dce194e5f9691437fbeec0a831a34eeb79daf42197890bbd8eced35f83d70f77[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

dce194e5f9691437fbeec0a831a34eeb79daf42197890bbd8eced35f83d70f77.zip.zip
Size

26.4MB
MD5

97e8fb438779d878e5702dda27c02997
SHA1

d73e2d4fd03bcab7d205ebf3eea449f0a7ea3ef5
SHA256

ecd43440dbe63b1792bb58283095862d0b825ef88c11687be01bde04638783cc
SHA512

41d88626878c20ffced64106ea7c63fadd0b406842bbd81f5a77353b0678859fbedb0dd57dc2ee0e8cd8d0933387da2b9afa19d413d6565b281725fa614dbc44
SSDEEP

786432:y//QWyVw9bBep/+HY8dijYHGLclKp62F4yEVlmhs4xm+Ml+pMt:y/KV1/+HPiFSKf7EVUi44+Ml+pMt

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack003/BootCD/WinTools/splitjoin.exe	upx

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack003/BootCD/WinTools/DTemp.exe
unpack003/BootCD/WinTools/DskSpeed.exe
unpack003/BootCD/WinTools/SpaceMonger.exe
unpack003/BootCD/WinTools/memTest.exe
unpack003/BootCD/WinTools/pagedfrg.exe
unpack003/BootCD/WinTools/splitjoin.exe

Files

dce194e5f9691437fbeec0a831a34eeb79daf42197890bbd8eced35f83d70f77.zip.zip
.zip

Password: infected
dce194e5f9691437fbeec0a831a34eeb79daf42197890bbd8eced35f83d70f77.zip
.zip
Hiren's.BootCD.5.0.iso
.iso
BootCD/DiskCmdr.cab
.cab
bold10.fnt
bold12.fnt
bold8.fnt
boot.znc
dskcmdos.exe
mbr.bin
reg8.fnt
BootCD/DosBurn.cab
.cab
ADDEV.COM
ASPI.SYS
CD2FILE.EXE
CD2WAV.CFG
CD2WAV.EXE
CDCOPY.BAT
CDDA2MP3.BAT
CDDA32MB.BAT
CDDA64MB.BAT
CDERASE.BAT
CDRDOS.DAT
CDRECOV.EXE
CDRSHELL.BAT
CDTOOLS.EXE
CLOSE.COM
CWSDPMI.EXE
DELDEV.COM
DOC/DAO16V39/CDTOOLS.TXT
DOC/DAO16V39/DEVLIST.TXT
DOC/DAO16V39/FREEWARE.TXT
DOC/DAO16V39/VARIABLE.TXT
DOC/DOSCDRB2/CDCOPY.TXT
DOC/DOSCDRB2/CDDA2MP3.TXT
DOC/DOSCDRB2/CDDA32MB.TXT
DOC/DOSCDRB2/CDDA64MB.TXT
DOC/DOSCDRB2/CDERASE.TXT
DOC/DOSCDRB2/CDRSHELL.TXT
DOC/DOSCDRB2/ISO2CD.TXT
DOC/VOBSPL11/VOBSPLIT.TXT
FILE2CD.EXE
ISO2CD.BAT
LAME.EXE
LAWS.TXT
OPEN.COM
README.TXT
TCP.DAT
TCP.EXE
TCP.MNU
VOBSPLIT.EXE
BootCD/DskMangr.cab
.cab
DM1.EXE
DM1.HLP
DM1.REC
README.txt
XBIOS.OVL
BootCD/LapLink5.cab
.cab
LL5.EXE
LL5.HLP
LL5.TXT
BootCD/NortonAV.cab
.cab
CATALOG.DAT
ECBOOTIL.VXD
ECMSVR32.DLL
.dll windows:4 windows x86

85c3b929cba1021129223999fb840042

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/11/2002, 00:00

Not After

19/11/2003, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

45:35:8c:13:dd:91:b8:66:b9:a3:af:f5:d3:5b:ef:8d:b4:e7:98:46
Signer

Actual PE Digest

45:35:8c:13:dd:91:b8:66:b9:a3:af:f5:d3:5b:ef:8d:b4:e7:98:46

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ReleaseMutex
GetVersion
GetLogicalDriveStringsA
WriteFile
SetFilePointer
lstrcmpA
FreeLibrary
GetProcAddress
LoadLibraryA
GetFileTime
GetModuleHandleA
SetFileTime
GetEnvironmentVariableA
GetModuleFileNameA
GetCommandLineA
GetACP
IsDBCSLeadByte
GetLocalTime
GetLastError
GlobalLock
GlobalUnlock
GlobalHandle
GlobalAlloc
GlobalFree
SetLastError
SetFileApisToOEM
SetFileApisToANSI
AreFileApisANSI
SetCurrentDirectoryA
GetCurrentDirectoryA
GetDiskFreeSpaceA
GetTempFileNameA
GetTempPathA
DeleteFileA
SetEndOfFile
GetFileAttributesA
SetFileAttributesA
GetCurrentProcess
ReadFile
FindFirstFileA
FindClose
GetLocaleInfoA
GetFileType
GetShortPathNameA
CompareStringA
GetDriveTypeA
GetLogicalDrives
FileTimeToDosDateTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetWindowsDirectoryA
GetSystemDirectoryA
ResumeThread
WideCharToMultiByte
InitializeCriticalSection
lstrcpyA
ReleaseSemaphore
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
TlsSetValue
GetTimeZoneInformation
ExitProcess
GetCPInfo
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapAlloc
RtlUnwind
VirtualAlloc
HeapReAlloc
RaiseException
CompareStringW
SetEnvironmentVariableA
WaitForSingleObject
CreateMutexA
GetVersionExA
lstrcatA
QueryDosDeviceA
CreateFileA
DeviceIoControl
SetErrorMode
GetVolumeInformationA
CloseHandle
lstrlenA
DeleteCriticalSection

user32

CharPrevA
GetSystemMetrics
GetKeyboardType
CharNextA
CharToOemA
CharUpperA
wsprintfA
IsCharUpperA
CharUpperBuffA

advapi32

RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegQueryValueA

Exports

Exports

ECOMInUse
ECOMReleaseUnusedResources
ECOMStartup
_SymGetFreeSystemResources@4
_SymSystemHeapInfo@4

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EXCLUDE.DAT
EXCLUDEL.DAT
NAVDX.EXE
NAVDX.OVL
NAVENG.EXP
NAVENG.SYS
.sys windows:3 windows x86

2a4d6e18f429698a17527b63819e740d

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/11/2002, 00:00

Not After

19/11/2003, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:87:7e:f9:ec:df:6a:49:a7:4e:4b:7e:07:8c:a8:90:dd:ea:c1:5c
Signer

Actual PE Digest

27:87:7e:f9:ec:df:6a:49:a7:4e:4b:7e:07:8c:a8:90:dd:ea:c1:5c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

IoDeleteSymbolicLink
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteDevice
IofCompleteRequest
wcscat
wcscpy

Sections

.text
Size: 160B - Virtual size: 158B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 96B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGED
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 256B - Virtual size: 240B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NAVENG.VXD
NAVENG32.DLL
.dll windows:4 windows x86

fdf9aa058858ce4df8e4d204f49e3db9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/11/2002, 00:00

Not After

19/11/2003, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a0:f5:ca:a5:b3:7d:96:0c:f4:d8:43:9d:f5:ef:03:67:2a:ae:80:c3
Signer

Actual PE Digest

a0:f5:ca:a5:b3:7d:96:0c:f4:d8:43:9d:f5:ef:03:67:2a:ae:80:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

EnterCriticalSection
lstrcpyA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
lstrcatA
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement

user32

CharNextA

Exports

Exports

EXTQueryInterface
WEP

Sections

.text
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NAVEX15.EXP
NAVEX15.SYS
.sys windows:3 windows x86

c6fa58cbd968f323b0db16b6a43e4f61

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/11/2002, 00:00

Not After

19/11/2003, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:98:c5:ac:30:58:df:1a:31:e1:57:68:96:0a:17:1c:2a:df:75:34
Signer

Actual PE Digest

71:98:c5:ac:30:58:df:1a:31:e1:57:68:96:0a:17:1c:2a:df:75:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

ntoskrnl.exe

wcscat
IoCreateSymbolicLink
IoCreateDevice
RtlInitUnicodeString
IoDeleteSymbolicLink
IofCompleteRequest
IoDeleteDevice
wcscpy
strchr
strncmp
strncpy

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGED
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 288B - Virtual size: 282B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 832B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NAVEX15.VXD
NAVEX32A.DLL
.dll windows:4 windows x86

ce7b2e986934686d1ec326624b8047e6

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

12/05/1997, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

12/12/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

28/02/2001, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2001-4 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.

Not Before

19/11/2002, 00:00

Not After

19/11/2003, 23:59

Subject

CN=Symantec Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Symantec Research Labs,O=Symantec Corporation,L=Santa Monica,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:1f:33:f0:92:d3:08:43:11:4d:f3:82:44:02:2e:cd:e9:aa:88:aa
Signer

Actual PE Digest

b9:1f:33:f0:92:d3:08:43:11:4d:f3:82:44:02:2e:cd:e9:aa:88:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeEnvironmentStringsA
GlobalFree
GlobalAlloc
GetTempFileNameA
GetTempPathA
lstrcatA
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
lstrlenA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
HeapAlloc
GetCPInfo
RtlUnwind
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA

user32

CharNextA

Exports

Exports

EXTQueryInterface
WEP

Sections

.text
Size: 492KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NAVOPTS.DAT
NAVSTART.DAT
NCSACERT.TXT
SCRAUTH.DAT
SYMAVENG.CAT
SYMAVENG.INF
TCDEFS.DAT
TCSCAN7.DAT
TCSCAN8.DAT
TCSCAN9.DAT
TECHNOTE.TXT
TINF.DAT
TINFIDX.DAT
TINFL.DAT
TSCAN1.DAT
TSCAN1HD.DAT
V.GRD
V.SIG
VIRFOUND.DAT
VIRSCAN.INF
VIRSCAN1.DAT
VIRSCAN2.DAT
VIRSCAN3.DAT
VIRSCAN4.DAT
VIRSCAN5.DAT
VIRSCAN6.DAT
VIRSCAN7.DAT
VIRSCAN8.DAT
VIRSCAN9.DAT
VIRSCANT.DAT
VSCANMSX.DAT
WHATSNEW.TXT
ZDONE.DAT
hh
.zip
palmdefs1.zip
.zip
pocketpcdefs1.zip
.zip
BootCD/PartCmdr.cab
.cab
BootCD/PartMngr.cab
.cab
BootCD/QuickVie.cab
.cab
BootCD/SavePart.cab
.cab
BootCD/Tools.cab
.cab
BootCD/Vdefs/howto.txt
BootCD/WinTools/DTemp.att
BootCD/WinTools/DTemp.exe
.exe windows:1 windows x86

3a7ba751ff07d6d67499588030d384f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

kernel32

GetCurrentDirectoryA
GetVersion
EnterCriticalSection
LeaveCriticalSection
FindNextFileA
CreateFileA
SetConsoleCtrlHandler
RtlUnwind
RaiseException
TlsSetValue
GetVolumeInformationA
GetSystemInfo
GetStdHandle
VirtualQuery
GetFileType
SetCurrentDirectoryA
UnhandledExceptionFilter
GetFileAttributesA
SizeofResource
ReadFile
VirtualAlloc
LoadResource
InitializeCriticalSection
GetCommandLineA
GetVersionExA
TlsFree
GetSystemDirectoryA
WriteFile
GetProcAddress
FindClose
DeleteFileA
SetHandleCount
SetFilePointer
FindFirstFileA
DeviceIoControl
GetModuleFileNameA
TlsGetValue
GetLocalTime
TlsAlloc
GetLastError
CloseHandle
GetFullPathNameA
ExitProcess
GetEnvironmentStrings
LockResource
GetCurrentThreadId
FileTimeToDosDateTime
GetModuleHandleA
VirtualFree
GlobalMemoryStatus
FileTimeToLocalFileTime
FindResourceA
GetStartupInfoA

user32

ShowWindow
SetTimer
SetForegroundWindow
SetDlgItemTextA
SetDlgItemInt
SendDlgItemMessageA
TranslateMessage
ReleaseDC
PostQuitMessage
LoadIconA
KillTimer
IsWindowVisible
GetDlgItemInt
GetDlgItem
GetDC
GetClientRect
ExitWindowsEx
EnumWindows
EnumThreadWindows
EndDialog
EnableWindow
DrawIconEx
DialogBoxParamA
DestroyWindow
DestroyMenu
CreatePopupMenu
CreateIconIndirect
CreateDialogParamA
AppendMenuA
TrackPopupMenuEx
MessageBoxA
GetMessageA
GetCursorPos
DispatchMessageA
SendMessageA
DestroyIcon

comctl32

InitCommonControls
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create

gdi32

TextOutA
SetTextColor
SetBkMode
SelectObject
PatBlt
GetTextExtentPoint32A
DeleteObject
DeleteDC
CreateSolidBrush
CreateFontA
CreateCompatibleDC
CreateCompatibleBitmap
CreateBitmap

shell32

Shell_NotifyIconA
ShellExecuteA

comdlg32

GetSaveFileNameA
ChooseColorA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

lz32

LZOpenFileA
LZCopy
LZClose

advapi32

RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
RegCloseKey

Exports

Exports

@__lockDebuggerData$qv
@__unlockDebuggerData$qv
__DebuggerHookData
__GetExceptDLLinfo

Sections

CODE
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 13KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 45KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BootCD/WinTools/DskSpeed.exe
.exe windows:4 windows x86

6c4c476e5c97b2e9904abff22b756c7a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
WriteFile
DeviceIoControl
CreateThread
LCMapStringW
LCMapStringA
GetStringTypeW
CloseHandle
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
GetLastError
RtlUnwind
GetFileType
SetFilePointer
CreateFileA
GetVersionExA
QueryPerformanceFrequency
GetStringTypeA
QueryPerformanceCounter
GetStdHandle
SetHandleCount
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
GetProcAddress
HeapDestroy
HeapCreate
VirtualFree
HeapFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
FlushFileBuffers

user32

PostQuitMessage
DialogBoxParamA
MessageBoxA
PostMessageA
ShowWindow
SetWindowPos
GetDlgItem
EnableWindow
SetDlgItemTextA
GetDlgItemTextA
SendMessageA
GetClientRect

advapi32

RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA

shell32

ShellExecuteA

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BootCD/WinTools/ImageExp.cab
.cab
BootCD/WinTools/SpaceMonger.exe
.exe windows:4 windows x86

dabc5019c94f3e88d51d12734e01b9a0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapReAlloc
RaiseException
TerminateProcess
GetACP
HeapSize
HeapDestroy
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
HeapCreate
VirtualFree
GetStdHandle
ExitProcess
RtlUnwind
GetModuleFileNameA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
lstrcpyA
GetModuleHandleA
GlobalLock
GlobalUnlock
GlobalFree
LockResource
FindResourceA
LoadResource
GetCommandLineA
GetStartupInfoA
HeapFree
HeapAlloc
GetFullPathNameA
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
SetErrorMode
GetCurrentDirectoryA
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetLastError
GlobalFlags
Sleep
GetFileType
lstrcmpA
GlobalAlloc
GetDriveTypeA
FileTimeToSystemTime
GetCurrentThread
lstrcpynA
SetLastError
LocalFree
MulDiv
InterlockedIncrement
MultiByteToWideChar
WideCharToMultiByte
GetVersion
InterlockedDecrement
lstrlenA
GlobalGetAtomNameA
lstrcatA
GetCurrentThreadId
GlobalFindAtomA
lstrcmpiA
GlobalAddAtomA
SetUnhandledExceptionFilter
GlobalDeleteAtom
GetStringTypeA
GetEnvironmentStringsW
SetHandleCount
FindFirstFileA
GetDiskFreeSpaceA
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryA
CreateFileA
FindClose
FindNextFileA
CloseHandle
DeviceIoControl

user32

PostMessageA
SetDlgItemInt
SetDlgItemTextA
IsDialogMessageA
SetWindowTextA
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
GetWindowDC
TabbedTextOutA
DrawTextA
GrayStringA
SetRectEmpty
InvalidateRect
PtInRect
LoadAcceleratorsA
TranslateAcceleratorA
ReleaseCapture
SetCursor
GetDesktopWindow
LoadMenuA
SetMenu
ReuseDDElParam
UnpackDDElParam
ValidateRect
GetMessageA
InflateRect
LoadStringA
GetDCEx
LockWindowUpdate
SetCapture
SetParent
GetTopWindow
MessageBoxA
IsChild
GetCapture
WinHelpA
wsprintfA
GetClassInfoA
RegisterClassA
GetMenu
GetSubMenu
GetMenuItemID
SetRect
ShowOwnedPopups
GetKeyState
PostQuitMessage
GetFocus
GetClassLongA
GetPropA
CallWindowProcA
RemovePropA
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
RegisterWindowMessageA
IntersectRect
SystemParametersInfoA
IsIconic
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
GetParent
GetDlgItem
CreateWindowExA
GetWindowLongA
DefWindowProcA
SetWindowLongA
BeginPaint
DrawIcon
EndPaint
SetTimer
KillTimer
ShowWindow
GetWindowRect
SetWindowPos
GetCursorPos
IsWindowEnabled
BringWindowToTop
WindowFromPoint
GetClassNameA
ScreenToClient
LoadCursorA
RegisterClassExA
GetSystemMetrics
LoadImageA
GetWindow
LoadIconA
GetSystemMenu
AppendMenuA
GetWindowPlacement
UpdateWindow
OffsetRect
GetSysColor
GetSysColorBrush
FrameRect
FillRect
GetMenuItemCount
InsertMenuItemA
ClientToScreen
CreatePopupMenu
TrackPopupMenuEx
DestroyMenu
RedrawWindow
GetDC
ReleaseDC
GetClientRect
IsWindow
PeekMessageA
TranslateMessage
DispatchMessageA
AdjustWindowRectEx
EqualRect
DeferWindowPos
BeginDeferWindowPos
CopyRect
EndDeferWindowPos
IsWindowVisible
SendDlgItemMessageA
MapWindowPoints
SetWindowsHookExA
SetFocus
CallNextHookEx
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
SendMessageA
EnableWindow
SetPropA
GetMessageTime
UnhookWindowsHookEx
UnregisterClassA

gdi32

SelectObject
CreateSolidBrush
CreatePalette
CreateFontA
RealizePalette
CreateRectRgn
GetTextExtentPoint32A
GetTextMetricsA
SetTextColor
TextOutA
SetTextAlign
SetBkMode
GetStockObject
GetClipBox
DeleteObject
GetObjectA
CreateBitmap
SetBkColor
CreateRectRgnIndirect
DeleteDC
PatBlt
SaveDC
RestoreDC
SelectPalette
SetROP2
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SelectClipRgn
ExcludeClipRect
IntersectClipRect
MoveToEx
LineTo
GetDeviceCaps
CreatePatternBrush
PtVisible
RectVisible
ExtTextOutA
Escape
StretchDIBits
CreateCompatibleBitmap
GetCharWidthA
CreateFontIndirectA
SetRectRgn
CombineRgn
BitBlt
CreateCompatibleDC

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA

shell32

DragQueryFileA
ShellExecuteExA
SHFileOperationA
ShellExecuteA
SHGetFileInfoA
DragFinish

comctl32

ord17
ImageList_Create
ImageList_ReplaceIcon

Sections

.text
Size: 140KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BootCD/WinTools/memTest.exe
.exe windows:4 windows x86

12df39092d3fff69b45d503c730fff37

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord2554
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord5307
ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord823
ord2621
ord800
ord5953
ord2818
ord540
ord4698
ord1200
ord4593
ord5265
ord4376
ord4853
ord4998
ord4710
ord2514
ord6052
ord4078
ord2512
ord5731
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord4673
ord2124
ord5277
ord4627
ord4425
ord3597
ord324
ord641
ord4234
ord1146
ord1168
ord2863
ord4224
ord2379
ord755
ord470
ord1106
ord2642
ord3092
ord3095
ord926
ord535
ord6199
ord1175
ord924
ord1948
ord5303
ord5715
ord565
ord817
ord2726
ord4226
ord4699
ord4486
ord6375
ord4274
ord4407
ord1775
ord2446
ord1576

msvcrt

__p__acmdln
__getmainargs
exit
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_exit
_onexit
__dllonexit
time
_XcptFilter
__CxxFrameHandler
sprintf
_setmbcp

kernel32

ResumeThread
GlobalMemoryStatus
WaitForSingleObject
GetModuleHandleA
GetStartupInfoA

user32

GetSystemMenu
DrawIcon
GetClientRect
GetSystemMetrics
AppendMenuA
IsIconic
SendMessageA
KillTimer
PostThreadMessageA
EnableWindow
SetTimer
LoadIconA

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BootCD/WinTools/pagedfrg.exe
.exe windows:4 windows x86

ced90662e5f65e076aaff60d115dc74b

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

OpenProcess
GetCurrentProcessId
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetSystemDirectoryA
CreateEventA
GetVersion
LCMapStringA
GetStringTypeW
GetStringTypeA
ReadFile
SetEndOfFile
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
MultiByteToWideChar
SetFilePointer
GetCommandLineA
SetStdHandle
RtlUnwind
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
LCMapStringW
DeviceIoControl
DuplicateHandle
CreateThread
TerminateThread
SetEvent
CloseHandle
GetDriveTypeA
GetModuleHandleA
WaitForSingleObject
GetProcAddress
SetLastError
CreateFileA
FindResourceA
LoadResource
SizeofResource
LockResource
GetCurrentProcess
FlushFileBuffers
GetLastError
GetModuleFileNameA
WriteFile
HeapFree
HeapAlloc
GetStartupInfoA
ExitProcess

user32

LoadIconA
RegisterClassExA
CreateDialogParamA
GetMessageA
TranslateMessage
DispatchMessageA
IsDialogMessageA
PostMessageA
IsDlgButtonChecked
GetDlgItemTextA
WinHelpA
GetDlgItem
EnableWindow
SendDlgItemMessageA
SendMessageA
CheckDlgButton
SetDlgItemTextA
LoadCursorA
GetWindowRect
GetClientRect
CreateWindowExA
SetWindowPos
ShowWindow
PostQuitMessage
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
DefWindowProcA
MessageBoxA
EndDialog

gdi32

GetObjectA
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
GetStockObject

comctl32

ord17

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA

shell32

ShellExecuteA

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BootCD/WinTools/pagedfrg.hlp
BootCD/WinTools/splitjoin.exe
.exe windows:1 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BootCD/autorun.com
BootCD/chntpw.cab
.cab
BootCD/dcc.cab
.cab
BootCD/easyRecv.cab
.cab
BootCD/fm.cab
.cab
BootCD/fprot.cab
.cab
BootCD/fw.cab
.cab
BootCD/ghost.cab
.cab
BootCD/hddtools.cab
.cab
BootCD/icon.ico
BootCD/mix.cab
.cab
BootCD/nortUTIL.cab
.cab
BootCD/nssi.cab
.cab
BootCD/ntfs.cab
.cab
BootCD/pRESIZER.cab
.cab
BootCD/pci.cab
.cab
BootCD/pqdi.cab
.cab
BootCD/pqpm.cab
.cab
BootCD/sa.cab
.cab
BootCD/testdisk.cab
.cab
[BOOT]/Boot-2.88M.img
autorun.inf
keyboard patch/Patch.bat
.bat .vbs
keyboard patch/Readme.txt
keyboard patch/keyb.dat
keyboard patch/keyb.sys

Sharing

General

Malware Config

Signatures

Files

Password: infected

85c3b929cba1021129223999fb840042

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57Certificate

Extended Key Usages

Key Usages

45:35:8c:13:dd:91:b8:66:b9:a3:af:f5:d3:5b:ef:8d:b4:e7:98:46Signer

Headers

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 8KB - Virtual size: 5KB

.data Size: 12KB - Virtual size: 13KB

.rsrc Size: 4KB - Virtual size: 912B

.reloc Size: 12KB - Virtual size: 8KB

2a4d6e18f429698a17527b63819e740d

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57Certificate

Extended Key Usages

Key Usages

27:87:7e:f9:ec:df:6a:49:a7:4e:4b:7e:07:8c:a8:90:dd:ea:c1:5cSigner

Headers

File Characteristics

Imports

ntoskrnl.exe

Sections

.text Size: 160B - Virtual size: 158B

.data Size: 96B - Virtual size: 88B

PAGE Size: 55KB - Virtual size: 55KB

PAGED Size: 2KB - Virtual size: 2KB

INIT Size: 256B - Virtual size: 240B

.rsrc Size: 832B - Virtual size: 824B

.reloc Size: 1KB - Virtual size: 1KB

fdf9aa058858ce4df8e4d204f49e3db9

Code Sign

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75Certificate

Extended Key Usages

Key Usages

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9dCertificate

Extended Key Usages

Key Usages

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57Certificate

Extended Key Usages

Key Usages

a0:f5:ca:a5:b3:7d:96:0c:f4:d8:43:9d:f5:ef:03:67:2a:ae:80:c3Signer

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 72KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

45:35:8c:13:dd:91:b8:66:b9:a3:af:f5:d3:5b:ef:8d:b4:e7:98:46
Signer

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 912B

.reloc
Size: 12KB - Virtual size: 8KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

27:87:7e:f9:ec:df:6a:49:a7:4e:4b:7e:07:8c:a8:90:dd:ea:c1:5c
Signer

.text
Size: 160B - Virtual size: 158B

.data
Size: 96B - Virtual size: 88B

PAGE
Size: 55KB - Virtual size: 55KB

PAGED
Size: 2KB - Virtual size: 2KB

INIT
Size: 256B - Virtual size: 240B

.rsrc
Size: 832B - Virtual size: 824B

.reloc
Size: 1KB - Virtual size: 1KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

a0:f5:ca:a5:b3:7d:96:0c:f4:d8:43:9d:f5:ef:03:67:2a:ae:80:c3
Signer

.text
Size: 76KB - Virtual size: 72KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 16KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 824B

.reloc
Size: 8KB - Virtual size: 4KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

71:98:c5:ac:30:58:df:1a:31:e1:57:68:96:0a:17:1c:2a:df:75:34
Signer

.text
Size: 57KB - Virtual size: 57KB

.data
Size: 11KB - Virtual size: 11KB

PAGE
Size: 404KB - Virtual size: 404KB

PAGED
Size: 37KB - Virtual size: 37KB

INIT
Size: 288B - Virtual size: 282B

.rsrc
Size: 832B - Virtual size: 824B

.reloc
Size: 8KB - Virtual size: 8KB

4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Certificate

4a:29:3e:9d:1d:8c:40:7f:17:49:ff:7d:61:5f:8e:75
Certificate

08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Certificate

7f:4b:a5:0b:f9:97:0f:cc:a0:b2:42:17:9e:96:46:57
Certificate

b9:1f:33:f0:92:d3:08:43:11:4d:f3:82:44:02:2e:cd:e9:aa:88:aa
Signer

.text
Size: 492KB - Virtual size: 490KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 52KB - Virtual size: 59KB

.rsrc
Size: 4KB - Virtual size: 824B

.reloc
Size: 12KB - Virtual size: 11KB