57df3d3c31bf62a3d09244ea9167572f084cc8ad94a13a11288c25d8063d105b

Sharing

Copy URL Twitter E-mail

General

Target

57df3d3c31bf62a3d09244ea9167572f084cc8ad94a13a11288c25d8063d105b
Size

2.2MB
MD5

d7673361082637d9a7caf77780ab0d85
SHA1

e53ace98756b37fa232831d61f20f8a471061303
SHA256

57df3d3c31bf62a3d09244ea9167572f084cc8ad94a13a11288c25d8063d105b
SHA512

b1704c321d36ebedd1ca64a1a281372f033a3cc4c3ea55ae5b726bc3ea3a5249f6e320ae5208902b87a5980ba1bee6e857f063a704930c25877b0a910870de05
SSDEEP

49152:pvcRPA3Oxk3X80y8FbnuMqg3e3Kds3OqMEr/A0TURh9H7gm:pv643H3X83CLywfdlV1

Score

9^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/VStart50/Files/Icons.dll	acprotect

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/VStart50/Files/Icons.dll	upx
static1/unpack001/VStart50/Plugins/EasyPanel/EasyPanel.exe	upx
static1/unpack001/VStart50/Plugins/LCDClock/LCDClock.exe	upx
static1/unpack001/VStart50/Plugins/SlideShow/SlideShow.exe	upx
static1/unpack001/VStart50/Plugins//.exe	upx
static1/unpack001/VStart50/UpDate.exe	upx
static1/unpack001/VStart50/vsEnFolder.exe	upx

Files

57df3d3c31bf62a3d09244ea9167572f084cc8ad94a13a11288c25d8063d105b
.zip
VStart50/Files/COMCTL32.OCX
.dll regsvr32 windows x86

c8cebbf034d8c6304701e5ec3fae70a4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

3a:e9:b1:64:12:e1:81:f2:31:c5:5b:ee:f2:50:5e:d1:a6:a5:30:9e
Signer

Actual PE Digest

3a:e9:b1:64:12:e1:81:f2:31:c5:5b:ee:f2:50:5e:d1:a6:a5:30:9e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

24/11/2022, 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

comctl32

ImageList_SetOverlayImage
ImageList_DrawEx
ImageList_GetIconSize
ImageList_SetBkColor
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Add
ImageList_AddMasked
ord16
ord17
ImageList_Draw
ImageList_Create
ImageList_Destroy
ImageList_Remove

kernel32

lstrcmpA
GetProcAddress
GlobalSize
CloseHandle
GetFileSize
ReadFile
lstrcmpiA
IsDBCSLeadByte
lstrcmpiW
LockResource
FindResourceA
LoadResource
GetWindowsDirectoryA
GetLastError
GetLocaleInfoA
OpenFile
MultiByteToWideChar
lstrcatA
DisableThreadLibraryCalls
GetVersion
GetProcessHeap
GetDateFormatA
GetLocalTime
GetTimeFormatA
GetModuleFileNameA
GetCurrentThreadId
LoadLibraryA
GlobalUnlock
GlobalAlloc
GlobalLock
CompareStringA
GlobalFree
GetVersionExA
lstrlenA
lstrcpyA
IsBadReadPtr
HeapReAlloc
lstrcpynA
IsBadWritePtr
InterlockedDecrement
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
HeapFree
InterlockedIncrement
HeapAlloc
lstrlenW
LeaveCriticalSection
EnterCriticalSection

user32

IsWindowVisible
EndPaint
BeginPaint
MoveWindow
CharUpperA
IntersectRect
MessageBeep
SetCursor
EndDialog
RedrawWindow
GetMessagePos
CreateAcceleratorTableA
VkKeyScanA
PeekMessageA
PeekMessageW
SetWindowRgn
RegisterWindowMessageA
RegisterClipboardFormatA
SetCursorPos
OffsetRect
EqualRect
IsChild
GetWindowTextA
SetCapture
GetCursorPos
ScreenToClient
PostMessageA
DrawEdge
GetSysColor
wsprintfA
FillRect
InflateRect
DrawTextA
GetWindowRect
MapVirtualKeyA
DestroyWindow
CreateWindowExA
GetSysColorBrush
GetParent
GetAsyncKeyState
SetWindowLongA
TranslateMessage
DispatchMessageA
IsWindowEnabled
GetActiveWindow
CreateDialogIndirectParamA
IsDialogMessageA
GetNextDlgTabItem
GetWindow
CharNextA
SetParent
InvalidateRect
UpdateWindow
UnregisterClassA
MessageBoxA
SetWindowsHookExA
SetTimer
KillTimer
CheckRadioButton
CallNextHookEx
SetActiveWindow
DestroyIcon
SetFocus
DrawIcon
UnionRect
DialogBoxParamA
PtInRect
LoadCursorA
GetWindowDC
SetRect
IsRectEmpty
GetDC
ReleaseDC
GetClipboardFormatNameA
ClientToScreen
PostMessageW
FrameRect
GetClientRect
CallWindowProcA
GetKeyState
GetCapture
ReleaseCapture
GetClassInfoA
RegisterClassA
LoadIconA
GetSystemMetrics
CopyImage
MapDialogRect
GetWindowLongA
SetWindowPos
GetFocus
EnableWindow
GetDlgItemTextA
SetDlgItemTextA
GetDlgItem
SetDlgItemInt
GetDlgItemInt
IsDlgButtonChecked
SendDlgItemMessageA
CheckDlgButton
LoadStringA
DefWindowProcA
SendMessageA
ShowWindow
WinHelpA
UnhookWindowsHookEx

ole32

CreateStreamOnHGlobal
RevokeDragDrop
CreateOleAdviseHolder
RegisterDragDrop
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
DoDragDrop
ReleaseStgMedium
OleLoadFromStream
OleSaveToStream

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegOpenKeyA
RegQueryValueA
RegEnumKeyExA
RegCloseKey

oleaut32

SafeArrayPutElement
SafeArrayGetElement
SafeArrayRedim
SafeArrayGetUBound
SafeArrayCreate
SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayAccessData
VariantCopy
GetErrorInfo
OleCreateFontIndirect
CreateErrorInfo
SetErrorInfo
OleCreatePropertyFrame
LoadTypeLibEx
UnRegisterTypeLi
LoadRegTypeLi
RegisterTypeLi
OleLoadPicture
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
OleCreatePictureIndirect
VariantCopyInd
OleTranslateColor
VariantChangeType
SysFreeString
SysStringLen
VariantClear
SysAllocString
VariantInit
SafeArrayCopy

comdlg32

GetOpenFileNameA

gdi32

GetNearestColor
CreatePalette
LPtoDP
GetWindowExtEx
GetBitmapBits
TextOutA
CreateDIBitmap
RealizePalette
GetViewportExtEx
SelectPalette
GetPaletteEntries
GetDIBits
CopyEnhMetaFileA
CreateICA
CopyMetaFileA
StretchBlt
Rectangle
GetObjectA
SetBkColor
CreateDCA
CreateRectRgn
SetViewportOrgEx
SetWindowOrgEx
DeleteObject
SetWindowExtEx
SetMapMode
SetViewportExtEx
CreateSolidBrush
GetDeviceCaps
SelectObject
ExcludeClipRect
GetClipRgn
SelectClipRgn
GetClipBox
DeleteDC
CreateRectRgnIndirect
CreateCompatibleDC
PatBlt
CreateCompatibleBitmap
SetBkMode
SetTextColor
CreateBitmap
GetStockObject
GetTextExtentPoint32A

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 331KB - Virtual size: 330KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Files/Change.wav
VStart50/Files/City.txt
VStart50/Files/Config.bak
VStart50/Files/Config.ini
VStart50/Files/CoreAudio.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Files/CoreAudio.tlb
VStart50/Files/CoreAudioApi.dll
.dll windows x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Files/Find.ico
VStart50/Files/Icons.dll
.dll regsvr32 windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

UPX0
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/Files/LastWeather.htm
.xml
VStart50/Files/MSWINSCK.OCX
.dll regsvr32 windows x86

fcc40667ac22e0c598518006de958259

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc
Signer

Actual PE Digest

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

24/11/2022, 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

wsock32

accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send

kernel32

WideCharToMultiByte
GetVersion
GetProcAddress
GetModuleFileNameA
InitializeCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
IsBadWritePtr
DisableThreadLibraryCalls
lstrlenW
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetTickCount
MultiByteToWideChar
SetLastError
GetLocaleInfoA
DeleteCriticalSection
FreeLibrary
lstrcmpA
InterlockedDecrement
GetFileAttributesA
GetWindowsDirectoryA
LoadLibraryA
GetLastError
InterlockedIncrement
lstrcmpiA
FindResourceA
LockResource
LoadResource
HeapReAlloc

user32

EndDialog
DrawEdge
DialogBoxParamA
LoadCursorA
MessageBoxA
GetActiveWindow
GetDC
CharNextA
ReleaseDC
SetParent
GetWindowRect
ShowWindow
WinHelpA
IsDialogMessageA
GetWindow
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
SetWindowPos
LoadBitmapA
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
GetSystemMetrics
GetDlgItemTextA
ClientToScreen
OffsetRect
EqualRect
IntersectRect
SetWindowRgn
PtInRect
MessageBeep
LoadStringA
IsWindow
CreateDialogIndirectParamA
GetParent
SetDlgItemTextA
SendMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow
SetWindowLongA
KillTimer
SetTimer
UnregisterClassA
RegisterClassA
PeekMessageA
PostMessageA
SendDlgItemMessageA
GetDlgItemInt
SetDlgItemInt
SetFocus
MoveWindow
CreateWindowExA
wsprintfA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder

advapi32

RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

oleaut32

VariantChangeType
SysAllocStringLen
SysAllocString
SafeArrayRedim
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
OleCreatePropertyFrame
LoadRegTypeLi
SetErrorInfo
SysFreeString
CreateErrorInfo
GetErrorInfo
SafeArrayUnaccessData
SafeArrayDestroy
VariantClear
SysAllocStringByteLen
SafeArrayCreate
SysStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
VariantInit
SafeArrayAccessData
SafeArrayGetDim

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
DeleteDC
DeleteObject
GetObjectA
LPtoDP
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
CreateDCA
BitBlt
SelectObject

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Files/New.vbak
VStart50/Files/POPSmtp.ini
VStart50/Files/Province.txt
VStart50/Files/RegAsm.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Files/Start.wav
VStart50/Files/SysLink.vss
VStart50/Files/Tray98.ico
VStart50/Files/TrayXP.ico
VStart50/Files/go.htm
.html .js
VStart50/Files/msg.wav
VStart50/Files/vb6chs.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Icons/PassWord.ico
VStart50/Icons/Small/ACDSee.ico
VStart50/Icons/Small/Download.ico
VStart50/Icons/Small/Favorites.ico
VStart50/Icons/Small/Folder.ico
VStart50/Icons/Small/Green.ico
VStart50/Icons/Small/Home.ico
VStart50/Icons/Small/ICQ.ico
VStart50/Icons/Small/ICQ2.ico
VStart50/Icons/Small/IE.ico
VStart50/Icons/Small/Laptop.ico
VStart50/Icons/Small/MSN.ico
VStart50/Icons/Small/Nero.ico
VStart50/Icons/Small/New.ico
VStart50/Icons/Small/New2.ico
VStart50/Icons/Small/Orange.ico
VStart50/Icons/Small/PassWord.ico
VStart50/Icons/Small/Screen.ico
VStart50/Icons/Small/ShortCut.ico
VStart50/Icons/Small/Strawberry.ico
VStart50/Icons/Small/System.ico
VStart50/Icons/Small/System/CDRom.ico
VStart50/Icons/Small/System/ControlPanel.ico
VStart50/Icons/Small/System/DeskTop.ico
VStart50/Icons/Small/System/Hangup.ico
VStart50/Icons/Small/System/KillProgram.ico
VStart50/Icons/Small/System/LockMe.ico
VStart50/Icons/Small/System/LogOut.ico
VStart50/Icons/Small/System/MMSYS.ico
VStart50/Icons/Small/System/Monitor.ico
VStart50/Icons/Small/System/Mute.ico
VStart50/Icons/Small/System/MyDocument.ico
VStart50/Icons/Small/System/NetWork.ico
VStart50/Icons/Small/System/Printer.ico
VStart50/Icons/Small/System/Program.ico
VStart50/Icons/Small/System/Rasphone.ico
VStart50/Icons/Small/System/ReBoot.ico
VStart50/Icons/Small/System/Recycle.ico
VStart50/Icons/Small/System/ScreenSavers.ico
VStart50/Icons/Small/System/ShutDown.ico
VStart50/Icons/Small/System/Suspend.ico
VStart50/Icons/Small/System/TaskBar.ico
VStart50/Icons/Small/System/access.ico
VStart50/Icons/Small/System/appwiz.ico
VStart50/Icons/Small/System/desk.ico
VStart50/Icons/Small/System/hdwwiz.ico
VStart50/Icons/Small/System/inetcpl.ico
VStart50/Icons/Small/System/intl.ico
VStart50/Icons/Small/System/joy.ico
VStart50/Icons/Small/System/keyboard.ico
VStart50/Icons/Small/System/mouse.ico
VStart50/Icons/Small/System/nusrmgr.ico
VStart50/Icons/Small/System/powercfg.ico
VStart50/Icons/Small/System/sysdm.ico
VStart50/Icons/Small/System/telephon.ico
VStart50/Icons/Small/System/timedate.ico
VStart50/Icons/Small/TrayStart.ico
VStart50/Icons/Small/VStart.ico
VStart50/Icons/Small/url.ico
VStart50/Icons/Small/׬.ico
VStart50/Icons/Small/ʼǱ.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/ھ.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/.ico
VStart50/Icons/Small/û.ico
VStart50/Icons/Small/ʼ.ico
VStart50/Icons/Small/Ϸ.ico
VStart50/Icons/Small/Ϸ.ico
VStart50/Icons/Small/.ico
VStart50/Icons/System/CDRom.ico
VStart50/Icons/System/ControlPanel.ico
VStart50/Icons/System/DeskTop.ico
VStart50/Icons/System/Hangup.ico
VStart50/Icons/System/KillProgram.ico
VStart50/Icons/System/LockMe.ico
VStart50/Icons/System/LogOut.ico
VStart50/Icons/System/MMSYS.ico
VStart50/Icons/System/Monitor.ico
VStart50/Icons/System/Mute.ico
VStart50/Icons/System/MyDocument.ico
VStart50/Icons/System/NetWork.ico
VStart50/Icons/System/Printer.ico
VStart50/Icons/System/Program.ico
VStart50/Icons/System/Rasphone.ico
VStart50/Icons/System/ReBoot.ico
VStart50/Icons/System/Recycle.ico
VStart50/Icons/System/ScreenSavers.ico
VStart50/Icons/System/ShutDown.ico
VStart50/Icons/System/Suspend.ico
VStart50/Icons/System/TaskBar.ico
VStart50/Icons/System/access.ico
VStart50/Icons/System/appwiz.ico
VStart50/Icons/System/desk.ico
VStart50/Icons/System/hdwwiz.ico
VStart50/Icons/System/inetcpl.ico
VStart50/Icons/System/intl.ico
VStart50/Icons/System/joy.ico
VStart50/Icons/System/keyboard.ico
VStart50/Icons/System/mouse.ico
VStart50/Icons/System/nusrmgr.ico
VStart50/Icons/System/powercfg.ico
VStart50/Icons/System/sysdm.ico
VStart50/Icons/System/telephon.ico
VStart50/Icons/System/timedate.ico
VStart50/Icons/VStart.ico
VStart50/Icons/nIcon/0.ico
VStart50/Icons/nIcon/1.ico
VStart50/Icons/nIcon/2.ico
VStart50/Icons/nIcon/root.ico
VStart50/Icons/url.ico
VStart50/Icons/wIcon/0.png
.png
VStart50/Icons/wIcon/1.png
.png
VStart50/Icons/wIcon/10.png
.png
VStart50/Icons/wIcon/11.png
.png
VStart50/Icons/wIcon/12.png
.png
VStart50/Icons/wIcon/13.png
.png
VStart50/Icons/wIcon/14.png
.png
VStart50/Icons/wIcon/15.png
.png
VStart50/Icons/wIcon/16.png
.png
VStart50/Icons/wIcon/17.png
.png
VStart50/Icons/wIcon/18.png
.png
VStart50/Icons/wIcon/19.png
.png
VStart50/Icons/wIcon/2.png
.png
VStart50/Icons/wIcon/20.png
.png
VStart50/Icons/wIcon/21.png
.png
VStart50/Icons/wIcon/22.png
.png
VStart50/Icons/wIcon/23.png
.png
VStart50/Icons/wIcon/24.png
.png
VStart50/Icons/wIcon/25.png
.png
VStart50/Icons/wIcon/26.png
.png
VStart50/Icons/wIcon/27.png
.png
VStart50/Icons/wIcon/28.png
.png
VStart50/Icons/wIcon/29.png
.png
VStart50/Icons/wIcon/3.png
.png
VStart50/Icons/wIcon/30.png
.png
VStart50/Icons/wIcon/31.png
.png
VStart50/Icons/wIcon/4.png
.png
VStart50/Icons/wIcon/5.png
.png
VStart50/Icons/wIcon/6.png
.png
VStart50/Icons/wIcon/7.png
.png
VStart50/Icons/wIcon/8.png
.png
VStart50/Icons/wIcon/9.png
.png
VStart50/Icons/wIcon/baoxue.ico
VStart50/Icons/wIcon/baoyu.ico
VStart50/Icons/wIcon/daxue.ico
VStart50/Icons/wIcon/dayu.ico
VStart50/Icons/wIcon/duoyun.ico
VStart50/Icons/wIcon/leizhenyu.ico
VStart50/Icons/wIcon/longjuanfeng.ico
VStart50/Icons/wIcon/nothing.png
.png
VStart50/Icons/wIcon/other.ico
VStart50/Icons/wIcon/qing.ico
VStart50/Icons/wIcon/wu.ico
VStart50/Icons/wIcon/xiaoxue.ico
VStart50/Icons/wIcon/xiaoyu.ico
VStart50/Icons/wIcon/yin.ico
VStart50/Icons/wIcon/zhenyu.ico
VStart50/Icons/wIcon/zhongxue.ico
VStart50/Icons/wIcon/zhongyu.ico
VStart50/Plugins/EasyPanel/EasyPanel.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 224KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 67KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/Plugins/EasyPanel/Main1.ico
VStart50/Plugins/EasyPanel/Main2.ico
VStart50/Plugins/EasyPanel/New.bak
.rtf .bak
VStart50/Plugins/EasyPanel/RICHTX32.OCX
.dll regsvr32 windows x86

aaca01ab2cd35af160b8025e9dcfad9f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:be:da:cb:6f:7c:07:ce:80:06:10:c2:9a:0c:17:6f:0c:b4:42:44
Signer

Actual PE Digest

c6:be:da:cb:6f:7c:07:ce:80:06:10:c2:9a:0c:17:6f:0c:b4:42:44

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

24/11/2022, 14:54
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

shell32

DragAcceptFiles
DragQueryFileA
DragFinish

oledlg

ord1

kernel32

GlobalUnlock
GetVersionExA
GlobalSize
GlobalLock
FindResourceA
GlobalAlloc
GlobalFree
GetLocaleInfoA
LoadResource
LockResource
GetModuleFileNameA
GetWindowsDirectoryA
HeapReAlloc
GetFileAttributesA
lstrcatA
lstrcpynA
DisableThreadLibraryCalls
GetProcAddress
GetVersion
GetAtomNameA
FindAtomA
AddAtomA
IsBadWritePtr
DeleteAtom
InterlockedIncrement
FreeLibrary
LoadLibraryA
InterlockedDecrement
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
WriteFile
GetLastError
ReadFile
LeaveCriticalSection
CreateFileA
lstrcmpA
lstrcpyA
HeapAlloc
lstrlenA
HeapFree
WideCharToMultiByte
lstrlenW
SetFilePointer
MultiByteToWideChar
IsDBCSLeadByte
CloseHandle
lstrcmpiA

user32

SetCursorPos
ScreenToClient
GetClipboardFormatNameA
PeekMessageW
PostMessageW
PeekMessageA
RegisterWindowMessageA
IsDlgButtonChecked
SetDlgItemInt
SetDlgItemTextA
CheckDlgButton
ReleaseCapture
DefWindowProcA
LoadCursorA
SetCursor
CreateDialogIndirectParamA
MapWindowPoints
FillRect
GetDlgItemTextA
GetClientRect
InvalidateRect
ValidateRect
SetRect
GetSysColor
InflateRect
GetClassInfoA
TrackPopupMenu
GetWindow
GetWindowTextA
CharNextA
MessageBoxA
SendDlgItemMessageA
GetDlgItem
PostMessageA
IsChild
TranslateMessage
DispatchMessageA
IsWindowEnabled
GetNextDlgTabItem
IsDialogMessageA
WinHelpA
BeginPaint
MoveWindow
SetFocus
IsWindowVisible
EndPaint
SetParent
ShowWindow
EnableMenuItem
DeleteMenu
EqualRect
SetWindowRgn
IntersectRect
GetWindowRect
OffsetRect
GetDlgItemInt
GetActiveWindow
SetWindowLongA
SetWindowPos
LoadMenuA
UnregisterClassA
DestroyWindow
DestroyMenu
GetSubMenu
RemoveMenu
GetParent
GetMenuItemCount
GetFocus
IsWindow
WindowFromDC
RegisterClassA
LoadStringA
RegisterClipboardFormatA
GetCapture
GetCursorPos
EnableWindow
EndDialog
wsprintfA
GetKeyState
MessageBeep
CallWindowProcA
GetDC
GetSystemMetrics
ReleaseDC
UpdateWindow
SendMessageA
DialogBoxParamA
GetWindowLongA
CreateWindowExA
ClientToScreen
PtInRect

ole32

DoDragDrop
RegisterDragDrop
CreateOleAdviseHolder
OleCreateFromFile
CLSIDFromProgID
OleCreate
OleSetContainedObject
StringFromCLSID
OleGetIconOfClass
CoGetMalloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleSaveToStream
OleLoadFromStream
RevokeDragDrop
CoTaskMemRealloc
ReleaseStgMedium
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

advapi32

RegEnumKeyExA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA
RegDeleteKeyA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA

oleaut32

SafeArrayGetElement
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayGetLBound
VariantCopyInd
VariantCopy
SafeArrayUnaccessData
SetErrorInfo
OleCreatePropertyFrame
CreateErrorInfo
UnRegisterTypeLi
LoadTypeLi
LoadTypeLibEx
SafeArrayCreate
SafeArrayPutElement
RegisterTypeLi
OleCreatePictureIndirect
LoadRegTypeLi
GetErrorInfo
OleCreateFontIndirect
SysAllocStringLen
OleLoadPicture
OleTranslateColor
SysStringLen
SysFreeString
VariantChangeType
VariantClear
SysAllocString
VariantInit
SafeArrayCopy

comdlg32

GetOpenFileNameA
CommDlgExtendedError

gdi32

GetNearestColor
CreateSolidBrush
DeleteObject
EnumFontFamiliesExA
CreatePalette
GetBitmapBits
StretchBlt
GetObjectA
SelectPalette
CreateDIBitmap
GetDIBits
GetPaletteEntries
RealizePalette
CreateBitmap
CopyEnhMetaFileA
GetStockObject
CreateDCA
LPtoDP
CopyMetaFileA
GetViewportExtEx
CreateRectRgnIndirect
GetWindowExtEx
GetClipBox
SetWindowExtEx
SetBkColor
SelectObject
CreateCompatibleBitmap
SetViewportExtEx
DeleteDC
EndDoc
PatBlt
StartPage
StartDocA
EndPage
SetWindowOrgEx
SetViewportOrgEx
DPtoLP
CreateCompatibleDC
GetMapMode
CreateICA
GetObjectType
SetMapMode
GetDeviceCaps

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
VBFrameworkMapClassObject

Sections

.text
Size: 116KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VStart50/Plugins/EasyPanel/Setup.ini
VStart50/Plugins/EasyPanel/explain.ini
VStart50/Plugins/LCDClock/LCDClock.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 132KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 31KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/Plugins/LCDClock/Main1.ico
VStart50/Plugins/LCDClock/Main2.ico
VStart50/Plugins/LCDClock/explain.ini
VStart50/Plugins/MyWeather/Main1.ico
VStart50/Plugins/MyWeather/Main2.ico
VStart50/Plugins/MyWeather/MyWeather.exe
.exe windows x86

c63675d802018c8af6854ab96037ab85

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryVar
__vbaAryDestruct
ord592
ord593
__vbaExitProc
ord300
ord594
ord301
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaFpR4
ord306
__vbaBoolVar
ord520
ord307
ord309
__vbaVarTstLt
_CIsin
__vbaErase
ord631
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaPutOwner4
__vbaPrintObj
__vbaI2I4
DllFunctionCall
__vbaFpUI1
__vbaCastObjVar
__vbaLbound
__vbaRedimPreserve
ord566
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
__vbaRedim
EVENT_SINK_Release
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord607
__vbaVarDiv
ord608
__vbaFPException
ord717
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaI2Var
ord644
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaVar2Vec
ord648
ord570
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
ord573
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaI4Var
__vbaAryLock
__vbaVarAdd
ord612
__vbaStrToAnsi
__vbaVarDup
__vbaStrComp
__vbaFpI4
ord616
ord617
_CIatan
ord618
__vbaStrMove
__vbaAryCopy
__vbaCastObj
_allmul
__vbaLateIdSt
_CItan
__vbaAryUnlock
_CIexp
__vbaMidStmtBstr
__vbaFreeObj
__vbaFreeStr

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VStart50/Plugins/MyWeather/Setup.ini
VStart50/Plugins/MyWeather/explain.ini
VStart50/Plugins/SlideShow/Main1.ico
VStart50/Plugins/SlideShow/Main2.ico
VStart50/Plugins/SlideShow/SlideShow.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 34KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/Plugins/SlideShow/explain.ini
VStart50/Plugins//Main1.ico
VStart50/Plugins//Main2.ico
VStart50/Plugins//explain.ini
VStart50/Plugins//.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 136KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/Readme.txt
VStart50/Skin/LiveMessenger/Bar.bmp
VStart50/Skin/LiveMessenger/C_Down.ico
VStart50/Skin/LiveMessenger/C_Move.ico
VStart50/Skin/LiveMessenger/C_Normal.ico
VStart50/Skin/LiveMessenger/Close_Down.bmp
VStart50/Skin/LiveMessenger/Close_Move.bmp
VStart50/Skin/LiveMessenger/Close_Normal.bmp
VStart50/Skin/LiveMessenger/MenuCheck.ico
VStart50/Skin/LiveMessenger/MenuLeft.bmp
VStart50/Skin/LiveMessenger/Min_Down.bmp
VStart50/Skin/LiveMessenger/Min_Move.bmp
VStart50/Skin/LiveMessenger/Min_Normal.bmp
VStart50/Skin/LiveMessenger/S_Down.bmp
VStart50/Skin/LiveMessenger/S_Move.bmp
VStart50/Skin/LiveMessenger/S_Normal.bmp
VStart50/Skin/LiveMessenger/Scroll.bmp
VStart50/Skin/LiveMessenger/Setup.ini
VStart50/Skin/LiveMessenger/Skin-1.bmp
VStart50/Skin/LiveMessenger/Skin-2.bmp
VStart50/Skin/LiveMessenger/Skin-3.bmp
VStart50/Skin/LiveMessenger/Skin-4.bmp
VStart50/Skin/LiveMessenger/Skin-5.bmp
VStart50/Skin/LiveMessenger/Skin-6.bmp
VStart50/Skin/LiveMessenger/Skin-7.bmp
VStart50/Skin/LiveMessenger/Skin-8.bmp
VStart50/Skin/LiveMessenger/Skin_Down.bmp
VStart50/Skin/LiveMessenger/Skin_Move.bmp
VStart50/Skin/LiveMessenger/Skin_Normal.bmp
VStart50/Skin/LiveMessenger/UpDown.bmp
VStart50/Skin/LiveMessenger/bottom.bmp
VStart50/Skin/LiveMessenger/button1_Normal.ico
VStart50/Skin/LiveMessenger/button2_Normal.ico
VStart50/Skin/LiveMessenger/button3_Normal.ico
VStart50/Skin/LiveMessenger/button4_Normal.ico
VStart50/Skin/LiveMessenger/button5_Normal.ico
VStart50/Skin/LiveMessenger/button7_Normal.ico
VStart50/Skin/LiveMessenger/button9_Normal.ico
VStart50/Skin/QQ2009/Bar.bmp
VStart50/Skin/QQ2009/C_Down.ico
VStart50/Skin/QQ2009/C_Move.ico
VStart50/Skin/QQ2009/C_Normal.ico
VStart50/Skin/QQ2009/Close_Down.bmp
VStart50/Skin/QQ2009/Close_Move.bmp
VStart50/Skin/QQ2009/Close_Normal.bmp
VStart50/Skin/QQ2009/MenuCheck.ico
VStart50/Skin/QQ2009/MenuLeft.bmp
VStart50/Skin/QQ2009/Min_Down.bmp
VStart50/Skin/QQ2009/Min_Move.bmp
VStart50/Skin/QQ2009/Min_Normal.bmp
VStart50/Skin/QQ2009/S_Down.bmp
VStart50/Skin/QQ2009/S_Move.bmp
VStart50/Skin/QQ2009/S_Normal.bmp
VStart50/Skin/QQ2009/Scroll.bmp
VStart50/Skin/QQ2009/SearchButton_Down.bmp
VStart50/Skin/QQ2009/SearchButton_Move.bmp
VStart50/Skin/QQ2009/SearchButton_Normal.bmp
VStart50/Skin/QQ2009/Setup.ini
VStart50/Skin/QQ2009/Skin-1.bmp
VStart50/Skin/QQ2009/Skin-2.bmp
VStart50/Skin/QQ2009/Skin-3.bmp
VStart50/Skin/QQ2009/Skin-4.bmp
VStart50/Skin/QQ2009/Skin-5.bmp
VStart50/Skin/QQ2009/Skin-6.bmp
VStart50/Skin/QQ2009/Skin-7.bmp
VStart50/Skin/QQ2009/Skin-8.bmp
VStart50/Skin/QQ2009/Skin_Down.bmp
VStart50/Skin/QQ2009/Skin_Move.bmp
VStart50/Skin/QQ2009/Skin_Normal.bmp
VStart50/Skin/QQ2009/button10_Normal.ico
VStart50/Skin/QQ2009/button1_Normal.ico
VStart50/Skin/QQ2009/button2_Normal.ico
VStart50/Skin/QQ2009/button3_Normal.ico
VStart50/Skin/QQ2009/button4_Normal.ico
VStart50/Skin/QQ2009/button5_Normal.ICO
VStart50/Skin/QQ2009/button6_Normal.ico
VStart50/Skin/QQ2009/button7_Down.ico
VStart50/Skin/QQ2009/button7_Move.ico
VStart50/Skin/QQ2009/button7_Normal.ico
VStart50/Skin/QQ2009/button8_Normal.ICO
VStart50/Skin/QQ2009/button9_Normal.ico
VStart50/Skin/QQ2009/pre.gif
VStart50/Skin/QQ2009/pre.txt
VStart50/Skin/QQ2009/updown.bmp
VStart50/Skin/TM2008/Bar.bmp
VStart50/Skin/TM2008/C_Down.ico
VStart50/Skin/TM2008/C_Move.ico
VStart50/Skin/TM2008/C_Normal.ico
VStart50/Skin/TM2008/Close_Down.bmp
VStart50/Skin/TM2008/Close_Move.bmp
VStart50/Skin/TM2008/Close_Normal.bmp
VStart50/Skin/TM2008/MenuCheck.ico
VStart50/Skin/TM2008/MenuLeft.bmp
VStart50/Skin/TM2008/Min_Down.bmp
VStart50/Skin/TM2008/Min_Move.bmp
VStart50/Skin/TM2008/Min_Normal.bmp
VStart50/Skin/TM2008/S_Down.bmp
VStart50/Skin/TM2008/S_Move.bmp
VStart50/Skin/TM2008/S_Normal.bmp
VStart50/Skin/TM2008/Scroll.bmp
VStart50/Skin/TM2008/SearchButton_Down.bmp
VStart50/Skin/TM2008/SearchButton_Move.bmp
VStart50/Skin/TM2008/SearchButton_Normal.bmp
VStart50/Skin/TM2008/Setup.ini
VStart50/Skin/TM2008/Skin-1.bmp
VStart50/Skin/TM2008/Skin-2.bmp
VStart50/Skin/TM2008/Skin-3.bmp
VStart50/Skin/TM2008/Skin-4.bmp
VStart50/Skin/TM2008/Skin-5.bmp
VStart50/Skin/TM2008/Skin-6.bmp
VStart50/Skin/TM2008/Skin-7.bmp
VStart50/Skin/TM2008/Skin-8.bmp
VStart50/Skin/TM2008/Skin_Down.bmp
VStart50/Skin/TM2008/Skin_Move.bmp
VStart50/Skin/TM2008/Skin_Normal.bmp
VStart50/Skin/TM2008/button1_Normal.ico
VStart50/Skin/TM2008/button2_Normal.ico
VStart50/Skin/TM2008/button7_Down.ico
VStart50/Skin/TM2008/button7_Move.ico
VStart50/Skin/TM2008/button7_Normal.ico
VStart50/Skin/TM2008/pre.gif
VStart50/Skin/TM2008/pre.txt
VStart50/Skin/TM2008/updown.bmp
VStart50/Skin/Windows/Bar.bmp
VStart50/Skin/Windows/C_Down.ico
VStart50/Skin/Windows/C_Move.ico
VStart50/Skin/Windows/C_Normal.ico
VStart50/Skin/Windows/Close_Down.bmp
VStart50/Skin/Windows/Close_Move.bmp
VStart50/Skin/Windows/Close_Normal.bmp
VStart50/Skin/Windows/MenuCheck.ico
VStart50/Skin/Windows/MenuLeft.bmp
VStart50/Skin/Windows/Min_Down.bmp
VStart50/Skin/Windows/Min_Move.bmp
VStart50/Skin/Windows/Min_Normal.bmp
VStart50/Skin/Windows/S_Down.bmp
VStart50/Skin/Windows/S_Move.bmp
VStart50/Skin/Windows/S_Normal.bmp
VStart50/Skin/Windows/Scroll.bmp
VStart50/Skin/Windows/Setup.ini
VStart50/Skin/Windows/Skin-1.bmp
VStart50/Skin/Windows/Skin-2.bmp
VStart50/Skin/Windows/Skin-3.bmp
VStart50/Skin/Windows/Skin-4.bmp
VStart50/Skin/Windows/Skin-5.bmp
VStart50/Skin/Windows/Skin-6.bmp
VStart50/Skin/Windows/Skin-7.bmp
VStart50/Skin/Windows/Skin-8.bmp
VStart50/Skin/Windows/Skin_Down.bmp
VStart50/Skin/Windows/Skin_Move.bmp
VStart50/Skin/Windows/Skin_Normal.bmp
VStart50/Skin/Windows/updown.bmp
VStart50/Skin/Ĭ/Bar.bmp
VStart50/Skin/Ĭ/C_Down.ico
VStart50/Skin/Ĭ/C_Move.ico
VStart50/Skin/Ĭ/C_Normal.ico
VStart50/Skin/Ĭ/Close_Down.bmp
VStart50/Skin/Ĭ/Close_Move.bmp
VStart50/Skin/Ĭ/Close_Normal.bmp
VStart50/Skin/Ĭ/MenuCheck.ico
VStart50/Skin/Ĭ/MenuLeft.bmp
VStart50/Skin/Ĭ/Min_Down.bmp
VStart50/Skin/Ĭ/Min_Move.bmp
VStart50/Skin/Ĭ/Min_Normal.bmp
VStart50/Skin/Ĭ/S_Down.bmp
VStart50/Skin/Ĭ/S_Move.bmp
VStart50/Skin/Ĭ/S_Normal.bmp
VStart50/Skin/Ĭ/Scroll.bmp
VStart50/Skin/Ĭ/Setup.ini
VStart50/Skin/Ĭ/Skin-1.bmp
VStart50/Skin/Ĭ/Skin-2.bmp
VStart50/Skin/Ĭ/Skin-3.bmp
VStart50/Skin/Ĭ/Skin-4.bmp
VStart50/Skin/Ĭ/Skin-5.bmp
VStart50/Skin/Ĭ/Skin-6.bmp
VStart50/Skin/Ĭ/Skin-7.bmp
VStart50/Skin/Ĭ/Skin-8.bmp
VStart50/Skin/Ĭ/Skin_Down.bmp
VStart50/Skin/Ĭ/Skin_Move.bmp
VStart50/Skin/Ĭ/Skin_Normal.bmp
VStart50/Skin/Ĭ/UpDown.bmp
VStart50/Skin/ٶHi/Bar.bmp
VStart50/Skin/ٶHi/C_Down.ico
VStart50/Skin/ٶHi/C_Move.ico
VStart50/Skin/ٶHi/C_Normal.ico
VStart50/Skin/ٶHi/Close_Down.bmp
VStart50/Skin/ٶHi/Close_Move.bmp
VStart50/Skin/ٶHi/Close_Normal.bmp
VStart50/Skin/ٶHi/MenuCheck.ico
VStart50/Skin/ٶHi/MenuLeft.bmp
VStart50/Skin/ٶHi/Min_Down.bmp
VStart50/Skin/ٶHi/Min_Move.bmp
VStart50/Skin/ٶHi/Min_Normal.bmp
VStart50/Skin/ٶHi/Pre.gif
VStart50/Skin/ٶHi/S_Down.bmp
VStart50/Skin/ٶHi/S_Move.bmp
VStart50/Skin/ٶHi/S_Normal.bmp
VStart50/Skin/ٶHi/Scroll.bmp
VStart50/Skin/ٶHi/SearchButton_Down.bmp
VStart50/Skin/ٶHi/SearchButton_Move.bmp
VStart50/Skin/ٶHi/SearchButton_Normal.bmp
VStart50/Skin/ٶHi/Setup.ini
VStart50/Skin/ٶHi/Skin-1.bmp
VStart50/Skin/ٶHi/Skin-2.bmp
VStart50/Skin/ٶHi/Skin-3.bmp
VStart50/Skin/ٶHi/Skin-4.bmp
VStart50/Skin/ٶHi/Skin-5.bmp
VStart50/Skin/ٶHi/Skin-6.bmp
VStart50/Skin/ٶHi/Skin-7.bmp
VStart50/Skin/ٶHi/Skin-8.bmp
VStart50/Skin/ٶHi/Skin_Down.bmp
VStart50/Skin/ٶHi/Skin_Move.bmp
VStart50/Skin/ٶHi/Skin_Normal.bmp
VStart50/Skin/ٶHi/button1_Normal.ico
VStart50/Skin/ٶHi/button2_Normal.ico
VStart50/Skin/ٶHi/button3_Normal.ICO
VStart50/Skin/ٶHi/button6_Down.ICO
VStart50/Skin/ٶHi/button6_Move.ICO
VStart50/Skin/ٶHi/button6_Normal.ICO
VStart50/Skin/ٶHi/button7_Down.ico
VStart50/Skin/ٶHi/button7_Move.ico
VStart50/Skin/ٶHi/button7_Normal.ico
VStart50/Skin/ٶHi/pre.txt
VStart50/Skin/ٶHi/updown.bmp
VStart50/Skin//Bar.bmp
VStart50/Skin//C_Down.ico
VStart50/Skin//C_Move.ico
VStart50/Skin//C_Normal.ico
VStart50/Skin//Close_Down.bmp
VStart50/Skin//Close_Move.bmp
VStart50/Skin//Close_Normal.bmp
VStart50/Skin//MenuCheck.ico
VStart50/Skin//MenuLeft.bmp
VStart50/Skin//Min_Down.bmp
VStart50/Skin//Min_Move.bmp
VStart50/Skin//Min_Normal.bmp
VStart50/Skin//S_Down.bmp
VStart50/Skin//S_Move.bmp
VStart50/Skin//S_Normal.bmp
VStart50/Skin//Scroll.bmp
VStart50/Skin//Setup.ini
VStart50/Skin//Skin-1.bmp
VStart50/Skin//Skin-2.bmp
VStart50/Skin//Skin-3.bmp
VStart50/Skin//Skin-4.bmp
VStart50/Skin//Skin-5.bmp
VStart50/Skin//Skin-6.bmp
VStart50/Skin//Skin-7.bmp
VStart50/Skin//Skin-8.bmp
VStart50/Skin//Skin_Down.bmp
VStart50/Skin//Skin_Move.bmp
VStart50/Skin//Skin_Normal.bmp
VStart50/Skin//UpDown.bmp
VStart50/UpDate.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/User50/Config.ini
VStart50/User50/HotKey.vsh
VStart50/User50/HotKeyTag.ini
VStart50/User50/enFolder.vsf
VStart50/User50/index.vsi
VStart50/User50/ַ.vst
VStart50/User50/ҵĳ.vst
VStart50/User50/ҵļ.vst
VStart50/VIcon.VDB
VStart50/VIcon.idx
VStart50/VStart.exe
.exe windows x86

72c55ead169b3f9f35661b237855ece7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaR8FixI4
__vbaVarTstGt
__vbaVarSub
__vbaStrI2
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
ord693
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
ord695
__vbaLineInputStr
ord588
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
__vbaVarIdiv
__vbaPut3
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaPut4
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaVarIndexLoadRef
__vbaVarFix
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaI2Abs
__vbaResume
__vbaCopyBytes
__vbaForEachCollAd
ord629
__vbaVarCmpNe
__vbaStrCat
__vbaError
ord552
ord660
__vbaLsetFixstr
ord553
ord661
__vbaRecDestruct
__vbaSetSystemError
__vbaLenBstrB
__vbaHresultCheckObj
__vbaNameFile
ord662
ord663
ord557
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
ord666
__vbaAryVar
Zombie_GetTypeInfo
__vbaVarXor
__vbaVarCmpGe
__vbaAryDestruct
__vbaVarIndexLoadRefLock
__vbaLateMemSt
__vbaBoolStr
__vbaStrBool
ord593
__vbaVarForInit
__vbaForEachCollObj
__vbaExitProc
ord300
ord594
ord301
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaVarIndexLoad
ord598
ord305
ord599
__vbaFpR4
ord306
__vbaStrFixstr
ord520
__vbaBoolVar
ord307
__vbaFPFix
ord522
ord309
__vbaRefVarAry
__vbaVargVar
__vbaVarTstLt
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord524
ord709
__vbaErase
ord631
__vbaVarCmpGt
ord632
__vbaVargVarMove
ord525
__vbaLateMemStAd
__vbaNextEachCollObj
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaVarAbs
ord528
__vbaGenerateBoundsError
__vbaGet3
ord529
__vbaStrCmp
__vbaGet4
__vbaPutOwner3
__vbaVarTstEq
__vbaAryConstruct2
__vbaDateR8
__vbaPutOwner4
__vbaR4Str
__vbaObjVar
__vbaPrintObj
__vbaI2I4
ord561
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
ord670
__vbaFpUI1
__vbaCastObjVar
ord566
__vbaLbound
__vbaRedimPreserve
__vbaStrR4
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
ord569
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
ord601
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
ord311
EVENT_SINK_QueryInterface
ord710
__vbaUI1I4
__vbaVarMul
__vbaExceptHandler
ord711
ord313
__vbaPrintFile
ord712
__vbaStrToUnicode
ord314
__vbaDateStr
ord606
_adj_fprem
_adj_fdivr_m64
ord315
__vbaLateIdStAd
__vbaI2Str
ord607
__vbaVarDiv
ord316
ord608
ord716
ord531
__vbaVarCmpLe
__vbaFPException
ord532
__vbaInStrVar
__vbaStrCompVar
ord717
ord319
__vbaGetOwner3
__vbaUbound
__vbaStrVarVal
__vbaGetOwner4
__vbaVarCat
__vbaDateVar
__vbaLsetFixstrFree
__vbaI2Var
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
ord647
__vbaFileOpen
__vbaVarLateMemCallLdRf
__vbaVar2Vec
__vbaR8Str
ord570
ord648
__vbaNew2
__vbaInStr
__vbaVarInt
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
ord573
__vbaStrCopy
ord681
__vbaI4Str
__vbaVarNot
__vbaVarCmpLt
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord578
ord685
ord100
__vbaVarTstNe
ord579
__vbaVarSetVar
__vbaI4Var
__vbaVarCmpEq
ord689
ord610
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
ord320
__vbaVarDup
__vbaStrComp
__vbaStrToAnsi
ord612
ord321
__vbaVerifyVarObj
__vbaVarMod
__vbaUnkVar
__vbaVarTstGe
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaFpI4
ord616
__vbaRecDestructAnsi
__vbaLateMemCallLd
ord617
_CIatan
__vbaI2ErrVar
ord618
__vbaAryCopy
__vbaStrMove
__vbaCastObj
ord619
__vbaR8IntI4
__vbaStrVarCopy
ord542
ord543
_allmul
ord544
__vbaLateIdSt
ord545
_CItan
__vbaNextEachCollAd
ord546
__vbaAryUnlock
__vbaFPInt
ord547
__vbaVarForNext
_CIexp
__vbaMidStmtBstr
ord580
__vbaRecAssign
__vbaI4ErrVar
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VStart50/vsEnFolder.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VStart50/vsRepair.exe
.exe windows x86

33f9568f75d622c3452f7f96dd0d3d03

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
_adj_fprem1
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaBoolVar
_CIsin
__vbaChkstk
ord526
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
__vbaVarTstEq
__vbaAryConstruct2
__vbaI2I4
DllFunctionCall
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord608
__vbaFPException
__vbaStrCompVar
__vbaStrVarVal
ord645
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaAryLock
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
ord616
ord617
_CIatan
__vbaStrMove
ord618
__vbaCastObj
_allmul
_CItan
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord580

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VStart50/ʹ˵.txt
VStart50/װض.url
.url
VStart50/ Vista ʹ.txt
VStart50/ļ˵.txt

Sharing

General

Malware Config

Signatures

Files

c8cebbf034d8c6304701e5ec3fae70a4

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:0e:7d:a7:00:00:00:00:00:48Certificate

Extended Key Usages

Key Usages

3a:e9:b1:64:12:e1:81:f2:31:c5:5b:ee:f2:50:5e:d1:a6:a5:30:9eSigner

Signature Validations

Verification

24/11/2022, 14:54 Valid: false

Headers

File Characteristics

Imports

version

comctl32

kernel32

user32

ole32

advapi32

oleaut32

comdlg32

gdi32

Exports

Exports

Sections

.text Size: 331KB - Virtual size: 330KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 224KB - Virtual size: 224KB

.reloc Size: 24KB - Virtual size: 23KB

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 4KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 832B

.reloc Size: 4KB - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 20KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 832B

.reloc Size: 4KB - Virtual size: 12B

Headers

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 60KB

UPX1 Size: 2KB - Virtual size: 4KB

.rsrc Size: 43KB - Virtual size: 44KB

fcc40667ac22e0c598518006de958259

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

3a:e9:b1:64:12:e1:81:f2:31:c5:5b:ee:f2:50:5e:d1:a6:a5:30:9e
Signer

24/11/2022, 14:54
Valid: false

.text
Size: 331KB - Virtual size: 330KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 224KB - Virtual size: 224KB

.reloc
Size: 24KB - Virtual size: 23KB

.text
Size: 4KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 832B

.reloc
Size: 4KB - Virtual size: 12B

.text
Size: 20KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 832B

.reloc
Size: 4KB - Virtual size: 12B

UPX0
Size: - Virtual size: 60KB

UPX1
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 43KB - Virtual size: 44KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc
Signer

24/11/2022, 14:54
Valid: false

.text
Size: 68KB - Virtual size: 66KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 28KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 37KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 12B

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 98KB - Virtual size: 97KB

.reloc
Size: 512B - Virtual size: 12B

UPX0
Size: - Virtual size: 224KB

UPX1
Size: 67KB - Virtual size: 68KB

.rsrc
Size: 5KB - Virtual size: 8KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

c6:be:da:cb:6f:7c:07:ce:80:06:10:c2:9a:0c:17:6f:0c:b4:42:44
Signer