01ffeef14e97744001216fc63c161a1f

Sharing

Copy URL Twitter E-mail

General

Target

01ffeef14e97744001216fc63c161a1f
Size

5.5MB
MD5

01ffeef14e97744001216fc63c161a1f
SHA1

d7bd9a4bd64e238412d6e78fcf8cad82021c1bcc
SHA256

b9889e5edfcef5b9110dcace47847f357132be057e21515469e83d4608c7875e
SHA512

0d70b49e170212a38664d517f456f1ea6cbe02248de54df3ce8f7c72de74fe3361a2bb78183b492f37f4a817c7cf89716b7cc3a5542bc85156d08f571452a67b
SSDEEP

98304:J2u1llRw89IlqsLk9OZToUUGlmqXTfHfy5OXfJeh+I+88J/:JB1lle8WlIOZTfnLfy5OXfJeh+z88J/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/edu/绿色免安装IIS.exe

Files

01ffeef14e97744001216fc63c161a1f
.rar
edu/SqlIn.mdb
edu/ad/nzcms_link.asp
.html
edu/ad/nzcms_tj.asp
.html
edu/ad/nzcms_tj_files/01.gif
.gif
edu/ad/pic-index.asp
.html .js polyglot
edu/ad/pic2-index.asp
.html .js polyglot
edu/admin/GetCode.asp
.vbs
edu/admin/getcode/Head.Fix
edu/admin/getcode/body.Fix
edu/admin/images/RSCount.gif
.gif
edu/admin/images/Thumbs.db
edu/admin/images/XX.gif
.gif
edu/admin/images/a.gif
.gif
edu/admin/images/ad_01.gif
.gif
edu/admin/images/ad_02.gif
.gif
edu/admin/images/ad_04.gif
.gif
edu/admin/images/addinfo.gif
.gif
edu/admin/images/bar1.gif
.gif
edu/admin/images/botbg.gif
.gif
edu/admin/images/deng.png
.png
edu/admin/images/dui.png
.png
edu/admin/images/end.gif
.gif
edu/admin/images/help.gif
.gif
edu/admin/images/help.png
.png
edu/admin/images/help2.gif
.gif
edu/admin/images/hf.png
.png
edu/admin/images/info_top.gif
.gif
edu/admin/images/left1.gif
.gif
edu/admin/images/left2.gif
.gif
edu/admin/images/logo.jpg
.jpg
edu/admin/images/logo/nzcms_logo.fla
edu/admin/images/logo/nzcms_logo.swf
edu/admin/images/logo/top.jpg
.jpg
edu/admin/images/menu01.gif
.gif
edu/admin/images/menu02.gif
.gif
edu/admin/images/mhf.png
.png
edu/admin/images/no.gif
.gif
edu/admin/images/no.png
.png
edu/admin/images/nz.gif
.gif
edu/admin/images/nz519_02.gif
.gif
edu/admin/images/nz_01.gif
.gif
edu/admin/images/nz_05.gif
.gif
edu/admin/images/nzcms.mp3
edu/admin/images/nzcms/Thumbs.db
edu/admin/images/nzcms/www.ningzhi.net_01.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_010.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_011.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_02.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_03.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_04.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_05.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_06.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_07.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_08.gif
.gif
edu/admin/images/nzcms/www.ningzhi.net_09.gif
.gif
edu/admin/images/nzcms_ad.jpg
.jpg
edu/admin/images/nzcms_admin.jpg
.jpg
edu/admin/images/nzcms_close.gif
.gif
edu/admin/images/nzcms_top01.gif
.gif
edu/admin/images/nzsoft_06.gif
.gif
edu/admin/images/nzsoft_14.gif
.gif
edu/admin/images/s.gif
.gif
edu/admin/images/samll_addinfo.gif
.gif
edu/admin/images/sort_bg.gif
.gif
edu/admin/images/sort_bg2.gif
.gif
edu/admin/images/title.gif
.gif
edu/admin/images/top.gif
.gif
edu/admin/images/top2.gif
.gif
edu/admin/images/top_bg.gif
.gif
edu/admin/images/top_bg.png
.png
edu/admin/images/wenj.gif
.gif
edu/admin/images/www.ningzhi.net.jpg
.jpg
edu/admin/images/xin.gif
.gif
edu/admin/images/yzm.gif
.gif
edu/admin/index.asp
.html
edu/admin/login.asp
edu/admin/manage.asp
edu/admin/manage_web.asp
.html
edu/admin/nzcms_admin/index.asp
.vbs
edu/admin/nzcms_admin/ningzhi.asp
.vbs
edu/admin/nzcms_admin/ningzhi.css
edu/admin/nzcms_admin/ningzhi.js
.js
edu/admin/nzcms_left.asp
.html
edu/admin/out.asp
edu/admin/top.asp
.html .js polyglot
edu/admin/web1/index.asp
edu/admin/web1/nzcms_2.asp
.html
edu/admin/web1/nzcms_3.asp
.html
edu/admin/web1/nzcms_4.asp
.html
edu/admin/web1/nzcms_5.asp
.html
edu/admin/web1/nzcms_dim.asp
.html
edu/admin/web1/nzcms_save_info.asp
edu/admin/web10/index.asp
.html
edu/admin/web10/nzcms_1.asp
edu/admin/web10/nzcms_2.asp
edu/admin/web10/nzcms_save_info.asp
edu/admin/web2/index.asp
.html
edu/admin/web2/nzcms_2.asp
.html
edu/admin/web2/nzcms_save_info.asp
edu/admin/web3/index.asp
edu/admin/web3/nz.asp
.html
edu/admin/web3/nzcms_0.asp
.html .js polyglot
edu/admin/web3/nzcms_1.asp
.html .js polyglot
edu/admin/web3/nzcms_2.asp
edu/admin/web3/nzcms_3.asp
edu/admin/web3/nzcms_dim.asp
.html
edu/admin/web3/nzcms_edit_info.asp
.html .js polyglot
edu/admin/web3/nzcms_save_info.asp
edu/admin/web4/index.asp
edu/admin/web4/nzcms_2.asp
.html
edu/admin/web4/nzcms_3.asp
edu/admin/web4/nzcms_4.asp
.html
edu/admin/web4/nzcms_save_info.asp
edu/admin/web5/index.asp
edu/admin/web5/nzcms_save_info.asp
edu/admin/web6/index.asp
edu/admin/web6/nzcms_1.asp
edu/admin/web6/nzcms_2.asp
edu/admin/web6/nzcms_save_info.asp
edu/admin/web7/index.asp
edu/admin/web7/nzcms_1.asp
edu/admin/web7/nzcms_save_info.asp
edu/admin/web8/index.asp
edu/admin/web8/nzcms_1.asp
edu/admin/web8/nzcms_save_info.asp
edu/admin/web9/Excel.asp
edu/admin/web9/index.asp
.html
edu/admin/web9/index_files/css.css
edu/admin/web9/index_files/pa.gif
.gif
edu/admin/web9/index_files/validator.js
.js
edu/admin/web9/nzcms_1.asp
edu/admin/web9/nzcms_2.asp
edu/admin/web9/nzcms_3.asp
edu/admin/web9/nzcms_save_info.asp
edu/admin/web9/nzcms_show_info.asp
.html
edu/admin_css/css.css
edu/book.asp
.html .js polyglot
edu/book_write.asp
.html .js polyglot
edu/css/admin_css.css
edu/css/css.css
edu/css/css_2.css
edu/css/red_news_css.css
edu/data/xce_Data.MDF
edu/data/xce_Log.LDF
edu/file/GetCode.asp
.vbs
edu/file/getcode/Head.Fix
edu/file/getcode/body.Fix
edu/file/login.asp
edu/file/md5.asp
.vbs
edu/file/out.asp
edu/flash/ad1/ad1.swf
edu/flash/ad2/ad2.gif
.gif
edu/flash/news/nzcms.swf
edu/flash/top/nzgov_06.jpg
.jpg
edu/flash/top/top.swf
edu/flv/20116220523610989.flv
edu/flv/Desktop.ini
edu/images/123.gif
.gif
edu/images/Desktop.ini
edu/images/HOT.gif
.gif
edu/images/HOT2.gif
.gif
edu/images/RSCount.gif
.gif
edu/images/bg/01.gif
.gif
edu/images/bg/ding.gif
.gif
edu/images/biao.gif
.gif
edu/images/book.gif
.gif
edu/images/by.nzcms.gif
.gif
edu/images/end_logo.jpg
.jpg
edu/images/indexbook_bg.jpg
.jpg
edu/images/laba.gif
.gif
edu/images/left_bg1.jpg
.jpg
edu/images/left_bg2.jpg
.jpg
edu/images/loading.gif
.gif
edu/images/more.gif
.gif
edu/images/new.gif
.gif
edu/images/news_14.gif
.gif
edu/images/news_gg.gif
.gif
edu/images/no.gif
.gif
edu/images/nzcms.2011_39.gif
.gif
edu/images/nzcms.2011_44.gif
.gif
edu/images/nzcms.2011_book.gif
.gif
edu/images/nzcms.gif
.gif
edu/images/nzcms.topso_bg.gif
.gif
edu/images/nzcms.xinxin.gif
.gif
edu/images/nzcms/bannan1.gif
.gif
edu/images/nzcms/bannan2.gif
.gif
edu/images/nzcms/bannan3.gif
.gif
edu/images/nzcms/end.gif
.gif
edu/images/nzcms/left.gif
.gif
edu/images/nzcms/left2.gif
.gif
edu/images/nzcms/list_bg.gif
.gif
edu/images/nzcms/list_news_bg.gif
.gif
edu/images/nzcms/news_bg.gif
.gif
edu/images/nzcms/nzcms.2011_07.gif
.gif
edu/images/nzcms/nzcms.2011_077.gif
.gif
edu/images/nzcms/nzcms_bg.jpg
.jpg
edu/images/nzcms/nzcms_bh.gif
.gif
edu/images/nzcms/nzcms_top01.gif
.gif
edu/images/nzcms/right_bg2.gif
.gif
edu/images/nzcms/right_bg3.gif
.gif
edu/images/nzcms/top_bg.jpg
.jpg
edu/images/nzcms/tu.jpg
.jpg
edu/images/nzcms/tu2.jpg
.jpg
edu/images/nzcms_book01.gif
.gif
edu/images/nzcms_book02.gif
.gif
edu/images/nzcms_left_bg.gif
.gif
edu/images/nzcms_pic_no.gif
.gif
edu/images/nzdown.gif
.gif
edu/images/nzshu.gif
.gif
edu/images/suo.gif
.gif
edu/images/swfnews.swf
edu/images/time.gif
.gif
edu/images/top03.gif
.gif
edu/images/txt.png
.png
edu/images/type_img.png
.png
edu/images/vote.gif
.gif
edu/images/vote1.gif
.gif
edu/images/word.gif
.gif
edu/images/zbr.gif
.gif
edu/images/复件 new.gif
.gif
edu/index.asp
.html .js polyglot
edu/index_book.asp
.html
edu/list.asp
.html .js polyglot
edu/list_news.asp
.html .js polyglot
edu/nz.ico
edu/nz_pic/01.jpg
.jpg
edu/nz_pic/02.jpg
.jpg
edu/nz_pic/03.jpg
.jpg
edu/nz_pic/04.jpg
.jpg
edu/nz_pic/201012281059790810.gif
.gif
edu/nz_pic/201161414215199829.jpg
.jpg
edu/nz_pic/201161414215199829_small.jpg
.jpg
edu/nz_pic/201161414222512335.jpg
.jpg
edu/nz_pic/201161414222512335_small.jpg
.jpg
edu/nz_pic/201161414233558648.jpg
.jpg
edu/nz_pic/201161414233558648_small.jpg
.jpg
edu/nz_pic/201161414244856495.jpg
.jpg
edu/nz_pic/201161414244856495_small.jpg
.jpg
edu/nz_pic/201182622341532143.gif
.gif
edu/nz_pic/20119510244520322.gif
.gif
edu/nz_pic/20119510244520322_small.gif
.jpg
edu/nz_pic/2011951027145140.jpg
.jpg
edu/nz_pic/2011951027145140_small.jpg
.jpg
edu/nz_pic/20119510273784198.jpg
.jpg
edu/nz_pic/20119510273784198_small.jpg
.jpg
edu/nz_pic/20119510284448828.jpg
.jpg
edu/nz_pic/20119510284448828_small.jpg
.jpg
edu/nz_pic/Desktop.ini
edu/nz_pic/nz_pic.jpg
.jpg
edu/nz_pic/soft_01.gif
.gif
edu/nz_pic/soft_02.gif
.gif
edu/nz_pic/soft_03.gif
.gif
edu/nz_pic/soft_04.gif
.gif
edu/nz_pic/soft_05.gif
.gif
edu/nz_pic/soft_06.gif
.gif
edu/nz_pic/soft_07.gif
.gif
edu/nz_pic/soft_08.gif
.gif
edu/nzweb/Desktop.ini
edu/nzweb/Dialog/about.htm
.html .js polyglot
edu/nzweb/Dialog/anchor.htm
.html .js polyglot
edu/nzweb/Dialog/art.htm
.html .js polyglot
edu/nzweb/Dialog/backimage.htm
.html .js polyglot
edu/nzweb/Dialog/browse.htm
.html .js polyglot
edu/nzweb/Dialog/dialog.js
.js
edu/nzweb/Dialog/eWebEditorClient.CAB
.cab
eWebEditorClient.INF
eWebEditorClient.dll
.dll regsvr32 windows:4 windows x86 arch:x86

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23/08/2007, 00:00

Not After

22/08/2008, 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

Actual PE Digest

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
ord518
__vbaForEachCollAd
__vbaStrCat
__vbaVarCmpNe
ord660
__vbaSetSystemError
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaLateMemSt
ord593
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaBoolVarNull
_CIsin
ord631
ord709
__vbaErase
ord632
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
__vbaGenerateBoundsError
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaGet4
__vbaI2I4
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaLbound
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
__vbaNew
__vbaUI1I2
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
ord716
ord531
__vbaFPException
__vbaInStrVar
ord532
__vbaUbound
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaInStr
__vbaVarLateMemCallLdRf
__vbaNew2
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord579
ord101
__vbaVarSetVar
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord616
__vbaFpI4
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarSetObjAddref
ord617
__vbaLateMemCallLd
_CIatan
__vbaStrMove
__vbaCastObj
__vbaForEachVar
__vbaStrVarCopy
ord619
_allmul
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord580

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 76KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
edu/nzweb/Dialog/eWebEditorClientInstall.exe
.exe windows:1 windows x86 arch:x86

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

23/08/2007, 00:00

Not After

22/08/2008, 23:59

Subject

CN=High-point Software Ltd.,OU=WoSign Class 3 Code Signing,O=High-point Software Ltd.,L=Fuzhou,ST=Fujian,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

Actual PE Digest

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
edu/nzweb/Dialog/emot.htm
.html .js polyglot
edu/nzweb/Dialog/eq.htm
.html .js polyglot
edu/nzweb/Dialog/fieldset.htm
.html .js polyglot
edu/nzweb/Dialog/file.htm
.html .js polyglot
edu/nzweb/Dialog/findreplace.htm
.html .js polyglot
edu/nzweb/Dialog/flash.htm
.html .js polyglot
edu/nzweb/Dialog/fullscreen.htm
.html .js polyglot
edu/nzweb/Dialog/help.htm
.html
edu/nzweb/Dialog/hyperlink.htm
.html .js polyglot
edu/nzweb/Dialog/i_upload.htm
.html .js polyglot
edu/nzweb/Dialog/iframe.htm
.html .js polyglot
edu/nzweb/Dialog/img.htm
.html .js polyglot
edu/nzweb/Dialog/importexcel.htm
.html .js polyglot
edu/nzweb/Dialog/importword.htm
.html .js polyglot
edu/nzweb/Dialog/installactivex.htm
.html .js polyglot
edu/nzweb/Dialog/map.htm
.html .js polyglot
edu/nzweb/Dialog/marquee.htm
.html .js polyglot
edu/nzweb/Dialog/media.htm
.html .js polyglot
edu/nzweb/Dialog/owcexcel.htm
.html .js polyglot
edu/nzweb/Dialog/paragraph.htm
.html .js polyglot
edu/nzweb/Dialog/selcolor.htm
.html .js polyglot
edu/nzweb/Dialog/symbol.htm
.html .js polyglot
edu/nzweb/Dialog/table.htm
.html .js polyglot
edu/nzweb/Dialog/tablecell.htm
.html .js polyglot
edu/nzweb/Dialog/tablecellsplit.htm
.html .js polyglot
edu/nzweb/Dialog/template.htm
.html .js polyglot
edu/nzweb/SysImage/Rect.gif
.gif
edu/nzweb/SysImage/RectImg.gif
.gif
edu/nzweb/SysImage/bg/birthday.gif
.gif
edu/nzweb/SysImage/bg/christmas.gif
.gif
edu/nzweb/SysImage/bg/citrus.gif
.gif
edu/nzweb/SysImage/bg/clear.jpg
.jpg
edu/nzweb/SysImage/bg/fiesta.jpg
.jpg
edu/nzweb/SysImage/bg/flower.gif
.gif
edu/nzweb/SysImage/bg/gathering.jpg
.jpg
edu/nzweb/SysImage/bg/glacier.jpg
.jpg
edu/nzweb/SysImage/bg/grid.gif
.gif
edu/nzweb/SysImage/bg/hearts.gif
.gif
edu/nzweb/SysImage/bg/ivy.gif
.gif
edu/nzweb/SysImage/bg/maize.jpg
.jpg
edu/nzweb/SysImage/bg/nature.jpg
.jpg
edu/nzweb/SysImage/bg/snow.gif
.gif
edu/nzweb/SysImage/bg/tech.gif
.gif
edu/nzweb/SysImage/bold.gif
.gif
edu/nzweb/SysImage/emot/01.gif
.gif
edu/nzweb/SysImage/emot/02.gif
.gif
edu/nzweb/SysImage/emot/03.gif
.gif
edu/nzweb/SysImage/emot/04.gif
.gif
edu/nzweb/SysImage/emot/05.gif
.gif
edu/nzweb/SysImage/emot/06.gif
.gif
edu/nzweb/SysImage/emot/07.gif
.gif
edu/nzweb/SysImage/emot/08.gif
.gif
edu/nzweb/SysImage/emot/09.gif
.gif
edu/nzweb/SysImage/emot/10.gif
.gif
edu/nzweb/SysImage/emot/11.gif
.gif
edu/nzweb/SysImage/emot/12.gif
.gif
edu/nzweb/SysImage/emot/13.gif
.gif
edu/nzweb/SysImage/emot/14.gif
.gif
edu/nzweb/SysImage/emot/15.gif
.gif
edu/nzweb/SysImage/emot/16.gif
.gif
edu/nzweb/SysImage/emot/17.gif
.gif
edu/nzweb/SysImage/emot/18.gif
.gif
edu/nzweb/SysImage/emot/19.gif
.gif
edu/nzweb/SysImage/emot/20.gif
.gif
edu/nzweb/SysImage/emot/21.gif
.gif
edu/nzweb/SysImage/emot/22.gif
.gif
edu/nzweb/SysImage/emot/23.gif
.gif
edu/nzweb/SysImage/emot/24.gif
.gif
edu/nzweb/SysImage/emot/25.gif
.gif
edu/nzweb/SysImage/emot/26.gif
.gif
edu/nzweb/SysImage/emot/27.gif
.gif
edu/nzweb/SysImage/emot/28.gif
.gif
edu/nzweb/SysImage/emot/29.gif
.gif
edu/nzweb/SysImage/emot/30.gif
.gif
edu/nzweb/SysImage/emot/31.gif
.gif
edu/nzweb/SysImage/emot/32.gif
.gif
edu/nzweb/SysImage/emot/33.gif
.gif
edu/nzweb/SysImage/emot/34.gif
.gif
edu/nzweb/SysImage/emot/35.gif
.gif
edu/nzweb/SysImage/emot/36.gif
.gif
edu/nzweb/SysImage/emot/37.gif
.gif
edu/nzweb/SysImage/emot/38.gif
.gif
edu/nzweb/SysImage/emot/39.gif
.gif
edu/nzweb/SysImage/emot/40.gif
.gif
edu/nzweb/SysImage/emot/41.gif
.gif
edu/nzweb/SysImage/emot/42.gif
.gif
edu/nzweb/SysImage/emot/43.gif
.gif
edu/nzweb/SysImage/emot/44.gif
.gif
edu/nzweb/SysImage/emot/45.gif
.gif
edu/nzweb/SysImage/emot/46.gif
.gif
edu/nzweb/SysImage/emot/47.gif
.gif
edu/nzweb/SysImage/emot/48.gif
.gif
edu/nzweb/SysImage/emot/49.gif
.gif
edu/nzweb/SysImage/emot/50.gif
.gif
edu/nzweb/SysImage/file/audio.gif
.gif
edu/nzweb/SysImage/file/avi.gif
.gif
edu/nzweb/SysImage/file/bmp.gif
.gif
edu/nzweb/SysImage/file/closedfolder.gif
.gif
edu/nzweb/SysImage/file/code.gif
.gif
edu/nzweb/SysImage/file/doc.gif
.gif
edu/nzweb/SysImage/file/exe.gif
.gif
edu/nzweb/SysImage/file/folder.gif
.gif
edu/nzweb/SysImage/file/folderback.gif
.gif
edu/nzweb/SysImage/file/gif.gif
.gif
edu/nzweb/SysImage/file/hlp.gif
.gif
edu/nzweb/SysImage/file/htm.gif
.gif
edu/nzweb/SysImage/file/jpg.gif
.gif
edu/nzweb/SysImage/file/mdb.gif
.gif
edu/nzweb/SysImage/file/mid.gif
.gif
edu/nzweb/SysImage/file/mp.gif
.gif
edu/nzweb/SysImage/file/mp3.gif
.gif
edu/nzweb/SysImage/file/openfolder.gif
.gif
edu/nzweb/SysImage/file/parentfolder.gif
.gif
edu/nzweb/SysImage/file/pdf.gif
.gif
edu/nzweb/SysImage/file/pic.gif
.gif
edu/nzweb/SysImage/file/ppt.gif
.gif
edu/nzweb/SysImage/file/rar.gif
.gif
edu/nzweb/SysImage/file/rm.gif
.gif
edu/nzweb/SysImage/file/swf.gif
.gif
edu/nzweb/SysImage/file/txt.gif
.gif
edu/nzweb/SysImage/file/unknow.gif
.gif
edu/nzweb/SysImage/file/xls.gif
.gif
edu/nzweb/SysImage/file/zip.gif
.gif
edu/nzweb/SysImage/icon16/aspx.gif
.gif
edu/nzweb/SysImage/icon16/audio.gif
.gif
edu/nzweb/SysImage/icon16/avi.gif
.gif
edu/nzweb/SysImage/icon16/bmp.gif
.gif
edu/nzweb/SysImage/icon16/chm.gif
.gif
edu/nzweb/SysImage/icon16/code.gif
.gif
edu/nzweb/SysImage/icon16/doc.gif
.gif
edu/nzweb/SysImage/icon16/exe.gif
.gif
edu/nzweb/SysImage/icon16/gif.gif
.gif
edu/nzweb/SysImage/icon16/hlp.gif
.gif
edu/nzweb/SysImage/icon16/htm.gif
.gif
edu/nzweb/SysImage/icon16/ico.gif
.gif
edu/nzweb/SysImage/icon16/jpg.gif
.gif
edu/nzweb/SysImage/icon16/js.gif
.gif
edu/nzweb/SysImage/icon16/mdb.gif
.gif
edu/nzweb/SysImage/icon16/mid.gif
.gif
edu/nzweb/SysImage/icon16/mp.gif
.gif
edu/nzweb/SysImage/icon16/mp3.gif
.gif
edu/nzweb/SysImage/icon16/pdf.gif
.gif
edu/nzweb/SysImage/icon16/png.gif
.gif
edu/nzweb/SysImage/icon16/ppt.gif
.gif
edu/nzweb/SysImage/icon16/rar.gif
.gif
edu/nzweb/SysImage/icon16/rm.gif
.gif
edu/nzweb/SysImage/icon16/swf.gif
.gif
edu/nzweb/SysImage/icon16/txt.gif
.gif
edu/nzweb/SysImage/icon16/unknow.gif
.gif
edu/nzweb/SysImage/icon16/xls.gif
.gif
edu/nzweb/SysImage/icon16/xml.gif
.gif
edu/nzweb/SysImage/icon16/zip.gif
.gif
edu/nzweb/SysImage/icon32/aspx.gif
.gif
edu/nzweb/SysImage/icon32/audio.gif
.gif
edu/nzweb/SysImage/icon32/avi.gif
.gif
edu/nzweb/SysImage/icon32/bmp.gif
.gif
edu/nzweb/SysImage/icon32/chm.gif
.gif
edu/nzweb/SysImage/icon32/code.gif
.gif
edu/nzweb/SysImage/icon32/doc.gif
.gif
edu/nzweb/SysImage/icon32/exe.gif
.gif
edu/nzweb/SysImage/icon32/gif.gif
.gif
edu/nzweb/SysImage/icon32/hlp.gif
.gif
edu/nzweb/SysImage/icon32/htm.gif
.gif
edu/nzweb/SysImage/icon32/ico.gif
.gif
edu/nzweb/SysImage/icon32/jpg.gif
.gif
edu/nzweb/SysImage/icon32/js.gif
.gif
edu/nzweb/SysImage/icon32/mdb.gif
.gif
edu/nzweb/SysImage/icon32/mid.gif
.gif
edu/nzweb/SysImage/icon32/mp.gif
.gif
edu/nzweb/SysImage/icon32/mp3.gif
.gif
edu/nzweb/SysImage/icon32/pdf.gif
.gif
edu/nzweb/SysImage/icon32/png.gif
.gif
edu/nzweb/SysImage/icon32/ppt.gif
.gif
edu/nzweb/SysImage/icon32/rar.gif
.gif
edu/nzweb/SysImage/icon32/rm.gif
.gif
edu/nzweb/SysImage/icon32/swf.gif
.gif
edu/nzweb/SysImage/icon32/txt.gif
.gif
edu/nzweb/SysImage/icon32/unknow.gif
.gif
edu/nzweb/SysImage/icon32/xls.gif
.gif
edu/nzweb/SysImage/icon32/xml.gif
.gif
edu/nzweb/SysImage/icon32/zip.gif
.gif
edu/nzweb/SysImage/italic.gif
.gif
edu/nzweb/SysImage/loading.gif
.gif
edu/nzweb/SysImage/space.gif
.gif
edu/nzweb/SysImage/tree/arrowdown.gif
.gif
edu/nzweb/SysImage/tree/arrowup.gif
.gif
edu/nzweb/SysImage/tree/blank.gif
.gif
edu/nzweb/SysImage/tree/branch1.gif
.gif
edu/nzweb/SysImage/tree/branch2.gif
.gif
edu/nzweb/SysImage/tree/dirclose.gif
.gif
edu/nzweb/SysImage/tree/diropen.gif
.gif
edu/nzweb/SysImage/tree/folderclose.gif
.gif
edu/nzweb/SysImage/tree/folderopen.gif
.gif
edu/nzweb/SysImage/tree/folderparent.gif
.gif
edu/nzweb/SysImage/tree/line.gif
.gif
edu/nzweb/SysImage/tree/minus1.gif
.gif
edu/nzweb/SysImage/tree/minus2.gif
.gif
edu/nzweb/SysImage/tree/plus1.gif
.gif
edu/nzweb/SysImage/tree/plus2.gif
.gif
edu/nzweb/SysImage/tree/root.gif
.gif
edu/nzweb/asp/config.asp
edu/nzweb/ewebeditor.htm
.html .js polyglot
edu/nzweb/js/buttons.js
.js
edu/nzweb/js/nzcms.js
.js
edu/nzweb/js/zh-cn.js
edu/nzweb/nzcms_up/201109/20110901102623469.rar
.rar
edu/nzweb/nzcms_up/201109/20110901102629198.xls
.xls windows office2003
edu/nzweb/nzcms_up/201109/20110901102634755.doc
.doc windows office2003
edu/nzweb/nzcms_up/201109/20110905093642237.jpg
.jpg
edu/nzweb/nzcms_up/201109/20110905100632995.zip
edu/nzweb/nzcms_up/201109/20110905100636244.xls
.xls windows office2003
edu/nzweb/nzcms_up/201109/20110905100641635.doc
.doc windows office2003
edu/nzweb/popup.htm
.html .js polyglot
edu/nzweb/sharefile/image/back_48.jpg
.jpg
edu/nzweb/sharefile/image/book_48.jpg
.jpg
edu/nzweb/sharefile/image/book_lock_48.jpg
.jpg
edu/nzweb/sharefile/image/book_pencil_48.jpg
.jpg
edu/nzweb/sharefile/image/bullet_arrow_48.jpg
.jpg
edu/nzweb/sharefile/image/bullet_arrow_v48.jpg
.jpg
edu/nzweb/sharefile/image/bullet_email_48.jpg
.jpg
edu/nzweb/sharefile/image/bullet_info_48.jpg
.jpg
edu/nzweb/sharefile/image/cd_gray_48.jpg
.jpg
edu/nzweb/sharefile/image/cd_green_48.jpg
.jpg
edu/nzweb/sharefile/image/cd_yellow_48.jpg
.jpg
edu/nzweb/sharefile/image/copy_48.jpg
.jpg
edu/nzweb/sharefile/image/doc_48.jpg
.jpg
edu/nzweb/sharefile/image/doc_faq_48.jpg
.jpg
edu/nzweb/sharefile/image/doc_important_48.jpg
.jpg
edu/nzweb/sharefile/image/doc_remove_48.jpg
.jpg
edu/nzweb/sharefile/image/email_48.jpg
.jpg
edu/nzweb/sharefile/image/email_delete_48.jpg
.jpg
edu/nzweb/sharefile/image/email_new_48.jpg
.jpg
edu/nzweb/sharefile/image/email_open_48.jpg
.jpg
edu/nzweb/sharefile/image/email_sent_48.jpg
.jpg
edu/nzweb/sharefile/image/folder_48.jpg
.jpg
edu/nzweb/sharefile/image/folder_info_48.jpg
.jpg
edu/nzweb/sharefile/image/folder_lock_48.jpg
.jpg
edu/nzweb/sharefile/image/folder_move_48.jpg
.jpg
edu/nzweb/sharefile/image/forward_48.jpg
.jpg
edu/nzweb/sharefile/image/mix_clock_48.jpg
.jpg
edu/nzweb/sharefile/image/mix_money_48.jpg
.jpg
edu/nzweb/sharefile/image/mix_pencil_48.jpg
.jpg
edu/nzweb/sharefile/image/mix_world_48.jpg
.jpg
edu/nzweb/sharefile/image/paste_48.jpg
.jpg
edu/nzweb/sharefile/image/stop_48.jpg
.jpg
edu/nzweb/sharefile/image/symbol_faq_48.jpg
.jpg
edu/nzweb/sharefile/image/symbols_download_48.jpg
.jpg
edu/nzweb/sharefile/image/symbols_info_48.jpg
.jpg
edu/nzweb/sharefile/image/symbols_stop_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_back_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_buy_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_calendar_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_edit_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_help_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_login_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_manual_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_open_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_print_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_remove_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_save_48.jpg
.jpg
edu/nzweb/sharefile/image/toolbar_search_48.jpg
.jpg
edu/nzweb/sharefile/image/trash_48.jpg
.jpg
edu/nzweb/sharefile/image/trash_arrow_48.jpg
.jpg
edu/nzweb/sharefile/image/trash_full_48.jpg
.jpg
edu/nzweb/sharefile/image/user_48.jpg
.jpg
edu/nzweb/sharefile/image/user_add_48.jpg
.jpg
edu/nzweb/sharefile/image/user_delete_48.jpg
.jpg
edu/nzweb/sharefile/image/user_info_48.jpg
.jpg
edu/nzweb/sharefile/image/weather_clouds_48.jpg
.jpg
edu/nzweb/sharefile/image/weather_ray_48.jpg
.jpg
edu/nzweb/sharefile/image/weather_sun_48.jpg
.jpg
edu/nzweb/sharefile/image/weather_sunny_48.jpg
.jpg
edu/nzweb/skin/blue1/btnchecked.gif
.gif
edu/nzweb/skin/blue1/btndown.gif
.gif
edu/nzweb/skin/blue1/btnover.gif
.gif
edu/nzweb/skin/blue1/buttons.gif
.gif
edu/nzweb/skin/blue1/dialog.css
edu/nzweb/skin/blue1/editor.css
edu/nzweb/skin/blue1/editorarea.code.css
edu/nzweb/skin/blue1/editorarea.css
edu/nzweb/skin/blue1/editorarea.edit.css
edu/nzweb/skin/blue1/editorarea.text.css
edu/nzweb/skin/blue1/menuarea.css
edu/nzweb/skin/blue1/tbbg.gif
.gif
edu/nzweb/skin/blue2/btnchecked.gif
.gif
edu/nzweb/skin/blue2/btndown.gif
.gif
edu/nzweb/skin/blue2/btnover.gif
.gif
edu/nzweb/skin/blue2/buttons.gif
.gif
edu/nzweb/skin/blue2/dialog.css
edu/nzweb/skin/blue2/editor.css
edu/nzweb/skin/blue2/editorarea.code.css
edu/nzweb/skin/blue2/editorarea.css
edu/nzweb/skin/blue2/editorarea.edit.css
edu/nzweb/skin/blue2/editorarea.text.css
edu/nzweb/skin/blue2/menuarea.css
edu/nzweb/skin/blue2/menubg.gif
.gif
edu/nzweb/skin/green1/btnchecked.gif
.gif
edu/nzweb/skin/green1/btndown.gif
.gif
edu/nzweb/skin/green1/btnover.gif
.gif
edu/nzweb/skin/green1/buttons.gif
.gif
edu/nzweb/skin/green1/dialog.css
edu/nzweb/skin/green1/editor.css
edu/nzweb/skin/green1/editorarea.code.css
edu/nzweb/skin/green1/editorarea.css
edu/nzweb/skin/green1/editorarea.edit.css
edu/nzweb/skin/green1/editorarea.text.css
edu/nzweb/skin/green1/menuarea.css
edu/nzweb/skin/green1/menubg.gif
.gif
edu/nzweb/skin/light1/btnchecked.gif
.gif
edu/nzweb/skin/light1/btndown.gif
.gif
edu/nzweb/skin/light1/btnover.gif
.gif
edu/nzweb/skin/light1/buttons.gif
.gif
edu/nzweb/skin/light1/dialog.css
edu/nzweb/skin/light1/editor.css
edu/nzweb/skin/light1/editorarea.code.css
edu/nzweb/skin/light1/editorarea.css
edu/nzweb/skin/light1/editorarea.edit.css
edu/nzweb/skin/light1/editorarea.text.css
edu/nzweb/skin/light1/menuarea.css
edu/nzweb/skin/light1/menubg.gif
.gif
edu/nzweb/skin/ningzhi/btnchecked.gif
.gif
edu/nzweb/skin/ningzhi/btndown.gif
.gif
edu/nzweb/skin/ningzhi/btnover.gif
.gif
edu/nzweb/skin/ningzhi/buttons.gif
.gif
edu/nzweb/skin/ningzhi/dialog.css
edu/nzweb/skin/ningzhi/editor.css
edu/nzweb/skin/ningzhi/editorarea.code.css
edu/nzweb/skin/ningzhi/editorarea.css
edu/nzweb/skin/ningzhi/editorarea.edit.css
edu/nzweb/skin/ningzhi/editorarea.text.css
edu/nzweb/skin/ningzhi/menuarea.css
edu/nzweb/skin/ningzhi/menubg.gif
.gif
edu/nzweb/skin/office2000/btnchecked.gif
.gif
edu/nzweb/skin/office2000/buttons.gif
.gif
edu/nzweb/skin/office2000/dialog.css
edu/nzweb/skin/office2000/editor.css
edu/nzweb/skin/office2000/editorarea.code.css
edu/nzweb/skin/office2000/editorarea.css
edu/nzweb/skin/office2000/editorarea.edit.css
edu/nzweb/skin/office2000/editorarea.text.css
edu/nzweb/skin/office2000/menuarea.css
edu/nzweb/skin/office2000/tbbg.gif
.gif
edu/nzweb/skin/office2000/tbleft.gif
.gif
edu/nzweb/skin/office2000/tbright.gif
.gif
edu/nzweb/skin/office2003/btnchecked.gif
.gif
edu/nzweb/skin/office2003/btndown.gif
.gif
edu/nzweb/skin/office2003/btnover.gif
.gif
edu/nzweb/skin/office2003/buttons.gif
.gif
edu/nzweb/skin/office2003/dialog.css
edu/nzweb/skin/office2003/editor.css
edu/nzweb/skin/office2003/editorarea.code.css
edu/nzweb/skin/office2003/editorarea.css
edu/nzweb/skin/office2003/editorarea.edit.css
edu/nzweb/skin/office2003/editorarea.text.css
edu/nzweb/skin/office2003/menuarea.css
edu/nzweb/skin/office2003/menubg.gif
.gif
edu/nzweb/skin/office2003/tbbg.gif
.gif
edu/nzweb/skin/office2003/tbhandle.gif
.gif
edu/nzweb/skin/office2003/tbleft.gif
.gif
edu/nzweb/skin/office2003/tbright.gif
.gif
edu/nzweb/skin/officexp/buttons.gif
.gif
edu/nzweb/skin/officexp/dialog.css
edu/nzweb/skin/officexp/editor.css
edu/nzweb/skin/officexp/editorarea.code.css
edu/nzweb/skin/officexp/editorarea.css
edu/nzweb/skin/officexp/editorarea.edit.css
edu/nzweb/skin/officexp/editorarea.text.css
edu/nzweb/skin/officexp/menuarea.css
edu/nzweb/skin/officexp/menubg.gif
.gif
edu/nzweb/skin/officexp/tbbg.gif
.gif
edu/nzweb/skin/officexp/tbleft.gif
.gif
edu/nzweb/skin/officexp/tbright.gif
.gif
edu/nzweb/skin/red1/btnchecked.gif
.gif
edu/nzweb/skin/red1/btndown.gif
.gif
edu/nzweb/skin/red1/btnover.gif
.gif
edu/nzweb/skin/red1/buttons.gif
.gif
edu/nzweb/skin/red1/dialog.css
edu/nzweb/skin/red1/editor.css
edu/nzweb/skin/red1/editorarea.code.css
edu/nzweb/skin/red1/editorarea.css
edu/nzweb/skin/red1/editorarea.edit.css
edu/nzweb/skin/red1/editorarea.text.css
edu/nzweb/skin/red1/menuarea.css
edu/nzweb/skin/red1/menubg.gif
.gif
edu/nzweb/skin/vista1/btnchecked.gif
.gif
edu/nzweb/skin/vista1/btndown.gif
.gif
edu/nzweb/skin/vista1/btnover.gif
.gif
edu/nzweb/skin/vista1/buttons.gif
.gif
edu/nzweb/skin/vista1/dialog.css
edu/nzweb/skin/vista1/editor.css
edu/nzweb/skin/vista1/editorarea.code.css
edu/nzweb/skin/vista1/editorarea.css
edu/nzweb/skin/vista1/editorarea.edit.css
edu/nzweb/skin/vista1/editorarea.text.css
edu/nzweb/skin/vista1/menuarea.css
edu/nzweb/skin/vista1/menubg.gif
.gif
edu/nzweb/skin/vista1/sb_btn_bg.gif
.gif
edu/nzweb/skin/vista1/sb_btn_bg2.gif
.gif
edu/nzweb/skin/vista1/sb_btn_left.gif
.gif
edu/nzweb/skin/vista1/sb_btn_left2.gif
.gif
edu/nzweb/skin/vista1/sb_btn_right.gif
.gif
edu/nzweb/skin/vista1/sb_btn_right2.gif
.gif
edu/nzweb/skin/vista1/tbbg.gif
.gif
edu/nzweb/skin/yellow1/btnchecked.gif
.gif
edu/nzweb/skin/yellow1/btndown.gif
.gif
edu/nzweb/skin/yellow1/btnover.gif
.gif
edu/nzweb/skin/yellow1/buttons.gif
.gif
edu/nzweb/skin/yellow1/dialog.css
edu/nzweb/skin/yellow1/editor.css
edu/nzweb/skin/yellow1/editorarea.code.css
edu/nzweb/skin/yellow1/editorarea.css
edu/nzweb/skin/yellow1/editorarea.edit.css
edu/nzweb/skin/yellow1/editorarea.text.css
edu/nzweb/skin/yellow1/menuarea.css
edu/nzweb/skin/yellow1/menubg.gif
.gif
edu/nzweb/style/ningzhi.js
edu/nzweb/style/user.js
edu/nzweb/template/0.gif
.gif
edu/nzweb/template/01.htm
edu/nzweb/template/02.htm
edu/nzweb/template/03.htm
edu/nzweb/template/04.htm
edu/nzweb/template/05.htm
edu/nzweb/template/06.htm
edu/nzweb/template/template.js
edu/poto.asp
.html .js polyglot
edu/red_news.asp
.html .js polyglot
edu/show_book.asp
.html .js polyglot
edu/show_news.asp
.html .js polyglot
edu/tp.asp
.html .js polyglot
edu/vcastr22.swf
edu/使用说明.html
edu/新云软件.url
.url
edu/绿色免安装IIS.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

test
Size: - Virtual size: 988KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

data
Size: 625KB - Virtual size: 628KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

075408aabeacabe90c51dddc4557f964

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cfSigner

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 76KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 4KB

.reloc Size: 8KB - Virtual size: 7KB

Code Sign

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6dCertificate

Extended Key Usages

Key Usages

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:feSigner

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 36KB - Virtual size: 36KB

DATA Size: 1024B - Virtual size: 588B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 14KB

Headers

File Characteristics

Sections

test Size: - Virtual size: 988KB

data Size: 625KB - Virtual size: 628KB

.rsrc Size: 6KB - Virtual size: 8KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

6c:1a:02:a1:2b:d9:fb:97:04:d1:5b:40:ba:da:b2:90:84:fe:b3:cf
Signer

.text
Size: 76KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 4KB

.reloc
Size: 8KB - Virtual size: 7KB

ea:42:f4:0c:a4:cd:ac:6f:82:d8:54:f9:be:21:30:6d
Certificate

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

78:98:f8:e5:49:1b:e3:78:ac:ba:26:cb:07:bc:70:b7:05:f8:bd:fe
Signer

CODE
Size: 36KB - Virtual size: 36KB

DATA
Size: 1024B - Virtual size: 588B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 14KB

test
Size: - Virtual size: 988KB

data
Size: 625KB - Virtual size: 628KB

.rsrc
Size: 6KB - Virtual size: 8KB