SS Tools SafePvP[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

SS Tools SafePvP.rar
Size

21.6MB
MD5

168d85cb9b30c2065a2bdaf704b2ddef
SHA1

4aed9ca176e5f9b9c5a5160cbb0b5c942ec59ea5
SHA256

6cc0505bc3d39f9806d605ba115dd302da1f485554ec44c9c96286f5ea34d909
SHA512

cd1bc78ee86480ac10f6af86254b4dd7f230d312ff403bd0dd32d910997de5bab79f3cc8a81862bdc268173e32d067179a74fd68616d90f445bc721eb2a64547
SSDEEP

393216:na+3nVZeku6O6HTpwthhG239C8kQeJx8pYRdvptIQUmyjV7Cht74/YJbTZGRI:nPeILoYAAQeJxlpLyXyhGu

Score

10^/10

pyinstaller upx

Malware Config

Signatures

Nirsoft 2 IoCs

Processes:

resource	yara_rule
static1/unpack001/Srenshare tool/Tools/LastActivityView.exe	Nirsoft
static1/unpack001/Srenshare tool/Tools/USBDeview.exe	Nirsoft

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
static1/unpack001/Srenshare tool/Tools/RegScanner.exe	upx
static1/unpack001/Srenshare tool/Tools/UserAssistView.exe	upx

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
static1/unpack001/Srenshare tool/Tools/Kangaroo (1).exe	pyinstaller

Files

SS Tools SafePvP.rar
.rar
Srenshare tool/Atajos/$Recycle.Bin.lnk
.lnk
Srenshare tool/Atajos/Elementos recientes.lnk
.lnk
Srenshare tool/Atajos/Folder Options.lnk
.lnk
Srenshare tool/Atajos/Iconos.lnk
.lnk
Srenshare tool/Atajos/Prefetch.lnk
.lnk
Srenshare tool/Atajos/Regedit Ruta.txt
Srenshare tool/Atajos/Temp.lnk
.lnk
Srenshare tool/LandSS.exe
.exe windows x86

Code Sign

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

Issuer

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

17-08-2015 15:32

Not After

24-10-2018 08:08

Subject

CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=BW,C=DE,1.2.840.113549.1.9.1=#0c1263657274407068696c616e64726f2e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02-08-2011 10:00

Not After

02-08-2019 10:00

Subject

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

95:bd:ed:d0:08:8d:5b:ee:2a:50:02:dd:12:32:fb:89:14:f6:56:f3
Signer

Actual PE Digest

95:bd:ed:d0:08:8d:5b:ee:2a:50:02:dd:12:32:fb:89:14:f6:56:f3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=BW,C=DE,1.2.840.113549.1.9.1=#0c1263657274407068696c616e64726f2e636f6d

23-10-2018 16:44
Valid: true

Chain 1

CN=philandro Software GmbH,O=philandro Software GmbH,L=Stuttgart,ST=BW,C=DE,1.2.840.113549.1.9.1=#0c1263657274407068696c616e64726f2e636f6d

CN=GlobalSign CodeSigning CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: - Virtual size: 6.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 762B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.dummy
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_MEM_READ

.custom
Size: 470B - Virtual size: 512B

IMAGE_SCN_MEM_READ
Srenshare tool/Strings/- Strings/- Cracked/Avix.txt
Srenshare tool/Strings/- Strings/- Cracked/Gorilla.txt
Srenshare tool/Strings/- Strings/- Cracked/Harambe.txt
Srenshare tool/Strings/- Strings/- Cracked/Incognito.txt
Srenshare tool/Strings/- Strings/- Cracked/Kurium.txt
Srenshare tool/Strings/- Strings/- Cracked/Xerxes.txt
Srenshare tool/Strings/- Strings/- Demon/Demon 1.7.10.txt
Srenshare tool/Strings/- Strings/- Demon/Demon Client Names.txt
Srenshare tool/Strings/- Strings/- Demon/Demon Pago.txt
Srenshare tool/Strings/- Strings/- Demon/Demon.txt
Srenshare tool/Strings/- Strings/- Demon/Demon_Craked Novas.txt
Srenshare tool/Strings/- Strings/- J3Ultimate Cheat/Como detectar o J3Ultimate Cheat.txt
Srenshare tool/Strings/- Strings/- J3Ultimate Cheat/Imagem do arquivo.class Cheat do J3Ultimate.png
.png
Srenshare tool/Strings/- Strings/- Miscellaneous/- Modules.txt
Srenshare tool/Strings/- Strings/- Miscellaneous/- Pegar pro Inject.txt
Srenshare tool/Strings/- Strings/- Self Destruck por link/- Self Destruck por link.txt
Srenshare tool/Strings/- Strings/- Vape/#VapeSmasher.rar
.rar
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.06 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.07 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.23 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.47 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.49 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape 2.50 Cracked.txt
Srenshare tool/Strings/- Strings/- Vape/- Cracked/Vape por DLL.txt
Srenshare tool/Strings/- Strings/- Vape/- Vape Lite/Vape Lite.txt
Srenshare tool/Strings/- Strings/- Vape/- Vape Lite/Vape Pago Como Pegar.txt
Srenshare tool/Strings/- Strings/- Vape/Vape Método Antigo/Vape SS (old).txt
Srenshare tool/Strings/- Strings/- Vea/Antigo Vea (V1).txt
Srenshare tool/Strings/- Strings/- Vea/New Vea.txt
Srenshare tool/Strings/- Strings/- Vea/Novo Vea (V2 to V8).txt
Srenshare tool/Strings/- Strings/- Vea/Vea V8 Cracked.txt
Srenshare tool/Strings/- Strings/AV Client.txt
Srenshare tool/Strings/- Strings/Antigo Vea (V1).txt
Srenshare tool/Strings/- Strings/Avix.txt
Srenshare tool/Strings/- Strings/Bape (Trump).txt
Srenshare tool/Strings/- Strings/Batty's Coordinates.txt
Srenshare tool/Strings/- Strings/Bit Client.txt
Srenshare tool/Strings/- Strings/Brpkscore.txt
Srenshare tool/Strings/- Strings/Children.txt
Srenshare tool/Strings/- Strings/Cyanide.txt
Srenshare tool/Strings/- Strings/Demon Cracked.txt
Srenshare tool/Strings/- Strings/Demon.txt
Srenshare tool/Strings/- Strings/Demon_Craked Novas.txt
Srenshare tool/Strings/- Strings/Drek.txt
Srenshare tool/Strings/- Strings/EMOD v2.txt
Srenshare tool/Strings/- Strings/Fitchi.txt
Srenshare tool/Strings/- Strings/Fusk.txt
Srenshare tool/Strings/- Strings/Gorilla.txt
Srenshare tool/Strings/- Strings/Gucci.txt
Srenshare tool/Strings/- Strings/Harambe.txt
Srenshare tool/Strings/- Strings/Hillary Rodham Clinton.txt
Srenshare tool/Strings/- Strings/Hittler.txt
Srenshare tool/Strings/- Strings/J3 Ultimate Client.txt
Srenshare tool/Strings/- Strings/Kurium.txt
Srenshare tool/Strings/- Strings/Lowser Client.txt
Srenshare tool/Strings/- Strings/Majenta.txt
Srenshare tool/Strings/- Strings/MisPlace.txt
Srenshare tool/Strings/- Strings/MotionBlur Misplace.txt
Srenshare tool/Strings/- Strings/Nero ghost.txt
Srenshare tool/Strings/- Strings/Novo Vea (V2 to V8).txt
Srenshare tool/Strings/- Strings/ONETAP.txt
Srenshare tool/Strings/- Strings/Optfine Client.txt
Srenshare tool/Strings/- Strings/Phantom Client.txt
Srenshare tool/Strings/- Strings/Shadow Inject Client.txt
Srenshare tool/Strings/- Strings/TcpNoDelay Edit.txt
Srenshare tool/Strings/- Strings/Time Changer-1.0 Private 97.txt
Srenshare tool/Strings/- Strings/Time changer bcz.txt
Srenshare tool/Strings/- Strings/TimeChanger Misplace 1.01.txt
Srenshare tool/Strings/- Strings/Trump.txt
Srenshare tool/Strings/- Strings/Vape 2.06 Crack.txt
Srenshare tool/Strings/- Strings/Vape 2.47.txt
Srenshare tool/Strings/- Strings/Vape 2.49 Cracked.txt
Srenshare tool/Strings/- Strings/Vape 2.50.txt
Srenshare tool/Strings/- Strings/Vape v3.txt
Srenshare tool/Strings/- Strings/Veiv.txt
Srenshare tool/Strings/- Strings/Velt client.txt
Srenshare tool/Strings/- Strings/Wetnoodle.txt
Srenshare tool/Strings/- Strings/Willy Client.txt
Srenshare tool/Strings/- Strings/Xerxes.txt
Srenshare tool/Strings/- Strings/Zuiy.txt
Srenshare tool/Strings/- Strings/_Strings-
Srenshare tool/Strings/- Strings/v5 JensDE.txt
Srenshare tool/Tools/Everything-1.4.1.935.x86-Setup.exe
.exe windows x86

32f3282581436269b3a75b6675fe3e08

Code Sign

0a:e7:db:92:ca:a8:6c:bd:f8:67:91:73:35:fb:f8:60
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02-11-2018 00:00

Not After

31-12-2019 12:00

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:7b:05:64:d1:99:30:2b:69:50:90:95:93:ce:81:5c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02-11-2018 00:00

Not After

08-01-2020 12:00

Subject

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c1:01:59:ea:a9:1c:0f:45:eb:36:6b:05:b5:cd:2d:c9:ae:28:8e:61:a1:24:3f:9b:85:b2:b7:0e:01:ec:0f:2b
Signer

Actual PE Digest

c1:01:59:ea:a9:1c:0f:45:eb:36:6b:05:b5:cd:2d:c9:ae:28:8e:61:a1:24:3f:9b:85:b2:b7:0e:01:ec:0f:2b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

18-02-2019 02:00
Valid: true

Chain 1

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

fa:d4:b4:f0:fc:96:e3:bd:2b:d7:39:d5:38:f2:5b:3f:b0:42:10:b5
Signer

Actual PE Digest

fa:d4:b4:f0:fc:96:e3:bd:2b:d7:39:d5:38:f2:5b:3f:b0:42:10:b5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=voidtools,O=voidtools,L=Wilmington,ST=South Australia,C=AU

18-02-2019 02:00
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Srenshare tool/Tools/Jitter Click Training-How fast can you click in 10 seconds-.url
.url
Srenshare tool/Tools/Kangaroo (1).exe
.exe windows x86

4df47bd79d7fe79953651a03293f0e8f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
SetDllDirectoryW
GetModuleFileNameW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
LoadLibraryExW
GetShortPathNameW
FormatMessageW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetCommandLineA
ReadFile
CreateFileW
GetDriveTypeW
GetFileType
CloseHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
GetFullPathNameA
CreateDirectoryW
RemoveDirectoryW
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
SetConsoleCtrlHandler
DeleteFileW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleCP
CompareStringW
LCMapStringW
GetCurrentDirectoryW
FlushFileBuffers
SetEnvironmentVariableA
GetFileAttributesExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
GetProcessHeap
WriteConsoleW
GetTimeZoneInformation
HeapSize
HeapReAlloc
SetEndOfFile
RaiseException

ws2_32

ntohl

Sections

.text
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Srenshare tool/Tools/LastActivityView.exe
.exe windows x86

8e0ee8bdfc37e806f77196a49dba6058

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-09-2014 00:00

Not After

12-09-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30-03-2016 00:00

Not After

30-06-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f3:2b:56:05:4d:1f:65:ff:8f:74:d7:b3:04:c8:ca:d7:42:10:01:4b:1d:4f:f9:60:ea:3e:cf:94:ec:ed:5d:20
Signer

Actual PE Digest

f3:2b:56:05:4d:1f:65:ff:8f:74:d7:b3:04:c8:ca:d7:42:10:01:4b:1d:4f:f9:60:ea:3e:cf:94:ec:ed:5d:20

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

03-06-2018 08:26
Valid: true

Chain 1

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

ce:64:88:67:c4:67:47:3c:46:78:5f:a3:63:d8:16:13:63:d9:f4:55
Signer

Actual PE Digest

ce:64:88:67:c4:67:47:3c:46:78:5f:a3:63:d8:16:13:63:d9:f4:55

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

03-06-2018 08:26
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p__fmode
exit
_cexit
_XcptFilter
_exit
_c_exit
_onexit
__dllonexit
_msize
__set_app_type
_controlfp
_except_handler3
_wcmdln
calloc
realloc
_wcslwr
strlen
_purecall
_itow
_wcsnicmp
qsort
modf
_memicmp
_wtoi
memcmp
wcstoul
wcsrchr
swscanf
malloc
_ultow
wcscmp
free
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy
wcslen
wcscpy
memset
_wcsicmp
wcschr
_snwprintf
wcscat
wcsncat

comctl32

CreateStatusWindowW
CreateToolbarEx
ImageList_SetImageCount
ImageList_Create
ord17
ImageList_Add
ImageList_AddMasked

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

ExitProcess
ReadProcessMemory
QueryDosDeviceW
GetVolumeInformationW
GetLogicalDrives
GetLongPathNameW
OpenProcess
EnumResourceTypesW
GetModuleHandleA
GetStartupInfoW
GetProcAddress
GetCurrentProcessId
SetErrorMode
DeleteFileW
CloseHandle
GetFileSize
SystemTimeToFileTime
FileTimeToSystemTime
CompareFileTime
GetSystemTimeAsFileTime
GetDriveTypeW
FreeLibrary
GetModuleHandleW
LoadLibraryW
GetTickCount
GetWindowsDirectoryW
ExpandEnvironmentStringsW
GetLastError
GetCurrentProcess
GetDateFormatW
FindNextFileW
SizeofResource
GetTempFileNameW
GlobalLock
FormatMessageW
FindFirstFileW
GetVersionExW
FindClose
GetTimeFormatW
GetFileAttributesW
FileTimeToLocalFileTime
ReadFile
FindResourceW
WriteFile
GetModuleFileNameW
LocalFree
LoadResource
CreateFileW
TzSpecificLocalTimeToSystemTime
LockResource
SystemTimeToTzSpecificLocalTime
lstrcpyW
MultiByteToWideChar
lstrlenW
LocalFileTimeToFileTime
LoadLibraryExW
GlobalAlloc
GetSystemDirectoryW
GlobalUnlock
WideCharToMultiByte
GetTempPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle

user32

ChildWindowFromPoint
LoadCursorW
SetCursor
GetSysColorBrush
ShowWindow
GetDlgItemInt
SetDlgItemInt
DeferWindowPos
CreateWindowExW
BeginPaint
EndPaint
GetWindow
GetClientRect
SendDlgItemMessageW
DrawFrameControl
EndDialog
SetWindowLongW
GetDlgItem
SetWindowTextW
UpdateWindow
SendMessageW
SetDlgItemTextW
InvalidateRect
GetDlgItemTextW
GetWindowRect
GetSystemMetrics
RegisterClassW
PostMessageW
MessageBoxW
TranslateAcceleratorW
SetMenu
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
LoadImageW
GetSysColor
GetWindowLongW
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
KillTimer
SetTimer
GetParent
GetClassNameW
MoveWindow
OpenClipboard
CheckMenuItem
GetMenuStringW
GetMenuItemCount
CloseClipboard
CheckMenuRadioItem
SetClipboardData
EnableWindow
GetCursorPos
MapWindowPoints
GetMenu
GetSubMenu
GetDC
EmptyClipboard
EnableMenuItem
ReleaseDC
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
DestroyWindow
LoadStringW
GetDesktopWindow
GetWindowTextW
LoadMenuW
DestroyIcon
LoadIconW
IsDialogMessageW
TranslateMessage
DrawTextExW
GetKeyState
RegisterWindowMessageW
TrackPopupMenu
PostQuitMessage
GetMessageW
DispatchMessageW
CreatePopupMenu
CallWindowProcW

gdi32

CreateFontIndirectW
SetTextColor
DeleteObject
GetPixel
DeleteDC
SetBkMode
SetBkColor
GetStockObject
GetTextExtentPoint32W
GetDeviceCaps
SetPixel
SelectObject
CreateCompatibleDC
GetObjectW

comdlg32

FindTextW
GetSaveFileNameW

advapi32

RegCloseKey
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
OpenServiceW
OpenSCManagerW
ControlService
StartServiceW
QueryServiceStatus
CloseServiceHandle
RegConnectRegistryW

shell32

SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHBindToParent
SHGetDesktopFolder
SHGetMalloc

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantTimeToSystemTime

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Srenshare tool/Tools/Paladin.exe
.exe windows x64

865f1a2a60fe8bf4d5c492f9cf2e0817

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:7b:88:08:fd:b4:83:37:9e:9a:a8:96:36:f7:75:bd
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-08-2019 00:00

Not After

27-08-2020 12:00

Subject

SERIALNUMBER=2929496-2,CN=Monelite,O=Monelite,L=Puuppola,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:45

Not After

15-04-2021 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:aa:37:55:8d:72:66:e1:87:69:56:fb:68:82:fb:c2
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-08-2019 00:00

Not After

27-08-2020 12:00

Subject

SERIALNUMBER=2929496-2,CN=Monelite,O=Monelite,L=Puuppola,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:64:91:b7:d4:5b:e7:4f:ec:63:06:0e:b8:2f:63:ec:99:0b:af:95:a7:51:c3:c0:44:5b:7f:2e:bb:ad:14:86
Signer

Actual PE Digest

44:64:91:b7:d4:5b:e7:4f:ec:63:06:0e:b8:2f:63:ec:99:0b:af:95:a7:51:c3:c0:44:5b:7f:2e:bb:ad:14:86

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2929496-2,CN=Monelite,O=Monelite,L=Puuppola,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

10-10-2019 18:30
Valid: true

Chain 1

SERIALNUMBER=2929496-2,CN=Monelite,O=Monelite,L=Puuppola,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

d9:12:a7:63:4e:a3:07:15:53:fb:7c:d5:11:3d:ef:6a:ec:03:eb:63
Signer

Actual PE Digest

d9:12:a7:63:4e:a3:07:15:53:fb:7c:d5:11:3d:ef:6a:ec:03:eb:63

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2929496-2,CN=Monelite,O=Monelite,L=Puuppola,C=FI,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024649

10-10-2019 18:30
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d9

Direct3DCreate9

wintrust

WinVerifyTrust

ws2_32

htons

crypt32

CertFreeCertificateChain

wldap32

ord27

normaliz

IdnToAscii

user32

SetClipboardData
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW

ole32

CoCreateInstance

oleaut32

VariantInit

kernel32

GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

OpenServiceA

shell32

ShellExecuteA

ntdll

NtReadVirtualMemory

imm32

ImmReleaseContext

wtsapi32

WTSSendMessageW

Exports

Exports

vg�|)#�5x��<�l[��(�be��o��1D�n��(��5- ݑ}�.LU�5��0t~�r �P�»� ��+{Œ��b��Oug�%�?=Š�4y/z"��يj��y��^y��{�)6��4�`��M��KE9��D��vWk��mj�5��/��n<F��VM]��+bX34�_��u�O��]!:_R�>݇q��m ��Ct��v��H��A�U�د�Hy�8��?ӓ�-� o��6hG�Բj�;�keM�i�4��*��r�g�^��ϋDK�}y�W�sĜ��O�Bχ(e�D�2r_ ��H(��&� 63��d�t~�Z��B�ʪ��Ü�;O��;Q��J%L@�\�8Qq瑬��ʃ3n�0U#n��I��" ap�L��Ӡ�I��nh�JB�c�+��.��{�(�y�[�Y>��]�X�ǀ�NWp��.$ƅ�~��ĎΦ�8��:��BEI��n3^ %M@��vxp̽�$�>mL �� l��{��F�(��kbY�S֌Y`*��(x�,B��n�f��^;�b�^d��;��m��YfYi��f#�Ϲ��2�;t�[�C��<r�Ϻ��}��$ҭ�Ŵ�+�n��)̸[��C�P2K5��Sw�\R�x;"�O�^h@�p�/�f�98@a�b��8�Z��8Y}�e.��&!��sv֌��8]3�]�1&�� ^~��/u>�'=��6�"'�2��:-��O��Nm��*(�8�ϕ��6��ڍh��A��Ъ��o/C��R@䷜1O/@4��2Ȏ�J.��&��Φ�To��q��]\��h�xׅT��dI��K��'[BU�ߩ5XbN�y�ҫ�G�++��r��7�}1��"z9� ?��%�ׯ�-�ܖv��A�MO8� � �3��Y�S]�?h��s;�Z!�H bvB�24�dO��>��VI�g�H�b��e`ڰ >�--��V!Hf�"��]��ii��b��j�G.��:s�Q�S��(�s�7 2u�ɺ&��Iu.IlL*�Y��X�9��?��X��B@ ��{~{�� G�~|��aRBC�}�ʽ�j.G��;�b��z}�u�j�:�C��^u�N#=C��Šb;K2��ѐ}A\o^��J4�2��=b��[ɛx��:J��x�T ��l�jd��Y̔��)�;��m@��{� ��N�gp�* r(��m�j)��.a�7��w��t�.G��"��U�:Q#͓��c�|��瞠�|��5�x;�z)�wMN��ف�"Љ�ⶔ��_� Ϲek��=z�}�`Q��<K�K '"��_~�6I:pq��=)~�COD"7��lM�&b��k]�c��Ya��XI\xZ��H�d��E��D2j;��u,V� ęv�ؠ� !�EDH ��-D�Ndʐ�E �v��[e�H�"A��ʠ��l�_��#͎�:�^�S��g��3M�9sK��Ӏ��~õ2�J�ο��4�KB�[b� �6O��JH�-��~ѡ��M�ܒF��l��W��CJ�v�F��u?/vk��ƄA�-�u �2��Kg�La-��}�D�F��J��æ�9c��:��f�ն`W=��1/��/��i��ޯB0w��(�c"y&��m�z��B��O��ۤ��ʏ"��KL[�Lڮȿ��h�{��K�L%�e�^�nmb�� P{9r��i_!��j��0�˚.vE�'c0�!H_+�J�C��+;��~��W��=��~11�)��Ws��&��d/1�`��&:a'��sã$M��_��"W��~KH��˳?OZL��.�tQWP�4�9�g�x�r��~�SC�ф0"��z�Lv&��w5IÚ*>��41U��p�D�f��j��T>9�bV) u��#�*�s/��8��ܗrEL�b�:M�>��] ik��J.efL�yI��䊣��T��eX��^�)a�vԆ�N�;�Uo��D��X��4�]Ht�X�o�\��vP��Y��o��ȆΛ��P.*�|�E*0Ά��F�gۊe�'��'f��>_�p�֕e~=�z>폣�3��m��z��x�w��u>��D[��瓊a�y��'��c %��^�N>(c~��S�si��I��ʿ�K� y4�tt{�g�܀_��r�i�P(��ڌF�.��T��-7��.��U�M;{�ͥ��L��}�>��0T/%�Q�n�W��.��f�h��K��d��.�B�k��/'�%D�~<+��umCML��1k˪4�ڬɳ��:��@e`�Z#|5�dr;;O��S~Sc��@��o�CQ�A�Tp��e/��=�$��V5��Ug�ʛ��HzS5"��;��>�qhR�@䷫(��Y��D99��8� #�~��pY�ǫ�,��V>�ک�t�ڵ ��y��V�a�J?ˈ�%�A˩�e1"��,��w;pB��G��:0��6c��E��ȁ�'>1 ��XZB�.#��0)��" b�z�cXwI��%t B��!J�j!y�d��r��uɩU�# ��d��M�i^��e��?п�`��w��-5�X�� #ᇳ̓}ik�L�2{j�Cu<'Z�Lo��v!�z�k��a�f i�G:ꕒ��q��P�G��#}_��iē.�>q=ɵ٭J��'�_��&20��O0$ J�M\El,�)��Y��d��gȓ��ٔ�Ty�ER!�@UD�Lh�Y�6ۦk4��L��VH;�.��W��< ��b^ ��R�m�Z��Cu�/��X4��g��_b3�Q̈��yJ,�ya�qSOr��" ��,�

Sections

.text
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pld0
Size: - Virtual size: 5.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pld1
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Srenshare tool/Tools/Process Hacker 2.lnk
.lnk
Srenshare tool/Tools/RegScanner.exe
.exe windows x86

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-09-2014 00:00

Not After

12-09-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30-03-2016 00:00

Not After

30-06-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

0a:e2:53:e5:da:3f:e8:c4:62:50:2b:ba:47:56:b6:1d:55:05:77:0c:89:90:d4:37:66:dc:77:6d:5a:1a:b0:86
Signer

Actual PE Digest

0a:e2:53:e5:da:3f:e8:c4:62:50:2b:ba:47:56:b6:1d:55:05:77:0c:89:90:d4:37:66:dc:77:6d:5a:1a:b0:86

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

22-05-2018 11:02
Valid: true

Chain 1

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

73:37:f6:c9:d3:1a:80:b0:96:f4:7e:c6:56:37:79:66:f2:bd:48:d5
Signer

Actual PE Digest

73:37:f6:c9:d3:1a:80:b0:96:f4:7e:c6:56:37:79:66:f2:bd:48:d5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

22-05-2018 11:02
Valid: false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 41KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Srenshare tool/Tools/USBDeview.exe
.exe windows x64

2972774eeebfb89daabb7439aa6afc0a

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07-06-2005 08:09

Not After

30-05-2020 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24-08-2011 00:00

Not After

30-05-2020 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

12-09-2014 00:00

Not After

12-09-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

30-03-2016 00:00

Not After

30-06-2019 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09-05-2013 00:00

Not After

08-05-2028 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

23:37:ce:66:5e:38:a8:77:36:2d:42:34:2d:0e:a5:5a:85:74:fc:c8:b3:8d:4a:20:e2:8b:94:11:a0:fb:e9:f3
Signer

Actual PE Digest

23:37:ce:66:5e:38:a8:77:36:2d:42:34:2d:0e:a5:5a:85:74:fc:c8:b3:8d:4a:20:e2:8b:94:11:a0:fb:e9:f3

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

15-06-2016 05:21
Valid: true

Chain 1

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

4f:52:09:50:d5:fe:c4:fe:ab:b6:1f:e7:67:84:64:44:a0:36:84:40
Signer

Actual PE Digest

4f:52:09:50:d5:fe:c4:fe:ab:b6:1f:e7:67:84:64:44:a0:36:84:40

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

15-06-2016 05:21
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__set_app_type
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_fmode
__dllonexit
_mbsrchr
atol
_mbschr
_snprintf
qsort
_strlwr
_mbsicmp
memmove
_commode
__setusermatherr
_initterm
__getmainargs
_onexit
_acmdln
_strnicmp
malloc
strtoul
free
modf
_strcmpi
memcmp
_memicmp
strchr
strrchr
strcmp
srand
rand
_strupr
abs
_itoa
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
memcpy
strlen
_purecall
atoi
_stricmp
strcpy
memset
strcat
strncat
sprintf

comctl32

ImageList_Create
ImageList_SetImageCount
CreateToolbarEx
ord6
ImageList_AddMasked

ws2_32

WSACleanup
WSAStartup
htons
WSAGetLastError
htonl
inet_addr
connect
WSAAsyncGetHostByName
WSAAsyncSelect
send
closesocket
WSASetLastError
socket
bind

kernel32

GetStartupInfoA
DeviceIoControl
GetCurrentThreadId
LocalFree
OpenProcess
GetTempFileNameA
GetModuleHandleA
GetCurrentProcess
ExitProcess
GetCurrentProcessId
ReadProcessMemory
CreateProcessA
Sleep
SetErrorMode
GetStdHandle
GetPrivateProfileIntA
EnumResourceNamesA
WritePrivateProfileStringA
WideCharToMultiByte
GlobalLock
GlobalAlloc
GetFileSize
LoadLibraryExA
CompareFileTime
WinExec
GetPrivateProfileStringA
FileTimeToSystemTime
GetProcAddress
LoadLibraryA
FreeLibrary
SystemTimeToFileTime
GetDiskFreeSpaceExA
GetLogicalDrives
GetWindowsDirectoryA
GetDriveTypeA
CloseHandle
DeleteFileA
CreateThread
CreateFileA
GetTickCount
WriteFile
ReadFile
FlushFileBuffers
GetTimeFormatA
GlobalUnlock
GetFileAttributesA
GetVersionExA
GetLastError
FormatMessageA
FileTimeToLocalFileTime
SystemTimeToTzSpecificLocalTime
GetTempPathA
GetModuleFileNameA
GetDateFormatA

user32

CheckMenuItem
SetForegroundWindow
IsDialogMessageA
TranslateMessage
KillTimer
GetKeyState
GetMessageA
DispatchMessageA
SetTimer
IsWindowVisible
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageA
DrawTextExA
FindWindowA
LoadIconA
LoadMenuA
GetMenuItemInfoA
EnumChildWindows
AttachThreadInput
EnumWindows
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
LoadCursorA
SetCursor
GetWindowRect
EndDialog
GetDlgItemInt
GetDlgItem
CreateWindowExA
EndPaint
InvalidateRect
SetDlgItemInt
BeginPaint
GetWindow
SetDlgItemTextA
GetClientRect
DrawFrameControl
GetDlgItemTextA
SetWindowTextA
GetSystemMetrics
DeferWindowPos
SendDlgItemMessageA
PostMessageA
SetMenu
LoadAcceleratorsA
SetWindowPos
DefWindowProcA
TranslateAcceleratorA
MessageBoxA
GetWindowPlacement
SendMessageA
RegisterClassA
UpdateWindow
LoadImageA
GetWindowLongA
SetWindowLongA
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
GetWindowTextA
ReleaseDC
GetDC
GetMenuItemCount
GetParent
GetMenuStringA
SetClipboardData
GetSubMenu
EnableWindow
GetClassNameA
MapWindowPoints
CloseClipboard
GetCursorPos
GetSysColor
MoveWindow
OpenClipboard
GetMenu
DestroyWindow
EmptyClipboard
EnableMenuItem
LoadStringA
ModifyMenuA
DialogBoxParamA
GetDlgCtrlID
DestroyMenu
CreateDialogParamA
GetWindowThreadProcessId

gdi32

GetTextExtentPoint32A
GetDeviceCaps
SelectObject
SetBkColor
GetStockObject
CreateFontIndirectA
SetBkMode
DeleteObject
SetTextColor

comdlg32

FindTextA
GetSaveFileNameA
ChooseFontA

advapi32

RegCreateKeyA
CryptCreateHash
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptAcquireContextA
RegUnLoadKeyA
RegConnectRegistryA
RegLoadKeyA
RegEnumKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegDeleteKeyA

shell32

ShellExecuteA
ShellExecuteExA
Shell_NotifyIconA

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Srenshare tool/Tools/UserAssistView.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Srenshare tool/Tools/luyten-0.4.5.exe
.exe windows x86

5c015bd7e84af79e092e9447b444a0b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA

kernel32

CloseHandle
CreateMutexA
CreateProcessA
ExitProcess
FindResourceExA
FormatMessageA
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetEnvironmentVariableA
GetExitCodeProcess
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GlobalMemoryStatusEx
LoadResource
LocalFree
LockResource
SetEnvironmentVariableA
SetLastError
SetUnhandledExceptionFilter
WaitForSingleObject

msvcrt

__getmainargs
__p__environ
__p__fmode
__set_app_type
_cexit
_chdir
_close
_findclose
_findfirst
_findnext
_iob
_itoa
_onexit
_open
_read
_setmode
_stat
atexit
atoi
fclose
fopen
fprintf
fwrite
memset
printf
signal
strcat
strchr
strcmp
strcpy
strlen
strncat
strncpy
strpbrk
strrchr
strstr
strtok

shell32

ShellExecuteA

user32

CreateWindowExA
DispatchMessageA
EnumWindows
FindWindowExA
GetMessageA
GetSystemMetrics
GetWindowLongA
GetWindowRect
GetWindowTextA
GetWindowThreadProcessId
KillTimer
LoadImageA
MessageBoxA
PostQuitMessage
SendMessageA
SetForegroundWindow
SetTimer
SetWindowPos
ShowWindow
TranslateMessage
UpdateWindow

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 35KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Code Sign

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2dCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:37:e8Certificate

Extended Key Usages

Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

95:bd:ed:d0:08:8d:5b:ee:2a:50:02:dd:12:32:fb:89:14:f6:56:f3Signer

Signature Validations

Verification

23-10-2018 16:44 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 10KB - Virtual size: 10KB

.itext Size: - Virtual size: 6.5MB

.rdata Size: 1024B - Virtual size: 762B

.data Size: 1.9MB - Virtual size: 1.9MB

.dummy Size: - Virtual size: 28KB

.reloc Size: 1024B - Virtual size: 768B

.rsrc Size: 29KB - Virtual size: 29KB

.custom Size: 470B - Virtual size: 512B

32f3282581436269b3a75b6675fe3e08

Code Sign

0a:e7:db:92:ca:a8:6c:bd:f8:67:91:73:35:fb:f8:60Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

02:7b:05:64:d1:99:30:2b:69:50:90:95:93:ce:81:5cCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66Certificate

Extended Key Usages

Key Usages

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1bCertificate

Extended Key Usages

Key Usages

c1:01:59:ea:a9:1c:0f:45:eb:36:6b:05:b5:cd:2d:c9:ae:28:8e:61:a1:24:3f:9b:85:b2:b7:0e:01:ec:0f:2bSigner

Signature Validations

Verification

18-02-2019 02:00 Valid: true

Chain 1

fa:d4:b4:f0:fc:96:e3:bd:2b:d7:39:d5:38:f2:5b:3f:b0:42:10:b5Signer

Signature Validations

Verification

18-02-2019 02:00 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

11:21:ea:a4:08:03:a9:22:6f:30:37:43:ee:53:7d:5c:d6:2d
Certificate

04:00:00:00:00:01:31:89:c6:37:e8
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

95:bd:ed:d0:08:8d:5b:ee:2a:50:02:dd:12:32:fb:89:14:f6:56:f3
Signer

23-10-2018 16:44
Valid: true

.text
Size: 10KB - Virtual size: 10KB

.itext
Size: - Virtual size: 6.5MB

.rdata
Size: 1024B - Virtual size: 762B

.data
Size: 1.9MB - Virtual size: 1.9MB

.dummy
Size: - Virtual size: 28KB

.reloc
Size: 1024B - Virtual size: 768B

.rsrc
Size: 29KB - Virtual size: 29KB

.custom
Size: 470B - Virtual size: 512B

0a:e7:db:92:ca:a8:6c:bd:f8:67:91:73:35:fb:f8:60
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

02:7b:05:64:d1:99:30:2b:69:50:90:95:93:ce:81:5c
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

c1:01:59:ea:a9:1c:0f:45:eb:36:6b:05:b5:cd:2d:c9:ae:28:8e:61:a1:24:3f:9b:85:b2:b7:0e:01:ec:0f:2b
Signer

18-02-2019 02:00
Valid: true

fa:d4:b4:f0:fc:96:e3:bd:2b:d7:39:d5:38:f2:5b:3f:b0:42:10:b5
Signer

18-02-2019 02:00
Valid: false

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.0MB

.rsrc
Size: 43KB - Virtual size: 43KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 125KB - Virtual size: 124KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 2KB - Virtual size: 57KB

.gfids
Size: 512B - Virtual size: 184B

.rsrc
Size: 130KB - Virtual size: 130KB

.reloc
Size: 6KB - Virtual size: 5KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

1a:f0:66:0e:83:7a:35:a2:cd:92:ec:61:3f:c1:5d:b8
Certificate

bd:1b:1e:45:0b:bd:d5:df:88:67:8e:7d:da:22:3d:17
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

f3:2b:56:05:4d:1f:65:ff:8f:74:d7:b3:04:c8:ca:d7:42:10:01:4b:1d:4f:f9:60:ea:3e:cf:94:ec:ed:5d:20
Signer

03-06-2018 08:26
Valid: true

ce:64:88:67:c4:67:47:3c:46:78:5f:a3:63:d8:16:13:63:d9:f4:55
Signer

03-06-2018 08:26
Valid: false