1[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1.zip
Size

9.1MB
MD5

748c6f55b4b78710535cfa1d125452c9
SHA1

0730ba7a55a943b66a8d1c3f01019c805466909b
SHA256

a090b61d0195db1fc8d42d48db88a643151f2ad8132779b194e6090f396289e4
SHA512

670ee37cb4b76842dd1d66d540122b4ff627c8b0e4a62f06288636d7cc6afc8c26cb70e1b43b75fd6c41ef7487845f7905e6e813d22515fcafe125cb82e82ba0
SSDEEP

196608:gfeD4p2OSSSuUNWDvXey4SNenoAGvC+Q/j00+t3RPAy7+s+:gfe5OSSUQL34SL9k/Y0ohPAyb+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/海外模式前期准备工具.docx.exe

Files

1.zip
.zip

Password: infected
Postex/2.txt
Postex/captcommBase.dll
.dll windows x86

3ed7dd407efd7d7bc87188256e7521d9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:6a:f9:5e:02:ce:45:d3:5f:44:51:1e:61:c6:ce:d6
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/12/2020, 00:00

Not After

02/01/2024, 23:59

Subject

CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=Hangzhou,ST=Zhejiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:18:1a:bd:e4:1c:56:d0:17:41:ac:4e:ba:30:5f:8b:0a:70:70:14:27:e5:d3:e4:74:68:6d:31:3e:6c:25:e4
Signer

Actual PE Digest

8c:18:1a:bd:e4:1c:56:d0:17:41:ac:4e:ba:30:5f:8b:0a:70:70:14:27:e5:d3:e4:74:68:6d:31:3e:6c:25:e4

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

opengl32

glViewport
glVertex3f
glTranslatef
glTexParameteri
glTexImage2D
glTexCoord2f
glRotatef
glMatrixMode
glLoadIdentity
glGenTextures
glFlush
glEnd
glEnable
glCullFace
glClearDepth
glClearColor
glClear
glBindTexture
glBegin
wglMakeCurrent
wglGetCurrentDC
wglGetCurrentContext
wglDeleteContext
wglCreateContext

glu32

gluPerspective
gluLookAt

kernel32

SetEvent
CreateEventA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetTickCount
GetDiskFreeSpaceA
GetFileTime
GetFullPathNameA
SetFileTime
GetTempFileNameA
ReplaceFileA
SystemTimeToFileTime
GetUserDefaultLCID
GetProfileIntA
SearchPathA
VerSetConditionMask
VerifyVersionInfoA
InitializeCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalHandle
LocalReAlloc
SetErrorMode
VirtualProtect
FileTimeToSystemTime
GetThreadLocale
GlobalFlags
InitializeCriticalSectionAndSpinCount
ResetEvent
PulseEvent
GetOEMCP
GetCPInfo
DeleteFileA
FindClose
FindFirstFileA
FlushFileBuffers
LockFile
SetEndOfFile
UnlockFile
WriteFile
DuplicateHandle
GetHandleInformation
GetCurrentProcess
LoadLibraryExA
GetShortPathNameA
MoveFileA
GetVolumeInformationA
GetStringTypeExA
GetTempPathA
GetACP
GetFileAttributesExA
GetFileSizeEx
LocalFileTimeToFileTime
SetFileAttributesA
FindResourceExW
GetUserDefaultUILanguage
ReleaseSemaphore
ReleaseMutex
CreateMutexA
WaitForMultipleObjects
CreateSemaphoreA
GetWindowsDirectoryA
LocalLock
LocalUnlock
GetModuleHandleExW
RtlUnwind
EncodePointer
DecodePointer
AreFileApisANSI
GetCommandLineA
HeapValidate
GetSystemInfo
RaiseException
SetThreadStackGuarantee
VirtualAlloc
VirtualQuery
IsDebuggerPresent
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
ExitThread
SetStdHandle
GetFileType
GetLocaleInfoEx
OutputDebugStringW
WriteConsoleW
FatalAppExitA
SetConsoleCtrlHandler
WaitForSingleObjectEx
lstrlenA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
TerminateProcess
GetStartupInfoW
RegisterApplicationRestart
GetProcessHeap
InitOnceExecuteOnce
QueryPerformanceCounter
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapFree
HeapReAlloc
HeapSize
HeapQueryInformation
HeapAlloc
GetStringTypeW
GetConsoleCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetTimeFormatEx
GetDateFormatEx
CompareStringEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
GetTimeZoneInformation
SetEnvironmentVariableA
OpenEventW
InitializeCriticalSectionEx
FileTimeToLocalFileTime
CreateFileMappingW
OpenFileMappingW
GetCurrentDirectoryA
GlobalReAlloc
GetModuleFileNameA
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
GetFileAttributesA
GetCurrentProcessId
ResumeThread
SuspendThread
GetThreadPriority
SetThreadPriority
GlobalFindAtomA
GlobalAddAtomA
FindResourceA
LoadLibraryW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
GetVersion
OutputDebugStringA
GetFileAttributesW
lstrcmpA
GetAtomNameA
GlobalGetAtomNameA
MultiByteToWideChar
CopyFileA
FormatMessageA
MulDiv
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
SetLastError
lstrcpyA
FreeResource
GetCurrentThreadId
GetThreadPreferredUILanguages
ApplicationRecoveryFinished
GetStdHandle
ApplicationRecoveryInProgress
Sleep
ExitProcess
GetVersionExA
CreateFileMappingA
MapViewOfFile
LocalAlloc
LocalFree
UnmapViewOfFile
CreateFileW
SetFilePointer
LoadLibraryA
lstrcmpiA
GetProcAddress
GetModuleHandleA
VirtualFree
GetLastError
InterlockedDecrement
InterlockedIncrement
CreateThread
WaitForSingleObject
CloseHandle
ReadFile
GetFileSize
CreateFileA
WideCharToMultiByte
FindResourceW
SizeofResource
LockResource
LoadResource
RegisterApplicationRecoveryCallback
IsValidCodePage
GetCurrentThread
CompareStringA

user32

EnableMenuItem
ModifyMenuA
DeleteMenu
InsertMenuItemA
SetMenuItemInfoA
GetMenuDefaultItem
SetMenuDefaultItem
DrawIcon
DrawTextA
DrawTextExA
GrayStringA
DrawStateA
GetTabbedTextExtentA
WindowFromDC
ExcludeUpdateRgn
ScrollDC
SetMenuContextHelpId
GetMenuContextHelpId
DrawFocusRect
FrameRect
InvertRect
CheckMenuRadioItem
LoadBitmapA
CreateDialogIndirectParamA
EndDialog
RegisterClipboardFormatA
WaitMessage
GetKeyNameTextA
MapVirtualKeyA
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongA
GetKeyboardLayout
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
CopyAcceleratorTableA
IsRectEmpty
SetCursorPos
CopyIcon
ChangeWindowMessageFilter
IsClipboardFormatAvailable
InSendMessage
SetRectEmpty
RealChildWindowFromPoint
GetClipboardFormatNameA
GetDoubleClickTime
GetComboBoxInfo
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
DestroyCursor
EnumChildWindows
GetDialogBaseUnits
CharNextA
PtInRect
UnregisterClassA
IsCharLowerA
MapVirtualKeyExA
MsgWaitForMultipleObjectsEx
GetTabbedTextExtentW
SetRect
InflateRect
IntersectRect
UnionRect
SubtractRect
LoadMenuA
TranslateAcceleratorA
LoadAcceleratorsA
ArrangeIconicWindows
DlgDirSelectComboBoxExA
DlgDirListComboBoxA
DlgDirSelectExA
DlgDirListA
LoadCursorW
GetLastActivePopup
FindWindowExA
FindWindowA
SetParent
GetDesktopWindow
ChildWindowFromPointEx
ChildWindowFromPoint
WindowFromPoint
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
CreateCaret
GetWindowContextHelpId
SetWindowContextHelpId
EnableScrollBar
ShowScrollBar
LockWindowUpdate
RedrawWindow
ValidateRgn
InvalidateRgn
ValidateRect
GetWindowRgn
SetWindowRgn
GetUpdateRgn
GetUpdateRect
GetWindowDC
GetDCEx
SetForegroundWindow
UpdateWindow
DragDetect
GetSystemMenu
DrawMenuBar
HiliteMenuItem
KillTimer
SetTimer
GetActiveWindow
GetOpenClipboardWindow
ChangeClipboardChain
GetClipboardViewer
SetClipboardViewer
GetClipboardOwner
OpenClipboard
GetNextDlgTabItem
GetNextDlgGroupItem
BringWindowToTop
IsWindowVisible
CloseWindow
OpenIcon
ShowOwnedPopups
FlashWindow
MonitorFromPoint
SendNotifyMessageA
CheckMenuItem
DrawCaption
IsDialogMessageA
SetWindowTextA
ScrollWindowEx
IsWindowEnabled
EnableWindow
SendDlgItemMessageA
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
GetDlgItemInt
SetDlgItemInt
MoveWindow
GetMonitorInfoA
MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
LoadIconW
GetWindow
GetTopWindow
GetClassNameA
GetClassLongA
SetWindowLongA
GetWindowLongA
EqualRect
CopyRect
MapWindowPoints
ScreenToClient
AdjustWindowRectEx
GetWindowTextLengthA
GetWindowTextA
RemovePropA
GetPropA
SetPropA
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetActiveWindow
TrackPopupMenuEx
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
GetDlgItem
DeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
GetClassInfoExA
GetClassInfoA
CallWindowProcA
GetMessageTime
GetMessagePos
LoadBitmapW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
MapDialogRect
TabbedTextOutA
SendMessageA
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
IsMenu
GetParent
DestroyAcceleratorTable
NotifyWinEvent
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
SetCursor
MessageBeep
GetAsyncKeyState
SetFocus
CharUpperA
IsZoomed
IsIconic
EndDeferWindowPos
BeginDeferWindowPos
IsChild
IsWindow
TrackMouseEvent
RegisterWindowMessageA
SystemParametersInfoA
OffsetRect
wsprintfA
MessageBoxA
GetFocus
DispatchMessageA
GetMessageA
TranslateMessage
PeekMessageA
GetClientRect
GetSystemMetrics
ShowWindow
GetDC
GetWindowRect
CreateWindowExA
CreateWindowExW
AdjustWindowRect
RegisterClassA
RegisterClassW
LoadCursorA
LoadIconA
GetCursorPos
SetCapture
ReleaseCapture
GetKeyState
DestroyWindow
EndPaint
BeginPaint
PostQuitMessage
DefWindowProcA
PostMessageA
SetSysColors
GetSysColor
InvalidateRect
ReleaseDC
GetMenuItemInfoA
LoadMenuW
CreatePopupMenu
CreateMenu
LoadMenuIndirectA
DrawFrameControl
DrawEdge
UpdateLayeredWindow
DrawAnimatedRects
CharUpperBuffA
GetIconInfo
DrawIconEx
FillRect
GetSysColorBrush
CopyImage
LoadImageW
EmptyClipboard
SetClipboardData
CloseClipboard
ReuseDDElParam
UnpackDDElParam
GetMenuBarInfo
LoadImageA
DestroyIcon
GetWindowThreadProcessId
PostThreadMessageA
DestroyMenu
GetForegroundWindow

gdi32

Arc
Chord
CombineRgn
CreateBitmapIndirect
GetTextCharacterExtra
GetTextAlign
GetTextColor
GetTextExtentPoint32A
GetFontLanguageInfo
GetCharacterPlacementA
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
InvertRgn
MaskBlt
PlgBlt
OffsetRgn
Pie
PaintRgn
PolyPolygon
PtInRegion
PtVisible
RectInRegion
RectVisible
Rectangle
ResetDCA
RoundRect
ResizePalette
SetBitmapBits
SetBoundsRect
SetPixelV
SetRectRgn
UpdateColors
PlayEnhMetaFile
GdiComment
GetTextMetricsA
CreateBrushIndirect
CreateDiscardableBitmap
CreateDIBPatternBrushPt
CreateEllipticRgn
CreateEllipticRgnIndirect
CreateFontIndirectA
CreateFontA
CreateHatchBrush
CreateICA
CreatePen
CreatePenIndirect
CreatePolyPolygonRgn
CreatePatternBrush
AnimatePalette
CreateRectRgnIndirect
CreateRoundRectRgn
StretchBlt
DrawEscape
Ellipse
EnumObjects
EqualRgn
Escape
ExtEscape
ExtCreateRegion
ExtFloodFill
FillRgn
FloodFill
FrameRgn
GetROP2
GetAspectRatioFilterEx
GetBkColor
GetBkMode
GetBitmapBits
GetBitmapDimensionEx
ChoosePixelFormat
DescribePixelFormat
GetPixelFormat
SetPixelFormat
SwapBuffers
DeleteObject
DeleteDC
GdiFlush
SetDIBits
SelectObject
CreateDIBSection
CreateCompatibleDC
GetStockObject
SetPaletteEntries
GetPaletteEntries
RealizePalette
SelectPalette
SetSystemPaletteUse
CreatePalette
UnrealizeObject
SetPixel
PatBlt
GetPixel
GetDIBits
GetBoundsRect
GetBrushOrgEx
GetCharWidthA
GetCharWidthFloatA
GetCharABCWidthsA
GetCharABCWidthsFloatA
CreateRectRgn
SetDIBColorTable
GetCurrentObject
GetCurrentPositionEx
GetFontData
GetGlyphOutlineA
GetGraphicsMode
GetMapMode
GetNearestColor
GetNearestPaletteIndex
GetObjectType
CreateCompatibleBitmap
BitBlt
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
ExtTextOutA
CreateEnhMetaFileA
CloseEnhMetaFile
CreateMetaFileA
CloseMetaFile
GetDeviceCaps
CreateDCA
CreateSolidBrush
CopyMetaFileA
DeleteMetaFile
GetTextExtentPoint32W
GetTextExtentPointA
GetSystemPaletteEntries
EnumFontFamiliesExA
StretchDIBits
GetTextCharsetInfo
EnumFontFamiliesA
CreateDIBitmap
ScaleWindowExtEx
ScaleViewportExtEx
OffsetWindowOrgEx
OffsetViewportOrgEx
SetWindowOrgEx
SetWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PolylineTo
PolyBezierTo
MoveToEx
SetArcDirection
SelectClipPath
PolyDraw
ArcTo
SetColorAdjustment
ModifyWorldTransform
SetWorldTransform
EnumMetaFile
PlayMetaFileRecord
SetTextJustification
SetTextAlign
SetTextCharacterExtra
SetStretchBltMode
SetROP2
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetGraphicsMode
SetMapperFlags
SetBkMode
ExtSelectClipRgn
AngleArc
PolyPolyline
GetWorldTransform
GetColorAdjustment
GetOutlineTextMetricsA
GetPolyFillMode
GetRegionData
GetRgnBox
SelectClipRgn
SaveDC
CreateHalftonePalette
StartDocA
EndDoc
StartPage
EndPage
AbortDoc
SetAbortProc
AbortPath
BeginPath
CloseFigure
EndPath
FillPath
FlattenPath
GetPath
PathToRegion
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
ExtCreatePen
GetMiterLimit
GetArcDirection
TextOutA
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
PolyBezier
GetStretchBltMode
SetBitmapDimensionEx
SetBrushOrgEx
GetTextFaceA
GetKerningPairsA
ExcludeClipRect
GetClipBox
GetClipRgn
IntersectClipRect
LineTo
OffsetClipRgn
PlayMetaFile
RestoreDC

advapi32

RegSetValueA
RegDeleteKeyA
RegDeleteValueA
RegSetValueExA
RegEnumKeyA
RegQueryValueA
SetFileSecurityA
GetFileSecurityA
RegEnumKeyExA
RegOpenKeyExW
RegEnumValueA
SetThreadToken
OpenThreadToken
RevertToSelf
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA

shell32

DragFinish
SHAppBarMessage
ShellExecuteA
SHGetFileInfoA
SHCreateItemFromParsingName
ExtractIconA
SHGetMalloc
DragQueryFileA
SHGetSpecialFolderLocation
SHBrowseForFolderA
SHGetDesktopFolder
SHAddToRecentDocs
SHGetKnownFolderPath
ShellExecuteExA
SHGetSpecialFolderPathA
SHGetPathFromIDListA
InitNetworkAddressControl
DragAcceptFiles

msimg32

GradientFill
AlphaBlend
TransparentBlt

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathRemoveExtensionA
PathFindFileNameA
PathFindExtensionA
StrFormatKBSizeA

uxtheme

DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetThemeSysColor
GetWindowTheme
IsAppThemed
DrawThemeParentBackground
DrawThemeTextEx
BufferedPaintInit
BufferedPaintUnInit
BeginBufferedPaint
EndBufferedPaint
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
OpenThemeData
CloseThemeData

dwmapi

DwmDefWindowProc
DwmSetWindowAttribute
DwmExtendFrameIntoClientArea
DwmIsCompositionEnabled

oledlg

ord9
ord7
ord6
ord5
ord4
ord3
ord8

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromFile
GdipCreateBitmapFromStreamICM
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePalette
GdipDrawImageI
GdipGetImagePaletteSize
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipAlloc
GdipBitmapUnlockBits
GdipDeleteGraphics

winmm

PlaySoundA

imm32

ImmGetContext
ImmGetOpenStatus
ImmReleaseContext

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

propsys

PSGetPropertyDescriptionListFromString

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter
GetJobA

ole32

OleCreateLinkToFile
OleCreateFromFile
OleSave
OleSaveToStream
OleSetContainedObject
OleIsRunning
OleLockRunning
OleGetIconOfClass
GetHGlobalFromILockBytes
CreateILockBytesOnHGlobal
OleSetMenuDescriptor
CoGetMalloc
StgCreateDocfile
StgOpenStorage
StgIsStorageFile
CreateFileMoniker
OleCreateStaticFromData
CoDisconnectObject
StringFromGUID2
CoInitializeEx
OleCreateLinkFromData
CoRegisterClassObject
CoRevokeClassObject
CoRegisterMessageFilter
OleGetClipboard
CoLockObjectExternal
RegisterDragDrop
RevokeDragDrop
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
OleTranslateAccelerator
IsAccelerator
OleQueryLinkFromData
OleQueryCreateFromData
OleRun
OleRegGetMiscStatus
OleRegEnumVerbs
GetClassFile
GetRunningObjectTable
CreateDataAdviseHolder
CreateOleAdviseHolder
OleCreateFromData
OleCreate
WriteClassStm
CreateItemMoniker
CreateGenericComposite
StgIsStorageILockBytes
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
OleSetClipboard
PropVariantCopy
CLSIDFromProgID
CLSIDFromString
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
CreateStreamOnHGlobal
SetConvertStg
OleRegGetUserType
ReleaseStgMedium
OleDuplicateData
ReadFmtUserTypeStg
WriteFmtUserTypeStg
WriteClassStg
ReadClassStg
CreateBindCtx
CoTreatAsClass
CoTaskMemFree
CoTaskMemAlloc
CoGetClassObject
StringFromCLSID
OleLoad

oleaut32

SysAllocStringLen
VariantClear
VariantChangeType
SysStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString
VariantInit
SafeArrayGetDim
SafeArrayGetElemsize
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
SysReAllocStringLen
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayCreate
SafeArrayDestroyDescriptor
SafeArrayDestroyData
SafeArrayDestroy
SafeArrayRedim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SafeArrayPutElement
SafeArrayCopy
SafeArrayPtrOfIndex
VariantCopy
VarDateFromStr
VarCyFromStr
VarBstrFromCy
VarBstrFromDate
VarBstrFromDec
VarDecFromStr
OleCreateFontIndirect
DosDateTimeToVariantTime
SystemTimeToVariantTime
VariantTimeToSystemTime
VarDateFromUdate
VarUdateFromDate

Exports

Exports

SignalChromeElf

Sections

.textbss
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 783KB - Virtual size: 782KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Postex/xiaomi.exe
.exe windows x86

f445a355de351458a817ecff1e323bab

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2006, 17:01

Not After

23/05/2016, 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/01/2013, 00:00

Not After

16/02/2016, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c2:10:a5:69:40:bd:5a:9e:0e:9a:ab:ed:19:72:30:cb:ed:44:60:92
Signer

Actual PE Digest

c2:10:a5:69:40:bd:5a:9e:0e:9a:ab:ed:19:72:30:cb:ed:44:60:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

captcommbase

ord1

Exports

Exports

CreateModule
FinalizeModule
InitializeModule
ReleaseModule

Sections

.tp3
Size: 1.6MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp3
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp3
Size: 5.9MB - Virtual size: 12.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp3
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp3
Size: 48KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tp3
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
海外模式前期准备工具.docx.exe
.exe windows x64

9b1750fedfd6c58671276fa1f0f96e20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

LCMapStringW
GetStringTypeW
VirtualAlloc
VirtualFree
LoadLibraryA
GetNativeSystemInfo
IsBadReadPtr
RtlPcToFileHeader
RtlUnwindEx
HeapValidate
GetCommandLineA
GetCommandLineW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapQueryInformation
GetStdHandle
GetFileType
WriteConsoleW
QueryPerformanceFrequency
SetStdHandle
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleOutputCP
GetConsoleMode
ReadConsoleW
SetFilePointerEx
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
VirtualQuery
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
Sleep
SearchPathA
ResetEvent
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
FindResourceExW
GetWindowsDirectoryA
GetTickCount
GetUserDefaultLCID
GetTempFileNameA
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
GetCPInfo
GetOEMCP
lstrcpyA
FileTimeToSystemTime
GetVolumeInformationA
lstrcmpiA
GetHandleInformation
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
OutputDebugStringW
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
CreateFileA
VirtualProtect
GetProfileIntA
GetACP
GetThreadLocale
GetAtomNameA
SetErrorMode
DeleteFileA
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
CompareStringW
GetCurrentDirectoryA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetSystemDirectoryW
EncodePointer
LeaveCriticalSection
EnterCriticalSection
CopyFileA
FormatMessageA
MulDiv
LocalFree
GlobalSize
ResumeThread
SetThreadPriority
GlobalAddAtomA
WaitForSingleObject
SetEvent
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GlobalUnlock
GetModuleHandleExW
GetModuleFileNameW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
FindResourceA
GlobalFree
FreeResource
CompareStringA
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
LoadLibraryExW
GetModuleFileNameA
FreeLibrary
GetVersionExA
GetCurrentThreadId
GetCurrentThread
VirtualProtectEx
OutputDebugStringA
VirtualQueryEx
GetCurrentProcessId
GetSystemInfo
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatusEx
HeapFree
CloseHandle
OpenProcess
GetCurrentProcess
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
GetLastError
SetLastError
MultiByteToWideChar
ExitProcess
FindClose
FindNextFileA
FindFirstFileA
GetEnvironmentVariableA
SetEndOfFile
CreateFileW

user32

MonitorFromWindow
WinHelpA
GetScrollInfo
SetScrollInfo
UnhookWindowsHookEx
GetClassNameA
GetClassLongPtrA
GetClassLongA
SetWindowLongPtrA
GetWindowLongPtrA
SetWindowLongA
PtInRect
EqualRect
AdjustWindowRectEx
RemovePropA
GetPropA
SetPropA
ScrollWindow
TrackPopupMenu
SetMenu
GetMenu
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
CallWindowProcA
DefWindowProcA
GetMessageTime
GetMessagePos
RegisterWindowMessageA
CopyRect
GetSysColor
GetWindowTextLengthA
GetWindowTextA
SetFocus
OffsetRect
SetRectEmpty
SendDlgItemMessageA
InvertRect
FrameRect
FillRect
DrawFocusRect
GetSysColorBrush
DrawStateA
GrayStringA
DrawTextExA
DrawTextA
DrawIcon
SetMenuDefaultItem
GetMenuDefaultItem
SetMenuItemInfoA
GetMenuItemInfoA
InsertMenuItemA
DeleteMenu
ModifyMenuA
EnableMenuItem
CheckMenuItem
CreatePopupMenu
CreateMenu
LoadMenuW
LoadMenuA
DrawFrameControl
DrawEdge
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringA
IsMenu
NotifyWinEvent
GetMonitorInfoA
LoadIconW
LoadIconA
LoadCursorW
LoadCursorA
GetTopWindow
SetParent
WindowFromPoint
MapWindowPoints
ScreenToClient
ClientToScreen
HideCaret
GetWindowRect
GetClientRect
EnableScrollBar
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
LockWindowUpdate
RedrawWindow
InvalidateRgn
InvalidateRect
GetWindowRgn
SetWindowRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
SetForegroundWindow
SetWindowTextA
RegisterHotKey
GetSystemMetrics
UnregisterClassA
PeekMessageA
PostQuitMessage
GetForegroundWindow
UpdateWindow
GetSystemMenu
DrawMenuBar
KillTimer
SetTimer
SetCapture
GetCapture
OpenClipboard
GetNextDlgTabItem
GetNextDlgGroupItem
IsZoomed
IsDialogMessageA
WaitMessage
ReleaseCapture
CopyImage
SystemParametersInfoA
RealChildWindowFromPoint
LoadAcceleratorsW
DestroyMenu
CharNextA
CopyAcceleratorTableA
SetRect
IntersectRect
IsRectEmpty
MessageBeep
BringWindowToTop
IsIconic
ShowWindow
MoveWindow
CheckDlgButton
SetWindowPos
SetWindowContextHelpId
GetParent
GetWindow
MapDialogRect
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetActiveWindow
EnableWindow
IsWindowEnabled
SetActiveWindow
GetWindowLongA
GetDesktopWindow
SendMessageA
PostMessageA
TabbedTextOutA
GetFocus
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetMessageA
TranslateMessage
DispatchMessageA
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
SetCursor
MessageBoxA
GetWindowThreadProcessId
GetLastActivePopup
PostThreadMessageA
IsChild
ShowOwnedPopups
IsWindowVisible
DestroyCursor
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
IsClipboardFormatAvailable
CharUpperBuffA
GetDoubleClickTime
DestroyAcceleratorTable
CreateAcceleratorTableA
ToAsciiEx
GetKeyboardState
MapVirtualKeyExA
IsCharLowerA
GetKeyboardLayout
GetComboBoxInfo
MonitorFromPoint
UpdateLayeredWindow
CopyIcon
SetCursorPos
EmptyClipboard
SetClipboardData
CloseClipboard
SetClassLongPtrA
EnumDisplayMonitors
SetLayeredWindowAttributes
GetIconInfo
DrawIconEx
UnionRect
RegisterClipboardFormatA
LoadImageW
TrackMouseEvent
MapVirtualKeyA
GetKeyNameTextA
ReuseDDElParam
LoadImageA
TranslateAcceleratorA
LoadAcceleratorsA
CharUpperA
DestroyIcon
UnpackDDElParam
InflateRect
GetAsyncKeyState
GetClipboardFormatNameA

gdi32

CreateFontIndirectA
CreateHatchBrush
CreatePalette
CreatePen
CreatePatternBrush
CreateRectRgn
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
Ellipse
Escape
ExtFloodFill
FillRgn
FrameRgn
GetBkColor
GetBoundsRect
GetMapMode
GetNearestPaletteIndex
GetObjectType
GetPaletteEntries
GetPixel
GetRgnBox
GetStockObject
GetTextColor
GetTextExtentPoint32A
GetViewportExtEx
GetViewportOrgEx
GetWindowExtEx
GetWindowOrgEx
OffsetRgn
PatBlt
PtInRegion
PtVisible
RectVisible
Rectangle
RealizePalette
RoundRect
SelectObject
SetPaletteEntries
SetPixel
SetPixelV
StretchBlt
SetRectRgn
GetTextMetricsA
GetObjectA
TextOutA
CreatePolygonRgn
DPtoLP
LPtoDP
Polygon
Polyline
GetTextFaceA
DeleteDC
DeleteObject
ExcludeClipRect
GetClipBox
IntersectClipRect
LineTo
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkColor
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
MoveToEx
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
EnumFontFamiliesExA
GetSystemPaletteEntries
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
CreateDIBSection
SetDIBColorTable
CreateCompatibleBitmap
CombineRgn
BitBlt
GetDeviceCaps
CreateEllipticRgn
CreateDCA
CopyMetaFileA
CreateBitmap
ExtTextOutA
CreateCompatibleDC

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueA
RegEnumValueA
RegEnumKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumKeyA

shell32

ShellExecuteA
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
DragQueryFileA
SHGetFileInfoA
SHAppBarMessage
DragFinish

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathIsUNCA
PathRemoveFileSpecW
PathFindFileNameA
PathFindExtensionA
StrFormatKBSizeA

uxtheme

DrawThemeBackground
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
IsAppThemed
DrawThemeParentBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
GetThemeSysColor
OpenThemeData
DrawThemeText
CloseThemeData

ole32

RegisterDragDrop
RevokeDragDrop
OleGetClipboard
DoDragDrop
CoRegisterMessageFilter
OleLockRunning
OleIsCurrentClipboard
OleFlushClipboard
CreateStreamOnHGlobal
CoRevokeClassObject
OleUninitialize
OleInitialize
OleCreateMenuDescriptor
OleDestroyMenuDescriptor
CoFreeUnusedLibraries
CoDisconnectObject
CoInitializeEx
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
StringFromGUID2
CoGetClassObject
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
StringFromCLSID
CoInitialize
CoCreateInstance
CLSIDFromProgID
CoCreateGuid
CoUninitialize
OleTranslateAccelerator
IsAccelerator
CoLockObjectExternal
CLSIDFromString

oleaut32

VarBstrFromDate
VariantCopy
LoadTypeLi
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
OleCreateFontIndirect
VariantChangeType
VariantClear
VariantInit
SysAllocStringByteLen
SysFreeString
SysAllocStringLen

oledlg

ord8

psapi

EnumProcesses
EnumProcessModules

gdiplus

GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDeleteGraphics
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromScan0

oleacc

AccessibleObjectFromWindow
CreateStdAccessibleObject
LresultFromObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 959KB - Virtual size: 1018KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.giats
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gxfg
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

3ed7dd407efd7d7bc87188256e7521d9

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

03:6a:f9:5e:02:ce:45:d3:5f:44:51:1e:61:c6:ce:d6Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

8c:18:1a:bd:e4:1c:56:d0:17:41:ac:4e:ba:30:5f:8b:0a:70:70:14:27:e5:d3:e4:74:68:6d:31:3e:6c:25:e4Signer

Headers

DLL Characteristics

File Characteristics

Imports

opengl32

glu32

kernel32

user32

gdi32

advapi32

shell32

msimg32

comctl32

shlwapi

uxtheme

dwmapi

oledlg

gdiplus

winmm

imm32

oleacc

propsys

winspool.drv

ole32

oleaut32

Exports

Exports

Sections

.textbss Size: - Virtual size: 3.0MB

.text Size: 6.1MB - Virtual size: 6.1MB

.rdata Size: 783KB - Virtual size: 782KB

.data Size: 46KB - Virtual size: 84KB

.idata Size: 30KB - Virtual size: 29KB

.rsrc Size: 1.7MB - Virtual size: 1.7MB

.reloc Size: 316KB - Virtual size: 316KB

f445a355de351458a817ecff1e323bab

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0eCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

c2:10:a5:69:40:bd:5a:9e:0e:9a:ab:ed:19:72:30:cb:ed:44:60:92Signer

Headers

File Characteristics

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

03:6a:f9:5e:02:ce:45:d3:5f:44:51:1e:61:c6:ce:d6
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

8c:18:1a:bd:e4:1c:56:d0:17:41:ac:4e:ba:30:5f:8b:0a:70:70:14:27:e5:d3:e4:74:68:6d:31:3e:6c:25:e4
Signer

.textbss
Size: - Virtual size: 3.0MB

.text
Size: 6.1MB - Virtual size: 6.1MB

.rdata
Size: 783KB - Virtual size: 782KB

.data
Size: 46KB - Virtual size: 84KB

.idata
Size: 30KB - Virtual size: 29KB

.rsrc
Size: 1.7MB - Virtual size: 1.7MB

.reloc
Size: 316KB - Virtual size: 316KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

71:70:bd:93:cf:3f:18:9a:e6:45:2b:51:4c:49:34:0e
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

c2:10:a5:69:40:bd:5a:9e:0e:9a:ab:ed:19:72:30:cb:ed:44:60:92
Signer

.tp3
Size: 1.6MB - Virtual size: 6.5MB

.tp3
Size: 1.6MB - Virtual size: 1.6MB

.tp3
Size: 5.9MB - Virtual size: 12.4MB

.tp3
Size: 4KB - Virtual size: 1KB

.tp3
Size: 48KB - Virtual size: 46KB

.tp3
Size: 20KB - Virtual size: 20KB

.text
Size: 4.2MB - Virtual size: 4.2MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 959KB - Virtual size: 1018KB

.pdata
Size: 191KB - Virtual size: 190KB

.gfids
Size: 111KB - Virtual size: 111KB

.giats
Size: 512B - Virtual size: 16B

.tls
Size: 512B - Virtual size: 9B

.gxfg
Size: 32KB - Virtual size: 32KB

.gehcont
Size: 512B - Virtual size: 40B

.rsrc
Size: 39KB - Virtual size: 38KB

.reloc
Size: 84KB - Virtual size: 83KB