PVZ[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PVZ.rar
Size

37.8MB
MD5

538f938078164f324885965b81af0f48
SHA1

2bfeaf8f1e50830de60b115588c268f106ff7dbf
SHA256

836460b45c4a7d79b0701af58e423d9d1b6665abb82fcbf9d25985f118635a2b
SHA512

1c1ba0adc03841c23c2c58f540924a55c2397e0636a97205e18e56494e5a92c066d96bbc1f3002915e9fef84d55696962a520d581ef11cb166e60a86808e8db9
SSDEEP

786432:ccKc/T/EwtTC+42BJsFE+6Z379p4HOdln7lP3QbktaRNBTCS9AwBip4g4Iu3dEV7:ccbT/E4+YOFQZ33X3B3no9fBpgQC3L

Score

1^/10

Malware Config

Signatures

Files

PVZ.rar
.rar
PVZ/Plantas Vs Zombies.exe
.exe windows x86

2da9090feb3b5ad189a8a38d81052da5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

43:82:85:c1:0d:2d:c2:61:06:cd:3b:63:61:fb:f5:2f:a8:41:3f:1b
Signer

Actual PE Digest

43:82:85:c1:0d:2d:c2:61:06:cd:3b:63:61:fb:f5:2f:a8:41:3f:1b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

08/10/2010, 19:59
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

ord17

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

kernel32

GetDiskFreeSpaceA
GetModuleFileNameA
GetModuleHandleA
GetVersionExA
LocalFree
DeleteFileA
CreateThread
LoadLibraryW
InterlockedDecrement
FindFirstFileW
LoadLibraryExW
FindClose
FindNextFileW
ExpandEnvironmentStringsW
lstrlenA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetProcessHeap
SetEndOfFile
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetStringTypeA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetSystemTimeAsFileTime
LoadLibraryA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
IsValidCodePage
GetOEMCP
GetACP
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetHandleCount
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStdHandle
GetFileType
VirtualAlloc
VirtualFree
HeapCreate
GetStringTypeW
ResetEvent
CopyFileA
GetProcAddress
GetLastError
CreateDirectoryA
MultiByteToWideChar
MulDiv
GetExitCodeProcess
CreateEventA
Sleep
TerminateThread
OpenProcess
GetWindowsDirectoryA
SetEvent
WaitForSingleObject
GetCurrentProcessId
GetCurrentProcess
FreeLibrary
GetSystemDirectoryA
WideCharToMultiByte
LocalFileTimeToFileTime
CloseHandle
SetFileAttributesA
SetFileTime
CreateFileA
DosDateTimeToFileTime
LCMapStringA
LCMapStringW
GetCPInfo
RaiseException
RemoveDirectoryA
HeapReAlloc
RtlUnwind
GetStartupInfoA
GetCommandLineA
ExitProcess
GetModuleHandleW
ResumeThread
ExitThread
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
ReadFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FindNextFileA
FindFirstFileA
CreateFileW
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
TerminateProcess

user32

ReleaseDC
EndDeferWindowPos
DestroyIcon
SetWindowTextW
DialogBoxParamA
EnableWindow
LoadStringW
SetWindowLongA
CharLowerA
EndPaint
GetClassNameA
SetTimer
GetWindowRect
SendDlgItemMessageA
FillRect
DrawTextW
KillTimer
DrawTextA
DrawIconEx
DialogBoxParamW
GetClientRect
SendMessageA
MapWindowPoints
BeginPaint
GetDC
DrawFocusRect
GetWindowTextA
GetWindowLongA
GetWindowTextW
CreateWindowExA
GetClassNameW
RegisterWindowMessageA
IsWindowUnicode
GetDlgItem
EndDialog
GetDesktopWindow
GetSysColor
SetWindowPos
EnumChildWindows
ShowWindow
GetSysColorBrush
IsDlgButtonChecked
IsWindow
PostMessageA
AdjustWindowRectEx
DeferWindowPos
MessageBoxW
BeginDeferWindowPos
GetSystemMetrics
SetWindowTextA
LoadImageA
SendMessageW

gdi32

GetTextExtentPoint32W
SetTextColor
DeleteDC
CreateFontA
GetDeviceCaps
SetBkColor
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateFontW
GetTextMetricsA
GetObjectA
GetStockObject
CreateSolidBrush
BitBlt

advapi32

RegOpenKeyA
SaferCloseLevel
RegDeleteKeyA
SaferComputeTokenFromLevel
RegCloseKey
SaferCreateLevel
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
RegQueryValueExA
RegSetValueExA
CreateProcessAsUserA

shell32

SHChangeNotify
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListW
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteExA
SHBrowseForFolderW

ole32

CoInitialize
CoUninitialize
StringFromGUID2
CoInitializeSecurity
CoCreateGuid
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
VariantInit
VariantClear

Sections

.text
Size: 379KB - Virtual size: 378KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PVZ/crack/PlantsVsZombies.exe
.exe windows x86

1960f341eacf7913682ed5ee0a61707d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

23/09/2009, 00:00

Not After

20/09/2012, 23:59

Subject

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:4d:97:dc:c2:cb:7d:d9:93:0c:96:d4:c5:d4:be:5a:8b:70:cc:09
Signer

Actual PE Digest

07:4d:97:dc:c2:cb:7d:d9:93:0c:96:d4:c5:d4:be:5a:8b:70:cc:09

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=PopCap Games,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=PopCap Games,L=Seattle,ST=Washington,C=US

08/10/2010, 19:58
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

rpcrt4

UuidCreate

wsock32

gethostbyname
WSAStartup
inet_addr

xlayout

GetXMLAttributeRaw
CreateLayoutComponentContainerPimpl
GetRequiredAttributeHelper
CreateEventListenerPimpl
CreateLayoutComponentBasePimpl
CreateExpression
StringToEventCode
CreateLayoutSystem
GetCommonDebugInfo
GetPositionInitialValuesHelper
CreateExpressionExtenderPimpl
CreateActionFromXMLElement
CreateComponentWidgetBasePimpl

dynamiccontentlib

CreateDynamicContentSystem

msvcp90

??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$allocator@D@std@@QAE@XZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??0?$allocator@_W@std@@QAE@XZ
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?rend@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$reverse_iterator@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@III_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXV?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@ID@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z

msvcr90

_fileno
_stricmp
_chdir
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
__CxxLongjmpUnwind
_except_handler4_common
_crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
labs
getenv
memchr
memcmp
iswspace
pow
fprintf
__iob_func
sqrt
calloc
ungetc
log10
longjmp
strcat
_vsnwprintf
realloc
_vsnprintf
strcmp
_getcwd
tolower
towupper
tan
fmod
fabs
wcsncmp
qsort
sin
cos
abs
floor
ceil
wcscpy
strcpy
strlen
_beginthreadex
_CxxThrowException
__CxxFrameHandler3
strstr
atoi
_errno
strerror
free
malloc
strncmp
srand
toupper
_chsize
rewind
ferror
fflush
memmove_s
memset
memcpy
isspace
ispunct
exit
memmove
_wcsicmp
fgetc
??_V@YAXPAX@Z
fwrite
fgets
fopen_s
feof
rand
_wfopen
_purecall
??0exception@std@@QAE@XZ
fclose
_invalid_parameter_noinfo
fread
ftell
fseek
_mkdir
_wmkdir
_wgetcwd
abort
_snprintf
_setjmp3
strtod
fopen
_time64
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??3@YAXPAX@Z
sscanf
__RTDynamicCast
sprintf
_invoke_watson

wininet

InternetSetOptionA
InternetConnectA
HttpOpenRequestA
InternetGetLastResponseInfoA
InternetCloseHandle
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetQueryOptionA
HttpAddRequestHeadersA
InternetOpenA

kernel32

LeaveCriticalSection
GetModuleFileNameA
GetModuleHandleA
EnumResourceNamesA
SetCurrentDirectoryA
SetThreadPriority
GetCurrentThread
OpenProcess
TerminateProcess
CloseHandle
GetCommandLineW
CreateMutexA
GetLastError
GetTickCount
SetFileAttributesA
GetCurrentProcessId
OpenEventA
CreateEventA
SetEvent
Sleep
DeleteFileW
MoveFileExW
FormatMessageA
LocalFree
GetVersionExA
GlobalLock
GlobalUnlock
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
GetProcAddress
GetWindowsDirectoryA
FreeLibrary
CreateFileA
CreateToolhelp32Snapshot
Process32First
Process32Next
DeleteFileA
GetExitCodeProcess
FindFirstFileW
FindClose
FindFirstFileA
InterlockedIncrement
InterlockedDecrement
IsBadWritePtr
CreateProcessA
ResumeThread
SetFileAttributesW
QueryPerformanceCounter
QueryPerformanceFrequency
GetModuleFileNameW
GetFullPathNameW
CreateProcessW
MoveFileExA
GetLogicalDriveStringsA
GetDriveTypeA
WaitForSingleObject
UnmapViewOfFile
CreateThread
CreateFileMappingA
MapViewOfFile
WriteProcessMemory
ReadProcessMemory
GetVolumeInformationA
VirtualAlloc
VirtualFree
ResetEvent
OpenFileMappingA
GlobalAlloc
MulDiv
FindNextFileA
GetFileTime
GetThreadPriority
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
CopyFileA
EnterCriticalSection

user32

IsWindowEnabled
AdjustWindowRect
GetCursorPos
MessageBeep
LoadCursorA
GetFocus
RegisterClassW
DialogBoxParamA
GetDlgItem
EndDialog
PostThreadMessageA
GetMessageA
PostThreadMessageW
CreateCursor
DestroyCursor
SetCursor
SetClipboardData
MessageBoxA
GetParent
GetQueueStatus
WindowFromPoint
ScreenToClient
BeginPaint
EndPaint
SetCapture
ReleaseCapture
DrawTextExW
GetForegroundWindow
FillRect
PostMessageA
MoveWindow
ReleaseDC
GetClientRect
GetDC
GetWindowRect
GetSystemMetrics
CloseClipboard
GetClipboardData
OpenClipboard
GetDesktopWindow
DefWindowProcA
SendMessageA
GetWindowLongA
SetTimer
SetClipboardViewer
SetWindowLongA
RegisterClassA
DispatchMessageA
TranslateMessage
PeekMessageA
MsgWaitForMultipleObjects
LoadImageA
MessageBoxW
DestroyWindow
SetActiveWindow
IsIconic
SetWindowPos
SetFocus
PostQuitMessage
RegisterWindowMessageA
DefWindowProcW
EnumDisplayMonitors
IntersectRect
GetWindowPlacement
IsWindowVisible
SetWindowTextA
GetWindowTextA
SetWindowTextW
CreateWindowExW
GetWindowTextW
GetWindowTextLengthA
IsWindowUnicode
SystemParametersInfoA
CreateWindowExA
IsWindow
GetWindowThreadProcessId
EnableWindow
BringWindowToTop
SetForegroundWindow
ShowWindow
EnumWindows

gdi32

CreateFontIndirectA
DeleteObject
GetTextExtentPoint32W
GetCharABCWidthsW
GetStockObject
GetObjectA
SetTextColor
TextOutW
SetDIBitsToDevice
StretchBlt
GetDeviceCaps
CreateFontA
GetTextMetricsA
DeleteDC
BitBlt
SelectObject
SetBkMode
CreateDIBSection
CreateCompatibleDC

advapi32

RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteA
ShellExecuteExW

ole32

CoInitializeSecurity
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetElement
VariantInit
SysAllocStringLen
SysStringLen
SysAllocStringByteLen
SysFreeString
SysAllocString
SysReAllocString
SafeArrayGetUBound
SafeArrayGetLBound
SysReAllocStringLen

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

Sections

.text
Size: 1012KB - Virtual size: 1012KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 247KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 238KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2da9090feb3b5ad189a8a38d81052da5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

43:82:85:c1:0d:2d:c2:61:06:cd:3b:63:61:fb:f5:2f:a8:41:3f:1bSigner

Signature Validations

Verification

08/10/2010, 19:59 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Sections

.text Size: 379KB - Virtual size: 378KB

.rdata Size: 60KB - Virtual size: 60KB

.data Size: 7KB - Virtual size: 21KB

.rsrc Size: 31KB - Virtual size: 31KB

1960f341eacf7913682ed5ee0a61707d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

07:4d:97:dc:c2:cb:7d:d9:93:0c:96:d4:c5:d4:be:5a:8b:70:cc:09Signer

Signature Validations

Verification

08/10/2010, 19:58 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

rpcrt4

wsock32

xlayout

dynamiccontentlib

msvcp90

msvcr90

wininet

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

Sections

.text Size: 1012KB - Virtual size: 1012KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

43:82:85:c1:0d:2d:c2:61:06:cd:3b:63:61:fb:f5:2f:a8:41:3f:1b
Signer

08/10/2010, 19:59
Valid: false

.text
Size: 379KB - Virtual size: 378KB

.rdata
Size: 60KB - Virtual size: 60KB

.data
Size: 7KB - Virtual size: 21KB

.rsrc
Size: 31KB - Virtual size: 31KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

60:f0:be:25:f0:28:bf:ed:b5:bd:f0:ce:5c:7a:9e:26
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

07:4d:97:dc:c2:cb:7d:d9:93:0c:96:d4:c5:d4:be:5a:8b:70:cc:09
Signer

08/10/2010, 19:58
Valid: false

.text
Size: 1012KB - Virtual size: 1012KB

.rdata
Size: 247KB - Virtual size: 247KB

.data
Size: 18KB - Virtual size: 238KB

.rsrc
Size: 217KB - Virtual size: 216KB

.reloc
Size: 76KB - Virtual size: 75KB