sigmaplot14[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

sigmaplot14.rar
Size

167.3MB
MD5

d4c009c1e8a793b9cc537fdf48ce04ef
SHA1

f80637b6c5dec462d8038ffe68b467bce692bd80
SHA256

7afd0200c3f7892c39ce2a606002cf586eeac2f049b669ebaba866b172bbe1e7
SHA512

831e0627e2fecaf9e1b0e2b21051d7922722629c072e1824003e3a19141823d5aebd2420a7e598d33f06ec5128c54c26a6a63c9ca5038cc5d34a15db5846ab98
SSDEEP

3145728:gyqLJAfu0Qx2/yAM/lIEECff4RNMkQyqiYvS76uTVR13SH:gzyE2apEV8a4vTm/iH

Score

1^/10

Malware Config

Signatures

Files

sigmaplot14.rar
.rar
sigmaplot14/Patch/Instructions.txt
sigmaplot14/Patch/SentinelU.dll
.dll windows x86

29b0c9117c43f6968380b8ad9e99656c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

hasp_windows_107466

ord23
ord13
ord14
ord15
ord17
ord6
ord7
ord4
ord22
ord16

mfc100

ord7144
ord13483
ord13480
ord13485
ord13482
ord13484
ord13481
ord3409
ord5238
ord11172
ord11180
ord4078
ord7355
ord9449
ord11184
ord11153
ord11787
ord4622
ord4903
ord11413
ord13181
ord10922
ord14075
ord1732
ord7091
ord11806
ord5095
ord8439
ord4881
ord5098
ord4625
ord4774
ord4606
ord6897
ord6898
ord6888
ord4772
ord3618
ord9281
ord8304
ord6112
ord4283
ord316
ord1982
ord1313
ord300
ord901
ord3839
ord2067
ord1316
ord310
ord7141
ord1288
ord888
ord6835
ord266
ord265
ord1294
ord1296
ord3676
ord8486
ord13299
ord7073
ord13301
ord11421
ord11420
ord2163
ord4724
ord13767
ord11726
ord7510
ord7584
ord5242
ord305
ord2626
ord7487
ord11781
ord7876
ord13125
ord11744
ord4144
ord11627
ord2611
ord1479
ord906
ord13518
ord2090
ord322
ord2052
ord2050
ord2079
ord1979
ord2040
ord3406
ord408
ord1948
ord2089
ord2087
ord1940
ord1867
ord1929
ord323
ord1297
ord7357

msvcr100

memcpy
fflush
memset
__clean_type_info_names_internal
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
?terminate@@YAXXZ
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
free
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__CxxFrameHandler3
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fclose
_CxxThrowException
setvbuf
fsetpos
fgetpos
_purecall
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
memmove
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
memcpy_s
fgetc
fputc
ungetc
_time64
_localtime64_s
atoi
_mktime64
_lock_file
_unlock_file
fwrite
_fseeki64

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
GetFileAttributesA
GetLastError
GetModuleFileNameA
CopyFileA
GetPrivateProfileStringA
WritePrivateProfileStringA
LocalFree
LocalAlloc
EncodePointer
DecodePointer
InterlockedExchange
Sleep
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection

shell32

SHGetFolderPathA

shlwapi

PathAppendA
PathFileExistsA

msvcp100

??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_BADOFF@std@@3_JB
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ

Exports

Exports

InitSentinel
IsNetworkLicense
SentinelGetExpiryTime
SentinelGetFingerPrintInfoXML
SentinelGetLicenseInfoXML
SentinelGetRecentLoginTime
SentinelGetSessionInfoXML
SentinelIsLicenseTampered
SentinelIsMIAnnualLicense
SentinelLogin
SentinelLoginRemote
SentinelLogout
SentinelSetLicenseTampered
SentinelSetRecentLoginTime
SentinelUpdate

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sigmaplot14/Patch/SigmaplotInstaller.exe
.exe windows x86

6ed9c3891c601138152f24a4aa07a422

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:c6:45:08:47:74:49:9e:c6:d4:c9:e8:f9:a0:fd:c8
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/09/2016, 00:00

Not After

22/10/2018, 23:59

Subject

CN=SYSTAT SOFTWARE INC.,O=SYSTAT SOFTWARE INC.,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:8a:1a:99:41:3e:17:bc:04:92:88:1b:46:71:87:76:34:2b:ac:9b
Signer

Actual PE Digest

d9:8a:1a:99:41:3e:17:bc:04:92:88:1b:46:71:87:76:34:2b:ac:9b

Digest Algorithm

sha1

PE Digest Matches

false

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=SYSTAT SOFTWARE INC.,O=SYSTAT SOFTWARE INC.,L=San Jose,ST=California,C=US

05/10/2017, 14:33
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

spwzdsu

ord36
ord35
ord31
ord30
ord2
ord21
ord17
ord22
ord16
ord15
ord14
ord13
ord12
ord11
ord10
ord3
ord9
ord7
ord8
ord6
ord5
ord4
ord32
ord20
ord19
ord18
ord34
ord29
ord33

sp~ijxsfu

ord23

sp~ejxsfu

ord28
ord26

sp~cs__fu

ord4
ord32
ord31
ord29
ord3
ord28
ord11
ord12

sp~gof5fu

ord20
ord19
ord9
ord13
ord10
ord8
ord12
ord4
ord3
ord6
ord5
ord1
ord14
ord28
ord22

sp~pagwfu

ord8
ord9
ord188
ord170
ord131
ord171
ord172
ord150
ord21
ord40
ord29
ord132
ord4
ord69
ord120
ord173
ord130
ord11
ord109
ord110
ord73
ord74
ord159
ord25
ord72
ord96
ord90
ord84
ord78
ord175
ord38
ord49
ord67
ord174
ord167
ord35
ord46
ord39
ord165
ord47
ord45
ord180
ord36
ord111
ord125
ord48
ord37
ord148
ord61
ord60
ord216
ord154
ord186
ord181
ord176
ord187
ord215
ord5
ord160

sp~dw__fu

ord262
ord258
ord265
ord263
ord259
ord261
ord301
ord302
ord300
ord181
ord56
ord57
ord65
ord208
ord172
ord45
ord183
ord207
ord34
ord166
ord185
ord67
ord251
ord250
ord184
ord188
ord66
ord217
ord260
ord49
ord84
ord150
ord125
ord54
ord55
ord4
ord3
ord123
ord61
ord226
ord6
ord177
ord176
ord178
ord198
ord199
ord196
ord197
ord200
ord195
ord161
ord160
ord218
ord219
ord221
ord222
ord203
ord204
ord228
ord227
ord230
ord229
ord232
ord266
ord264
ord249
ord46
ord47
ord59
ord44
ord43
ord38
ord237
ord205
ord206
ord231
ord234
ord233
ord236
ord235
ord225
ord80
ord267
ord171
ord213
ord142
ord92
ord164
ord240
ord242

sp~evalf

ord62
ord42
ord51
ord67
ord45
ord33
ord9
ord49
ord63
ord3
ord47
ord32
ord61
ord39
ord7
ord20
ord57
ord18
ord19
ord82
ord79
ord78
ord75
ord66
ord65
ord64
ord72
ord68
ord69
ord70
ord71

sp~hijaku

ord2
ord4

sp~tdl5fu

ord5
ord10
ord15
ord14
ord8
ord16
ord12
ord11
ord13
ord4

sp~cfitfu

ord69
ord41
ord23
ord111
ord68
ord51
ord93
ord25
ord24
ord52
ord105
ord96
ord94
ord104
ord27
ord56
ord35
ord43
ord45
ord54
ord7
ord22
ord31
ord109
ord3
ord70
ord65
ord40
ord37
ord30
ord21
ord61
ord26
ord13
ord63
ord62
ord87
ord103
ord102
ord72
ord99
ord36
ord53
ord14
ord15
ord18
ord16
ord17
ord95
ord97
ord58
ord66
ord8
ord38
ord39
ord76
ord50
ord49
ord48
ord47
ord42
ord114
ord113
ord12
ord71
ord107
ord100
ord73
ord79
ord44
ord57
ord80
ord67
ord64
ord116
ord59
ord106
ord89
ord81
ord85
ord74
ord82
ord86
ord75
ord60
ord84
ord10
ord110
ord91
ord92
ord90
ord115
ord88
ord11
ord29
ord28
ord20
ord19
ord101
ord34
ord33
ord32

sp~obj5fu

ord6
ord5
ord1
ord2

sp~ddm_fu

ord3
ord5
ord2
ord4
ord6
ord8

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Remove
ImageList_Destroy

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ter32_spw

ord32
ord17
ord773
ord109
ord28
ord155
ord112
ord557
ord508
ord407
ord351
ord779
ord214
ord128
ord193
ord495
ord333
ord594
ord782
ord770
ord131
ord570
ord116
ord213
ord130
ord468
ord781
ord180
ord145
ord680
ord123
ord492
ord129
ord71
ord607
ord135
ord97
ord538
ord775
ord127
ord620
ord11
ord14
ord12
ord13
ord59
ord163
ord497
ord496
ord210
ord618
ord746
ord623
ord483
ord19
ord776
ord93
ord47
ord55
ord356
ord53
ord18
ord400
ord16
ord164
ord15
ord118
ord769
ord771
ord20
ord173
ord64
ord24
ord165
ord54
ord439
ord622
ord337
ord48
ord774
ord40
ord316
ord120
ord92
ord10
ord30
ord768
ord772
ord67
ord106
ord245
ord105
ord31
ord98
ord87
ord51
ord52
ord99
ord33
ord121
ord68
ord169

sp~smthru

CreateSmootherEngine

iex_img

IEx_ErrorCode
IEx_SetImageOptions
IEx_SaveToEPS

sp~rtfwfu

ord62
ord70
ord11
ord30
ord10
ord144
ord150
ord145
ord143
ord31
ord20
ord133
ord134
ord148
ord135

statrn32

ST_OpenEnvironment
ST_DBGetSource
ST_DBSetParm
ST_DBReadSources
ST_SetWindowHandle
ST_CloseEnvironment

sentinelu

SentinelUpdate
SentinelLoginRemote
SentinelLogout
SentinelLogin
SentinelGetLicenseInfoXML
SentinelGetFingerPrintInfoXML
SentinelGetSessionInfoXML
IsNetworkLicense
SentinelIsMIAnnualLicense
SentinelIsLicenseTampered
SentinelGetRecentLoginTime
SentinelGetExpiryTime
SentinelSetRecentLoginTime
SentinelSetLicenseTampered

lmsysu

InitLMSys

uidllu

CreateLicenseInfo
ShowLicErrorMessage

shfolder

SHGetFolderPathW

sigmapropbrowseru

ord2
?ExpandAll@CPropertyGridCtrl@@QAEXH@Z
?UpdateNBMSummaryInfo@CPropertyGridCtrl@@QAEXV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@00KH@Z
?RemoveAll@CPropertyGridCtrl@@QAEXXZ
??1CPropertyGridCtrl@@UAE@XZ
??0CPropertyGridCtrl@@QAE@XZ
?MarkModifiedProperties@CPropertyGridCtrl@@QAEXHH@Z
?SetVSDotNetLook@CPropertyGridCtrl@@QAEXH@Z
?EnableDescriptionArea@CPropertyGridCtrl@@QAEXH@Z
?EnableHeaderCtrl@CPropertyGridCtrl@@QAEXHPB_W0@Z
?SetDescriptionRows@CPropertyGridCtrl@@QAEXH@Z

grandplandlgsu

ord8
ord11
ord16
ord10
ord13
ord15
ord14
ord7
ord9
ord5

owndu

ord1

mfc100u

ord14146
ord2417
ord7385
ord2884
ord2887
ord12606
ord5556
ord2756
ord2980
ord2981
ord3627
ord10412
ord10058
ord8179
ord11123
ord3380
ord12351
ord7618
ord2064
ord9525
ord10122
ord6711
ord6674
ord12595
ord6667
ord6323
ord6704
ord4100
ord8494
ord13329
ord5074
ord2119
ord286
ord3410
ord5229
ord11801
ord1310
ord2549
ord7054
ord1989
ord11494
ord7357
ord4511
ord277
ord2614
ord12147
ord7914
ord1440
ord1298
ord1944
ord761
ord6059
ord8346
ord9328
ord5302
ord5138
ord11467
ord13365
ord5239
ord13364
ord1203
ord920
ord1992
ord3879
ord342
ord2008
ord7524
ord7512
ord3978
ord7973
ord2067
ord4103
ord1176
ord723
ord1716
ord11568
ord4157
ord2062
ord2085
ord2040
ord11540
ord266
ord1344
ord1334
ord1346
ord265
ord1335
ord2409
ord779
ord3501
ord11248
ord2815
ord4861
ord6933
ord5225
ord771
ord3864
ord5637
ord4360
ord280
ord11838
ord11940
ord2066
ord1986
ord3846
ord5528
ord7399
ord4975
ord4102
ord2004
ord2620
ord13605
ord322
ord1019
ord13214
ord13220
ord4151
ord1476
ord469
ord7662
ord2629
ord285
ord5264
ord468
ord5889
ord5517
ord12798
ord12801
ord12153
ord1445
ord1446
ord13127
ord1270
ord1020
ord869
ord2018
ord5518
ord4150
ord11531
ord1313
ord7871
ord3503
ord1342
ord782
ord11530
ord290
ord968
ord13070
ord11516
ord12150
ord407
ord4512
ord1480
ord3169
ord7661
ord7664
ord2077
ord320
ord293
ord2063
ord1333
ord13047
ord6243
ord1297
ord898
ord4205
ord5113
ord6087
ord5440
ord10043
ord11206
ord10064
ord8118
ord10265
ord10352
ord9621
ord10199
ord10933
ord10936
ord10934
ord10935
ord11618
ord11619
ord6145
ord11210
ord2418
ord12610
ord5558
ord2184
ord11982
ord3971
ord2030
ord945
ord3703
ord4139
ord11998
ord796
ord374
ord3493
ord11999
ord1867
ord2068
ord6466
ord11365
ord1089
ord574
ord12029
ord11104
ord4415
ord4381
ord4377
ord4410
ord4432
ord4390
ord4418
ord4427
ord4398
ord4402
ord4406
ord4394
ord4423
ord4385
ord1517
ord1510
ord1506
ord8382
ord11194
ord13372
ord7350
ord7485
ord7418
ord7506
ord2360
ord4699
ord4824
ord4819
ord2382
ord3568
ord4269
ord11412
ord2893
ord8136
ord8090
ord13010
ord5640
ord7602
ord11909
ord7971
ord12946
ord2734
ord13244
ord10133
ord2918
ord10347
ord2300
ord3647
ord1759
ord4484
ord4489
ord2736
ord5613
ord12117
ord11139
ord3553
ord7962
ord13122
ord7322
ord12358
ord10192
ord8142
ord8106
ord2817
ord2936
ord2275
ord1805
ord10172
ord2675
ord10501
ord8425
ord8137
ord11600
ord12364
ord3552
ord4006
ord10285
ord13106
ord13863
ord13862
ord13859
ord12115
ord7080
ord4839
ord13470
ord8296
ord9093
ord3835
ord10536
ord13197
ord9257
ord10453
ord8145
ord10535
ord7895
ord6483
ord1102
ord681
ord605
ord12465
ord12856
ord12517
ord12869
ord6893
ord4774
ord12899
ord12338
ord5754
ord4634
ord5144
ord5091
ord3739
ord8096
ord7084
ord5642
ord5650
ord12681
ord2352
ord13124
ord12678
ord2705
ord12679
ord12622
ord1730
ord8870
ord8685
ord8163
ord2359
ord2562
ord4155
ord4178
ord4172
ord4183
ord13343
ord8080
ord11443
ord5670
ord4843
ord5035
ord13471
ord8822
ord5209
ord5206
ord9593
ord1727
ord4870
ord4865
ord13494
ord10289
ord8021
ord9706
ord9756
ord9850
ord13548
ord10767
ord8016
ord11691
ord5174
ord9127
ord4838
ord3788
ord8281
ord9258
ord8728
ord8302
ord5069
ord5060
ord8887
ord1143
ord2486
ord10532
ord5065
ord12802
ord13302
ord12095
ord12593
ord7929
ord12948
ord1654
ord6558
ord1656
ord6572
ord1652
ord6413
ord1650
ord6375
ord11475
ord3838
ord1947
ord4450
ord4802
ord5162
ord603
ord11536
ord7533
ord1608
ord10766
ord9704
ord6778
ord345
ord6036
ord11031
ord923
ord11030
ord6325
ord921
ord8266
ord2748
ord3436
ord897
ord5809
ord5468
ord3749
ord7901
ord2617
ord6870
ord5227
ord1296
ord3506
ord2195
ord12182
ord12871
ord4332
ord6475
ord1233
ord1096
ord826
ord591
ord5751
ord4633
ord5146
ord8094
ord10489
ord7081
ord10529
ord12098
ord12676
ord2701
ord8873
ord8681
ord11444
ord3475
ord5668
ord4840
ord5033
ord5205
ord9592
ord10288
ord9708
ord9759
ord9473
ord13547
ord9126
ord13550
ord8824
ord2912
ord3812
ord1624
ord10335
ord2492
ord8789
ord9382
ord590
ord12375
ord11984
ord4208
ord12152
ord12369
ord5156
ord3439
ord7231
ord12155
ord11555
ord1285
ord882
ord1479
ord4519
ord2407
ord8363
ord11115
ord2338
ord6155
ord11080
ord10305
ord10308
ord8640
ord8655
ord8645
ord9075
ord9080
ord8657
ord9562

msvcr100

div
wcscat_s
wcschr
localeconv
memset
qsort
_itow_s
wcstod
swprintf_s
_wcsicmp
_wcsnicmp
wcscpy_s
_CxxThrowException
__RTDynamicCast
iswspace
free
_wtof
_wtoi
wcsncpy_s
_CIsqrt
memcpy_s
_purecall
iswdigit
_finite
_isnan
_copysign
_wsplitpath_s
_findclose
_wfindfirst32
_gcvt_s
malloc
swscanf_s
wcsrchr
wcstoul
_errno
_CIcos
_CIasin
towlower
__CxxFrameHandler3
_CIpow
iswpunct
ceil
ldiv
_CItan
_CIatan
sprintf_s
fprintf
__iob_func
_wtmpnam_s
_fcvt_s
iswalnum
atoi
isdigit
_wasctime_s
isspace
strrchr
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_commode
_fmode
__set_app_type
_unlock
__dllonexit
_lock
_onexit
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_wspawnv
_wfullpath
wcsncmp
_wmakepath_s
strcat_s
strcpy_s
wcsstr
_localtime64_s
wcscspn
wcsftime
_wtol
_wcsdup
_time64
memcpy
_beginthreadex
_wgetenv_s
fseek
fgetws
_wctime32_s
_fstat32
_fileno
_wfopen_s
fclose
ftell
iswalpha
wcsncat_s
floor
_CIlog10
_ltow_s
calloc
towupper
_ultow_s
_time32
_wcsnset_s
rand
srand
_wgetdcwd
_CIfmod
memmove
_localtime32_s
wcstok_s
strstr
_fpreset
signal
_wgetcwd
_wchdir
_wsetlocale
_wremove
_wtempnam
ispunct
_get_tzname
getenv_s
_CIlog
_CIexp
strncmp
_CIsin

kernel32

GetProfileIntW
OutputDebugStringW
GetPrivateProfileStringA
lstrcpyA
GetProfileStringA
GetProfileStringW
RaiseException
LoadLibraryA
FindResourceW
LoadResource
SizeofResource
LockResource
FreeResource
ResumeThread
SetThreadPriority
Sleep
CreateEventW
SetEvent
ResetEvent
GetTempPathW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
GetExitCodeProcess
GetFileTime
CompareFileTime
GetPrivateProfileSectionW
WritePrivateProfileSectionW
LocalAlloc
LocalFree
GetVersionExW
CreateToolhelp32Snapshot
Process32NextW
GetCurrentDirectoryW
GetThreadLocale
GetStringTypeExW
SetCurrentDirectoryW
UnlockFile
CreateDirectoryW
SetFileAttributesW
CopyFileW
WinExec
GetFileAttributesW
WriteProfileStringW
CreateMutexW
WaitForSingleObject
GlobalGetAtomNameW
GlobalDeleteAtom
CreateFileW
CloseHandle
WritePrivateProfileStringW
FindFirstFileW
FindNextFileW
GetPrivateProfileStringW
ReadFile
GetVersion
GetCurrentProcessId
ActivateActCtx
GetLastError
DeactivateActCtx
SetLastError
GetModuleHandleW
GetWindowsDirectoryW
GetSystemDirectoryW
GetProcAddress
FreeLibrary
OpenFile
SetErrorMode
WriteFile
DeleteFileW
CreateProcessW
MoveFileExW
FormatMessageW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WritePrivateProfileStringA
GetCurrentThreadId
lstrcatA
InterlockedExchange
InterlockedCompareExchange
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
lstrcpynA
MulDiv
lstrcpynW
lstrlenW
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
GetModuleFileNameW
GetTimeFormatW
GetLocalTime
GetUserDefaultLCID
GetDateFormatW
FormatMessageA
GetSystemTime
GetFileSize
GetLocaleInfoW
SetFileTime
SystemTimeToFileTime
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
EnumTimeFormatsW
GetPrivateProfileIntW
EnumDateFormatsW
LoadLibraryW
lstrcatW
lstrcpyW

user32

GetDC
GetKeyboardLayout
IsRectEmpty
SetRectEmpty
GetCursorPos
CopyRect
DrawTextW
GetDesktopWindow
UnionRect
ShowWindow
FillRect
GetActiveWindow
GetComboBoxInfo
GetDlgCtrlID
GetFocus
GetClientRect
UpdateWindow
ReleaseDC
KillTimer
GetDlgItem
PostMessageW
CharNextW
MessageBeep
SetFocus
PtInRect
ClientToScreen
ScreenToClient
ModifyMenuW
GetSysColor
SystemParametersInfoW
GetSystemMetrics
GetAsyncKeyState
GetMessageW
ReleaseCapture
SetCapture
GetCapture
DrawEdge
InflateRect
InvalidateRect
IsWindow
IsIconic
RegisterClipboardFormatW
PeekMessageW
SendMessageW
GetParent
BringWindowToTop
IsWindowVisible
GetWindowRect
OffsetRect
PostQuitMessage
SendMessageA
RegisterWindowMessageW
DestroyWindow
DefWindowProcW
RegisterClassW
LoadCursorW
ValidateRect
SetRect
wsprintfW
EnableWindow
GetUpdateRect
EndPaint
BeginPaint
LoadBitmapW
EqualRect
CreateMenu
DestroyMenu
SetTimer
GetMenuState
CreateWindowExW
GetWindow
GetTopWindow
GetClassNameW
GetWindowLongW
CreatePopupMenu
AppendMenuW
GetClipboardFormatNameW
GetMenuItemCount
GetMenuItemID
GetSubMenu
InsertMenuW
GetMenuStringW
MapDialogRect
GetKeyState
DeleteMenu
LoadMenuW
IsZoomed
RedrawWindow
IsMenu
LoadStringW
GetWindowTextA
SetWindowTextA
SetWindowTextW
DrawFocusRect
SetForegroundWindow
SendDlgItemMessageW
IsWindowEnabled
GetSysColorBrush
IsCharAlphaW
CharUpperW
GetWindowThreadProcessId
SetWindowsHookExW
AdjustWindowRect
GetDialogBaseUnits
GetTabbedTextExtentW
UnpackDDElParam
ReuseDDElParam
SetWindowPlacement
UnregisterClassW
EnumClipboardFormats
InSendMessage
CopyAcceleratorTableW
GetWindowTextW
MoveWindow
IsChild
GetMessagePos
EmptyClipboard
SetClipboardData
MessageBoxA
RemovePropW
GetPropW
SetPropW
ShowCursor
LoadStringA
WinHelpW
SetWindowsHookW
CallNextHookEx
wvsprintfW
DrawMenuBar
UnhookWindowsHookEx
DrawIcon
CallWindowProcW
SetWindowLongW
SetCaretPos
GetMessageTime
TranslateMessage
DispatchMessageW
DestroyCursor
SetCursor
PostThreadMessageW
RemoveMenu
CheckMenuItem
GetClipboardData
CloseClipboard
IsClipboardFormatAvailable
OpenClipboard
EnableMenuItem
MessageBoxW
GetWindowPlacement
SetActiveWindow
ShowOwnedPopups
LoadImageW
LoadIconW

gdi32

GetStockObject
SetPixel
CreateFontIndirectW
CreatePen
StretchBlt
DPtoLP
PlayMetaFile
SetViewportExtEx
SetMapMode
DeleteEnhMetaFile
SetViewportOrgEx
SetWindowExtEx
SaveDC
CreateDCW
GetObjectType
SetROP2
SetDIBitsToDevice
RealizePalette
SelectPalette
CreatePalette
GetViewportExtEx
SetWindowOrgEx
GetMapMode
GetWindowOrgEx
CreateBitmap
GetEnhMetaFileW
DeleteMetaFile
RoundRect
Rectangle
GetTextMetricsW
ResizePalette
PatBlt
SetDIBColorTable
StretchDIBits
ResetDCW
GetTextExtentPointA
CopyMetaFileW
CopyEnhMetaFileW
GetMetaFileBitsEx
EndDoc
EndPage
PlayEnhMetaFile
GetEnhMetaFilePaletteEntries
StartPage
StartDocW
Escape
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
SetMetaFileBitsEx
GetMetaFileW
CloseMetaFile
CreateMetaFileW
CreateDIBSection
GetPaletteEntries
GetDIBColorTable
GetTextFaceW
ExtTextOutW
SetTextColor
EnumFontFamiliesExW
EnumFontFamiliesW
GetDeviceCaps
GetTextColor
GetBkColor
GetTextCharset
GetObjectW
SelectObject
CreateCompatibleBitmap
BitBlt
SetBkColor
CreateSolidBrush
DeleteObject
DeleteDC
GetTextExtentPoint32W
CreateCompatibleDC
TextOutW

comdlg32

CommDlgExtendedError

winspool.drv

DeviceCapabilitiesW

advapi32

RegOpenKeyExA
RegQueryValueW
RegSetValueExW
RegQueryInfoKeyW
RegCloseKey
RegOverridePredefKey
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExA
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW

shell32

ShellExecuteW
ShellExecuteExW
DragAcceptFiles
SHGetSpecialFolderPathA
DragQueryFileW

shlwapi

PathFileExistsW
SHSetValueA
SHGetValueA
PathFindExtensionW
PathAddExtensionW
PathRemoveExtensionW
PathAppendW
PathRemoveFileSpecW
SHDeleteKeyW

ole32

StgOpenStorage
CoGetTreatAsClass
CoTreatAsClass
SetConvertStg
ReadClassStg
GetConvertStg
CreateStreamOnHGlobal
CLSIDFromProgID
CoTaskMemFree
StringFromCLSID
StgCreateDocfile
WriteFmtUserTypeStg
WriteClassStg
OleSave
OleIsRunning
ProgIDFromCLSID
GetClassFile
OleLoad
CoGetMalloc
OleCreateMenuDescriptor

oleaut32

GetErrorInfo
LoadTypeLi
SafeArrayCreate
SafeArrayPutElement
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocStringLen
VariantChangeType
SysAllocString
SysFreeString
OleLoadPicture
VarUdateFromDate
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetElement
VariantCopyInd
VariantInit
VariantClear
SafeArrayGetDim
VariantCopy

oledlg

OleUIAddVerbMenuW

gdiplus

GdipCreateFromHDC
GdipDrawImageRectI
GdipDisposeImage
GdipCloneImage
GdipGetMetafileHeaderFromMetafile
GdipEmfToWmfBits
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateMetafileFromEmf

Exports

Exports

??0CFlatCombo@@QAE@XZ
??1CFlatCombo@@UAE@XZ
??_7CFlatCombo@@6B@
?AddString@CFlatCombo@@UAEHPB_W@Z
?DrawComboEdges@CFlatCombo@@IAEXPAVCDC@@@Z
?FindString@CFlatCombo@@UBEHHPB_W@Z
?FindStringExact@CFlatCombo@@UBEHHPB_W@Z
?FocusWnd@CFlatCombo@@SAPAVCWnd@@XZ
?GetLBText@CFlatCombo@@UAEXHAAV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@@Z
?GetMessageMap@CFlatCombo@@MBEPBUAFX_MSGMAP@@XZ
?GetThisMessageMap@CFlatCombo@@KGPBUAFX_MSGMAP@@XZ
?InsertString@CFlatCombo@@UAEHHPB_W@Z
?Offset@CFlatCombo@@IAEHXZ
?OnCloseup@CFlatCombo@@IAEXXZ
?OnCreate@CFlatCombo@@IAEHPAUtagCREATESTRUCTW@@@Z
?OnGetTTText@CFlatCombo@@IAEHIPAUtagNMHDR@@PAJ@Z
?OnGetdispinfo@CFlatCombo@@IAEXPAUtagNMHDR@@PAJ@Z
?OnLButtonDown@CFlatCombo@@IAEXIVCPoint@@@Z
?OnLButtonUp@CFlatCombo@@IAEXIVCPoint@@@Z
?OnMouseMove@CFlatCombo@@IAEXIVCPoint@@@Z
?OnMouseWheel@CFlatCombo@@IAEHIFVCPoint@@@Z
?OnNcLButtonDown@CFlatCombo@@IAEXIVCPoint@@@Z
?OnSetFocus@CFlatCombo@@IAEXPAVCWnd@@@Z
?OnSize@CFlatCombo@@IAEXIHH@Z
?OnToolHitTest@CFlatCombo@@UBEHVCPoint@@PAUtagTOOLINFOW@@@Z
?s_hwndFocus@CFlatCombo@@1PAUHWND__@@A

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 646KB - Virtual size: 646KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 49KB - Virtual size: 519KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 427KB - Virtual size: 427KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sigmaplot14/Read me.txt
sigmaplot14/SigmaplotInstaller.exe
.exe windows x86

eaefd1169420dcee9fef7c65aa268740

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:c6:45:08:47:74:49:9e:c6:d4:c9:e8:f9:a0:fd:c8
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

22/09/2016, 00:00

Not After

22/10/2018, 23:59

Subject

CN=SYSTAT SOFTWARE INC.,O=SYSTAT SOFTWARE INC.,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLastError
ResetEvent
CreateEventW
CloseHandle
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameW
FormatMessageW
LocalFree
GetWindowsDirectoryW
CreateFileW
SetFileTime
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
DeleteFileW
GetShortPathNameW
GetFullPathNameW
lstrlenW
GetCurrentDirectoryW
GetTempFileNameW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
SetEndOfFile
DeleteCriticalSection
GetStdHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
Sleep
LocalAlloc
SetCurrentDirectoryW
GetVersion
GetCommandLineW
CreateProcessW
GetExitCodeProcess
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryA
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
WaitForSingleObject
SetEvent
GetVersionExW
VirtualAlloc
WaitForMultipleObjects
VirtualFree
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
HeapFree
HeapAlloc
ExitThread
CreateThread
HeapReAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetModuleHandleW
GetProcAddress
ExitProcess
GetModuleFileNameA
TlsGetValue
TlsAlloc

user32

SetForegroundWindow
CharUpperW
DestroyWindow
RegisterWindowMessageW
AdjustWindowRect
LoadImageW
KillTimer
SetTimer
PostMessageW
EndDialog
IsDlgButtonChecked
SetDlgItemTextW
GetDlgItem
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
LoadStringW
DialogBoxParamW
CreateDialogParamW
SystemParametersInfoW
PeekMessageW
GetDesktopWindow
MessageBoxW
SendMessageW
GetWindowLongW
SetWindowLongW
ShowWindow
MoveWindow
GetWindowRect
LoadIconW

gdi32

GetObjectW

advapi32

RegSetValueExW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteExW
SHGetFolderPathW

ole32

CoInitialize
CoCreateInstance

oleaut32

SysAllocStringLen
SysFreeString
VariantClear
SysAllocString

Sections

.text
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
sigmaplot14/Video instructivo.mp4
sigmaplot14/_desktop.ini

Sharing

General

Malware Config

Signatures

Files

29b0c9117c43f6968380b8ad9e99656c

Headers

DLL Characteristics

File Characteristics

Imports

hasp_windows_107466

mfc100

msvcr100

kernel32

shell32

shlwapi

msvcp100

Exports

Exports

Sections

.text Size: 31KB - Virtual size: 31KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

6ed9c3891c601138152f24a4aa07a422

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

08:c6:45:08:47:74:49:9e:c6:d4:c9:e8:f9:a0:fd:c8Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

61:19:93:e4:00:00:00:00:00:1cCertificate

Key Usages

d9:8a:1a:99:41:3e:17:bc:04:92:88:1b:46:71:87:76:34:2b:ac:9bSigner

Signature Validations

Verification

05/10/2017, 14:33 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

spwzdsu

sp~ijxsfu

sp~ejxsfu

sp~cs__fu

sp~gof5fu

sp~pagwfu

sp~dw__fu

sp~evalf

sp~hijaku

sp~tdl5fu

sp~cfitfu

sp~obj5fu

sp~ddm_fu

comctl32

version

ter32_spw

sp~smthru

iex_img

sp~rtfwfu

statrn32

sentinelu

lmsysu

uidllu

shfolder

sigmapropbrowseru

grandplandlgsu

owndu

mfc100u

msvcr100

kernel32

user32

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

08:c6:45:08:47:74:49:9e:c6:d4:c9:e8:f9:a0:fd:c8
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

61:19:93:e4:00:00:00:00:00:1c
Certificate

d9:8a:1a:99:41:3e:17:bc:04:92:88:1b:46:71:87:76:34:2b:ac:9b
Signer

05/10/2017, 14:33
Valid: false

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 646KB - Virtual size: 646KB

.data
Size: 49KB - Virtual size: 519KB

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

.reloc
Size: 427KB - Virtual size: 427KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

08:c6:45:08:47:74:49:9e:c6:d4:c9:e8:f9:a0:fd:c8
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

.text
Size: 179KB - Virtual size: 178KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 9KB - Virtual size: 32KB

.rsrc
Size: 93KB - Virtual size: 93KB