set-up[.]zip | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

set-up.zip
Size

2.2MB
MD5

149b8dad07609822afbcd4943377a39e
SHA1

3d0eff0b31c79cd824532eba521ec161b610e43b
SHA256

84f7a27811b009113434281dea04b0d47da19617b3ef5961cb27882d96070c5a
SHA512

00481c1e63adca8a6047720adb72034912e5c010db9c4222fb3de5281cd76bcdbb8ba72a3558e98e58772248e78dfbbf4c573ab89966a105cf3a1647ed82312f
SSDEEP

49152:jO5e9ALPMxH5u+JL/bcqknhy055Kltcg9xPy6V42V/UgXfCMk:jGe+LP+ZXxbcqizTKoEP4e//6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/set-up.exe

Files

set-up.zip
.zip

Password: 1337
cache/Dictionaries/en-US-8-0.bdic
cache/en-US-8-0.bdic
set-up.exe
.exe windows x86

Password: 1337

a83b8b24c818a2f241d0b249452952e3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteProcessMemory
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
ReadProcessMemory
GetCurrentProcessId
RemoveVectoredExceptionHandler
VirtualProtect
GetCurrentProcess
GetModuleHandleA
Sleep
CreateFileA
GetSystemDirectoryA
AddVectoredExceptionHandler
GetThreadContext
ExitProcess
FreeLibrary
CreateFileMappingW
MapViewOfFile
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileW
UnmapViewOfFile
K32EnumProcessModulesEx
GetLastError
VirtualProtectEx
K32GetMappedFileNameW
VirtualQueryEx
GetFileSize
GetProcessHeap
GetModuleHandleW
IsWow64Process
ReadFile
SetFilePointer
GetSystemDirectoryW
DuplicateHandle
GetSystemInfo
VirtualAllocEx
VirtualFreeEx
IsBadReadPtr
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
VirtualAlloc
WriteFile
GetModuleHandleExW
VirtualQuery
SetLastError
GetModuleFileNameA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
FindNextFileW
FindFirstFileExW
FindClose
ReadConsoleW
GetConsoleMode
WriteConsoleW
SetFilePointerEx
HeapSize
HeapReAlloc
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

oleaut32

SafeArrayCreate
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData

dbghelp

ImageNtHeader

shlwapi

ord215
PathFindFileNameA

wintrust

WinVerifyTrust

mscoree

CLRCreateInstance

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlceca40.dll
.dll regsvr32 windows x64

Password: 1337

9378a388170d1d97aad5fe49ef5b9a9c

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fe:c6:89:4f:8a:ec:f4:30:ac:5d:ac:df:82:fa:c9:a0:9b:00:54:69
Signer

Actual PE Digest

fe:c6:89:4f:8a:ec:f4:30:ac:5d:ac:df:82:fa:c9:a0:9b:00:54:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

?terminate@@YAXXZ
__crt_debugger_hook
strstr
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
atol
sscanf_s
_vsnprintf
realloc
rand_s
malloc
_itow_s
towlower
swprintf_s
swscanf_s
wprintf
_wcsnicmp
wcscpy_s
vswprintf_s
free
fclose
_wfopen_s
iswspace
mbstowcs_s
feof
fseek
ferror
fread
_wtoi
_wcsicmp
_vsnprintf_s
wcsrchr
_purecall
wcsncpy_s
wcschr
wcsstr
_vsnwprintf_s
_vsnwprintf
_strlwr_s
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
memcpy
memset
memcmp

kernel32

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualAlloc
VirtualFree
IsDBCSLeadByteEx
ReadFile
GetSystemDefaultLCID
SystemTimeToFileTime
GetPrivateProfileSectionW
DeleteFileW
GetPrivateProfileIntW
GetFileAttributesW
GetVersionExW
GetPrivateProfileStringW
OutputDebugStringW
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
LoadLibraryW
GetProcAddress
GetLastError
GetCurrentDirectoryW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLocalTime
GetModuleHandleW
WriteFile
DisableThreadLibraryCalls
GetLocaleInfoW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetTickCount
RaiseException
GlobalMemoryStatus
GetFullPathNameW
Sleep
CloseHandle
CreateMutexW
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
LocalFree
GetCurrentThreadId
GetCurrentProcessId
GetSystemDirectoryW
CreateFileW
GetFileSize
SetFilePointer
SetEndOfFile
ReleaseMutex
GetVersionExA
MoveFileExW
GetSystemInfo

crypt32

CryptUnprotectData
CryptProtectData

advapi32

RegEnumValueW
RegQueryValueExW
RegDeleteKeyW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoGetMalloc
StringFromGUID2
StringFromCLSID

oleaut32

VariantChangeType
VariantCopy
SetErrorInfo
GetErrorInfo
SysFreeString
LoadTypeLi
RegisterTypeLi
SysAllocStringLen
VariantInit
VariantClear
SysStringLen
SysAllocString
CreateErrorInfo

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

wininet

InternetReadFile
InternetCloseHandle
HttpOpenRequestW
DetectAutoProxyUrl
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
HttpSendRequestA
HttpQueryInfoA
InternetSetOptionW
InternetConnectW

ws2_32

getaddrinfo
freeaddrinfo
inet_addr
getnameinfo
gethostname

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 398KB - Virtual size: 397KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlcecompact40.dll
.dll windows x64

Password: 1337

aa3ce00754057e3b5982796ed92e1ed8

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:82:d4:68:fd:95:f7:f0:0c:75:49:23:78:f9:07:b2:48:ed:41:2c
Signer

Actual PE Digest

0e:82:d4:68:fd:95:f7:f0:0c:75:49:23:78:f9:07:b2:48:ed:41:2c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

wprintf
_vsnprintf_s
_itow_s
swprintf_s
memset
memcpy
??3@YAXPEAX@Z
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
towlower
free
??2@YAPEAX_K@Z
_vsnwprintf_s
_wcsnicmp
wcsncpy_s
_wcsicmp
_purecall
vswprintf_s
memcmp

kernel32

GetTempPathW
CopyFileW
OutputDebugStringW
ReleaseMutex
WideCharToMultiByte
DisableThreadLibraryCalls
InitializeCriticalSection
DeleteCriticalSection
HeapDestroy
HeapCreate
HeapSetInformation
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
LeaveCriticalSection
GetTempFileNameW
CreateFileW
GetFileSize
CloseHandle
FreeLibrary
GetLocalTime
GetUserDefaultLCID
DeleteFileW
GetLastError
GetVersionExA
SetLastError
GetFileType
Sleep
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetModuleHandleW
CreateMutexW
GetFullPathNameW
LCMapStringW
WaitForSingleObject
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
MoveFileExW
GetProcAddress
GetModuleFileNameW
LoadLibraryW
GetSystemDirectoryW
QueryPerformanceCounter

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateGuid

Exports

Exports

SeRebuild

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 878B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlceer40EN.dll
.dll windows x64

Password: 1337

c87c2a73c4e25d3b70a017b9438324ca

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:01

Not After

25-07-2013 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:1d:1f:a3:d5:42:a0:94:9e:c0:87:72:2c:9c:ba:42:f4:03:5a:cf
Signer

Actual PE Digest

fb:1d:1f:a3:d5:42:a0:94:9e:c0:87:72:2c:9c:ba:42:f4:03:5a:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

__crt_debugger_hook
_onexit
_encode_pointer
_lock
__dllonexit
_unlock
__clean_type_info_names_internal
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
free
_initterm_e
_initterm
_malloc_crt

kernel32

Sleep
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter

user32

LoadStringW

Exports

Exports

SSCEGetErrorString

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlceme40.dll
.dll windows x64

Password: 1337

1ad21ec922b5c713aa9fba6463802528

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:b8:70:b4:2d:e3:22:76:2d:b2:41:15:45:15:c5:5d:35:8d:fd:47
Signer

Actual PE Digest

58:b8:70:b4:2d:e3:22:76:2d:b2:41:15:45:15:c5:5d:35:8d:fd:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

_itow_s
_vsnprintf_s
wprintf
swprintf_s
_malloc_crt
_initterm
_initterm_e
free
_encoded_null
_decode_pointer
_amsg_exit
__C_specific_handler
memset
memcpy
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
vswprintf_s
__CppXcptFilter
_encode_pointer
_wcsnicmp
wcsrchr
_vsnwprintf_s
wcsncpy_s
_wcsicmp
wcscpy_s
memcmp

kernel32

MoveFileExW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
CloseHandle
ReleaseMutex
HeapDestroy
HeapCreate
HeapSetInformation
HeapAlloc
HeapReAlloc
HeapSize
HeapFree
GetProcAddress
FreeLibrary
GetLastError
FormatMessageW
MultiByteToWideChar
Sleep
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
WriteFile
WaitForSingleObject
SetEndOfFile
SetFilePointer
GetFileSize
GetLocalTime
CreateFileW
GetModuleFileNameW
GetLocaleInfoW
OutputDebugStringW
GetModuleHandleW
LoadLibraryW

ole32

CoCreateGuid
CLSIDFromString

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString
SysAllocStringLen

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

Exports

Exports

DllAddRef
DllCanUnloadNow
DllMain
DllRelease
ME_AbortTransaction
ME_CleanupTombstoneData
ME_CleanupTrackingMetadata
ME_CleanupTransactionData
ME_ClearErrorInfo
ME_CloseAndReleaseStore
ME_CloseStore
ME_CommitTransaction
ME_CompileQueryPlan
ME_CreateCommand
ME_CreateDatabase
ME_CreateErrorInstance
ME_DeleteArray
ME_DeleteRecord
ME_DisableChangeTracking
ME_EnableChangeTracking
ME_ExecuteQueryPlan
ME_ExitChangeTracking
ME_GetBookmark
ME_GetChangeTrackingInfo
ME_GetColumnInfo
ME_GetColumnOrdinal
ME_GetColumnsUpdated
ME_GetContextErrorInfo
ME_GetContextErrorMessage
ME_GetCurrentTrackingTxBsn
ME_GetCurrentTrackingTxCsn
ME_GetDatabaseInstanceID
ME_GetEncryptionMode
ME_GetIndexColumnOrdinals
ME_GetKeyInfo
ME_GetLocale
ME_GetLocaleFlags
ME_GetMinorError
ME_GetNativeVersionInfo
ME_GetParameterInfo
ME_GetSqlCeVersionInfo
ME_GetTrackingContext
ME_GetTrackingOptions
ME_GetTransactionBsn
ME_GetTransactionFlags
ME_GetValues
ME_GotoBookmark
ME_InitChangeTracking
ME_InsertRecord
ME_IsTableChangeTracked
ME_Move
ME_OpenCursor
ME_OpenStore
ME_OpenTransaction
ME_Prepare
ME_Read
ME_ReadAt
ME_Rebuild
ME_SafeDelete
ME_SafeRelease
ME_Seek
ME_SetColumnInfo
ME_SetContextErrorInfo
ME_SetRange
ME_SetTableInfoAsSystem
ME_SetTrackingContext
ME_SetTransactionFlag
ME_SetValue
ME_SetValues
ME_UpdateRecord
uwrda_Pull
uwrda_Push
uwrda_RemoteDataAccess
uwrda_SubmitSql
uwrda_SysFreeString
uwrda_get_CompressionLevel
uwrda_get_ConnectTimeout
uwrda_get_ConnectionManager
uwrda_get_ConnectionRetryTimeout
uwrda_get_ErrorPointer
uwrda_get_InternetLogin
uwrda_get_InternetPassword
uwrda_get_InternetProxyLogin
uwrda_get_InternetProxyPassword
uwrda_get_InternetProxyServer
uwrda_get_InternetUrl
uwrda_get_LocalConnectionString
uwrda_get_ReceiveTimeout
uwrda_get_SendTimeout
uwrda_put_CompressionLevel
uwrda_put_ConnectTimeout
uwrda_put_ConnectionManager
uwrda_put_ConnectionRetryTimeout
uwrda_put_InternetLogin
uwrda_put_InternetPassword
uwrda_put_InternetProxyLogin
uwrda_put_InternetProxyPassword
uwrda_put_InternetProxyServer
uwrda_put_InternetUrl
uwrda_put_LocalConnectionString
uwrda_put_ReceiveTimeout
uwrda_put_SendTimeout
uwrepl_AddSubscription
uwrepl_AsyncReplication
uwrepl_Cancel
uwrepl_DropSubscription
uwrepl_GetSyncResult
uwrepl_Initialize
uwrepl_LoadProperties
uwrepl_ReinitializeSubscription
uwrepl_Replication
uwrepl_Run
uwrepl_SaveProperties
uwrepl_Terminate
uwrepl_WaitForNextStatusReport
uwrepl_get_CompressionLevel
uwrepl_get_ConnectTimeout
uwrepl_get_ConnectionManager
uwrepl_get_ConnectionRetryTimeout
uwrepl_get_Distributor
uwrepl_get_DistributorAddress
uwrepl_get_DistributorLogin
uwrepl_get_DistributorNetwork
uwrepl_get_DistributorPassword
uwrepl_get_DistributorSecurityMode
uwrepl_get_ErrorPointer
uwrepl_get_ExchangeType
uwrepl_get_HostName
uwrepl_get_InternetLogin
uwrepl_get_InternetPassword
uwrepl_get_InternetProxyLogin
uwrepl_get_InternetProxyPassword
uwrepl_get_InternetProxyServer
uwrepl_get_InternetUrl
uwrepl_get_LoginTimeout
uwrepl_get_PostSyncCleanup
uwrepl_get_ProfileName
uwrepl_get_Publication
uwrepl_get_Publisher
uwrepl_get_PublisherAddress
uwrepl_get_PublisherChanges
uwrepl_get_PublisherConflicts
uwrepl_get_PublisherDatabase
uwrepl_get_PublisherLogin
uwrepl_get_PublisherNetwork
uwrepl_get_PublisherPassword
uwrepl_get_PublisherSecurityMode
uwrepl_get_QueryTimeout
uwrepl_get_ReceiveTimeout
uwrepl_get_SendTimeout
uwrepl_get_SnapshotTransferType
uwrepl_get_Subscriber
uwrepl_get_SubscriberChanges
uwrepl_get_SubscriberConflicts
uwrepl_get_SubscriberConnectionString
uwrepl_get_Validate
uwrepl_put_CompressionLevel
uwrepl_put_ConnectTimeout
uwrepl_put_ConnectionManager
uwrepl_put_ConnectionRetryTimeout
uwrepl_put_Distributor
uwrepl_put_DistributorAddress
uwrepl_put_DistributorLogin
uwrepl_put_DistributorNetwork
uwrepl_put_DistributorPassword
uwrepl_put_DistributorSecurityMode
uwrepl_put_ExchangeType
uwrepl_put_HostName
uwrepl_put_InternetLogin
uwrepl_put_InternetPassword
uwrepl_put_InternetProxyLogin
uwrepl_put_InternetProxyPassword
uwrepl_put_InternetProxyServer
uwrepl_put_InternetUrl
uwrepl_put_LoginTimeout
uwrepl_put_PostSyncCleanup
uwrepl_put_ProfileName
uwrepl_put_Publication
uwrepl_put_Publisher
uwrepl_put_PublisherAddress
uwrepl_put_PublisherDatabase
uwrepl_put_PublisherLogin
uwrepl_put_PublisherNetwork
uwrepl_put_PublisherPassword
uwrepl_put_PublisherSecurityMode
uwrepl_put_QueryTimeout
uwrepl_put_ReceiveTimeout
uwrepl_put_SendTimeout
uwrepl_put_SnapshotTransferType
uwrepl_put_Subscriber
uwrepl_put_SubscriberConnectionString
uwrepl_put_Validate
uwutil_ConvertFromDBTIMESTAMP
uwutil_ConvertToDBTIMESTAMP
uwutil_ReleaseCOMPtr
uwutil_SysFreeString
uwutil_ZeroMemory
uwutil_get_Error
uwutil_get_ErrorCount

Sections

.text
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlceqp40.dll
.dll windows x64

Password: 1337

46577fdb55ca93aec30667f864165326

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:01

Not After

25-07-2013 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:01:fb:08:33:ce:c3:fd:68:58:dd:88:5d:f9:c7:13:d0:fe:d6:84
Signer

Actual PE Digest

7f:01:fb:08:33:ce:c3:fd:68:58:dd:88:5d:f9:c7:13:d0:fe:d6:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
_vsnprintf_s
wprintf
wcsstr
_finite
rand_s
wcscat_s
wcstod
_clearfp
_vsnwprintf_s
_wcsnicmp
iswalpha
_wtol
_purecall
memmove
wcschr
modf
iswdigit
iswspace
swscanf_s
_itow_s
_ultow_s
malloc
free
towlower
vswprintf_s
wcsncpy_s
wcscpy_s
_wcsicmp
sin
cos
atan
asin
acos
sqrt
log
exp
atan2
log10
ceil
floor
memcmp
pow
floorf
ceilf
memcpy
memset
tan

kernel32

RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
Sleep
MoveFileExW
OutputDebugStringW
GetCurrentProcessId
GetCurrentThreadId
GetSystemInfo
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemDefaultLCID
CompareStringW
FileTimeToSystemTime
GetACP
MultiByteToWideChar
IsValidCodePage
GetLocalTime
LCMapStringW
GetLastError
GetTickCount
FreeLibrary
LoadLibraryW
GetModuleFileNameW
CreateFileW
GetProcAddress
CloseHandle
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetFileSize
SetFilePointer
SetEndOfFile
WaitForSingleObject
WriteFile
WideCharToMultiByte
ReleaseMutex
RtlLookupFunctionEntry

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CLSIDFromString
CoCreateFreeThreadedMarshaler
StringFromGUID2

oleaut32

VarDecFromCy
VarI2FromUI4
VarI2FromR8
VariantCopy
VarR4FromDec
VarCyFromDec
VarUI1FromI4
VarI4FromCy
SafeArrayUnlock
VarI2FromR4
VarCyFromUI1
SafeArrayCreate
VariantInit
VarUI1FromR4
SystemTimeToVariantTime
VarBstrFromDec
VarR4FromI1
VarBstrFromR8
SysAllocStringLen
VarR4FromCy
VarI4FromR8
VarDateFromStr
VarI4FromDec
VarI4FromStr
VarI2FromStr
VarR8FromI1
VarCyFromUI2
VarDecFromR8
VarBoolFromStr
VarCyFromR8
VarDecFromR4
SafeArrayLock
VarI4FromI1
VarI2FromDec
VarI4FromR4
VarUI1FromStr
VarI2FromI1
VarBstrFromDate
VarR8FromStr
VariantChangeTypeEx
VarUI1FromUI2
VarCyFromI4
VarBoolFromDec
VarI2FromCy
VarR8FromUI1
SysStringByteLen
VarI2FromUI1
SysFreeString
VarR4FromR8
VarR4FromUI1
VarCyFromStr
VarBstrFromR4
VarUI1FromI2
VarCyFromR4
VarR8FromCy
VarBstrFromCy
VarUI1FromDec
SetErrorInfo
VarI2FromI4
VarCyFromI2
VarUI1FromR8
VarR8FromDec
SysStringLen
VarUI1FromCy
VarBoolFromCy
VarI4FromUI1
VarR4FromStr
VariantClear
VarUI1FromBool
VarUI1FromUI4
VarCyFromI1
VarCyFromUI4

user32

CharUpperBuffW
CharLowerBuffW
CharNextExA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain

Sections

.text
Size: 815KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
sqlcese40.dll
.dll windows x64

Password: 1337

5810176cd4bbca01cf7bdc2d8d93ff57

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16-09-2006 01:04

Not After

15-09-2019 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2008 19:02

Not After

25-07-2013 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f9:93:48:d8:56:90:4c:95:82:a7:c4:ab:d5:41:b0:37:36:30:2e:cc
Signer

Actual PE Digest

f9:93:48:d8:56:90:4c:95:82:a7:c4:ab:d5:41:b0:37:36:30:2e:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcr90

?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__crt_debugger_hook
memcpy
memset
__clean_type_info_names_internal
_onexit
_lock
__dllonexit
_unlock
__CppXcptFilter
__C_specific_handler
_amsg_exit
_decode_pointer
_encoded_null
_initterm_e
_initterm
_malloc_crt
_encode_pointer
_snwprintf_s
towlower
wprintf
_vsnprintf_s
atoi
_ultow_s
swprintf_s
vswprintf_s
strncmp
rand_s
_wcsnicmp
_itow_s
qsort
_wcsicmp
free
malloc
swscanf_s
wcsrchr
_vsnwprintf_s
wcsncpy_s
wcscpy_s
memmove
_purecall
memcmp

kernel32

MoveFileExW
GetSystemDirectoryW
GetModuleFileNameW
WideCharToMultiByte
OutputDebugStringW
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
CloseHandle
CreateEventW
WriteFile
GetUserDefaultLCID
GetCurrentProcessId
FileTimeToSystemTime
DeleteFileW
GetProcessHeap
HeapValidate
HeapFree
LocalFree
HeapAlloc
LocalAlloc
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
HeapDestroy
HeapCreate
HeapReAlloc
HeapSize
GetSystemInfo
LoadLibraryW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
LCMapStringW
WaitForSingleObject
ReleaseMutex
GetCurrentThreadId
GetTickCount
Sleep
CompareFileTime
GetLocalTime
OpenThread
GetExitCodeThread
GetTempFileNameW
IsValidLocale
FlushFileBuffers
GetProcessTimes
GetCurrentProcess
GetVolumeInformationW
CreateFileW
SetFilePointer
ReadFile
SetEndOfFile
GlobalMemoryStatus
GetSystemTime
CreateMutexW
OpenMutexW
CreateFileMappingW
OpenFileMappingW
GetFullPathNameW
GetDriveTypeW
GetVersionExA
GetLocaleInfoA
MapViewOfFile
UnmapViewOfFile
GetFileInformationByHandle
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
GetFileType
GetFileSize
GetModuleHandleW
SetThreadPriority
CreateThread
WaitForMultipleObjects
SetEvent
QueryPerformanceCounter
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
HeapSetInformation

advapi32

GetFileSecurityW
InitializeSecurityDescriptor
SetFileSecurityW
SetSecurityDescriptorDacl
GetSecurityDescriptorLength
IsValidSecurityDescriptor
GetSecurityDescriptorControl
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

ole32

CoCreateFreeThreadedMarshaler

user32

DispatchMessageW
TranslateMessage
KillTimer
PeekMessageW
SetTimer
MsgWaitForMultipleObjectsEx
UnregisterClassW
DestroyWindow
CreateWindowExW
RegisterClassW
GetClassInfoW
DefWindowProcW
IsWindow
SendMessageW
PostMessageW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
EnableCedbFailpoint
EnableStorePlayback
EnableStoreTracing
InitSerialization
SqlCeAddDatabaseProps
SqlCeAddSyncPartner
SqlCeAttachCustomTrackingData
SqlCeBeginSyncSession
SqlCeBeginTransaction
SqlCeChangeDatabaseLCID
SqlCeCloseHandle
SqlCeCreateDatabase
SqlCeCreateSession
SqlCeDeleteDatabase
SqlCeDeleteRecord
SqlCeEndSyncSession
SqlCeEndTransaction
SqlCeEnumDBVolumes
SqlCeFindFirstDatabase
SqlCeFindNextChangedRecord
SqlCeFindNextDatabase
SqlCeFlushDBVol
SqlCeFreeNotification
SqlCeGetChangedRecordCnt
SqlCeGetChangedRecords
SqlCeGetCustomTrackingData
SqlCeGetDBInformationByHandle
SqlCeGetDatabaseProps
SqlCeGetDatabaseSession
SqlCeGetPropChangeInfo
SqlCeGetRecordChangeInfo
SqlCeMarkRecord
SqlCeMountDBVol
SqlCeOidGetInfo
SqlCeOnServerLoad
SqlCeOpenDatabase
SqlCeOpenDatabaseEx
SqlCeOpenStream
SqlCePurgeTrackingData
SqlCePurgeTrackingGenerations
SqlCeReadRecordProps
SqlCeRemoveDatabaseProps
SqlCeRemoveDatabaseTracking
SqlCeRemoveSyncPartner
SqlCeSeekDatabase
SqlCeSetDatabaseInfo
SqlCeSetSessionOption
SqlCeStreamRead
SqlCeStreamSaveChanges
SqlCeStreamSeek
SqlCeStreamSetSize
SqlCeStreamWrite
SqlCeTrackDatabase
SqlCeTrackProperty
SqlCeUninitialize
SqlCeUnmountDBVol
SqlCeWriteRecordProps
SuspendStoreOperation

Sections

.text
Size: 503KB - Virtual size: 502KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
translations/qt_ca.qm
translations/qt_cs.qm
translations/qt_de.qm
translations/qt_en.qm
translations/qt_fi.qm
translations/qt_fr.qm
translations/qt_he.qm
translations/qt_hu.qm
translations/qt_it.qm
translations/qt_ja.qm
translations/qt_ko.qm
translations/qt_lv.qm
translations/qt_ru.qm
translations/qt_sk.qm
translations/qt_uk.qm

Sharing

General

Malware Config

Signatures

Files

Password: 1337

Password: 1337

a83b8b24c818a2f241d0b249452952e3

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

dbghelp

shlwapi

wintrust

mscoree

Sections

.text Size: 126KB - Virtual size: 125KB

.rdata Size: 55KB - Virtual size: 54KB

.data Size: 4KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 7KB - Virtual size: 7KB

Password: 1337

9378a388170d1d97aad5fe49ef5b9a9c

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

fe:c6:89:4f:8a:ec:f4:30:ac:5d:ac:df:82:fa:c9:a0:9b:00:54:69Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

crypt32

advapi32

ole32

oleaut32

version

wininet

ws2_32

Exports

Exports

Sections

.text Size: 398KB - Virtual size: 397KB

.data Size: 8KB - Virtual size: 13KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 25KB - Virtual size: 25KB

.reloc Size: 4KB - Virtual size: 4KB

Password: 1337

aa3ce00754057e3b5982796ed92e1ed8

Code Sign

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

61:19:cc:93:00:01:00:00:00:66Certificate

Extended Key Usages

Key Usages

61:06:94:2d:00:00:00:00:00:09Certificate

Extended Key Usages

Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

0e:82:d4:68:fd:95:f7:f0:0c:75:49:23:78:f9:07:b2:48:ed:41:2cSigner

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

.text
Size: 126KB - Virtual size: 125KB

.rdata
Size: 55KB - Virtual size: 54KB

.data
Size: 4KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 7KB - Virtual size: 7KB

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:19:cc:93:00:01:00:00:00:66
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

fe:c6:89:4f:8a:ec:f4:30:ac:5d:ac:df:82:fa:c9:a0:9b:00:54:69
Signer

.text
Size: 398KB - Virtual size: 397KB

.data
Size: 8KB - Virtual size: 13KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 25KB - Virtual size: 25KB

.reloc
Size: 4KB - Virtual size: 4KB

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:19:cc:93:00:01:00:00:00:66
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

0e:82:d4:68:fd:95:f7:f0:0c:75:49:23:78:f9:07:b2:48:ed:41:2c
Signer

.text
Size: 88KB - Virtual size: 87KB

PAGELK
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 30KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 878B

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:19:cc:93:00:01:00:00:00:66
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

fb:1d:1f:a3:d5:42:a0:94:9e:c0:87:72:2c:9c:ba:42:f4:03:5a:cf
Signer

.text
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 192B

.rsrc
Size: 138KB - Virtual size: 137KB

.reloc
Size: 512B - Virtual size: 36B

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:19:cc:93:00:01:00:00:00:66
Certificate

61:06:94:2d:00:00:00:00:00:09
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

58:b8:70:b4:2d:e3:22:76:2d:b2:41:15:45:15:c5:5d:35:8d:fd:47
Signer

.text
Size: 57KB - Virtual size: 56KB