b6d42a9749f9311f1c684bc5d5dbff18_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b6d42a9749f9311f1c684bc5d5dbff18_JaffaCakes118
Size

1.2MB
MD5

b6d42a9749f9311f1c684bc5d5dbff18
SHA1

ebc8967fb5ee41ca8f38c9b7b81c2110d324d665
SHA256

62efd9cf0f1e601b1aacfdf3609159bbd9c750b5ea3ed4b29146f948b7d59bf8
SHA512

54f629b96838c1853ac167cd51d464729185c17ddb001bd8324ee54ca0b89e9b1d2f0472a0061d3ff4c164eefc4e2e7d3f838d8d81d2e5bbd0136313a1d2c9d7
SSDEEP

24576:KM5j34cV5wqbk+1n4iRRl6VlzwDGsX8EFdQHHbMoXDT4O/URWfYvf3:K3+JtvX8EFdeHbMoXDT4O/URWfYvf3

Score

1^/10

Malware Config

Signatures

Files

b6d42a9749f9311f1c684bc5d5dbff18_JaffaCakes118
.dll windows:5 windows x64 arch:x64

7988158a789517da03750dccd94b7ba0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:ed:a9:bd:76:92:19:b5:ac:96:70:be:26:04:a1:a7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

20/02/2014, 00:00

Not After

21/03/2017, 23:59

Subject

CN=Imagineer Systems Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Imagineer Systems Ltd,L=Guildford,ST=Surrey,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:cb:e4:c5:31:db:3e:ee:53:42:96:8e:bb:3a:7a:2d:f9:4b:c2:48
Signer

Actual PE Digest

75:cb:e4:c5:31:db:3e:ee:53:42:96:8e:bb:3a:7a:2d:f9:4b:c2:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Hudson\dependencies.x86_64\qt\4.8.5-1\qt-everywhere-enterprise-src-4.8.5\lib\QtCLucene4.pdb

Imports

qtcore4

?unicode@QChar@@QEBA?BGXZ
?count@QString@@QEBAHXZ
??YQString@@QEAAAEAV0@AEBV0@@Z
?end@QListData@@QEBAPEAPEAXXZ
??MQString@@QEBA_NAEBV0@@Z
?insert@QListData@@QEAAPEAPEAXH@Z
?toAscii@QString@@QEBA?AVQByteArray@@XZ
?rightRef@QString@@QEBA?AVQStringRef@@H@Z
?fromLatin1@QString@@SA?AV1@PEBDH@Z
?remove@QFile@@SA_NAEBVQString@@@Z
?append@QByteArray@@QEAAAEAV1@AEBV1@@Z
?rename@QFile@@QEAA_NAEBVQString@@@Z
?detach_grow@QListData@@QEAAPEAUData@1@PEAHH@Z
?arg@QString@@QEBA?AV1@AEBV1@HAEBVQChar@@@Z
?toUpper@QChar@@QEBA?AV1@XZ
??AQString@@QEAA?AVQCharRef@@H@Z
??4QCharRef@@QEAAAEAV0@AEBVQChar@@@Z
??0QByteArray@@QEAA@PEBD@Z
?hash@QCryptographicHash@@SA?AVQByteArray@@AEBV2@W4Algorithm@1@@Z
?toHex@QByteArray@@QEBA?AV1@XZ
?size@QFileInfo@@QEBA_JXZ
?lastModified@QFileInfo@@QEBA?AVQDateTime@@XZ
?toTime_t@QDateTime@@QEBAIXZ
??1QDateTime@@QEAA@XZ
?clear@QString@@QEAAXXZ
?append@QString@@QEAAAEAV1@VQChar@@@Z
?entryList@QDir@@QEBA?AVQStringList@@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
?remove@QDir@@QEAA_NAEBVQString@@@Z
?exists@QFileInfo@@QEBA_NXZ
?isReadable@QFileInfo@@QEBA_NXZ
?isWritable@QFileInfo@@QEBA_NXZ
?entryList@QDir@@QEBA?AVQStringList@@AEBV2@V?$QFlags@W4Filter@QDir@@@@V?$QFlags@W4SortFlag@QDir@@@@@Z
??0QFileInfo@@QEAA@AEBVQString@@@Z
?absoluteFilePath@QFileInfo@@QEBA?AVQString@@XZ
??1QFileInfo@@QEAA@XZ
?isFile@QFileInfo@@QEBA_NXZ
?isSymLink@QFileInfo@@QEBA_NXZ
?setPath@QDir@@QEAAXAEBVQString@@@Z
?write@QIODevice@@QEAA_JPEBD_J@Z
?isOpen@QIODevice@@QEBA_NXZ
??0QFile@@QEAA@XZ
?read@QIODevice@@QEAA_JPEAD_J@Z
?setFileName@QFile@@QEAAXAEBVQString@@@Z
?error@QFile@@QEBA?AW4FileError@1@XZ
?remove@QFile@@QEAA_NXZ
?exists@QFile@@SA_NAEBVQString@@@Z
??0QDir@@QEAA@AEBVQString@@@Z
?exists@QDir@@QEBA_NXZ
?mkpath@QDir@@QEBA_NAEBVQString@@@Z
?open@QFile@@UEAA_NV?$QFlags@W4OpenModeFlag@QIODevice@@@@@Z
??1QDir@@QEAA@XZ
?separator@QDir@@SA?AVQChar@@XZ
?unicode@QChar@@QEAAAEAGXZ
?left@QString@@QEBA?AV1@H@Z
?append@QString@@QEAAAEAV1@AEBVQLatin1String@@@Z
?at@QListData@@QEBAPEAPEAXH@Z
?allocate@QVectorData@@SAPEAU1@HH@Z
?qBadAlloc@@YAXXZ
?reallocate@QVectorData@@SAPEAU1@PEAU1@HHH@Z
??4QBasicAtomicInt@@QEAAAEAV0@H@Z
?qMemSet@@YAPEAXPEAXH_K@Z
?free@QVectorData@@SAXPEAU1@H@Z
?grow@QVectorData@@SAHHHH_N@Z
?shared_null@QVectorData@@2U1@A
?size@QListData@@QEBAHXZ
?number@QString@@SA?AV1@HH@Z
??8QString@@QEBA_NAEBV0@@Z
?QStringList_contains@QtPrivate@@YA?AVQBool@@PEBVQStringList@@AEBVQString@@W4CaseSensitivity@Qt@@@Z
??8@YA_NAEBVQLatin1String@@AEBVQStringRef@@@Z
?isNull@QString@@QEBA_NXZ
?length@QString@@QEBAHXZ
??8QString@@QEBA_NAEBVQLatin1String@@@Z
?right@QString@@QEBA?AV1@H@Z
?leftRef@QString@@QEBA?AVQStringRef@@H@Z
??1QStringRef@@QEAA@XZ
?remove@QString@@QEAAAEAV1@HH@Z
?at@QString@@QEBA?BVQChar@@H@Z
?isDigit@QChar@@QEBA_NXZ
??0QFile@@QEAA@AEBVQString@@@Z
?exists@QFile@@QEBA_NXZ
??1QFile@@UEAA@XZ
?constData@QString@@QEBAPEBVQChar@@XZ
?size@QString@@QEBAHXZ
?latin1@QLatin1String@@QEBAPEBDXZ
??0QString@@QEAA@HW4Initialization@Qt@@@Z
?data@QString@@QEAAPEAVQChar@@XZ
?resize@QString@@QEAAXH@Z
??0QChar@@QEAA@UQLatin1Char@@@Z
?arg@QString@@QEBA?AV1@HHHAEBVQChar@@@Z
?detach@QListData@@QEAAPEAUData@1@H@Z
?begin@QListData@@QEBAPEAPEAXXZ
?remove@QListData@@QEAAXH@Z
?qFree@@YAXPEAX@Z
??9QBasicAtomicInt@@QEBA_NH@Z
?append@QListData@@QEAAPEAPEAXXZ
?deref@QBasicAtomicInt@@QEAA_NXZ
?shared_null@QListData@@2UData@1@A
?ref@QBasicAtomicInt@@QEAA_NXZ
?toWCharArray@QString@@QEBAHPEAG@Z
?isEmpty@QString@@QEBA_NXZ
?append@QString@@QEAAAEAV1@AEBV1@@Z
?toLocal8Bit@QString@@QEBA?AVQByteArray@@XZ
?constData@QByteArray@@QEBAPEBDXZ
??1QByteArray@@QEAA@XZ
??0QString@@QEAA@XZ
??4QString@@QEAAAEAV0@AEBV0@@Z
?fromWCharArray@QString@@SA?AV1@PEBGH@Z
??0QString@@QEAA@AEBV0@@Z
??1QString@@QEAA@XZ
??0QLatin1String@@QEAA@PEBD@Z
??0QSharedData@@QEAA@XZ
??0QString@@QEAA@AEBVQLatin1String@@@Z

msvcp90

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@AEBV10@PEBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PEBDAEBV10@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ

msvcr90

_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
?terminate@@YAXXZ
log10
wcscat
_ftime64
ferror
feof
fopen
_errno
strerror
fseek
ftell
fread
fclose
strcmp
log
sqrt
wcsncmp
wcschr
wcstod
wcscspn
wcscpy
memset
memmove
printf
__iob_func
_decode_pointer
memmove_s
memcpy
_snwprintf
strcpy
strncat
strcat
_snprintf
_wcstoi64
_i64tow
pow
strtod
??_V@YAXPEAX@Z
_purecall
wcscmp
malloc
realloc
free
?what@exception@std@@UEBAPEBDXZ
??0exception@std@@QEAA@AEBQEBD@Z
??2@YAPEAX_K@Z
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBV01@@Z
_CxxThrowException
__CxxFrameHandler3
??3@YAXPEAX@Z
_invalid_parameter_noinfo
wcslen
wcsncpy
strlen
strncpy
_malloc_crt
_initterm
_initterm_e
_encoded_null
_amsg_exit
__CppXcptFilter
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
fprintf
__clean_type_info_names_internal

kernel32

GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
Sleep
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime

Exports

Exports

??0QCLuceneAnalyzer@@AEAA@XZ
??0QCLuceneAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneAnalyzerPrivate@@QEAA@AEBV0@@Z
??0QCLuceneAnalyzerPrivate@@QEAA@XZ
??0QCLuceneBooleanQuery@@QEAA@AEBV0@@Z
??0QCLuceneBooleanQuery@@QEAA@XZ
??0QCLuceneDocument@@QEAA@AEBV0@@Z
??0QCLuceneDocument@@QEAA@XZ
??0QCLuceneDocumentPrivate@@QEAA@AEBV0@@Z
??0QCLuceneDocumentPrivate@@QEAA@XZ
??0QCLuceneField@@IEAA@XZ
??0QCLuceneField@@QEAA@AEBV0@@Z
??0QCLuceneField@@QEAA@AEBVQString@@0H@Z
??0QCLuceneField@@QEAA@AEBVQString@@PEAVQCLuceneReader@@H@Z
??0QCLuceneFieldPrivate@@QEAA@AEBV0@@Z
??0QCLuceneFieldPrivate@@QEAA@XZ
??0QCLuceneFileReader@@QEAA@AEBV0@@Z
??0QCLuceneFileReader@@QEAA@AEBVQString@@0HH@Z
??0QCLuceneFilter@@AEAA@XZ
??0QCLuceneFilter@@QEAA@AEBV0@@Z
??0QCLuceneFilterPrivate@@QEAA@AEBV0@@Z
??0QCLuceneFilterPrivate@@QEAA@XZ
??0QCLuceneHits@@QEAA@AEBV0@@Z
??0QCLuceneHits@@QEAA@AEBVQCLuceneSearcher@@AEBVQCLuceneQuery@@AEBVQCLuceneFilter@@@Z
??0QCLuceneHits@@QEAA@AEBVQCLuceneSearcher@@AEBVQCLuceneQuery@@AEBVQCLuceneFilter@@AEBVQCLuceneSort@@@Z
??0QCLuceneHitsPrivate@@QEAA@AEBV0@@Z
??0QCLuceneHitsPrivate@@QEAA@XZ
??0QCLuceneIndexReader@@AEAA@XZ
??0QCLuceneIndexReader@@QEAA@AEBV0@@Z
??0QCLuceneIndexReaderPrivate@@QEAA@AEBV0@@Z
??0QCLuceneIndexReaderPrivate@@QEAA@XZ
??0QCLuceneIndexSearcher@@QEAA@AEBV0@@Z
??0QCLuceneIndexSearcher@@QEAA@AEBVQCLuceneIndexReader@@@Z
??0QCLuceneIndexSearcher@@QEAA@AEBVQString@@@Z
??0QCLuceneIndexWriter@@QEAA@AEBV0@@Z
??0QCLuceneIndexWriter@@QEAA@AEBVQString@@AEAVQCLuceneAnalyzer@@_N2@Z
??0QCLuceneIndexWriterPrivate@@QEAA@AEBV0@@Z
??0QCLuceneIndexWriterPrivate@@QEAA@XZ
??0QCLuceneKeywordAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneKeywordAnalyzer@@QEAA@XZ
??0QCLuceneMultiFieldQueryParser@@QEAA@AEBV0@@Z
??0QCLuceneMultiFieldQueryParser@@QEAA@AEBVQStringList@@AEAVQCLuceneAnalyzer@@@Z
??0QCLuceneMultiSearcher@@QEAA@AEBV0@@Z
??0QCLuceneMultiSearcher@@QEAA@V?$QList@VQCLuceneSearchable@@@@@Z
??0QCLucenePerFieldAnalyzerWrapper@@QEAA@AEBV0@@Z
??0QCLucenePerFieldAnalyzerWrapper@@QEAA@PEAVQCLuceneAnalyzer@@@Z
??0QCLucenePhraseQuery@@QEAA@AEBV0@@Z
??0QCLucenePhraseQuery@@QEAA@XZ
??0QCLucenePrefixQuery@@QEAA@AEBV0@@Z
??0QCLucenePrefixQuery@@QEAA@AEBVQCLuceneTerm@@@Z
??0QCLuceneQuery@@AEAA@XZ
??0QCLuceneQuery@@QEAA@AEBV0@@Z
??0QCLuceneQueryParser@@QEAA@AEBV0@@Z
??0QCLuceneQueryParser@@QEAA@AEBVQString@@AEAVQCLuceneAnalyzer@@@Z
??0QCLuceneQueryParserPrivate@@QEAA@AEBV0@@Z
??0QCLuceneQueryParserPrivate@@QEAA@XZ
??0QCLuceneQueryPrivate@@QEAA@AEBV0@@Z
??0QCLuceneQueryPrivate@@QEAA@XZ
??0QCLuceneRangeQuery@@QEAA@AEBV0@@Z
??0QCLuceneRangeQuery@@QEAA@AEBVQCLuceneTerm@@0_N@Z
??0QCLuceneReader@@QEAA@AEBV0@@Z
??0QCLuceneReader@@QEAA@XZ
??0QCLuceneReaderPrivate@@QEAA@AEBV0@@Z
??0QCLuceneReaderPrivate@@QEAA@XZ
??0QCLuceneSearchable@@AEAA@XZ
??0QCLuceneSearchable@@QEAA@AEBV0@@Z
??0QCLuceneSearchablePrivate@@QEAA@AEBV0@@Z
??0QCLuceneSearchablePrivate@@QEAA@XZ
??0QCLuceneSearcher@@QEAA@AEBV0@@Z
??0QCLuceneSearcher@@QEAA@XZ
??0QCLuceneSimpleAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneSimpleAnalyzer@@QEAA@XZ
??0QCLuceneSort@@QEAA@AEBV0@@Z
??0QCLuceneSort@@QEAA@AEBVQString@@_N@Z
??0QCLuceneSort@@QEAA@AEBVQStringList@@@Z
??0QCLuceneSort@@QEAA@XZ
??0QCLuceneSortPrivate@@QEAA@AEBV0@@Z
??0QCLuceneSortPrivate@@QEAA@XZ
??0QCLuceneStandardAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneStandardAnalyzer@@QEAA@AEBVQStringList@@@Z
??0QCLuceneStandardAnalyzer@@QEAA@XZ
??0QCLuceneStandardTokenizer@@QEAA@AEBV0@@Z
??0QCLuceneStandardTokenizer@@QEAA@AEBVQCLuceneReader@@@Z
??0QCLuceneStopAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneStopAnalyzer@@QEAA@AEBVQStringList@@@Z
??0QCLuceneStopAnalyzer@@QEAA@XZ
??0QCLuceneTerm@@QEAA@AEBV0@@Z
??0QCLuceneTerm@@QEAA@AEBV0@AEBVQString@@@Z
??0QCLuceneTerm@@QEAA@AEBVQString@@0@Z
??0QCLuceneTerm@@QEAA@XZ
??0QCLuceneTermPrivate@@QEAA@AEBV0@@Z
??0QCLuceneTermPrivate@@QEAA@XZ
??0QCLuceneTermQuery@@QEAA@AEBV0@@Z
??0QCLuceneTermQuery@@QEAA@AEBVQCLuceneTerm@@@Z
??0QCLuceneToken@@QEAA@AEBV0@@Z
??0QCLuceneToken@@QEAA@AEBVQString@@HH0@Z
??0QCLuceneToken@@QEAA@XZ
??0QCLuceneTokenPrivate@@QEAA@AEBV0@@Z
??0QCLuceneTokenPrivate@@QEAA@XZ
??0QCLuceneTokenStream@@AEAA@XZ
??0QCLuceneTokenStream@@QEAA@AEBV0@@Z
??0QCLuceneTokenStreamPrivate@@QEAA@AEBV0@@Z
??0QCLuceneTokenStreamPrivate@@QEAA@XZ
??0QCLuceneTokenizer@@AEAA@XZ
??0QCLuceneTokenizer@@QEAA@AEBV0@@Z
??0QCLuceneTokenizer@@QEAA@AEBVQCLuceneReader@@@Z
??0QCLuceneWhitespaceAnalyzer@@QEAA@AEBV0@@Z
??0QCLuceneWhitespaceAnalyzer@@QEAA@XZ
??1QCLuceneAnalyzer@@UEAA@XZ
??1QCLuceneAnalyzerPrivate@@QEAA@XZ
??1QCLuceneBooleanQuery@@UEAA@XZ
??1QCLuceneDocument@@QEAA@XZ
??1QCLuceneDocumentPrivate@@QEAA@XZ
??1QCLuceneField@@QEAA@XZ
??1QCLuceneFieldPrivate@@QEAA@XZ
??1QCLuceneFileReader@@UEAA@XZ
??1QCLuceneFilter@@EEAA@XZ
??1QCLuceneFilterPrivate@@QEAA@XZ
??1QCLuceneHits@@UEAA@XZ
??1QCLuceneHitsPrivate@@QEAA@XZ
??1QCLuceneIndexReader@@UEAA@XZ
??1QCLuceneIndexReaderPrivate@@QEAA@XZ
??1QCLuceneIndexSearcher@@UEAA@XZ
??1QCLuceneIndexWriter@@UEAA@XZ
??1QCLuceneIndexWriterPrivate@@QEAA@XZ
??1QCLuceneKeywordAnalyzer@@UEAA@XZ
??1QCLuceneMultiFieldQueryParser@@UEAA@XZ
??1QCLuceneMultiSearcher@@UEAA@XZ
??1QCLucenePerFieldAnalyzerWrapper@@UEAA@XZ
??1QCLucenePhraseQuery@@UEAA@XZ
??1QCLucenePrefixQuery@@UEAA@XZ
??1QCLuceneQuery@@UEAA@XZ
??1QCLuceneQueryParser@@UEAA@XZ
??1QCLuceneQueryParserPrivate@@QEAA@XZ
??1QCLuceneQueryPrivate@@QEAA@XZ
??1QCLuceneRangeQuery@@UEAA@XZ
??1QCLuceneReader@@UEAA@XZ
??1QCLuceneReaderPrivate@@QEAA@XZ
??1QCLuceneSearchable@@UEAA@XZ
??1QCLuceneSearchablePrivate@@QEAA@XZ
??1QCLuceneSearcher@@UEAA@XZ
??1QCLuceneSimpleAnalyzer@@UEAA@XZ
??1QCLuceneSort@@UEAA@XZ
??1QCLuceneSortPrivate@@QEAA@XZ
??1QCLuceneStandardAnalyzer@@UEAA@XZ
??1QCLuceneStandardTokenizer@@UEAA@XZ
??1QCLuceneStopAnalyzer@@UEAA@XZ
??1QCLuceneTerm@@UEAA@XZ
??1QCLuceneTermPrivate@@QEAA@XZ
??1QCLuceneTermQuery@@UEAA@XZ
??1QCLuceneToken@@UEAA@XZ
??1QCLuceneTokenPrivate@@QEAA@XZ
??1QCLuceneTokenStream@@UEAA@XZ
??1QCLuceneTokenStreamPrivate@@QEAA@XZ
??1QCLuceneTokenizer@@UEAA@XZ
??1QCLuceneWhitespaceAnalyzer@@UEAA@XZ
??4QCLuceneAnalyzer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneBooleanQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneDocument@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneField@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneFileReader@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneFilter@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneHits@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneIndexReader@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneIndexSearcher@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneIndexWriter@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneKeywordAnalyzer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneMultiFieldQueryParser@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneMultiSearcher@@QEAAAEAV0@AEBV0@@Z
??4QCLucenePerFieldAnalyzerWrapper@@QEAAAEAV0@AEBV0@@Z
??4QCLucenePhraseQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLucenePrefixQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneQueryParser@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneRangeQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneReader@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneSearchable@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneSearcher@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneSimpleAnalyzer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneSort@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneStandardAnalyzer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneStandardTokenizer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneStopAnalyzer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneTerm@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneTermQuery@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneToken@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneTokenStream@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneTokenizer@@QEAAAEAV0@AEBV0@@Z
??4QCLuceneWhitespaceAnalyzer@@QEAAAEAV0@AEBV0@@Z
??_7QCLuceneAnalyzer@@6B@
??_7QCLuceneBooleanQuery@@6B@
??_7QCLuceneFileReader@@6B@
??_7QCLuceneFilter@@6B@
??_7QCLuceneHits@@6B@
??_7QCLuceneIndexReader@@6B@
??_7QCLuceneIndexSearcher@@6B@
??_7QCLuceneIndexWriter@@6B@
??_7QCLuceneKeywordAnalyzer@@6B@
??_7QCLuceneMultiFieldQueryParser@@6B@
??_7QCLuceneMultiSearcher@@6B@
??_7QCLucenePerFieldAnalyzerWrapper@@6B@
??_7QCLucenePhraseQuery@@6B@
??_7QCLucenePrefixQuery@@6B@
??_7QCLuceneQuery@@6B@
??_7QCLuceneQueryParser@@6B@
??_7QCLuceneRangeQuery@@6B@
??_7QCLuceneReader@@6B@
??_7QCLuceneSearchable@@6B@
??_7QCLuceneSearcher@@6B@
??_7QCLuceneSimpleAnalyzer@@6B@
??_7QCLuceneSort@@6B@
??_7QCLuceneStandardAnalyzer@@6B@
??_7QCLuceneStandardTokenizer@@6B@
??_7QCLuceneStopAnalyzer@@6B@
??_7QCLuceneTerm@@6B@
??_7QCLuceneTermQuery@@6B@
??_7QCLuceneToken@@6B@
??_7QCLuceneTokenStream@@6B@
??_7QCLuceneTokenizer@@6B@
??_7QCLuceneWhitespaceAnalyzer@@6B@
?add@QCLuceneBooleanQuery@@QEAAXPEAVQCLuceneQuery@@_N11@Z
?add@QCLuceneBooleanQuery@@QEAAXPEAVQCLuceneQuery@@_N1@Z
?add@QCLuceneDocument@@QEAAXPEAVQCLuceneField@@@Z
?addAnalyzer@QCLucenePerFieldAnalyzerWrapper@@QEAAXAEBVQString@@PEAVQCLuceneAnalyzer@@@Z
?addDocument@QCLuceneIndexWriter@@QEAAXAEAVQCLuceneDocument@@AEAVQCLuceneAnalyzer@@@Z
?addIndexes@QCLuceneIndexWriter@@QEAAXAEBV?$QList@PEAVQCLuceneIndexReader@@@@@Z
?addTerm@QCLucenePhraseQuery@@QEAAXAEBVQCLuceneTerm@@@Z
?addTerm@QCLucenePhraseQuery@@QEAAXAEBVQCLuceneTerm@@H@Z
?bufferLength@QCLuceneToken@@QEBAIXZ
?clear@QCLuceneDocument@@QEAAXXZ
?close@QCLuceneIndexReader@@QEAAXXZ
?close@QCLuceneIndexSearcher@@QEAAXXZ
?close@QCLuceneIndexWriter@@QEAAXXZ
?close@QCLuceneMultiSearcher@@QEAAXXZ
?close@QCLuceneTokenStream@@QEAAXXZ
?close@QCLuceneTokenizer@@QEAAXXZ
?compareTo@QCLuceneTerm@@QEBAHAEBV1@@Z
?deleteDocument@QCLuceneIndexReader@@QEAAXH@Z
?deleteDocuments@QCLuceneIndexReader@@QEAAHAEBVQCLuceneTerm@@@Z
?doc@QCLuceneIndexSearcher@@QEAA_NHAEAVQCLuceneDocument@@@Z
?doc@QCLuceneMultiSearcher@@QEAA_NHAEAVQCLuceneDocument@@@Z
?docCount@QCLuceneIndexWriter@@QEAAHXZ
?document@QCLuceneHits@@QEAA?AVQCLuceneDocument@@H@Z
?document@QCLuceneIndexReader@@QEAA_NHAEAVQCLuceneDocument@@@Z
?endOffset@QCLuceneToken@@QEBAHXZ
?englishStopWords@QCLuceneStopAnalyzer@@QEBA?AVQStringList@@XZ
?equals@QCLuceneQuery@@QEBA_NAEBV1@@Z
?equals@QCLuceneTerm@@QEBA_NAEBV1@@Z
?field@QCLuceneTerm@@QEBA?AVQString@@XZ
?get@QCLuceneDocument@@QEBA?AVQString@@AEBV2@@Z
?getAnalyzer@QCLuceneIndexWriter@@QEAA?AVQCLuceneAnalyzer@@XZ
?getAnalyzer@QCLuceneQueryParser@@QEAA?AVQCLuceneAnalyzer@@XZ
?getBoost@QCLuceneDocument@@QEBANXZ
?getBoost@QCLuceneField@@QEBANXZ
?getBoost@QCLuceneQuery@@QEBANXZ
?getClassName@QCLuceneBooleanQuery@@SA?AVQString@@XZ
?getClassName@QCLucenePhraseQuery@@SA?AVQString@@XZ
?getClassName@QCLucenePrefixQuery@@SA?AVQString@@XZ
?getClassName@QCLuceneRangeQuery@@SA?AVQString@@XZ
?getClassName@QCLuceneTermQuery@@SA?AVQString@@XZ
?getClauseCount@QCLuceneBooleanQuery@@QEBAIXZ
?getCommitLockTimeout@QCLuceneIndexWriter@@QEBA_JXZ
?getCurrentVersion@QCLuceneIndexReader@@SA_JAEBVQString@@@Z
?getField@QCLuceneDocument@@QEBAPEAVQCLuceneField@@AEBVQString@@@Z
?getField@QCLuceneQueryParser@@QEAA?AVQString@@XZ
?getField@QCLuceneRangeQuery@@QEBA?AVQString@@XZ
?getFieldName@QCLucenePhraseQuery@@QEBA?AVQString@@XZ
?getLowerTerm@QCLuceneRangeQuery@@QEBA?AVQCLuceneTerm@@XZ
?getMaxBufferedDocs@QCLuceneIndexWriter@@QEBAHXZ
?getMaxClauseCount@QCLuceneBooleanQuery@@QEBAIXZ
?getMaxFieldLength@QCLuceneIndexWriter@@QEBAHXZ
?getMaxMergeDocs@QCLuceneIndexWriter@@QEBAHXZ
?getMergeFactor@QCLuceneIndexWriter@@QEBAHXZ
?getMinMergeDocs@QCLuceneIndexWriter@@QEBAHXZ
?getOmitNorms@QCLuceneField@@QEBA_NXZ
?getPrefix@QCLucenePrefixQuery@@QEBA?AVQCLuceneTerm@@XZ
?getQueryName@QCLuceneQuery@@QEBA?AVQString@@XZ
?getReader@QCLuceneIndexSearcher@@QEAA?AVQCLuceneIndexReader@@XZ
?getSlop@QCLucenePhraseQuery@@QEBAHXZ
?getTerm@QCLuceneTermQuery@@QEBA?AVQCLuceneTerm@@XZ
?getTermIndexInterval@QCLuceneIndexWriter@@QEBAHXZ
?getTerms@QCLucenePhraseQuery@@QEBA?AV?$QList@VQCLuceneTerm@@@@XZ
?getUpperTerm@QCLuceneRangeQuery@@QEBA?AVQCLuceneTerm@@XZ
?getUseCompoundFile@QCLuceneIndexWriter@@QEBA_NXZ
?getValues@QCLuceneDocument@@QEBA?AVQStringList@@AEBVQString@@@Z
?getVersion@QCLuceneIndexReader@@QEAA_JXZ
?getWriteLockTimeout@QCLuceneIndexWriter@@QEBA_JXZ
?growBuffer@QCLuceneToken@@QEAAXI@Z
?hasNorms@QCLuceneIndexReader@@QEAA_NAEBVQString@@@Z
?hashCode@QCLuceneQuery@@QEBAIXZ
?hashCode@QCLuceneTerm@@QEBAIXZ
?id@QCLuceneHits@@QEAAHH@Z
?indexExists@QCLuceneIndexReader@@SA_NAEBVQString@@@Z
?instanceOf@QCLuceneQuery@@QEBA_NAEBVQString@@@Z
?isBinary@QCLuceneField@@QEBA_NXZ
?isCompressed@QCLuceneField@@QEBA_NXZ
?isCurrent@QCLuceneIndexReader@@QEAA_NXZ
?isInclusive@QCLuceneRangeQuery@@QEBA_NXZ
?isIndexed@QCLuceneField@@QEBA_NXZ
?isLocked@QCLuceneIndexReader@@SA_NAEBVQString@@@Z
?isLuceneFile@QCLuceneIndexReader@@SA_NAEBVQString@@@Z
?isStoreOffsetWithTermVector@QCLuceneField@@QEBA_NXZ
?isStorePositionWithTermVector@QCLuceneField@@QEBA_NXZ
?isStored@QCLuceneField@@QEBA_NXZ
?isTermVectorStored@QCLuceneField@@QEBA_NXZ
?isTokenized@QCLuceneField@@QEBA_NXZ
?lastModified@QCLuceneIndexReader@@SA_KAEBVQString@@@Z
?length@QCLuceneHits@@QEBAHXZ
?maxDoc@QCLuceneIndexSearcher@@QEBAHXZ
?maxDoc@QCLuceneMultiSearcher@@QEBAHXZ
?name@QCLuceneField@@QEBA?AVQString@@XZ
?next@QCLuceneTokenStream@@QEAA_NAEAVQCLuceneToken@@@Z
?next@QCLuceneTokenizer@@QEAA_NAEAVQCLuceneToken@@@Z
?open@QCLuceneIndexReader@@SA?AV1@AEBVQString@@@Z
?optimize@QCLuceneIndexWriter@@QEAAXXZ
?parse@QCLuceneMultiFieldQueryParser@@SAPEAVQCLuceneQuery@@AEBVQString@@AEBVQStringList@@AEAVQCLuceneAnalyzer@@@Z
?parse@QCLuceneMultiFieldQueryParser@@SAPEAVQCLuceneQuery@@AEBVQString@@AEBVQStringList@@V?$QList@W4FieldFlags@QCLuceneMultiFieldQueryParser@@@@AEAVQCLuceneAnalyzer@@@Z
?parse@QCLuceneQueryParser@@QEAAPEAVQCLuceneQuery@@AEAVQCLuceneReader@@@Z
?parse@QCLuceneQueryParser@@QEAAPEAVQCLuceneQuery@@AEBVQString@@@Z
?parse@QCLuceneQueryParser@@SAPEAVQCLuceneQuery@@AEBVQString@@0AEAVQCLuceneAnalyzer@@@Z
?positionIncrement@QCLuceneToken@@QEBAHXZ
?positionIncrementGap@QCLuceneAnalyzer@@QEBAHAEBVQString@@@Z
?readApostrophe@QCLuceneStandardTokenizer@@QEAA_NAEBVQString@@AEAVQCLuceneToken@@@Z
?readAt@QCLuceneStandardTokenizer@@QEAA_NAEBVQString@@AEAVQCLuceneToken@@@Z
?readCompany@QCLuceneStandardTokenizer@@QEAA_NAEBVQString@@AEAVQCLuceneToken@@@Z
?readerValue@QCLuceneField@@QEBAPEAVQCLuceneReader@@XZ
?removeField@QCLuceneDocument@@QEAAXAEBVQString@@@Z
?removeFields@QCLuceneDocument@@QEAAXAEBVQString@@@Z
?resetTermTextLength@QCLuceneToken@@QEBAXXZ
?score@QCLuceneHits@@QEAANH@Z
?search@QCLuceneSearcher@@QEAA?AVQCLuceneHits@@AEBVQCLuceneQuery@@@Z
?search@QCLuceneSearcher@@QEAA?AVQCLuceneHits@@AEBVQCLuceneQuery@@AEBVQCLuceneFilter@@@Z
?search@QCLuceneSearcher@@QEAA?AVQCLuceneHits@@AEBVQCLuceneQuery@@AEBVQCLuceneFilter@@AEBVQCLuceneSort@@@Z
?search@QCLuceneSearcher@@QEAA?AVQCLuceneHits@@AEBVQCLuceneQuery@@AEBVQCLuceneSort@@@Z
?searcherIndex@QCLuceneMultiSearcher@@QEBAHH@Z
?set@QCLuceneTerm@@QEAAXAEBV1@AEBVQString@@@Z
?set@QCLuceneTerm@@QEAAXAEBVQString@@0@Z
?set@QCLuceneTerm@@QEAAXAEBVQString@@0_N@Z
?setBoost@QCLuceneDocument@@QEAAXN@Z
?setBoost@QCLuceneField@@QEAAXN@Z
?setBoost@QCLuceneQuery@@QEAAXN@Z
?setCommitLockTimeout@QCLuceneIndexWriter@@QEAAX_J@Z
?setConfig@QCLuceneField@@QEAAXH@Z
?setEndOffset@QCLuceneToken@@QEAAXH@Z
?setMaxBufferedDocs@QCLuceneIndexWriter@@QEAAXH@Z
?setMaxClauseCount@QCLuceneBooleanQuery@@QEAAXI@Z
?setMaxFieldLength@QCLuceneIndexWriter@@QEAAXH@Z
?setMaxMergeDocs@QCLuceneIndexWriter@@QEAAXH@Z
?setMergeFactor@QCLuceneIndexWriter@@QEAAXH@Z
?setMinMergeDocs@QCLuceneIndexWriter@@QEAAXH@Z
?setNorm@QCLuceneIndexReader@@QEAAXHAEBVQString@@E@Z
?setNorm@QCLuceneIndexReader@@QEAAXHAEBVQString@@N@Z
?setOmitNorms@QCLuceneField@@QEAAX_N@Z
?setPositionIncrement@QCLuceneToken@@QEAAXH@Z
?setSlop@QCLucenePhraseQuery@@QEAAXH@Z
?setSort@QCLuceneSort@@QEAAXAEBVQString@@_N@Z
?setSort@QCLuceneSort@@QEAAXAEBVQStringList@@@Z
?setStartOffset@QCLuceneToken@@QEAAXH@Z
?setTermIndexInterval@QCLuceneIndexWriter@@QEAAXH@Z
?setTermText@QCLuceneToken@@QEAAXAEBVQString@@@Z
?setType@QCLuceneToken@@QEAAXAEBVQString@@@Z
?setUseCompoundFile@QCLuceneIndexWriter@@QEAAX_N@Z
?setWriteLockTimeout@QCLuceneIndexWriter@@QEAAX_J@Z
?startOffset@QCLuceneToken@@QEBAHXZ
?stringValue@QCLuceneField@@QEBA?AVQString@@XZ
?subDoc@QCLuceneMultiSearcher@@QEBAHH@Z
?subSearcher@QCLuceneMultiSearcher@@QEBAHH@Z
?termText@QCLuceneToken@@QEBA?AVQString@@XZ
?termTextLength@QCLuceneToken@@QEBAIXZ
?text@QCLuceneTerm@@QEBA?AVQString@@XZ
?textLength@QCLuceneTerm@@QEBAIXZ
?toString@QCLuceneDocument@@QEBA?AVQString@@XZ
?toString@QCLuceneField@@QEBA?AVQString@@XZ
?toString@QCLuceneQuery@@QEBA?AVQString@@AEBV2@@Z
?toString@QCLuceneQuery@@QEBA?AVQString@@XZ
?toString@QCLuceneSort@@QEBA?AVQString@@XZ
?toString@QCLuceneTerm@@QEBA?AVQString@@XZ
?toString@QCLuceneToken@@QEBA?AVQString@@XZ
?tokenStream@QCLuceneAnalyzer@@QEBA?AVQCLuceneTokenStream@@AEBVQString@@AEBVQCLuceneReader@@@Z
?type@QCLuceneToken@@QEBA?AVQString@@XZ
?undeleteAll@QCLuceneIndexReader@@QEAAXXZ
?unlock@QCLuceneIndexReader@@SAXAEBVQString@@@Z

Sections

.text
Size: 768KB - Virtual size: 768KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7988158a789517da03750dccd94b7ba0

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

78:ed:a9:bd:76:92:19:b5:ac:96:70:be:26:04:a1:a7Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

75:cb:e4:c5:31:db:3e:ee:53:42:96:8e:bb:3a:7a:2d:f9:4b:c2:48Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

qtcore4

msvcp90

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 768KB - Virtual size: 768KB

.rdata Size: 331KB - Virtual size: 331KB

.data Size: 59KB - Virtual size: 63KB

.pdata Size: 64KB - Virtual size: 64KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

78:ed:a9:bd:76:92:19:b5:ac:96:70:be:26:04:a1:a7
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

75:cb:e4:c5:31:db:3e:ee:53:42:96:8e:bb:3a:7a:2d:f9:4b:c2:48
Signer

.text
Size: 768KB - Virtual size: 768KB

.rdata
Size: 331KB - Virtual size: 331KB

.data
Size: 59KB - Virtual size: 63KB

.pdata
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB