ooregeditor[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

ooregeditor.zip
Size

4.2MB
MD5

d53176e90570963d11e6d2c1dee37f57
SHA1

3f9ab3e5b6f28cd3ae561f809aa6f7794d4dafd2
SHA256

2cb00408bc421ce3ed51bfdd7089bfd28d82a8fa4cfe7787619a6c9d894d1063
SHA512

0136fcc5b677a536c0e87d1063ba4c91835723cc79b7ce81028888d479a9eb105baf3f9043063cefec1e725c0c6a526476c9b35b29e7382c2915a1cf4929ed8a
SSDEEP

98304:AUa+/CFmEiHtoom44u/xEEZZ+ZI5hCN1jnYhw3f9iGU+RCE9G2kC:jT/YFrom44u+EZZXujr3M5SCEx

Score

1^/10

Malware Config

Signatures

Files

ooregeditor.zip
.zip
OORegEdt.exe
.exe windows x64

b30ad0181e55c40990eeba87ab0131ec

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/11/2015, 00:00

Not After

17/12/2016, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8c:f4:4b:30:6b:0c:a6:8d:c8:ce:8d:58:80:84:3c:e4:85:a0:c1:79
Signer

Actual PE Digest

8c:f4:4b:30:6b:0c:a6:8d:c8:ce:8d:58:80:84:3c:e4:85:a0:c1:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mpr

WNetAddConnection2W

kernel32

LoadLibraryA
GetDateFormatW
GetModuleHandleA
GetTimeFormatW
ResetEvent
TerminateThread
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
lstrcpynW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapCreate
HeapSetInformation
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
SetThreadStackGuarantee
VirtualAlloc
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
ExitProcess
CreateThread
ExitThread
HeapReAlloc
HeapFree
HeapAlloc
RtlPcToFileHeader
RaiseException
DecodePointer
EncodePointer
RtlUnwindEx
RtlLookupFunctionEntry
GetStartupInfoW
GetCommandLineW
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTempPathW
GetNumberFormatW
GetCurrentDirectoryW
GetFileSizeEx
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetSystemDirectoryW
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
TlsAlloc
InitializeCriticalSection
TlsGetValue
GlobalFlags
GlobalGetAtomNameW
GetDiskFreeSpaceW
GetTempFileNameW
GetFileTime
SetFileTime
ReplaceFileW
SystemTimeToFileTime
GetUserDefaultLCID
GetTickCount
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
GetLocaleInfoW
LoadLibraryExW
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetCurrentProcessId
ReleaseActCtx
CreateActCtxW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
lstrcmpW
CopyFileW
GlobalSize
FormatMessageW
SetFileAttributesW
CreateDirectoryW
SetFilePointer
ReadFile
GetFileAttributesExW
WriteFile
GetFileSize
GetFileAttributesW
OpenMutexW
CreateMutexW
ReleaseMutex
CreateFileW
lstrcatW
WinExec
lstrcpyW
GetWindowsDirectoryW
WideCharToMultiByte
lstrlenA
lstrlenW
GlobalAlloc
GlobalReAlloc
GlobalFree
MulDiv
ActivateActCtx
DeactivateActCtx
LoadLibraryW
GetCurrentThread
GetUserDefaultLangID
FreeLibrary
WaitForSingleObject
FindFirstFileW
FindClose
GetCurrentProcess
GetVersion
MultiByteToWideChar
SetLastError
LocalFree
GetLastError
CloseHandle
LocalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
SizeofResource
DeleteFileW
CreateProcessW
Sleep
GetSystemInfo
GetModuleHandleW
GetProcAddress
FindResourceW
LoadResource
LockResource
GetExitCodeThread

user32

InsertMenuItemW
CreatePopupMenu
IntersectRect
BringWindowToTop
TranslateAcceleratorW
SetRectEmpty
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
IsIconic
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
SetCursor
PostQuitMessage
GetMessageW
GetCursorPos
CharUpperW
GetWindowThreadProcessId
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassNameW
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
LoadAcceleratorsW
ReleaseCapture
DestroyIcon
GetLastActivePopup
SetActiveWindow
GetWindowRgn
DestroyCursor
DrawIcon
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
UnhookWindowsHookEx
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
PtInRect
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
GetParent
GetWindowTextLengthW
GetWindowTextW
SetScrollPos
GetWindow
ReuseDDElParam
UnpackDDElParam
IsZoomed
RealChildWindowFromPoint
GetSysColorBrush
LoadCursorW
CopyImage
EnumDisplayMonitors
SetLayeredWindowAttributes
GetDialogBaseUnits
UnregisterClassW
DeleteMenu
SetTimer
GetWindowLongW
SetFocus
RegisterWindowMessageW
GetSystemMetrics
EnableMenuItem
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDC
ReleaseDC
CharNextW
CopyAcceleratorTableW
IsRectEmpty
InvalidateRgn
SetCapture
GetNextDlgGroupItem
MessageBeep
EnableWindow
LoadBitmapW
FillRect
PostMessageW
GetWindowRect
GetClientRect
SendMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterClipboardFormatW
InvalidateRect
IsWindow
GetTabbedTextExtentA
GetClipboardFormatNameW
GetCursor
GetClassLongW
IsWindowUnicode
GetWindowLongPtrA
SetWindowLongPtrA
SendMessageTimeoutW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
CreateIconIndirect
GetKeyboardLayoutList
wsprintfW
GetClipboardData
DragDetect
DestroyCaret
ShowCaret
SetCaretPos
CreateCaret
MessageBoxW
DrawTextW
GetScrollPos
GetSubMenu
LoadMenuW
ScreenToClient
GetFocus
LoadIconW
GetMessagePos
GetKeyState
CopyRect
OffsetRect
UpdateWindow
RedrawWindow
KillTimer
LoadImageW
GetAsyncKeyState
SetRect
SubtractRect
GetDoubleClickTime
CharUpperBuffW
CopyIcon
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
WaitMessage
IsMenu
MonitorFromPoint
UpdateLayeredWindow
MapVirtualKeyExW
IsCharLowerW
GetDCEx
PostThreadMessageW
GetSystemMenu
SetParent
UnionRect
WindowFromPoint
GetMenuDefaultItem
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
GetIconInfo
DrawIconEx
SetWindowRgn
DestroyAcceleratorTable
SetClassLongPtrW
DrawStateW
DrawEdge
DrawFrameControl
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
SetCursorPos
LockWindowUpdate

gdi32

GetCurrentPositionEx
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetObjectType
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
DPtoLP
CreateCompatibleBitmap
GetTextMetricsW
CreateFontW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
CombineRgn
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
ScaleWindowExtEx
GetCurrentObject
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
OffsetWindowOrgEx
Polyline
Ellipse
Polygon
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
OffsetRgn
EnumFontFamiliesExW
RoundRect
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextAlign
GetTextFaceW
GetSystemPaletteEntries
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
CopyMetaFileW
StretchDIBits
SelectPalette
GetDIBits
EndDoc
EndPage
StartPage
StartDocW
CreateDCW
CreateFontIndirectW
CreatePen
GetDeviceCaps
SetBoundsRect
GetCharWidthW
BeginPath
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
GetTextExtentPoint32A
SetBrushOrgEx
GetBitmapBits
ExtCreateRegion
GetTextExtentPoint32W
TextOutW
GetStockObject
BitBlt
CreateCompatibleDC
GetObjectW
CreateEllipticRgn
CreateSolidBrush
RealizePalette

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegSetValueExW
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
SetSecurityInfo
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetFileSecurityW
SetFileSecurityW
RegEnumKeyW
RegDeleteKeyW
RegSetValueW
RegLoadKeyW
RegUnLoadKeyW
RegSetKeySecurity
RegGetKeySecurity
RegOpenKeyW
RegConnectRegistryW
RegDeleteKeyExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegEnumValueW
RegQueryValueExW
MapGenericMask
RegQueryInfoKeyW
OpenThreadToken
RegQueryValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
DestroyPrivateObjectSecurity
GetNamedSecurityInfoW
ConvertSidToStringSidW
IsValidSecurityDescriptor
GetSecurityInfo
MakeAbsoluteSD

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteW
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW
DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteExW

comctl32

ord17
ImageList_GetIconSize
ImageList_Draw
_TrackMouseEvent
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_DrawEx

shlwapi

PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathStripToRootW

ole32

CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
RevokeDragDrop
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
CoRegisterMessageFilter
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CoInitializeEx
OleDuplicateData
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
ReleaseStgMedium
CoInitialize
OleFlushClipboard

oleaut32

OleLoadPicturePath
VarUdateFromDate
VariantChangeTypeEx
OleCreateFontIndirect
VarBstrFromDate
VarDateFromStr
SafeArrayDestroy
VariantCopy
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysFreeString

oledlg

OleUIBusyW
OleUIAddVerbMenuW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdiplusShutdown
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 181KB - Virtual size: 180KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OORegEdt32.exe
.exe windows x86

d350cd88c4bf4eb80f018b0c355d64f6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/11/2015, 00:00

Not After

17/12/2016, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:33:f0:9a:f8:7c:c6:78:21:c5:98:14:ed:71:10:3c:ac:3c:8e:06
Signer

Actual PE Digest

5e:33:f0:9a:f8:7c:c6:78:21:c5:98:14:ed:71:10:3c:ac:3c:8e:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mpr

WNetAddConnection2W

kernel32

LoadLibraryA
GetModuleHandleA
GetTimeFormatW
GetDateFormatW
TerminateThread
GetExitCodeThread
EnumResourceLanguagesW
EnumResourceNamesW
EnumResourceTypesW
GetPrivateProfileSectionNamesW
lstrcpynW
InterlockedCompareExchange
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsProcessorFeaturePresent
TerminateProcess
IsDebuggerPresent
UnhandledExceptionFilter
QueryPerformanceCounter
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
SetUnhandledExceptionFilter
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
GetSystemTimeAsFileTime
HeapSize
HeapQueryInformation
ExitProcess
CreateThread
ExitThread
HeapReAlloc
HeapFree
HeapAlloc
RaiseException
DecodePointer
EncodePointer
RtlUnwind
GetStartupInfoW
HeapSetInformation
GetCommandLineW
FindResourceExW
VirtualProtect
SearchPathW
GetProfileIntW
GetTempPathW
GetNumberFormatW
GetCurrentDirectoryW
GetFileSizeEx
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetErrorMode
FileTimeToSystemTime
GetSystemDirectoryW
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
TlsGetValue
GlobalFlags
GlobalGetAtomNameW
GetDiskFreeSpaceW
GetTempFileNameW
GetFileTime
SetFileTime
ReplaceFileW
SystemTimeToFileTime
GetUserDefaultLCID
GetTickCount
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
CompareStringA
GetLocaleInfoW
LoadLibraryExW
InterlockedExchange
CreateEventW
SuspendThread
SetEvent
ResumeThread
SetThreadPriority
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
MoveFileW
lstrcmpiW
GetThreadLocale
GetStringTypeExW
GetCurrentProcessId
ReleaseActCtx
CreateActCtxW
FreeResource
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
CompareStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
lstrcmpW
CopyFileW
GlobalSize
FormatMessageW
SetFileAttributesW
CreateDirectoryW
SetFilePointer
ReadFile
GetFileAttributesExW
WriteFile
GetFileSize
GetFileAttributesW
OpenMutexW
CreateMutexW
ReleaseMutex
CreateFileW
lstrcatW
WinExec
lstrcpyW
GetWindowsDirectoryW
WideCharToMultiByte
lstrlenA
lstrlenW
GlobalAlloc
GlobalReAlloc
GlobalFree
MulDiv
InterlockedDecrement
InterlockedIncrement
ActivateActCtx
DeactivateActCtx
LoadLibraryW
GetCurrentThread
GetUserDefaultLangID
FreeLibrary
WaitForSingleObject
FindFirstFileW
FindClose
GetCurrentProcess
GetVersion
MultiByteToWideChar
SetLastError
LocalFree
GetLastError
CloseHandle
LocalAlloc
GlobalLock
SizeofResource
GlobalUnlock
GetModuleFileNameW
DeleteFileW
CreateProcessW
Sleep
GetSystemInfo
GetModuleHandleW
GetProcAddress
FindResourceW
LoadResource
LockResource
ResetEvent

user32

InsertMenuItemW
CreatePopupMenu
IntersectRect
BringWindowToTop
TranslateAcceleratorW
SetRectEmpty
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
InflateRect
IsIconic
SetWindowContextHelpId
MapDialogRect
ShowOwnedPopups
SetCursor
PostQuitMessage
GetMessageW
GetCursorPos
CharUpperW
GetWindowThreadProcessId
MapVirtualKeyW
GetKeyNameTextW
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
IsWindowEnabled
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
CheckDlgButton
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
LoadAcceleratorsW
ReleaseCapture
DestroyIcon
RemovePropW
GetForegroundWindow
GetWindowRgn
DestroyCursor
DrawIcon
GetLastActivePopup
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetForegroundWindow
ShowScrollBar
IsWindowVisible
ValidateRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
PtInRect
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
GetParent
GetWindowTextLengthW
GetWindowTextW
SetScrollPos
ReuseDDElParam
UnpackDDElParam
IsZoomed
RealChildWindowFromPoint
GetSysColorBrush
LoadCursorW
CopyImage
EnumDisplayMonitors
SetLayeredWindowAttributes
GetDialogBaseUnits
UnregisterClassW
DeleteMenu
SetTimer
GetWindow
GetWindowLongW
SetFocus
RegisterWindowMessageW
GetSystemMetrics
EnableMenuItem
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetDC
CharNextW
CopyAcceleratorTableW
IsRectEmpty
InvalidateRgn
SetCapture
GetNextDlgGroupItem
MessageBeep
EnableWindow
LoadBitmapW
FillRect
PostMessageW
GetWindowRect
GetClientRect
SendMessageW
DispatchMessageW
TranslateMessage
PeekMessageW
RegisterClipboardFormatW
InvalidateRect
IsWindow
GetTabbedTextExtentA
GetClipboardFormatNameW
GetCursor
IsWindowUnicode
GetWindowLongA
SetWindowLongA
SendMessageTimeoutW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
CreateIconIndirect
GetKeyboardLayoutList
wsprintfW
GetClipboardData
DragDetect
DestroyCaret
ShowCaret
SetCaretPos
CreateCaret
MessageBoxW
DrawTextW
GetScrollPos
GetSubMenu
LoadMenuW
ScreenToClient
GetFocus
LoadIconW
GetMessagePos
GetKeyState
CopyRect
OffsetRect
UpdateWindow
RedrawWindow
KillTimer
LoadImageW
GetAsyncKeyState
SetRect
ReleaseDC
SubtractRect
GetDoubleClickTime
CharUpperBuffW
CopyIcon
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
CreateMenu
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
WaitMessage
IsMenu
MonitorFromPoint
UpdateLayeredWindow
MapVirtualKeyExW
IsCharLowerW
GetDCEx
LockWindowUpdate
PostThreadMessageW
GetSystemMenu
SetParent
UnionRect
WindowFromPoint
GetMenuDefaultItem
InvertRect
DrawFocusRect
HideCaret
EnableScrollBar
NotifyWinEvent
GetIconInfo
DrawIconEx
SetWindowRgn
DestroyAcceleratorTable
SetClassLongW
DrawStateW
DrawEdge
DrawFrameControl
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
CreateAcceleratorTableW
SetCursorPos

gdi32

ScaleWindowExtEx
GetCurrentPositionEx
PolyBezierTo
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
GetObjectType
CreateHatchBrush
CreateRectRgnIndirect
PatBlt
DPtoLP
CreateCompatibleBitmap
GetTextMetricsW
CreateFontW
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetRectRgn
CombineRgn
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
SetWindowExtEx
GetCurrentObject
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
SetWindowOrgEx
Polyline
Ellipse
Polygon
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
OffsetRgn
EnumFontFamiliesExW
RoundRect
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
SetPixelV
GetTextAlign
GetTextFaceW
GetSystemPaletteEntries
OffsetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
GetClipRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
CopyMetaFileW
StretchDIBits
SelectPalette
GetDIBits
EndDoc
EndPage
StartDocW
RealizePalette
CreateDCW
CreateFontIndirectW
BeginPath
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
GetTextExtentPoint32A
SetBrushOrgEx
GetBitmapBits
ExtCreateRegion
CreatePen
GetDeviceCaps
SetBoundsRect
GetCharWidthW
GetTextExtentPoint32W
TextOutW
GetStockObject
BitBlt
CreateCompatibleDC
CreateSolidBrush
GetObjectW
CreateEllipticRgn
StartPage

msimg32

AlphaBlend
TransparentBlt

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegSetValueExW
GetEffectiveRightsFromAclW
BuildTrusteeWithSidW
GetSecurityDescriptorDacl
SetSecurityInfo
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetFileSecurityW
SetFileSecurityW
RegEnumKeyW
RegSetValueW
RegLoadKeyW
RegUnLoadKeyW
RegSetKeySecurity
RegGetKeySecurity
RegOpenKeyW
RegConnectRegistryW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegEnumValueW
RegQueryValueExW
MapGenericMask
RegQueryInfoKeyW
OpenThreadToken
RegQueryValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitializeSecurityDescriptor
DestroyPrivateObjectSecurity
GetNamedSecurityInfoW
ConvertSidToStringSidW
IsValidSecurityDescriptor
GetSecurityInfo
MakeAbsoluteSD

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
ShellExecuteW
SHAppBarMessage
SHGetSpecialFolderLocation
SHGetDesktopFolder
ExtractIconW
DragQueryFileW
DragFinish
SHGetFileInfoW
ShellExecuteExW

comctl32

ImageList_Draw
_TrackMouseEvent
ord17
ImageList_GetIconSize
ImageList_Create
ImageList_GetImageCount
ImageList_Destroy
ImageList_AddMasked
ImageList_DrawEx

shlwapi

PathIsUNCW
PathRemoveFileSpecW
PathFindExtensionW
PathFindFileNameW
PathRemoveExtensionW
PathStripToRootW

ole32

CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
RevokeDragDrop
DoDragDrop
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateStreamOnHGlobal
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromString
CLSIDFromProgID
CoCreateGuid
CoInitializeEx
OleDuplicateData
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
ReleaseStgMedium
CoInitialize
CoRegisterMessageFilter

oleaut32

OleLoadPicturePath
VarUdateFromDate
VariantChangeTypeEx
OleCreateFontIndirect
VarBstrFromDate
VarDateFromStr
SafeArrayDestroy
VariantCopy
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SysStringLen
LoadTypeLi
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantChangeType
VariantClear
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysAllocString
SysFreeString

oledlg

OleUIBusyW
OleUIAddVerbMenuW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdiplusShutdown
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 667KB - Virtual size: 666KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 54KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 302KB - Virtual size: 302KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
README.TXT
de/OORegEdt.dll
.dll windows x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/11/2015, 00:00

Not After

17/12/2016, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:1f:bb:6f:16:1f:44:d0:19:8a:ba:cb:7d:7d:ba:9b:7d:46:e6:fa
Signer

Actual PE Digest

1a:1f:bb:6f:16:1f:44:d0:19:8a:ba:cb:7d:7d:ba:9b:7d:46:e6:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
en/OORegEdt.dll
.dll windows x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/11/2015, 00:00

Not After

17/12/2016, 23:59

Subject

CN=O&O Software GmbH,O=O&O Software GmbH,L=Berlin,ST=Berlin,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

91:fe:fd:31:34:21:82:79:79:bc:bb:f6:df:80:a1:ba:5e:36:c5:bb
Signer

Actual PE Digest

91:fe:fd:31:34:21:82:79:79:bc:bb:f6:df:80:a1:ba:5e:36:c5:bb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b30ad0181e55c40990eeba87ab0131ec

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

8c:f4:4b:30:6b:0c:a6:8d:c8:ce:8d:58:80:84:3c:e4:85:a0:c1:79Signer

Headers

DLL Characteristics

File Characteristics

Imports

mpr

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

oledlg

oleacc

gdiplus

imm32

winmm

version

Sections

.text Size: 3.2MB - Virtual size: 3.2MB

.rdata Size: 1.2MB - Virtual size: 1.2MB

.data Size: 72KB - Virtual size: 131KB

.pdata Size: 181KB - Virtual size: 180KB

text Size: 6KB - Virtual size: 5KB

data Size: 12KB - Virtual size: 11KB

.rsrc Size: 87KB - Virtual size: 86KB

.reloc Size: 143KB - Virtual size: 143KB

d350cd88c4bf4eb80f018b0c355d64f6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5e:33:f0:9a:f8:7c:c6:78:21:c5:98:14:ed:71:10:3c:ac:3c:8e:06Signer

Headers

DLL Characteristics

File Characteristics

Imports

mpr

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

8c:f4:4b:30:6b:0c:a6:8d:c8:ce:8d:58:80:84:3c:e4:85:a0:c1:79
Signer

.text
Size: 3.2MB - Virtual size: 3.2MB

.rdata
Size: 1.2MB - Virtual size: 1.2MB

.data
Size: 72KB - Virtual size: 131KB

.pdata
Size: 181KB - Virtual size: 180KB

text
Size: 6KB - Virtual size: 5KB

data
Size: 12KB - Virtual size: 11KB

.rsrc
Size: 87KB - Virtual size: 86KB

.reloc
Size: 143KB - Virtual size: 143KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5e:33:f0:9a:f8:7c:c6:78:21:c5:98:14:ed:71:10:3c:ac:3c:8e:06
Signer

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 667KB - Virtual size: 666KB

.data
Size: 54KB - Virtual size: 90KB

.rsrc
Size: 87KB - Virtual size: 86KB

.reloc
Size: 302KB - Virtual size: 302KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

1a:1f:bb:6f:16:1f:44:d0:19:8a:ba:cb:7d:7d:ba:9b:7d:46:e6:fa
Signer

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

2a:e5:e7:1a:59:33:cd:18:83:da:31:44:a7:03:8a:0c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

91:fe:fd:31:34:21:82:79:79:bc:bb:f6:df:80:a1:ba:5e:36:c5:bb
Signer

.rsrc
Size: 1.4MB - Virtual size: 1.4MB