500c0e2400d5968f7c34bde6036d0c9f015625cc04a5202d84fba915a3355a74

Sharing

Copy URL Twitter E-mail

General

Target

500c0e2400d5968f7c34bde6036d0c9f015625cc04a5202d84fba915a3355a74
Size

6.0MB
MD5

564cd6ea67e7ac6745c76f0537882483
SHA1

e9bb8009ab734c20f70ad2c823143eb372342211
SHA256

500c0e2400d5968f7c34bde6036d0c9f015625cc04a5202d84fba915a3355a74
SHA512

cf33d0e047781d434274688793c566286d846027c22ea0036653dbb56beee4682a3419a1c832c172e2b3952558f93d8d30dba159a3376728eb0eb77e11849c7d
SSDEEP

98304:y0dTjIn1R5ioo48rk4p47HuSOXEMi5be6h4IK1u5dKAb/Us9j9hmbTxB:VRIn1R8IC4nB5bXUvET+P

Score

4^/10

pdf link

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

resource	yara_rule
static1/unpack001/RevoUninstaller_Portable_免安裝/Revo Uninstaller Help.pdf	pdf_with_link_action

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Files

500c0e2400d5968f7c34bde6036d0c9f015625cc04a5202d84fba915a3355a74
.7z
RevoUninstaller_Portable_免安裝/LicenseAgreement.txt
RevoUninstaller_Portable_免安裝/Revo Uninstaller Help.pdf
.pdf
- http://www.revouninstaller.com/
RevoUninstaller_Portable_免安裝/RevoUPort.exe
.exe windows x86

f1701f0b31fe827683fdfb65eb40b138

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/05/2016, 00:00

Not After

10/01/2017, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/05/2016, 00:00

Not After

10/01/2017, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12/01/2016, 00:00

Not After

11/04/2027, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

17:36:3b:b5:a6:7e:bb:02:c9:d6:33:a3:38:01:a4:ca:13:cb:ee:5a:43:fa:cc:c5:3a:c3:b1:ea:f0:36:dc:68
Signer

Actual PE Digest

17:36:3b:b5:a6:7e:bb:02:c9:d6:33:a3:38:01:a4:ca:13:cb:ee:5a:43:fa:cc:c5:3a:c3:b1:ea:f0:36:dc:68

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

12/12/2016, 10:29
Valid: false

59:ca:f4:d0:a1:b2:cd:2e:30:96:8e:cc:a3:d6:39:e6:36:a2:ec:c3
Signer

Actual PE Digest

59:ca:f4:d0:a1:b2:cd:2e:30:96:8e:cc:a3:d6:39:e6:36:a2:ec:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

12/12/2016, 10:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathQuoteSpacesW
PathRemoveFileSpecW

kernel32

VirtualFree
GetModuleFileNameW
IsWow64Process
GetCurrentProcess
CreateProcessW
CloseHandle
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 149KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RevoUninstaller_Portable_免安裝/ctrlbars.dat
RevoUninstaller_Portable_免安裝/lang/Estonian.ini
RevoUninstaller_Portable_免安裝/lang/albanian.ini
RevoUninstaller_Portable_免安裝/lang/arabic.ini
RevoUninstaller_Portable_免安裝/lang/armenian.ini
RevoUninstaller_Portable_免安裝/lang/azerbaijani.ini
RevoUninstaller_Portable_免安裝/lang/bulgarian.ini
RevoUninstaller_Portable_免安裝/lang/czech.ini
RevoUninstaller_Portable_免安裝/lang/danish.ini
RevoUninstaller_Portable_免安裝/lang/dutch.ini
RevoUninstaller_Portable_免安裝/lang/english.ini
RevoUninstaller_Portable_免安裝/lang/finnish.ini
RevoUninstaller_Portable_免安裝/lang/french.ini
RevoUninstaller_Portable_免安裝/lang/german.ini
RevoUninstaller_Portable_免安裝/lang/hebrew.ini
RevoUninstaller_Portable_免安裝/lang/hellenic.ini
RevoUninstaller_Portable_免安裝/lang/hindi.ini
RevoUninstaller_Portable_免安裝/lang/hrvatski.ini
RevoUninstaller_Portable_免安裝/lang/hungarian.ini
RevoUninstaller_Portable_免安裝/lang/indonesian.ini
RevoUninstaller_Portable_免安裝/lang/italiano.ini
RevoUninstaller_Portable_免安裝/lang/japanese.ini
RevoUninstaller_Portable_免安裝/lang/korean.ini
RevoUninstaller_Portable_免安裝/lang/kurdish.ini
RevoUninstaller_Portable_免安裝/lang/macedonian.ini
RevoUninstaller_Portable_免安裝/lang/norwegian.ini
RevoUninstaller_Portable_免安裝/lang/persian.ini
RevoUninstaller_Portable_免安裝/lang/polish.ini
RevoUninstaller_Portable_免安裝/lang/portuguese.ini
RevoUninstaller_Portable_免安裝/lang/portuguese_standard.ini
RevoUninstaller_Portable_免安裝/lang/portuguesebrazil.ini
RevoUninstaller_Portable_免安裝/lang/romanian.ini
RevoUninstaller_Portable_免安裝/lang/russian.ini
RevoUninstaller_Portable_免安裝/lang/serbian.ini
RevoUninstaller_Portable_免安裝/lang/serbianLatin.ini
RevoUninstaller_Portable_免安裝/lang/simplifiedchinese.ini
RevoUninstaller_Portable_免安裝/lang/slovak.ini
RevoUninstaller_Portable_免安裝/lang/slovenian.ini
RevoUninstaller_Portable_免安裝/lang/spanish.ini
RevoUninstaller_Portable_免安裝/lang/swedish.ini
RevoUninstaller_Portable_免安裝/lang/traditionalchinese.ini
RevoUninstaller_Portable_免安裝/lang/turkish.ini
RevoUninstaller_Portable_免安裝/lang/ukrainian.ini
RevoUninstaller_Portable_免安裝/lang/vietnamese.ini
RevoUninstaller_Portable_免安裝/settings.ini
RevoUninstaller_Portable_免安裝/un_report.dat
RevoUninstaller_Portable_免安裝/x64/RevoUn.exe
.exe windows x64

1e3d1c6296af1d75e2a1c0db0991b059

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2016, 00:00

Not After

28/01/2020, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2016, 00:00

Not After

28/01/2020, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

17:e5:c9:b9:b2:04:8f:1e:21:17:fa:bb:4a:fa:d5:62:6a:4f:b0:20:cc:7b:c8:09:58:c3:f0:4b:ab:de:2e:c7
Signer

Actual PE Digest

17:e5:c9:b9:b2:04:8f:1e:21:17:fa:bb:4a:fa:d5:62:6a:4f:b0:20:cc:7b:c8:09:58:c3:f0:4b:ab:de:2e:c7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

21/03/2018, 14:18
Valid: false

45:8c:63:bb:51:04:7a:78:b5:bd:b8:98:63:d7:6d:e9:37:fc:f4:27
Signer

Actual PE Digest

45:8c:63:bb:51:04:7a:78:b5:bd:b8:98:63:d7:6d:e9:37:fc:f4:27

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

21/03/2018, 14:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

comctl32

ord17
_TrackMouseEvent
ImageList_Duplicate

shlwapi

PathMatchSpecW
PathAddBackslashW
PathRemoveExtensionW
StrToIntW
PathStripToRootW
SHDeleteKeyW
SHDeleteValueW
PathRemoveArgsW
ord487
PathGetArgsW
PathIsRootW
SHQueryValueExW
PathUnExpandEnvStringsW
StrCpyW
PathRemoveFileSpecW
PathIsUNCW
PathRemoveBackslashW
StrCatW
PathFileExistsW
PathFindExtensionW
PathAppendW
PathFindFileNameW
StrFormatByteSizeW
PathIsDirectoryW
StrStrIW
PathIsDirectoryEmptyW
StrCmpW
StrFormatKBSizeW
PathQuoteSpacesW
PathUnquoteSpacesW
StrCmpIW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses

msi

ord173
ord217

advapi32

GetUserNameW
RegNotifyChangeKeyValue
RegQueryValueW
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityInfo
SetEntriesInAclW
OpenProcessToken
RegDeleteKeyExW
FreeSid
SetNamedSecurityInfoW
AllocateAndInitializeSid
ConvertSidToStringSidW
LookupAccountNameW
RegUnLoadKeyW
RegSetValueExW
RegSetKeySecurity
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegLoadKeyW
RegGetKeySecurity
RegFlushKey
RegEnumKeyExW
RegCreateKeyExW
RegConnectRegistryW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
DeleteService
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyW

wininet

FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache

kernel32

VerifyVersionInfoW
GetUserDefaultLangID
CreateMutexW
GetCommandLineW
OutputDebugStringW
GetShortPathNameW
GlobalSize
CopyFileW
GlobalFree
SetThreadPriority
GetCurrentThreadId
SuspendThread
GetModuleHandleA
GetVersionExA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
lstrcmpA
lstrlenA
GlobalGetAtomNameW
GetThreadLocale
GetVolumeInformationW
CompareStringA
LoadLibraryExW
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GetPrivateProfileIntW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
SetErrorMode
GetFileSizeEx
GetFileTime
GetSystemDirectoryW
GetUserDefaultLCID
VerSetConditionMask
GetProfileIntW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapFree
HeapAlloc
HeapReAlloc
GetCPInfo
RtlUnwindEx
RaiseException
RtlPcToFileHeader
ExitThread
CreateThread
ExitProcess
HeapSize
HeapQueryInformation
VirtualProtect
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetProcessHeap
GetDriveTypeA
SetEnvironmentVariableA
QueryDosDeviceW
GetLogicalDriveStringsW
GetLongPathNameW
SystemTimeToTzSpecificLocalTime
GetVersion
VirtualFree
VirtualAlloc
DeviceIoControl
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
VirtualAllocEx
TlsAlloc
DeleteFileA
AreFileApisANSI
GetTempPathA
GetCurrentProcessId
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
FlushFileBuffers
ReadFile
GetFileAttributesW
GetFileAttributesA
FormatMessageW
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
GetTickCount
LockFile
UnlockFile
QueryPerformanceCounter
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
GetFullPathNameA
WideCharToMultiByte
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetComputerNameW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetTempFileNameW
TerminateProcess
DuplicateHandle
LocalFree
GetCurrentProcess
GetEnvironmentVariableW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetVersionExW
CompareFileTime
GetTempPathW
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceExW
lstrcmpiW
lstrlenW
GetBinaryTypeW
GetProcAddress
GetModuleHandleW
LoadLibraryW
SetLastError
GetDriveTypeW
GetLogicalDrives
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
SetEvent
ResumeThread
ResetEvent
SetFileAttributesW
RemoveDirectoryW
OpenProcess
WriteFile
CreateFileW
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
CreateProcessW
MoveFileW
lstrcatW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
lstrcmpW
lstrcpyW
GetFullPathNameW
DeleteFileW
FindClose
FindNextFileW
IsBadWritePtr
FindFirstFileW
GetLastError
CreateDirectoryW
Sleep
MoveFileExW
WaitForSingleObject
FindResourceW
LoadResource
LockResource
SizeofResource
MulDiv
SetPriorityClass
GetPriorityClass
GetThreadPriority
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetCurrencyFormatW
FindResourceExW
WinExec
GetCurrentDirectoryW
IsBadReadPtr

user32

InsertMenuW
CreatePopupMenu
PeekMessageW
GetWindowThreadProcessId
WindowFromPoint
DrawIcon
IsIconic
SetLayeredWindowAttributes
GetMonitorInfoW
MonitorFromWindow
EnumChildWindows
FindWindowW
ReleaseDC
GetWindowDC
SetForegroundWindow
GetForegroundWindow
SystemParametersInfoW
SetWindowRgn
LoadBitmapW
GetSysColorBrush
SetRect
GetMessagePos
DrawFrameControl
FillRect
SetWindowLongW
GetWindowLongW
LockWindowUpdate
GetClassNameW
EqualRect
SetScrollPos
SetScrollRange
GetScrollPos
GetScrollRange
GetDesktopWindow
LoadMenuW
DestroyMenu
LoadIconW
LoadStringW
InflateRect
OffsetRect
GetCursorPos
ShowWindow
SetCapture
PtInRect
ReleaseCapture
LoadImageW
SetWindowPos
RedrawWindow
SetFocus
SetRectEmpty
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
KillTimer
wsprintfW
TrackPopupMenu
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DestroyIcon
CreateWindowExW
PostMessageW
SetCursor
CopyRect
LoadAcceleratorsW
ClientToScreen
GetParent
IsWindowVisible
GetMenuItemCount
SendMessageW
UpdateWindow
GetMenuItemID
GetSubMenu
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
MessageBoxW
IsCharAlphaW
GetDoubleClickTime
RemoveMenu
AppendMenuW
GetMenuStringW
GetSysColor
GetDlgItem
EnableWindow
InvalidateRect
GetSystemMenu
GetSystemMetrics
GetFocus
SetTimer
GetClassInfoW
DefWindowProcW
LoadCursorW
GetWindowLongPtrW
IsChild
BeginDeferWindowPos
ScreenToClient
DeferWindowPos
EndDeferWindowPos
IsWindow
GetClientRect
GetWindowRect
GetMenuState
ValidateRect
GetKeyState
GetActiveWindow
CallNextHookEx
SetWindowsHookExW
IntersectRect
GetDC
BeginPaint
EndPaint
GetWindow
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
DrawStateW
FrameRect
MapVirtualKeyExW
EnableScrollBar
MessageBeep
GetNextDlgGroupItem
PostThreadMessageW
CreateMenu
GetTabbedTextExtentA
GetDCEx
InvalidateRgn
CopyAcceleratorTableW
UnionRect
UnregisterClassW
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
PostQuitMessage
SetParent
DeleteMenu
IsRectEmpty
CharNextW
MapVirtualKeyW
GetKeyNameTextW
IsZoomed
CharUpperW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
BringWindowToTop
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetMenuItemInfoW
RegisterWindowMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
GetClassLongPtrW
SendDlgItemMessageW
GetPropW
RemovePropW
IsClipboardFormatAvailable
GetClipboardData
IsCharAlphaNumericW
GetIconInfo
DrawIconEx
DrawFocusRect
DestroyCursor
GetWindowRgn
GetCursor
DestroyAcceleratorTable
CreateIconIndirect
IsMenu
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
SetWindowLongPtrW
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
ScrollWindow
SetMenu
ShowScrollBar
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
SetWindowPlacement
CallWindowProcW
GetMenu
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
IsWindowEnabled
MoveWindow
GetDlgCtrlID
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
TranslateAcceleratorW
DispatchMessageA
SetPropW
WaitMessage
GetAsyncKeyState
WindowFromDC
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
LoadMenuIndirectW
CreateAcceleratorTableW

gdi32

CreateFontIndirectW
DeleteObject
GetObjectW
GetBkColor
BitBlt
DPtoLP
GetMapMode
CreateCompatibleBitmap
PtInRegion
GetNearestColor
Ellipse
SetPixel
SetPixelV
GetStretchBltMode
CreatePolygonRgn
CreateRoundRectRgn
RealizePalette
FillRgn
FrameRgn
RoundRect
GetBkMode
EnumFontFamiliesExW
CreateDIBitmap
CreateDIBSection
CreateBitmap
LPtoDP
CreateCompatibleDC
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateRectRgn
CombineRgn
GetDIBits
StretchBlt
CreateFontW
CopyMetaFileW
CreateDCW
SetBkColor
CreateRectRgnIndirect
SetRectRgn
PatBlt
CreatePatternBrush
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetMapMode
GetClipBox
GetTextExtentPoint32W
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocW
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SelectPalette
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
GetDCOrgEx
GetTextColor
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
GetCharWidthW
StretchDIBits
GetRgnBox
GetTextAlign
OffsetRgn
GetViewportOrgEx
Rectangle
ExcludeClipRect
GetTextMetricsW
GetWindowOrgEx
GetTextExtentPoint32A
GetTextFaceW
GetROP2
GetPolyFillMode
Polygon
CreateEllipticRgn
CreateEllipticRgnIndirect
GetTextCharset
EnumFontFamiliesW
CreatePalette
PlayEnhMetaFile
GetEnhMetaFileW
GetMetaFileW
DeleteEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
ExtractIconW
DragFinish
SHEmptyRecycleBinW
SHAddToRecentDocs
Shell_NotifyIconW
CommandLineToArgvW
SHGetFolderPathW
SHFileOperationW
ord92
SHGetDesktopFolder
SHAppBarMessage

oledlg

OleUIBusyW

ole32

OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLoadFromStream
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleSaveToStream
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
WriteClassStm
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
OleTranslateAccelerator
IsAccelerator
CoInitializeEx

oleaut32

VarDiv
VarBstrFromR8
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysFreeString
VarDateFromStr
VariantClear
VarMul
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantChangeType
VarR8FromStr
VariantInit
OleCreateFontIndirect
SysStringLen
VarI4FromStr
OleCreatePictureIndirect
SysAllocString
VarCyFromStr
SafeArrayDestroy
VariantCopy

urlmon

URLDownloadToFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

PlaySoundW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 108KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 284KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
RevoUninstaller_Portable_免安裝/x86/RevoUn.exe
.exe windows x86

2418ab48eeca358d230c86458ea51fe7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2016, 00:00

Not After

28/01/2020, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2016, 00:00

Not After

28/01/2020, 23:59

Subject

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

5a:d7:ea:0f:48:85:b9:b0:3d:cc:7f:68:16:70:3e:89:67:4e:3d:2f:95:a6:89:73:18:ae:92:51:3b:a9:e1:39
Signer

Actual PE Digest

5a:d7:ea:0f:48:85:b9:b0:3d:cc:7f:68:16:70:3e:89:67:4e:3d:2f:95:a6:89:73:18:ae:92:51:3b:a9:e1:39

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

21/03/2018, 14:18
Valid: false

56:fd:d6:79:ce:ae:ac:eb:7a:c9:48:65:67:3e:2b:c7:d9:00:13:7c
Signer

Actual PE Digest

56:fd:d6:79:ce:ae:ac:eb:7a:c9:48:65:67:3e:2b:c7:d9:00:13:7c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=VS Revo Group,O=VS Revo Group,L=Ruse,ST=Ruse,C=BG

21/03/2018, 14:18
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17
_TrackMouseEvent
ImageList_Duplicate

shlwapi

PathMatchSpecW
PathAddBackslashW
PathRemoveExtensionW
StrToIntW
PathStripToRootW
SHDeleteKeyW
SHDeleteValueW
PathRemoveArgsW
ord487
PathIsRootW
PathGetArgsW
SHQueryValueExW
PathUnExpandEnvStringsW
StrCpyW
PathRemoveFileSpecW
PathIsUNCW
PathRemoveBackslashW
StrCatW
PathFileExistsW
PathFindExtensionW
PathAppendW
PathFindFileNameW
StrFormatByteSizeW
PathIsDirectoryW
StrStrIW
PathIsDirectoryEmptyW
StrCmpW
StrFormatKBSizeW
PathQuoteSpacesW
PathUnquoteSpacesW
StrCmpIW

psapi

GetProcessImageFileNameW
GetModuleFileNameExW
EnumProcesses

msi

ord173
ord217

advapi32

RegNotifyChangeKeyValue
GetTokenInformation
RegQueryValueW
AdjustTokenPrivileges
LookupPrivilegeValueW
SetSecurityInfo
SetEntriesInAclW
OpenProcessToken
FreeSid
SetNamedSecurityInfoW
AllocateAndInitializeSid
ConvertSidToStringSidW
LookupAccountNameW
RegUnLoadKeyW
RegSetValueExW
RegSetKeySecurity
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegLoadKeyW
RegGetKeySecurity
RegFlushKey
RegEnumKeyExW
RegCreateKeyExW
RegConnectRegistryW
RegDeleteKeyW
RegEnumKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
OpenSCManagerW
OpenServiceW
CloseServiceHandle
DeleteService
RegOpenKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumValueW
GetUserNameW

wininet

FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache

kernel32

IsWow64Process
GetLogicalDriveStringsW
QueryDosDeviceW
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLangID
CreateMutexW
GetCommandLineW
OutputDebugStringW
GetShortPathNameW
GlobalSize
CopyFileW
GlobalFree
SetThreadPriority
GetCurrentThreadId
SuspendThread
GetModuleHandleA
GetVersionExA
CompareStringW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
lstrcmpA
lstrlenA
GlobalGetAtomNameW
GetThreadLocale
GetVolumeInformationW
InterlockedExchange
CompareStringA
LoadLibraryExW
GetLocaleInfoW
EnumResourceLanguagesW
ConvertDefaultLocale
GetCurrentThread
GetPrivateProfileIntW
LocalAlloc
TlsGetValue
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
TlsFree
GetLongPathNameW
SetErrorMode
GetFileSizeEx
GetFileTime
GetSystemDirectoryW
GetUserDefaultLCID
GetCurrentDirectoryW
GetProfileIntW
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
HeapReAlloc
GetCPInfo
RtlUnwind
RaiseException
ExitThread
CreateThread
ExitProcess
HeapSize
VirtualProtect
VirtualQuery
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
GetFileInformationByHandle
PeekNamedPipe
GetCurrentDirectoryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
GetProcessHeap
GetDriveTypeA
SetEnvironmentVariableA
SystemTimeToTzSpecificLocalTime
GetVersion
VirtualFree
VirtualAlloc
DeviceIoControl
WriteProcessMemory
ReadProcessMemory
VirtualFreeEx
VirtualAllocEx
TlsAlloc
DeleteFileA
AreFileApisANSI
GetTempPathA
GetCurrentProcessId
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
FlushFileBuffers
ReadFile
GetFileAttributesW
GetFileAttributesA
FormatMessageW
FormatMessageA
GetSystemTimeAsFileTime
UnlockFileEx
GetTickCount
LockFile
UnlockFile
InterlockedCompareExchange
QueryPerformanceCounter
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
GetFileSize
CreateFileA
GetFullPathNameA
WideCharToMultiByte
FreeLibrary
FileTimeToLocalFileTime
FileTimeToSystemTime
GetComputerNameW
WaitForMultipleObjects
CreateEventW
GetModuleFileNameW
GetTempFileNameW
TerminateProcess
DuplicateHandle
LocalFree
GetCurrentProcess
GetEnvironmentVariableW
GetPrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
WritePrivateProfileStringW
GetVersionExW
CompareFileTime
GetTempPathW
SystemTimeToFileTime
GetSystemTime
GetDiskFreeSpaceExW
lstrcmpiW
lstrlenW
GetProcAddress
GetModuleHandleW
LoadLibraryW
SetLastError
GetDriveTypeW
GetLogicalDrives
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MultiByteToWideChar
SetEvent
ResumeThread
ResetEvent
SetFileAttributesW
RemoveDirectoryW
OpenProcess
WriteFile
CreateFileW
GlobalUnlock
GlobalLock
GlobalAlloc
CloseHandle
CreateProcessW
MoveFileW
lstrcatW
GetWindowsDirectoryW
ExpandEnvironmentStringsW
lstrcmpW
lstrcpyW
GetFullPathNameW
DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetLastError
CreateDirectoryW
IsBadWritePtr
Sleep
MoveFileExW
WaitForSingleObject
FindResourceW
LoadResource
LockResource
SizeofResource
MulDiv
SetPriorityClass
GetPriorityClass
GetThreadPriority
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
GetCurrencyFormatW
FindResourceExW
WinExec
GlobalFlags
IsBadReadPtr

user32

CreatePopupMenu
PeekMessageW
GetWindowThreadProcessId
WindowFromPoint
DrawIcon
IsIconic
SetLayeredWindowAttributes
GetMonitorInfoW
MonitorFromWindow
EnumChildWindows
FindWindowW
ReleaseDC
GetWindowDC
SetForegroundWindow
GetForegroundWindow
SystemParametersInfoW
SetWindowRgn
LoadBitmapW
GetSysColorBrush
SetRect
GetMessagePos
DrawFrameControl
FillRect
SetWindowLongW
LockWindowUpdate
GetClassNameW
EqualRect
SetScrollPos
SetScrollRange
GetScrollPos
GetScrollRange
GetDesktopWindow
LoadMenuW
DestroyMenu
LoadIconW
LoadStringW
InflateRect
OffsetRect
GetCursorPos
ShowWindow
SetCapture
PtInRect
ReleaseCapture
LoadImageW
SetWindowPos
RedrawWindow
SetFocus
SetRectEmpty
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
KillTimer
wsprintfW
TranslateAcceleratorW
InsertMenuW
SetClipboardData
EmptyClipboard
OpenClipboard
DestroyIcon
CreateWindowExW
PostMessageW
SetCursor
CopyRect
LoadAcceleratorsW
ClientToScreen
GetParent
TrackPopupMenu
IsWindowVisible
SendMessageW
UpdateWindow
GetMenuItemCount
GetMenuItemID
GetSubMenu
MsgWaitForMultipleObjects
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
MessageBoxW
IsCharAlphaW
GetDoubleClickTime
AppendMenuW
GetSysColor
GetDlgItem
EnableWindow
InvalidateRect
GetSystemMenu
GetSystemMetrics
GetFocus
SetTimer
GetClassInfoW
DefWindowProcW
LoadCursorW
GetWindowLongW
IsChild
BeginDeferWindowPos
ScreenToClient
DeferWindowPos
EndDeferWindowPos
IsWindow
GetClientRect
GetWindowRect
GetMenuStringW
GetMenuState
ValidateRect
GetKeyState
GetActiveWindow
CallNextHookEx
SetWindowsHookExW
IntersectRect
GetDC
BeginPaint
EndPaint
GetWindow
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
DrawStateW
FrameRect
MapVirtualKeyExW
EnableScrollBar
SendDlgItemMessageW
MessageBeep
GetNextDlgGroupItem
PostThreadMessageW
CreateMenu
GetTabbedTextExtentA
GetDCEx
InvalidateRgn
CopyAcceleratorTableW
UnionRect
UnregisterClassW
ShowOwnedPopups
SetWindowContextHelpId
MapDialogRect
RegisterClipboardFormatW
PostQuitMessage
SetParent
DeleteMenu
IsRectEmpty
CharNextW
MapVirtualKeyW
GetKeyNameTextW
IsZoomed
CharUpperW
UnpackDDElParam
ReuseDDElParam
InsertMenuItemW
BringWindowToTop
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
EnableMenuItem
CheckMenuItem
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
GetMenuItemInfoW
RegisterWindowMessageW
IsDialogMessageW
WinHelpW
GetCapture
GetClassLongW
IsClipboardFormatAvailable
GetClipboardData
IsCharAlphaNumericW
GetIconInfo
DrawIconEx
DrawFocusRect
DestroyCursor
GetWindowRgn
GetCursor
DestroyAcceleratorTable
CreateIconIndirect
IsMenu
SetPropW
GetPropW
RemovePropW
GetLastActivePopup
SetActiveWindow
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MapWindowPoints
ScrollWindow
SetMenu
ShowScrollBar
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
GetScrollInfo
SetScrollInfo
SetWindowPlacement
CallWindowProcW
GetMenu
SystemParametersInfoA
GetWindowPlacement
GetWindowTextLengthW
GetWindowTextW
IsWindowEnabled
MoveWindow
GetDlgCtrlID
SetWindowTextW
CloseClipboard
SetDlgItemTextW
RemoveMenu
SendDlgItemMessageA
WaitMessage
GetAsyncKeyState
WindowFromDC
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
LoadMenuIndirectW
CreateAcceleratorTableW

gdi32

CreateFontIndirectW
DeleteObject
GetObjectW
GetBkColor
BitBlt
DPtoLP
GetMapMode
CreateCompatibleBitmap
PtInRegion
GetNearestColor
Ellipse
SetPixel
SetPixelV
GetStretchBltMode
CreatePolygonRgn
CreateRoundRectRgn
RealizePalette
FillRgn
FrameRgn
RoundRect
GetBkMode
EnumFontFamiliesExW
CreateDIBitmap
CreateDIBSection
CreateBitmap
LPtoDP
CreateCompatibleDC
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
CreateRectRgn
CombineRgn
GetDIBits
StretchBlt
CreateFontW
CopyMetaFileW
CreateDCW
SetBkColor
CreateRectRgnIndirect
SetRectRgn
PatBlt
CreatePatternBrush
SaveDC
RestoreDC
SetBkMode
SetPolyFillMode
SetROP2
SetStretchBltMode
SetTextColor
SetMapMode
GetClipBox
GetTextExtentPoint32W
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
StartDocW
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
GetCurrentPositionEx
ExtSelectClipRgn
DeleteDC
GetStockObject
SelectPalette
PlayMetaFile
CreatePen
ExtCreatePen
CreateSolidBrush
GetDCOrgEx
GetTextColor
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
GetCharWidthW
StretchDIBits
GetRgnBox
GetTextAlign
OffsetRgn
GetViewportOrgEx
Rectangle
ExcludeClipRect
GetTextMetricsW
GetWindowOrgEx
GetTextExtentPoint32A
GetTextFaceW
GetROP2
GetPolyFillMode
Polygon
CreateEllipticRgn
CreateEllipticRgnIndirect
GetTextCharset
EnumFontFamiliesW
CreatePalette
PlayEnhMetaFile
GetEnhMetaFileW
GetMetaFileW
DeleteEnhMetaFile
CloseEnhMetaFile
CreateEnhMetaFileW
EndDoc
AbortDoc
SetAbortProc
EndPage
StartPage
GetDeviceCaps

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
ClosePrinter
DocumentPropertiesW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
ExtractIconW
DragFinish
SHEmptyRecycleBinW
SHAddToRecentDocs
Shell_NotifyIconW
CommandLineToArgvW
SHGetFolderPathW
SHFileOperationW
ord92
SHGetDesktopFolder
SHAppBarMessage

oledlg

OleUIBusyW

ole32

OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLoadFromStream
CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromProgID
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
OleSaveToStream
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
WriteClassStm
DoDragDrop
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
OleTranslateAccelerator
IsAccelerator
CoInitializeEx

oleaut32

VarDiv
VarBstrFromR8
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
SysFreeString
VarDateFromStr
VariantClear
SysStringLen
VarMul
SysStringByteLen
SysAllocStringLen
VariantChangeType
VariantInit
VarR8FromStr
OleCreateFontIndirect
SysAllocStringByteLen
VarI4FromStr
VariantCopy
OleCreatePictureIndirect
SysAllocString
VarCyFromStr
SafeArrayDestroy

urlmon

URLDownloadToFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

winmm

PlaySoundW

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 723KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 86KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7.6MB - Virtual size: 7.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f1701f0b31fe827683fdfb65eb40b138

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13Certificate

Extended Key Usages

Key Usages

17:36:3b:b5:a6:7e:bb:02:c9:d6:33:a3:38:01:a4:ca:13:cb:ee:5a:43:fa:cc:c5:3a:c3:b1:ea:f0:36:dc:68Signer

Signature Validations

Verification

12/12/2016, 10:29 Valid: false

59:ca:f4:d0:a1:b2:cd:2e:30:96:8e:cc:a3:d6:39:e6:36:a2:ec:c3Signer

Signature Validations

Verification

12/12/2016, 10:29 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 7KB - Virtual size: 6KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 149KB - Virtual size: 148KB

1e3d1c6296af1d75e2a1c0db0991b059

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

17:e5:c9:b9:b2:04:8f:1e:21:17:fa:bb:4a:fa:d5:62:6a:4f:b0:20:cc:7b:c8:09:58:c3:f0:4b:ab:de:2e:c7Signer

Signature Validations

Verification

21/03/2018, 14:18 Valid: false

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

23:07:31:ef:6f:4d:bd:f7:34:b7:3f:c6:d5:9c:2f:4b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

17:36:3b:b5:a6:7e:bb:02:c9:d6:33:a3:38:01:a4:ca:13:cb:ee:5a:43:fa:cc:c5:3a:c3:b1:ea:f0:36:dc:68
Signer

12/12/2016, 10:29
Valid: false

59:ca:f4:d0:a1:b2:cd:2e:30:96:8e:cc:a3:d6:39:e6:36:a2:ec:c3
Signer

12/12/2016, 10:29
Valid: false

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 7KB - Virtual size: 6KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 149KB - Virtual size: 148KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

17:e5:c9:b9:b2:04:8f:1e:21:17:fa:bb:4a:fa:d5:62:6a:4f:b0:20:cc:7b:c8:09:58:c3:f0:4b:ab:de:2e:c7
Signer

21/03/2018, 14:18
Valid: false

45:8c:63:bb:51:04:7a:78:b5:bd:b8:98:63:d7:6d:e9:37:fc:f4:27
Signer

21/03/2018, 14:18
Valid: false

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 1.5MB - Virtual size: 1.5MB

.data
Size: 108KB - Virtual size: 151KB

.pdata
Size: 284KB - Virtual size: 283KB

text
Size: 3KB - Virtual size: 2KB

data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 7.6MB - Virtual size: 7.6MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

13:bf:1f:69:97:76:35:7f:f3:11:bb:9b:e3:9d:4d:92
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

5a:d7:ea:0f:48:85:b9:b0:3d:cc:7f:68:16:70:3e:89:67:4e:3d:2f:95:a6:89:73:18:ae:92:51:3b:a9:e1:39
Signer

21/03/2018, 14:18
Valid: false

56:fd:d6:79:ce:ae:ac:eb:7a:c9:48:65:67:3e:2b:c7:d9:00:13:7c
Signer

21/03/2018, 14:18
Valid: false