(03) PDF ReDirect v2[.]5[.]2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

(03) PDF ReDirect v2.5.2.exe
Size

7.1MB
MD5

d84bd466a4de9fbedaabaf9a366cf4e6
SHA1

57f93f838a7204f0fe455bace047aef250e6716d
SHA256

7ab20ca0107f85b5ec838b76474e2c49f1295041f637f6c7130b745acecebf8a
SHA512

465b71d33efe8879737e2cf772c2c52e1f428ff8f14127330764b11a195e03f561b07dd48d7ad91b073afdb28f74281cd9827eacdfa5af13028e14f952b707fd
SSDEEP

196608:WiT7e3WYVlue372YxgQugzoOBvAHG4mMA7mp/i/MWm8:1YVlNKYxugznBvAmIkmp/q7

Score

3^/10

Malware Config

Signatures

Unsigned PE 18 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/Drivers/PR_Installer.exe
unpack001/Drivers/Win 2K-XP/PS5UI.DLL
unpack001/Drivers/Win 2K-XP/PSCRIPT5.DLL
unpack001/Drivers/Win XP64/PS5UI.DLL
unpack001/Drivers/Win XP64/PSCRIPT5.DLL
unpack001/OSSMTP.dll
unpack001/bin/gsdll32.dll
unpack001/cbak4exp.dll
unpack001/ccrpani6.ocx
unpack001/filev4exp09.ocx
unpack001/fldrv4exp09.ocx
unpack001/jpeg4exp.dll
unpack001/pdf4exp.dll
unpack001/vpdf4exp.dll
unpack001/zlib4exp.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

(03) PDF ReDirect v2.5.2.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

af:8e:77:01:98:b5:75:46:43:52:dc:2f:1c:4d:de:68:00:ce:70:3a
Signer

Actual PE Digest

af:8e:77:01:98:b5:75:46:43:52:dc:2f:1c:4d:de:68:00:ce:70:3a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GetACP
lstrlenA
lstrcmpA
lstrcpynA
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc

user32

SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
LoadIconA
SendMessageA
ShowWindow
GetDC

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 320B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
Capture.exe
.exe windows:4 windows x86 arch:x86

848ffc1397e45b5d3ba1cbd9cf33b7eb

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

28:c1:c0:05:18:32:20:d2:0c:05:4d:00:c4:d4:65:1f:25:68:58:7e
Signer

Actual PE Digest

28:c1:c0:05:18:32:20:d2:0c:05:4d:00:c4:d4:65:1f:25:68:58:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaAryMove
__vbaFreeVar
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
ord696
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFpCDblR8
EVENT_SINK_Invoke
__vbaFreeObjList
__vbaStrErrVarCopy
ord517
_adj_fprem1
__vbaRecAnsiToUni
ord518
ord519
__vbaCopyBytes
__vbaResume
__vbaStrCat
__vbaWriteFile
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenBstrB
__vbaNameFile
_adj_fdiv_m32
__vbaAryVar
__vbaVarTstLe
Zombie_GetTypeInfo
__vbaAryDestruct
__vbaLateMemSt
__vbaForEachCollObj
__vbaExitProc
__vbaBoolStr
ord593
ord594
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord599
__vbaStrFixstr
__vbaStrTextCmp
__vbaBoolVarNull
_CIsin
__vbaErase
ord631
ord709
__vbaVarZero
__vbaLateMemStAd
__vbaNextEachCollObj
__vbaVarCmpGt
ord525
__vbaChkstk
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord527
__vbaExitEachColl
__vbaStrCmp
ord529
__vbaPutOwner3
__vbaAryConstruct2
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
ord670
__vbaFpUI1
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaFixstrConstruct
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaStrR8
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
EVENT_SINK_QueryInterface
ord710
__vbaExceptHandler
ord711
__vbaStrToUnicode
ord712
__vbaInputFile
__vbaPrintFile
ord606
_adj_fprem
_adj_fdivr_m64
ord607
__vbaI2Str
ord608
ord716
ord531
__vbaFPException
ord717
__vbaInStrVar
ord319
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord534
ord535
ord536
__vbaI2Var
ord537
ord644
ord645
_CIlog
__vbaFileOpen
__vbaVar2Vec
__vbaNew2
__vbaR8Str
__vbaInStr
ord648
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
ord681
__vbaFreeStrList
ord576
_adj_fdivr_m32
__vbaPowerR8
ord577
_adj_fdiv_r
ord685
ord578
ord100
__vbaI4Var
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
ord320
__vbaStrToAnsi
__vbaVarDup
ord321
ord613
__vbaFpI2
__vbaFpI4
ord616
__vbaLateMemCallLd
ord617
__vbaRecDestructAnsi
_CIatan
__vbaStrMove
__vbaCastObj
ord618
__vbaAryCopy
__vbaStrVarCopy
__vbaR8IntI4
ord650
_allmul
__vbaVarLateMemCallSt
__vbaLateIdSt
ord652
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Sections

.text
Size: 336KB - Virtual size: 333KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Drivers/PR_Installer.exe
.exe windows:4 windows x86 arch:x86

e543ae468e021542f23ea56b2307c2f1

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarTstGt
__vbaVarSub
ord690
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaAryMove
__vbaFreeVar
__vbaLateIdCall
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
ord519
__vbaResume
__vbaStrCat
__vbaForEachCollAd
__vbaLsetFixstr
__vbaWriteFile
__vbaSetSystemError
ord554
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
__vbaAryDestruct
__vbaVarForInit
__vbaExitProc
__vbaOnError
__vbaObjSet
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord305
__vbaFpR4
__vbaStrFixstr
__vbaBoolVar
__vbaBoolVarNull
_CIsin
ord631
ord709
ord525
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord527
__vbaGenerateBoundsError
ord528
__vbaStrCmp
ord529
__vbaVarTstEq
__vbaAryConstruct2
__vbaI2I4
__vbaObjVar
DllFunctionCall
ord670
__vbaVarOr
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaLateIdCallLd
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
__vbaUI1I2
_CIsqrt
__vbaVarAnd
ord311
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaStr2Vec
__vbaExceptHandler
ord313
__vbaPrintFile
__vbaInputFile
__vbaStrToUnicode
ord712
_adj_fprem
_adj_fdivr_m64
ord607
ord531
ord716
__vbaFPException
__vbaInStrVar
ord717
__vbaUbound
__vbaStrVarVal
__vbaVarCat
ord535
ord536
ord644
ord537
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
__vbaVarNot
__vbaDerefAry1
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord100
__vbaVarTstNe
__vbaI4Var
ord689
__vbaVarCmpEq
__vbaAryLock
__vbaLateMemCall
__vbaStrToAnsi
__vbaVarDup
__vbaVarCopy
__vbaFpI4
ord616
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaStrMove
ord618
__vbaStrVarCopy
ord650
_allmul
__vbaLateIdSt
_CItan
__vbaNextEachCollAd
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Drivers/Win 2K-XP/PDFR.inf
Drivers/Win 2K-XP/PDFR_NST.PPD
Drivers/Win 2K-XP/PDFreDirectMonNT.dll
.dll windows:4 windows x86 arch:x86

f60a620303ab3ecf587fdc17bd8a4ba8

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2f:1f:41:61:a2:50:00:7f:fe:2a:ed:d9:c8:9a:fe:94:07:1d:9d:a8
Signer

Actual PE Digest

2f:1f:41:61:a2:50:00:7f:fe:2a:ed:d9:c8:9a:fe:94:07:1d:9d:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CharNextW
wsprintfW
MessageBoxW

winspool.drv

EnumPortsW
SetJobW
OpenPrinterW
GetJobW
ClosePrinter

advapi32

RegCloseKey
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyW
RegOpenKeyExW

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

kernel32

GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetLocaleInfoA
GetFileAttributesW
lstrcatW
lstrcpyW
lstrlenW
SetLastError
lstrcmpW
GetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DisableThreadLibraryCalls
GetEnvironmentVariableW
CloseHandle
CreateFileW
lstrcpynW
WriteFile
Sleep
GetExitCodeThread
SetEvent
CreateProcessW
GetTickCount
GetCurrentThread
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar

Exports

Exports

DllEntryPoint
InitializePrintMonitor

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Drivers/Win 2K-XP/PS5UI.DLL
.dll windows:5 windows x86 arch:x86

f3df2a0533c4d0c1555baa55a11521a4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
HeapCreate
MulDiv
CloseHandle
DeleteFileW
WriteFile
ReadFile
GetTempFileNameW
CreateFileW
MoveFileExW
CreateDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
WideCharToMultiByte
HeapFree
InterlockedIncrement
InterlockedDecrement
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
HeapDestroy
SetUnhandledExceptionFilter
SetErrorMode
LoadLibraryExW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetLocaleInfoW
CompareFileTime
GetFullPathNameW
VirtualFree
GetCPInfo
GetFileTime
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
VirtualAlloc
GetSystemInfo
RaiseException
GetUserDefaultUILanguage
GetACP
Sleep
SetLastError
LocalAlloc
HeapAlloc
GetCurrentProcess
LocalFree

msvcrt

malloc
_adjust_fdiv
_initterm
free
??2@YAPAXI@Z
ceil
floor
wcstod
iswctype
_vsnprintf
_wcsnicmp
_stricmp
wcsrchr
memmove
_vsnwprintf
wcscmp
wcslen
qsort
_wcsicmp
_ultoa
_except_handler3
strncmp
strrchr
strchr
_wtol
_strnicmp
isspace
??3@YAXPAX@Z

user32

CheckRadioButton
ShowWindow
GetDlgItem
SetDlgItemTextW
SetWindowLongW
EndDialog
GetWindowLongW
DialogBoxParamW
SetDlgItemTextA
LoadStringA
GetDlgItemTextW
SendDlgItemMessageW
SendMessageW
SetFocus
CheckDlgButton
WinHelpW
EnableWindow
MessageBoxW
MessageBeep
LoadStringW
GetAppCompatFlags2

winspool.drv

DeleteFormW
GetPrinterDataW
SetPrinterDataW
DeletePrinterDataW
GetPrinterW
EnumFormsW
GetFormW
GetPrinterDriverW
OpenPrinterW
SetPrinterW
ClosePrinter
AddFormW

gdi32

DeleteDC
CreateICW
ExtEscape
EnumFontFamiliesW

Exports

Exports

DevQueryPrintEx
DllMain
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvSplDeviceCaps
DrvUpgradePrinter

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Drivers/Win 2K-XP/PSCRIPT.HLP
Drivers/Win 2K-XP/PSCRIPT.NTF
Drivers/Win 2K-XP/PSCRIPT5.DLL
.dll windows:5 windows x86 arch:x86

d8641aabc132deef2640ad0645b76355

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryExW
FreeLibrary
UnmapViewOfFile
GetFileSize
CreateFileMappingW
SetErrorMode
GetFileTime
CompareFileTime
GetLastError
GetSystemDefaultLangID
Sleep
MultiByteToWideChar
GetUserDefaultUILanguage
RaiseException
GetSystemInfo
VirtualAlloc
HeapAlloc
LockResource
LoadResource
FindResourceW
GetCPInfo
HeapDestroy
VirtualFree
GetFullPathNameW
HeapCreate
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
LocalFree
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
InterlockedDecrement
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
GlobalFree
CreateFileW
WriteFile
WideCharToMultiByte
CloseHandle
DeleteFileW
GetTempPathW
GetTempFileNameW
LocalAlloc
DeleteCriticalSection
MulDiv
InitializeCriticalSection
SetLastError
MapViewOfFile

msvcrt

malloc
_adjust_fdiv
_initterm
free
??2@YAPAXI@Z
??3@YAXPAX@Z
wcsrchr
_wcsicmp
qsort
_ultoa
_ltoa
strncpy
strchr
strstr
strncmp
wcslen
wcscmp
strrchr
_wcsnicmp
iswctype
_strnicmp
isspace
_vsnprintf
atoi
strtol
_setjmp3
longjmp
_except_handler3
ceil

winspool.drv

EnumFormsW
GetPrinterDriverW
WritePrinter
GetJobW
GetPrinterDataW
GetPrinterW

gdi32

EngStretchBltROP
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_cGetGlyphs
EngGetCurrentCodePage
XLATEOBJ_hGetColorTransform
BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvGetRbrush
EngFindResource
EngQueryLocalTime
CLIPOBJ_ppoGetPath
EngDeletePath
FONTOBJ_cGetAllGlyphHandles
STROBJ_vEnumStart
STROBJ_bEnumPositionsOnly
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pifi
XFORMOBJ_iGetXform
PATHOBJ_vGetBounds
PATHOBJ_vEnumStart
PATHOBJ_bEnum
FONTOBJ_pxoGetXform
XFORMOBJ_bApplyXform
EngUnicodeToMultiByteN
EngTransparentBlt
EngBitBlt
EngEraseSurface
BRUSHOBJ_pvAllocRbrush
EngCreateBitmap
EngLockSurface
EngCopyBits
EngUnlockSurface
XLATEOBJ_iXlate
XLATEOBJ_piVector
EngLoadModule
EngCreatePalette
EngDeletePalette
EngFreeModule
EngDeleteSurface
EngCreateDeviceSurface
EngAssociateSurface
EngComputeGlyphSet
EngAlphaBlend
FONTOBJ_vGetInfo

user32

LoadStringW
GetAppCompatFlags2

mscms

InternalGetPS2ColorSpaceArray
InternalGetPS2CSAFromLCS
InternalGetPS2ColorRenderingDictionary
InternalGetPS2PreviewCRD

Exports

Exports

DllMain
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo

Sections

.text
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Drivers/Win XP64/PDFR.inf
Drivers/Win XP64/PDFR_NST.PPD
Drivers/Win XP64/PDFreDirectMon64.dll
.dll windows:4 windows x64 arch:x64

3799b1b272f45b31ee1cbfe4b866e7cd

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2c:b4:fb:72:3a:7e:77:ce:4d:6d:f8:c9:56:d5:ad:1a:d6:bb:d2:cd
Signer

Actual PE Digest

2c:b4:fb:72:3a:7e:77:ce:4d:6d:f8:c9:56:d5:ad:1a:d6:bb:d2:cd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

user32

CharNextW
wsprintfW
MessageBoxW

winspool.drv

EnumPortsW
SetJobW
OpenPrinterW
GetJobW
ClosePrinter

advapi32

RegCloseKey
OpenThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DuplicateTokenEx
CreateProcessAsUserW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyW
RegOpenKeyExW

shell32

SHGetFolderPathW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetSpecialFolderLocation
SHGetPathFromIDListW

kernel32

GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
GetLocaleInfoA
GetFileAttributesW
lstrcatW
lstrcpyW
lstrlenW
SetLastError
lstrcmpW
GetLastError
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
DisableThreadLibraryCalls
GetEnvironmentVariableW
CloseHandle
CreateFileW
lstrcpynW
WriteFile
Sleep
GetExitCodeThread
SetEvent
CreateProcessW
GetTickCount
GetCurrentThread
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcAddress
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
RtlUnwindEx
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
HeapSize
MultiByteToWideChar

Exports

Exports

DllEntryPoint
InitializePrintMonitor

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 634B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Drivers/Win XP64/PS5UI.DLL
.dll windows:5 windows x64 arch:x64

e1f98789494cfaf3672c4819b0953e47

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

ps5ui.pdb

Imports

msvcrt

wcstod
iswctype
_vsnprintf
??2@YAPEAX_K@Z
ceil
_wcsnicmp
_stricmp
wcsrchr
floor
_initterm
_wcsicmp
free
malloc
_wtol
_strnicmp
isspace
??3@YAXPEAX@Z
memmove
_vsnwprintf
memcpy
memset
qsort
_ultoa
strncmp
strrchr
strchr

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind

user32

EnableWindow
WinHelpW
CheckDlgButton
SetFocus
GetAppCompatFlags2
SendMessageW
SendDlgItemMessageW
LoadStringA
SetDlgItemTextA
DialogBoxParamW
GetWindowLongPtrW
EndDialog
SetWindowLongPtrW
SetDlgItemTextW
GetDlgItem
ShowWindow
CheckRadioButton
LoadStringW
MessageBoxW
MessageBeep
GetDlgItemTextW

kernel32

FreeLibrary
SetErrorMode
LoadLibraryExW
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetLocaleInfoW
CompareFileTime
GetFullPathNameW
VirtualFree
__C_specific_handler
GetCPInfo
GetFileTime
FindResourceW
LoadResource
LockResource
MultiByteToWideChar
GetSystemInfo
VirtualAlloc
RaiseException
GetUserDefaultUILanguage
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
HeapFree
WideCharToMultiByte
GetACP
LoadLibraryW
GetProcAddress
CreateDirectoryW
CreateFileW
GetTempFileNameW
MoveFileExW
ReadFile
LocalFree
HeapAlloc
LocalAlloc
SetLastError
HeapDestroy
GetLastError
HeapCreate
MulDiv
CloseHandle
DeleteFileW
WriteFile

winspool.drv

OpenPrinterW
GetPrinterDriverW
GetFormW
EnumFormsW
GetPrinterW
DeletePrinterDataW
SetPrinterDataW
GetPrinterDataW
DeleteFormW
AddFormW
SetPrinterW
ClosePrinter

gdi32

ExtEscape
EnumFontFamiliesW
CreateICW
DeleteDC

Exports

Exports

DevQueryPrintEx
DllMain
DrvConvertDevMode
DrvDeviceCapabilities
DrvDevicePropertySheets
DrvDocumentEvent
DrvDocumentPropertySheets
DrvDriverEvent
DrvPrinterEvent
DrvQueryColorProfile
DrvQueryJobAttributes
DrvSplDeviceCaps
DrvUpgradePrinter

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Drivers/Win XP64/PSCRIPT.HLP
Drivers/Win XP64/PSCRIPT.NTF
Drivers/Win XP64/PSCRIPT5.DLL
.dll windows:5 windows x64 arch:x64

9a17e8f4c7f10c91bdf5db187b7fc58b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

pscript5.pdb

Imports

msvcrt

malloc
free
_initterm
??3@YAXPEAX@Z
wcsrchr
_wcsicmp
qsort
_ltoa
_ultoa
strncpy
strchr
strstr
strncmp
memset
_stricmp
longjmp
_setjmp
strtol
atoi
??2@YAPEAX_K@Z
memcpy
strrchr
_wcsnicmp
iswctype
_strnicmp
isspace
_vsnprintf
ceil

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

winspool.drv

GetPrinterW
GetPrinterDriverW
WritePrinter
GetJobW
GetPrinterDataW
EnumFormsW

kernel32

WriteFile
CreateFileW
GlobalFree
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
Sleep
GetSystemDefaultLangID
GetLastError
CompareFileTime
GetFileTime
MapViewOfFile
CreateFileMappingW
GetFileSize
UnmapViewOfFile
FreeLibrary
GetProcAddress
LoadLibraryExW
SetErrorMode
MultiByteToWideChar
GetUserDefaultUILanguage
RaiseException
VirtualAlloc
CloseHandle
HeapAlloc
LockResource
LoadResource
FindResourceW
GetCPInfo
__C_specific_handler
HeapDestroy
VirtualFree
GetFullPathNameW
HeapCreate
HeapFree
DeleteFileW
GetTempPathW
GetTempFileNameW
LocalFree
LocalAlloc
DeleteCriticalSection
MulDiv
InitializeCriticalSection
SetLastError
QueryPerformanceCounter
GetSystemInfo

gdi32

EngCopyBits
EngAlphaBlend
EngComputeGlyphSet
FONTOBJ_vGetInfo
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_cGetGlyphs
EngGetCurrentCodePage
XLATEOBJ_hGetColorTransform
BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvGetRbrush
EngFindResource
EngQueryLocalTime
CLIPOBJ_ppoGetPath
EngDeletePath
FONTOBJ_cGetAllGlyphHandles
STROBJ_vEnumStart
STROBJ_bEnumPositionsOnly
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pifi
XFORMOBJ_iGetXform
PATHOBJ_vGetBounds
PATHOBJ_vEnumStart
PATHOBJ_bEnum
FONTOBJ_pxoGetXform
XFORMOBJ_bApplyXform
EngUnicodeToMultiByteN
EngTransparentBlt
EngStretchBltROP
EngBitBlt
EngEraseSurface
BRUSHOBJ_pvAllocRbrush
EngCreateBitmap
XLATEOBJ_iXlate
XLATEOBJ_piVector
EngLoadModule
EngCreatePalette
EngDeletePalette
EngFreeModule
EngDeleteSurface
EngCreateDeviceSurface
EngAssociateSurface
EngLockSurface
EngUnlockSurface

user32

GetAppCompatFlags2
LoadStringW

mscms

InternalGetPS2PreviewCRD
InternalGetPS2CSAFromLCS
InternalGetPS2ColorRenderingDictionary
InternalGetPS2ColorSpaceArray

Exports

Exports

DllMain
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo

Sections

.text
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 165KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
EULA.txt
History.txt
Language/Chinese Simplified.txt
Language/Czech.txt
Language/Deutsch.txt
Language/English.txt
Language/Espaol.txt
Language/Francais.txt
Language/Italiano.txt
Language/Japanese.txt
Language/Magyar.txt
Language/Nederlands.txt
Language/Norwegian.txt
Language/Portugus-BR.txt
Language/Portugus.txt
Language/Swedish.txt
MSMAPI32.OCX
.dll regsvr32 windows:4 windows x86 arch:x86

39c0caf76678c314404f857483758f24

Code Sign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
GetModuleFileNameA
GetWindowsDirectoryA
GetLocaleInfoA
InterlockedIncrement
IsBadWritePtr
GetFileAttributesA
GetVersion
GetLastError
LockResource
LoadResource
FindResourceA
CompareStringA
CompareStringW
DisableThreadLibraryCalls
GetProcessHeap
HeapReAlloc
lstrcmpA
LeaveCriticalSection
DeleteFileA
EnterCriticalSection
InterlockedDecrement
lstrcmpiA
lstrlenA
LoadLibraryA
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
HeapAlloc
InitializeCriticalSection
SetErrorMode
GetProcAddress
lstrcpynA
lstrcpyA
IsDBCSLeadByte
MultiByteToWideChar

user32

ReleaseDC
PostMessageA
ClientToScreen
CharNextA
GetDC
GetActiveWindow
EqualRect
GetWindowRect
GetParent
ShowWindow
PtInRect
OffsetRect
IntersectRect
LoadStringA
WinHelpA
SetWindowRgn
GetClientRect
IsWindowEnabled
IsChild
GetKeyState
CreateDialogIndirectParamA
LoadIconA
DrawEdge
DrawIcon
LoadCursorA
RegisterClassA
GetSystemMetrics
SendMessageA
GetDlgItem
SetDlgItemTextA
GetDlgItemTextA
MessageBeep
MessageBoxA
GetDlgItemInt
IsDlgButtonChecked
CheckDlgButton
SetDlgItemInt
SendDlgItemMessageA
GetWindowTextA
BeginPaint
SetParent
DialogBoxParamA
EndDialog
SetWindowPos
IsWindowVisible
CreateWindowExA
DestroyWindow
SetWindowLongA
UnregisterClassA
IsDialogMessageA
GetWindow
GetNextDlgTabItem
wsprintfA
RegisterClipboardFormatA
SetFocus
MoveWindow
DefWindowProcA
EndPaint
GetWindowLongA

ole32

CreateOleAdviseHolder
CoCreateInstance
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree

advapi32

RegEnumKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

oleaut32

OleCreatePropertyFrame
VariantClear
SetErrorInfo
UnRegisterTypeLi
LoadTypeLi
LoadTypeLibEx
LoadRegTypeLi
GetErrorInfo
RegisterTypeLi
VariantInit
SysFreeString
SysAllocStringLen
SysAllocString
VariantChangeType
CreateErrorInfo

gdi32

DeleteDC
GetWindowExtEx
GetViewportExtEx
SetMapMode
LPtoDP
SetWindowOrgEx
SetViewportOrgEx
CreateDCA
SetViewportExtEx
GetDeviceCaps
SetWindowExtEx
CreateRectRgnIndirect

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OSSMTP.dll
.dll regsvr32 windows:4 windows x86 arch:x86

582b7ed30531014d17900c13b6bed803

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaNextEachVar
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
ord660
__vbaLsetFixstr
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaI4Abs
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaVarIndexLoad
ord520
__vbaForEachCollVar
_CIsin
ord709
__vbaErase
ord632
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
__vbaGenerateBoundsError
__vbaStrCmp
__vbaGet3
__vbaVarTstEq
__vbaAryConstruct2
__vbaNextEachCollVar
__vbaI2I4
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
ord601
__vbaUI1I2
_CIsqrt
EVENT_SINK_QueryInterface
ord710
__vbaExceptHandler
ord711
ord712
__vbaStrToUnicode
ord314
ord606
_adj_fprem
_adj_fdivr_m64
ord315
ord316
ord608
__vbaFPException
__vbaStrVarVal
__vbaGetOwner3
__vbaVarCat
ord645
_CIlog
__vbaErrorOverflow
__vbaFileOpen
__vbaNew2
__vbaInStr
ord648
ord570
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
__vbaFpI2
ord616
__vbaVarCopy
ord617
_CIatan
__vbaStrMove
__vbaForEachVar
ord619
_allmul
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj
ord581

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PDF reDirect Help.chm
.chm
PDFR_Printer_Cmds_v25000.exe
.exe windows:4 windows x86 arch:x86

c0cda4706c71c644bf72db0e68ca1feb

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

44:e7:b6:a1:53:a0:2c:6c:eb:99:71:c0:f6:46:08:fd:19:43:2e:87
Signer

Actual PE Digest

44:e7:b6:a1:53:a0:2c:6c:eb:99:71:c0:f6:46:08:fd:19:43:2e:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
__vbaLenBstr
__vbaFreeVarList
_adj_fdiv_m64
__vbaFreeObjList
ord516
_adj_fprem1
__vbaRecAnsiToUni
__vbaResume
__vbaStrCat
__vbaWriteFile
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
ord631
ord525
__vbaChkstk
__vbaFileClose
EVENT_SINK_AddRef
__vbaStrCmp
ord529
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaFixstrConstruct
__vbaRedim
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
__vbaStrVarVal
__vbaUbound
__vbaVarCat
ord536
ord644
ord537
ord645
_CIlog
__vbaFileOpen
__vbaNew2
__vbaInStr
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord578
ord100
__vbaAryLock
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaFpI4
ord616
__vbaRecDestructAnsi
_CIatan
__vbaStrMove
__vbaStrVarCopy
ord650
_allmul
_CItan
ord546
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
ord581

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PDF_reDirect.exe
.exe windows:4 windows x86 arch:x86

3e695e68ab157390ffbf011df7b4e776

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10-05-2010 00:00

Not After

10-05-2015 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

29-06-2009 00:00

Not After

28-06-2012 23:59

Subject

CN=EXP Systems LLC,O=EXP Systems LLC,POSTALCODE=67212,STREET=11058 W 1st Street CT N,L=Wichita,ST=KS,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9d:77:13:2a:9c:6c:fc:d3:24:90:a6:43:eb:64:05:0b:19:e5:51:54
Signer

Actual PE Digest

9d:77:13:2a:9c:6c:fc:d3:24:90:a6:43:eb:64:05:0b:19:e5:51:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

__vbaVarSub
__vbaVarTstGt
ord690
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaCyMul
__vbaAryMove
__vbaFreeVar
ord588
__vbaLenBstr
__vbaStrVarMove
__vbaLateIdCall
ord696
__vbaPut3
__vbaFreeVarList
__vbaEnd
__vbaVarIdiv
_adj_fdiv_m64
__vbaNextEachVar
__vbaRaiseEvent
__vbaFreeObjList
ord516
ord517
__vbaStrErrVarCopy
_adj_fprem1
ord518
__vbaRecAnsiToUni
ord519
__vbaCopyBytes
__vbaResume
__vbaVarCmpNe
__vbaStrCat
ord660
ord553
__vbaWriteFile
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaNameFile
__vbaLenBstrB
ord663
__vbaVargVarCopy
__vbaLenVar
_adj_fdiv_m32
__vbaVarTstLe
__vbaAryVar
__vbaVarCmpGe
__vbaAryDestruct
__vbaLateMemSt
__vbaBoolStr
ord593
__vbaForEachCollObj
__vbaExitProc
__vbaStrBool
ord594
__vbaOnError
__vbaObjSet
ord595
ord596
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaForEachCollVar
__vbaStrFixstr
__vbaBoolVar
__vbaVarTstLt
__vbaBoolVarNull
_CIsin
__vbaErase
ord631
ord709
__vbaVarZero
__vbaVargVarMove
__vbaNextEachCollObj
ord525
__vbaVarCmpGt
__vbaChkstk
__vbaCyVar
ord526
__vbaFileClose
EVENT_SINK_AddRef
ord528
__vbaCyI2
__vbaExitEachColl
__vbaGet3
__vbaStrCmp
ord529
__vbaPutOwner3
__vbaVarTstEq
__vbaAryConstruct2
__vbaCyI4
__vbaR4Str
__vbaDateR8
__vbaObjVar
__vbaNextEachCollVar
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
ord670
__vbaFpUI1
__vbaCastObjVar
__vbaStrR4
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
ord568
__vbaFixstrConstruct
__vbaR4Cy
ord569
__vbaLateIdCallLd
__vbaR8Cy
__vbaRedim
__vbaStrR8
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
ord600
_CIsqrt
__vbaObjIs
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaStrUI1
__vbaVarMul
__vbaStr2Vec
__vbaExceptHandler
ord711
ord712
__vbaInputFile
__vbaStrToUnicode
ord606
__vbaDateStr
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
ord714
ord607
__vbaI2Str
__vbaVarDiv
ord608
__vbaVarCmpLe
ord716
ord531
__vbaFPException
ord717
__vbaInStrVar
__vbaGetOwner3
__vbaStrVarVal
__vbaUbound
__vbaVarCat
__vbaDateVar
ord535
__vbaI2Var
ord536
__vbaFileSeek
ord537
ord644
ord645
_CIlog
__vbaFileOpen
ord648
ord570
__vbaNew2
__vbaInStr
__vbaCyMulI2
ord571
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaVarSetObj
__vbaStrCopy
__vbaI4Str
ord681
__vbaFreeStrList
ord576
_adj_fdivr_m32
ord577
__vbaR8Var
__vbaPowerR8
_adj_fdiv_r
ord685
ord578
ord100
ord579
__vbaVarTstNe
__vbaI4Var
ord689
__vbaVarCmpEq
ord610
__vbaLateMemCall
__vbaAryLock
__vbaVarAdd
__vbaVarDup
__vbaStrToAnsi
ord613
__vbaFpI2
__vbaVarLateMemCallLd
__vbaVarTstGe
ord616
__vbaFpI4
__vbaVarCopy
ord617
__vbaR8IntI2
__vbaRecDestructAnsi
__vbaLateMemCallLd
_CIatan
__vbaI2ErrVar
__vbaStrMove
ord618
__vbaAryCopy
__vbaCastObj
__vbaForEachVar
__vbaR8IntI4
__vbaStrVarCopy
ord650
_allmul
__vbaLenVarB
__vbaLateIdSt
ord545
__vbaAryRecCopy
_CItan
ord546
__vbaAryUnlock
__vbaFPInt
_CIexp
__vbaI4ErrVar
__vbaFreeStr
__vbaFreeObj
__vbaRecAssign
ord581

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Stamps/APPROVED.ini
Stamps/APPROVED.pdf
.pdf
Stamps/COMPLETED.ini
Stamps/COMPLETED.pdf
.pdf
Stamps/CONFIDENTIAL - Yellow URH.ini
Stamps/CONFIDENTIAL - Yellow URH.txt
Stamps/CONFIDENTIAL-Text.ini
Stamps/CONFIDENTIAL-Text.txt
Stamps/CONFIDENTIAL.ini
Stamps/CONFIDENTIAL.pdf
.pdf
Stamps/DRAFT - Text.ini
Stamps/DRAFT - Text.txt
Stamps/DRAFT BLUE.ini
Stamps/DRAFT BLUE.pdf
.pdf
Stamps/DRAFT_ULH.ini
Stamps/DRAFT_ULH.pdf
.pdf
Stamps/E-Mail.ini
Stamps/E-Mail.pdf
.pdf
Stamps/EXP Business Card.ini
Stamps/EXP Business Card.pdf
.pdf
Stamps/FINAL.ini
Stamps/FINAL.pdf
.pdf
Stamps/FOR COMMENT.ini
Stamps/FOR COMMENT.pdf
.pdf
Stamps/FOR PUBLIC RELEASE.ini
Stamps/FOR PUBLIC RELEASE.pdf
.pdf
Stamps/INFORMATION_ONLY.ini
Stamps/INFORMATION_ONLY.pdf
.pdf
Stamps/NOT APPROVED.ini
Stamps/NOT APPROVED.pdf
.pdf
Stamps/NOT FOR PUBLIC RELEASE.ini
Stamps/NOT FOR PUBLIC RELEASE.pdf
.pdf
Stamps/OVERDUE.ini
Stamps/OVERDUE.pdf
.pdf
Stamps/PAID IN FULL.ini
Stamps/PAID IN FULL.pdf
.pdf
Stamps/PRELIMINARY RESULTS.ini
Stamps/PRELIMINARY RESULTS.pdf
.pdf
Stamps/Page Number Footer.ini
Stamps/Page Number Footer.txt
Stamps/TOP SECRET_Yellow.ini
Stamps/TOP SECRET_Yellow.pdf
.pdf
Stamps/VOID.ini
Stamps/VOID.pdf
.pdf
Stamps/www.exp-systems.com.ini
Stamps/www.exp-systems.com.txt
Uninstall.exe.nsis
bin/COPYING.TXT
bin/COPYING_LGPL.TXT
bin/Fontmap
bin/Fontmap.GS
bin/Q0.joboptions
bin/Q1.joboptions
bin/Q2.joboptions
bin/Q3.joboptions
bin/gs_agl.ps
bin/gs_btokn.ps
bin/gs_ccfnt.ps
bin/gs_ce_e.ps
bin/gs_cff.ps
bin/gs_cidcm.ps
bin/gs_ciddc.ps
bin/gs_cidfm.ps
bin/gs_cidfn.ps
bin/gs_cidtt.ps
bin/gs_ciecs2.ps
bin/gs_ciecs3.ps
bin/gs_cmap.ps
bin/gs_cmdl.ps
bin/gs_cspace.ps
bin/gs_css_e.ps
bin/gs_dbt_e.ps
bin/gs_devcs.ps
bin/gs_devn.ps
bin/gs_devpxl.ps
bin/gs_diskf.ps
bin/gs_diskn.ps
bin/gs_dpnxt.ps
bin/gs_dps.ps
bin/gs_dps1.ps
bin/gs_dps2.ps
bin/gs_dscp.ps
bin/gs_epsf.ps
bin/gs_fapi.ps
bin/gs_fform.ps
bin/gs_fntem.ps
bin/gs_fonts.ps
bin/gs_frsd.ps
bin/gs_icc.ps
bin/gs_il1_e.ps
bin/gs_il2_e.ps
bin/gs_img.ps
bin/gs_indxd.ps
bin/gs_init.ps
bin/gs_kanji.ps
bin/gs_ksb_e.ps
bin/gs_l2img.ps
bin/gs_lev2.ps
bin/gs_lgo_e.ps
bin/gs_lgx_e.ps
bin/gs_ll3.ps
bin/gs_mex_e.ps
bin/gs_mgl_e.ps
bin/gs_mro_e.ps
bin/gs_patrn.ps
bin/gs_pdf_e.ps
bin/gs_pdfwr.ps
bin/gs_pfile.ps
bin/gs_rdlin.ps
bin/gs_res.ps
bin/gs_resmp.ps
bin/gs_resst.ps
bin/gs_sepr.ps
bin/gs_setpd.ps
bin/gs_statd.ps
bin/gs_std_e.ps
bin/gs_stres.ps
bin/gs_sym_e.ps
bin/gs_trap.ps
bin/gs_ttf.ps
bin/gs_typ32.ps
bin/gs_typ42.ps
bin/gs_type1.ps
bin/gs_wan_e.ps
bin/gs_wl1_e.ps
bin/gs_wl2_e.ps
bin/gs_wl5_e.ps
bin/gsdll32.dll
.dll windows:4 windows x86 arch:x86

3edacdf434fad396dea32c5caf968307

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comdlg32

GetSaveFileNameA

gdi32

DeleteObject
GetTextMetricsA
GetTextFaceA
SelectObject
CreateFontIndirectA
GetTextExtentPointA
DeleteDC
GetBitmapBits
TextOutA
GetDeviceCaps
SetTextColor
PatBlt
SetMapMode
GetMapMode
CreateCompatibleDC
CreateBitmap
SetDIBitsToDevice
RealizePalette
SelectPalette
CreatePalette
SetBkMode

user32

GetDC
FindWindowA
MessageBoxA
SendDlgItemMessageA
EndDialog
PostMessageA
DialogBoxParamA
ReleaseDC
MessageBeep
IsWindow

winspool.drv

EnumPrintersA
ClosePrinter
EndDocPrinter
WritePrinter
AbortPrinter
StartDocPrinterA
OpenPrinterA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCloseKey

kernel32

SetEnvironmentVariableA
GetOEMCP
GetACP
CompareStringW
CompareStringA
GetCPInfo
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
InterlockedIncrement
GetVersion
GetProfileStringA
WinExec
GetModuleFileNameA
lstrlenA
GetLastError
CreateProcessA
GetStdHandle
CloseHandle
DuplicateHandle
CreatePipe
GetCurrentProcess
CreateFileA
GetTempFileNameA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetSystemTime
CreateMutexA
GlobalFree
GlobalUnlock
ReleaseMutex
WaitForSingleObject
GlobalLock
GlobalAlloc
ExitProcess
TerminateProcess
InterlockedDecrement
DeleteFileA
HeapFree
HeapAlloc
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetStdHandle
GetFileType
ReadFile
GetTimeZoneInformation
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
HeapReAlloc
MoveFileA
GetDriveTypeA
GetCommandLineA
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStartupInfoA
SetFilePointer
RaiseException
GetProcAddress
GetModuleHandleA
RtlUnwind
LoadLibraryA
FlushFileBuffers
WriteFile
GetStringTypeA
GetStringTypeW
GetExitCodeProcess
SetEndOfFile
GetFullPathNameA
GetCurrentDirectoryA

Exports

Exports

DllEntryPoint
DllMain
gsapi_delete_instance
gsapi_exit
gsapi_init_with_args
gsapi_new_instance
gsapi_revision
gsapi_run_file
gsapi_run_string
gsapi_run_string_begin
gsapi_run_string_continue
gsapi_run_string_end
gsapi_run_string_with_length
gsapi_set_display_callback
gsapi_set_poll
gsapi_set_stdio
gsapi_set_visual_tracer
gsdll_copy_dib
gsdll_copy_palette
gsdll_draw
gsdll_execute_begin
gsdll_execute_cont
gsdll_execute_end
gsdll_exit
gsdll_get_bitmap_row
gsdll_init
gsdll_lock_device
gsdll_revision

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 232KB - Virtual size: 229KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 52KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 60KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/n019003l.pfb
bin/n019004l.pfb
bin/n019023l.pfb
bin/n019024l.pfb
bin/n021003l.pfb
bin/n021004l.pfb
bin/n021023l.pfb
bin/n021024l.pfb
bin/n022003l.pfb
bin/n022004l.pfb
bin/n022023l.pfb
bin/n022024l.pfb
bin/pdf2dsc.ps
bin/pdf_base.ps
bin/pdf_draw.ps
bin/pdf_font.ps
bin/pdf_main.ps
.pdf
bin/pdf_ops.ps
bin/pdf_rbld.ps
bin/pdf_sec.ps
bin/pdfopt.ps
bin/pdfwrite.ps
.pdf
bin/xlatmap
cbak4exp.dll
.dll windows:4 windows x86 arch:x86

2c2efdaaac9f2f994db5dcfec17c7367

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

CreateDialogParamA
SetWindowTextA
IsWindow
DestroyWindow

msvcrt

_initterm
free
_adjust_fdiv
malloc
_onexit
__dllonexit

Exports

Exports

StartCallback
StopCallback

Sections

.text
Size: 1024B - Virtual size: 764B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 516B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ccrpani6.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

65fc9d0a203010ff43c76361850802f9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaStrI4
__vbaVarMove
__vbaFreeVar
__vbaAptOffset
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
ord519
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
__vbaBoolVar
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
__vbaFPException
__vbaI2Var
ord644
_CIlog
__vbaErrorOverflow
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaI4Str
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
_CIatan
__vbaStrMove
_allmul
_CItan
_CIexp
__vbaFreeObj
__vbaFreeStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data_v.dat
filev4exp09.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

a4382cec86116ecc10479481196fc42f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathMatchSpecW

kernel32

GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringA
CompareStringW
HeapReAlloc
HeapSize
GetLocalTime
GetSystemTime
GetTimeZoneInformation
Sleep
GlobalFree
GlobalUnlock
GlobalLock
CreateDirectoryW
MulDiv
GlobalAlloc
GlobalSize
SetThreadPriority
CreateThread
ResetEvent
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrcpyW
GetWindowsDirectoryW
MultiByteToWideChar
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
WriteFile
CopyFileW
CloseHandle
CreateFileW
GetSystemDirectoryW
GetFileAttributesW
FindNextFileW
WaitForSingleObject
SetEvent
TerminateProcess
ExitProcess
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
lstrcpyA
GetFileTime
GetFileSize
FindResourceExW
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
WritePrivateProfileStringW
GetProcessVersion
GetLastError
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
GetProfileIntW
ReleaseSemaphore
CreateSemaphoreW
GlobalReAlloc
SetLastError
GetUserDefaultLCID
IsDBCSLeadByte
InterlockedIncrement
FindNextChangeNotification
DuplicateHandle
WaitForMultipleObjects
GetCurrentProcess
FindCloseChangeNotification
FindFirstChangeNotificationW
FormatMessageW
lstrcpynW
LocalFree
lstrcmpiW
CreateEventW
GetModuleFileNameW
lstrcmpW
GetCurrentThread
lstrlenW
InterlockedDecrement
GetModuleHandleA
LoadLibraryA
FreeLibrary
lstrlenA
GetVersion
lstrcatW
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetDriveTypeW
FindResourceW
SizeofResource
LoadResource
LockResource
WideCharToMultiByte
GetVersionExW
GetTickCount
FindAtomW
AddAtomW
GetModuleHandleW
LoadLibraryW
GetProcAddress
SetEnvironmentVariableA

user32

GetDCEx
GetTabbedTextExtentA
CharUpperW
GetSysColorBrush
GetDialogBaseUnits
UnregisterClassW
IsClipboardFormatAvailable
LockWindowUpdate
EnumChildWindows
EndPaint
BeginPaint
GetClassNameW
GrayStringW
DrawTextW
TabbedTextOutW
SetRectEmpty
ReleaseCapture
SetCapture
IsRectEmpty
CreateMenu
GetDesktopWindow
InflateRect
DrawEdge
GetMessageW
TranslateMessage
ValidateRect
PostQuitMessage
LoadStringW
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
EnableMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
GetFocus
SetFocus
AdjustWindowRectEx
EqualRect
IsWindowVisible
GetTopWindow
MessageBoxW
IsChild
GetCapture
WinHelpW
wsprintfW
RegisterClassW
GetMenu
GetWindowTextLengthW
GetWindowTextW
GetDlgCtrlID
SetWindowsHookExW
CallNextHookEx
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
RegisterWindowMessageW
OffsetRect
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
GetParent
GetDlgItem
IsWindowEnabled
SetMenuItemBitmaps
InsertMenuItemW
SetMenuDefaultItem
InsertMenuW
GetSubMenu
UpdateWindow
LoadCursorW
SetCursor
CreateIconIndirect
CopyImage
GetMenuDefaultItem
IsCharAlphaW
GetScrollInfo
WindowFromPoint
PeekMessageW
DispatchMessageW
SetClipboardViewer
GetWindowDC
SetRect
FrameRect
GetIconInfo
IntersectRect
GetWindowRect
LoadBitmapW
GetClientRect
PtInRect
KillTimer
GetAsyncKeyState
GetMenuItemInfoW
SetMenuItemInfoW
GetMenuItemCount
GetMenuState
RemoveMenu
IsWindow
ChangeClipboardChain
SetTimer
GetMenuItemID
SystemParametersInfoW
GetSystemMetrics
DrawIconEx
LoadIconW
CreatePopupMenu
AppendMenuW
TrackPopupMenu
GetMenuStringW
DestroyMenu
GetCursorPos
ScreenToClient
CharUpperBuffW
GetKeyState
RegisterClipboardFormatW
ClientToScreen
DestroyIcon
CopyRect
SetWindowPos
LoadImageW
GetDC
ReleaseDC
FillRect
CreateWindowExW
SetParent
InvalidateRect
GetWindowLongW
SetWindowLongW
SendMessageW
PostMessageW
GetSysColor
DestroyWindow
EnableWindow
GetClassInfoW

gdi32

CreateRectRgn
CreatePen
CreatePatternBrush
CopyMetaFileW
CreateDCW
GetTextMetricsW
GetTextAlign
EnumFontFamiliesExW
UnrealizeObject
Rectangle
GetStockObject
GetCurrentPositionEx
MoveToEx
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetMapMode
SetROP2
SetBkMode
CreateBitmap
SetStretchBltMode
StretchBlt
SetBkColor
ExtTextOutW
DeleteDC
BitBlt
DeleteObject
CreateSolidBrush
SetViewportOrgEx
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetDeviceCaps
RestoreDC
SaveDC
CreateRectRgnIndirect
PatBlt
Escape
TextOutW
RectVisible
PtVisible
CombineRgn
CreateMetaFileW
CloseMetaFile
DeleteMetaFile
LPtoDP
SetTextColor
GetClipBox
SetDIBitsToDevice
SetRectRgn
GetDIBits
GetTextExtentPoint32W
CreateFontIndirectW
SetPixel
GetPixel
GetObjectW

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyW
RegCreateKeyW
RegSetValueExW
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptDestroyKey
CryptVerifySignatureW
CryptImportKey
RegEnumKeyW
RegSetValueW
RegDeleteKeyW
RegQueryValueW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
DragQueryFileW
SHGetMalloc
SHGetDataFromIDListW
SHGetFileInfoW
ExtractIconW
SHChangeNotify
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetDesktopFolder
SHBrowseForFolderW

comctl32

ImageList_ReplaceIcon
ImageList_AddMasked
ImageList_Add
ImageList_SetOverlayImage
ImageList_SetImageCount
ImageList_Create
ImageList_GetIconSize
ImageList_Duplicate
ImageList_GetIcon
ImageList_SetBkColor
ImageList_Remove
ImageList_GetImageCount
ord17
ImageList_Destroy

ole32

RegisterDragDrop
CoDisconnectObject
StringFromCLSID
ReadFmtUserTypeStg
OleDuplicateData
CreateOleAdviseHolder
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
CoInitializeEx
CoUninitialize
OleGetClipboard
CoTaskMemFree
CLSIDFromString
CoCreateInstance
OleInitialize
ReleaseStgMedium
OleLoadFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
DoDragDrop
RevokeDragDrop
ReadClassStm
CoLockObjectExternal

olepro32

ord254
ord253
ord251
ord252
ord250

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
LoadTypeLi
RegisterTypeLi
SysStringByteLen
VariantCopy
VariantChangeType
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayPutElement
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetDim
VariantClear
VariantInit
SysFreeString
LoadRegTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fldrv4exp09.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

c4cc3ab1a975f6f01e283840bdf99cc4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

shlwapi

PathMatchSpecW

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
GetStringTypeA
GetStringTypeW
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
Sleep
GlobalFree
GlobalUnlock
GlobalLock
MulDiv
GlobalSize
GlobalAlloc
lstrcpynW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleHandleW
AddAtomW
FindAtomW
GetTickCount
WideCharToMultiByte
LockResource
LoadResource
SizeofResource
FindResourceW
InterlockedIncrement
CreateDirectoryW
GetDriveTypeW
lstrcpyW
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
GetCurrentThreadId
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
HeapReAlloc
HeapSize
TerminateProcess
ExitProcess
GetLocalTime
GetSystemTime
GetTimeZoneInformation
RaiseException
GetCommandLineA
HeapAlloc
HeapFree
RtlUnwind
lstrcpyA
WritePrivateProfileStringW
FindResourceExW
GetFileTime
GetFileSize
GetFileAttributesW
GetShortPathNameW
GetFullPathNameW
GetVolumeInformationW
FindFirstFileW
FindClose
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
CreateFileW
GetCurrentProcess
DuplicateHandle
lstrcatW
GetVersion
lstrlenA
LoadLibraryA
GetModuleHandleA
InterlockedDecrement
lstrlenW
SetLastError
GetProcessVersion
GetLastError
GlobalFlags
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
CloseHandle
GetCurrentThread
CopyFileW
GetUserDefaultLCID
FileTimeToLocalFileTime
FileTimeToSystemTime
GetModuleFileNameW
GlobalReAlloc
FormatMessageW
LocalFree
GetProfileIntW
IsDBCSLeadByte
lstrcmpiW
lstrcmpW

user32

GetDCEx
CharUpperW
GetTabbedTextExtentA
GetSysColorBrush
GetDialogBaseUnits
UnregisterClassW
GetMessageW
TranslateMessage
PostQuitMessage
IsClipboardFormatAvailable
LockWindowUpdate
EnumChildWindows
SetRectEmpty
CreateMenu
IsRectEmpty
SetCapture
ReleaseCapture
GetDesktopWindow
ValidateRect
DrawEdge
InflateRect
PtInRect
GetClassNameW
GrayStringW
DrawTextW
TabbedTextOutW
EndPaint
BeginPaint
wvsprintfW
LoadStringW
GetMenuCheckMarkDimensions
ModifyMenuW
CheckMenuItem
EnableMenuItem
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
LoadIconW
UpdateWindow
SendDlgItemMessageW
SendDlgItemMessageA
MapWindowPoints
PeekMessageW
DispatchMessageW
GetFocus
SetFocus
AdjustWindowRectEx
EqualRect
IsWindowVisible
GetScrollPos
GetTopWindow
MessageBoxW
IsChild
GetCapture
WinHelpW
wsprintfW
GetClassInfoW
RegisterClassW
GetMenu
GetWindowTextLengthW
GetWindowTextW
GetDlgCtrlID
SetWindowsHookExW
CallNextHookEx
SetPropW
UnhookWindowsHookEx
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
RegisterWindowMessageW
OffsetRect
IntersectRect
SystemParametersInfoW
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
GetSystemMetrics
CreateDialogIndirectParamW
DestroyWindow
GetParent
GetDlgItem
IsWindowEnabled
SetMenuItemBitmaps
InsertMenuItemW
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
InsertMenuW
GetSubMenu
RemoveMenu
LoadCursorW
SetCursor
GetIconInfo
CreateIconIndirect
GetMenuDefaultItem
GetMenuItemCount
GetMenuState
GetMenuItemID
CopyRect
GetDC
FillRect
CreateWindowExW
GetWindowLongW
SetWindowLongW
SetParent
PostMessageW
SetClipboardViewer
GetWindowDC
SetRect
ReleaseDC
LoadImageW
CopyImage
LoadBitmapW
DestroyIcon
SetTimer
KillTimer
GetClientRect
GetCursorPos
ScreenToClient
ClientToScreen
GetAsyncKeyState
CreatePopupMenu
AppendMenuW
TrackPopupMenu
GetMenuStringW
DestroyMenu
ChangeClipboardChain
GetKeyState
GetSysColor
RegisterClipboardFormatW
GetWindowRect
SetWindowPos
InvalidateRect
SendMessageW
EnableWindow

gdi32

CreatePen
CreatePatternBrush
PtVisible
RectVisible
TextOutW
Escape
LPtoDP
DeleteMetaFile
CloseMetaFile
CreateMetaFileW
SetRectRgn
CombineRgn
CopyMetaFileW
CreateDCW
GetTextExtentPoint32W
GetTextMetricsW
GetClipBox
GetTextAlign
EnumFontFamiliesExW
UnrealizeObject
Rectangle
CreateRectRgn
GetCurrentPositionEx
MoveToEx
SelectClipRgn
ScaleWindowExtEx
CreateFontIndirectW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
GetObjectW
RealizePalette
GetDeviceCaps
CreateBitmap
DeleteObject
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetMapMode
SetROP2
SetBkMode
SelectPalette
RestoreDC
SaveDC
CreateRectRgnIndirect
PatBlt
SetViewportOrgEx
GetStockObject
SetTextColor
ExtTextOutW
SetBkColor
DeleteDC
SelectObject
CreateSolidBrush

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegQueryValueExW
RegCreateKeyW
RegSetValueExW
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptReleaseContext
CryptDestroyKey
CryptVerifySignatureW
CryptImportKey
RegOpenKeyExW
RegEnumKeyW
RegOpenKeyW
RegSetValueW
RegDeleteKeyW
RegQueryValueW
RegCreateKeyExW
RegCloseKey

shell32

SHGetPathFromIDListW
ShellExecuteW
DragQueryFileW
SHBrowseForFolderW
ExtractIconW
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetMalloc
SHGetDesktopFolder
SHChangeNotify

comctl32

ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_AddMasked
ImageList_GetIconSize
ImageList_Create
ImageList_Duplicate
ImageList_SetOverlayImage
ImageList_Remove
ImageList_GetBkColor
ImageList_GetImageCount
ord17
ImageList_Destroy

ole32

ReadFmtUserTypeStg
OleDuplicateData
ReadClassStm
CreateOleAdviseHolder
CreateDataAdviseHolder
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
DoDragDrop
OleSaveToStream
CoTaskMemAlloc
CreateDataCache
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
CoDisconnectObject
StringFromGUID2
ReleaseStgMedium
CoTaskMemFree
CoCreateInstance
OleInitialize
OleLoadFromStream
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
OleGetClipboard

olepro32

ord254
ord253
ord251
ord252
ord250

oleaut32

SysStringLen
RegisterTypeLi
LoadTypeLi
SysStringByteLen
SysAllocStringLen
SysAllocString
VariantChangeType
VariantClear
VariantCopy
SafeArrayGetDim
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayPutElement
LoadRegTypeLi
SysFreeString
VariantInit

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jpeg4exp.dll
.dll windows:4 windows x86 arch:x86

eb6df2cdc437fbaf0d983ed099e6f072

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OutputDebugStringA
CloseHandle
WriteFile
LocalFree
LocalAlloc
SetFilePointer
ReadFile
GetCurrentThreadId
GetModuleFileNameA
GetLastError
FreeEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsA
RtlUnwind
ExitProcess
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
HeapAlloc
HeapFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
CreateFileA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetACP
FlushFileBuffers
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
InterlockedDecrement
InterlockedIncrement
VirtualAlloc
HeapReAlloc
GetCPInfo
GetOEMCP
LoadLibraryA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle

user32

PostQuitMessage
wsprintfA
MessageBoxA
PeekMessageA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

Exports

Exports

ijlErrorStr
ijlFree
ijlGetLibVersion
ijlInit
ijlRead
ijlWrite

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
pdf4exp.dll
.dll regsvr32 windows:5 windows x86 arch:x86

9caa1fb0954d8df4bb0a3f922846f974

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
CreateErrorInfo
GetErrorInfo
SetErrorInfo
DispGetIDsOfNames
RegisterTypeLib
LoadTypeLibEx
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegFlushKey
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongW
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PostThreadMessageW
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OffsetRect
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharToOemW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
CharUpperBuffA
AdjustWindowRectEx
ActivateKeyboardLayout

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
lstrcpyW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualAlloc
SwitchToThread
SizeofResource
SignalObjectAndWait
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
MultiByteToWideChar
MulDiv
LockResource
LoadResource
LoadLibraryW
LeaveCriticalSection
IsBadReadPtr
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetVersionExW
GetVersion
GetTimeZoneInformation
GetTickCount
GetThreadLocale
GetTempPathW
GetStdHandle
GetShortPathNameW
GetProfileStringW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileTime
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FindResourceW
FindFirstFileW
FindClose
FileTimeToLocalFileTime
FileTimeToDosDateTime
EnumCalendarInfoA
EnterCriticalSection
DeleteFileW
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringA
CompareStringW
CloseHandle
Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject
StrokePath
StrokeAndFillPath
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetMapMode
SetICMMode
SetEnhMetaFileBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RestoreDC
RemoveFontResourceW
RectVisible
RealizePalette
PolyBezierTo
PlayEnhMetaFile
PatBlt
MoveToEx
MaskBlt
LineTo
LPtoDP
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetTextMetricsW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetOutlineTextMetricsA
GetObjectW
GetKerningPairs
GetGlyphOutlineW
GetFontData
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetCharWidthW
GetCharWidth32W
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
FillPath
ExtTextOutW
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExA
EnumEnhMetaFile
EndPath
EndPage
EndDoc
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateScalableFontResourceW
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateEnhMetaFileW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineTransform
CloseFigure
CloseEnhMetaFile
BitBlt
BeginPath
AddFontResourceW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

IsEqualGUID
OleUninitialize
OleInitialize
CoTaskMemFree
CLSIDFromProgID
StringFromCLSID
CoCreateInstance
CoLockObjectExternal
CoDisconnectObject
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoInitialize
IsEqualGUID
CoCreateGuid

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
DeviceCapabilitiesA
DeviceCapabilitiesW
ClosePrinter

crypt32

CryptSignMessage
CertGetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
PFXImportCertStore
PFXIsPFXBlob

msvcrt

strlen
strncpy
_ftol
vsprintf
fprintf
printf
pow
ceil
floor
memcpy
memset
realloc
free
calloc
malloc

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 171B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 225KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
vpdf4exp.dll
.dll windows:4 windows x86 arch:x86

79aa023951e65acf3eb518f3bd6f804b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TlsFree
TlsGetValue
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
TlsAlloc
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
Sleep
LCMapStringA
LCMapStringW
CloseHandle
ReadFile
SetFilePointer
VirtualAlloc
IsBadWritePtr
HeapSize
FlushFileBuffers
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetOEMCP
SetStdHandle
CreateFileA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedExchange
TlsSetValue
GetCurrentThreadId
GetSystemTimeAsFileTime
RaiseException
GetTimeZoneInformation
DeleteFileA
HeapFree
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
GetVersion
GetCommandLineA
RtlUnwind
GetSystemTime
FatalAppExitA
LoadLibraryA
GetProcAddress
GetVersionExA
GetACP
GetFullPathNameA
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetLocalTime
GetLastError
EnterCriticalSection
LeaveCriticalSection
SetLastError
GetEnvironmentStringsW
GetModuleFileNameA

user32

IntersectRect
GetDC
ReleaseDC
FillRect
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MessageBoxA

gdi32

GetOutlineTextMetricsA
GetCharWidthA
GetRegionData
GetTextFaceA
GetTextMetricsA
GetFontData
CreateFontA
DeleteDC
CloseFigure
RestoreDC
SelectClipRgn
SaveDC
CreateRectRgn
DeleteObject
CreateSolidBrush
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
PolyBezierTo
BeginPath
SelectClipPath
IntersectClipRect
WidenPath
CreateDCA
CreateFontIndirectA
EndPath
ExtCreatePen
SetMiterLimit
SetPolyFillMode
StrokeAndFillPath
StrokePath
FillPath
MoveToEx
LineTo
GetClipBox
StretchDIBits
SetDIBitsToDevice
GetClipRgn
SetStretchBltMode
GetObjectType
CreateBitmap
GetDeviceCaps
BitBlt
GetDIBits
GetObjectA
CreateDIBitmap
ExtEscape
GetStockObject
EnumFontFamiliesExA
CreatePen

advapi32

RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA

Exports

Exports

FPDFAction_GetDest
FPDFAction_GetFilePath
FPDFAction_GetType
FPDFAction_GetURIPath
FPDFBitmap_Create
FPDFBitmap_CreateEx
FPDFBitmap_Destroy
FPDFBitmap_FillRect
FPDFBitmap_GetBuffer
FPDFBitmap_GetHeight
FPDFBitmap_GetWidth
FPDFBookmark_Find
FPDFBookmark_GetAction
FPDFBookmark_GetColorRef
FPDFBookmark_GetDest
FPDFBookmark_GetFirstChild
FPDFBookmark_GetFontStyle
FPDFBookmark_GetNextSibling
FPDFBookmark_GetTitle
FPDFDest_GetPageIndex
FPDFDest_GetZoomMode
FPDFDest_GetZoomParam
FPDFLink_GetAction
FPDFLink_GetDest
FPDFLink_GetLinkAtPoint
FPDFOBJ_CountElement
FPDFOBJ_GetCatalog
FPDFOBJ_GetElementByIndex
FPDFOBJ_GetElementByName
FPDFOBJ_GetFloat
FPDFOBJ_GetInfo
FPDFOBJ_GetInteger
FPDFOBJ_GetNameByIndex
FPDFOBJ_GetString
FPDFOBJ_GetType
FPDF_AddItemToMRUList
FPDF_AllocMemory
FPDF_ClearMRUList
FPDF_CloseDocument
FPDF_ClosePage
FPDF_DeviceToPage
FPDF_EnumPageSize
FPDF_FreeMemory
FPDF_GetDocPermissions
FPDF_GetLastError
FPDF_GetMetaText
FPDF_GetPageCount
FPDF_GetPageHeight
FPDF_GetPageSizeByIndex
FPDF_GetPageThumbnail
FPDF_GetPageWidth
FPDF_GetPasswordLevel
FPDF_LoadCustomDocument
FPDF_LoadDocument
FPDF_LoadMemDocument
FPDF_LoadPage
FPDF_OutputDecrypted
FPDF_PageToDevice
FPDF_QuickDrawPage
FPDF_RegisterSecurityFilter
FPDF_RenderPage
FPDF_RenderPageBitmap
FPDF_SetErrorHandler
FPDF_SetModulePath
FPDF_Snapshot
FPDF_UnlockDLL
_FPDFBitmap_GetStride@4
_FPDFBookmark_GetPageFirstLine@12

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 424KB - Virtual size: 421KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 116KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zlib4exp.dll
.dll windows:4 windows x86 arch:x86

e5c5650f0b0c0414d7e983aacdedc6c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crtdll

fwrite
fread
_errno
fclose
free
vsprintf
fflush
fseek
rewind
fputc
malloc
ftell
fprintf
_fdopen
fopen
sprintf
calloc
_initterm

kernel32

GlobalAlloc
GetVersion
GlobalFree

Exports

Exports

adler32
compress
compress2
crc32
deflate
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflateReset
deflateSetDictionary
get_crc_table
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzwrite
inflate
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
unzClose
unzCloseCurrentFile
unzGetCurrentFileInfo
unzGetGlobalComment
unzGetGlobalInfo
unzGetLocalExtrafield
unzGoToFirstFile
unzGoToNextFile
unzLocateFile
unzOpen
unzOpen2
unzOpenCurrentFile
unzOpenCurrentFile2
unzReadCurrentFile
unzStringFileNameCompare
unzeof
unztell
zError
zipClose
zipCloseFileInZip
zipCloseFileInZipRaw
zipOpen
zipOpenNewFileInZip
zipOpenNewFileInZip2
zipWriteInFileInZip
zlibVersion

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 692B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9Certificate

Extended Key Usages

Key Usages

af:8e:77:01:98:b5:75:46:43:52:dc:2f:1c:4d:de:68:00:ce:70:3aSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 9KB - Virtual size: 8KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

9b6b6a7858e17fb0b17e1c1428330343

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 697B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 320B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

848ffc1397e45b5d3ba1cbd9cf33b7eb

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

af:8e:77:01:98:b5:75:46:43:52:dc:2f:1c:4d:de:68:00:ce:70:3a
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 9KB - Virtual size: 8KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 697B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 320B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

28:c1:c0:05:18:32:20:d2:0c:05:4d:00:c4:d4:65:1f:25:68:58:7e
Signer

.text
Size: 336KB - Virtual size: 333KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 28KB - Virtual size: 25KB

.text
Size: 132KB - Virtual size: 131KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 8KB - Virtual size: 5KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

c6:a7:3d:9b:22:22:7c:46:aa:75:84:44:11:ad:16:c9
Certificate

2f:1f:41:61:a2:50:00:7f:fe:2a:ed:d9:c8:9a:fe:94:07:1d:9d:a8
Signer

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 8KB - Virtual size: 10KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 107KB - Virtual size: 106KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 16KB - Virtual size: 16KB

.reloc
Size: 4KB - Virtual size: 3KB