upload[.]zip[.]7z

Resubmissions

19-05-2023 19:41

230519-yd7lysfg36 8

03-02-2023 20:09

230203-yw7pnsba48 8

Sharing

Copy URL

Twitter E-mail

General

Target

upload.zip.7z
Size

64.6MB
MD5

90fa15a023f1e916748bbbc6462d9476
SHA1

e8048b00d95f2e45b1d4c845ef89ea074b131159
SHA256

7e3d87ad429823529ad981805578019f0b292bd886c7b401c0ef9b52f05d4b02
SHA512

eb819af44576cda3cc4d0df1cc94e2c9baaa3a6c576599fa1c104ff0fbc06e2308706b04b5da7efb5f760d9cd785f7a8bd519f4df88c328d4ba29c968bee8b38
SSDEEP

1572864:T5GTC8cyU93cU8txuAvh976E8MK1fXZNQtdE5uR6aUR6dp:T5UC8jUwtxzh6k4f4tdv6dED

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/graphpadprism8安装后-crack文件复制到安装目录\URET NFO v2.2.exe	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/graphpadprism8安装后-crack文件复制到安装目录\URET NFO v2.2.exe

Files

upload.zip.7z
.7z

Password: infected
upload.zip
.zip

Password: infected
graphpadprism8安装后-crack文件复制到安装目录\Crack\x64\prism.exe
.exe windows x64

Password: infected

3ef72d3f2bd2a84d0928535a95ba1a1c

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10-01-2019 00:00

Not After

09-01-2022 23:59

Subject

SERIALNUMBER=201729710129,CN=GraphPad Software LLC,O=GraphPad Software LLC,POSTALCODE=92037,STREET=7825 Fay Avenue\,Suite 230,L=La Jolla,ST=CA,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10-01-2019 00:00

Not After

09-01-2022 23:59

Subject

SERIALNUMBER=201729710129,CN=GraphPad Software LLC,O=GraphPad Software LLC,POSTALCODE=92037,STREET=7825 Fay Avenue\,Suite 230,L=La Jolla,ST=CA,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

67:a3:7a:76:ae:ed:e8:b2:1c:1d:b0:47:2d:7e:03:96:bb:1f:70:ee:53:f2:1e:1a:e5:bc:6f:b5:a1:2a:b7:21
Signer

Actual PE Digest

67:a3:7a:76:ae:ed:e8:b2:1c:1d:b0:47:2d:7e:03:96:bb:1f:70:ee:53:f2:1e:1a:e5:bc:6f:b5:a1:2a:b7:21

Digest Algorithm

sha256

PE Digest Matches

false

1a:dd:d3:61:74:39:a2:b9:cc:37:d8:25:45:e3:3e:bf:7a:f6:2f:3c
Signer

Actual PE Digest

1a:dd:d3:61:74:39:a2:b9:cc:37:d8:25:45:e3:3e:bf:7a:f6:2f:3c

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

comctl32

ImageList_EndDrag
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
InitCommonControlsEx
ImageList_Remove
ord345
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
_TrackMouseEvent
ImageList_BeginDrag
ord14
ord15
ord13

oledlg

OleUIEditLinksW
OleUIPasteSpecialW
OleUIInsertObjectW
OleUIConvertW

odbc32

ord24
ord26
ord9
ord31
ord75
ord107
ord111
ord136

wininet

FtpFindFirstFileW
InternetCloseHandle
InternetOpenUrlW
InternetGetLastResponseInfoW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
InternetConnectW
InternetReadFile
InternetWriteFile
InternetQueryDataAvailable
FtpCreateDirectoryW
FtpOpenFileW
FtpDeleteFileW
FtpPutFileW
InternetQueryOptionW
InternetSetStatusCallbackW
InternetFindNextFileW
InternetErrorDlg
HttpQueryInfoW
HttpEndRequestW
HttpSendRequestExW
HttpSendRequestExA
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetOpenW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSetPenMiterLimit
GdipClonePen
GdipCreatePen1
GdipCreateSolidFill
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipGetRegionHRgn
GdipGetMetafileHeaderFromStream
GdipCreateMetafileFromStream
GdipRecordMetafile
GdipSetPathFillMode
GdipStartPathFigure
GdipGetPathWorldBoundsI
GdipGetRegionBoundsI
GdipCreateLineBrushFromRectI
GdipSetLinePresetBlend
GdipDrawLineI
GdipFillPath
GdipFillRegion
GdipSetClipRegion
GdipClosePathFigures
GdipCreateRegionHrgn
GdipDrawImage
GdipAddPathPieI
GdipDrawArcI
GdipDrawArc
GdipDrawLinesI
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageBounds
GdipCreateBitmapFromResource
GdipFlush
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetDC
GdipReleaseDC
GdipSetPenLineCap197819
GdipAddPathPie
GdipSetTextRenderingHint
GdipGetWorldTransform
GdipGraphicsClear
GdipDrawImageRectRect
GdipGetClip
GdipGetHemfFromMetafile
GdipCreateMetafileFromEmf
GdipRecordMetafileI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipEmfToWmfBits
GdipAddPathEllipseI
GdipTransformPath
GdipTranslateMatrix
GdipRotateMatrix
GdipTransformMatrixPointsI
GdipImageRotateFlip
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromGdiDib
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipFree
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathRectangleI
GdipDeletePen
GdipSetSmoothingMode
GdipDrawPath
GdipFillRectangleI
GdipSaveGraphics
GdipRestoreGraphics
GdipResetClip
GdipGetClipBoundsI
GdipSetClipRect
GdipAddPathCurveI
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenLineJoin
GdipSetClipPath
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCloneRegion
GdipCombineRegionRegion
GdipIsEmptyRegion
GdipCreateFontFromLogfontW
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetImageThumbnail
GdipSetWorldTransform
GdipGetDpiX
GdipGetDpiY
GdipDrawRectangle
GdipCreateHatchBrush
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipFillPolygonI
GdipRecordMetafileFileName
GdipSetEmpty
GdipCombineRegionRectI
GdipCreateRegionRectI
GdipSetClipRectI
GdipAddPathLine2I
GdipAddPathPolygonI
GdipSetImageAttributesColorMatrix
GdipMultiplyWorldTransform
GdipSetPageUnit
GdipDrawImageRect
GdipDrawImageRectI
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromStreamICM
GdipCreateRegionPath
GdipCreatePen2
GdipDrawLine
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawDriverString
GdipMeasureDriverString
GdipGetPointCount
GdipGetPathPointsI
GdipIsVisibleRegionPointI
GdipIsVisibleRegionRectI
GdipGetPenWidth
GdipAddPathLine2
GdipAddPathPolygon
GdipSetPenDashCap197819
GdipSetPenCustomStartCap
GdipSetPenCustomEndCap
GdipSetPenDashStyle
GdipSetPenDashArray
GdipCreateCustomLineCap
GdipDeleteCustomLineCap
GdipSetCustomLineCapBaseInset
GdipSetCustomLineCapWidthScale
GdipResetPath
GdipAddPathLine
GdipAddPathArc
GdipAddPathRectangle
GdipAddPathEllipse
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipDeleteRegion
GdipCreateRegion
GdipGetMatrixElements
GdipDeleteMatrix
GdipCreateMatrix
GdipIsVisiblePathPointI
GdipWidenPath
GdipAddPathArcI
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipCreateFontFromDC

msimg32

AlphaBlend
GradientFill

imm32

ImmIsUIMessageW
ImmNotifyIME
ImmGetOpenStatus
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

kernel32

RtlUnwindEx
RtlPcToFileHeader
GetCPInfo
FindFirstFileExW
MoveFileExW
GetFileType
SetFilePointerEx
SetConsoleCtrlHandler
FindFirstFileExA
FindNextFileA
SystemTimeToTzSpecificLocalTime
GetTempPathA
GetModuleHandleExW
AreFileApisANSI
GetProcessHeap
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreW
HeapSize
IsValidCodePage
GetOEMCP
GetConsoleCP
GetConsoleMode
DecodePointer
EncodePointer
HeapReAlloc
GetStringTypeW
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
GetStdHandle
lstrlenW
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
GetModuleHandleW
lstrcpynW
CompareStringW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocaleInfoW
GetCalendarInfoW
LCIDToLocaleName
CloseHandle
WaitForSingleObject
CreateThread
GetModuleFileNameW
GetDateFormatW
MultiByteToWideChar
InitializeCriticalSection
SetEvent
ResetEvent
CreateEventW
ExitThread
CreateFileW
GetLastError
LocalAlloc
LocalFree
TerminateThread
GetTickCount64
FreeLibrary
GetProcAddress
MulDiv
LoadLibraryW
GetSystemTime
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToFileTime
ReadFile
WriteFile
ResumeThread
lstrlenA
DeleteFileW
lstrcpynA
WideCharToMultiByte
GetCurrentProcessId
GetACP
TryEnterCriticalSection
SleepEx
GetTickCount
GetExitCodeThread
SuspendThread
GetProcessAffinityMask
SetThreadAffinityMask
GetTempFileNameW
GetTempPathW
FormatMessageW
GlobalLock
CreateDirectoryW
GetFileSize
lstrcmpA
GetLocalTime
GetTimeZoneInformation
GetFileSizeEx
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
FindClose
GetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetSystemDirectoryW
lstrcmpiW
GetVersionExW
GlobalHandle
FileTimeToLocalFileTime
ReleaseMutex
CreateMutexW
SetThreadPriority
GlobalDeleteAtom
GlobalGetAtomNameW
GetTimeFormatW
LoadResource
LockResource
SizeofResource
FindResourceW
SetCurrentDirectoryW
GetCurrentDirectoryW
GlobalUnlock
GlobalAddAtomW
GlobalAlloc
GlobalFree
GetFullPathNameW
lstrcpyW
GetLongPathNameW
DeleteAtom
AddAtomW
GetAtomNameW
GlobalSize
Sleep
GetProfileStringW
GlobalGetAtomNameA
GetSystemDefaultLocaleName
GetUserDefaultLangID
LoadLibraryExW
GetCurrentThread
FindFirstFileW
GetDriveTypeW
FlushFileBuffers
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
CreateFileA
FileTimeToDosDateTime
FreeResource
GetComputerNameA
GetComputerNameW
GetSystemDefaultLangID
WaitForMultipleObjects
GetCommandLineW
SetFileAttributesW
DuplicateHandle
AddVectoredExceptionHandler
OpenMutexW
CreateProcessW
GetStartupInfoW
OpenProcess
RemoveDirectoryW
SetEndOfFile
CopyFileW
SearchPathW
GetWindowsDirectoryW
GetProductInfo
SetHandleCount
GetProfileIntW
GlobalReAlloc
GlobalFlags
GlobalMemoryStatus
ExpandEnvironmentStringsW
FindNextFileW
GetShortPathNameW
ReplaceFileW
SetErrorMode
VirtualAlloc
VirtualFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetWindowsDirectoryA
LoadLibraryA
CreateFileMappingA
ExitProcess
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleW
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
OutputDebugStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
GetExitCodeProcess
SetEnvironmentVariableW
SetEnvironmentVariableA
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
LoadLibraryExA
CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
SwitchToThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetThreadPriority
UnregisterWait
HeapFree
SignalObjectAndWait

user32

LockWindowUpdate
MapDialogRect
GetNextDlgTabItem
GetKeyState
GetAncestor
GetUpdateRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetClipboardData
DrawIconEx
DrawEdge
GetClassLongPtrW
SetClassLongPtrW
IsRectEmpty
EqualRect
GetTopWindow
IsZoomed
RemoveMenu
GetMenuItemInfoW
SetMenuDefaultItem
LoadBitmapW
GetComboBoxInfo
CharLowerBuffW
SendNotifyMessageW
ShowWindowAsync
ModifyMenuW
AdjustWindowRectEx
WindowFromPoint
GetMessagePos
SetCursor
DestroyIcon
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
IntersectRect
UnionRect
SetScrollInfo
GetScrollInfo
SendMessageTimeoutW
IsClipboardFormatAvailable
InvalidateRgn
SetRectEmpty
DefDlgProcW
CharLowerW
WinHelpW
GetCursor
RegisterWindowMessageW
GetKeyboardState
SetKeyboardState
SetDlgItemTextA
GetActiveWindow
RegisterClipboardFormatW
CreateMenu
SetWindowRgn
GetWindowRgn
IsDialogMessageW
GetDesktopWindow
EnableScrollBar
GetMessageTime
GetCapture
SetCapture
ReleaseCapture
DrawStateW
InvertRect
InsertMenuW
GetIconInfo
MonitorFromPoint
GetMonitorInfoW
ChildWindowFromPointEx
UpdateLayeredWindow
GetAsyncKeyState
DrawIcon
GetMenuStringW
ValidateRect
CheckMenuItem
GetMenuInfo
SetMenuInfo
CheckMenuRadioItem
LoadMenuW
MessageBoxIndirectW
SetForegroundWindow
mouse_event
LoadStringA
CharUpperW
CharUpperBuffW
SubtractRect
GetDlgItemTextA
DrawTextA
ShowCaret
FindWindowW
ScrollWindowEx
SendInput
CreateCaret
DestroyCaret
HideCaret
SetCaretPos
GetCaretPos
GetClipboardOwner
IsCharAlphaNumericW
PostQuitMessage
EnumWindows
GetMenuCheckMarkDimensions
IsMenu
AttachThreadInput
CharNextW
CharPrevW
GetScrollBarInfo
wsprintfW
GetWindowLongPtrW
IsWindowEnabled
LoadCursorW
InvalidateRect
UpdateWindow
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
KillTimer
SetTimer
EndDialog
DialogBoxParamW
GetParent
MessageBeep
GetWindowRect
GetWindowTextW
PostMessageW
SetWindowLongPtrW
GetDlgCtrlID
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemInt
SetDlgItemInt
MapWindowPoints
GetClientRect
SetWindowPos
SendDlgItemMessageW
GetDlgItemTextW
SetWindowTextW
MessageBoxW
SetFocus
DestroyWindow
SendMessageW
GetSysColor
EnableWindow
SetDlgItemTextW
GetDlgItem
ShowWindow
CreateDialogParamW
GetClassNameW
ScreenToClient
ClientToScreen
GetWindowDC
GetFocus
MoveWindow
DispatchMessageW
TranslateMessage
GetDialogBaseUnits
GetWindowLongW
PtInRect
OffsetRect
InflateRect
BeginDeferWindowPos
SetActiveWindow
SetMenu
GetMenu
BringWindowToTop
IsIconic
GetWindowPlacement
SetParent
GetDoubleClickTime
TrackPopupMenu
MonitorFromWindow
SystemParametersInfoW
GetWindowThreadProcessId
GetLastActivePopup
GetWindow
GetWindowTextLengthW
SetMenuItemInfoW
InsertMenuItemW
DeleteMenu
GetMenuItemCount
GetMenuItemID
LoadStringW
PostThreadMessageW
GetMessageW
GetSubMenu
LoadIconW
RedrawWindow
EnableMenuItem
GetSystemMenu
GetMessageExtraInfo
PeekMessageW
FrameRect
DrawTextW
GetSystemMetrics
UnregisterClassW
DrawFrameControl
TrackMouseEvent
GetSysColorBrush
RemovePropW
LoadImageW
FindWindowExW
CopyRect
FillRect
EndPaint
BeginPaint
ReleaseDC
GetDC
WindowFromDC
TrackPopupMenuEx
AppendMenuW
DestroyMenu
CreatePopupMenu
GetForegroundWindow
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowVisible
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
DrawFocusRect
GetCursorPos
SetRect
EnumChildWindows
GetPropW
SetPropW
EndDeferWindowPos
GetMenuState
DeferWindowPos

gdi32

FillRgn
GetDIBits
Rectangle
SelectClipRgn
ExtSelectClipRgn
SetDIBitsToDevice
GetEnhMetaFileHeader
LPtoDP
SetWindowOrgEx
TextOutW
CreateRoundRectRgn
CreateBrushIndirect
PatBlt
CreateFontW
DeleteMetaFile
CloseMetaFile
CreateHatchBrush
CreateMetaFileW
SetMetaFileBitsEx
CloseEnhMetaFile
CreateEnhMetaFileW
GetWinMetaFileBits
CreateRectRgnIndirect
FrameRgn
GetRgnBox
SetViewportOrgEx
OffsetViewportOrgEx
IntersectClipRect
GetROP2
SetROP2
SetStretchBltMode
OffsetWindowOrgEx
CreateBitmap
CreatePatternBrush
GetMetaFileBitsEx
GetViewportExtEx
SetGraphicsMode
SetWinMetaFileBits
GetObjectType
EnumFontFamiliesExW
StretchBlt
PlayEnhMetaFile
SetViewportExtEx
SetWindowExtEx
CreateRectRgn
CombineRgn
DPtoLP
GetTextMetricsW
SetEnhMetaFileBits
GetEnhMetaFileBits
GetTextExtentPointW
CopyEnhMetaFileW
DeleteEnhMetaFile
CreateCompatibleBitmap
BitBlt
SetMapMode
GetDeviceCaps
ExcludeClipRect
GetBkColor
GetTextColor
MoveToEx
SetTextAlign
RoundRect
LineTo
CreatePen
SaveDC
RestoreDC
GetTextExtentPoint32W
CreateSolidBrush
ExtTextOutW
SetBkMode
SetBkColor
GetCurrentObject
DeleteObject
SelectObject
GetStockObject
DeleteDC
CreateCompatibleDC
SetTextColor
GetObjectW
GetTextFaceW
ExtEscape
ModifyWorldTransform
GetObjectA
CreateDCA
ExtCreatePen
GetPixel
GetNearestColor
GetMapMode
Escape
CreateICW
CreateDCW
GetEnhMetaFileW
GetMetaFileW
SetAbortProc
EndDoc
StartDocW
ResetDCW
EndPage
StartPage
CreatePalette
Polyline
ExtTextOutA
TextOutA
PlayMetaFileRecord
SetPixel
PolyPolygon
Pie
OffsetClipRgn
FloodFill
ExtFloodFill
Chord
EnumMetaFile
CopyMetaFileW
StretchDIBits
SetPolyFillMode
GetWindowOrgEx
GetRegionData
ExtCreateRegion
ScaleWindowExtEx
Arc
Polygon
RectInRegion
GetWindowExtEx
CreatePenIndirect
PtInRegion
SetTextJustification
Ellipse
SetTextCharacterExtra
TranslateCharsetInfo
UnrealizeObject
SetBrushOrgEx
SelectPalette
RealizePalette
GetViewportOrgEx
GetTextAlign
GetCharWidthW
CreatePolygonRgn
GetGraphicsMode
CreateDIBSection
CreateFontIndirectW

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
ChooseFontW
ChooseColorW
PrintDlgW
GetOpenFileNameW

advapi32

SetEntriesInAclW
RegQueryMultipleValuesW
RegOpenKeyW
RegQueryValueExW
RegQueryValueW
RegSetValueW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
GetUserNameW
RegGetValueW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegCreateKeyW
RegCreateKeyA
RegCloseKey
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

shell32

ShellExecuteExW
ExtractIconExW
CommandLineToArgvW
ShellExecuteA
SHAddToRecentDocs
SHChangeNotify
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
DoEnvironmentSubstW

ole32

OleFlushClipboard
CoSetProxyBlanket
CoInitializeSecurity
GetHGlobalFromStream
ProgIDFromCLSID
GetHGlobalFromILockBytes
OleRegEnumVerbs
OleRegGetUserType
OleGetIconOfClass
OleRun
OleDraw
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
OleSetContainedObject
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateFromData
OleCreate
OleQueryCreateFromData
ReadFmtUserTypeStg
CreateBindCtx
MkParseDisplayName
StgOpenStorageOnILockBytes
CoTaskMemAlloc
CLSIDFromProgID
CoFreeUnusedLibraries
CoLockObjectExternal
SetConvertStg
GetConvertStg
CreateILockBytesOnHGlobal
OleRegEnumFormatEtc
CreateOleAdviseHolder
ReleaseStgMedium
OleGetClipboard
OleSetClipboard
OleSaveToStream
OleCreateLinkFromData
OleQueryLinkFromData
OleUninitialize
OleInitialize
WriteFmtUserTypeStg
WriteClassStm
WriteClassStg
ReadClassStg
OleBuildVersion
GetRunningObjectTable
CreateItemMoniker
CreateFileMoniker
CreateGenericComposite
StgCreateDocfileOnILockBytes
CreateDataAdviseHolder
CoCreateGuid
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
CoGetMalloc
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
VarBstrCat
SafeArrayAllocDescriptor
SafeArrayDestroyDescriptor
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
GetActiveObject
RegisterActiveObject
RevokeActiveObject
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayCreate
GetErrorInfo

secur32

InitSecurityInterfaceW

usp10

ScriptStringAnalyse
ScriptStringOut
ScriptString_pSize
ScriptStringFree

dwmapi

DwmGetWindowAttribute

shlwapi

PathRemoveBackslashW
StrStrIW
StrTrimW
StrStrW
PathAppendW
PathFileExistsW
PathIsDirectoryW
StrStrIA
StrChrW
StrCmpW
StrCmpIW
PathAddExtensionW
PathFindExtensionW
PathAddBackslashW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsURLW
PathCombineW
PathStripPathW
StrCpyW
StrCmpNIW
StrTrimA
StrCmpNIA
PathParseIconLocationW
StrChrIW
SHDeleteKeyW
StrToIntW

wintrust

WinVerifyTrust

Sections

.text
Size: 14.3MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.7MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 932KB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 701KB - Virtual size: 701KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 645B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
graphpadprism8安装后-crack文件复制到安装目录\InstallPrism8-32bit.msi
.msi
graphpadprism8安装后-crack文件复制到安装目录\InstallPrism8-64bit.msi
.msi
graphpadprism8安装后-crack文件复制到安装目录\URET NFO v2.2.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 384KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 289KB - Virtual size: 292KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
graphpadprism8安装后-crack文件复制到安装目录\URET.nfo
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING BUN 6-10-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING BUN 6-16-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING BUN 6-23-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING Creatinine 6-16-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING Creatinine 6-24-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING Creatinine 6-9-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING H151.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IFNa mRNA 7-8-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IFNb mRNA 7-8-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IKB Western 7-12-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IKB Western 7-15-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IKB Western 7-21-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IKB Western 7-29-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-1b 6-17-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-1b mRNA 7-8-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 6-17-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 6-24-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 9-21-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 kid 6-30-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 kid combine 6-30-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 mRNA 7-6-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING IL-6 serum 7-29-22 combine.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING KC mRNA 7-6-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING KIM-1 mRNA 7-6-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING KIM-1 mRNA combined 10-3-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING MIP-2 mRNA 7-6-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING NGAL 6-25-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING NGAL 7-27-22 1800F DILUTION.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING NGAL 7-27-22 urine 900 dilution.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING NGAL mRNA 7-6-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING P-TBK1 Western 7-13-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING TNFa 6-17-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING TNFa mRNA 7-20-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING TUNEL 8-19-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING Vehicle 5-27-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING injury score 8-5-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING p-TBK1 Western 7-22 28-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING p-TBK1 Western 7-22-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING survival-34min.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING survival.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING urine NGAL 6-25-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI-STING-GFR.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI30min-STING for all .pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\AKI30min-STING for reasonable data .pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR Bilateral 1,6,7,8,9 2-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR Bilateral 2-21-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR Bilateral 3-1-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR C23 Bilateral combine.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR C23 day21 combine.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR C23 day7 combine.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR Right IRI 6,7,8,9 2-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\GFR change at RIR.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv plasma ALT 12-09-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv plasma AST 12-09-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv plasma LDH 12-09-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv plasma lactate 12-09-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv rimRNA plasma ALT 1-20-23.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv rimRNA plasma AST 1-20-23.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h iv rimRNA plasma LDH 1-20-23.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma 2iv ALT 12-23-22-.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma 2iv AST 12-23-22-.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma 2iv LDH 12-23-22-.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma ALT 11-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma ALT 12-02-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma AST 12-02-22-.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma LDH 12-02-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma ip+ip ALT 1-6-23.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma ip+ip AST 1-6-23.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 24h plasma ip+ip LDH 1-6-23.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma ALT 11-04-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma AST 11-04-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma BUN 11-04-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma IL-6 ELISA 11-04-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma LDH 11-04-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma TNF-a ELISA 11-04-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS 4h plasma creatinine 11-04-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma ALT 5-19-22.pzfx
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma AST 5-19-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma LDH 11-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma LDH 5-19-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma lactate 11-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS plasma lactate 5-19-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS-STING BUN 10-18-21-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS-STING BUN 10-18-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\HS-STING Creatinine 10-18-21-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\Peri-operative HS GFR 4-22-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\Peri-operative HS GFR 4-8-22.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\experiment\Project1.pzfx
.xml
graphpadprism8安装后-crack文件复制到安装目录\file_id.diz
graphpadprism8安装后-crack文件复制到安装目录\prism.exe
.exe windows x86

Password: infected

8573c168b856a54a90cf766b32e666d8

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10-01-2019 00:00

Not After

09-01-2022 23:59

Subject

SERIALNUMBER=201729710129,CN=GraphPad Software LLC,O=GraphPad Software LLC,POSTALCODE=92037,STREET=7825 Fay Avenue\,Suite 230,L=La Jolla,ST=CA,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

Issuer

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

10-01-2019 00:00

Not After

09-01-2022 23:59

Subject

SERIALNUMBER=201729710129,CN=GraphPad Software LLC,O=GraphPad Software LLC,POSTALCODE=92037,STREET=7825 Fay Avenue\,Suite 230,L=La Jolla,ST=CA,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130a43616c69666f726e6961,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-12-2014 00:00

Not After

02-12-2029 23:59

Subject

CN=COMODO RSA Extended Validation Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31-12-2015 00:00

Not After

09-07-2019 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

82:fa:ea:25:e3:0d:35:25:6b:a1:f1:9f:1f:1f:1c:2b:40:37:ea:40:2c:8b:94:dd:5f:74:51:fe:fd:35:4e:d1
Signer

Actual PE Digest

82:fa:ea:25:e3:0d:35:25:6b:a1:f1:9f:1f:1f:1c:2b:40:37:ea:40:2c:8b:94:dd:5f:74:51:fe:fd:35:4e:d1

Digest Algorithm

sha256

PE Digest Matches

false

9b:ad:b7:14:47:0d:59:18:d7:64:f6:7e:c8:f9:ad:0e:01:85:f5:2a
Signer

Actual PE Digest

9b:ad:b7:14:47:0d:59:18:d7:64:f6:7e:c8:f9:ad:0e:01:85:f5:2a

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_NET_RUN_FROM_SWAP

Imports

comctl32

ImageList_EndDrag
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
InitCommonControlsEx
ImageList_Remove
ord345
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
_TrackMouseEvent
ImageList_BeginDrag
ord14
ord15
ord13

oledlg

OleUIEditLinksW
OleUIPasteSpecialW
OleUIInsertObjectW
OleUIConvertW

odbc32

ord24
ord26
ord9
ord31
ord75
ord107
ord111
ord136

wininet

InternetSetStatusCallbackW
InternetCloseHandle
InternetOpenUrlW
InternetGetLastResponseInfoW
FtpSetCurrentDirectoryW
FtpRemoveDirectoryW
FtpCreateDirectoryW
FtpOpenFileW
FtpDeleteFileW
InternetConnectW
InternetReadFile
InternetOpenW
InternetWriteFile
FtpPutFileW
FtpFindFirstFileW
InternetQueryDataAvailable
InternetFindNextFileW
InternetErrorDlg
HttpQueryInfoW
HttpEndRequestW
HttpSendRequestExW
HttpSendRequestExA
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetOptionW
InternetQueryOptionW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipSaveImageToStream
GdipSetPenMiterLimit
GdipClonePen
GdipCreatePen1
GdipCreateSolidFill
GdipCreateTexture
GdipDeleteBrush
GdipCloneBrush
GdipGetRegionHRgn
GdipDeleteRegion
GdipCreateRegion
GdipGetMatrixElements
GdipGetMetafileHeaderFromStream
GdipCreateMetafileFromStream
GdipRecordMetafile
GdipSetPathFillMode
GdipStartPathFigure
GdipGetPathWorldBoundsI
GdipGetRegionBoundsI
GdipCreateLineBrushFromRectI
GdipSetLinePresetBlend
GdipDrawLineI
GdipFillPath
GdipFillRegion
GdipSetClipRegion
GdipClosePathFigures
GdipCreateRegionHrgn
GdipDrawImage
GdipAddPathPieI
GdipDrawArcI
GdipDrawArc
GdipDrawLinesI
GdipGetImageVerticalResolution
GdipGetImageHorizontalResolution
GdipGetImageBounds
GdipCreateBitmapFromResource
GdipFlush
GdipCreateFromHDC
GdipDeleteGraphics
GdipGetDC
GdipSetPenLineCap197819
GdipAddPathPie
GdipReleaseDC
GdipSetTextRenderingHint
GdipGetWorldTransform
GdipGraphicsClear
GdipDrawImageRectRect
GdipGetClip
GdipGetHemfFromMetafile
GdipCreateMetafileFromEmf
GdipRecordMetafileI
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipEmfToWmfBits
GdipAddPathEllipseI
GdipTransformPath
GdipTranslateMatrix
GdipRotateMatrix
GdipTransformMatrixPointsI
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipCreateBitmapFromGraphics
GdipCreateBitmapFromGdiDib
GdipCreateHBITMAPFromBitmap
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipFree
GdipCreatePath
GdipDeletePath
GdipClosePathFigure
GdipAddPathLineI
GdipAddPathRectangleI
GdipDeletePen
GdipSetSmoothingMode
GdipDrawPath
GdipFillRectangleI
GdipSaveGraphics
GdipRestoreGraphics
GdipResetClip
GdipGetClipBoundsI
GdipSetClipRect
GdipAddPathCurveI
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetPenLineJoin
GdipSetClipPath
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdipSaveImageToFile
GdipCloneRegion
GdipCombineRegionRegion
GdipCreateFontFromDC
GdipCreateFontFromLogfontW
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipGetImageThumbnail
GdipSetWorldTransform
GdipGetDpiX
GdipGetDpiY
GdipDrawRectangle
GdipCreateHatchBrush
GdipTranslateWorldTransform
GdipScaleWorldTransform
GdipFillPolygonI
GdipRecordMetafileFileName
GdipSetEmpty
GdipCombineRegionRectI
GdipCreateRegionRectI
GdipSetClipRectI
GdipAddPathLine2I
GdipAddPathPolygonI
GdipSetImageAttributesColorMatrix
GdipMultiplyWorldTransform
GdipSetPageUnit
GdipDrawImageRect
GdipDrawImageRectI
GdipImageRotateFlip
GdipCreateBitmapFromStreamICM
GdipCreateRegionPath
GdipCreatePen2
GdipDrawLine
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDrawDriverString
GdipMeasureDriverString
GdipGetPointCount
GdipGetPathPointsI
GdipIsVisibleRegionPointI
GdipIsVisibleRegionRectI
GdipGetPenWidth
GdipAddPathLine2
GdipAddPathPolygon
GdipSetPenDashCap197819
GdipSetPenCustomStartCap
GdipSetPenCustomEndCap
GdipSetPenDashStyle
GdipSetPenDashArray
GdipCreateCustomLineCap
GdipDeleteCustomLineCap
GdipSetCustomLineCapBaseInset
GdipSetCustomLineCapWidthScale
GdipResetPath
GdipAddPathLine
GdipAddPathArc
GdipAddPathRectangle
GdipAddPathEllipse
GdipDrawImagePointRectI
GdipDrawImageRectRectI
GdipDeleteMatrix
GdipCreateMatrix
GdipIsVisiblePathPointI
GdipWidenPath
GdipAddPathArcI
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipIsEmptyRegion

msimg32

AlphaBlend
GradientFill

imm32

ImmIsUIMessageW
ImmNotifyIME
ImmGetOpenStatus
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
ImmGetDefaultIMEWnd

kernel32

GetCPInfo
FindFirstFileExW
MoveFileExW
SetFilePointerEx
SetConsoleCtrlHandler
FindFirstFileExA
FindNextFileA
SystemTimeToTzSpecificLocalTime
GetTempPathA
GetModuleHandleExW
AreFileApisANSI
GetProcessHeap
GetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateSemaphoreW
HeapSize
IsValidCodePage
GetOEMCP
GetConsoleCP
GetConsoleMode
GetFileType
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleW
SetStdHandle
DecodePointer
EncodePointer
HeapReAlloc
GetStringTypeW
IsProcessorFeaturePresent
IsDebuggerPresent
HeapAlloc
TerminateProcess
lstrlenW
RaiseException
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
GetCurrentProcess
GetCurrentThreadId
FlushInstructionCache
GetModuleHandleW
lstrcpynW
CompareStringW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocaleInfoW
GetCalendarInfoW
LCIDToLocaleName
CloseHandle
WaitForSingleObject
CreateThread
GetModuleFileNameW
GetDateFormatW
MultiByteToWideChar
InitializeCriticalSection
SetEvent
ResetEvent
CreateEventW
ExitThread
CreateFileW
GetLastError
LocalAlloc
LocalFree
TerminateThread
GetTickCount64
FreeLibrary
GetProcAddress
MulDiv
LoadLibraryW
GetSystemTime
GetSystemTimeAsFileTime
FileTimeToSystemTime
SystemTimeToFileTime
ReadFile
WriteFile
ResumeThread
GetVersionExW
GetModuleHandleA
lstrlenA
DeleteFileW
lstrcpynA
WideCharToMultiByte
GetCurrentProcessId
GetACP
TryEnterCriticalSection
SleepEx
GetTickCount
GetExitCodeThread
SuspendThread
GetProcessAffinityMask
SetThreadAffinityMask
GetTempFileNameW
GetTempPathW
InterlockedDecrement
FormatMessageW
GlobalLock
CreateDirectoryW
GetFileSize
lstrcmpA
GetLocalTime
GetTimeZoneInformation
GetFileSizeEx
SetFilePointer
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
QueryPerformanceCounter
FindClose
GetFileAttributesW
GetFileAttributesExW
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
GetSystemDirectoryW
lstrcmpiW
GlobalHandle
FileTimeToLocalFileTime
ReleaseMutex
CreateMutexW
SetThreadPriority
GlobalDeleteAtom
GlobalGetAtomNameW
GetTimeFormatW
LoadResource
LockResource
SizeofResource
FindResourceW
SetCurrentDirectoryW
GetCurrentDirectoryW
GlobalUnlock
GlobalAddAtomW
GlobalAlloc
GlobalFree
GetFullPathNameW
InterlockedIncrement
lstrcpyW
GetLongPathNameW
DeleteAtom
AddAtomW
GetAtomNameW
GlobalSize
Sleep
GetProfileStringW
GlobalGetAtomNameA
GetSystemDefaultLocaleName
GetUserDefaultLangID
LoadLibraryExW
GetCurrentThread
FindFirstFileW
GetDriveTypeW
FlushFileBuffers
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
CreateFileA
FileTimeToDosDateTime
FreeResource
GetComputerNameA
GetComputerNameW
GetSystemDefaultLangID
WaitForMultipleObjects
GetCommandLineW
SetFileAttributesW
DuplicateHandle
AddVectoredExceptionHandler
OpenMutexW
CreateProcessW
GetStartupInfoW
OpenProcess
RemoveDirectoryW
SetEndOfFile
CopyFileW
SearchPathW
GetWindowsDirectoryW
GetProductInfo
SetHandleCount
GetProfileIntW
GlobalReAlloc
GlobalFlags
GlobalMemoryStatus
ExpandEnvironmentStringsW
FindNextFileW
GetShortPathNameW
ReplaceFileW
SetErrorMode
VirtualAlloc
VirtualFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetPrivateProfileStringW
GetWindowsDirectoryA
LoadLibraryA
CreateFileMappingA
ExitProcess
GetEnvironmentStringsW
FreeEnvironmentStringsW
InterlockedExchange
OutputDebugStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
WriteConsoleW
GetExitCodeProcess
SetEnvironmentVariableW
SetEnvironmentVariableA
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
LoadLibraryExA
CreateTimerQueueTimer
CreateTimerQueue
DeleteTimerQueueTimer
SwitchToThread
GetThreadTimes
FreeLibraryAndExitThread
VirtualProtect
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetThreadPriority
UnregisterWait
HeapFree
SignalObjectAndWait

user32

GetForegroundWindow
SetForegroundWindow
LockWindowUpdate
MapDialogRect
GetNextDlgTabItem
GetKeyState
GetAncestor
GetUpdateRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetClipboardData
DrawIconEx
DrawEdge
GetClassLongW
SetClassLongW
IsRectEmpty
EqualRect
GetTopWindow
IsZoomed
RemoveMenu
GetMenuItemInfoW
SetMenuDefaultItem
LoadBitmapW
GetComboBoxInfo
CharLowerBuffW
SendNotifyMessageW
ShowWindowAsync
ModifyMenuW
AdjustWindowRectEx
WindowFromPoint
GetMessagePos
SetCursor
DestroyIcon
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
IntersectRect
UnionRect
SetScrollInfo
GetScrollInfo
SendMessageTimeoutW
IsClipboardFormatAvailable
InvalidateRgn
SetRectEmpty
DefDlgProcW
CharLowerW
WinHelpW
GetCursor
RegisterWindowMessageW
GetKeyboardState
SetKeyboardState
SetDlgItemTextA
GetActiveWindow
RegisterClipboardFormatW
CreateMenu
SetWindowRgn
GetWindowRgn
IsDialogMessageW
GetDesktopWindow
EnableScrollBar
GetMessageTime
GetCapture
SetCapture
ReleaseCapture
DrawStateW
InvertRect
InsertMenuW
GetIconInfo
MonitorFromPoint
GetMonitorInfoW
ChildWindowFromPointEx
UpdateLayeredWindow
GetAsyncKeyState
GetClassNameW
GetMenuStringW
GetMenuState
CheckMenuItem
GetMenuInfo
SetMenuInfo
SetActiveWindow
LoadMenuW
MessageBoxIndirectW
GetMessageExtraInfo
mouse_event
LoadStringA
CharUpperW
CharUpperBuffW
SubtractRect
GetDlgItemTextA
DrawTextA
ShowCaret
FindWindowW
ScrollWindowEx
SendInput
CreateCaret
DestroyCaret
HideCaret
SetCaretPos
GetCaretPos
GetClipboardOwner
IsCharAlphaNumericW
PostQuitMessage
EnumWindows
GetMenuCheckMarkDimensions
IsMenu
AttachThreadInput
CharNextW
CharPrevW
GetScrollBarInfo
LoadCursorW
InvalidateRect
UpdateWindow
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
KillTimer
SetTimer
EndDialog
DialogBoxParamW
GetParent
MessageBeep
GetWindowRect
GetWindowTextW
PostMessageW
SetWindowLongW
GetDlgCtrlID
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemInt
SetDlgItemInt
MapWindowPoints
GetClientRect
SetWindowPos
SendDlgItemMessageW
GetDlgItemTextW
SetWindowTextW
MessageBoxW
SetFocus
DestroyWindow
SendMessageW
GetSysColor
EnableWindow
SetDlgItemTextW
GetDlgItem
ShowWindow
ScreenToClient
ClientToScreen
GetWindowDC
GetFocus
MoveWindow
DispatchMessageW
TranslateMessage
GetDialogBaseUnits
PtInRect
OffsetRect
InflateRect
FrameRect
DrawTextW
GetSystemMetrics
IsWindowEnabled
GetMenu
BringWindowToTop
IsIconic
GetWindowPlacement
SetParent
GetDoubleClickTime
TrackPopupMenu
MonitorFromWindow
SystemParametersInfoW
GetWindowThreadProcessId
GetLastActivePopup
GetWindow
GetWindowTextLengthW
SetMenuItemInfoW
InsertMenuItemW
DeleteMenu
GetMenuItemCount
GetMenuItemID
LoadStringW
PostThreadMessageW
GetMessageW
GetSubMenu
LoadIconW
RedrawWindow
EnableMenuItem
GetSystemMenu
PeekMessageW
ValidateRect
CheckMenuRadioItem
CreateDialogParamW
UnregisterClassW
DrawFrameControl
TrackMouseEvent
GetSysColorBrush
RemovePropW
LoadImageW
FindWindowExW
CopyRect
FillRect
EndPaint
BeginPaint
ReleaseDC
GetDC
WindowFromDC
TrackPopupMenuEx
AppendMenuW
DestroyMenu
CreatePopupMenu
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowVisible
IsWindow
SetMenu
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
DrawFocusRect
GetCursorPos
SetRect
EnumChildWindows
GetPropW
SetPropW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
wsprintfW
DrawIcon
GetWindowLongW

gdi32

FillRgn
GetDIBits
Rectangle
SelectClipRgn
ExtSelectClipRgn
SetDIBitsToDevice
GetEnhMetaFileHeader
LPtoDP
SetWindowOrgEx
TextOutW
CreateRoundRectRgn
CreateBrushIndirect
DeleteMetaFile
CreateFontW
GetTextFaceW
CloseMetaFile
CreateHatchBrush
CreateMetaFileW
SetMetaFileBitsEx
CloseEnhMetaFile
CreateEnhMetaFileW
GetWinMetaFileBits
CreateRectRgnIndirect
FrameRgn
GetRgnBox
SetViewportOrgEx
OffsetViewportOrgEx
IntersectClipRect
GetROP2
SetROP2
SetStretchBltMode
OffsetWindowOrgEx
CreateBitmap
CreatePatternBrush
GetMetaFileBitsEx
GetViewportExtEx
SetGraphicsMode
SetWinMetaFileBits
GetObjectType
EnumFontFamiliesExW
StretchBlt
CreateRectRgn
CombineRgn
DPtoLP
GetTextMetricsW
SetEnhMetaFileBits
GetEnhMetaFileBits
GetTextExtentPointW
CopyEnhMetaFileW
DeleteEnhMetaFile
CreateCompatibleBitmap
BitBlt
SetMapMode
GetDeviceCaps
ExcludeClipRect
GetBkColor
GetTextColor
MoveToEx
SetTextAlign
RoundRect
LineTo
CreatePen
SaveDC
RestoreDC
GetTextExtentPoint32W
CreateSolidBrush
ExtTextOutW
SetBkMode
SetBkColor
GetCurrentObject
DeleteObject
SelectObject
GetStockObject
DeleteDC
CreateCompatibleDC
SetTextColor
GetObjectW
PatBlt
ExtEscape
ModifyWorldTransform
GetObjectA
CreateDCA
ExtCreatePen
GetPixel
GetNearestColor
GetMapMode
Escape
CreateICW
CreateDCW
GetEnhMetaFileW
GetMetaFileW
SetAbortProc
EndDoc
StartDocW
ResetDCW
EndPage
StartPage
CreatePalette
Polyline
ExtTextOutA
TextOutA
PlayMetaFileRecord
SetPixel
PolyPolygon
Pie
OffsetClipRgn
FloodFill
ExtFloodFill
Chord
EnumMetaFile
CopyMetaFileW
StretchDIBits
SetPolyFillMode
GetWindowOrgEx
GetRegionData
ExtCreateRegion
ScaleWindowExtEx
Arc
Polygon
RectInRegion
GetWindowExtEx
CreatePenIndirect
PtInRegion
SetTextJustification
Ellipse
SetTextCharacterExtra
TranslateCharsetInfo
UnrealizeObject
SetBrushOrgEx
SelectPalette
RealizePalette
GetViewportOrgEx
GetTextAlign
GetCharWidthW
CreatePolygonRgn
GetGraphicsMode
CreateDIBSection
SetWindowExtEx
SetViewportExtEx
PlayEnhMetaFile
CreateFontIndirectW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

comdlg32

GetSaveFileNameW
CommDlgExtendedError
ChooseFontW
ChooseColorW
PrintDlgW
GetOpenFileNameW

advapi32

SetEntriesInAclW
RegQueryMultipleValuesW
RegOpenKeyW
RegQueryValueExW
RegQueryValueW
RegSetValueW
RegDeleteKeyW
RegSetValueExW
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegCreateKeyExW
GetUserNameW
RegGetValueW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegEnumKeyExA
RegCreateKeyW
RegCreateKeyA
RegCloseKey
AllocateAndInitializeSid
FreeSid
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetEffectiveRightsFromAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

shell32

ShellExecuteExW
ExtractIconExW
CommandLineToArgvW
ShellExecuteA
SHAddToRecentDocs
SHChangeNotify
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
ShellExecuteW
DoEnvironmentSubstW

ole32

OleFlushClipboard
CoSetProxyBlanket
CoInitializeSecurity
GetHGlobalFromStream
ProgIDFromCLSID
GetHGlobalFromILockBytes
OleRegEnumVerbs
OleRegGetUserType
OleGetIconOfClass
OleRun
OleDraw
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
OleSetContainedObject
OleSave
OleLoad
OleCreateFromFile
OleCreateLinkToFile
OleCreateFromData
OleCreate
OleQueryCreateFromData
ReadFmtUserTypeStg
CreateBindCtx
MkParseDisplayName
StgOpenStorageOnILockBytes
CoTaskMemAlloc
CLSIDFromProgID
CoFreeUnusedLibraries
CoLockObjectExternal
SetConvertStg
GetConvertStg
CreateILockBytesOnHGlobal
OleRegEnumFormatEtc
CreateOleAdviseHolder
ReleaseStgMedium
OleGetClipboard
OleSetClipboard
OleSaveToStream
OleCreateLinkFromData
OleQueryLinkFromData
OleUninitialize
OleInitialize
WriteFmtUserTypeStg
WriteClassStm
WriteClassStg
ReadClassStg
OleBuildVersion
GetRunningObjectTable
CreateItemMoniker
CreateFileMoniker
CreateGenericComposite
StgCreateDocfileOnILockBytes
CreateDataAdviseHolder
CoCreateGuid
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
CoGetMalloc
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString
SysAllocStringLen
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantClear
VarBstrCat
SafeArrayAllocDescriptor
SafeArrayDestroyDescriptor
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantChangeType
GetActiveObject
RegisterActiveObject
RevokeActiveObject
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
SafeArrayCreate
GetErrorInfo

secur32

InitSecurityInterfaceW

usp10

ScriptStringAnalyse
ScriptStringOut
ScriptString_pSize
ScriptStringFree

dwmapi

DwmGetWindowAttribute

shlwapi

PathRemoveBackslashW
StrStrIW
StrTrimW
StrStrW
PathAppendW
PathFileExistsW
PathIsDirectoryW
StrStrIA
StrChrW
StrCmpW
StrCmpIW
PathAddExtensionW
PathFindExtensionW
PathAddBackslashW
PathFindFileNameW
PathRemoveExtensionW
PathRemoveFileSpecW
PathIsURLW
PathCombineW
PathStripPathW
StrCpyW
StrCmpNIW
StrTrimA
StrCmpNIA
PathParseIconLocationW
StrChrIW
SHDeleteKeyW
StrToIntW

wintrust

WinVerifyTrust

Sections

.text
Size: 12.7MB - Virtual size: 12.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 601KB - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 593B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 727KB - Virtual size: 726KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

3ef72d3f2bd2a84d0928535a95ba1a1c

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89Certificate

Extended Key Usages

Key Usages

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1Certificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

67:a3:7a:76:ae:ed:e8:b2:1c:1d:b0:47:2d:7e:03:96:bb:1f:70:ee:53:f2:1e:1a:e5:bc:6f:b5:a1:2a:b7:21Signer

1a:dd:d3:61:74:39:a2:b9:cc:37:d8:25:45:e3:3e:bf:7a:f6:2f:3cSigner

Headers

DLL Characteristics

File Characteristics

Imports

comctl32

oledlg

odbc32

wininet

version

gdiplus

msimg32

imm32

kernel32

user32

gdi32

winspool.drv

comdlg32

advapi32

shell32

ole32

oleaut32

secur32

usp10

dwmapi

shlwapi

wintrust

Sections

.text Size: 14.3MB - Virtual size: 14.3MB

.rdata Size: 3.7MB - Virtual size: 3.6MB

.data Size: 932KB - Virtual size: 6.0MB

.pdata Size: 701KB - Virtual size: 701KB

.tls Size: 1024B - Virtual size: 645B

.rsrc Size: 9.6MB - Virtual size: 9.6MB

.reloc Size: 276KB - Virtual size: 275KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 384KB

UPX1 Size: 47KB - Virtual size: 48KB

.rsrc Size: 289KB - Virtual size: 292KB

Password: infected

8573c168b856a54a90cf766b32e666d8

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89Certificate

Extended Key Usages

Key Usages

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

67:a3:7a:76:ae:ed:e8:b2:1c:1d:b0:47:2d:7e:03:96:bb:1f:70:ee:53:f2:1e:1a:e5:bc:6f:b5:a1:2a:b7:21
Signer

1a:dd:d3:61:74:39:a2:b9:cc:37:d8:25:45:e3:3e:bf:7a:f6:2f:3c
Signer

.text
Size: 14.3MB - Virtual size: 14.3MB

.rdata
Size: 3.7MB - Virtual size: 3.6MB

.data
Size: 932KB - Virtual size: 6.0MB

.pdata
Size: 701KB - Virtual size: 701KB

.tls
Size: 1024B - Virtual size: 645B

.rsrc
Size: 9.6MB - Virtual size: 9.6MB

.reloc
Size: 276KB - Virtual size: 275KB

UPX0
Size: - Virtual size: 384KB

UPX1
Size: 47KB - Virtual size: 48KB

.rsrc
Size: 289KB - Virtual size: 292KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

d9:4e:18:86:d5:e2:01:a1:d6:44:fb:4c:e4:10:06:89
Certificate

6d:d4:72:eb:02:ae:04:06:e3:dd:84:3f:5f:e1:45:e1
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

82:fa:ea:25:e3:0d:35:25:6b:a1:f1:9f:1f:1f:1c:2b:40:37:ea:40:2c:8b:94:dd:5f:74:51:fe:fd:35:4e:d1
Signer

9b:ad:b7:14:47:0d:59:18:d7:64:f6:7e:c8:f9:ad:0e:01:85:f5:2a
Signer

.text
Size: 12.7MB - Virtual size: 12.7MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 601KB - Virtual size: 5.6MB

.tls
Size: 1024B - Virtual size: 593B

.rsrc
Size: 9.6MB - Virtual size: 9.6MB

.reloc
Size: 727KB - Virtual size: 726KB