cafa9b5db9850142ae8446afc4404e8d

Sharing

Copy URL Twitter E-mail

General

Target

cafa9b5db9850142ae8446afc4404e8d
Size

1.3MB
MD5

cafa9b5db9850142ae8446afc4404e8d
SHA1

40ae517f6d3f1a0105ee0851c06eec7e301cef01
SHA256

cb9278b122616a0f604f84d9e20e99246acb6c3d0d5e17424e5b69fc800e2d97
SHA512

411dc1d1a7f58bff1d92e0ac5528319ddcca946911d8cf646d4d2127c4aceea22acab899e00bb187998d010c37a709e5db26a0ec352d38382201b3495022fc7f
SSDEEP

24576:pmJCEdqxwMbjs9iC+Hyc8KMNhZlHsLLhPSBCiZhCPWWX2m++YFs1ho:pyQxjuijycvo/HsLLleZEPb++91a

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
cafa9b5db9850142ae8446afc4404e8d
unpack001/$PLUGINSDIR/ProcDll.dll

Files

cafa9b5db9850142ae8446afc4404e8d
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 580KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ProcDll.dll
.dll windows:4 windows x86 arch:x86

18641a8b3acba3c4384c489b38850aa0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
CreateFileW
GetVersionExW
GetFileAttributesW
MoveFileExW
lstrlenW
InterlockedIncrement
DebugBreak
OutputDebugStringW
InterlockedDecrement
LoadLibraryW
DuplicateHandle
GetCurrentProcess
CreatePipe
GetStdHandle
CreateProcessW
ReadFile
IsBadWritePtr
IsBadReadPtr
GlobalFree
lstrcpyW
Process32FirstW
GetLongPathNameW
GetCurrentProcessId
WaitForSingleObject
TerminateProcess
Sleep
GetTickCount
SetLastError
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleW
QueryDosDeviceW
VirtualAlloc
VirtualFree
TerminateThread
Module32FirstW
Module32NextW
Process32NextW
LoadLibraryA
GetProcAddress
OpenProcess
lstrcmpiW
CloseHandle
FreeLibrary
lstrlenA
MultiByteToWideChar

user32

wvsprintfW
GetWindowLongW
LoadStringW
EnumWindows
CharNextW
GetWindowThreadProcessId
GetWindowTextW
SystemParametersInfoW
IsIconic
GetWindowPlacement
CreateWindowExW
UpdateWindow
LoadImageW
OffsetRect
ScreenToClient
MoveWindow
IsWindowVisible
ShowWindow
KillTimer
CharLowerW
FindWindowW
SetTimer
PostMessageW
DialogBoxParamW
SetWindowTextW
BringWindowToTop
EndDialog
GetParent
GetWindow
GetWindowRect
GetDesktopWindow
GetClientRect
MapWindowPoints
SetWindowPos
SendMessageW
GetDlgItem
EnumChildWindows
SetDlgItemTextW
GetClassNameW
IsWindow
GetSystemMetrics

gdi32

DeleteObject
GetObjectW

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysStringLen
SysFreeString
SysAllocString

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

shlwapi

PathFileExistsW

msvcrt

iswspace
wcscmp
_itow
_snwprintf
memmove
??3@YAXPAX@Z
wcsstr
wcsrchr
wcsncat
swscanf
_beginthread
__dllonexit
_onexit
wcsncpy
_wsplitpath
wcschr
strtoul
strlen
_wtoi
iswdigit
memcpy
time
_wcsnicmp
__CxxFrameHandler
_wcsicmp
memset
wcslen
??2@YAPAXI@Z

msvcp60

?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z

netapi32

Netbios

Exports

Exports

CheckDirLegal
CheckInstallType
CheckSSOUsing
CreateBitmapCtrl
DoLog
FreeTXSSOModuleExistResult
GetFileVersion
GetLegalDir
GetNetCardID
GetProgressTitleHWnd
IsFileExist
IsFolderEmpty
IsModuleExist
IsProcRunning
IsProcRunningByFileName
IsVistaSystem
KillAllProcUsingSSO
KillProcIDByCloseWnd
KillProcRunning
MsgBoxSetup
MsgBoxWaitQQMusicExist
OpenFirewall
ParseCmdLineFromQQ
RemoveFirewall
SetInstallProgress
SetProgressTitle
WaitForShellExecute
WaitKillProcIDRunning
WaitKillProcRunning
free_instfilespage_bitmap
kill_instfilespage_timer
load_instfilespage_bitmap
start_instfilespage_timer

Sections

.text
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_2_/Extract.dll
.dll windows:4 windows x86 arch:x86

102033a12b8cf17a451a9e9760020138

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

67:aa:51:35:62:bb:5c:b1:19:94:ea:25:f5:78:37:54:5f:40:c7:2e
Signer

Actual PE Digest

67:aa:51:35:62:bb:5c:b1:19:94:ea:25:f5:78:37:54:5f:40:c7:2e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\vcoutput\Release\7z\Extract.pdb

Imports

kernel32

GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
WaitForMultipleObjects
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
CloseHandle
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
SetCurrentDirectoryA
AreFileApisANSI
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
CreateDirectoryA
DeleteFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryW
GetSystemDirectoryW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
GetShortPathNameA
lstrlenA
GetFullPathNameA
GetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
SearchPathA
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
GetFullPathNameW
SearchPathW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindFirstChangeNotificationW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
GetFileInformationByHandle
ReadFile
WriteFile
SetEndOfFile
CreateFileA
CompareFileTime
GetSystemInfo
GlobalMemoryStatus
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
CompareStringW
CompareStringA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetLocaleInfoW
GetLocaleInfoA
LoadLibraryA
RtlUnwind
RaiseException
HeapAlloc
HeapFree
ExitThread
CreateThread
GetCommandLineA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
FatalAppExitA
HeapReAlloc
HeapDestroy
HeapCreate
ExitProcess
GetStdHandle
GetModuleFileNameA
Sleep
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetEnvironmentVariableA

user32

CharPrevA
CharToOemA
CharNextA
CharLowerW
CharUpperW
CharLowerA
CharUpperA
CharPrevExA

oleaut32

VariantCopy
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 274KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_2_/MiniQQDL.exe
.exe windows:4 windows x86 arch:x86

7e799db65b2f9bd20450d0ef8b0f3ede

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:17:35:d0:c4:f9:6f:f9:a9:07:b2:a9:5a:4a:70:50:fb:b5:cd:3b
Signer

Actual PE Digest

1d:17:35:d0:c4:f9:6f:f9:a9:07:b2:a9:5a:4a:70:50:fb:b5:cd:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\XF Code\DLPlugins_proj\trunk\GameDownloader\Src\bin\QQGameDown.pdb

Imports

comctl32

_TrackMouseEvent
InitCommonControlsEx

kernel32

CreateThread
ExitThread
GetLocalTime
FindFirstFileW
CreateEventW
ResetEvent
SetEvent
WaitForSingleObject
TerminateThread
OutputDebugStringW
IsBadReadPtr
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReadFile
SetEndOfFile
GetTimeZoneInformation
CreateFileA
SetFilePointer
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LoadLibraryA
InterlockedExchange
SetConsoleCtrlHandler
FatalAppExitA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStdHandle
WriteFile
HeapSize
Sleep
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
ExitProcess
GetModuleHandleA
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
RaiseException
GetModuleFileNameA
GetModuleHandleW
WideCharToMultiByte
lstrcatW
ExpandEnvironmentStringsW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
FreeResource
GlobalLock
GlobalUnlock
LoadLibraryW
GetProcAddress
FreeLibrary
MultiByteToWideChar
CreateDirectoryW
GetModuleFileNameW
GetFileAttributesW
GetVersionExW
GlobalAlloc
GlobalFree
GetCurrentThread
CloseHandle
GetCommandLineW
CreateMutexW
GetLastError
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcpynW
lstrlenW
GetCurrentThreadId

user32

IsIconic
ShowWindow
UpdateWindow
FindWindowA
DrawIcon
EnumThreadWindows
DialogBoxParamW
SendMessageTimeoutW
BringWindowToTop
LoadCursorW
SetForegroundWindow
FindWindowW
DispatchMessageW
TranslateMessage
GetMessageW
SetRect
LoadImageW
PostQuitMessage
GetWindowRect
GetClassNameW
DrawAnimatedRects
EnumChildWindows
MessageBoxW
PostMessageW
DestroyWindow
IsWindow
FlashWindow
SetWindowPos
CallWindowProcW
SetWindowTextW
RegisterWindowMessageW
SetFocus
CheckDlgButton
SetDlgItemInt
GetDlgItem
SendDlgItemMessageW
EndPaint
GetClientRect
BeginPaint
EnableWindow
IsDlgButtonChecked
GetDlgItemInt
SetTimer
KillTimer
LoadIconW
DestroyMenu
TrackPopupMenu
GetCursorPos
CreateDialogParamW
EndDialog
WindowFromPoint
IsZoomed
SetWindowRgn
GetActiveWindow
RedrawWindow
GetClassInfoExW
GetSystemMetrics
DrawIconEx
GetSystemMenu
GetMenuState
GetWindowTextW
SetCursor
FindWindowExW
IsWindowVisible
GetClassInfoW
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
SystemParametersInfoW
MapWindowPoints
DrawFocusRect
GetParent
ClientToScreen
DefWindowProcW
RegisterClassExW
SetWindowLongW
GetWindowLongW
IntersectRect
CreateWindowExW
InvalidateRect
GetWindowDC
GetCapture
SetCapture
ScreenToClient
ReleaseCapture
InflateRect
OffsetRect
DrawTextW
GetDC
ReleaseDC
PtInRect
LoadMenuW
GetSubMenu
SendMessageW

gdi32

CreateFontIndirectW
CombineRgn
CreateRoundRectRgn
CreateRectRgn
ExcludeClipRect
CreateDIBSection
GetClipBox
CreateCompatibleBitmap
StretchBlt
CreateCompatibleDC
BitBlt
DeleteDC
Rectangle
SetBkColor
ExtTextOutW
CreateRectRgnIndirect
SelectClipRgn
RoundRect
MoveToEx
CreatePen
LineTo
SelectObject
GetTextExtentPoint32W
GetStockObject
SetTextColor
SetBkMode
DeleteObject
CreateSolidBrush

advapi32

GetFileSecurityW
RegQueryValueExW
RegOpenKeyExW
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
ImpersonateSelf
OpenThreadToken
RevertToSelf
MapGenericMask
AccessCheck

shell32

SHGetSpecialFolderPathW
Shell_NotifyIconW
SHGetMalloc
SHBrowseForFolderW
ShellExecuteW
SHGetPathFromIDListW

ole32

CoInitializeEx
CLSIDFromProgID
CoCreateInstance
CoLoadLibrary
CoFreeLibrary
CoUninitialize
CoGetInterfaceAndReleaseStream
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream

oleaut32

SysAllocString
SysAllocStringByteLen
SysFreeString
SysStringLen

gdiplus

GdipLoadImageFromStreamICM
GdipDrawImageRectI
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipCloneImage
GdipCloneBrush
GdipCloneBitmapAreaI
GdipCreateFont
GdipDrawImageRectRectI
GdipDrawString
GdipCreateFromHDC
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteFont
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteBrush
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown

shlwapi

wnsprintfW

Sections

.text
Size: 324KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_2_/TNProxy.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5b6be223aae9558de13dd3a8d5d553f3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b9:30:e9:58:b6:b6:9e:50:34:77:30:46:b9:49:1a:ea:e0:66:aa:a2
Signer

Actual PE Digest

b9:30:e9:58:b6:b6:9e:50:34:77:30:46:b9:49:1a:ea:e0:66:aa:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LoadLibraryA
InterlockedIncrement
GetProcAddress
FreeLibrary
GetTickCount
CloseHandle
Sleep
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue

ws2_32

htonl
sendto
connect
htons
ntohs
ntohl
gethostbyname
WSAStartup
WSACleanup
select
closesocket
ioctlsocket
setsockopt
socket
bind
recvfrom
recv
send
getpeername
listen
accept
inet_ntoa
__WSAFDIsSet
WSAGetLastError
gethostname
inet_addr

msvcrt

memcmp
strcmp
??1type_info@@UAE@XZ
isdigit
memchr
fgetc
malloc
_adjust_fdiv
__dllonexit
_ftol
atoi
_CxxThrowException
strncpy
strstr
memmove
free
calloc
memset
rand
srand
_beginthreadex
memcpy
strlen
_initterm
_onexit
time
strcpy
_iob
fputc
sprintf
printf
_purecall
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z

msvcp60

??1_Winit@std@@QAE@XZ
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xran@std@@YAXXZ
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Xlen@std@@YAXXZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ

iphlpapi

GetAdaptersInfo
GetIfEntry

wininet

InternetGetConnectedState

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 300KB - Virtual size: 297KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_2_/Tencentdl.exe
.exe windows:4 windows x86 arch:x86

206d852282163bc725cf39cdad381ad6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b0:ff:e9:1f:41:66:51:a5:02:68:08:f9:f8:39:9e:36:4e:d6:56:e2
Signer

Actual PE Digest

b0:ff:e9:1f:41:66:51:a5:02:68:08:f9:f8:39:9e:36:4e:d6:56:e2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\XF Code\DLPlugins_proj\trunk\Tencentdl\Output\Release\Tencentdl.pdb

Imports

kernel32

HeapFree
GetProcessHeap
TlsGetValue
TlsSetValue
SetWaitableTimer
PostQueuedCompletionStatus
HeapAlloc
WaitForSingleObject
GetCurrentThreadId
QueueUserAPC
TerminateThread
WaitForMultipleObjects
GetQueuedCompletionStatus
CreateIoCompletionPort
SetLastError
InterlockedCompareExchange
FlushInstructionCache
GetCurrentProcess
GetSystemTimeAsFileTime
GetTickCount
SleepEx
CreateWaitableTimerA
DeleteFileA
OpenProcess
CreateToolhelp32Snapshot
CopyFileA
Sleep
CreateThread
GetCommandLineA
LoadLibraryA
GetVersionExA
DeviceIoControl
CreateFileA
RemoveDirectoryA
SetFileAttributesA
MoveFileA
GetFileSize
FlushFileBuffers
WriteFile
ReadFile
SetFilePointer
ResetEvent
WritePrivateProfileStringA
GetPrivateProfileIntA
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
ResumeThread
OpenEventA
FormatMessageA
LocalFree
GetThreadLocale
IsProcessorFeaturePresent
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CloseHandle
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapSize
VirtualFree
HeapCreate
HeapDestroy
GetDateFormatA
GetTimeFormatA
GetStartupInfoA
GetDriveTypeA
FileTimeToLocalFileTime
ExitThread
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
IsDebuggerPresent
FindFirstFileA
FindNextFileA
FindClose
GetFileAttributesA
TlsAlloc
InterlockedExchangeAdd
SetEvent
CreateEventA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GetModuleFileNameA
IsDBCSLeadByte
TlsFree
InterlockedExchange
lstrcmpiA
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
InterlockedIncrement
lstrlenA
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
ReadProcessMemory
GetThreadSelectorEntry
GetCurrentThread
VirtualQueryEx
VirtualQuery
SetUnhandledExceptionFilter
OutputDebugStringA
GetCurrentProcessId
SetEndOfFile
FileTimeToSystemTime
CreateFileW
AreFileApisANSI
SetFileTime
CreateDirectoryA
FindFirstFileW
GetLocaleInfoW
InterlockedDecrement
GetStdHandle
SetFileAttributesW
DeleteFileW
GetCurrentDirectoryA
CreateDirectoryW
GetFullPathNameA

user32

GetDlgItem
MonitorFromPoint
TrackPopupMenu
DestroyIcon
LoadStringA
GetWindowRect
FindWindowA
RedrawWindow
SetWindowLongA
GetWindowLongA
DrawTextA
LoadBitmapA
EndDialog
DestroyWindow
IsWindow
SendMessageA
SetWindowPos
CharNextA
CreateDialogParamA
PostThreadMessageA
CharUpperA
TranslateMessage
GetClientRect
GetMessageA
CreateWindowExA
PtInRect
SetRect
GetParent
CallWindowProcA
DefWindowProcA
SetWindowTextA
GetWindow
ShowWindow
EnableWindow
GetSystemMetrics
IsIconic
MoveWindow
BringWindowToTop
ClientToScreen
InvalidateRect
IsWindowVisible
ShowOwnedPopups
LoadIconA
SetForegroundWindow
GetLastActivePopup
DrawIconEx
LoadMenuA
DestroyMenu
PostMessageA
UnregisterClassA
DispatchMessageA
GetActiveWindow
DialogBoxParamA
GetIconInfo
SystemParametersInfoA
MapWindowPoints
GetSysColor
WindowFromPoint
GetCapture
ReleaseCapture
GetWindowTextA
LoadImageA
GetCursorPos
GetSubMenu
GetMonitorInfoA

gdi32

SetBkColor
ExtTextOutA
GetObjectA
CreateFontA
DeleteObject
CreateCompatibleBitmap
StretchBlt
BitBlt
SetTextColor
SetBkMode
SelectObject
RestoreDC
SaveDC
DeleteDC
CreateCompatibleDC
CreateSolidBrush

advapi32

RegQueryValueExA
IsTextUnicode
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegOpenKeyA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
SHGetFileInfoA
ShellExecuteA

ole32

CLSIDFromProgID
StringFromGUID2
CoRegisterClassObject
CoRevokeClassObject
CoCreateGuid
CoInitialize
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoLoadLibrary
CoFreeLibrary
CoCreateInstance
CoTaskMemAlloc
CoInitializeEx

oleaut32

SysStringLen
VarUI4FromStr
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantClear
SysAllocStringByteLen
SysFreeString
SysAllocString
UnRegisterTypeLi
RegisterTypeLi

shlwapi

wnsprintfA

comctl32

_TrackMouseEvent

ws2_32

sendto
htons
gethostbyname
inet_addr
select
__WSAFDIsSet
ntohs
inet_ntoa
accept
getpeername
WSAGetLastError
listen
connect
recv
send
htonl
ntohl
WSAStartup
WSACleanup
closesocket
ioctlsocket
setsockopt
recvfrom
socket
bind

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

netapi32

NetWkstaTransportEnum
Netbios
NetApiBufferFree

psapi

GetModuleFileNameExA

imagehlp

SymLoadModule
SymFunctionTableAccess
SymInitialize
SymSetOptions
StackWalk
SymGetModuleInfo

Sections

.text
Size: 612KB - Virtual size: 608KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 64KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_2_/config.ini
$_2_/dlcore.dll
.dll regsvr32 windows:4 windows x86 arch:x86

278664a63119b51335e94f5b5a17489b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4b:bf:78:b7:24:89:5b:2c:a7:c9:7e:d9:2a:4f:57:3f:fb:f0:00:09
Signer

Actual PE Digest

4b:bf:78:b7:24:89:5b:2c:a7:c9:7e:d9:2a:4f:57:3f:fb:f0:00:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\vcoutput\ReleaseStatic\xdownload\dlcore.pdb

Imports

ws2_32

ioctlsocket
closesocket
inet_ntoa
ntohl
htonl
gethostname
WSACleanup
WSAStartup
select
__WSAFDIsSet
accept
listen
getpeername
connect
WSAGetLastError
recv
send
inet_addr
gethostbyname
bind
ntohs
sendto
socket
recvfrom
setsockopt
getsockname
WSASetLastError
htons

kernel32

GetConsoleOutputCP
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
OutputDebugStringA
GetTickCount
CloseHandle
FindClose
FindFirstFileA
GetFileAttributesA
CreateEventA
SetEvent
ResetEvent
WaitForSingleObject
DeleteFileA
CopyFileA
WriteConsoleW
MultiByteToWideChar
InterlockedDecrement
lstrlenA
InterlockedIncrement
InterlockedExchangeAdd
ReleaseSemaphore
GetCurrentThreadId
CreateSemaphoreA
GetModuleFileNameA
WaitForMultipleObjects
MoveFileA
CreateFileA
InterlockedExchange
OpenMutexA
GetLastError
CreateMutexA
ReleaseMutex
WideCharToMultiByte
lstrlenW
RaiseException
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
DisableThreadLibraryCalls
SetThreadLocale
GetThreadLocale
GetLocaleInfoA
CreateFileW
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetFilePointerEx
TerminateThread
SetStdHandle
GetFullPathNameA
GetTimeZoneInformation
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapSize
GetCurrentDirectoryA
GetTempPathA
GetFileSize
FlushFileBuffers
GetVolumeInformationA
WriteFile
ReadFile
SetFilePointer
GetVersionExA
GetProcAddress
MapViewOfFileEx
CreateFileMappingA
UnmapViewOfFile
DeviceIoControl
LoadLibraryA
GetSystemDirectoryA
HeapFree
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
ExitThread
CreateThread
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapReAlloc
GetCommandLineA
GetProcessHeap
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeA
CreateDirectoryA
LCMapStringA
LCMapStringW
GetCPInfo
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError

user32

CharNextA
UnregisterClassA

advapi32

OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
IsTextUnicode
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegEnumValueA
RegCreateKeyA
RegOpenKeyA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

CoInitialize
CoLoadLibrary
CoFreeLibrary
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoCreateGuid

oleaut32

VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

netapi32

NetWkstaTransportEnum
Netbios
NetApiBufferFree

shell32

SHGetSpecialFolderPathA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
ReleaseCommLib

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_2_/image/button.png
.png
$_2_/image/close.png
.png
$_2_/image/loading.png
.png
$_2_/image/mainbnd.png
.png
$_2_/image/mainwnd.jpg
.jpg
$_2_/image/min.png
.png
$_2_/xzqdl.ico

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 580KB

.rsrc Size: 15KB - Virtual size: 15KB

18641a8b3acba3c4384c489b38850aa0

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

version

shlwapi

msvcrt

msvcp60

netapi32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 40KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 12B

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 3KB

102033a12b8cf17a451a9e9760020138

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

67:aa:51:35:62:bb:5c:b1:19:94:ea:25:f5:78:37:54:5f:40:c7:2eSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 274KB - Virtual size: 273KB

.rdata Size: 51KB - Virtual size: 51KB

.data Size: 10KB - Virtual size: 22KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 15KB - Virtual size: 15KB

7e799db65b2f9bd20450d0ef8b0f3ede

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 580KB

.rsrc
Size: 15KB - Virtual size: 15KB

.text
Size: 40KB - Virtual size: 40KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 12B

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

67:aa:51:35:62:bb:5c:b1:19:94:ea:25:f5:78:37:54:5f:40:c7:2e
Signer

.text
Size: 274KB - Virtual size: 273KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 10KB - Virtual size: 22KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 15KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

1d:17:35:d0:c4:f9:6f:f9:a9:07:b2:a9:5a:4a:70:50:fb:b5:cd:3b
Signer

.text
Size: 324KB - Virtual size: 322KB

.rdata
Size: 48KB - Virtual size: 45KB

.data
Size: 12KB - Virtual size: 17KB

.tls
Size: 4KB - Virtual size: 13B

.rsrc
Size: 4KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

b9:30:e9:58:b6:b6:9e:50:34:77:30:46:b9:49:1a:ea:e0:66:aa:a2
Signer

.text
Size: 300KB - Virtual size: 297KB

.rdata
Size: 32KB - Virtual size: 31KB

.data
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 16KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate