Angry Mania[.]iso

Sharing

Copy URL Twitter E-mail

General

Target

Angry Mania.iso
Size

694.4MB
MD5

5f4b9ffa8b305e1036711bba60cef663
SHA1

0a513b8b2707c7e1010724137f1b879f55c31dbb
SHA256

b33aa6e300d0c410d1b856168fe19a9cd83b6167eeeaedf6310983f5413861d3
SHA512

441ea1f7a23223ab535bd3943323a5623dc4e393cb5ad7c8b66db8b1780f2754375db4144ee974f33bd883bf34344cf9895610bd80364e3338b96a9b2ad9d670
SSDEEP

12582912:OqX6KUobAAWzuEq+gIrthy/aiGwkMSSKhvgI6BGJ+6YlTKp83lgbGZ3rjL:OqX6KLeq+fgai2SQYI6BGJFcTN3rZ3rn

Score

8^/10

aspackv2 upx

Malware Config

Signatures

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/Catalogo Novedades.exe	aspack_v212_v242
static1/unpack001/DirectX/DX9Setup.exe	aspack_v212_v242
static1/unpack001/Dll/Cinco.000	aspack_v212_v242
static1/unpack001/Dll/Cuatro.000	aspack_v212_v242
static1/unpack001/Dll/FlashSetup.exe	aspack_v212_v242
static1/unpack001/Dll/Tres.000	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Menu.exe	upx

Files

Angry Mania.iso
.iso
0Lnk/TopD.000
.lnk
0Lnk/TopE.000
.lnk
0Lnk/TopF.000
.lnk
0Lnk/TopG.000
.lnk
0Lnk/TopH.000
.lnk
0Lnk/TopI.000
.lnk
0Lnk/TopJ.000
.lnk
0Lnk/TopK.000
.lnk
Catalogo Novedades.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 587KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 11KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Container/Crazy Birds/Setup.exe
.exe windows x86

1fcba0f12b59daa1494fd78bed3f30f8

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
CloseHandle
GetFileSize
ReadFile
WriteFile
SetFilePointer
GetLastError
GetModuleFileNameA
ResumeThread
SetThreadPriority
CreateThread
WaitForSingleObject
CreateProcessA
GetTempPathA
CompareStringW
CompareStringA
FlushFileBuffers
GetStringTypeW
RemoveDirectoryA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
lstrlenA
CreateDirectoryA
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
IsBadWritePtr
SetEnvironmentVariableA
VirtualAlloc
GetStringTypeA
DeleteFileA
RtlUnwind
RaiseException
ExitProcess
TerminateProcess
GetCurrentProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapSize
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree

user32

SendMessageA
OffsetRect
PostMessageA
MessageBoxA
LoadIconA
GetSystemMetrics
LoadImageA
GetParent
GetDesktopWindow
GetWindowRect
GetDlgItem
SetWindowPos
GetWindowLongA
CreateDialogParamA
wsprintfA
ShowWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
PostQuitMessage

ole32

CoUninitialize
CoInitialize

comctl32

InitCommonControlsEx

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Container/Varios/AngryAnimals.exe
.exe windows x86

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/09/2012, 00:00

Not After

01/10/2015, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f6:5a:b8:96:56:ed:05:5b:f0:bb:fe:c7:6f:8f:f4:fc:1f:0c:f0:78
Signer

Actual PE Digest

f6:5a:b8:96:56:ed:05:5b:f0:bb:fe:c7:6f:8f:f4:fc:1f:0c:f0:78

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

29/10/2012, 21:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GlobalFree
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
HeapCreate
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
GetCurrentThreadId
GetNumberFormatW
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetCurrencyFormatW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
VirtualFree
SwitchToThread
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetFullPathNameW
CreateEventA

user32

InsertMenuW
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
EnableWindow
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
ShowWindowAsync
GetWindow
IsWindowVisible
ShowWindow
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
BeginPaint
EndPaint
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
CreateWindowExW
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
CallWindowProcW
GetCapture
DestroyWindow
MessageBoxW
LoadCursorW
GetCursorPos
InsertMenuA
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
ScreenToClient
SetWindowTextA
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
GetSystemMetrics
GetWindowTextA
UnregisterClassA
PostQuitMessage
LoadMenuW
DeleteMenu
RegisterClassExW
UpdateWindow
GetWindowTextLengthW
GetWindowTextW
LoadStringA
GetMenu
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
InsertMenuItemW
GetClassInfoExW
PostMessageA
RegisterWindowMessageA
GetClientRect
SetMenu

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
CreateDIBSection
GetObjectW
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
EnumFontFamiliesExW
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
getsockname
bind

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 905KB - Virtual size: 904KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Container/Varios/AngryBirdsBadPigs.exe
.exe windows x86

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/12/2010, 00:00

Not After

14/12/2012, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

df:50:46:f4:8f:31:e4:28:26:c7:2b:de:ba:c6:9a:58:58:a2:a9:1c
Signer

Actual PE Digest

df:50:46:f4:8f:31:e4:28:26:c7:2b:de:ba:c6:9a:58:58:a2:a9:1c

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

24/09/2011, 00:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CryptFindOIDInfo
CertFreeCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCompareCertificate
CertVerifyTimeValidity
CertOpenStore
CertVerifyRevocation
CertCloseStore
CertAddStoreToCollection

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInStop
waveOutClose
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeSetEvent
waveOutGetPosition
timeGetTime
waveInAddBuffer
waveInStart
waveOutReset
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeKillEvent
timeEndPeriod
waveInOpen

oleaut32

SysFreeString

dsound

ord8

kernel32

GlobalFree
ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
CreateFileA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
TlsSetValue
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
GetModuleHandleA
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetStartupInfoW
GetCommandLineA
SwitchToThread
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
lstrlenW
GetVersion
DeviceIoControl
VirtualAlloc
VirtualFree
CreateSemaphoreA
TlsAlloc
TlsFree
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GlobalUnlock
GetProcessTimes
FreeLibrary
CreateProcessA
GetVersionExW
LCMapStringW
GetTickCount
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
LoadLibraryW
GetProcAddress
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
HeapReAlloc
HeapCreate
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
GetFileSizeEx

user32

GetDlgItemTextW
GetWindowTextLengthA
GetDlgItemTextA
InsertMenuW
InsertMenuA
GetWindowTextA
UnregisterClassA
LoadMenuW
DeleteMenu
GetWindowTextLengthW
GetWindowTextW
UpdateWindow
BeginPaint
EndPaint
IsIconic
GetMenu
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EnableWindow
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
GetCapture
EnumWindows
GetCursorPos
MessageBoxW
LoadStringA
GetWindowInfo
CopyRect
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
CreatePopupMenu
TrackPopupMenu
DrawMenuBar
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
ShowWindow
DialogBoxParamW
ScreenToClient
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
RegisterClipboardFormatW
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
FillRect
PostMessageW
SetRectEmpty
DestroyWindow
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
GetMonitorInfoW
SystemParametersInfoW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetDC
ReleaseDC
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
ClientToScreen
SendInput
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
EnumDisplayDevicesA
GetSystemMetrics
SetRect
OffsetRect
MonitorFromWindow
CreateWindowExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
DefWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
GetDoubleClickTime
PostMessageA
RegisterWindowMessageA
MessageBoxA
GetWindowPlacement

gdi32

GetBkMode
GetTextColor
SelectClipRgn
GetBkColor
SetTextAlign
CreatePen
GetTextExtentPoint32W
GetCurrentObject
CreateRectRgn
GetTextAlign
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
SelectObject
ExtTextOutW
GetDeviceCaps
SetBkMode
RealizePalette
SelectPalette
LPtoDP
StartDocW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetClipRgn
IntersectClipRect
BitBlt
CreateDIBSection
GetFontData
GetObjectW
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
EnumFontFamiliesExW
DPtoLP
LineTo
StartPage
EndPage
SetPolyFillMode
SaveDC
BeginPath
EndPath
SetTextColor
SetTextCharacterExtra
MoveToEx
ExtTextOutA
EnumFontFamiliesA
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
SetPixel
GetStockObject
CreateDCA
GetICMProfileA
EnumFontFamiliesW
DeleteObject
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
CreateFontIndirectA

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetFolderPathA
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize
PropVariantClear

ws2_32

inet_addr
WSACloseEvent
htons
getsockname
ntohs
send
recv
setsockopt
WSAStartup
gethostbyname
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
bind
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
gethostname
select
ntohl
htonl
WSASocketW

mscms

TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform

opengl32

wglGetProcAddress

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Container/Varios/AngryBirdsBomb.exe
.exe windows x86

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/09/2012, 00:00

Not After

01/10/2015, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:fa:46:61:af:b0:33:f1:fe:93:1f:3a:91:b6:8f:be:7f:04:ad:4f
Signer

Actual PE Digest

f3:fa:46:61:af:b0:33:f1:fe:93:1f:3a:91:b6:8f:be:7f:04:ad:4f

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

29/10/2012, 21:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GlobalFree
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
HeapCreate
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
GetCurrentThreadId
GetNumberFormatW
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetCurrencyFormatW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
VirtualFree
SwitchToThread
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetFullPathNameW
CreateEventA

user32

InsertMenuW
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
EnableWindow
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
ShowWindowAsync
GetWindow
IsWindowVisible
ShowWindow
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
BeginPaint
EndPaint
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
CreateWindowExW
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
CallWindowProcW
GetCapture
DestroyWindow
MessageBoxW
LoadCursorW
GetCursorPos
InsertMenuA
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
ScreenToClient
SetWindowTextA
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
GetSystemMetrics
GetWindowTextA
UnregisterClassA
PostQuitMessage
LoadMenuW
DeleteMenu
RegisterClassExW
UpdateWindow
GetWindowTextLengthW
GetWindowTextW
LoadStringA
GetMenu
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
InsertMenuItemW
GetClassInfoExW
PostMessageA
RegisterWindowMessageA
GetClientRect
SetMenu

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
CreateDIBSection
GetObjectW
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
EnumFontFamiliesExW
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
getsockname
bind

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 905KB - Virtual size: 904KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Container/Varios/AngrySpaceFangame.exe
.exe windows x86

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15/12/2010, 00:00

Not After

14/12/2012, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:79:e1:28:41:79:1c:fe:17:83:5f:43:13:39:2d:4b:dd:0d:a2:c4
Signer

Actual PE Digest

7a:79:e1:28:41:79:1c:fe:17:83:5f:43:13:39:2d:4b:dd:0d:a2:c4

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

24/09/2011, 00:04
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CryptFindOIDInfo
CertFreeCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCompareCertificate
CertVerifyTimeValidity
CertOpenStore
CertVerifyRevocation
CertCloseStore
CertAddStoreToCollection

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInStop
waveOutClose
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeSetEvent
waveOutGetPosition
timeGetTime
waveInAddBuffer
waveInStart
waveOutReset
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeKillEvent
timeEndPeriod
waveInOpen

oleaut32

SysFreeString

dsound

ord8

kernel32

GlobalFree
ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
CreateFileA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
TlsSetValue
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
GetModuleHandleA
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetStartupInfoW
GetCommandLineA
SwitchToThread
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
lstrlenW
GetVersion
DeviceIoControl
VirtualAlloc
VirtualFree
CreateSemaphoreA
TlsAlloc
TlsFree
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GlobalUnlock
GetProcessTimes
FreeLibrary
CreateProcessA
GetVersionExW
LCMapStringW
GetTickCount
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
LoadLibraryW
GetProcAddress
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
HeapReAlloc
HeapCreate
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
GetFileSizeEx

user32

GetDlgItemTextW
GetWindowTextLengthA
GetDlgItemTextA
InsertMenuW
InsertMenuA
GetWindowTextA
UnregisterClassA
LoadMenuW
DeleteMenu
GetWindowTextLengthW
GetWindowTextW
UpdateWindow
BeginPaint
EndPaint
IsIconic
GetMenu
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EnableWindow
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
GetCapture
EnumWindows
GetCursorPos
MessageBoxW
LoadStringA
GetWindowInfo
CopyRect
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
CreatePopupMenu
TrackPopupMenu
DrawMenuBar
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
ShowWindow
DialogBoxParamW
ScreenToClient
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
RegisterClipboardFormatW
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
FillRect
PostMessageW
SetRectEmpty
DestroyWindow
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
GetMonitorInfoW
SystemParametersInfoW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetDC
ReleaseDC
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
ClientToScreen
SendInput
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
EnumDisplayDevicesA
GetSystemMetrics
SetRect
OffsetRect
MonitorFromWindow
CreateWindowExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
DefWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
GetDoubleClickTime
PostMessageA
RegisterWindowMessageA
MessageBoxA
GetWindowPlacement

gdi32

GetBkMode
GetTextColor
SelectClipRgn
GetBkColor
SetTextAlign
CreatePen
GetTextExtentPoint32W
GetCurrentObject
CreateRectRgn
GetTextAlign
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
SelectObject
ExtTextOutW
GetDeviceCaps
SetBkMode
RealizePalette
SelectPalette
LPtoDP
StartDocW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetClipRgn
IntersectClipRect
BitBlt
CreateDIBSection
GetFontData
GetObjectW
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
EnumFontFamiliesExW
DPtoLP
LineTo
StartPage
EndPage
SetPolyFillMode
SaveDC
BeginPath
EndPath
SetTextColor
SetTextCharacterExtra
MoveToEx
ExtTextOutA
EnumFontFamiliesA
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
SetPixel
GetStockObject
CreateDCA
GetICMProfileA
EnumFontFamiliesW
DeleteObject
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
CreateFontIndirectA

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetFolderPathA
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize
PropVariantClear

ws2_32

inet_addr
WSACloseEvent
htons
getsockname
ntohs
send
recv
setsockopt
WSAStartup
gethostbyname
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
bind
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
gethostname
select
ntohl
htonl
WSASocketW

mscms

TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform

opengl32

wglGetProcAddress

Sections

.text
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Container/Varios/CuteBirdsForest.exe
.exe windows x86

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/09/2012, 00:00

Not After

01/10/2015, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fc:d9:60:8e:5e:29:6e:80:b7:01:e7:42:40:64:dc:b1:a7:f5:73:6d
Signer

Actual PE Digest

fc:d9:60:8e:5e:29:6e:80:b7:01:e7:42:40:64:dc:b1:a7:f5:73:6d

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

29/10/2012, 21:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GlobalFree
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
HeapCreate
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
GetCurrentThreadId
GetNumberFormatW
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetCurrencyFormatW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
VirtualFree
SwitchToThread
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetFullPathNameW
CreateEventA

user32

InsertMenuW
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
EnableWindow
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
ShowWindowAsync
GetWindow
IsWindowVisible
ShowWindow
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
BeginPaint
EndPaint
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
CreateWindowExW
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
CallWindowProcW
GetCapture
DestroyWindow
MessageBoxW
LoadCursorW
GetCursorPos
InsertMenuA
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
ScreenToClient
SetWindowTextA
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
GetSystemMetrics
GetWindowTextA
UnregisterClassA
PostQuitMessage
LoadMenuW
DeleteMenu
RegisterClassExW
UpdateWindow
GetWindowTextLengthW
GetWindowTextW
LoadStringA
GetMenu
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
InsertMenuItemW
GetClassInfoExW
PostMessageA
RegisterWindowMessageA
GetClientRect
SetMenu

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
CreateDIBSection
GetObjectW
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
EnumFontFamiliesExW
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
getsockname
bind

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 905KB - Virtual size: 904KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Container/Varios/KingsGame.exe
.exe windows x86

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

24/09/2012, 00:00

Not After

01/10/2015, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3c:7f:4e:fb:89:45:13:e2:7e:3b:59:b7:06:62:fe:a8:09:aa:ae:64
Signer

Actual PE Digest

3c:7f:4e:fb:89:45:13:e2:7e:3b:59:b7:06:62:fe:a8:09:aa:ae:64

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Universal Client,O=Adobe Systems Incorporated,ST=California,C=US

29/10/2012, 21:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptGetMessageCertificates
CertCreateCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CryptVerifyMessageSignature

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInOpen
timeSetEvent
waveOutGetPosition
timeGetTime
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutClose
waveInStop
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveInAddBuffer
waveInStart
waveOutReset
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeKillEvent
timeBeginPeriod
timeEndPeriod

oleaut32

SysFreeString

dsound

ord8

kernel32

ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GlobalFree
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
RaiseException
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetLastError
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
FlushInstructionCache
GetModuleHandleA
GetCommandLineW
SetEndOfFile
SetFileAttributesA
CopyFileA
GetStartupInfoW
GetCommandLineA
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetStartupInfoA
UnhandledExceptionFilter
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
HeapCreate
CreateFileA
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
GlobalUnlock
GetCurrentProcess
GetProcessTimes
FreeLibrary
CreateProcessA
LCMapStringW
GetTickCount
GetCurrentThreadId
GetNumberFormatW
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
GetVersionExW
LoadLibraryW
GetProcAddress
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
CompareStringW
GetCurrencyFormatW
VirtualAlloc
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
CreateSemaphoreA
VirtualFree
SwitchToThread
DeviceIoControl
GetVersion
lstrlenW
InterlockedExchangeAdd
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
GetFullPathNameW
CreateEventA

user32

InsertMenuW
GetDlgItemTextA
GetWindowTextLengthA
GetDlgItemTextW
EnableWindow
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
ShowWindowAsync
GetWindow
IsWindowVisible
ShowWindow
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
BeginPaint
EndPaint
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
CreateWindowExW
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
CallWindowProcW
GetCapture
DestroyWindow
MessageBoxW
LoadCursorW
GetCursorPos
InsertMenuA
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
GetMenuItemInfoW
RemoveMenu
SetMenuItemInfoW
DrawMenuBar
CreatePopupMenu
TrackPopupMenu
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
MessageBoxA
DialogBoxParamW
ScreenToClient
SetWindowTextA
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
PostMessageW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
SetRectEmpty
SetWindowLongW
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
SystemParametersInfoW
GetSystemMetrics
GetWindowTextA
UnregisterClassA
PostQuitMessage
LoadMenuW
DeleteMenu
RegisterClassExW
UpdateWindow
GetWindowTextLengthW
GetWindowTextW
LoadStringA
GetMenu
GetClipboardFormatNameA
RegisterClipboardFormatA
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
DefWindowProcW
SendInput
GetKeyboardLayout
FillRect
GetWindowLongW
GetWindowRect
UpdateLayeredWindow
GetDC
ReleaseDC
ClientToScreen
GetMonitorInfoW
SetRect
OffsetRect
MonitorFromWindow
GetDoubleClickTime
InsertMenuItemW
GetClassInfoExW
PostMessageA
RegisterWindowMessageA
GetClientRect
SetMenu

gdi32

BitBlt
SelectObject
RealizePalette
SelectPalette
ExtTextOutW
SetBkColor
CreateSolidBrush
StretchBlt
SetStretchBltMode
GetStretchBltMode
EnumFontFamiliesW
GetICMProfileA
CreateDCA
GetStockObject
SetPixel
CreateBitmap
CreateFontIndirectW
GetTextMetricsW
EnumFontFamiliesA
SetBkMode
SetTextAlign
IntersectClipRect
CreateDIBSection
GetObjectW
SelectClipRgn
ExtTextOutA
SetTextColor
CreateFontIndirectA
GetClipRgn
CreateRectRgn
GetTextAlign
GetBkMode
GetTextColor
SetTextCharacterExtra
GetTextExtentPoint32W
GetCurrentObject
GetBkColor
CreatePen
DPtoLP
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
LPtoDP
StartDocW
EndDoc
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetDeviceCaps
CreateCompatibleBitmap
GetDIBits
GetFontData
DeleteObject
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
EnumFontFamiliesExW
PolyBezierTo
LineTo
MoveToEx
EndPath
BeginPath
SaveDC
SetPolyFillMode
StartPage
EndPage

comdlg32

GetSaveFileNameA
GetOpenFileNameA
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError

advapi32

RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathA
DragQueryFileW

ole32

OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoInitialize
CoUninitialize
ReleaseStgMedium
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
OleGetClipboard
CoCreateInstance
PropVariantClear

mscms

CreateColorTransformW
CloseColorProfile
TranslateBitmapBits
DeleteColorTransform
OpenColorProfileW

ws2_32

recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
send
ntohs
htons
WSACloseEvent
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
getsockname
bind

Sections

.text
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 905KB - Virtual size: 904KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Demos/AngryBirdsInstaller_2-3-0.exe
.exe windows x86

a7743dff61b65f4214e6cf40057cf69d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6e:a6:02:88:77:a8:70:1d:08:fa:82:8c:7f:a7:0b:d8:d7:1e:ae:f4
Signer

Actual PE Digest

6e:a6:02:88:77:a8:70:1d:08:fa:82:8c:7f:a7:0b:d8:d7:1e:ae:f4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

10/10/2012, 13:16
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
GetShortPathNameW
GetModuleHandleW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetLocaleInfoA
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetLogicalDriveStringsW
CreateDirectoryW
GetFileSize
SetFilePointer
ReadFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
GetDiskFreeSpaceExW
FormatMessageW
CreateProcessW
GetExitCodeProcess
GetVersion
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessA
DeleteFileA
LockFile
UnlockFile
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
GetDesktopWindow
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
InvalidateRect
SetFocus
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
MapWindowPoints
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
GetWindowDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
GetDlgItem
IsWindow
PostMessageW
EnableMenuItem
SetWindowPos
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
LoadStringW

gdi32

GetDeviceCaps
GetObjectW
DeleteDC
SetBkMode
DeleteObject
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateFontIndirectW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Demos/AngryBirdsRioInstaller_1.4.4.exe
.exe windows x86

a7743dff61b65f4214e6cf40057cf69d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

36:df:d9:2e:ed:54:8e:9d:09:c1:74:50:88:10:28:92:3e:7a:b6:30
Signer

Actual PE Digest

36:df:d9:2e:ed:54:8e:9d:09:c1:74:50:88:10:28:92:3e:7a:b6:30

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

12/04/2012, 10:20
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
GetShortPathNameW
GetModuleHandleW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetLocaleInfoA
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetLogicalDriveStringsW
CreateDirectoryW
GetFileSize
SetFilePointer
ReadFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
GetDiskFreeSpaceExW
FormatMessageW
CreateProcessW
GetExitCodeProcess
GetVersion
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessA
DeleteFileA
LockFile
UnlockFile
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
GetDesktopWindow
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
InvalidateRect
SetFocus
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
MapWindowPoints
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
GetWindowDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
GetDlgItem
IsWindow
PostMessageW
EnableMenuItem
SetWindowPos
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
LoadStringW

gdi32

GetDeviceCaps
GetObjectW
DeleteDC
SetBkMode
DeleteObject
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateFontIndirectW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Demos/AngryBirdsSeasonsInstaller_3-0-0.exe
.exe windows x86

a7743dff61b65f4214e6cf40057cf69d

Code Sign

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:08
Certificate

Issuer

CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/04/2012, 07:00

Not After

26/04/2017, 07:00

Subject

CN=Starfield Services Timestamp Authority,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9c:e0:d0:f5:ac:a7:54:07:9b:3b:e9:eb:ff:0e:90:b1:92:4f:19:eb
Signer

Actual PE Digest

9c:e0:d0:f5:ac:a7:54:07:9b:3b:e9:eb:ff:0e:90:b1:92:4f:19:eb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

20/01/2023, 16:07
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
GetShortPathNameW
GetModuleHandleW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetLocaleInfoA
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetLogicalDriveStringsW
CreateDirectoryW
GetFileSize
SetFilePointer
ReadFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
GetDiskFreeSpaceExW
FormatMessageW
CreateProcessW
GetExitCodeProcess
GetVersion
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessA
DeleteFileA
LockFile
UnlockFile
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
GetDesktopWindow
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
InvalidateRect
SetFocus
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
MapWindowPoints
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
GetWindowDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
GetDlgItem
IsWindow
PostMessageW
EnableMenuItem
SetWindowPos
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
LoadStringW

gdi32

GetDeviceCaps
GetObjectW
DeleteDC
SetBkMode
DeleteObject
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateFontIndirectW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Demos/AngryBirdsSpaceInstaller_1-3-1.exe
.exe windows x86

a7743dff61b65f4214e6cf40057cf69d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:3b:79:2b:cc:3f:45:a2:37:af:10:5f:18:da:6e:d8:7e:15:ed:52
Signer

Actual PE Digest

6c:3b:79:2b:cc:3f:45:a2:37:af:10:5f:18:da:6e:d8:7e:15:ed:52

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

22/10/2012, 14:40
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
GetShortPathNameW
GetModuleHandleW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetLocaleInfoA
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetLogicalDriveStringsW
CreateDirectoryW
GetFileSize
SetFilePointer
ReadFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
GetDiskFreeSpaceExW
FormatMessageW
CreateProcessW
GetExitCodeProcess
GetVersion
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessA
DeleteFileA
LockFile
UnlockFile
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
GetDesktopWindow
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
InvalidateRect
SetFocus
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
MapWindowPoints
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
GetWindowDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
GetDlgItem
IsWindow
PostMessageW
EnableMenuItem
SetWindowPos
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
LoadStringW

gdi32

GetDeviceCaps
GetObjectW
DeleteDC
SetBkMode
DeleteObject
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateFontIndirectW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 221KB - Virtual size: 221KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Demos/AngryBirdsStarWarsInstaller_1-0-0.exe
.exe windows x86

a7743dff61b65f4214e6cf40057cf69d

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

92:74:f3:61:45:b1:9e:90:a6:40:e3:49:ea:40:07:2e:a3:e6:e0:92
Signer

Actual PE Digest

92:74:f3:61:45:b1:9e:90:a6:40:e3:49:ea:40:07:2e:a3:e6:e0:92

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

31/10/2012, 16:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
GetShortPathNameW
GetModuleHandleW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
LoadLibraryExW
EnterCriticalSection
LeaveCriticalSection
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
CreateMutexW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetLocaleInfoA
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
GetLogicalDriveStringsW
CreateDirectoryW
GetFileSize
SetFilePointer
ReadFile
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
GetDiskFreeSpaceExW
FormatMessageW
CreateProcessW
GetExitCodeProcess
GetVersion
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessA
DeleteFileA
LockFile
UnlockFile
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LCMapStringA
GetStringTypeA
GetStringTypeW

user32

GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
GetDesktopWindow
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
InvalidateRect
SetFocus
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
MapWindowPoints
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
GetWindowTextLengthW
GetWindowTextW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
GetWindowDC
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
GetDlgItem
IsWindow
PostMessageW
EnableMenuItem
SetWindowPos
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
LoadStringW

gdi32

GetDeviceCaps
GetObjectW
DeleteDC
SetBkMode
DeleteObject
GetStockObject
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetMapMode
SetMapMode
GetViewportExtEx
GetWindowExtEx
CreateFontIndirectW

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

VarUI4FromStr
OleLoadPicture

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 361KB - Virtual size: 361KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Demos/BadPiggiesInstaller_1.1.0.exe
.exe windows x86

e4089548ce32953cff5d3587e55f592f

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

03:01
Certificate

Issuer

OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

Not Before

16/11/2006, 01:54

Not After

16/11/2026, 01:54

Subject

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:a7:4d:b1:67:25:0d
Certificate

Issuer

SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

26/10/2011, 13:20

Not After

26/10/2014, 13:20

Subject

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

af:ca:67:ff:4d:fe:98:4f:8a:44:25:26:a8:64:7f:ed:df:a9:63:a1
Signer

Actual PE Digest

af:ca:67:ff:4d:fe:98:4f:8a:44:25:26:a8:64:7f:ed:df:a9:63:a1

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Rovio Entertainment Ltd.,OU=Technology,O=Rovio Entertainment Ltd.,L=Espoo,ST=Uusimaa,C=FI

06/11/2012, 09:10
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnterCriticalSection
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
InitializeCriticalSection
DeleteCriticalSection
InterlockedDecrement
InterlockedIncrement
LoadLibraryW
GetCurrentThreadId
CloseHandle
LeaveCriticalSection
CreateMutexW
GetCommandLineW
SetCurrentDirectoryW
GetDriveTypeW
GetFileAttributesW
GetVersionExW
CopyFileW
GetCurrentProcess
FlushInstructionCache
SetLastError
lstrcmpiW
FreeLibrary
GetLastError
WriteFile
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetShortPathNameW
RaiseException
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
lstrlenW
MultiByteToWideChar
SetFileAttributesW
WideCharToMultiByte
GetStringTypeW
GetStringTypeA
LCMapStringA
GetConsoleMode
LocalAlloc
GetProcAddress
InterlockedExchange
LoadLibraryA
GetTempPathW
GetTempFileNameW
DeleteFileW
FindFirstFileW
FindNextFileW
RemoveDirectoryW
FindClose
CreateDirectoryW
GetLogicalDriveStringsW
GetFileSize
ReadFile
GetDiskFreeSpaceExW
SetFilePointer
EnumResourceLanguagesW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultLangID
GlobalMemoryStatus
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
FlushFileBuffers
lstrcpynW
GetSystemDirectoryW
GetWindowsDirectoryW
GetEnvironmentVariableW
GetSystemTime
WaitForSingleObject
CreateThread
MulDiv
GetExitCodeThread
TerminateThread
CreateEventW
SetEvent
MoveFileW
Sleep
ResetEvent
CreateFileA
FormatMessageW
GetTempPathA
GetTempFileNameA
DuplicateHandle
GetStdHandle
CreateProcessW
CreateProcessA
DeleteFileA
GetExitCodeProcess
LockFile
UnlockFile
GetVersion
CreateNamedPipeW
SearchPathW
OpenProcess
TerminateProcess
GlobalLock
GlobalUnlock
GlobalAlloc
GlobalFree
lstrcmpW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
ExitProcess
HeapCreate
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringW
RtlUnwind
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetConsoleCP

user32

SetWindowPos
MapWindowPoints
GetClientRect
GetParent
GetWindowRect
SystemParametersInfoW
GetWindowLongW
GetWindow
EndDialog
CreateDialogParamW
GetSystemMetrics
GetDC
PeekMessageW
TranslateMessage
DispatchMessageW
GetForegroundWindow
SendMessageW
CreateWindowExW
EnableWindow
ScreenToClient
PostQuitMessage
CallWindowProcW
ShowWindow
GetPropW
IsWindowVisible
RedrawWindow
IsWindow
SetFocus
GetWindowTextW
GetWindowTextLengthW
SetWindowTextW
SetForegroundWindow
LoadImageW
GetSystemMenu
EnableMenuItem
DestroyMenu
MsgWaitForMultipleObjects
ModifyMenuW
FindWindowW
MessageBeep
ExitWindowsEx
GetScrollRange
GetScrollPos
GetDlgCtrlID
SetPropW
RemovePropW
TrackPopupMenu
LoadMenuW
GetSubMenu
SetTimer
KillTimer
LoadIconW
ReleaseDC
GetDesktopWindow
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
UnregisterClassA
PostMessageW
LoadStringW
DialogBoxParamW
MessageBoxW
GetActiveWindow
SetWindowLongW
DefWindowProcW
CharNextW
DestroyWindow
GetDlgItem
InvalidateRect

gdi32

GetDeviceCaps
DeleteObject
GetObjectW
DeleteDC
SetBkMode
GetStockObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
CreateFontIndirectW

shell32

ShellExecuteW
SHGetFolderPathW
SHBrowseForFolderW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation

ole32

CreateStreamOnHGlobal
CreateILockBytesOnHGlobal
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
StgCreateDocfileOnILockBytes
CoInitialize

oleaut32

OleLoadPicture
VarUI4FromStr

shlwapi

PathFileExistsW

comctl32

PropertySheetW
DestroyPropertySheetPage
CreatePropertySheetPageW

msimg32

TransparentBlt

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

Sections

.text
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DirectX/APR2007_XACT_x64.cab
.cab .ps1
DirectX/APR2007_XACT_x86.cab
.cab
DirectX/APR2007_d3dx10_33_x64.cab
.cab
DirectX/APR2007_d3dx10_33_x86.cab
.cab
DirectX/APR2007_d3dx9_33_x64.cab
.cab
DirectX/APR2007_d3dx9_33_x86.cab
.cab
DirectX/APR2007_xinput_x64.cab
.cab
DirectX/APR2007_xinput_x86.cab
.cab
DirectX/AUG2006_XACT_x64.cab
.cab
DirectX/AUG2006_XACT_x86.cab
.cab
DirectX/AUG2006_xinput_x64.cab
.cab
DirectX/AUG2006_xinput_x86.cab
.cab
DirectX/AUG2007_XACT_x64.cab
.cab
DirectX/AUG2007_XACT_x86.cab
.cab
DirectX/AUG2007_d3dx10_35_x64.cab
.cab
DirectX/AUG2007_d3dx10_35_x86.cab
.cab
DirectX/AUG2007_d3dx9_35_x64.cab
.cab
DirectX/AUG2007_d3dx9_35_x86.cab
.cab
DirectX/Apr2005_d3dx9_25_x64.cab
.cab
DirectX/Apr2005_d3dx9_25_x86.cab
.cab
DirectX/Apr2006_MDX1_x86.cab
.cab
DirectX/Apr2006_MDX1_x86_Archive.cab
.cab
DirectX/Apr2006_XACT_x64.cab
.cab
DirectX/Apr2006_XACT_x86.cab
.cab
DirectX/Apr2006_d3dx9_30_x64.cab
.cab
DirectX/Apr2006_d3dx9_30_x86.cab
.cab
DirectX/Apr2006_xinput_x64.cab
.cab
DirectX/Apr2006_xinput_x86.cab
.cab .ps1
DirectX/Aug2005_d3dx9_27_x64.cab
.cab
DirectX/Aug2005_d3dx9_27_x86.cab
.cab
DirectX/Aug2008_XACT_x64.cab
.cab
DirectX/Aug2008_XACT_x86.cab
.cab
DirectX/Aug2008_XAudio_x64.cab
.cab
DirectX/Aug2008_XAudio_x86.cab
.cab
DirectX/Aug2008_d3dx10_39_x64.cab
.cab
DirectX/Aug2008_d3dx10_39_x86.cab
.cab
DirectX/Aug2008_d3dx9_39_x64.cab
.cab
DirectX/Aug2008_d3dx9_39_x86.cab
.cab
DirectX/BDANT.cab
.cab
DirectX/BDAXP.cab
.cab
DirectX/DEC2006_XACT_x64.cab
.cab
DirectX/DEC2006_XACT_x86.cab
.cab
DirectX/DEC2006_d3dx10_00_x64.cab
.cab
DirectX/DEC2006_d3dx10_00_x86.cab
.cab
DirectX/DEC2006_d3dx9_32_x64.cab
.cab
DirectX/DEC2006_d3dx9_32_x86.cab
.cab
DirectX/DSETUP.dll
.dll windows x86

b021ff25749d5d8bb42615cc84f1ef1b

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9a:2e:f1:01:ba:59:24:7f:d9:99:c0:d2:7f:0e:f4:13:2c:48:51:bb
Signer

Actual PE Digest

9a:2e:f1:01:ba:59:24:7f:d9:99:c0:d2:7f:0e:f4:13:2c:48:51:bb

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2008, 17:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LocalFree
LocalAlloc
lstrcmpA
WideCharToMultiByte
GetSystemDefaultLCID
GetModuleFileNameA
SetLastError
MultiByteToWideChar
lstrlenA
lstrlenW
CompareStringA
CreateDirectoryA
GetWindowsDirectoryA
FormatMessageA
GetCommandLineA
HeapFree
HeapAlloc
HeapReAlloc
GetLocalTime
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCurrentDirectoryA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
RtlUnwind
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
Sleep
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
CreateFileA
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
ReadFile
VirtualProtect
GetSystemInfo
VirtualQuery
GetSystemDirectoryA
SetCurrentDirectoryA
GetVersionExA
LoadLibraryA
GetProcAddress
OutputDebugStringA
CreateMutexA
GetLastError
CloseHandle
TerminateProcess
FreeLibrary

user32

GetKeyboardType
DestroyWindow
SetFocus
CreateDialogParamA
SetDlgItemTextA
MessageBoxA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegCreateKeyExA
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA

winmm

mmioRead
mmioDescend
mmioClose
mmioOpenA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

ole32

StringFromGUID2

Exports

Exports

DirectXDeviceDriverSetupA
DirectXDeviceDriverSetupW
DirectXLoadString
DirectXRegisterApplicationA
DirectXRegisterApplicationW
DirectXSetupA
DirectXSetupCallback
DirectXSetupGetEULAA
DirectXSetupGetEULAW
DirectXSetupGetFileVersion
DirectXSetupGetVersion
DirectXSetupIsEng
DirectXSetupIsJapan
DirectXSetupIsJapanNec
DirectXSetupSetCallback
DirectXSetupShowEULA
DirectXSetupW
DirectXUnRegisterApplication

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DirectX/DX9Setup.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 501KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DirectX/DXSETUP.exe
.exe windows x86

06e947b532bbd61410aea9cbe5ad7d45

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7c:a6:58:99:99:53:2f:cf:24:21:f9:25:95:94:4d:88:30:9b:7a:11
Signer

Actual PE Digest

7c:a6:58:99:99:53:2f:cf:24:21:f9:25:95:94:4d:88:30:9b:7a:11

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2008, 18:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegDeleteValueA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken

kernel32

FindClose
FindFirstFileA
lstrlenA
ReadFile
GetFileSize
CreateFileA
GetCurrentDirectoryA
GetCurrentProcess
GetModuleFileNameA
SetErrorMode
CreateMutexA
GetModuleHandleA
CreateThread
GetSystemDirectoryA
CloseHandle
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
CompareStringA
FormatMessageA
lstrcmpiA
LocalFree
GetProcessHeap
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
VirtualQuery
GetSystemInfo
VirtualProtect
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapReAlloc
VirtualAlloc
Sleep
GetModuleHandleW
InitializeCriticalSection
LCMapStringW
GetWindowsDirectoryA
OutputDebugStringA
CreateDirectoryA
GetLastError
GetCommandLineA
GetStartupInfoA
GetLocalTime
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
MultiByteToWideChar

gdi32

StretchBlt
DeleteDC
CreateCompatibleDC
SelectObject
CreateFontIndirectA
DeleteObject
GetDeviceCaps
GetObjectA

user32

ReleaseDC
GetDC
LoadImageA
SystemParametersInfoA
SendDlgItemMessageA
SetWindowTextA
GetWindowLongA
SetWindowLongA
PostMessageA
GetParent
SetDlgItemTextA
GetDlgItem
SendMessageA
ShowWindow
GetAsyncKeyState
ExitWindowsEx
EnumWindows
CharLowerA
LoadStringA
MessageBoxA
GetWindowTextA
GetClassNameA
SetForegroundWindow
SetFocus

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

CreatePropertySheetPageA
PropertySheetA
ord17

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DirectX/Dec2005_d3dx9_28_x64.cab
.cab
DirectX/Dec2005_d3dx9_28_x86.cab
.cab
DirectX/FEB2007_XACT_x64.cab
.cab
DirectX/FEB2007_XACT_x86.cab
.cab
DirectX/Feb2005_d3dx9_24_x64.cab
.cab
DirectX/Feb2005_d3dx9_24_x86.cab
.cab
DirectX/Feb2006_XACT_x64.cab
.cab
DirectX/Feb2006_XACT_x86.cab
.cab
DirectX/Feb2006_d3dx9_29_x64.cab
.cab
DirectX/Feb2006_d3dx9_29_x86.cab
.cab
DirectX/Garantia.txt
DirectX/JUN2006_XACT_x64.cab
.cab
DirectX/JUN2006_XACT_x86.cab
.cab
DirectX/JUN2007_XACT_x64.cab
.cab
DirectX/JUN2007_XACT_x86.cab
.cab
DirectX/JUN2007_d3dx10_34_x64.cab
.cab
DirectX/JUN2007_d3dx10_34_x86.cab
.cab
DirectX/JUN2007_d3dx9_34_x64.cab
.cab
DirectX/JUN2007_d3dx9_34_x86.cab
.cab
DirectX/JUN2008_X3DAudio_x64.cab
.cab
DirectX/JUN2008_X3DAudio_x86.cab
.cab
DirectX/JUN2008_XACT_x64.cab
.cab
DirectX/JUN2008_XACT_x86.cab
.cab
DirectX/JUN2008_XAudio_x64.cab
.cab
DirectX/JUN2008_XAudio_x86.cab
.cab
DirectX/JUN2008_d3dx10_38_x64.cab
.cab
DirectX/JUN2008_d3dx10_38_x86.cab
.cab
DirectX/JUN2008_d3dx9_38_x64.cab
.cab
DirectX/JUN2008_d3dx9_38_x86.cab
.cab
DirectX/Jun2005_d3dx9_26_x64.cab
.cab
DirectX/Jun2005_d3dx9_26_x86.cab
.cab
DirectX/Mar2008_X3DAudio_x64.cab
.cab
DirectX/Mar2008_X3DAudio_x86.cab
.cab
DirectX/Mar2008_XACT_x64.cab
.cab
DirectX/Mar2008_XACT_x86.cab
.cab
DirectX/Mar2008_XAudio_x64.cab
.cab
DirectX/Mar2008_XAudio_x86.cab
.cab
DirectX/Mar2008_d3dx10_37_x64.cab
.cab
DirectX/Mar2008_d3dx10_37_x86.cab
.cab
DirectX/Mar2008_d3dx9_37_x64.cab
.cab
DirectX/Mar2008_d3dx9_37_x86.cab
.cab
DirectX/NOV2007_X3DAudio_x64.cab
.cab
DirectX/NOV2007_X3DAudio_x86.cab
.cab
DirectX/NOV2007_XACT_x64.cab
.cab
DirectX/NOV2007_XACT_x86.cab
.cab
DirectX/Nov2007_d3dx10_36_x64.cab
.cab
DirectX/Nov2007_d3dx10_36_x86.cab
.cab
DirectX/Nov2007_d3dx9_36_x64.cab
.cab
DirectX/Nov2007_d3dx9_36_x86.cab
.cab
DirectX/OCT2006_XACT_x64.cab
.cab
DirectX/OCT2006_XACT_x86.cab
.cab
DirectX/OCT2006_d3dx9_31_x64.cab
.cab
DirectX/OCT2006_d3dx9_31_x86.cab
.cab
DirectX/Oct2005_xinput_x64.cab
.cab
DirectX/Oct2005_xinput_x86.cab
.cab
DirectX/dsetup32.dll
.dll windows x86

9f5697c8aad28db39ef5e8311ec1a191

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:72:4a:2e:97:40:a6:1c:ff:d0:61:1c:80:33:44:90:3e:22:8d:7c
Signer

Actual PE Digest

b7:72:4a:2e:97:40:a6:1c:ff:d0:61:1c:80:33:44:90:3e:22:8d:7c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

31/07/2008, 18:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindClose
FindFirstFileA
GetSystemDirectoryA
CopyFileA
DeleteFileA
SetFileAttributesA
WideCharToMultiByte
LoadResource
FindResourceA
GetSystemDefaultLCID
GetModuleFileNameA
lstrcmpA
LockResource
SizeofResource
SetLastError
GetPrivateProfileStringA
MultiByteToWideChar
CloseHandle
GetFileSize
CreateFileA
GetPrivateProfileSectionA
lstrcmpiA
lstrlenA
FindNextFileA
GetShortPathNameA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryExA
GetFileAttributesA
GetPrivateProfileSectionNamesA
GetSystemInfo
GetDiskFreeSpaceA
GetModuleHandleA
ReadFile
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
LocalFileTimeToFileTime
SystemTimeToFileTime
GetTempFileNameA
GetDriveTypeA
GetCurrentDirectoryA
ExpandEnvironmentStringsA
GetTempPathA
MoveFileExA
SetFileTime
GetFileTime
Sleep
CreateMutexA
GetCommandLineA
GetLocalTime
HeapFree
HeapReAlloc
HeapAlloc
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetVersionExA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
WriteFile
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
GetModuleHandleW
SetFilePointer
SetStdHandle
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
VirtualProtect
VirtualQuery
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
GetProcAddress
LoadLibraryA
GetCurrentProcess
FreeLibrary
CompareStringA
FormatMessageA
LocalFree
GetWindowsDirectoryA
OutputDebugStringA
CreateDirectoryA
GetCurrentThreadId
GetLastError

gdi32

GetDeviceCaps

user32

PeekMessageA
ShowWindow
GetDlgItem
SendMessageA
CharLowerA
MessageBoxA
CreateDialogParamA
SetFocus
DestroyWindow
DialogBoxParamA
GetMessageA
CharNextA
EndDialog
SetDlgItemTextA
SendDlgItemMessageA
GetDesktopWindow
GetWindowRect
GetDC
ReleaseDC
SetWindowPos
LoadStringA
DispatchMessageA
TranslateMessage
GetKeyboardType

advapi32

RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryInfoKeyA
RegEnumKeyExA
RegDeleteValueA
RegQueryValueExA

shlwapi

SHDeleteKeyA

winmm

mmioDescend
mmioOpenA
mmioClose
mmioRead

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

shell32

SHFileOperationA

ole32

StringFromGUID2

Exports

Exports

DirectXLoadString
DirectXSetupCallback
DirectXSetupSetCallback
DirectXSetupShowEULA
iDirectXSetup
iDirectXSetupGetEULA

Sections

.text
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DirectX/dxdllreg_x86.cab
.cab
DirectX/dxnt.cab
.cab
DirectX/dxupdate.cab
.cab
DirectX/dxwebsetup.exe
.exe windows x86

1494de9b53e05fc1f40cb92afbdd6ce4

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:0a:eb:ec:17:d3:56:62:ca:bb:b6:00:b3:53:69:32:0a:d4:5e:c4
Signer

Actual PE Digest

f9:0a:eb:ec:17:d3:56:62:ca:bb:b6:00:b3:53:69:32:0a:d4:5e:c4

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

27/10/2008, 17:29
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegCloseKey
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegQueryInfoKeyA

kernel32

LocalFree
LocalAlloc
GetLastError
GetCurrentProcess
GetModuleFileNameA
lstrlenA
GetSystemDirectoryA
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
SetFileAttributesA
lstrcmpA
FindFirstFileA
lstrcatA
lstrcpyA
_lclose
_llseek
_lopen
WritePrivateProfileStringA
GetWindowsDirectoryA
CreateDirectoryA
GetFileAttributesA
ExpandEnvironmentStringsA
IsDBCSLeadByte
GetShortPathNameA
GetPrivateProfileStringA
GetPrivateProfileIntA
lstrcmpiA
GetProcAddress
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
CloseHandle
LoadResource
SizeofResource
FindResourceA
ReadFile
WriteFile
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetCurrentDirectoryA
GetTempFileNameA
ExitProcess
CreateFileA
LoadLibraryExA
lstrcpynA
GetVolumeInformationA
FormatMessageA
GetCurrentDirectoryA
GetVersionExA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetTempPathA
GetSystemInfo
CreateMutexA
SetEvent
CreateEventA
CreateThread
ResetEvent
TerminateThread
GetDriveTypeA
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
LockResource
LoadLibraryA
GetDiskFreeSpaceA
MulDiv
EnumResourceLanguagesA
FreeLibrary
GlobalFree

gdi32

GetDeviceCaps

user32

ExitWindowsEx
wsprintfA
CharNextA
CharUpperA
CharPrevA
SetWindowLongA
GetWindowLongA
CallWindowProcA
DispatchMessageA
MsgWaitForMultipleObjects
PeekMessageA
SendMessageA
SetWindowPos
ReleaseDC
GetDC
GetWindowRect
SendDlgItemMessageA
GetDlgItem
SetForegroundWindow
SetWindowTextA
MessageBoxA
DialogBoxIndirectParamA
ShowWindow
EnableWindow
GetDlgItemTextA
EndDialog
GetDesktopWindow
MessageBeep
SetDlgItemTextA
LoadStringA
GetSystemMetrics

comctl32

ord17

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 253KB - Virtual size: 256KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Dll/Cinco.000
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 501KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Dll/Cuatro.000
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 501KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Dll/Flash.exe
.exe windows x86

78c751010579c51cdad3f096a3cbcc97

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA
FindExecutableA

user32

CharNextA
DefWindowProcA
GetWindowWord
SetWindowWord
BeginPaint
GetSysColor
GetClientRect
SetRect
EndPaint
RegisterClassA
OemToCharBuffA
LoadCursorA
GetLastActivePopup
ShowWindow
PostMessageA
EnableWindow
DestroyWindow
SetWindowTextA
SetForegroundWindow
SetActiveWindow
GetWindowRect
SetTimer
KillTimer
DialogBoxIndirectParamA
GetDlgItemTextA
EndDialog
SendMessageA
GetKeyState
PeekMessageA
TranslateMessage
DispatchMessageA
GetParent
SetDlgItemTextA
SendDlgItemMessageA
GetDlgItem
InvalidateRect
UpdateWindow
wsprintfA
MessageBoxA
SetCursor
GetSystemMetrics
SetWindowPos

kernel32

CreateDirectoryA
_lclose
_lopen
GlobalUnlock
RtlUnwind
GetCommandLineA
GetModuleHandleA
ExitProcess
GetACP
GetModuleFileNameA
SetErrorMode
GetVersion
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcmpiA
GetWindowsDirectoryA
GetEnvironmentVariableA
LocalAlloc
LocalFree
GlobalHandle
lstrcpyA
GlobalFree
GlobalAlloc
GlobalLock
WinExec
_llseek
GetDriveTypeA
_lread
_lwrite
GetVolumeInformationA
FindClose
FindFirstFileA
GetCurrentDirectoryA
SetCurrentDirectoryA
lstrlenA
lstrcatA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
_lcreat

gdi32

GetBkColor
SetBkColor
SetTextColor
SetTextAlign
DeleteObject
GetTextExtentPoint32A
ExtTextOutA
CreateDCA
GetDeviceCaps
CreateFontIndirectA
DeleteDC
SelectObject

advapi32

RegQueryValueA

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_winzip_
Size: 529KB - Virtual size: 532KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dll/Flash.lnk
.lnk
Dll/Flash.ocx
.dll regsvr32 windows x86

1cd3d89be41dd651b02dd66afd312a7f

Code Sign

6d:a2:7a:e9:29:2e:b6:dd:c0:a8:00:1d:47:6e:3b:69
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

03/12/2001, 00:00

Not After

02/12/2011, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

43:40:6a:a9:b8:2d:e8:7e:57:2c:9c:12:f9:52:c2:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

02/06/2004, 00:00

Not After

17/06/2005, 23:59

Subject

CN=Macromedia\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Macromedia\, Inc.,L=San Francisco,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

winmm

waveInStop
waveInClose
waveInUnprepareHeader
waveInReset
timeSetEvent
waveInPrepareHeader
waveInOpen
waveInGetDevCapsA
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveOutGetDevCapsA
timeKillEvent
timeGetTime
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
waveInAddBuffer
waveInStart
waveInGetNumDevs
waveOutGetNumDevs
waveOutWrite
waveOutPrepareHeader

kernel32

HeapAlloc
HeapReAlloc
HeapFree
GetUserDefaultLangID
GetSystemDefaultLangID
DeleteFileA
CreateFileA
GetSystemDirectoryA
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
GetFileAttributesA
MoveFileA
RemoveDirectoryA
CreateDirectoryA
ReadFile
WriteFile
GetTempFileNameA
GetTempPathA
SetFilePointer
GetFileSize
FindFirstFileA
FindNextFileA
FindClose
ReleaseMutex
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetTickCount
WaitForSingleObject
IsDBCSLeadByteEx
GetProcessTimes
SetThreadPriority
CreateThread
ExitThread
CreateEventA
SetEvent
ResetEvent
WaitForMultipleObjects
GetThreadPriority
GetCurrentThread
CreateProcessA
GetLocaleInfoA
SetErrorMode
GetCurrentProcess
FlushInstructionCache
GlobalLock
GlobalUnlock
GetCurrentThreadId
MulDiv
LockResource
Sleep
LoadLibraryA
GetProcAddress
lstrcatA
lstrcpyA
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DebugBreak
InitializeCriticalSection
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GlobalAlloc
GlobalFree
GetVersionExA
MultiByteToWideChar
GetCPInfo
GetACP
IsDBCSLeadByte
GetLastError
lstrlenA
InterlockedIncrement
WideCharToMultiByte
lstrlenW
InterlockedDecrement
GetShortPathNameA
GetModuleHandleA
GetModuleFileNameA
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
CreateMutexA
DisableThreadLibraryCalls
HeapCreate
HeapDestroy
CloseHandle

user32

MapVirtualKeyA
GetKeyState
UpdateWindow
SetCapture
ReleaseCapture
GetFocus
PtInRect
IsChild
GetParent
GetSystemMetrics
InsertMenuItemA
GetMenuItemInfoA
GetMenuItemCount
WaitForInputIdle
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
SetClipboardData
EmptyClipboard
GetDesktopWindow
PostThreadMessageA
GetQueueStatus
PeekMessageA
MsgWaitForMultipleObjects
RegisterWindowMessageA
DispatchMessageA
GetCapture
LoadMenuA
GetSubMenu
GetMenuItemID
DeleteMenu
ClientToScreen
TrackPopupMenu
DestroyMenu
SystemParametersInfoA
SetCursor
GetCursorPos
ScreenToClient
KillTimer
SetTimer
FillRect
MessageBoxA
CheckMenuItem
SetFocus
GetWindowRect
GetKeyboardLayout
CreateWindowExA
CallWindowProcA
GetWindowLongA
DefWindowProcA
SetWindowLongA
IntersectRect
EqualRect
OffsetRect
SetWindowRgn
SetWindowPos
UnionRect
InvalidateRect
LoadCursorA
wsprintfA
RegisterClassExA
BeginPaint
GetClientRect
EndPaint
CreateDialogParamA
LoadStringA
IsDialogMessageA
MoveWindow
ShowWindow
GetDialogBaseUnits
IsWindow
DestroyWindow
SendDlgItemMessageA
SetDlgItemTextW
CheckDlgButton
GetWindowTextLengthA
GetWindowTextA
IsDlgButtonChecked
GetDlgItem
GetClassInfoExA
UnregisterClassA
CharNextA
GetTopWindow
GetDoubleClickTime
GetDC
ReleaseDC
WindowFromPoint
WinHelpA
EnableMenuItem

gdi32

GetCurrentObject
GetTextExtentPoint32W
GetTextExtentPoint32A
DPtoLP
GetTextColor
GetBkMode
GetTextAlign
CreateRectRgn
GetClipRgn
CreatePen
SetBkColor
GetBkColor
CreatePalette
StartDocA
EndDoc
StrokePath
ExtCreatePen
SetTextColor
ExtTextOutW
ExtTextOutA
SelectClipRgn
IntersectClipRect
SetTextAlign
SetBkMode
EnumFontFamiliesA
GetObjectType
GetClipBox
GetSystemPaletteEntries
FillPath
Rectangle
LPtoDP
SetViewportOrgEx
BitBlt
CreateSolidBrush
CreateMetaFileA
SetWindowOrgEx
SetWindowExtEx
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
CreateFontIndirectA
GetTextMetricsA
GetTextExtentPointA
SelectPalette
RealizePalette
CreateCompatibleDC
GetDeviceCaps
CreateDIBSection
DeleteDC
GetObjectA
SaveDC
RestoreDC
PolyBezierTo
BeginPath
SetPolyFillMode
MoveToEx
LineTo
EndPath
SelectClipPath
CreateCompatibleBitmap
GdiFlush
SetDIBitsToDevice
StretchDIBits
SelectObject
DeleteObject
StartPage
EndPage
GetStockObject

comdlg32

PrintDlgA

advapi32

RegDeleteValueA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumValueA
RegQueryValueExA
RegCreateKeyA

ole32

CoFreeUnusedLibraries
CoUninitialize
CoInitialize
OleSaveToStream
WriteClassStm
OleLoadFromStream
CreateDataAdviseHolder
OleRegGetMiscStatus
CreateOleAdviseHolder
OleRegGetUserType
OleRegEnumVerbs
CoCreateInstance
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CreateBindCtx

oleaut32

SysFreeString
SysAllocStringLen
VarUI4FromStr
RegisterTypeLi
SysAllocString
SysStringLen
LoadRegTypeLi
VariantClear
OleCreatePropertyFrame
VariantInit
SafeArrayUnlock
SafeArrayLock
SafeArrayCreateVector
VariantChangeType
SysAllocStringByteLen
SysStringByteLen
LoadTypeLi

wsock32

setsockopt
gethostbyname
ioctlsocket
htons
htonl

wininet

InternetCloseHandle
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
InternetReadFile

urlmon

RegisterBindStatusCallback
HlinkSimpleNavigateToMoniker
CreateURLMoniker

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 712KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 835KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Dll/FlashSetup.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 501KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Dll/Garantia.txt
Dll/Tres.000
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 501KB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 9KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Joyas10.zip
.zip
Menu.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 627KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 103KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
autorun.inf

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

CODE Size: 587KB - Virtual size: 1.5MB

DATA Size: 11KB - Virtual size: 44KB

BSS Size: - Virtual size: 8KB

.idata Size: 5KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 88KB

.rsrc Size: 20KB - Virtual size: 68KB

.aspack Size: 17KB - Virtual size: 20KB

.adata Size: - Virtual size: 4KB

1fcba0f12b59daa1494fd78bed3f30f8

Headers

File Characteristics

Imports

kernel32

user32

ole32

comctl32

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 2KB

6a082b701a9bceb7e88df3f0123db9f9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

f6:5a:b8:96:56:ed:05:5b:f0:bb:fe:c7:6f:8f:f4:fc:1f:0c:f0:78Signer

Signature Validations

Verification

29/10/2012, 21:42 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

urlmon

version

winmm

oleaut32

dsound

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

mscms

ws2_32

Sections

.text Size: 4.0MB - Virtual size: 4.0MB

.rodata Size: 1KB - Virtual size: 1KB

.rdata Size: 905KB - Virtual size: 904KB

.data Size: 92KB - Virtual size: 182KB

.rodata Size: 1KB - Virtual size: 1KB

.rsrc Size: 356KB - Virtual size: 356KB

.reloc Size: 158KB - Virtual size: 157KB

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

CODE
Size: 587KB - Virtual size: 1.5MB

DATA
Size: 11KB - Virtual size: 44KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 5KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 88KB

.rsrc
Size: 20KB - Virtual size: 68KB

.aspack
Size: 17KB - Virtual size: 20KB

.adata
Size: - Virtual size: 4KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 2KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f6:5a:b8:96:56:ed:05:5b:f0:bb:fe:c7:6f:8f:f4:fc:1f:0c:f0:78
Signer

29/10/2012, 21:42
Valid: false

.text
Size: 4.0MB - Virtual size: 4.0MB

.rodata
Size: 1KB - Virtual size: 1KB

.rdata
Size: 905KB - Virtual size: 904KB

.data
Size: 92KB - Virtual size: 182KB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 356KB - Virtual size: 356KB

.reloc
Size: 158KB - Virtual size: 157KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

df:50:46:f4:8f:31:e4:28:26:c7:2b:de:ba:c6:9a:58:58:a2:a9:1c
Signer

24/09/2011, 00:04
Valid: false

.text
Size: 5.7MB - Virtual size: 5.7MB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 199KB - Virtual size: 1.1MB

.rodata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 313KB - Virtual size: 312KB

.reloc
Size: 275KB - Virtual size: 274KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

4d:4a:a1:fd:f2:6f:9f:33:53:d6:26:14:ed:a6:62:37
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f3:fa:46:61:af:b0:33:f1:fe:93:1f:3a:91:b6:8f:be:7f:04:ad:4f
Signer

29/10/2012, 21:42
Valid: false