26443d1fcdbefb494516212b02d148de

Sharing

Copy URL

Twitter E-mail

General

Target

26443d1fcdbefb494516212b02d148de
Size

1.8MB
MD5

26443d1fcdbefb494516212b02d148de
SHA1

201772cded29e7b7c5d330dfc60ccff1821d535c
SHA256

47927a246897dad732396203f1ceb9f35cb1ceb6c9753f67f281601ebe2c185b
SHA512

adf48d01277dda1e6bc221679fe6821dac76c156ca2113882e1d67e5cbdbdab8d180f4c649a86fa97a7f5ae1bb2fe9971faadb500331b5e3e17c085db1be1289
SSDEEP

49152:BwHwX0u37rLAylDEkTvhvTKIgPUMypWNQVOVttheY:qHwX0u3MylAkTvMI02WSVOV9eY

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/Adobe.Contribute.CS5.v6.0.Keymaker.Only-CORE/keygen.exe	upx
static1/unpack004/CORE10k.EXE	upx
static1/unpack004/keygen.exe	upx
static1/unpack007/CORE10k.EXE	upx
static1/unpack007/keygen.exe	upx
static1/unpack002/Adobe.Flash.Catalyst.CS5.v1.0.Keymaker.Only-CORE/keygen.exe	upx
static1/unpack002/Adobe.Illustrator.CS5.v15.0.Keymaker.Only-CORE/keygen.exe	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Adobe.Contribute.CS5.v6.0.Keymaker.Only-CORE/keygen.exe
unpack004/CORE10k.EXE
unpack004/keygen.exe
unpack007/CORE10k.EXE
unpack007/keygen.exe
unpack002/Adobe.Dreamweaver.CS5.v11.0.4909.Incl.Keymaker-EMBRACE/keygen.exe
unpack002/Adobe.Flash.Catalyst.CS5.v1.0.Keymaker.Only-CORE/keygen.exe
unpack002/Adobe.Flash.Professional.CS5.Keymaker-EMBRACE/keygen.exe
unpack002/Adobe.Illustrator.CS5.v15.0.Keymaker.Only-CORE/keygen.exe
unpack002/Adobe.InDesign.CS5.Premium.v7.0.Incl.Keymaker-EMBRACE/keygen.exe
unpack002/Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE/keygen.exe

Files

26443d1fcdbefb494516212b02d148de
.rar
CS5.5 Crack/Crackx86/ADOBE-cs5-全系列注册机.rar
.rar
Adobe.Contribute.CS5.v6.0.Keymaker.Only-CORE/core.nfo
Adobe.Contribute.CS5.v6.0.Keymaker.Only-CORE/file_id.diz
Adobe.Contribute.CS5.v6.0.Keymaker.Only-CORE/keygen.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 540KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Creative.Suite.5.Master.Collection.Keymaker.Only-CORE/core.nfo
Adobe.Creative.Suite.5.Master.Collection.Keymaker.Only-CORE/cr-x1500.zip
.zip
CORE.NFO
CORE10k.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 13.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 129KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FILE_ID.DIZ
keygen.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 536KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Creative.Suite.5.Master.Collection.Keymaker.Only-CORE/file_id.diz
Adobe.Creative.Suite.5.Master.Collection.MAC.OSX-HOTiSO.._hotiso.NFO/Adobe.Creative.Suite.5.Master.Collection.MAC.OSX-HOTiSO.._hotiso.nfo
Adobe.Creative.Suite.5.Master.Collection.MAC.OSX-HOTiSO.._hotiso.NFO/readme.txt
Adobe.Creative.Suite.5.Production.Premium.Multilingual.Keymaker.Only-CORE/CORE.NFO
Adobe.Creative.Suite.5.Production.Premium.Multilingual.Keymaker.Only-CORE/FILE_ID.DIZ
Adobe.Creative.Suite.5.Production.Premium.Multilingual.Keymaker.Only-CORE/cr-cs5pp.zip
.zip
CORE.NFO
CORE10k.EXE
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 13.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 129KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
FILE_ID.DIZ
keygen.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 536KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Dreamweaver.CS5.v11.0.4909.Incl.Keymaker-EMBRACE/embrace.nfo
Adobe.Dreamweaver.CS5.v11.0.4909.Incl.Keymaker-EMBRACE/file_id.diz
Adobe.Dreamweaver.CS5.v11.0.4909.Incl.Keymaker-EMBRACE/keygen.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.Inc
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Flash.Catalyst.CS5.v1.0.Keymaker.Only-CORE/core.nfo
Adobe.Flash.Catalyst.CS5.v1.0.Keymaker.Only-CORE/file_id.diz
Adobe.Flash.Catalyst.CS5.v1.0.Keymaker.Only-CORE/keygen.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 540KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Flash.Professional.CS5.Keymaker-EMBRACE/embrace.nfo
Adobe.Flash.Professional.CS5.Keymaker-EMBRACE/keygen.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.Inc
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Illustrator.CS5.v15.0.Keymaker.Only-CORE/core.nfo
Adobe.Illustrator.CS5.v15.0.Keymaker.Only-CORE/file_id.diz
Adobe.Illustrator.CS5.v15.0.Keymaker.Only-CORE/keygen.exe
.exe windows:1 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 540KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.InDesign.CS5.Premium.v7.0.Incl.Keymaker-EMBRACE/embrace.nfo
Adobe.InDesign.CS5.Premium.v7.0.Incl.Keymaker-EMBRACE/file_id.diz
Adobe.InDesign.CS5.Premium.v7.0.Incl.Keymaker-EMBRACE/keygen.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.Inc
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE/embrace.nfo
Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE/file_id.diz
Adobe.Photoshop.CS5.Extended.v12.0.ONLY.Keymaker-EMBRACE/keygen.exe
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.Inc
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Inc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
CS5.5 Crack/Crackx86/Adobe.All.Products.v1.0.Keymaker.Only-CORE.zip
.zip
CS5.5 Crack/adobemasterkeygen55.rar
.rar
CS5.5 Crack/amtlib文件/Acrobat X/amtlib.dll
.dll windows:5 windows x86 arch:x86

7524f3d13c1483d52c012b7efaa26398

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05/11/2009, 00:00

Not After

10/12/2010, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ce:3e:56:b2:a9:be:1b:9b:3c:df:56:13:fa:b6:25:59:a5:16:41:b3
Signer

Actual PE Digest

ce:3e:56:b2:a9:be:1b:9b:3c:df:56:13:fa:b6:25:59:a5:16:41:b3

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceFrequency
GetEnvironmentVariableA
GetModuleFileNameW
CreateSemaphoreW
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
CreateThread
SetEvent
OpenEventW
QueryPerformanceCounter
GetVersionExW
GetComputerNameExW
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetTempPathW
TryEnterCriticalSection
SwitchToThread
ResumeThread
IsDBCSLeadByteEx
GetFileAttributesW
CompareStringW
CompareStringA
GetProcAddress
LocalFree
LoadLibraryW
FreeLibrary
FormatMessageW
SetLastError
GetCurrentThread
GetLastError
GetCurrentProcess
GetTimeZoneInformation
CloseHandle
GetProcessHeap
SetEndOfFile
CreateFileW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
Sleep
GetSystemTimeAsFileTime
RaiseException
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapAlloc
HeapReAlloc
GetFullPathNameW
GetCurrentThreadId
GetCommandLineA
GetCurrentProcessId
GetTimeFormatA
GetDateFormatA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
DeleteFileW
CreateDirectoryW
MoveFileA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
HeapCreate
HeapDestroy
VirtualFree
FatalAppExitA
VirtualAlloc
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetModuleHandleA
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
ReadFile
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCurrentDirectoryA
SetCurrentDirectoryA
SetStdHandle
CreateFileA
GetFileAttributesA
SetFilePointer
GetDriveTypeA
GetFullPathNameA
GetLocaleInfoA
GetStringTypeA
SetConsoleCtrlHandler
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

MessageBoxW

advapi32

GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
SetTokenInformation
SetEntriesInAclW

shell32

ShellExecuteA
SHGetFolderPathW

Exports

Exports

AMTBackgroundUpdateCheck
AMTForegroundUpdateCheck
AMTForegroundUpdateCheckEnabled
AMTGetLibVersion
AMTGetParentLEIDLicenseStatus
AMTGetProductClearSerialNumber
AMTObtainProductLicense
AMTPlugPlugRequest
AMTPreObtainProductLicense
AMTPreValidateProductLicense
AMTReleaseProductLicense
AMTRetrieveAdobeID
AMTSuppressBackgroundUpdateChecks
AMTValidateProductLicense

Sections

.text
Size: 753KB - Virtual size: 753KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CS5.5 Crack/crackx64/amtlib.dll
.dll windows:5 windows x64 arch:x64

68d2ac136fe946a5227ef75cd255b13f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

05/11/2009, 00:00

Not After

10/12/2010, 23:59

Subject

CN=Adobe Systems Incorporated,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Information Systems,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c9:ad:21:6f:57:2b:b6:be:34:b7:4d:6f:f4:09:0e:50:01:ba:46:24
Signer

Actual PE Digest

c9:ad:21:6f:57:2b:b6:be:34:b7:4d:6f:f4:09:0e:50:01:ba:46:24

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceFrequency
GetEnvironmentVariableA
GetModuleFileNameW
CreateSemaphoreW
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
CreateThread
SetEvent
OpenEventW
QueryPerformanceCounter
GetVersionExW
GetComputerNameExW
MultiByteToWideChar
WideCharToMultiByte
OutputDebugStringA
GetTempPathW
TryEnterCriticalSection
SwitchToThread
ResumeThread
IsDBCSLeadByteEx
GetFileAttributesW
CompareStringW
CompareStringA
GetProcAddress
LocalFree
LoadLibraryW
FreeLibrary
FormatMessageW
SetLastError
GetCurrentThread
GetLastError
GetCurrentProcess
GetTimeZoneInformation
CloseHandle
GetProcessHeap
SetEndOfFile
CreateFileW
Sleep
HeapFree
HeapAlloc
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapReAlloc
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetFullPathNameW
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetCurrentProcessId
GetDateFormatA
GetTimeFormatA
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
DeleteFileW
CreateDirectoryW
MoveFileA
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsFree
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
ReadFile
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
FatalAppExitA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetStdHandle
CreateFileA
GetFileAttributesA
SetFilePointer
GetDriveTypeA
GetFullPathNameA
GetLocaleInfoA
GetStringTypeA
SetConsoleCtrlHandler
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

user32

MessageBoxW

advapi32

GetNamedSecurityInfoW
SetNamedSecurityInfoW
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
OpenProcessToken
SetTokenInformation
SetEntriesInAclW

shell32

ShellExecuteA
SHGetFolderPathW

Exports

Exports

AMTBackgroundUpdateCheck
AMTForegroundUpdateCheck
AMTForegroundUpdateCheckEnabled
AMTGetLibVersion
AMTGetParentLEIDLicenseStatus
AMTGetProductClearSerialNumber
AMTObtainProductLicense
AMTPlugPlugRequest
AMTPreObtainProductLicense
AMTPreValidateProductLicense
AMTReleaseProductLicense
AMTSuppressBackgroundUpdateChecks
AMTValidateProductLicense

Sections

.text
Size: 890KB - Virtual size: 890KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 540KB

UPX1 Size: 68KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 13.0MB

UPX1 Size: 129KB - Virtual size: 132KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 536KB

UPX1 Size: 68KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 13.0MB

UPX1 Size: 129KB - Virtual size: 132KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 536KB

UPX1 Size: 68KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.Inc Size: - Virtual size: 260KB

.Inc Size: 57KB - Virtual size: 60KB

.Inc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 540KB

UPX1 Size: 68KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.Inc Size: - Virtual size: 260KB

.Inc Size: 56KB - Virtual size: 60KB

.Inc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 540KB

UPX1 Size: 68KB - Virtual size: 68KB

.rsrc Size: 2KB - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.Inc Size: - Virtual size: 260KB

.Inc Size: 57KB - Virtual size: 60KB

.Inc Size: 4KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.Inc Size: - Virtual size: 260KB

.Inc Size: 56KB - Virtual size: 60KB

.Inc Size: 4KB - Virtual size: 8KB

7524f3d13c1483d52c012b7efaa26398

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

UPX0
Size: - Virtual size: 540KB

UPX1
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 13.0MB

UPX1
Size: 129KB - Virtual size: 132KB

.rsrc
Size: 4KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 536KB

UPX1
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 13.0MB

UPX1
Size: 129KB - Virtual size: 132KB

.rsrc
Size: 4KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 536KB

UPX1
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 4KB

.Inc
Size: - Virtual size: 260KB

.Inc
Size: 57KB - Virtual size: 60KB

.Inc
Size: 4KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 540KB

UPX1
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 4KB

.Inc
Size: - Virtual size: 260KB

.Inc
Size: 56KB - Virtual size: 60KB

.Inc
Size: 4KB - Virtual size: 8KB

UPX0
Size: - Virtual size: 540KB

UPX1
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 2KB - Virtual size: 4KB

.Inc
Size: - Virtual size: 260KB

.Inc
Size: 57KB - Virtual size: 60KB

.Inc
Size: 4KB - Virtual size: 8KB

.Inc
Size: - Virtual size: 260KB

.Inc
Size: 56KB - Virtual size: 60KB

.Inc
Size: 4KB - Virtual size: 8KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

ce:3e:56:b2:a9:be:1b:9b:3c:df:56:13:fa:b6:25:59:a5:16:41:b3
Signer

.text
Size: 753KB - Virtual size: 753KB

.rdata
Size: 124KB - Virtual size: 123KB

.data
Size: 10KB - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 32KB - Virtual size: 31KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

4d:4e:dd:77:06:ef:6b:31:31:d0:0b:1c:67:91:d0:c1
Certificate

c9:ad:21:6f:57:2b:b6:be:34:b7:4d:6f:f4:09:0e:50:01:ba:46:24
Signer

.text
Size: 890KB - Virtual size: 890KB

.rdata
Size: 236KB - Virtual size: 235KB

.data
Size: 14KB - Virtual size: 37KB

.pdata
Size: 59KB - Virtual size: 59KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB