jade[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

jade.exe
Size

2.7MB
MD5

c1eda3f9185b44c59cd8798da8f0a582
SHA1

a5214f66a3819e4ce629f590312947290c0ab028
SHA256

307b8d9e43de1ff8af94c4ece5c0bddfb55f723dc230b643401dd5669cfcaaad
SHA512

10e6b9f9560659bbe1a2e1fe393f5abc8fe817adc3979b6e68ae4bbc417b7eafa1ff4d38ee1e83c5ea76d28199df9b6dff5e983e912865a4019657587ec54b6b
SSDEEP

49152:sf8erHOWCCinfuZkMqGOwLW6TlQEWA6cI5RpFWf8l2t2jq72iVZlxZ+iZxZwsZNJ:sfNjbC72qMf2lAzWE3InSlbrbPNYqtD

Score

1^/10

Malware Config

Signatures

Files

jade.exe
.exe windows:6 windows x86 arch:x86

7c4ed2a8245b5894024c4aaa053d4084

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:ab:46:78:40:a0:20:b8:9e:8b:86:d8:2a:99:21:9e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/04/2014, 00:00

Not After

13/07/2017, 23:59

Subject

CN=Jade Software Corporation Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Jade Software Corporation Limited,L=Christchurch,ST=Christchurch,C=NZ

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:73:20:87:62:a6:0b:10:6e:d7:59:89:ec:eb:76:88:9a:6e:f9:70
Signer

Actual PE Digest

2c:73:20:87:62:a6:0b:10:6e:d7:59:89:ec:eb:76:88:9a:6e:f9:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\Cut\jade7108\Debug_Ansi\Win32\bin\jade.pdb

Imports

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

jomos

?find@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEHD@Z
??Y?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@D@Z
?intlConvertString@@YAHW4IntlStringFormat@@AAI1PBX011PAX@Z
?allocate@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXI@Z
?getMethod@DllDesc@@QBEPAXQBD_N@Z
?isLoaded@DllDesc@@QBE_NXZ
?getIniFileUIntegerParam@@YGIQBD00I_NII@Z
??0?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@D@Z
??H?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE?AV0@D@Z
??9?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE_NPBD@Z
?josIsDTNMode@@YG_NXZ
?josGetLocaleInfo@@YGHKKPADI@Z
?josIsValidLocale@@YGHI@Z
?josGetYearGivenYY@@YGHH@Z
?isGregorianLeapYear@@YG_NH@Z
?isGregorianCalendar@@YG_NK@Z
?josConvertCalendarDateToGregorianDate@@YG_NKAAH00@Z
?isAnyDigit@LocGenericFormatter@@QAE_ND@Z
??0LocNumberFormatter@@QAE@XZ
??1LocNumberFormatter@@UAE@XZ
?parseInteger@LocNumberFormatter@@QAEHPBDIAAHAAI@Z
?LocaleInfo@NlsLocale@@QAEPBDI@Z
?CalendarInfo@NlsLocale@@QAEHIAAHH@Z
?LocaleStoreForThread@LocaleDataStore@@SAPAV1@XZ
?ThreadLocale@LocaleDataStore@@SAPAVNlsLocale@@I@Z
?FindThreadLocale@LocaleDataStore@@QAEPAVNlsLocale@@I@Z
??4?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@D@Z
?isEmpty@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE_NXZ
??9?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE_NABV0@@Z
?getResource@DllDesc@@QAEPAXHI@Z
??0ThreadMutex@@QAE@QBD@Z
??0XHeap@@QAE@QBDIIII@Z
??1XHeap@@QAE@XZ
?josGetJadeWorkDirectory@@YGPADQADI@Z
?josFileFindFirst@@YG_NQBDPAUJosFileSearchInfo@@@Z
?josFileFindNext@@YG_NPAUJosFileSearchInfo@@@Z
?josFileFindClose@@YGHPAUJosFileSearchInfo@@@Z
?getFileVersionInfo@JModuleVersion@@QAE_NQBDAAI111@Z
??0JomLog@@QAE@QBDPBD_N@Z
??1JomLog@@QAE@XZ
?log@JomLog@@QAEHAAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
??0DllDesc@@QAE@QBDW4OSIdentity@JomOs@@W4OSFileType@2@@Z
?getDllGetVersion@DllDesc@@QAEHAAI000@Z
?josCreateProcess@@YG_NQBD0QAPBD_NPAHH2@Z
josShellExecute
?josTime@@YG_JPA_J@Z
??0HighPrecisionNumber@@QAE@XZ
?parse@LocNumberFormatter@@QAEHHHHPBDIAAVHighPrecisionNumber@@AAI@Z
?isBlank@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE_NXZ
?josSoundAlert@@YGHPAUDskParam@@@Z
?setTimer@Thread@@QAEIPAXIIP6GX0III@Z@Z
?killTimer@Thread@@QAE_NPAXI@Z
?getInstance@ThreadManager@@SAPAV1@XZ
?currentThreadId@ThreadManager@@SAIXZ
?currentThread@ThreadManager@@SAPAVThread@@XZ
?getResource@DllDesc@@QAEPAXHIAAI@Z
?intlVsnprintf@@YGHPADIPBD0@Z
??0?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@I@Z
?josGetTempPath@@YGIIQAD@Z
?josGetTempFileName@@YGIQBD0IQAD@Z
?setEmpty@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXXZ
?scanExcluding@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE?AV1@PBDAAH@Z
?osSetFilePatchNumber@OSIdentification@JomOs@@QAEXW4OSIdentity@2@HH@Z
?josSetFatClientCallBack@@YGXP6GHHPAUDskParam@@0@Z@Z
?josSetCnetSendToPmapCallBack@@YGXP6GHHPAUDskParam@@0@Z@Z
?isAlive@Thread@@QAE_NXZ
?resumeThread@ThreadManager@@SAHPAVThread@@@Z
josGetCurrentDirectory
?find@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEHDI@Z
?getLastError@JOSFile@@QBEHXZ
?name@JOSFile@@QBEPADXZ
?preloadLibraries@DllDesc@@SAXXZ
?josUUIDcreateNil@@YGXPAY0BA@E@Z
?josUUIDcompare@@YGHPAY0BA@$$CBE0@Z
?getIniFileNameExists@CfgModule@@QAE_NXZ
?getIniFileBooleanParam2@@YG_NQBD00_N1AA_N@Z
?getIniFileMetricUnitsParam@@YGIQBD00I_NII@Z
?clearInterpWriteWindow@@YGX_N@Z
?closeInterpWriteWindow@@YGX_N@Z
?putInterpWriteTextDirect@@YGXPADI@Z
?cfgModule@@3VCfgModule@@A
?getStandardExitCode@@YGHH@Z
?josSetJadeThreadStore@@YGXI@Z
?josCommandLineNowSafe@@YGXXZ
??0ServiceClient@@QAE@PBD0@Z
??1ServiceClient@@UAE@XZ
?runService@ServiceClient@@UAEH_NPAU__jomHInstance__@@@Z
?createService@ServiceClient@@UAEHXZ
?doCommandInitServerApps@ServiceClient@@MAEHXZ
?doCommandProcessDump@ServiceClient@@MAEHW4ProcessDumpType@@@Z
?doCommandTrace@ServiceClient@@MAEH_N@Z
?doCommandUserDefined@ServiceClient@@MAEHW4ServiceCommand@1@@Z
?doContinue@ServiceClient@@MAEHXZ
?doParseArgs@ServiceClient@@MAEXHQBQBD@Z
?doPause@ServiceClient@@MAEHXZ
?doRefresh@ServiceClient@@MAEHXZ
?doStart@ServiceClient@@MAEHXZ
?doStatus@ServiceClient@@MAEHXZ
?getStatus@ServiceClient@@UAE?AW4ServiceState@1@XZ
?isServiceInstalled@ServiceClient@@UAE_NXZ
?isServiceRunning@ServiceClient@@UAE_NXZ
?isServiceStopped@ServiceClient@@UAE_NXZ
?removeService@ServiceClient@@UAEHXZ
?saveArgs@ServiceClient@@UAEXHQBQBD@Z
?saveArgs@ServiceClient@@UAEXHQBQB_W@Z
?startService@ServiceClient@@UAEHXZ
?startServiceSync@ServiceClient@@UAEHXZ
?stopService@ServiceClient@@UAEHXZ
?stopServiceSync@ServiceClient@@UAEHXZ
?right@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE?AV1@I@Z
??8?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE_NABV0@@Z
?substring@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEXAAV1@II@Z
?setValue@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXPBDI@Z
?josGetProcessId@@YGHXZ
?findLast@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEHD@Z
?tail@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEAADXZ
?removeLast@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXI@Z
?write@JadeFile@@UAEHPAX_KI@Z
??1LocCurrencyFormatter@@UAE@XZ
?parse@LocCurrencyFormatter@@QAEHHHHPBDIAAVHighPrecisionNumber@@AAI@Z
??0LocDateFormatter@@QAE@XZ
??1LocDateFormatter@@UAE@XZ
?parseLong@LocDateFormatter@@QAEHPBDIAAI1@Z
?parseShort@LocDateFormatter@@QAEHPBDIAAI1@Z
??0LocTimeFormatter@@QAE@XZ
??1LocTimeFormatter@@UAE@XZ
?parse@LocTimeFormatter@@QAEHPBDIAAI1@Z
?intlSnprintf@@YAHPADIPBDZZ
?append@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV1@PBDI@Z
?printf@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAAHPBDZZ
?josGetMaxPhysicalMemory@@YG_KXZ
?isText@JadeFile@@QBE_NXZ
?isAnsiText@JadeFile@@QBE_NXZ
?jstr_deallocate@@YGXPAX@Z
?loadLibrary@DllDesc@@QAEXXZ
?josOSInitiatedShutdown@@YG_NXZ
?substring@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE?AV1@I@Z
?clear@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXXZ
?reSize@?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEXI@Z
?Lcid_User@NlsLocale@@2IB
?writeSequentialNative@JadeFile@@UAEHPBDI@Z
?writeSequential@JadeFile@@UAEHPAXI@Z
?getFileLength@JOSFile@@QAE_KXZ
?writeNative@JadeFile@@UAEHPBD_KI@Z
?info@JomLog@@QAAHQBDZZ
?log@JomLog@@QAAHQBDZZ
?getLinkerCreated@JModuleVersion@@QAE_NAAUDskTimeStamp@@@Z
?closeImage@JModuleVersion@@QAE_NXZ
?openImage@JModuleVersion@@QAE_NQBD@Z
?getCharacterOffset@JadeFile@@UAE_KXZ
??1JModuleVersion@@QAE@XZ
??0JModuleVersion@@QAE@XZ
?readSequential@JadeFile@@UAEHPAXI@Z
?read@JadeFile@@UAEHPAX_KI@Z
??0DllDesc@@QAE@QBD_N1@Z
?purge@JadeFile@@UAEHXZ
?close@JadeFile@@UAEHXZ
?open@JadeFile@@UAEHQBDW4FileKind@1@W4FileMode@JOSFile@@W4ShareMode@4@I@Z
?getFileTimes@JadeFile@@UAEHPAUDskTimeStamp@@00@Z
?getFileLength@JadeFile@@UAE_KXZ
?isOpen@JadeFile@@QBE_NXZ
?setLastBufferedWriteError@JadeFile@@QAEXH@Z
?getLastBufferedWriteError@JadeFile@@QAEHXZ
??1JadeFile@@UAE@XZ
??0JadeFile@@QAE@XZ
?josMD5File@@YGHQBDQAE@Z
?josFileImageLooksExecutable@@YG_NQBD@Z
?josCreateDirectory@@YGHQBDW4FileFlags@JOSFile@@@Z
josCreateDirectory
?writeSequential@JOSBasicFile@@QAEHPBXI@Z
?open@JOSBasicFile@@UAEHQBDW4FileMode@JOSFile@@W4ShareMode@3@W4FileAccess@3@I@Z
??1JOSBasicFile@@UAE@XZ
??0JOSBasicFile@@QAE@XZ
?setFileTimes@JOSFile@@QAEHPAUDskTimeStamp@@00@Z
?isOpen@JOSFile@@QBE_NXZ
?close@JOSFile@@UAEHXZ
josFileDelete
josFileCopy
josFileAccess
?josSetFileAttribute@@YGHQBDW4FileAttribute@@_N@Z
josValidateDirectory
?alloc@XHeap@@QAEPAXI_N@Z
?free@XHeap@@QAEXPAX@Z
?josDefaultHeap@@3VXHeap@@A
?josAssertFail@@YGXQBD000HPAX@Z
??0?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@XZ
??0?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@PBD@Z
??1?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@XZ
??B?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEPADXZ
??4?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@ABV0@@Z
??4?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@PBD@Z
??H?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE?AV0@PBD@Z
josGetLastError
?josGetThreadLocale@@YGIXZ
?jomLog@@YAHQBDZZ
??0ThreadMutex@@QAE@XZ
??1ThreadMutex@@UAE@XZ
?acquire@ThreadMutex@@QAE_NXZ
?relinquish@ThreadMutex@@QAE_NXZ
??0Event@@QAE@_N0@Z
??1Event@@UAE@XZ
?wait@Event@@QAE_NPAI@Z
?wait@Event@@QAE_NI@Z
?cause@Event@@QAE_NXZ
?reset@Event@@QAE_NXZ
?getStatus@Event@@QBEIXZ
??2Event@@SAPAXI@Z
??3Event@@SAXPAX@Z
?josServbyname@@YGGPBD0@Z
?josInetNtop@@YGPBDHPBUsockaddr@@PADI@Z
?intlGetDefaultLocaleId@@YGIXZ
?intlSprintf@@YAHPADPBDZZ
?getCharacterLength@JadeFile@@UAE_KXZ
?commit@JadeFile@@UAEHXZ
?intlStrnicmp@@YGHPBD0I@Z
?intlUnicodeToCString@@YGHPB_WPADI@Z
?intlCStringToUnicode@@YGHPBDPA_WI@Z
??0?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE@ABV0@@Z
?length@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEIXZ
?josNormaliseDirectory@@YGXQADI@Z
?c_string@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBEPADXZ
?left@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE?AV1@I@Z
?substring@?$JadeString@DV?$CharTraits@D@@$0EA@@@QBE?AV1@II@Z
??Y?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@ABV0@@Z
??Y?$JadeString@DV?$CharTraits@D@@$0EA@@@QAEAAV0@PBD@Z
??H?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE?AV0@ABV0@@Z
??8?$JadeString@DV?$CharTraits@D@@$0EA@@@QAE_NPBD@Z
??0?$JadeString@EV?$CharTraits@E@@$0EA@@@QAE@XZ
??1?$JadeString@EV?$CharTraits@E@@$0EA@@@QAE@XZ
?length@?$JadeString@EV?$CharTraits@E@@$0EA@@@QBEIXZ
?data@?$JadeString@EV?$CharTraits@E@@$0EA@@@QBEPAEXZ
?systemExitCode@@YGH_NAAH@Z
??0OSIdentification@JomOs@@QAE@XZ
?getMyId@OSIdentification@JomOs@@QAE?AW4OSIdentity@2@XZ
?osGetNextDownloadFile@OSIdentification@JomOs@@QAEPAUOSDownloadFile@2@W4OSIdentity@2@_NAAH@Z
?osGetFilePatchNumber@OSIdentification@JomOs@@QAEHW4OSIdentity@2@H@Z
?josGetErrorText@@YGPADHPADI@Z
?josGetTickCount@@YGIXZ
?josSleep@@YGXI@Z
?josGetUserName@@YG_NPADPAI@Z
?josGetComputerName@@YGXPADPAI@Z
?josTerminateProcess@@YGXXZ
?setFileTimes@JadeFile@@UAEHPAUDskTimeStamp@@00@Z
?setEndOfLine@JadeFile@@UAEXQBDI@Z
?seekToCharacterPos@JadeFile@@UAEH_K00@Z
?seek@JadeFile@@UAEH_K@Z
?readSequentialNative@JadeFile@@UAEHPADIPAI@Z
?readNative@JadeFile@@UAEHPAD_KI@Z
?readLine@JadeFile@@UAEHAAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
?readLine@JadeFile@@UAEHAAUDskParam@@@Z
?read@JadeFile@@UAEHPAX_KIAAI@Z
?peekString@JadeFile@@UAEHPAUDskParam@@I@Z
?logError@JadeFile@@UAEHQBDH@Z
?isRemote@JadeFile@@UAE_NXZ
?isEof@JadeFile@@UAE_NXZ
?initialise@JadeFile@@UAEHQBD@Z
?getUTF8Offset@JadeFile@@UAE_KXZ
?getLastError@JadeFile@@UAEHXZ
??0LocCurrencyFormatter@@QAE@XZ
?getFileOffset@JadeFile@@UAE_KXZ
josHelp
?josGetVersion@@YGIPAUOSVersionInfo@@@Z
?LastError@NlsLocale@@QAEIXZ
?Serialize@NlsLocale@@QAE_NAAV?$JadeString@EV?$CharTraits@E@@$0EA@@@@Z
??1NlsLocale@@QAE@XZ
??0NlsLocale@@QAE@I@Z
josDateTimeToGregorian
?josGetCurrentUTCBias@@YGHXZ
?josGetCurrentDateTime@@YGXPAUDskTimeStamp@@@Z
?josBrowseForDirectory@@YGHQBD0AAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
josWinFatalException
?setIniFileStringParam@@YG_NQBD000@Z
?getIniFileStringParam@@YG_NQBD000_NAAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
?getIniFileStringParam@@YGPADQBD000_NQADI@Z
?getIniFileIntegerParam@@YGHQBD00H_NHH@Z
?getIniFileBooleanParam@@YG_NQBD00_N1@Z
?josMaintainIniFile@@YGXQBD0000_N0@Z
?getGlbIniFileName@@YGPBDXZ
?josGetCommandLine@@YGPBDXZ
?callFunction@DllDesc@@QAEHQBDPAUDskParam@@1AAH_N@Z
??1DllDesc@@UAE@XZ
?josGetModuleFileName@@YGIPAU__jomHmodule__@@QADI@Z
?josGetTempPath@@YGIAAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
?josSetIsDTNMode@@YGX_N@Z
?josGetExecutableName@@YGPBDXZ
?josGetInstallDirectory@@YGPADQADI@Z
?josGetHomeDirectory@@YGPADQADI@Z
?josGetProgramDataDirectory@@YGPADQADI@Z
?josSetThreadLocale@@YGXI@Z
?josThinClientProcessing@@YGHHPAUDskParam@@0@Z
?josGetCurrentThreadId@@YGIXZ
josInvokeGenericCallBack
?postMessage@Thread@@QAEHPAUThreadMessage@@PAX@Z
?waitMessage@Thread@@QAEHPAVEvent@@I@Z
?getThreadId@Thread@@QAE?BIXZ
?createThread@ThreadManager@@SAPAVThread@@QBDP6GIPAX@Z1_N3W4ThreadPriority@@@Z
?josIsAbsolutePath@@YG_NABV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z
?josNormaliseDirectory@@YG_NAAV?$JadeString@DV?$CharTraits@D@@$0EA@@@@Z

jomjdi

?jdiSwapSize4Endian@@YGMM@Z
?jdiSwapSize8Endian@@YG_J_J@Z
?jdiSwapSize8Endian@@YG_K_K@Z
?jdiSwapSize4Endian@@YGHH@Z
jdiSwapSize4Endian
?jdiSwapSize2Endian@@YGFF@Z
?jdiSwapSize8Endian@@YGNN@Z

jomutil

paramDeleteJadeString
paramSetJadeString
?imageConvertTo32Bits@FreeImageDesc@@QAEPAUFIBITMAP@@PAU2@@Z
?imageInvert@FreeImageDesc@@QAE_NPAUFIBITMAP@@@Z
?imageSetChannel@FreeImageDesc@@QAE_NPAUFIBITMAP@@0W4FREE_IMAGE_COLOR_CHANNEL@@@Z
?imageConvertTo8Bits@FreeImageDesc@@QAEPAUFIBITMAP@@PAU2@@Z
?imageConvertTo24Bits@FreeImageDesc@@QAEPAUFIBITMAP@@PAU2@@Z
?imageAllocate@FreeImageDesc@@QAEPAUFIBITMAP@@HHIIII@Z
?parseServerURI@ServerURIParser@@QAEHPBD@Z
?isLocalServer@ServerURIParser@@QAE_NXZ
?isNonURI@ServerURIParser@@QAE_NXZ
??1ServerURIParser@@QAE@XZ
??0ServerURIParser@@QAE@XZ
?autoupgradeIfPossible@DistribMgmt@@QAEHPBD@Z
?getInstance@DistribMgmt@@SAPAV1@XZ
?imageRescale@FreeImageDesc@@QAEPAUFIBITMAP@@PAU2@HHW4FREE_IMAGE_FILTER@@@Z
?imageUnload@FreeImageDesc@@QAEXPAUFIBITMAP@@@Z
?imageSaveToMem@FreeImageDesc@@QAE_NW4FREE_IMAGE_FORMAT@@PAUFIBITMAP@@PAUfiio_mem_handle_s@@@Z
?imageLoadFromMem@FreeImageDesc@@QAEPAUFIBITMAP@@W4FREE_IMAGE_FORMAT@@PAEI@Z
?imageGetBits@FreeImageDesc@@QAEPAEPAUFIBITMAP@@@Z
?imageGetInfo@FreeImageDesc@@QAEPAUtagBITMAPINFO@@PAUFIBITMAP@@@Z
?isProcLoaded@FreeImageDesc@@QAE_NXZ
??1FreeImageDesc@@UAE@XZ
??0FreeImageDesc@@QAE@_N@Z
jomGetMessageText
paramDeleteJadeAny
paramCreateJadeAny
paramCreateJadeStringUtf8
?jomutilMemorySpaceId@@3IA
paramDeleteJadeBinary
paramCreateJadeBinary
paramCreateJadeString
?formatTimeStamp@@YGPADABUDskTimeStamp@@QADI@Z
?getCurrentDateTime@@YGHPAUDskTimeStamp@@@Z
paramSetJadeBinary
paramDeleteJadeStringUtf8

surface

?getBold@CSurfaceFont@@QAE_NXZ
?getItalic@CSurfaceFont@@QAE_NXZ
?getStrikethru@CSurfaceFont@@QAE_NXZ
?setPen@CSurface@@QAEXKHH@Z
?setFont@CSurface@@QAEXPADM_N111@Z
?setBrush@CSurface@@QAEXKH@Z
?addImageIndx@CSurface@@QAEII@Z
?getImageIndx@CSurface@@QAEII@Z
??1?$Vector@I$09@@UAE@XZ
??0?$Vector@I$09@@QAE@XZ
?create@CSurfaceTextChunk@@QAEXPAV?$JadeString@DV?$CharTraits@D@@$0EA@@@_NUtagPOINT@@1H1@Z
??1CSurfaceTextChunk@@UAE@XZ
??0CSurfaceTextChunk@@QAE@XZ
??0CSurfaceBrush@@QAE@ABV0@@Z
??4CSurfaceBrush@@QAEAAV0@ABV0@@Z
?setPicture@CSurfaceBrush@@QAEXH@Z
?set@CSurfaceBrush@@QAEXKH@Z
?getColor@CSurfaceBrush@@QAEKXZ
??1CSurfaceBrush@@UAE@XZ
??0CSurfaceBrush@@QAE@KH@Z
??0CSurfacePen@@QAE@ABV0@@Z
??4CSurfacePen@@QAEAAV0@ABV0@@Z
?set@CSurfacePen@@QAEXKHH@Z
?getStyle@CSurfacePen@@QAEHXZ
?getWidth@CSurfacePen@@QAEHXZ
??1CSurfacePen@@UAE@XZ
??0CSurfacePen@@QAE@KHH@Z
?play@CMetaFilePlayerSVG@@UAEHPAVCSurface@@PAUtagRECT@@@Z
?getSize@CSurfaceFont@@QAEMXZ
??0CSurfaceFont@@QAE@ABV0@@Z
?getColor@CSurfacePen@@QAEKXZ
??9CSurfacePen@@QAE_NABV0@@Z
?getStyle@CSurfaceBrush@@QAEHXZ
?getPicture@CSurfaceBrush@@QAEHXZ
??9CSurfaceBrush@@QAE_NABV0@@Z
?getTextAngle@CTextStyle@@QAEHXZ
?getCharAngle@CTextStyle@@QAEHXZ
??0CSurface@@QAE@XZ
??1CSurface@@UAE@XZ
?size@?$Vector@I$09@@QBEIXZ
?add@?$Vector@I$09@@QAEXABI@Z
?atGet@?$Vector@I$09@@QBEPAII@Z
?clearTransform@CSurface@@UAEXXZ
?setBrush@CSurface@@UAEXPAVCSurfaceBrush@@@Z
?setFont@CSurface@@UAEXPAVCSurfaceFont@@@Z
?setPen@CSurface@@UAEXPAVCSurfacePen@@@Z
?setTransform@CSurface@@UAEXMMMMMM@Z
?canDrawFormattedText@CSurface@@UAE_NXZ
?drawString@CSurface@@UAE_NPAV?$Array@VCSurfaceTextChunk@@$01@@PAUtagRECT@@HMM@Z
?drawStringRotated@CSurface@@UAEXPBDPAUtagRECT@@IHH@Z
?getEMFPlayerDestination@CSurface@@UAEPAUHDC__@@XZ
?getHDC@CSurface@@UAEPAUHDC__@@XZ
?requiredPictureType@CSurface@@UAEHH@Z
?setForeColor@CSurface@@UAEXK@Z
?setTextRotation@CSurface@@UAEXHH@Z
??0CMetaFilePlayerSVG@@QAE@PAEI@Z
?getFaceName@CSurfaceFont@@QAEPADXZ
?getUnderline@CSurfaceFont@@QAE_NXZ
??1CSurfaceFont@@UAE@XZ
??1CMetaFilePlayerSVG@@UAE@XZ

jadprnt

?SetDocName@CPrinter@jadprnt@@QAEHPAUDskParam@@@Z
?OpenThePrinter@CPrinter@jadprnt@@QAEHPAUDskParam@@0000@Z
?GetOrientation@CPrinter@jadprnt@@QAEHXZ
?GetPrinterHdc@CPrinter@jadprnt@@QAEPAUHDC__@@XZ
?GetUnprintableMargins@CPrinter@jadprnt@@QAEHPAH000@Z
?GetPrintable@CPrinter@jadprnt@@QAEHPAH0@Z
?ChangePageInfo@CPrinter@jadprnt@@QAEHPAUDskParam@@@Z
?GetGeneratedImageDPI@CPrinter@jadprnt@@QAEIXZ
FindPrinterClass
_GetCachedMetaFile@12
SetFormDPI
?IsRectInRegion@CRectRgn@@QAE_NPAUtagRECT@@@Z
_GetSurfaceAndOffsets@16
?SetEntryCount@CRectRgn@@QAEXI@Z
?GetEntryCount@CRectRgn@@QAEIXZ
?AddRegion@CRectRgn@@QAEXPAUtagRECT@@@Z
?SetPrintDataType@CPrinter@jadprnt@@QAEHPAUDskParam@@0@Z

jadeactivexthin

?Disconnect@CDispEventInterface@@UAEJXZ
?Connect@CDispEventInterface@@UAEJPAUIConnectionPoint@@@Z
?removeFirst@?$Array@VCDispInterface@@$03@@QAEPAVCDispInterface@@XZ
?size@?$Array@VCDispInterface@@$03@@QBEIXZ
?EnableEvent@CDispEventInterface@@QAEHPAUDskParam@@0@Z
?LoadImplementedEvents@CDispEventInterface@@QAEXPAUDskParam@@@Z
?DisableEvents@CDispEventInterface@@QAEX_N@Z
?Initialize@CDispEventInterface@@QAEHPAVCActiveXObject@@PAUIDispatch@@PAUIConnectionPoint@@U_GUID@@@Z
??1CDispEventInterface@@UAE@XZ
??0CDispEventInterface@@QAE@XZ
?VariantToDskParam@CDispInterface@@QAEHPAUtagVARIANT@@PAUDskParam@@HPAUtagSAFEARRAY@@@Z
?Initialize@CDispInterface@@QAEHPAVCActiveXObject@@PAUIDispatch@@U_GUID@@H@Z
?GetJadeObject@CDispInterface@@QAE?AUDskObjectId@@XZ
??1CDispInterface@@UAE@XZ
??0CDispInterface@@QAE@XZ
??3CActiveXBase@@SAXPAX@Z
??2CActiveXBase@@SAPAXI@Z
??0CActiveXObject@@QAE@XZ
?ProcessDispatchEvent@CDispEventInterface@@UAEHJGPAUtagDISPPARAMS@@PAUtagVARIANT@@@Z
??1CActiveXObject@@UAE@XZ

ws2_32

WSACancelBlockingCall
WSAStartup
WSACleanup
htonl
ntohl
ntohs
closesocket
connect
getpeername
recv
select
send
setsockopt
shutdown
socket
WSAGetLastError
getaddrinfo
freeaddrinfo
getsockname

kernel32

MulDiv
SetCurrentDirectoryA
TlsAlloc
TlsFree
CompareStringA
OutputDebugStringA
lstrlenW
GetModuleFileNameA
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetVersionExA
DeleteFileA
DisableThreadLibraryCalls
GetUserDefaultLCID
FindResourceA
LoadLibraryA
lstrcatA
lstrcpyA
lstrcmpiA
lstrcmpA
GlobalFree
SizeofResource
LockResource
LoadResource
GetProcAddress
GetModuleHandleA
FreeResource
FreeLibrary
CreateProcessA
TlsSetValue
TlsGetValue
GetCurrentProcess
CloseHandle
WriteFile
FlushFileBuffers
CreateFileA
MultiByteToWideChar
lstrlenA
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
GetLastError
WideCharToMultiByte
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer

user32

EnableMenuItem
DestroyMenu
CreatePopupMenu
GetSystemMenu
SetMenu
GetCapture
SetWindowPlacement
GetWindowPlacement
TrackMouseEvent
RegisterWindowMessageA
LoadStringA
SetCursorPos
IsCharAlphaNumericA
IsCharAlphaA
CharLowerA
CharUpperA
IntersectRect
EndPaint
BeginPaint
AppendMenuA
DefWindowProcA
GetFocus
ReleaseDC
GetDC
DrawTextA
GetDesktopWindow
NotifyWinEvent
LoadCursorA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
ClientToScreen
SetCursor
DisableProcessWindowsGhosting
GetClientRect
SetFocus
TrackPopupMenu
DrawIcon
SetForegroundWindow
PostMessageA
GetMessageA
GetMenuItemCount
SendMessageA
RedrawWindow
SystemParametersInfoA
SetWindowTextA
DrawEdge
DrawFrameControl
TranslateMessage
DispatchMessageA
PeekMessageA
GetDoubleClickTime
RegisterClassA
GetClassInfoA
CreateWindowExA
DestroyWindow
ShowWindow
SetWindowPos
IsWindowVisible
IsIconic
BringWindowToTop
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyState
SetCapture
ReleaseCapture
IsWindowEnabled
GetSystemMetrics
GetMenuStringA
ModifyMenuA
SetActiveWindow
GetForegroundWindow
GetWindowDC
SetWindowRgn
GetWindowRgn
ScrollWindow
GetWindowTextA
GetWindowTextLengthA
GetWindowRect
AdjustWindowRectEx
MessageBoxA
GetCursorPos
ClipCursor
WindowFromPoint
GetSysColor
DrawFocusRect
FillRect
FrameRect
UnionRect
OffsetRect
GetWindowLongA
SetWindowLongA
GetParent
SetParent
FindWindowA
GetClassNameA
GetTopWindow
GetWindowThreadProcessId
GetWindow
DestroyCursor
DestroyIcon
GetScrollInfo
ArrangeIconicWindows
GetComboBoxInfo
LoadCursorFromFileA
LoadIconA
CreateIconFromResource
CreateIconFromResourceEx
DrawIconEx
PostQuitMessage
GetUpdateRect
InsertMenuA
GetIconInfo
RegisterClipboardFormatA
VkKeyScanA
ShowScrollBar
MapWindowPoints
ScreenToClient
ShowCaret
IsZoomed
EnableWindow
GetDlgItem
CopyRect
CallWindowProcA
HideCaret

gdi32

CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgnIndirect
CreateSolidBrush
DeleteDC
Ellipse
ExtFloodFill
FillRgn
GetClipBox
GetClipRgn
GetDIBits
GetGraphicsMode
GetPixel
GetRgnBox
GetStockObject
GetViewportOrgEx
LineTo
OffsetRgn
PatBlt
Pie
RectInRegion
Rectangle
RestoreDC
RoundRect
SaveDC
SelectClipRgn
SetBkColor
SetBkMode
SetGraphicsMode
SetRectRgn
StretchDIBits
SetROP2
SetTextColor
SetTextAlign
CreateEllipticRgn
GdiComment
SetWorldTransform
CreateDIBSection
ExtCreatePen
GetObjectA
MoveToEx
ExtTextOutA
Polygon
Polyline
SetViewportOrgEx
SetBrushOrgEx
GetDCOrgEx
CreateBrushIndirect
CreateDIBPatternBrushPt
GetObjectType
GetStretchBltMode
GetSystemPaletteEntries
SetDIBits
StretchBlt
SetStretchBltMode
SetEnhMetaFileBits
SetWinMetaFileBits
DeleteMetaFile
PlayMetaFile
SetMapMode
SetViewportExtEx
GetCurrentObject
GetBkMode
GetTextAlign
GetTextExtentPoint32A
GetTextExtentExPointA
GetCharacterPlacementA
DPtoLP
LPtoDP
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap
CombineRgn
Chord
Arc
PtInRegion
CreatePolygonRgn
BitBlt
GetTextFaceA
GetTextMetricsA
SelectObject
GetDeviceCaps
GetCharABCWidthsFloatA
EnumFontFamiliesExA
CreateFontIndirectA
PlayEnhMetaFile
CreateEnhMetaFileA
CloseEnhMetaFile
SelectPalette
RealizePalette
DeleteObject
DeleteEnhMetaFile
CreatePalette

comdlg32

CommDlgExtendedError
PrintDlgA
ChooseFontA
ChooseColorA
GetSaveFileNameA
GetOpenFileNameA
GetFileTitleW

advapi32

CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDecrypt
CryptEncrypt
RegCloseKey
CryptDeriveKey
CryptReleaseContext
CryptAcquireContextA
RegQueryValueA
RegOpenKeyExA
RegEnumKeyExA

shell32

Shell_NotifyIconA
ShellExecuteA

ole32

GetHGlobalFromILockBytes
OleLockRunning
OleRun
OleSave
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoGetClassObject
OleRegGetUserType
OleSetMenuDescriptor
CoTaskMemFree
OleGetAutoConvert
StringFromCLSID
CLSIDFromString
ProgIDFromCLSID
CLSIDFromProgID
StgCreateDocfile
OleInitialize
OleUninitialize
CoInitializeEx
OleCreate
OleCreateLinkToFile
OleCreateFromFile
OleLoad
OleSetContainedObject
OleGetIconOfClass
CoTaskMemAlloc
CreateBindCtx
ReleaseStgMedium
CoCreateInstance

oleaut32

VariantInit
VariantClear
VarR8FromCy
VarCyFromR4
VarCyFromR8
OleCreatePropertyFrameIndirect
OleCreateFontIndirect
SafeArrayCreate
SysAllocStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
LHashValOfNameSys
OleCreatePictureIndirect
SysStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
SafeArrayGetDim

oleacc

GetRoleTextA
AccessibleObjectFromWindow
LresultFromObject

comctl32

ord17

msvcp120

?_Syserror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z

msvcr120

_initterm
_initterm_e
__set_app_type
__setusermatherr
_configthreadlocale
_ismbblead
_cexit
_exit
exit
_stricmp
__getmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
_except1
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_controlfp_s
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
sqrt
exp
strrchr
strftime
sprintf
_vsnprintf
strcpy
mbtowc
modf
tolower
isupper
_invoke_watson
__crtSetUnhandledExceptionFilter
_commode
_fmode
_except_handler4_common
_acmdln
memcmp
memcpy
memset
strlen
memmove
_hypot
_CxxThrowException
__CxxFrameHandler3
strchr
wcslen
rand
strncmp
strtod
fabs
strncpy
_strtoi64
_strtoui64
strstr
abs
memchr
_gmtime64
_localtime64
sscanf
strcmp
strncpy_s
free
cos
_snprintf
sin

Exports

Exports

??1?$Array@VThread@@$01@@UAE@XZ
??1?$Vector@P6GXW4ThreadEntryReason@@@Z$01@@UAE@XZ
??3?$Vector@P6GXW4ThreadEntryReason@@@Z$01@@SAXPAX@Z
??4DskHandleEx@@QAEAAU0@ABU0@@Z
??4JModuleVersion@@QAEAAV0@ABV0@@Z
??_7?$Array@VThread@@$01@@6B@
??_7?$Vector@P6GXW4ThreadEntryReason@@@Z$01@@6B@
?getLastError@JModuleVersion@@QAEHXZ
ActiveXSendToPmap
CnetSendToPmap
DllGetVersion
DotNetGuiSendToPmap
DotNetSendToPmap
FreeTextChunksForPrinter
IsThinClient
JadeClientProc
JadeFromWpf
JadeObjectProc
MakeTextChunksForPrinter
WinMain
_DllMain@12
_JadeFromWpf2@20
_moduleVersion_jade_7_1_8@0

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7c4ed2a8245b5894024c4aaa053d4084

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

07:ab:46:78:40:a0:20:b8:9e:8b:86:d8:2a:99:21:9eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2c:73:20:87:62:a6:0b:10:6e:d7:59:89:ec:eb:76:88:9a:6e:f9:70Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

jomos

jomjdi

jomutil

surface

jadprnt

jadeactivexthin

ws2_32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

oleacc

comctl32

msvcp120

msvcr120

Exports

Exports

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 166KB - Virtual size: 165KB

.data Size: 9KB - Virtual size: 16KB

.rsrc Size: 929KB - Virtual size: 928KB

.reloc Size: 77KB - Virtual size: 76KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07:ab:46:78:40:a0:20:b8:9e:8b:86:d8:2a:99:21:9e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2c:73:20:87:62:a6:0b:10:6e:d7:59:89:ec:eb:76:88:9a:6e:f9:70
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 166KB - Virtual size: 165KB

.data
Size: 9KB - Virtual size: 16KB

.rsrc
Size: 929KB - Virtual size: 928KB

.reloc
Size: 77KB - Virtual size: 76KB