ae2974214caed91ed520d90d3c5926e5cd0c82244df6745acd87d0f979fed73b

Sharing

Copy URL Twitter E-mail

General

Target

ae2974214caed91ed520d90d3c5926e5cd0c82244df6745acd87d0f979fed73b
Size

4.4MB
MD5

0d7f56f21d5a1f9b0c125bdf8b8e67ad
SHA1

4105e2ec0f48a3ce12f9a0b2eeda7e0d7e3ba52c
SHA256

ae2974214caed91ed520d90d3c5926e5cd0c82244df6745acd87d0f979fed73b
SHA512

e73b4b7527cdfdf6e9862c3f2684cde5e1b614fdeff56799e600422dd9e1a40de07a3b9934a6ba815c2c66d4cc5099d145d53a7b7827715a0c4c664cf901f1b0
SSDEEP

98304:jDBAApiffyXp8ZXDD+G2yy3SGsSJVItdTjG6PxImKo88I79AkhpF:jVtiXyXOXDDAyyCGsaVAnGuWVNt5AkXF

Score

N/A

Malware Config

Signatures

Files

ae2974214caed91ed520d90d3c5926e5cd0c82244df6745acd87d0f979fed73b
.rar
稻壳阅读器_2.12.17_解压版/看前必读/失业君的逆袭.jpg
.jpg
稻壳阅读器_2.12.17_解压版/看前必读/看前必读.txt
稻壳阅读器_2.12.17_解压版/稻壳阅读器_2.12.17_解压版.rar
.rar
稻壳阅读器_2.12.17_Green/DocBox.exe
.exe windows x86

eb5f3a61dde09a5bfc0201303d8cd168

Code Sign

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/07/2020, 00:00

Not After

12/07/2023, 12:00

Subject

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c3:5d:f4:34:25:84:83:76:ef:21:95:0d:98:6f:85
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/07/2020, 00:00

Not After

12/07/2023, 12:00

Subject

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:33:ce:36:39:ca:05:f2:f3:59:0a:24:6c:90:f5:69:7a:1d:ce:30:ce:f0:20:92:f0:e9:ba:ec:4f:b8:53:cd
Signer

Actual PE Digest

04:33:ce:36:39:ca:05:f2:f3:59:0a:24:6c:90:f5:69:7a:1d:ce:30:ce:f0:20:92:f0:e9:ba:ec:4f:b8:53:cd

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

01/09/2022, 07:34
Valid: true

Chain 1

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

fd:0e:b5:7f:ff:63:72:83:f1:71:da:aa:be:97:49:3a:81:2f:01:ec
Signer

Actual PE Digest

fd:0e:b5:7f:ff:63:72:83:f1:71:da:aa:be:97:49:3a:81:2f:01:ec

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

01/09/2022, 07:34
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdiplus

GdipDrawRectangleI
GdipSetCompositingQuality
GdipStartPathFigure
GdipDeleteRegion
GdipFillEllipseI
GdipResetWorldTransform
GdipCreateFontFromDC
GdipCreatePath2
GdipClosePathFigure
GdipSetSolidFillColor
GdipGetPointCount
GdipIsVisiblePathPointI
GdipCreateRegionPath
GdipAddPathLineI
GdipCreateFromHWND
GdipSetPenWidth
GdipIsVisibleRectI
GdipTransformPointsI
GdipDeletePathIter
GdipPathIterRewind
GdipCreatePathIter
GdipGetPathData
GdipAddPathEllipseI
GdipCreateFontFromLogfontA
GdipPathIterNextMarkerPath
GdipSetPathMarker
GdipGetRegionHRgn
GdipDrawImageRectRectI
GdipDrawImageRectRect
GdipSaveImageToFile
GdipFillRectangle
GdipCreateBitmapFromHBITMAP
GdipDrawEllipse
GdipFillEllipse
GdipResetPath
GdipDrawImagePointRectI
GdipMeasureString
GdipSetPenEndCap
GdipDrawRectangle
GdipAddPathLine2I
GdipGetPixelOffsetMode
GdipDrawEllipseI
GdipSetPenStartCap
GdipCreateStringFormat
GdipFillRegion
GdipSetPenDashStyle
GdipFillRectanglesI
GdipDrawImageRect
GdipSetStringFormatTrimming
GdipSetPenColor
GdipGetImageGraphicsContext
GdipCreateRegionHrgn
GdipAddPathCurve
GdipStringFormatGetGenericTypographic
GdipSetStringFormatLineAlign
GdipAddPathEllipse
GdipAddPathLine
GdipGetClip
GdipSetClipRegion
GdipSetClipRectI
GdipCreateRegion
GdipGetFontHeight
GdipGetGenericFontFamilySansSerif
GdipCreateBitmapFromGdiDib
GdipGetDC
GdipReleaseDC
GdipDeleteMatrix
GdipSetPenMode
GdipGetPathWorldBoundsI
GdipClonePath
GdipTranslateMatrix
GdipSetPenMiterLimit
GdipCreateMatrix
GdipTransformPath
GdipCreateLineBrushFromRect
GdipGetLogFontW
GdipCreateBitmapFromGraphics
GdipDrawArc
GdipDrawLine
GdipAddPathRectanglesI
GdipSetStringFormatMeasurableCharacterRanges
GdipGetImageEncodersSize
GdipBitmapLockBits
GdipBitmapSetResolution
GdipGetStringFormatFlags
GdipCloneBitmapAreaI
GdipMeasureCharacterRanges
GdipGetRegionBounds
GdipScaleMatrix
GdipRotateMatrix
GdipBitmapUnlockBits
GdipGetImageEncoders
GdipSetPropertyItem
GdipGetImageHorizontalResolution
GdipGetFamilyName
GdipSetPenDashOffset
GdipSetPenDashArray
GdipInvertMatrix
GdipSetWorldTransform
GdipTransformMatrixPoints
GdipGetFamily
GdipSetInterpolationMode
GdipSetPageUnit
GdipSetTextRenderingHint
GdipSetStringFormatFlags
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipCreateBitmapFromScan0
GdipSetSmoothingMode
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipSetImageAttributesWrapMode
GdipImageSelectActiveFrame
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipGetPropertyItem
GdipDrawString
GdipCloneStringFormat
GdipCreatePen2
GdipStringFormatGetGenericDefault
GdipSetPenLineJoin
GdipCreateFont
GdipDeleteStringFormat
GdipDeleteFont
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipCreateBitmapFromStream
GdipDisposeImage
GdipCreateHBITMAPFromBitmap
GdipGetImageHeight
GdipDeleteBrush
GdipAlloc
GdipDrawImageRectI
GdipCreateSolidFill
GdipSetPixelOffsetMode
GdipFree
GdipCreateFromHDC
GdipRotateWorldTransform
GdipCloneBrush
GdipFillRectangleI
GdipDeleteGraphics
GdipSetCompositingMode
GdipGetImageWidth
GdipSetStringFormatAlign
GdipDrawLineI
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdipFillPath
GdipDrawPath
GdipWindingModeOutline
GdipDeletePen
GdipCreatePen1
GdipDrawImageI
GdipTranslateWorldTransform

shlwapi

StrCmpW
ord219
PathAppendW
PathIsNetworkPathW
SHDeleteValueW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathIsRelativeW
StrCmpLogicalW
StrStrW
StrStrIW

urlmon

CoInternetSetFeatureEnabled
CoInternetGetSession

psapi

GetModuleBaseNameW

kernel32

GetLogicalDrives
GlobalUnlock
MapViewOfFile
CreateFileMappingW
GetCurrentProcessId
ExitProcess
MoveFileExW
GlobalLock
FindResourceW
LoadResource
GlobalFree
GlobalAlloc
LockResource
UnmapViewOfFile
SetErrorMode
GetFullPathNameW
GetCommandLineW
SizeofResource
GetDriveTypeW
MoveFileW
MulDiv
GetTickCount
GetSystemTimeAsFileTime
CopyFileW
GetModuleHandleW
DeleteCriticalSection
LocalFree
GetLocalTime
CloseHandle
Process32FirstW
DeleteFileW
SetEvent
Process32NextW
GetLastError
FormatMessageW
WriteConsoleW
OpenProcess
Sleep
GetTimeFormatW
CreateThread
GlobalAddAtomW
GlobalDeleteAtom
CreateEventW
CreateToolhelp32Snapshot
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
GetCurrentProcess
EnterCriticalSection
OutputDebugStringA
WriteFile
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
ReadConsoleW
SetFilePointerEx
SetStdHandle
GetCurrentDirectoryW
GetConsoleMode
GetConsoleCP
CreateProcessA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
SetConsoleCtrlHandler
GetTimeZoneInformation
LoadLibraryExW
RtlUnwind
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetACP
GetExitCodeProcess
GetEnvironmentVariableW
CreateSemaphoreA
ReleaseSemaphore
FileTimeToDosDateTime
OpenThread
VirtualQuery
GetThreadContext
GetCurrentThread
GetModuleHandleA
ResumeThread
SuspendThread
Thread32First
Thread32Next
GetModuleFileNameA
ReadDirectoryChangesW
QueueUserAPC
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
GetFileTime
GetTempFileNameW
GetFileInformationByHandle
SetFileAttributesW
SetFileTime
RemoveDirectoryW
GetPrivateProfileIntW
GetShortPathNameW
GetLongPathNameW
WritePrivateProfileStringW
GetFileSizeEx
CreateDirectoryW
AllocConsole
VerifyVersionInfoW
CreateProcessW
VerSetConditionMask
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
GetLocaleInfoW
GetStdHandle
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetStartupInfoW
GetVolumePathNameW
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
FlushFileBuffers
FormatMessageA
WideCharToMultiByte
FreeLibrary
GetProcessHeap
GetFileSize
LockFileEx
CreateFileMappingA
GetProcAddress
UnlockFile
HeapCompact
LoadLibraryW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
GetFileAttributesW
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
GetDiskFreeSpaceW
InterlockedCompareExchange
TryEnterCriticalSection
ReadFile
AreFileApisANSI
OutputDebugStringW
GetDateFormatW
GlobalMemoryStatusEx
QueryPerformanceFrequency
GetUserDefaultUILanguage
FindNextFileW
FindFirstFileW
SetUnhandledExceptionFilter
Module32NextW
QueryPerformanceCounter
HeapDestroy
Module32FirstW
HeapAlloc
GetSystemInfo
HeapReAlloc
GetLocaleInfoA
GetSystemDirectoryW
GetVersionExW
GetEnvironmentVariableA
TerminateProcess
HeapFree
HeapCreate
CreateEventA
DecodePointer
RaiseException
GetCurrentThreadId
FileTimeToSystemTime
GetSystemTime
SetThreadExecutionState
FindClose
ResetEvent
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
GetWindowsDirectoryW
CreateFileW

user32

GetAncestor
InvalidateRect
UpdateWindow
GetParent
CharLowerBuffW
EnumDisplaySettingsW
PostQuitMessage
KillTimer
GetDlgItem
IsZoomed
GetClientRect
SetWindowLongW
EndDeferWindowPos
GetClassNameW
SetFocus
IsCharUpperW
SetMenu
MoveWindow
GetForegroundWindow
GetSysColor
GetMonitorInfoW
SetTimer
BeginDeferWindowPos
IsIconic
ShowWindow
GetSystemMetrics
EndDialog
SendMessageW
ScreenToClient
CreateWindowExW
EnumChildWindows
MonitorFromWindow
SetWindowPos
IsWindowVisible
GetDC
DestroyWindow
GetFocus
GetWindowRect
MapVirtualKeyW
PostMessageW
CallWindowProcW
ShowScrollBar
GetKeyState
DefWindowProcW
DeferWindowPos
GetWindowLongW
SetParent
LoadCursorW
FindWindowW
LoadIconW
TranslateMessage
TranslateAcceleratorW
DispatchMessageW
LoadAcceleratorsW
RegisterClassExW
FindWindowExW
AllowSetForegroundWindow
GetMessageW
GetWindowThreadProcessId
GetWindowTextW
IsWindow
ReleaseDC
DestroyMenu
GetPropW
RemovePropW
SetPropW
SetWindowTextW
AdjustWindowRectEx
MonitorFromRect
EnumDisplayMonitors
DdeCreateStringHandleW
DdeConnect
GetWindowInfo
DdeInitializeW
DdeUninitialize
DdeClientTransaction
DdeFreeDataHandle
CheckMenuItem
DdeDisconnect
DdeFreeStringHandle
SetForegroundWindow
SendMessageA
GetWindowPlacement
DefFrameProcW
DefDlgProcW
DefMDIChildProcW
GetWindowRgn
IsCharAlphaNumericW
RegisterClassW
FrameRect
DrawFocusRect
CopyImage
GetActiveWindow
MsgWaitForMultipleObjects
PeekMessageW
wsprintfW
wsprintfA
PostMessageA
CheckRadioButton
DialogBoxIndirectParamW
IsDlgButtonChecked
UnhookWindowsHookEx
SetLayeredWindowAttributes
SetWindowsHookExW
CheckDlgButton
GetDesktopWindow
DialogBoxParamW
MessageBoxW
IsWindowEnabled
IsRectEmpty
SetRect
GetMenuItemInfoW
ModifyMenuW
CheckMenuRadioItem
GetMenuItemID
GetMenu
InsertMenuItemW
GetMenuItemCount
SetMenuItemInfoW
RemoveMenu
AppendMenuW
CreateMenu
GetSystemMenu
SetMenuItemBitmaps
OffsetRect
SetMenuDefaultItem
GetWindowDC
DrawEdge
DrawFrameControl
GetMessageExtraInfo
CharLowerW
BringWindowToTop
EnableWindow
SetDlgItemTextW
SendDlgItemMessageW
GetCursor
TrackMouseEvent
ReleaseCapture
SetCapture
EmptyClipboard
CloseClipboard
GetCapture
OpenClipboard
UnpackDDElParam
IsWindowUnicode
ShowWindowAsync
ReuseDDElParam
GetWindowTextLengthW
DrawTextW
SetCursor
InsertMenuW
MapWindowPoints
RedrawWindow
InvalidateRgn
TrackPopupMenu
CreatePopupMenu
FillRect
PtInRect
GetMessagePos
EndPaint
BeginPaint
SetActiveWindow
SystemParametersInfoW
EnableMenuItem
ShowCaret
IsClipboardFormatAvailable
SetClipboardData
GetClipboardData
InflateRect
SetClassLongW
HideCaret
SetWindowRgn
GetListBoxInfo
GetScrollInfo
SetScrollInfo
GetCursorPos
GetUpdateRect
ValidateRect
ClientToScreen
GetAsyncKeyState
GetWindow

gdi32

LineTo
SetTextColor
GetTextExtentPoint32W
CreatePolygonRgn
SelectObject
CreateRectRgn
RoundRect
DeleteDC
CreateRoundRectRgn
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SetStretchBltMode
StretchBlt
SetWorldTransform
IntersectClipRect
GetObjectA
CombineRgn
PtInRegion
DeleteObject
GetStockObject
GetObjectW
CreatePen
MoveToEx
SetBkColor
CreateSolidBrush
FillRgn
CreateFontIndirectW
SetBkMode
SetBrushOrgEx
PatBlt
CreatePatternBrush
CreateBitmap
SetROP2
GetDIBColorTable
SetDIBColorTable
SetGraphicsMode
GetDIBits
SetDIBits
ExtTextOutW
CreateRectRgnIndirect
CreateDIBSection
SelectClipRgn
StartPage
AbortDoc
EndDoc
CreateDCW
GetDeviceCaps
SetMapMode
StartDocW
EndPage
EnumFontFamiliesExW
GetClipBox
SetViewportOrgEx
ExcludeClipRect
ExtSelectClipRgn
Rectangle
GetTextMetricsW

comdlg32

ChooseColorW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgExW
GetOpenFileNameW

advapi32

RegEnumKeyW
CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptVerifySignatureW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptSetKeyParam
CryptImportKey
CryptReleaseContext
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegSetKeySecurity
InitializeSecurityDescriptor
RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RevertToSelf
DuplicateTokenEx
AllocateAndInitializeSid
ImpersonateLoggedOnUser
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegCloseKey
FreeSid
CheckTokenMembership
GetTokenInformation

shell32

SHBindToParent
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
SHChangeNotify
ShellExecuteExW
DragQueryFileW
ShellExecuteW
SHGetFileInfoW
SHGetDesktopFolder
SHAddToRecentDocs
SHOpenFolderAndSelectItems
DragFinish
ord190
DragAcceptFiles

ole32

OleUninitialize
CreateStreamOnHGlobal
OleInitialize
OleCreate
OleSetContainedObject
CoTaskMemAlloc
StgCreateDocfile
CoCreateInstance
CoGetMalloc
ReleaseStgMedium
CoCreateGuid
CoTaskMemFree
CoUninitialize
CoInitialize
CoDisconnectObject

libdocbox

ofd_open_document_with_stream
ofd_bound_page_quick
ofd_run_page
hn_run_page
hn_bound_page_quick
hn_open_document
ddjvu_context_release
ddjvu_document_get_pagetext
ddjvu_page_get_type
ddjvu_message_peek
ddjvu_document_get_pageinfo_imp
miniexp_cadr
ddjvu_document_get_fileinfo_imp
crc32
ddjvu_page_create_by_pageno
ddjvu_message_pop
ddjvu_document_get_outline
ddjvu_job_status
miniexp_cddr
ddjvu_context_create
pdf_lookup_inherited_page_item
gzerror
gzseek
gzopen
gzclose
gzread
gztell
inflateEnd
inflate
inflateInit2_
fz_md5_final
fz_sha256_final
fz_sha256_update
fz_md5_update
fz_md5_init
fz_sha256_init
deflateInit2_
deflateEnd
deflate
WebPGetInfo
WebPDecodeBGRAInto
fz_convert_pixmap
fz_load_jpx
fz_device_rgb
fz_do_always
fz_open_dctd
fz_open_memory
fz_new_pixmap_with_data
fz_device_gray
fz_drop_colorspace
fz_do_try
fz_read
fz_push_try
fz_free_context
fz_var_imp
fz_close
fz_device_cmyk
fz_load_jpeg_info
fz_drop_pixmap
fz_do_catch
fz_throw_imp
fz_device_bgr
fz_new_context_imp
fz_clone_stream
fz_new_text_device
fz_new_draw_device
fz_end_page
fz_load_chapter_page
fz_scale_pixmap
fz_set_use_document_css
fz_load_outline
fz_bound_page
fz_keep_image
fz_drop_display_list
fz_keep_pixmap
fz_warn_imp
fz_new_text_page
fz_new_text_sheet
fz_run_display_list
fz_free_device
fz_rect_from_irect
fz_new_bbox_device
fz_count_chapter_pages
fz_invert_matrix
fz_transform_rect
fz_new_pixmap
fz_begin_page
epub_run_page
fz_clone_context
install_load_system_font_funcs
epub_layout_chapter
fz_new_list_device
fz_free_text_sheet
epub_page_is_layouted
fz_drop_image
fz_count_pages
fz_free
epub_open_document
fz_new_display_list
fz_free_page
fz_enable_device_hints
fz_copy_pixmap_rect
fz_round_rect
fz_transform_point
fz_clear_pixmap_with_value
fz_new_pixmap_from_image
fz_close_document
fz_new_pixmap_with_bbox
fz_count_chapters
fz_intersect_rect
fz_free_text_page
fz_new_buffer_from_shared_data
txt_run_page
fz_drop_buffer
txt_layout_chapter
txt_open_document_with_buffer
txt_page_is_layouted
gzopen_w
mobi_run_page
fz_new_image_from_buffer
mobi_layout_chapter
mobi_page_is_layouted
mobi_open_document_with_buffer
fz_strdup
fz_load_page
fz_new_link
fz_calloc
fz_free_outline
pdf_trailer
pdf_add_page
fz_fill_image
fz_new_image
pdf_close_document
pdf_write_document
fz_free_compressed_buffer
deflateInit_
fz_malloc
pdf_create_document
pdf_new_ref
pdf_drop_obj
pdf_insert_page
pdf_dict_getp
pdf_new_string
pdf_is_indirect
pdf_free_page
pdf_new_dict
pdf_page_write
fz_new_buffer
pdf_is_dict
fz_rethrow
pdf_dict_puts_drop
fz_closepath
fz_lineto
pdf_unmark_obj
fz_text_char_bbox
pdf_to_int
fz_scale
pdf_delete_annot
pdf_load_page_by_obj
pdf_run_page
pdf_xref_len
pdf_dict_gets
pdf_load_name_tree
fz_new_device
ofd_document_stream
pdf_count_pages
fz_free_link_dest
pdf_is_int
fz_free_text
fz_read_all
fz_free_path
caj_open_document_with_stream
fz_advance_glyph
pdf_insert_annot
pdf_crypt_version
fz_concat
pdf_parse_link_dest
pdf_array_push
pdf_free_annot
fz_tell
pdf_resolve_indirect
fz_drop_font
fz_new_stroke_state
pdf_mark_obj
pdf_create_annot
fz_fill_path
pdf_to_real
pdf_needs_password
fz_open_file_w
pdf_has_permission
fz_translate
pdf_to_str_len
fz_begin_group
pdf_lookup_dest
pdf_dict_put
fz_malloc_array
pdf_dict_getsa
fz_stroke_path
fz_rotate
fz_new_path
fz_curvetov
pdf_run_page_with_usage
pdf_copy_dict
pdf_load_document_annots
fz_moveto
pdf_array_get
pdf_crypt_key
pdf_to_rect
pdf_cache_object
pdf_to_str_buf
pdf_new_array
pdf_specifics
pdf_is_name
pdf_open_document_with_stream
fz_fill_text
pdf_is_array
fz_chartorune
fz_load_system_font
fz_seek
pdf_dict_get_key
fz_pixmap_bbox
fz_encode_character_with_fallback
pdf_to_num
pdf_obj_parent_num
fz_load_system_cjk_font
pdf_is_real
pdf_get_xref_entry
pdf_to_bool
pdf_to_name
pdf_keep_obj
fz_add_text
pdf_lex
fz_end_group
pdf_crypt_revision
pdf_js_supported
fz_keep_font
pdf_new_bool
pdf_dict_len
pdf_is_stream
pdf_run_annot
fz_open_buffer
fz_curveto
fz_drop_stroke_state
fz_new_stream
fz_pre_scale
pdf_array_len
fz_new_text
fz_pre_translate
pdf_to_gen
pdf_dict_get_val
pdf_authenticate_password
pdf_load_stream
pdf_bound_page
pdf_file_spec_to_str
pdf_to_ucs2_buf
fz_matrix_expansion
ybs_run_page
ybs_close_document
ybs_free_page
ybs_load_page
ybs_update_page
ybs_get_page
ybs_count_pages
ybs_get_fixed_document
ybs_bound_page
ybs_open_document
markdown_run_page
markdown_open_document
fz_load_links
xps_load_page
fz_xml_text
fz_free_xml
fz_xml_att
xps_free_part
fz_xml_down
xps_close_document
fz_xml_next
xps_load_outline
fz_parse_xml
xps_run_page
xps_bound_page
fz_xml_is_tag
xps_read_part
xps_resolve_url
fz_xml_tag
xps_lookup_link_target_obj
xps_count_pages
xps_open_document_with_stream
fz_atof
minilisp_finish
miniexp_caddr
ddjvu_document_create_by_data
ddjvu_format_release
miniexp_to_str
ddjvu_format_create
ddjvu_job_release
ddjvu_stream_close
ddjvu_document_get_pageanno
ddjvu_miniexp_release
ddjvu_document_get_pagenum
ddjvu_free
ddjvu_format_set_row_order
ddjvu_anno_get_hyperlinks
ddjvu_document_get_filenum
ddjvu_document_create_by_filename_utf8
ddjvu_page_render
ddjvu_document_job
ddjvu_page_set_rotation
miniexp_stringp
ddjvu_page_job
miniexp_symbol

comctl32

CreatePropertySheetPageW
ord413
ord410
ImageList_Draw
ord412
PropertySheetW
ord411
InitCommonControlsEx

msimg32

GradientFill

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetGetConnectedState

winhttp

WinHttpSetOption
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadData
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpenRequest
WinHttpQueryHeaders
WinHttpOpen
WinHttpWriteData
WinHttpReceiveResponse

iphlpapi

GetAdaptersInfo

winspool.drv

OpenPrinterW
GetPrinterW
DocumentPropertiesW
ClosePrinter
DeviceCapabilitiesW
EnumPrintersW
ord203

oleaut32

SysFreeString
VariantClear
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
VariantInit
SafeArrayCreateVector
SafeArrayPutElement
SysAllocString

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
稻壳阅读器_2.12.17_Green/DocBox.visualelementsmanifest.xml
稻壳阅读器_2.12.17_Green/Icons/largelogo.png
.png
稻壳阅读器_2.12.17_Green/Icons/smalllogo.png
.png
稻壳阅读器_2.12.17_Green/libdocbox.dll
.dll windows x86

f6efccea3ee350cdb2c8ea351e4926b1

Code Sign

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03/07/2020, 00:00

Not After

12/07/2023, 12:00

Subject

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c3:5d:f4:34:25:84:83:76:ef:21:95:0d:98:6f:85
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

08/07/2020, 00:00

Not After

12/07/2023, 12:00

Subject

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ce:20:f0:ec:7d:aa:8a:57:db:5f:00:ec:9e:30:07:0e:fe:e6:82:eb:d3:21:45:6c:db:33:68:65:0c:8d:78:69
Signer

Actual PE Digest

ce:20:f0:ec:7d:aa:8a:57:db:5f:00:ec:9e:30:07:0e:fe:e6:82:eb:d3:21:45:6c:db:33:68:65:0c:8d:78:69

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

01/09/2022, 06:36
Valid: true

Chain 1

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

8b:8b:a9:c3:5c:d9:90:2c:a5:bc:d8:88:6f:1a:f2:2a:17:c6:22:88
Signer

Actual PE Digest

8b:8b:a9:c3:5c:d9:90:2c:a5:bc:d8:88:6f:1a:f2:2a:17:c6:22:88

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Beijing Zhike Online Technology Co.\, Ltd.,O=Beijing Zhike Online Technology Co.\, Ltd.,ST=Beijing,C=CN

01/09/2022, 06:36
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetSystemTimeAsFileTime
EnumSystemLocalesW
FindClose
FindFirstFileExA
FindNextFileA
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WaitForSingleObjectEx
WriteConsoleW
EncodePointer
DecodePointer
CreateFileW
RaiseException
GetCurrentThreadId
GetCurrentProcessId
GetUserDefaultLCID
QueryPerformanceCounter
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement
InitializeCriticalSection
WaitForSingleObject
SetEvent
ResetEvent
InterlockedIncrement
CreateEventA
GetFullPathNameA
Sleep
GetTickCount
FindFirstFileW
GetFullPathNameW
lstrcpynW
GetWindowsDirectoryW
CreateEventW
ReadFile
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesExW
ReadConsoleW
SetEndOfFile
GetTimeZoneInformation

shell32

SHGetFolderPathW

ole32

CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize

Exports

Exports

LzmaDecode
WebPDecodeBGRAInto
WebPGetInfo
aes_crypt_cbc
aes_setkey_dec
aes_setkey_enc
ar_at_eof
ar_close
ar_close_archive
ar_entry_get_filetime
ar_entry_get_name
ar_entry_get_offset
ar_entry_get_size
ar_entry_uncompress
ar_get_global_comment
ar_open_7z_archive
ar_open_file
ar_open_file_w
ar_open_istream
ar_open_memory
ar_open_rar_archive
ar_open_tar_archive
ar_open_zip_archive
ar_parse_entry
ar_parse_entry_at
ar_parse_entry_for
ar_read
ar_seek
ar_skip
ar_tell
caj_open_document_with_stream
crc32
ddjvu_anno_get_hyperlinks
ddjvu_context_create
ddjvu_context_release
ddjvu_document_create_by_data
ddjvu_document_create_by_filename_utf8
ddjvu_document_get_fileinfo_imp
ddjvu_document_get_filenum
ddjvu_document_get_outline
ddjvu_document_get_pageanno
ddjvu_document_get_pageinfo_imp
ddjvu_document_get_pagenum
ddjvu_document_get_pagetext
ddjvu_document_job
ddjvu_format_create
ddjvu_format_release
ddjvu_format_set_row_order
ddjvu_free
ddjvu_job_release
ddjvu_job_status
ddjvu_message_peek
ddjvu_message_pop
ddjvu_message_wait
ddjvu_miniexp_release
ddjvu_page_create_by_pageno
ddjvu_page_get_type
ddjvu_page_job
ddjvu_page_render
ddjvu_page_set_rotation
ddjvu_stream_close
ddjvu_stream_write
deflate
deflateEnd
deflateInit2_
deflateInit_
epub_layout_chapter
epub_open_document
epub_page_is_layouted
epub_run_page
ft_error_string
fz_aa_level
fz_add_text
fz_adjust_rect_for_stroke
fz_advance_glyph
fz_alpha_from_gray
fz_analyze_text
fz_apply_transfer_function
fz_arc4_encrypt
fz_arc4_init
fz_atof
fz_atoi
fz_begin_group
fz_begin_mask
fz_begin_page
fz_begin_tile
fz_begin_tile_id
fz_bitmap_details
fz_blend_pixel
fz_blendmode_name
fz_bound_glyph
fz_bound_page
fz_bound_path
fz_bound_shade
fz_bound_text
fz_buffer_cat
fz_buffer_printf
fz_buffer_storage
fz_buffer_vprintf
fz_calloc
fz_calloc_no_throw
fz_caught
fz_caught_message
fz_chartorune
fz_cleanname
fz_clear_bitmap
fz_clear_pixmap
fz_clear_pixmap_rect_with_value
fz_clear_pixmap_with_value
fz_clip_image_mask
fz_clip_path
fz_clip_stroke_path
fz_clip_stroke_text
fz_clip_text
fz_clone_context
fz_clone_context_internal
fz_clone_path
fz_clone_stream
fz_clone_stroke_state
fz_clone_text
fz_close
fz_close_archive
fz_close_document
fz_close_output
fz_closepath
fz_colorspace_is_indexed
fz_compressed_buffer_size
fz_concat
fz_concat_push
fz_convert_color
fz_convert_location
fz_convert_pixmap
fz_copy_aa_context
fz_copy_pixmap_rect
fz_copy_selection
fz_count_archive_entries
fz_count_chapter_pages
fz_count_chapters
fz_count_pages
fz_currentpoint
fz_curveto
fz_curvetov
fz_curvetoy
fz_debug_tree
fz_debug_xml
fz_decode_indexed_tile
fz_decode_tile
fz_decomp_image_from_stream
fz_decouple_type3_font
fz_default_halftone
fz_detach_xml
fz_device_bgr
fz_device_cmyk
fz_device_gray
fz_device_rgb
fz_dirname
fz_disable_device_hints
fz_do_always
fz_do_catch
fz_do_try
fz_drop_bitmap
fz_drop_buffer
fz_drop_colorspace
fz_drop_colorspace_context
fz_drop_display_list
fz_drop_font
fz_drop_font_context
fz_drop_function
fz_drop_glyph
fz_drop_glyph_cache_context
fz_drop_halftone
fz_drop_image
fz_drop_link
fz_drop_pixmap
fz_drop_shade
fz_drop_storable
fz_drop_store_context
fz_drop_stroke_state
fz_drop_transfer_function
fz_dump_glyph_cache_stats
fz_empty_hash
fz_empty_store
fz_enable_device_hints
fz_encode_character
fz_encode_character_with_fallback
fz_end_group
fz_end_mask
fz_end_page
fz_end_tile
fz_eval_function
fz_expand_indexed_pixmap
fz_expand_rect
fz_fill_image
fz_fill_image_mask
fz_fill_path
fz_fill_shade
fz_fill_text
fz_fin_cached_color_converter
fz_find_item
fz_flush_warnings
fz_fopen_utf8
fz_free
fz_free_aa_context
fz_free_argv
fz_free_colorspace_imp
fz_free_compressed_buffer
fz_free_context
fz_free_device
fz_free_hash
fz_free_image
fz_free_jbig2_globals_imp
fz_free_link_dest
fz_free_outline
fz_free_page
fz_free_path
fz_free_pixmap_imp
fz_free_scale_cache
fz_free_shade_imp
fz_free_text
fz_free_text_page
fz_free_text_sheet
fz_free_tree
fz_free_xml
fz_ftoa
fz_function_size
fz_gamma_pixmap
fz_gen_id
fz_generate_transition
fz_getopt
fz_glyph_bbox
fz_glyph_bbox_no_ctx
fz_glyph_cacheable
fz_glyph_height
fz_glyph_width
fz_gridfit_matrix
fz_grow_buffer
fz_halftone_pixmap
fz_has_archive_entry
fz_hash_find
fz_hash_get_key
fz_hash_get_val
fz_hash_insert
fz_hash_insert_with_pos
fz_hash_len
fz_hash_remove
fz_hash_remove_fast
fz_highlight_selection
fz_highlight_text
fz_ignore_text
fz_image_get_pixmap
fz_include_point_in_rect
fz_init_cached_color_converter
fz_install_load_system_font_funcs
fz_intersect_irect
fz_intersect_rect
fz_invert_matrix
fz_invert_pixmap
fz_invert_pixmap_rect
fz_irect_from_rect
fz_is_rectilinear
fz_keep_bitmap
fz_keep_buffer
fz_keep_colorspace
fz_keep_colorspace_context
fz_keep_display_list
fz_keep_font
fz_keep_font_context
fz_keep_function
fz_keep_glyph
fz_keep_glyph_cache
fz_keep_halftone
fz_keep_image
fz_keep_link
fz_keep_pixmap
fz_keep_shade
fz_keep_storable
fz_keep_store_context
fz_keep_stream
fz_keep_stroke_state
fz_keep_transfer_function
fz_layout_document
fz_lineto
fz_list_archive_entry
fz_load_chapter_page
fz_load_jbig2_globals
fz_load_jpeg_info
fz_load_jpx
fz_load_jxr
fz_load_jxr_info
fz_load_links
fz_load_outline
fz_load_page
fz_load_png
fz_load_png_info
fz_load_system_cjk_font
fz_load_system_font
fz_load_tiff
fz_load_tiff_info
fz_load_tiff_subimage
fz_load_tiff_subimage_count
fz_lookup_blendmode
fz_lookup_color_converter
fz_lookup_device_colorspace
fz_malloc
fz_malloc_array
fz_malloc_array_no_throw
fz_malloc_no_throw
fz_matrix_expansion
fz_matrix_max_expansion
fz_md5_final
fz_md5_init
fz_md5_pixmap
fz_md5_update
fz_moveto
fz_new_aa_context
fz_new_bbox_device
fz_new_bitmap
fz_new_buffer
fz_new_buffer_from_data
fz_new_buffer_from_shared_data
fz_new_colorspace
fz_new_colorspace_context
fz_new_context_imp
fz_new_device
fz_new_display_list
fz_new_draw_device
fz_new_draw_device_type3
fz_new_draw_device_with_bbox
fz_new_font_context
fz_new_font_from_buffer
fz_new_font_from_file
fz_new_font_from_memory
fz_new_glyph_cache_context
fz_new_glyph_from_8bpp_data
fz_new_glyph_from_pixmap
fz_new_halftone
fz_new_hash_table
fz_new_image
fz_new_image_from_buffer
fz_new_image_from_data
fz_new_image_from_pixmap
fz_new_indexed_colorspace
fz_new_link
fz_new_list_device
fz_new_output_to_filename
fz_new_output_with_buffer
fz_new_output_with_file
fz_new_path
fz_new_pixmap
fz_new_pixmap_from_1bpp_data
fz_new_pixmap_from_8bpp_data
fz_new_pixmap_from_image
fz_new_pixmap_with_bbox
fz_new_pixmap_with_bbox_and_data
fz_new_pixmap_with_data
fz_new_png_from_image
fz_new_png_from_pixmap
fz_new_scale_cache
fz_new_store_context
fz_new_stream
fz_new_stroke_state
fz_new_stroke_state_with_dash_len
fz_new_text
fz_new_text_device
fz_new_text_page
fz_new_text_sheet
fz_new_trace_device
fz_new_type3_font
fz_normalize_vector
fz_open_a85d
fz_open_aesd
fz_open_ahxd
fz_open_arc4
fz_open_archive
fz_open_archive_entry
fz_open_archive_with_stream
fz_open_buffer
fz_open_compressed_buffer
fz_open_concat
fz_open_copy
fz_open_dctd
fz_open_directory
fz_open_faxd
fz_open_fd
fz_open_file
fz_open_file_w
fz_open_flated
fz_open_image_decomp_stream
fz_open_image_decomp_stream_from_buffer
fz_open_jbig2d
fz_open_leecher
fz_open_lzwd
fz_open_memory
fz_open_null
fz_open_predict
fz_open_rld
fz_outline_ft_glyph
fz_outline_glyph
fz_output_pam_band
fz_output_pam_header
fz_output_png
fz_output_png_band
fz_output_png_header
fz_output_png_trailer
fz_output_pnm_band
fz_output_pnm_header
fz_paint_shade
fz_parse_xml
fz_pixmap_bbox
fz_pixmap_bbox_no_ctx
fz_pixmap_colorspace
fz_pixmap_components
fz_pixmap_height
fz_pixmap_samples
fz_pixmap_set_resolution
fz_pixmap_size
fz_pixmap_width
fz_pop_clip
fz_pre_rotate
fz_pre_scale
fz_pre_shear
fz_pre_translate
fz_premultiply_pixmap
fz_prepare_t3_glyph
fz_print_outline
fz_print_outline_xml
fz_print_text
fz_print_text_page
fz_print_text_page_html
fz_print_text_page_xml
fz_print_text_sheet
fz_printf
fz_process_mesh
fz_purge_glyph_cache
fz_push_try
fz_putc
fz_puts
fz_read
fz_read_all
fz_read_archive_entry
fz_read_best
fz_read_file
fz_read_line
fz_rebind_archive
fz_rebind_device
fz_rebind_output
fz_rebind_stream
fz_rect_from_irect
fz_redirect_io_to_console
fz_remove_item
fz_render_ft_glyph
fz_render_ft_glyph_pixmap
fz_render_ft_stroked_glyph
fz_render_ft_stroked_glyph_pixmap
fz_render_glyph
fz_render_glyph_pixmap
fz_render_stroked_glyph
fz_render_stroked_glyph_pixmap
fz_render_t3_glyph
fz_render_t3_glyph_direct
fz_render_t3_glyph_pixmap
fz_resize_array
fz_resize_array_no_throw
fz_resize_buffer
fz_rethrow
fz_rethrow_if
fz_rethrow_message_imp
fz_rotate
fz_round_rect
fz_run_display_list
fz_run_t3_glyph
fz_runelen
fz_runetochar
fz_scale
fz_scale_pixmap
fz_scale_pixmap_cached
fz_search_text_page
fz_seek
fz_set_aa_level
fz_set_device_bgr
fz_set_device_cmyk
fz_set_device_gray
fz_set_device_rgb
fz_set_font_bbox
fz_set_use_document_css
fz_set_user_css
fz_set_user_line_height_scale
fz_sha256_final
fz_sha256_init
fz_sha256_update
fz_sha384_final
fz_sha384_init
fz_sha384_update
fz_sha512_final
fz_sha512_init
fz_sha512_update
fz_shear
fz_shrink_store
fz_snprintf
fz_store_item

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data:
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 213KB - Virtual size: 323KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

eb5f3a61dde09a5bfc0201303d8cd168

Code Sign

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

09:c3:5d:f4:34:25:84:83:76:ef:21:95:0d:98:6f:85Certificate

Extended Key Usages

Key Usages

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9dCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

04:33:ce:36:39:ca:05:f2:f3:59:0a:24:6c:90:f5:69:7a:1d:ce:30:ce:f0:20:92:f0:e9:ba:ec:4f:b8:53:cdSigner

Signature Validations

Verification

01/09/2022, 07:34 Valid: true

Chain 1

fd:0e:b5:7f:ff:63:72:83:f1:71:da:aa:be:97:49:3a:81:2f:01:ecSigner

Signature Validations

Verification

01/09/2022, 07:34 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

gdiplus

shlwapi

urlmon

psapi

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

libdocbox

comctl32

msimg32

version

wininet

winhttp

iphlpapi

winspool.drv

oleaut32

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 321KB - Virtual size: 320KB

.data Size: 53KB - Virtual size: 73KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 108KB - Virtual size: 107KB

f6efccea3ee350cdb2c8ea351e4926b1

Code Sign

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:c3:5d:f4:34:25:84:83:76:ef:21:95:0d:98:6f:85
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

04:33:ce:36:39:ca:05:f2:f3:59:0a:24:6c:90:f5:69:7a:1d:ce:30:ce:f0:20:92:f0:e9:ba:ec:4f:b8:53:cd
Signer

01/09/2022, 07:34
Valid: true

fd:0e:b5:7f:ff:63:72:83:f1:71:da:aa:be:97:49:3a:81:2f:01:ec
Signer

01/09/2022, 07:34
Valid: false

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 321KB - Virtual size: 320KB

.data
Size: 53KB - Virtual size: 73KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 108KB - Virtual size: 107KB

0b:8c:7b:25:56:ac:07:2c:77:13:de:2e:3e:0e:8c:24
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

09:c3:5d:f4:34:25:84:83:76:ef:21:95:0d:98:6f:85
Certificate

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ce:20:f0:ec:7d:aa:8a:57:db:5f:00:ec:9e:30:07:0e:fe:e6:82:eb:d3:21:45:6c:db:33:68:65:0c:8d:78:69
Signer

01/09/2022, 06:36
Valid: true

8b:8b:a9:c3:5c:d9:90:2c:a5:bc:d8:88:6f:1a:f2:2a:17:c6:22:88
Signer

01/09/2022, 06:36
Valid: false

.text
Size: 2.6MB - Virtual size: 2.6MB

.data:
Size: 733KB - Virtual size: 733KB

.rdata
Size: 2.6MB - Virtual size: 2.6MB

.data
Size: 213KB - Virtual size: 323KB

.gfids
Size: 512B - Virtual size: 288B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 87KB - Virtual size: 87KB