fc29a6023ee58201b502f797e72b5682_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

fc29a6023ee58201b502f797e72b5682_JaffaCakes118
Size

5.8MB
MD5

fc29a6023ee58201b502f797e72b5682
SHA1

01249211f30150f8735dee86bce560aa518498b7
SHA256

d26baa56ac07d9d19ec3d0fdd2fdfef5d2c1c39fe4a3eef256d14a2fbad4cc7c
SHA512

a4047aaff86ba351bad4ea423ac52903053b0198fb282223c47b0073e6b00a69451b31bb1b93f4747814264bfc1538d605aab9327a8caf1679cfa735b8ab6789
SSDEEP

98304:jXqkiop3hAqGMxHA0EkvpfP5jn70juGUZnWcZ8hI24PI4vu9mqJFs6v8/ZmmAf64:HiahAJmg0LvdWVcWVhIVFKZJa60xAWmR

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Lz0/keygen.exe
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/CamTrax64.exe.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.Office.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SldWorks.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SwCommands.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SwConst.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/hasp_net_windows.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/hasp_windows_50974.dll.deploy
unpack001/camtrax642010x32install/CamTrax64_2010_18_32_136/stdole.dll.deploy

Files

fc29a6023ee58201b502f797e72b5682_JaffaCakes118
.rar
155绿色软件站.url
.url
Lz0/install.txt
Lz0/keygen.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64.application
camtrax642010x32install/CamTrax64_2010_18_32_136.application
camtrax642010x32install/CamTrax64_2010_18_32_136/CamArcIcon.ico.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/CamIcon2.ico.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/CamTrax.ico.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/CamTrax64.exe.deploy
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\grh\Documents\Visual Studio 2005\Projects\CamTrax64\obj\Release\CamTrax64.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 4KB - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/CamTrax64.exe.manifest
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/CamTrax64 Quick Start Guide.pdf.deploy
.pdf
- http://I.lb
- http://www.camnetics.com
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/CamTrax64 SI Units.xls.deploy
.deploy .xls windows office2003
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/CamTrax64.pdf.deploy
.pdf
- http://Inc.www.camnetics.com
- http://camnetics.com
- http://www.camnetics.com
- http://www.camnetics.com/�
- http://x.xxx
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/CamTrax64.xls.deploy
.deploy .xls windows office2003
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/ConjugateTutorial.pdf.deploy
.pdf
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/ImportFileSample.txt.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylinderTerminalVelocity01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalDRDR01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalDoubleFollower01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalDoubleFollowerOscillating01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalNoDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalOscillatingArm01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleCylindricalSingleDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskConstantVelocity01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskDRDR01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskDoubleFollowerTranslating01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskDoubleTerminalVelocity01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskNoDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskOscillating01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskOscillatingArm01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskSingleDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleDiskTerminalVelocity01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleLinearDRDR01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleLinearNoDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleLinearOscillatingArm01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleLinearSingleDwell01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/SampleCams/SampleLinearTerminalVelocity01.ctxcom.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/header.dat.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Documents/trailer.dat.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Images/ChartBackground.bmp.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.Office.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SldWorks.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SwCommands.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 140KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/Interop.SwConst.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 268KB - Virtual size: 266KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/LicenseCT64.txt.deploy
camtrax642010x32install/CamTrax64_2010_18_32_136/Microsoft.Office.Interop.Excel.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

72:2a:00:b7:84:76:69:15:02:39:90:1d:99:c8:3f:2c:2e:cb:23:27
Signer

Actual PE Digest

72:2a:00:b7:84:76:69:15:02:39:90:1d:99:c8:3f:2c:2e:cb:23:27

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/hasp_net_windows.dll.deploy
.dll windows:4 windows x86 arch:x86

3eb2698f063b24c9a99f1a4407eb553d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
HeapReAlloc
LeaveCriticalSection
HeapAlloc
GetProcessHeap
HeapFree
EnterCriticalSection
DeleteCriticalSection
GetCurrentDirectoryW
InitializeCriticalSection
IsBadReadPtr
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetVersionExA
LoadLibraryW
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
Sleep
InterlockedDecrement
InterlockedIncrement
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
DisableThreadLibraryCalls
GetModuleHandleA
OutputDebugStringA
GetProcAddress

msvcr71

?terminate@@YAXXZ
__security_error_handler
_onexit
__dllonexit
??1type_info@@UAE@XZ
wcslen
wcscat
_amsg_exit
__CppXcptFilter
_adjust_fdiv
malloc
_initterm
_except_handler3
_purecall
??0exception@@QAE@XZ
strcspn
memchr
sprintf
??_U@YAPAXI@Z
localeconv
_CxxThrowException
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
__CxxFrameHandler
??2@YAPAXI@Z
__crtLCMapStringA
__pctype_func
isupper
___lc_codepage_func
___lc_handle_func
_unlock
memcpy
_lock
___setlc_active_func
___unguarded_readlc_active_add_func
strlen
setlocale
islower
__uncaught_exception
abort
strchr
free
??_V@YAXPAX@Z
??3@YAXPAX@Z
memmove
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
_wstat
__CxxDetectRethrow
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__CxxCallUnwindDtor
__CxxExceptionFilter

advapi32

RegCloseKey
RegOpenKeyExA
RegQueryValueExA

mscoree

_CorDllMain

setupapi

SetupSetPlatformPathOverrideA

Sections

.text
Size: 180KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/hasp_windows_50974.dll.deploy
.dll windows:4 windows x86 arch:x86

c41bd4212c6729afae5bf11eedb279c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
DeviceIoControl
LocalFree
CreateFileA
LocalAlloc
InterlockedDecrement
WaitForSingleObject
InterlockedCompareExchange
CreateMutexA
ReleaseMutex
GetLastError
GetVolumeInformationA
GetEnvironmentVariableA
FreeLibrary
GetProcAddress
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
Sleep
TlsSetValue
TlsGetValue
TlsAlloc
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
TlsFree
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleA
ReadFile
WriteFile
GetFileSize
FindClose
GetLocalTime
GetVersion
SetErrorMode
FindFirstFileA
FindNextFileA
GetModuleFileNameA
InterlockedIncrement
HeapReAlloc
SearchPathA
CreateSemaphoreA
OpenSemaphoreA
ReleaseSemaphore

Exports

Exports

hasp_datetime_to_hasptime
hasp_decrypt
hasp_detach
hasp_enable_trace
hasp_encrypt
hasp_free
hasp_get_info
hasp_get_rtc
hasp_get_sessioninfo
hasp_get_size
hasp_get_trace
hasp_get_version
hasp_hasptime_to_datetime
hasp_legacy_decrypt
hasp_legacy_encrypt
hasp_legacy_set_idletime
hasp_legacy_set_rtc
hasp_login
hasp_login_ex
hasp_login_port
hasp_login_scope
hasp_logout
hasp_read
hasp_update
hasp_write

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/haspvlib_50974.dylib.deploy
.dylib macos arch:x86
camtrax642010x32install/CamTrax64_2010_18_32_136/office.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5a:c9:11:db:fe:42:f2:fd:e3:ca:c5:94:fc:96:83:fd:2d:fb:1c:60
Signer

Actual PE Digest

5a:c9:11:db:fe:42:f2:fd:e3:ca:c5:94:fc:96:83:fd:2d:fb:1c:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 396KB - Virtual size: 394KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/CamTrax64_2010_18_32_136/stdole.dll.deploy
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
camtrax642010x32install/setup.exe
.exe windows:5 windows x86 arch:x86

928e6da25d23c91661ea2007a59330be

Code Sign

04:00:00:00:00:01:1e:44:a5:e2:4e
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

28/01/1999, 13:00

Not After

27/01/2017, 12:00

Subject

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:00:00:00:00:01:25:a2:cc:bb:d4
Certificate

Issuer

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Not Before

18/12/2009, 16:30

Not After

18/12/2012, 16:30

Subject

CN=Camnetics\, Inc.,O=Camnetics\, Inc.,L=Oregon,ST=WI,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:1e:44:a5:ec:be
Certificate

Issuer

CN=GlobalSign Primary Object Publishing CA,OU=Primary Object Publishing CA,O=GlobalSign nv-sa,C=BE

Not Before

22/01/2004, 10:00

Not After

27/01/2017, 11:00

Subject

CN=GlobalSign ObjectSign CA,OU=ObjectSign CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a9:10:35:b3:61:50:d2:11:ac:6d:b1:e3:2e:ba:f7:d7:61:e2:aa:68
Signer

Actual PE Digest

a9:10:35:b3:61:50:d2:11:ac:6d:b1:e3:2e:ba:f7:d7:61:e2:aa:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

setup.pdb

Imports

kernel32

EndUpdateResourceA
MultiByteToWideChar
IsValidCodePage
GetDiskFreeSpaceExA
Sleep
SetFilePointer
FindResourceA
LoadResource
LockResource
SizeofResource
CreateEventA
SetEvent
FormatMessageA
LocalFree
CreateProcessA
GetModuleFileNameA
ExpandEnvironmentStringsA
GlobalAlloc
GlobalFree
GetSystemDirectoryA
GetVersionExA
CompareStringA
GetSystemInfo
GetCurrentProcess
GetFileAttributesA
GetTempPathA
GetTempFileNameA
DeleteFileA
CreateDirectoryA
CopyFileA
WideCharToMultiByte
GetEnvironmentVariableA
ReadFile
GetWindowsDirectoryA
GetDateFormatA
GetTimeFormatA
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcessId
RaiseException
RtlUnwind
CloseHandle
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CreateFileW
SetEndOfFile
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
CreateThread
InitializeCriticalSection
MulDiv
lstrlenW
GetExitCodeProcess
WaitForSingleObject
GetTickCount
FindNextFileA
FindClose
FindFirstFileA
WriteFile
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetThreadLocale
UpdateResourceA
BeginUpdateResourceA
LocalAlloc
lstrlenA
UpdateResourceW
GetTempPathW
GetTempFileNameW
GetSystemDirectoryW
GetModuleFileNameW
GetFileAttributesW
FormatMessageW
FindResourceW
DeleteFileW
CreateProcessW
CreateDirectoryW
CopyFileW
BeginUpdateResourceW
GetVersion

gdi32

CreateFontIndirectA
EnumFontFamiliesExA
DeleteObject
GetObjectA
GetStockObject
DeleteDC
GetObjectW
GetDeviceCaps
CreateCompatibleDC
GetTextExtentPoint32A
GetTextMetricsA
SelectObject

user32

ScreenToClient
SetClassLongA
LoadCursorA
SetCursor
LoadIconA
LoadImageA
SetFocus
GetFocus
EnableWindow
MsgWaitForMultipleObjects
SetDlgItemTextA
SetWindowTextA
GetDlgItem
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
DestroyWindow
ShowWindow
SetForegroundWindow
MoveWindow
CreateDialogParamA
CreateDialogIndirectParamA
SendMessageA
GetClientRect
ShowScrollBar
SendDlgItemMessageA
SystemParametersInfoA
GetWindowRect
CharNextA
ExitWindowsEx
MessageBoxA
GetSystemMetrics
DrawTextW
ReleaseDC
GetDialogBaseUnits
LoadStringA
GetDC
MessageBoxW

ole32

CoUninitialize
CoInitialize

shell32

ShellExecuteA
ShellExecuteW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ShellExecuteExA

Sections

.text
Size: 283KB - Virtual size: 282KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.rsrc Size: 9KB - Virtual size: 8KB

.text Size: 33KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 12B

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.sdata Size: 4KB - Virtual size: 139B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 140KB - Virtual size: 137KB

.rsrc Size: 4KB - Virtual size: 872B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rsrc Size: 4KB - Virtual size: 888B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 140KB - Virtual size: 138KB

.rsrc Size: 4KB - Virtual size: 904B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 268KB - Virtual size: 266KB

.rsrc Size: 4KB - Virtual size: 880B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:06:27:81:00:00:00:00:00:08Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

.rsrc
Size: 9KB - Virtual size: 8KB

.text
Size: 33KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 3.2MB - Virtual size: 3.2MB

.sdata
Size: 4KB - Virtual size: 139B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 140KB - Virtual size: 137KB

.rsrc
Size: 4KB - Virtual size: 872B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 1.8MB - Virtual size: 1.8MB

.rsrc
Size: 4KB - Virtual size: 888B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 140KB - Virtual size: 138KB

.rsrc
Size: 4KB - Virtual size: 904B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 268KB - Virtual size: 266KB

.rsrc
Size: 4KB - Virtual size: 880B

.reloc
Size: 4KB - Virtual size: 12B

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

72:2a:00:b7:84:76:69:15:02:39:90:1d:99:c8:3f:2c:2e:cb:23:27
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 180KB - Virtual size: 176KB

.rdata
Size: 68KB - Virtual size: 66KB

.data
Size: 8KB - Virtual size: 21KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 6KB

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 68KB - Virtual size: 1.2MB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 17KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:06:27:81:00:00:00:00:00:08
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

5a:c9:11:db:fe:42:f2:fd:e3:ca:c5:94:fc:96:83:fd:2d:fb:1c:60
Signer

.text
Size: 396KB - Virtual size: 394KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B