FOVhnXH[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FOVhnXH.exe
Size

400KB
MD5

740438689ddae62c0f6307d3b65bf501
SHA1

1cec849b15a5f9b3789c1b55e4fef7330579a8da
SHA256

398d7637767bcc3f7c650256afe0cf68e6771b7d725299806f78167b84a0793b
SHA512

350603ae25e1efa34166a201be41f60fe72025296d461b75bb6dec43913789a706d8d876c7611150df3ade8174c5e870d89c151bb350772d94cb6e3e4c32868f
SSDEEP

6144:AaB0tMeEqoAVihTTUgBRZkOqHbCMHTEjTZJr8aMko+KpulNzQxgLtVehd:90tMeEqo9hT4gGOvmTIH4Lko+AwUxEta

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

FOVhnXH.exe
.exe windows:4 windows x86 arch:x86

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/02/2018, 00:00

Not After

28/02/2019, 23:59

Subject

CN=Ludvig Strigeus,O=Ludvig Strigeus,POSTALCODE=41665,STREET=Bondegatan 12,L=Gothenburg,ST=N/A,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:57:4a:ad:08:b1:d5:69:10:f8:84:e5:9a:e3:52:f0:f3:8e:26:12
Signer

Actual PE Digest

7a:57:4a:ad:08:b1:d5:69:10:f8:84:e5:9a:e3:52:f0:f3:8e:26:12

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 636B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
TunSafe.exe
.exe windows:6 windows x64 arch:x64

de95da01118ff85071193e08e4d5cd33

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1c
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

28/02/2018, 00:00

Not After

28/02/2019, 23:59

Subject

CN=Ludvig Strigeus,O=Ludvig Strigeus,POSTALCODE=41665,STREET=Bondegatan 12,L=Gothenburg,ST=N/A,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:40:0e:9b:17:6a:9d:6c:66:83:11:17:4e:fa:11:5a:2a:e6:45:ca
Signer

Actual PE Digest

d4:40:0e:9b:17:6a:9d:6c:66:83:11:17:4e:fa:11:5a:2a:e6:45:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Code\TunSafe\tunsafe\build\x64_Release\TunSafe.pdb

Imports

kernel32

SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExA
GetStringTypeW
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetFilePointerEx
HeapSize
LCMapStringW
HeapReAlloc
GetFileType
HeapAlloc
HeapFree
CreateFileW
GetStdHandle
WideCharToMultiByte
GetModuleHandleExW
GetCommandLineA
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RtlPcToFileHeader
RtlUnwindEx
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
SetEndOfFile
RtlVirtualUnwind
CreateMutexA
CreateDirectoryA
ExpandEnvironmentStringsA
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetModuleHandleA
GlobalUnlock
GlobalLock
GetCommandLineW
GetFileAttributesA
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSectionEx
RaiseException
MultiByteToWideChar
GlobalAlloc
QueueUserAPC
GetTickCount
CreateProcessA
QueryPerformanceCounter
SetHandleInformation
CreatePipe
DeviceIoControl
CancelWaitableTimer
SetWaitableTimer
CreateWaitableTimerA
SetThreadPriority
PostQueuedCompletionStatus
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
GetSystemDirectoryW
InitializeSListHead
InterlockedFlushSList
InterlockedPushListSList
SystemTimeToFileTime
GetSystemTime
GetTickCount64
SleepEx
LoadLibraryA
GetProcAddress
InterlockedPushEntrySList
InterlockedPopEntrySList
GetLocalTime
WaitForSingleObject
CreateThread
ResetEvent
ExitProcess
WaitForMultipleObjects
ConnectNamedPipe
PeekNamedPipe
ReadFile
WriteFile
SetEvent
CancelIo
FlushFileBuffers
SetNamedPipeHandleState
CreateFileA
CreateNamedPipeW
CreateEventA
CloseHandle
GetCurrentProcess
GetCurrentThread
Sleep
GetLastError
GetModuleFileNameW
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetACP
WriteConsoleW

user32

SetClipboardData
EmptyClipboard
InvalidateRect
SendMessageA
OpenClipboard
CloseClipboard
GetClientRect
MapWindowPoints
GetParent
ShowWindow
TranslateMessage
DispatchMessageA
SetDlgItemTextA
EnableWindow
GetDlgItem
SetWindowTextA
CreatePopupMenu
AppendMenuA
SetMenuDefaultItem
ClientToScreen
TrackPopupMenu
DestroyMenu
MessageBoxA
BringWindowToTop
SetForegroundWindow
GetMessageA
EndDialog
IsDialogMessageA
SendMessageTimeoutA
FindWindowA
SetProcessDPIAware
PostMessageA
GetWindowLongA
SetWindowLongA
ChangeWindowMessageFilter
CreateDialogParamA
LoadIconA
RegisterWindowMessageA
ReleaseDC
GetDC
LoadCursorA
DrawTextA
PtInRect
EndPaint
BeginPaint
LoadBitmapA
GetSysColorBrush
GetSysColor
FillRect
CreateWindowExA
RegisterClassExA
DefWindowProcA
CheckMenuRadioItem
CheckMenuItem
GetMenu
IsWindowVisible
GetCursorPos
LoadMenuA
SetMenu
DialogBoxParamA
GetAsyncKeyState
MoveWindow
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
PostQuitMessage
GetDlgItemTextA

gdi32

CreateFontIndirectA
SetBkColor
ExtTextOutA
Polyline
CreateFontA
GetObjectA
SelectObject
Rectangle
CreateCompatibleDC
StretchBlt
TextOutA
CreatePen
DeleteObject
GetDeviceCaps
CreatePatternBrush
CreateBitmap
BitBlt
CreateCompatibleBitmap
DeleteDC
TextOutW
SetTextColor
SetBkMode

comdlg32

GetOpenFileNameA

advapi32

StartServiceA
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
CreateServiceW
ChangeServiceConfig2A
OpenServiceW
ControlService
QueryServiceStatus
OpenThreadToken
OpenProcessToken
GetTokenInformation
IsValidSid
LookupAccountSidW
RegCloseKey
DeleteService
RegDeleteValueW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
StartServiceCtrlDispatcherW
RegSetValueExA
RevertToSelf
ImpersonateNamedPipeClient
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerW
SetServiceStatus
DeregisterEventSource
ReportEventA
RegisterEventSourceW
RegCreateKeyExA

shell32

ShellExecuteExA
ShellExecuteExW
DragAcceptFiles
DragQueryFileA
DragFinish
ShellExecuteA
Shell_NotifyIconA

ole32

CoCreateInstance

oleaut32

VariantClear
VariantInit
SysAllocStringLen
SysFreeString
SysAllocString

ws2_32

closesocket
WSASocketA
htons
bind
WSARecvFrom
WSAGetLastError
WSASendTo
inet_ntop
inet_pton
gethostbyname
WSAStartup
htonl

iphlpapi

GetIpForwardTable2
FreeMibTable
ConvertInterfaceGuidToLuid
InitializeIpInterfaceEntry
GetIpInterfaceEntry
SetIpInterfaceEntry
GetUnicastIpAddressTable
DeleteUnicastIpAddressEntry
InitializeUnicastIpAddressEntry
CreateUnicastIpAddressEntry
ConvertInterfaceLuidToIndex
ConvertInterfaceIndexToLuid
DeleteIpForwardEntry2
FlushIpNetTable2
CreateIpForwardEntry2

fwpuclnt

FwpmGetAppIdFromFileName0
FwpmFilterCreateEnumHandle0
FwpmFilterAdd0
FwpmEngineClose0
FwpmEngineOpen0
FwpmSubLayerAdd0
FwpmFreeMemory0
FwpmSubLayerGetByKey0
FwpmFilterEnum0
FwpmFilterDeleteById0
FwpmFilterDestroyEnumHandle0
FwpmSubLayerDeleteByKey0

rpcrt4

UuidFromStringA

comctl32

InitCommonControlsEx

Sections

.text
Size: 258KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

7a:57:4a:ad:08:b1:d5:69:10:f8:84:e5:9a:e3:52:f0:f3:8e:26:12Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 106KB

.ndata Size: - Virtual size: 80KB

.rsrc Size: 27KB - Virtual size: 27KB

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 636B

de95da01118ff85071193e08e4d5cd33

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1cCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

d4:40:0e:9b:17:6a:9d:6c:66:83:11:17:4e:fa:11:5a:2a:e6:45:caSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

7a:57:4a:ad:08:b1:d5:69:10:f8:84:e5:9a:e3:52:f0:f3:8e:26:12
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 106KB

.ndata
Size: - Virtual size: 80KB

.rsrc
Size: 27KB - Virtual size: 27KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 636B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

54:5d:63:1d:c3:80:b1:50:7d:a5:da:d9:30:d8:ef:1c
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

d4:40:0e:9b:17:6a:9d:6c:66:83:11:17:4e:fa:11:5a:2a:e6:45:ca
Signer

.text
Size: 258KB - Virtual size: 258KB

.rdata
Size: 69KB - Virtual size: 69KB

.data
Size: 4KB - Virtual size: 18KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 48KB - Virtual size: 47KB

.reloc
Size: 2KB - Virtual size: 1KB