPAPAX@Z
?Reset@Cy_Http@@QAEXXZ
?ResetForReconnect@Cy_Http@@UAEXXZ
?ResetForReconnect@Cy_HttpWininet@@UAEXXZ
?ResetForReconnect@Cy_Https@@UAEXXZ
?ResetForReconnect@Cy_HttpsWininet@@UAEXXZ
?SaveCookie@Cy_CookieManager@@QAEHABVCy_XString@@0@Z
?SaveCookietoShared@Cy_Http@@QAEJAAVCy_XString@@AAVCy_VariableArray@@H@Z
?Set@Cy_HttpAuth@@UAEXABV1@@Z
?Set@Cy_HttpContents@@QAEXABV1@@Z
?SetAgent@Cy_Http@@QAEXABVCy_XString@@@Z
?SetBoundary@Cy_Http@@QAEXAAVCy_Buffer@@H@Z
?SetContentLength@Cy_Http@@QAEXAAVCy_Buffer@@H@Z
?SetContents@Cy_HttpContents@@QAEXABVCy_Buffer@@@Z
?SetContents@Cy_HttpContents@@QAEXPBEH@Z
?SetContentsEncodingType@Cy_HttpContents@@QAEXABVCy_XString@@@Z
?SetContentsEncodingType@Cy_HttpContents@@QAEXPBD@Z
?SetContentsLength@Cy_HttpContents@@QAE?BHPAV?$multimap@VCy_XString@@V1@V_Cy_XString_Less_IgnoreCase@@V?$allocator@U?$pair@$$CBVCy_XString@@V1@@std@@@std@@@std@@H@Z
?SetContentsType@Cy_HttpContents@@QAEXABVCy_XString@@@Z
?SetContentsType@Cy_HttpContents@@QAEXPBD@Z
?SetCookie@Cy_CookieManager@@QAEHABVCy_XString@@00@Z
?SetHost@Cy_Http@@QAEHPBDH@Z
?SetResponseHeader@Cy_HttpAuth@@UAEHPBD0@Z
?SetResponseHeader@Cy_HttpAuthProxyNTLM@@UAEHPBD0@Z
?SetURL@Cy_Http@@QAEHABVCy_XString@@@Z
?_TypeCode@Cy_AuthInfoRequest@@SAIXZ
?_TypeCode@Cy_CookieArrayObject@@SAIXZ
?_TypeCode@Cy_CookieItemArrayObject@@SAIXZ
?_TypeCode@Cy_CookiePathArrayObject@@SAIXZ
?_TypeCode@Cy_Http@@SAIXZ
?_TypeCode@Cy_HttpAuth@@SAIXZ
?_TypeCode@Cy_HttpAuthArrayObject@@SAIXZ
?_TypeCode@Cy_HttpWininet@@SAIXZ
?_TypeCode@Cy_Https@@SAIXZ
?_TypeCode@Cy_HttpsWininet@@SAIXZ
?_TypeName@Cy_AuthInfoRequest@@SAPBDXZ
?_TypeName@Cy_CookieArrayObject@@SAPBDXZ
?_TypeName@Cy_CookieItemArrayObject@@SAPBDXZ
?_TypeName@Cy_CookiePathArrayObject@@SAPBDXZ
?_TypeName@Cy_Http@@SAPBDXZ
?_TypeName@Cy_HttpAuth@@SAPBDXZ
?_TypeName@Cy_HttpAuthArrayObject@@SAPBDXZ
?_TypeName@Cy_HttpWininet@@SAPBDXZ
?_TypeName@Cy_Https@@SAPBDXZ
?_TypeName@Cy_HttpsWininet@@SAPBDXZ

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

accaf2f9011ffb1dd7c6ebf00aa8eb35

Headers

File Characteristics

Imports

ws2_32

wininet

kernel32

user32

advapi32

xmempoollib91

xbasiclib91

msvcp80

msvcr80

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 127KB

.rdata Size: 48KB - Virtual size: 44KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 17KB

.text
Size: 128KB - Virtual size: 127KB

.rdata
Size: 48KB - Virtual size: 44KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB