bd544339421707737c2029f3aa1469a3

Sharing

Copy URL Twitter E-mail

General

Target

bd544339421707737c2029f3aa1469a3
Size

4.8MB
MD5

bd544339421707737c2029f3aa1469a3
SHA1

9de0d5d330627e606b5df6ebbb6c26cd1246deaa
SHA256

e287b24c8890a0d24ed00eac89457875bfe9d6c8c7e9e7e449087ebe101f2e99
SHA512

ef270ff41d5ee00813f76362f35b5783beb1e48a921ac7f0a4e953e0d25c24eb207614ae12ae71adf00baba30c33248aa87224262c0cb3a1428101cb4e087843
SSDEEP

98304:p5KJN8LW39Lv6ppgQvf3KMaAp/teERiK2HTafqkBrybJ2kS+aOUCi:pwJN8LW3cpmQvf3wAp/te4ijHTXIrA2v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/windows vista 优化/TweakCube-V7.exe

Files

bd544339421707737c2029f3aa1469a3
.rar
windows vista 优化/CCleaner.exe
.exe windows:4 windows x86 arch:x86

024c03ef9a35357005991081956ec4ff

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

28/07/2009, 00:00

Not After

23/08/2011, 23:59

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:a9:2b:51:b3:d8:bc:3b:bf:37:87:2b:c5:4b:47:5a:26:86:39:16
Signer

Actual PE Digest

72:a9:2b:51:b3:d8:bc:3b:bf:37:87:2b:c5:4b:47:5a:26:86:39:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\Piriform\CCleaner\trunk\src\CCleaner\Release\CCleaner.pdb

Imports

kernel32

SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeA
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringA
GetStdHandle
GetOEMCP
HeapCreate
RtlUnwind
CreateThread
ExitThread
GetLogicalDrives
ExitProcess
IsDebuggerPresent
UnhandledExceptionFilter
WriteConsoleA
CreateWaitableTimerA
SetLastError
SystemTimeToFileTime
ResumeThread
TlsSetValue
CreateMutexA
TlsGetValue
TlsFree
TlsAlloc
ReleaseMutex
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetThreadLocale
GetACP
HeapSize
HeapReAlloc
HeapDestroy
LocalAlloc
LockFile
UnlockFile
InterlockedCompareExchange
GetDiskFreeSpaceA
GetFileAttributesA
DeleteFileA
AreFileApisANSI
GetSystemTime
GetTempPathA
SetEndOfFile
GetCurrentProcessId
LockFileEx
GetConsoleOutputCP
SetEnvironmentVariableA
LeaveCriticalSection
RaiseException
FreeLibrary
Sleep
InterlockedIncrement
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
MulDiv
FlushFileBuffers
WriteFile
LocalFree
LoadLibraryA
GetModuleFileNameA
GetLocaleInfoA
GlobalLock
GlobalUnlock
GetModuleHandleA
CompareStringA
HeapFree
GetProcessHeap
HeapAlloc
CreateEventA
VirtualProtect
IsBadReadPtr
SetUnhandledExceptionFilter
GetFileSize
ReadFile
SetFilePointer
TerminateProcess
GlobalAlloc
CreateFileA
DeviceIoControl
GetFullPathNameA
FormatMessageA
GetTickCount
MoveFileExW
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
OpenProcess
SetErrorMode
GetUserDefaultLangID
FindClose
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
SetEvent
GetCurrentThread
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
EnterCriticalSection
FlushInstructionCache
LoadResource
GetCurrentProcess
LockResource
SizeofResource
GetVersion
GetCurrentThreadId
CloseHandle
InterlockedExchange
SetWaitableTimer
GetLastError

advapi32

CopySid
OpenProcessToken
GetTokenInformation
RegNotifyChangeKeyValue
AdjustTokenPrivileges
LookupPrivilegeValueW
EqualSid
OpenThreadToken
AllocateAndInitializeSid
GetSidSubAuthority
GetSidSubAuthorityCount
FreeSid
LookupAccountSidW
GetLengthSid
RegCloseKey
LookupAccountNameW
IsValidSid
GetSidIdentifierAuthority

user32

WindowFromPoint
EndPaint
UnregisterClassA
CloseClipboard
EmptyClipboard
OpenClipboard
GetWindowThreadProcessId
WaitForInputIdle
ExitWindowsEx
GetMenuItemID
SystemParametersInfoA
GetWindowPlacement
GetSystemMetrics
UpdateWindow
GetDlgCtrlID
MessageBoxA
LockWindowUpdate
PostQuitMessage
IsZoomed
SetMenuDefaultItem
SetActiveWindow
GetScrollPos
IsWindowEnabled
AdjustWindowRectEx
GetMenu
SetRect
GetComboBoxInfo
EndDialog
BringWindowToTop
SetFocus
KillTimer
SetTimer
PtInRect
SetCursorPos
GetCursorPos
MoveWindow
GetSysColorBrush
SetRectEmpty
TranslateMessage
DrawFocusRect
RedrawWindow
SetCursor
OffsetRect
InflateRect
GetIconInfo
CopyRect
IsWindow
GetFocus
DestroyCursor
GetKeyState
DestroyIcon
ReleaseCapture
FrameRect
SetCapture
GetCapture
DrawEdge
BeginPaint
DestroyMenu
TrackPopupMenu
CreatePopupMenu
SetScrollPos
GetActiveWindow
GetScrollInfo
IsIconic
GetParent
GetDlgItem
MapWindowPoints
ReleaseDC
GetWindow
GetDesktopWindow
EnumWindows
SetWindowPos
GetDC
InvalidateRect
GetWindowRect
GetSysColor
GetNextDlgTabItem
ScrollWindowEx
SetForegroundWindow
GetClientRect
GetWindowDC
GetMessagePos
OpenIcon
SetScrollInfo
ShowWindow
DestroyWindow
ScreenToClient
IsWindowVisible
ClientToScreen
FillRect

gdi32

GetClipBox
RestoreDC
SaveDC
GetStockObject
CreatePatternBrush
CreateBitmap
PatBlt
LineTo
CombineRgn
MoveToEx
CreateRectRgnIndirect
ExcludeClipRect
SelectClipRgn
GetClipRgn
CreatePen
CreateRectRgn
StrokeAndFillPath
EndPath
BeginPath
SetBkColor
DeleteDC
CreateDIBSection
GetDIBColorTable
StretchBlt
DeleteObject
GetDeviceCaps
SetTextColor
SetBkMode
SelectObject
BitBlt
CreateCompatibleBitmap
SetViewportOrgEx
CreateCompatibleDC
CreateSolidBrush
Ellipse

rpcrt4

UuidFromStringA

ole32

CLSIDFromString
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
OleUninitialize
CoTaskMemRealloc
OleInitialize
ReleaseStgMedium
OleDuplicateData
RevokeDragDrop
RegisterDragDrop
DoDragDrop
PropVariantClear
CoUninitialize
CoInitialize
CoSetProxyBlanket

oleaut32

SysAllocStringLen
VarUI4FromStr
SysFreeString
VarBstrFromR8
VariantInit
SysAllocString
VariantTimeToSystemTime
VariantClear
VariantChangeType

shlwapi

PathAppendW
PathRemoveBackslashW
PathMatchSpecW
PathRemoveFileSpecA
StrRetToStrW
PathStripPathA
PathRemoveFileSpecW
PathFileExistsW
SHStrDupW
PathIsDirectoryW
PathCombineW
PathCompactPathW

comctl32

ImageList_Destroy
ImageList_Remove
ImageList_Draw
ImageList_GetIconSize
_TrackMouseEvent
ImageList_LoadImageW
ImageList_GetImageCount
ImageList_Create
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
windows vista 优化/Defraggler.exe
.exe windows:4 windows x86 arch:x86

037038ec031e5ce7c83877d23b0297f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

28/07/2009, 00:00

Not After

23/08/2011, 23:59

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:0e:89:b2:8d:4e:90:df:ce:d2:aa:1b:e7:71:51:19:25:cd:9e:de
Signer

Actual PE Digest

58:0e:89:b2:8d:4e:90:df:ce:d2:aa:1b:e7:71:51:19:25:cd:9e:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projekty\defraggler\build_temp_df\tagged_build_src\bin\defragglergui\release\Defraggler.pdb

Imports

wininet

InternetOpenUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW

kernel32

WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwind
CreateThread
ExitThread
IsDebuggerPresent
UnhandledExceptionFilter
FormatMessageA
CreateFileA
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetDriveTypeW
QueryDosDeviceW
GetDiskFreeSpaceExW
SetErrorMode
SetFilePointerEx
GetVolumeNameForVolumeMountPointW
GetVolumeInformationW
GetVersionExA
OutputDebugStringA
GetCurrentDirectoryA
GetModuleFileNameA
GetThreadContext
GetEnvironmentVariableW
GetEnvironmentVariableA
ResumeThread
ReadProcessMemory
SuspendThread
OpenMutexW
OpenEventW
GetFileInformationByHandle
ReadFile
DuplicateHandle
CreatePipe
GetOverlappedResult
TerminateProcess
GetDiskFreeSpaceW
CreateMutexW
FindNextChangeNotification
FindCloseChangeNotification
FindFirstChangeNotificationW
GetFileAttributesExW
GetNumberFormatW
GetFullPathNameW
GetFileAttributesW
GetLocaleInfoW
FindNextFileW
FindFirstFileW
FindClose
LoadResource
FindResourceExW
GetModuleFileNameW
MulDiv
InterlockedExchange
GetModuleHandleW
FindResourceW
SizeofResource
LockResource
lstrlenW
GetCurrentThreadId
GetSystemInfo
GetStdHandle
LoadLibraryExW
CompareStringA
SetEnvironmentVariableA
CreateProcessA
CreateEventA
GetComputerNameExW
SetUnhandledExceptionFilter
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
AllocConsole
CreateProcessW
GetStartupInfoW
ExitProcess
OpenProcess
GetCurrentProcessId
GetTickCount
GetCurrentDirectoryW
FreeLibrary
Sleep
CreateWaitableTimerW
ReleaseMutex
SetWaitableTimer
SetThreadPriority
FileTimeToSystemTime
lstrlenA
CompareFileTime
SystemTimeToFileTime
GetModuleHandleA
GetPriorityClass
SetPriorityClass
CompareStringW
GetSystemDirectoryW
lstrcmpiW
lstrcmpW
DeviceIoControl
GetSystemTimeAsFileTime
DeleteFileW
GetLogicalDrives
QueryPerformanceCounter
QueryPerformanceFrequency
GetPrivateProfileStructW
WritePrivateProfileStructW
GetPrivateProfileStringW
WritePrivateProfileStringW
LocalFree
FormatMessageW
FlushInstructionCache
GetCurrentProcess
GetSystemWindowsDirectoryW
MultiByteToWideChar
RaiseException
GetLocalTime
EnumResourceNamesW
SetConsoleTextAttribute
WriteConsoleW
WideCharToMultiByte
GetVersionExW
GetLastError
GetTempPathW
CreateFileW
GlobalMemoryStatusEx
WaitForSingleObject
WriteFile
SetEvent
ResetEvent
LeaveCriticalSection
CreateEventW
LoadLibraryW
FlushFileBuffers
EnterCriticalSection
CloseHandle
GetHandleInformation
WaitForMultipleObjects
GetProcAddress
SetLastError
DeleteCriticalSection
GetCommandLineW
InitializeCriticalSection
GetConsoleOutputCP

user32

LoadAcceleratorsW
EnumWindows
GetWindowThreadProcessId
SetDlgItemTextW
UnregisterClassW
DispatchMessageW
GetMessageW
FrameRect
RegisterWindowMessageW
BringWindowToTop
DrawFrameControl
GetWindow
SetTimer
KillTimer
DrawTextExW
LoadCursorW
SetCursor
BeginPaint
TranslateMessage
UnregisterClassA
EndPaint
EndDialog
GetDC
LoadImageW
ReleaseDC
GetWindowRect
SetRect
PostQuitMessage
TranslateAcceleratorW
CharNextW
SetMenuDefaultItem
SetWindowPlacement
PeekMessageW
GetWindowPlacement
SystemParametersInfoW
MessageBeep
RemoveMenu
SetActiveWindow
AppendMenuW
CreatePopupMenu
LoadStringA
SetMenu
GetMessagePos
GetClassNameW
GetCursorPos
ReleaseCapture
DrawFocusRect
GetMenu
GetCapture
IsWindowEnabled
SetCapture
IsZoomed
SetRectEmpty
DialogBoxParamW
DeleteMenu
GetMenuItemID
ScreenToClient
EnableMenuItem
PostMessageW
GetMenuStringW
TrackPopupMenu
InsertMenuW
SetMenuInfo
GetMenuInfo
LoadBitmapW
CreateDialogParamW
GetWindowTextLengthW
GetWindowTextW
GetActiveWindow
GetWindowDC
GetSysColorBrush
GetClassInfoExW
RegisterClassExW
OffsetRect
GetDialogBaseUnits
GetDlgCtrlID
EnableWindow
GetFocus
SetFocus
InflateRect
DrawTextW
SetWindowTextW
IsDialogMessageW
TrackMouseEvent
CopyRect
ClientToScreen
UpdateWindow
DrawEdge
IsWindowVisible
SetMenuItemInfoW
GetParent
GetMenuItemInfoW
GetSubMenu
DestroyMenu
LoadMenuW
IsMenu
ShowWindow
LoadIconW
TrackPopupMenuEx
GetDlgItem
SendMessageW
MapWindowPoints
GetMonitorInfoW
CreateWindowExW
MonitorFromPoint
IsWindow
DestroyWindow
SetWindowPos
DefWindowProcW
FillRect
GetWindowLongW
GetSysColor
GetSystemMetrics
SetWindowLongW
GetClientRect
DrawIconEx
DestroyIcon
CallWindowProcW
RedrawWindow
MessageBoxW
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
MoveWindow
GetDesktopWindow
GetForegroundWindow
LoadStringW
InvalidateRect
PtInRect
GetMenuItemCount

gdi32

CreateDIBSection
RealizePalette
CreatePalette
SelectPalette
GetTextExtentPoint32W
SetPolyFillMode
LineTo
MoveToEx
RestoreDC
SaveDC
Polygon
Polyline
CreatePatternBrush
PatBlt
CreateBitmap
CreateRectRgn
CombineRgn
CreateRectRgnIndirect
GetClipBox
SelectClipRgn
GetClipRgn
OffsetWindowOrgEx
ExtTextOutW
SetBkColor
Rectangle
GetCurrentObject
CreatePen
GetStockObject
CreateSolidBrush
SetTextColor
SetBkMode
GetDeviceCaps
BitBlt
CreateFontIndirectW
DPtoLP
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
SetViewportOrgEx
DeleteDC
GetObjectW
SelectObject
TextOutW

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
InitiateSystemShutdownW
RegQueryInfoKeyW
GetUserNameA
InitializeSecurityDescriptor
GetUserNameW

shell32

SHBindToParent
SHGetSpecialFolderLocation
ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteExW
SHEmptyRecycleBinW
SHQueryRecycleBinW
CommandLineToArgvW

ole32

CoTaskMemAlloc
CoUninitialize
CoTaskMemRealloc
CoInitialize
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx

oleaut32

VarUI4FromStr

shlwapi

PathCombineW
PathFindFileNameA
StrFormatKBSizeW
PathRemoveFileSpecW

comctl32

ImageList_SetImageCount
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_Draw
ImageList_Write
ImageList_Read
ImageList_AddMasked
DestroyPropertySheetPage
PropertySheetW
_TrackMouseEvent
InitCommonControlsEx
CreateStatusWindowW
ImageList_Add
CreatePropertySheetPageW
ImageList_GetImageCount

msimg32

AlphaBlend
TransparentBlt

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 192KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
windows vista 优化/TweakCube-V7.exe
.exe windows:4 windows x86 arch:x86

ccc0e829fe1206cd39d147ca374725d4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
SetFileSecurityA
SetFileSecurityW

kernel32

CloseHandle
CompareStringA
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteFileA
DeleteFileW
DosDateTimeToFileTime
ExitProcess
ExpandEnvironmentStringsA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindResourceA
FreeLibrary
GetCPInfo
GetCommandLineA
GetCurrentDirectoryA
GetCurrentProcess
GetDateFormatA
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocaleInfoA
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetNumberFormatA
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTime
GetTempPathA
GetTickCount
GetTimeFormatA
GetVersionExA
GlobalAlloc
HeapAlloc
HeapFree
HeapReAlloc
IsDBCSLeadByte
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MoveFileExA
MultiByteToWideChar
ReadFile
SetCurrentDirectoryA
SetEndOfFile
SetEnvironmentVariableA
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
Sleep
SystemTimeToFileTime
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrcmpiA
lstrlenA

comctl32

ord17

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

gdi32

DeleteObject

shell32

SHBrowseForFolderA
SHChangeNotify
SHFileOperationA
SHGetFileInfoA
SHGetMalloc
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA

user32

CharToOemA
CharToOemBuffA
CharUpperA
CopyRect
CreateWindowExA
DefWindowProcA
DestroyIcon
DestroyWindow
DialogBoxParamA
DispatchMessageA
EnableWindow
EndDialog
FindWindowExA
GetClassNameA
GetClientRect
GetDlgItem
GetDlgItemTextA
GetMessageA
GetParent
GetSysColor
GetSystemMetrics
GetWindow
GetWindowLongA
GetWindowRect
GetWindowTextA
IsWindow
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadIconA
LoadStringA
MapWindowPoints
MessageBoxA
OemToCharA
OemToCharBuffA
PeekMessageA
PostMessageA
RegisterClassExA
SendDlgItemMessageA
SendMessageA
SetDlgItemTextA
SetFocus
SetMenu
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfA
wvsprintfA

ole32

CLSIDFromString
CoCreateInstance
CreateStreamOnHGlobal
OleInitialize
OleUninitialize

Sections

.text
Size: 78KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
windows vista 优化/TweakUAC.exe
.exe windows:4 windows x86 arch:x86

4ff0947b71de6cfd0064d22faf4ee83f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

37:ad:aa:de:a7:e5:0c:15:84:f1:a1:e2:ff:cf:56:24
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

27/02/2006, 00:00

Not After

27/02/2007, 23:59

Subject

CN=WinAbility Software Corporation,O=WinAbility Software Corporation,POSTALCODE=84763,STREET=244 W Main St,L=Rockville,ST=UT,C=US,2.5.4.18=#1306363330323732

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b6:24:2b:32:57:fd:d3:a4:5c:57:71:e8:d3:0a:27:41:72:90:6b:e4
Signer

Actual PE Digest

b6:24:2b:32:57:fd:d3:a4:5c:57:71:e8:d3:0a:27:41:72:90:6b:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

q:\vista\release\win32\TweakUAC.pdb

Imports

comctl32

ord17

shlwapi

SHSetValueW
SHGetValueW

kernel32

GetModuleHandleW
GetVersionExW
GetLastError
GetCurrentProcess
LCMapStringW
LCMapStringA
GetStringTypeW
GetProcAddress
GetStringTypeA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
Sleep
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte

user32

MessageBoxW
ExitWindowsEx

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW

shell32

ShellExecuteW

Sections

.text
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
windows vista 优化/bbt-Windows Vista 服务优化.bat
windows vista 优化/bbt清理系统垃圾文件-vista.bat
windows vista 优化/sre.exe
.exe windows:4 windows x86 arch:x86

c8d13a4da83847bdd0a6943ab489b52d

Code Sign

4e:47:59:de:d1:08:b6:64:b2:1f:9a:ac:d5:20:98:8b
Certificate

Issuer

CN=KZTechs.COM Root Certificate Authority,OU=Smallfrogs,O=KZTechs.COM,C=CN,1.2.840.113549.1.9.1=#0c13737570706f7274406b7a74656368732e636f6d

Not Before

06/09/2009, 05:43

Not After

06/09/2029, 05:43

Subject

CN=Smallfrogs

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

82:0e:23:53:52:35:b6:ce:e2:2c:c6:43:12:58:fd:08:ea:30:b5:34
Signer

Actual PE Digest

82:0e:23:53:52:35:b6:ce:e2:2c:c6:43:12:58:fd:08:ea:30:b5:34

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Smallfrogs\CodesSVNLib\trunk\sreng2\product\win32\SREngLdr.pdb

Imports

kernel32

SetFilePointer
CloseHandle
WriteFile
FlushFileBuffers
CreateFileA
GetVersionExA
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
GetTempPathA
CreateDirectoryA
GetTempFileNameA
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
GetLocalTime
CreateProcessA
FreeLibrary
CreateEventA
ResetEvent
CreateThread
GetFileSize
CreateFileMappingA
TerminateThread
MapViewOfFile
SetFileAttributesA
MoveFileExA
UnmapViewOfFile
DeleteFileA
WaitForSingleObject
GetCurrentThreadId
Sleep
GetModuleHandleA
InterlockedExchange
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
lstrlenA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetACP
GetLocaleInfoA
GetThreadLocale
GetSystemTimeAsFileTime
VirtualAlloc
GetCommandLineA
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
GetCPInfo
GetOEMCP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
RaiseException
GetConsoleCP
GetConsoleMode
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
SetStdHandle

advapi32

RegDeleteValueA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

024c03ef9a35357005991081956ec4ff

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

72:a9:2b:51:b3:d8:bc:3b:bf:37:87:2b:c5:4b:47:5a:26:86:39:16Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

gdi32

rpcrt4

ole32

oleaut32

shlwapi

comctl32

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 269KB - Virtual size: 269KB

.data Size: 72KB - Virtual size: 82KB

.tls Size: 512B - Virtual size: 2B

.rsrc Size: 267KB - Virtual size: 266KB

037038ec031e5ce7c83877d23b0297f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

58:0e:89:b2:8d:4e:90:df:ce:d2:aa:1b:e7:71:51:19:25:cd:9e:deSigner

Headers

File Characteristics

PDB Paths

Imports

wininet

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

version

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 256KB - Virtual size: 254KB

.data Size: 68KB - Virtual size: 77KB

.tls Size: 4KB - Virtual size: 9B

.rsrc Size: 192KB - Virtual size: 190KB

ccc0e829fe1206cd39d147ca374725d4

Headers

File Characteristics

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

72:a9:2b:51:b3:d8:bc:3b:bf:37:87:2b:c5:4b:47:5a:26:86:39:16
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 269KB - Virtual size: 269KB

.data
Size: 72KB - Virtual size: 82KB

.tls
Size: 512B - Virtual size: 2B

.rsrc
Size: 267KB - Virtual size: 266KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

58:0e:89:b2:8d:4e:90:df:ce:d2:aa:1b:e7:71:51:19:25:cd:9e:de
Signer

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 256KB - Virtual size: 254KB

.data
Size: 68KB - Virtual size: 77KB

.tls
Size: 4KB - Virtual size: 9B

.rsrc
Size: 192KB - Virtual size: 190KB

.text
Size: 78KB - Virtual size: 80KB

.data
Size: 2KB - Virtual size: 32KB

.idata
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 15KB - Virtual size: 16KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

37:ad:aa:de:a7:e5:0c:15:84:f1:a1:e2:ff:cf:56:24
Certificate

b6:24:2b:32:57:fd:d3:a4:5c:57:71:e8:d3:0a:27:41:72:90:6b:e4
Signer

.text
Size: 28KB - Virtual size: 26KB

.rdata
Size: 12KB - Virtual size: 11KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 32KB - Virtual size: 28KB

4e:47:59:de:d1:08:b6:64:b2:1f:9a:ac:d5:20:98:8b
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

82:0e:23:53:52:35:b6:ce:e2:2c:c6:43:12:58:fd:08:ea:30:b5:34
Signer

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 16KB - Virtual size: 12KB

.data
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 32KB - Virtual size: 30KB