e601aa33691a16b2bc39b8808141a7f6_JaffaCakes118
- SHA256 00a1f3f97a7d6f9ade141fe21dc39c20cc2da58c15010a1cdb0d3a7831a577a2
Overview
overview
7Static
static
7亲宝儿�....6.exe
windows7-x64
3亲宝儿�....6.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...rk.dll
windows7-x64
1$PLUGINSDI...rk.dll
windows10-2004-x64
1Baidu-Toolbar.exe
windows7-x64
3Baidu-Toolbar.exe
windows10-2004-x64
3$PROGRAM_F...rX.dll
windows7-x64
7$PROGRAM_F...rX.dll
windows10-2004-x64
7$PROGRAM_F...er.exe
windows7-x64
1$PROGRAM_F...er.exe
windows10-2004-x64
1$PROGRAM_F...rc.dll
windows7-x64
1$PROGRAM_F...rc.dll
windows10-2004-x64
1MainRun.dll
windows7-x64
1MainRun.dll
windows10-2004-x64
1baohe.exe
windows7-x64
7baohe.exe
windows10-2004-x64
7bass.dll
windows7-x64
1bass.dll
windows10-2004-x64
1bassvideo.dll
windows7-x64
7bassvideo.dll
windows10-2004-x64
7basswma.dll
windows7-x64
1basswma.dll
windows10-2004-x64
1bhtray.exe
windows7-x64
7bhtray.exe
windows10-2004-x64
7offpage/loading.htm
windows7-x64
1offpage/loading.htm
windows10-2004-x64
1offpage/offline.htm
windows7-x64
1offpage/offline.htm
windows10-2004-x64
1Behavioral task
behavioral1
Sample
亲宝儿歌宝盒1.6.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
亲宝儿歌宝盒1.6.exe
Resource
win10v2004-20240319-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/processwork.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/processwork.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Baidu-Toolbar.exe
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Baidu-Toolbar.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
Resource
win7-20240220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
MainRun.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
MainRun.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
baohe.exe
Resource
win7-20240319-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral20
Sample
baohe.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral21
Sample
bass.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
bass.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
bassvideo.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
bassvideo.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
basswma.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral26
Sample
basswma.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral27
Sample
bhtray.exe
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral28
Sample
bhtray.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral29
Sample
offpage/loading.htm
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
offpage/loading.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
offpage/offline.htm
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral32
Sample
offpage/offline.htm
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target e601aa33691a16b2bc39b8808141a7f6_JaffaCakes118
- Size 3.4MB
- Sample240407-2fqb8sgf66
- SHA256 00a1f3f97a7d6f9ade141fe21dc39c20cc2da58c15010a1cdb0d3a7831a577a2
- MD5 e601aa33691a16b2bc39b8808141a7f6
- SHA1 d4d563a39463ec4d34698dbfc07a8b78465ef0c0
- SHA512 6ad70008c874cfbffbb5c1daae1eb5f4fa608f7c98f1d0bb17408d0aabaadb7fa482b08b8e834eb6fe9afc2b2fc0f546f87731c1767b5941bb798d8cbf2af351
- SSDEEP 98304:KBKx2BcdND/thmtTCQ6H5LN7MU4aSWuV3XGaB/UVDA:r2BcvD/TcTCLjIaPuVHGMUG
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/bassvideo.dll acprotect -
resource yara_rule static1/unpack002/baohe.exe upx static1/unpack002/bassvideo.dll upx static1/unpack002/bhtray.exe upx static1/unpack002/update.exe upx - Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/亲宝儿歌宝盒1.6.exe unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/$PLUGINSDIR/StartMenu.dll unpack002/$PLUGINSDIR/processwork.dll unpack002/baohe.exe unpack002/bass.dll unpack002/bassvideo.dll unpack005/out.upx unpack002/basswma.dll unpack002/bhtray.exe unpack002/uninst.exe unpack007/$PLUGINSDIR/processwork.dll unpack002/update.exe unpack008/out.upx - NSIS installer 5 IoCs
resource yara_rule static1/unpack001/亲宝儿歌宝盒1.6.exe nsis_installer_1 static1/unpack001/亲宝儿歌宝盒1.6.exe nsis_installer_2 static1/unpack002/Baidu-Toolbar.exe nsis_installer_1 static1/unpack002/uninst.exe nsis_installer_1 static1/unpack002/uninst.exe nsis_installer_2
File Explorer
-
e601aa33691a16b2bc39b8808141a7f6_JaffaCakes118.rar 3.4MB
-
亲宝儿歌宝盒1.6.exe.exe 3.5MB
-
$PLUGINSDIR/InstallOptions.dll.dll 14KB
-
$PLUGINSDIR/StartMenu.dll.dll 7KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp9KB
-
$PLUGINSDIR/modern-wizard.bmp51KB
-
$PLUGINSDIR/processwork.dll.dll 231KB
-
Baidu-Toolbar.exe.exe 867KB
-
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll.dll 2.3MB
-
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe.exe 229KB
-
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll.dll 369KB
-
MainRun.dll168B
-
baohe.exe.exe 926KB
-
bass.dll.dll 97KB
-
bassvideo.dll.dll 118KB
-
out.upx.dll 306KB
-
basswma.dll.dll 15KB
-
bhtray.exe.exe 525KB
-
offpage/images/loading.jpg.jpg 5KB
-
offpage/images/net.bmp395KB
-
offpage/images/net.jpg.jpg 10KB
-
offpage/images/wait.bmp395KB
-
offpage/loading.htm.html 577B
-
offpage/offline.htm.html 716B
-
skin/fwin.skn72KB
-
skin/main.skn157KB
-
skin/roster.skn10KB
-
skin/search.skn23KB
-
skin/window.skn100KB
-
uninst.exe.exe 229KB
-
$PLUGINSDIR/modern-header.bmp9KB
-
$PLUGINSDIR/processwork.dll.dll 231KB
-
update.exe.exe 510KB
-
out.upx.exe 1.2MB
-
新云软件.url.url 133B
-
软件介绍.txt690B
亲宝儿歌宝盒1.6.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 c15c39b54ae9d95eb5c44a41538169a98f8319ad1ea6c3c06428c84d5d4652e5
- MD5 05088a362f226037b63afc3c7fe5dbf5
- SHA1 19c28f2c6adc5391aefe3a8f9de480845dcbc618
- SHA512 c89b71dc5d8da3595fa1379eab40db47bd69ddf6e8efd9f40256133cae087916edd58558aea6898df341f810edd68a826eedd21accac33a614f217d1d475dd6b
- SSDEEP 98304:obmuoWe0TJQri3fM74iCKp2RdAxiyC8KypKX5ptX77cpnJwL:oZod0JQri3w43KkvNyHK3ptv6ni
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH b1cd0d78f652ce5fc63f0879371af012
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10696
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
dialog
initDialog
show
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=48, version=9044,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/StartMenu.dll
- IMPHASH a648aeaa164b592c1e8892a10400b5ae
- SHA256 7755ff2707ca19344d489a5acec02d9e310425fa6e100d2f13025761676b875b
- MD5 a4173b381625f9f12aadb4e1cdaefdb8
- SHA1 cf1680c2bc970d5675adbf5e89292a97e6724713
- SHA512 fcac79d42862da6bdd3ecad9d887a975cdff2301a8322f321be58f754a26b27077b452faa4751bbd09cd3371b4afce65255fbbb443e2c93dd2cba0ba652f4a82
- SSDEEP 96:2fiqP7bO2qHkAC40KhvSE+6nrxtMn0iGd88qRLqtJ1tbRhElfRx2:siqP7OHX1Q4xtcf8qo/ttgfRx2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6391
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleHandleA
lstrcatA
FindClose
FindNextFileA
MulDiv
GlobalFree
lstrcpynA
GlobalAlloc
lstrcmpiA
FindFirstFileA
lstrcpyA
user32
TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ole32
CoTaskMemFree
Init
Select
Show
Name
.text
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
518B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=11, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-header.bmp
- SHA256 4b7461502c18c189d100b158298fd037212af26db287235c0d369f98388c1ffd
- MD5 3ac35b8734d0ee1cb9127720e9329d35
- SHA1 5e391b7914ce3225b1e7141c7b856e83f237d5e2
- SHA512 57c33bfbd1d9abb460a818cf09dab79014579c78bc214c7fcd06b890d8d41537aa2b7275e8db5c3642579c65ba109f8d008e843016bc00fa4274c7baadfaea59
- SSDEEP 192:TK3Taw+vkhRK0ki+SRiwNFGae0OWSfIqonliMn1tvrUVIzXtatKWRo9vZsRfnQ4:TMOkhRK0kijIwN0ISfIqoli41tvrU2Dc
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 7650c9e7ca7448979ead93c0a199ddeda5dae98da47e1debf046185980e2280e
- MD5 c0ad5cd70b421d576efab047b94f3e40
- SHA1 adc59ebb8cf42a4df74a0fcf74a2129af64ab184
- SHA512 2aa1f493dd82d8571bc60a019f8810d54186e695c76151e66857e6944b81ca379d40f5662bc157005e87a7169dd5af2db2936d6bede182a5c85dc681c0cbdc91
- SSDEEP 384:wmR2wpNfTTtxVvvt2U3asOkrQslZ9gA82D+hoCVIcanudNMLZYN0MMd3oSESEafw:rw0e1VIcanFoSfJQxV
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/processwork.dll
- SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
- MD5 0a4fa7a9ba969a805eb0603c7cfe3378
- SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
- SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
- SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
208948
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
CloseProcess
ExistsProcess
KillProcess
QuitProcess
Name
CODE
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
147B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
47B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Baidu-Toolbar.exe
- IMPHASH 73b73e00f465fa1a2a3bf6377a40219b
- SHA256 4635f7e9e0ce743a67fc34c6d23d06058089ab4977f75fc62b53c3af8a294fb6
- MD5 5ededbd93a2a4d3ed4976ad4721dcdb8
- SHA1 974df1fcdb09cda94c7f36821b04cccd760ea197
- SHA512 210ab3b309e4a2654980af960339ea4d26605f72aa75469b85a738a3187acb65ffe08a67d09d58a3f7b6a14007c8d6812b4d14c6288a9acd8b36c7bf5becb80b
- SSDEEP 24576:UaAw2uRUIftBihuEfU+uy0dOy134bVggt:UagfhRobdOyRYht
- MD5 SHA1 SHA512 SSDEEP
-
NSIS installer
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Serial Number
04:00:00:00:00:01:20:19:c1:90:66
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2009 - Jan 28, 2028
Subject
CN=GlobalSign Time Stamping Authority,O=GlobalSign NV,C=BE
Serial Number
01:00:00:00:00:01:25:b0:b4:cc:01
Issuer
CN=GlobalSign Timestamping CA,OU=Timestamping CA,O=GlobalSign
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2009 - Dec 22, 2020
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN
Serial Number
65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2009 - Jul 30, 2012
Minor OS version
0
Major OS version
4
Entry point
13011
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
CloseHandle
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA
user32
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
FindWindowExA
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=157, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
- IMPHASH 8468b88eb97c7ed8e903637ad8f51134
- SHA256 57c89ab88f4b30236a0551d6c7c1e3d628e21f66eb90788cb677ab297b605e7f
- MD5 9470743da734caccf44aa5edfa48165f
- SHA1 fff739190ceaf760d14b492db6436d875f481aee
- SHA512 6dde0a56284aa369b99f77be0ac7d30e6226a9a42514e699f79a779b4d0140bf076a405abb5089a0621eebb528e641497c8cd3572aeb6cf53e43d35232854410
- SSDEEP 49152:djToLHk0n34IAx2a5SWOBHjUbbTn/DTcmbRnUWTdy3/+B:lTo7k0n34uCSWOp09co
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN
Serial Number
65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2009 - Jul 30, 2012
Minor OS version
0
Major OS version
4
Entry point
1078776
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\cygwin\home\scmpf\compiler_src\pupeng_231106_win32\app\gensoft\bar\toolbar\chinese_unicode_release\BaiduBarX.pdb
setupapi
SetupIterateCabinetW
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
imm32
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
shlwapi
PathFindFileNameW
SHDeleteKeyW
SHSetValueW
SHGetValueW
PathRemoveExtensionW
PathFileExistsW
SHDeleteValueW
UrlCombineW
StrCpyW
PathIsDirectoryA
PathRemoveFileSpecA
StrCmpIW
StrStrIW
UrlUnescapeA
UrlCanonicalizeW
StrRetToStrW
StrRetToStrA
UrlEscapeW
SHCopyKeyW
UrlUnescapeW
PathIsDirectoryW
PathRemoveFileSpecW
wininet
InternetQueryOptionW
InternetCrackUrlW
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
InternetOpenUrlW
InternetGetCookieW
HttpSendRequestExW
HttpEndRequestW
InternetGetConnectedState
InternetOpenA
InternetSetOptionA
InternetQueryDataAvailable
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetSetCookieW
DeleteUrlCacheEntryW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
InternetReadFile
InternetCloseHandle
GetUrlCacheEntryInfoW
InternetCanonicalizeUrlW
InternetConnectA
urlmon
URLDownloadToFileW
CoInternetGetSession
rpcrt4
UuidCreate
iphlpapi
GetNetworkParams
GetAdaptersInfo
ws2_32
gethostbyname
gethostname
kernel32
InterlockedDecrement
lstrlenW
lstrlenA
DebugBreak
OutputDebugStringW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
GetCurrentThreadId
InterlockedIncrement
CreateProcessW
WideCharToMultiByte
CreateDirectoryW
GetTempPathW
CreateFileW
CloseHandle
WriteFile
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
WaitForSingleObject
CreateMutexW
ReleaseMutex
DeleteFileW
ResumeThread
SetThreadPriority
SizeofResource
LockResource
LoadResource
FindResourceW
LocalFree
FreeLibrary
lstrcmpiW
TryEnterCriticalSection
LoadLibraryExW
MultiByteToWideChar
IsProcessorFeaturePresent
GetVersionExW
LoadLibraryA
CopyFileW
DeviceIoControl
GetSystemDirectoryW
GetPrivateProfileStringW
GetTickCount
GetACP
CompareStringW
GetCurrentProcessId
FindClose
FindNextFileW
FindFirstFileW
TerminateThread
GetExitCodeThread
OpenMutexW
GetFullPathNameW
GlobalFree
MulDiv
RemoveDirectoryW
Sleep
ReadFile
GetFileSize
Thread32Next
SuspendThread
OpenThread
Thread32First
CreateToolhelp32Snapshot
UnmapViewOfFile
SetUnhandledExceptionFilter
MapViewOfFile
CreateFileMappingW
TerminateProcess
OpenProcess
SwitchToThread
GetCommandLineW
GetCurrentProcess
GetPrivateProfileIntW
Process32NextW
Process32FirstW
WritePrivateProfileStringW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
SetFileAttributesW
lstrcmpW
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
GlobalSize
MoveFileExW
SetErrorMode
FreeResource
GetShortPathNameW
InterlockedExchange
ReadProcessMemory
SetFilePointer
lstrcatW
lstrcpyW
GetTempFileNameW
GetSystemTime
VirtualFree
VirtualAlloc
RtlUnwind
UnhandledExceptionFilter
IsDebuggerPresent
HeapReAlloc
GetSystemTimeAsFileTime
ExitThread
CreateThread
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
GetFileAttributesA
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
GetCurrentThread
GetStdHandle
GetModuleFileNameA
FatalAppExitA
HeapDestroy
HeapCreate
HeapSize
ExitProcess
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryA
SetCurrentDirectoryA
GetTimeZoneInformation
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetDriveTypeA
GetFullPathNameA
CompareStringA
FlushInstructionCache
InterlockedCompareExchange
ExpandEnvironmentStringsW
GetVersionExA
SetEnvironmentVariableA
DisableThreadLibraryCalls
user32
SetWindowRgn
GetMenuItemRect
RemovePropW
GetPropW
SetPropW
SetMenuItemInfoW
DrawStateW
TrackPopupMenuEx
ModifyMenuW
MessageBeep
FrameRect
GetMessagePos
GetSystemMetrics
LoadBitmapW
PeekMessageW
GetSubMenu
CharLowerBuffA
WaitForInputIdle
CreateIconFromResourceEx
CharNextA
EqualRect
SetActiveWindow
ScrollWindow
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CharUpperW
CreateMenu
InsertMenuW
TrackPopupMenu
MonitorFromPoint
RemoveMenu
AppendMenuW
CreatePopupMenu
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
ReleaseCapture
GetSysColor
SetCursor
GetDlgCtrlID
SetFocus
SetCapture
IsWindowEnabled
UpdateWindow
DrawFocusRect
SetRectEmpty
OffsetRect
EnableWindow
RedrawWindow
GetWindowTextLengthW
DrawTextW
DestroyIcon
GetClassLongW
SetClassLongW
MonitorFromRect
GetMonitorInfoW
CopyRect
GetScrollInfo
WindowFromPoint
IsChild
FindWindowW
CharLowerBuffW
ScreenToClient
AdjustWindowRectEx
GetCursorPos
GetWindowThreadProcessId
GetGUIThreadInfo
GetClassNameW
PtInRect
MessageBoxW
MoveWindow
FillRect
GetFocus
ReleaseDC
TranslateMessage
DispatchMessageW
InvalidateRect
GetWindowTextW
SetRect
GetActiveWindow
LoadIconW
IsWindowVisible
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SendMessageW
DialogBoxParamW
DestroyMenu
IsMenu
GetKeyState
CharLowerW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
LoadCursorW
SetScrollInfo
SetScrollPos
GetSysColorBrush
InsertMenuItemW
GetMenuItemInfoW
GetMenuItemCount
EnableMenuItem
DeleteMenu
UpdateLayeredWindow
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CharUpperBuffW
UnregisterClassA
DrawIconEx
GetMessageW
IsIconic
PostThreadMessageW
FindWindowExW
EnumChildWindows
SendMessageA
GetUpdateRect
ClientToScreen
GetTopWindow
MenuItemFromPoint
GetMenuItemID
RegisterWindowMessageW
IsRectEmpty
GetDlgItemTextW
AdjustWindowRect
GetWindowDC
KillTimer
SetTimer
PostMessageW
CharNextW
EndPaint
BeginPaint
DefWindowProcW
LoadStringW
SetWindowPos
IsWindow
GetDlgItem
ShowWindow
GetDC
SetWindowTextW
GetWindowLongW
SetWindowLongW
CallWindowProcW
EndDialog
CreateDialogParamW
SetDlgItemTextW
EnumWindows
IsDialogMessageW
InflateRect
LoadImageW
GetCapture
gdi32
PatBlt
GetTextColor
Rectangle
CreateRoundRectRgn
FillRgn
CreateRectRgn
CreateFontW
CreateBitmap
ExcludeClipRect
GetDeviceCaps
DPtoLP
GetObjectW
CreatePen
LineTo
MoveToEx
SelectObject
CreateCompatibleBitmap
SetViewportOrgEx
ExtTextOutW
RestoreDC
SaveDC
GetCurrentObject
CreateSolidBrush
CreateFontIndirectW
GetTextExtentPoint32W
TextOutW
GetPixel
SetTextColor
ExtCreateRegion
CombineRgn
SetStretchBltMode
StretchBlt
BitBlt
CreateCompatibleDC
GetClipBox
GetDIBits
DeleteObject
GetStockObject
CreateDIBSection
SetBkColor
SetBkMode
DeleteDC
advapi32
RegQueryValueExW
GetSecurityDescriptorSacl
SetSecurityInfo
EqualSid
GetUserNameW
RegSetKeySecurity
RegEnumKeyW
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetTokenInformation
CopySid
RegCreateKeyW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
CreateProcessAsUserW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx
OpenProcessToken
RegOpenKeyW
shell32
ShellExecuteW
DuplicateIcon
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteExW
ExtractIconW
SHGetMalloc
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFolderPathW
DragQueryFileA
ole32
OleInitialize
OleUninitialize
GetHGlobalFromStream
CreateStreamOnHGlobal
OleDraw
RegisterDragDrop
CLSIDFromProgID
RevokeDragDrop
CoCreateGuid
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
ReleaseStgMedium
oleaut32
VariantInit
VariantClear
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarBstrCmp
VariantCopy
LoadTypeLi
SysFreeString
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
CreateErrorInfo
VarBstrCat
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
UnRegisterTypeLi
SysStringLen
SetErrorInfo
VariantChangeType
GetErrorInfo
msimg32
AlphaBlend
ClearDefSearch
ClearHomePage
CloseIEUpdate
DllCanUnloadNow
DllCreateObject
DllGetClassObject
DllRegisterServer
RunOnceRemove
RunOnceUpdate
SVCUninstall
SetDefSearch
SetHomePageToBaidu
Uninstall
UpdateBaiduToolbar
UpdateBaiduToolbarWithUI
Name
.text
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
286KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Shared
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
638KB
Virtual Size
638KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
86KB
Virtual Size
85KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=125, productName=VS2005 build 50727, version=50727,
count=190, id=109, productName=VS2005 build 50727, version=50727,
count=13, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=35, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=537, id=1, productName=Unmarked objects,
count=264, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
- IMPHASH 5b79acdd9738a352787f0a927feb114d
- SHA256 c11a6312a09752284fa22fa5986dcbb3befa286fced62c76fcd1afac9d6568b9
- MD5 b5fead037a0116dd5269d146e97a0f89
- SHA1 e6b6c2b753dd236674a728fa40e189923eaba2bf
- SHA512 9186fd2f7faab36dc3dd1fce3a7fc3911a72ed5822cb120944e5d20a4aeed700942e5365a4fd44aeaf7a075d11f89e9f304925b0be313947543e9f9459171457
- SSDEEP 3072:GrOYrp3K7YIRMNaPvN1FtZb5SZiSPyuQrTBfVKWYCtvtocHfJz9WAe:wA3BXdPb5Si/uQrTBdbBt+cVe
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN
Serial Number
65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2009 - Jul 30, 2012
Minor OS version
0
Major OS version
4
Entry point
69209
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
psapi
GetModuleFileNameExW
dbghelp
SymGetOptions
SymSetOptions
StackWalk
SymGetModuleInfo
SymFunctionTableAccess
SymInitialize
SymLoadModule
wininet
InternetCrackUrlW
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
kernel32
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
LocalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
WaitForSingleObject
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
InterlockedDecrement
lstrcmpiW
SetEvent
CreateThread
CreateEventW
GetModuleFileNameW
InterlockedIncrement
lstrlenA
DebugBreak
OutputDebugStringW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
Sleep
GetCurrentThreadId
GetCommandLineW
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetModuleFileNameA
VirtualQueryEx
UnmapViewOfFile
FlushInstructionCache
GetCurrentProcess
MapViewOfFile
CreateFileMappingW
OpenThread
CreateFileW
DeleteFileW
GetTempPathW
ReadFile
GetFileSize
InterlockedExchange
WriteFile
GlobalFree
GlobalAlloc
GetCurrentProcessId
GetVersionExW
SetFilePointer
GetShortPathNameW
FindClose
FindFirstFileW
ExitProcess
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStartupInfoW
GetFileAttributesA
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
HeapDestroy
GetTimeZoneInformation
CreateFileA
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapCreate
SetLastError
GetConsoleCP
GetConsoleMode
GetFullPathNameW
GetCurrentDirectoryA
user32
CharLowerBuffW
LoadImageW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SendMessageW
GetDlgItem
ShowWindow
GetWindowLongW
GetActiveWindow
DestroyWindow
EndDialog
DialogBoxParamW
LoadStringW
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
PostThreadMessageW
GetSystemMetrics
UnregisterClassA
advapi32
RegOpenKeyW
RegQueryValueExW
RegCreateKeyW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
SHGetFolderPathW
ShellExecuteExW
ole32
CoInitialize
CoUninitialize
StringFromGUID2
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
oleaut32
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
shlwapi
PathFileExistsW
StrCmpNIW
Name
.text
Size
140KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
24KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=22, id=125, productName=VS2005 build 50727, version=50727,
count=174, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=29, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=267, id=1, productName=Unmarked objects,
count=87, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
$PROGRAM_FILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
- IMPHASH d811d71710ad58776155b7a8da1fa9db
- SHA256 5bc5a1926d22dd745043f9aba8d27415f026cf65cdf03fd283585388e9da3544
- MD5 ab6fe64e02885d93adb991abfe5c608f
- SHA1 7b41f74ae34eba7b2f8e57ab9e703550cd0cb069
- SHA512 96882ae32b16caf17e1c72648ba0dd7083b24257872ef9752800ee92ddbfe61a17c4422a94382214f2acd49f96dd34d0971eea3b0e7fc6be8e12c788423bdfdc
- SSDEEP 3072:OekGhjtQJY+WWOWfJe7Tqu4Xg4bZdOpFRcwJIpJ4f26LTTSIxt0j27dcliVs1UGM:HyC65g4bZdOpFNJ8R27dVGbdaX
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US
Serial Number
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jun 15, 2007 - Jun 14, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Serial Number
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
May 21, 2009 - May 20, 2019
Subject
CN=Baidu Online Network Technology (Beijing) Co.\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Baidu Online Network Technology (Beijing) Co.\, Ltd.,L=Beijing,ST=Beijing,C=CN
Serial Number
65:16:5e:50:24:9f:f6:ad:03:9d:77:06:ec:59:bf:8d
Issuer
CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 31, 2009 - Jul 30, 2012
Minor OS version
0
Major OS version
4
Entry point
4823
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
Name
.text
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
316KB
Virtual Size
314KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=125, productName=VS2005 build 50727, version=50727,
count=71, id=109, productName=VS2005 build 50727, version=50727,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=75, id=1, productName=Unmarked objects,
count=27, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
MainRun.dll
- SHA256 161b58c9553669dce9aee8fc2946f65d84988321a193356dacc9af47e9a89f91
- MD5 2a9d906957945ca6d6ac83384ab59b08
- SHA1 38eb401389cb5f62685eece8c8868266f047d356
- SHA512 cee385a29ddfa9aa6b17059347da4008ad2afe09525ec974ff64b13898456323ebb7d10227ae613173c62c128efd1b6fe291119d6b9b2d93f978470124e16426
- MD5 SHA1 SHA512
baohe.exe
- SHA256 5504f23a968806db3b6e8ef7b373d945601f9cc5a2818735ff29583703d9b8e8
- MD5 3ca452f1439afc3159c76550565486c0
- SHA1 3ff60671c8ff53089622858ee4db2aa20df3d6aa
- SHA512 c824af41301dc04566d46b6cedac418f575b3bd9d235193c51d501f9a9c7e9975087c67934f3509f0f84dd22ee8d137ca9d2b909f1e8b32f9d4e38abebc44698
- SSDEEP 24576:kzbaDXmkFPQZVhisrIM3qsj9i/oH1oYTEAU4ACGz:kzb6XV5aPiXgqsxiJQACG
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
3085744
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
812KB
Virtual Size
816KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
113KB
Virtual Size
116KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
bass.dll
- SHA256 6dd21a9b9cc87d3a1998784d7c3baa72ceba80ed5fffb34b3f0ad6dfaa9f2074
- MD5 79c65ba9c060e48621a3167cd878b526
- SHA1 a6bfcf65e2de3b01eaa60813e27d88ab435fce6c
- SHA512 07e1ca87e2df850fc06fcdc285c55245e861949906818efbde5b6f3b06861d38a70635d2816408fa94c71471afb6f70ae18e5014b7177dd74906a3668d7da3ed
- SSDEEP 3072:eLea/MDISRA/ESY1zSSCTmrsOma7sq6LUYzMTTmwwVc:y1/k9u/gMXOJn6pzMTTec
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
401462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASS_Apply3D
BASS_ChannelBytes2Seconds
BASS_ChannelFlags
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttribute
BASS_ChannelGetData
BASS_ChannelGetDevice
BASS_ChannelGetInfo
BASS_ChannelGetLength
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelGetTags
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelLock
BASS_ChannelPause
BASS_ChannelPlay
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttribute
BASS_ChannelSetDSP
BASS_ChannelSetDevice
BASS_ChannelSetFX
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttribute
BASS_ChannelStop
BASS_ChannelUpdate
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXReset
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetConfig
BASS_GetConfigPtr
BASS_GetDSoundObject
BASS_GetDevice
BASS_GetDeviceInfo
BASS_GetEAXParameters
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicLoad
BASS_Pause
BASS_PluginFree
BASS_PluginGetInfo
BASS_PluginLoad
BASS_RecordFree
BASS_RecordGetDevice
BASS_RecordGetDeviceInfo
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetDevice
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleFree
BASS_SampleGetChannel
BASS_SampleGetChannels
BASS_SampleGetData
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SampleSetData
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetConfig
BASS_SetConfigPtr
BASS_SetDevice
BASS_SetEAXParameters
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateFileUser
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_StreamPutData
BASS_StreamPutFileData
BASS_Update
_
Name
Size
92KB
Virtual Size
376KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
568B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
bassvideo.dll
- SHA256 b33784449e59e8f1162ab41ea05f9cd0673b858fe400be9fe838ec86bdd03bde
- MD5 0bc4f43116b2d7cbfd81b21a8d3479d5
- SHA1 3d82de4244e78c773b6f128ef51a22ef9915d53b
- SHA512 45db896ff43fa14b0cc2b0d1468a615196c5354b64d77319a231797fc65ec6a630464f26440abd5f7a820cab4e58353f273b0deb0fa7b37478fc711a5911bec2
- SSDEEP 3072:X55XUH8N5XZRxxf0UE5u+7XrBFYM/TEgTi:XvXxJRx1fE5u+77YM/TtT
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
408240
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
BassVideo_AddFile
BassVideo_AddText
BassVideo_AddText2
BassVideo_AddToRoot
BassVideo_AddVideo
BassVideo_AddVideo2
BassVideo_CaptureBitmap
BassVideo_Capture_ConfigDevice
BassVideo_Capture_ConfigDevicePin
BassVideo_Capture_EnumDevice
BassVideo_Capture_Start
BassVideo_Capture_StreamCreate
BassVideo_CloseWindow
BassVideo_ConfigEncoderFilter
BassVideo_ConfigFilter
BassVideo_CreateEncoder
BassVideo_CustomStreamCreateFile
BassVideo_CustomStreamCreateURL
BassVideo_DVD_EnableCaptions
BassVideo_DVD_EnableSubtitle
BassVideo_DVD_GetAudioLanguage
BassVideo_DVD_GetAudioLanguageCount
BassVideo_DVD_GetChapterCount
BassVideo_DVD_GetSubtitleCount
BassVideo_DVD_GetSubtitleName
BassVideo_DVD_GetTitleCount
BassVideo_DVD_MouseClick
BassVideo_DVD_MouseMove
BassVideo_DVD_Play
BassVideo_DVD_PlayChapterAndStop
BassVideo_DVD_PlayNextChapter
BassVideo_DVD_PlayPrevChapter
BassVideo_DVD_PlayTitleInTime
BassVideo_DVD_RePlayChapter
BassVideo_DVD_RestoreBookMarks
BassVideo_DVD_SaveBookMarks
BassVideo_DVD_SelectParentalLevel
BassVideo_DVD_SetAudioLanguage
BassVideo_DVD_SetPlayRate
BassVideo_DVD_SetSubtitle
BassVideo_DVD_ShowMenu
BassVideo_DVD_ShowTitle
BassVideo_DVD_StreamCreate
BassVideo_EncoderAudio
BassVideo_EncoderVideo
BassVideo_Encoder_Create
BassVideo_Encoder_GetWMSetting
BassVideo_Encoder_GetWMSettingCount
BassVideo_Encoder_SetWMSetting
BassVideo_EnumEncoder
BassVideo_EnumFilter
BassVideo_ErrorGetCode
BassVideo_EventToString
BassVideo_FrameStep
BassVideo_Free
BassVideo_GetColorRange
BassVideo_GetConfig
BassVideo_GetCurrentBuffering
BassVideo_GetEvent
BassVideo_GetFilterByName
BassVideo_GetFrameInfo
BassVideo_GetGraph
BassVideo_GetInfo
BassVideo_GetLength
BassVideo_GetPitchEnable
BassVideo_GetPitchValue
BassVideo_GetPosition
BassVideo_GetTempoEnable
BassVideo_GetTempoValue
BassVideo_GetVersion
BassVideo_GetVideoInfo
BassVideo_GetVideoWindow
BassVideo_HasFilterPropertyPage
BassVideo_Init
BassVideo_Pause
BassVideo_Play
BassVideo_ReAddVideo
BassVideo_ReAddVideo2
BassVideo_RemoveText
BassVideo_Repaint
BassVideo_SaveGraphFile
BassVideo_SetChannel
BassVideo_SetColor
BassVideo_SetConfig
BassVideo_SetDelayValue
BassVideo_SetEndPosition
BassVideo_SetEventNotify
BassVideo_SetPitchEnable
BassVideo_SetPitchValue
BassVideo_SetPosition
BassVideo_SetRatio
BassVideo_SetTempoEnable
BassVideo_SetTempoValue
BassVideo_SetVideoWindow
BassVideo_SetVolume
BassVideo_Set_Draw_CallBack
BassVideo_ShowFilterPropertyPage
BassVideo_Stop
BassVideo_StreamCreateFile
BassVideo_StreamCreateFileMem
BassVideo_StreamCreateFileUser
BassVideo_StreamCreateURL
BassVideo_StreamFree
BassVideo_WindowMove
BassVideo_WindowResize
Name
UPX0
Size
Virtual Size
284KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
111KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 72cd0978ba9d3bb55a3495c28c2e56f3bc7e3fc810ada0365b30029257553fa0
- MD5 0d178de947f2cefe8180e55239057f6d
- SHA1 d2ada020b5c718d58dd9db0f6f2a638400ba8e67
- SHA512 b5f3965ba679ab7563f491f40e71110d29bde261d0278f0acfacf40866fbbf11e957156b8057b815626b49e1db1b7df15b9f5bf563d8a9fad1f0635d81eb287a
- SSDEEP 6144:794nmon1z7WJymCW2UXxZdedtUaC6t53DFUQOeBSSaGoG4Oe9jobpHRo:anJn17WJQwxZdedtUaC6t53sBGZ4Oe9t
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
280604
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
59KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
916B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
basswma.dll
- SHA256 7b0585e26c04a0dca7c6a18b96b7a681d16ff33833e20a1320db97975326b6d7
- MD5 b2ca7d7c9361c4236afb00e19b6fe4e1
- SHA1 46935d9a2512df365cd8410672aa9c263413969a
- SHA512 5a4e3bf1f7659618d4285e723ec3a59c2ffc5c350fddb515e6d19c4cf35e4b93ca803e78b8beebbcb2b71b48803899045f28c9f20d55ee325051e747d027f6b4
- SSDEEP 384:+CicdYzuHz8w/mSJ2aIflWLb6kV8M2VuUb881O2y2l:rdEuHT/TaWLb6+b2V7zt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
36918
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
BASS_WMA_EncodeClose
BASS_WMA_EncodeGetClients
BASS_WMA_EncodeGetPort
BASS_WMA_EncodeGetRates
BASS_WMA_EncodeOpen
BASS_WMA_EncodeOpenFile
BASS_WMA_EncodeOpenNetwork
BASS_WMA_EncodeOpenNetworkMulti
BASS_WMA_EncodeOpenPublish
BASS_WMA_EncodeOpenPublishMulti
BASS_WMA_EncodeSetNotify
BASS_WMA_EncodeSetTag
BASS_WMA_EncodeWrite
BASS_WMA_GetWMObject
BASS_WMA_StreamCreateFile
BASS_WMA_StreamCreateFileAuth
BASS_WMA_StreamCreateFileUser
BASSplugin
Name
Size
12KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
576B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
bhtray.exe
- SHA256 0056a1e52275aa986bf6a72516090da28abe357fce9fc0715552b1812042ed29
- MD5 dd3c88b90b9b3c4b58c2670543b117fd
- SHA1 7268464cf491aec5c610e6ff8f4ff8ef28e805f8
- SHA512 a3587822112d4316a62ec600c7bdbabe198220604c5d8f3b904d196e7a8995182f2327410556661cc0c13fb11d8d5030aeabf527d7590989261e1203eb725a47
- SSDEEP 12288:Z/P8XT2uebWscZTM5YZH9l6Xfvyn/2mlX//No0VoS9Rd:ZH8XTNscxM5YV9l5Nlv/5VRd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1533072
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
420KB
Virtual Size
424KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
offpage/images/loading.jpg
- SHA256 7fa8ed90c3ca0d124af09c7f0d06b5c8b9edc20253f0c6846520820bdceac320
- MD5 d64393cbb8faa276a2fa746a079109d8
- SHA1 454ebf0a2cf2de8a81b23174bc57a23db2b92a9f
- SHA512 f9868133e3ffeed4e36cff37f82526e5f335e052a4c4173931e92a795a446523f82450ac316a564a7ac4f6f2abac849ef1ea329a0c343c2fe4aade2a1b777759
- SSDEEP 96:km6EEi864jQtz/wgJKoz0JvMIU/kkiw3pRP4sbCsw0MPpGNT3dHlUPRVyPxoTB:p/EnQhwyWJ0IYkkiaRP4stwhEzdFYVyE
- MD5 SHA1 SHA512 SSDEEP
offpage/images/net.bmp
- SHA256 717b773f75792ed929ef946150ccbe1cab909c093b290bdc26b2a9012c043095
- MD5 1e19f9ad0695108ba4d916ad8faeff22
- SHA1 b44c97960aca5ef30924a0caf9767d5c9830ce97
- SHA512 440daaa7f044d493d4ddb2965d2d9eebc3c3ee6fd8283efb71e44894a09fd29e362e3f0c49f0a3094a1dcf4518d171d3fb6333470977308bb9ce52c1249a48c7
- SSDEEP 1536:DrlFKTtF5KcV4gd7CDMg1pTL5BlaOmE+L0JHWnryonIE5M1irrGES+W8MEtbzrqU:0q5PO883oL1LMOZmDGJwy9WXbsW
- MD5 SHA1 SHA512 SSDEEP
offpage/images/net.jpg
- SHA256 f3736295a0b582dbc6bf42489d78eab8cbf0673b27eb7cfd4556398f01b3aca8
- MD5 9b933a08df1f9a21fdda38b038d263a9
- SHA1 b0067736d1cbd3173c67dbf582f6ee6ac651bfaf
- SHA512 ac97883c1e028cb270ee9b78424d3830505d5582fe169e4e835ec777511cc5357717190bdd19ae3ae4690095fe59c7320febf2fc686116ca46e537008c59796c
- SSDEEP 192:BtP2r0GPLXBeMCoGjV0ZUbO4LahLL+4ucfdrjz4pcEpdAkGyUyY7vhH3:Bt44b9TCdrjcpccdAZNyCX
- MD5 SHA1 SHA512 SSDEEP
offpage/images/wait.bmp
- SHA256 84ab8b8449dd75a5d88ce2a9c7826ae4db586f6905c6502d055d8d9fc6399fac
- MD5 e15bd4a2407e022f7cce4a4a9fe078f1
- SHA1 7214779b4e1db34e2ac07908afb81168b3e4d5e0
- SHA512 87ef8d54bcc0d0f781015fdb89461d9a050df2f0a37735d7dff544ec100894350152c36126607b84659daf7e74388829dd9b1e406b3669388cfd1c011101ca6f
- SSDEEP 1536:DrlFKTtF5KcV4gd7CDMg1pTL5BlaOmE+L0JHWnryonIE5M1irrGES+W8MEtbzrqU:0q5PO6xD7KBr9Tywy9WXbsW
- MD5 SHA1 SHA512 SSDEEP
offpage/loading.htm
- SHA256 1c12275a9033137dff7fdbd7fce63aac2717d7af524f01dbf70ce3cd2fe82365
- MD5 005e4ad4f217b00363629521f4d5b5b3
- SHA1 aa33b302f7dbe8da07940dd6d746f7221b466ee4
- SHA512 c018c7ffa6a381ee70d228ccfe3048f4a1c20ad62532b547c46ce92a82c8aa284a5dee4d25d9b585502933ae3e731294b1f94db36ff72e880b325a16e55c5a8b
- MD5 SHA1 SHA512
offpage/offline.htm
- SHA256 c92b5dda70824d4c8ce027a5fa474082413e0c95056da94c2d1a754e245d56fe
- MD5 6c7e7fecb99da984084ed41eb6ce9344
- SHA1 3c3d97c58bd523e516093ca40473ce017d7e1bc7
- SHA512 145c02d04af67fd06ec7985ca82f406d5d944d22af823aa7afd4c13bd94346b9956d855babef0ba09ed70c9504be330916d7a2a034b8d4c8c9bb7b9bad54f650
- MD5 SHA1 SHA512
skin/fwin.skn
- SHA256 c70cf78ee3238a051c58c056a48648c86c8ed090131b45881efce23091b140ed
- MD5 cbabc041b7c5a59969aae4a6fc34af75
- SHA1 52015a236f4085df61a1fb1dd37d98b43429f87d
- SHA512 38f31bef0d0ed439329c80aed792989e5a95ffbc15e756f73cda008133faebadfffba0e01e97457ac3c8e94d001dd3a070d6ef7a39ea83c9e9a0e4e09f6d7219
- SSDEEP 1536:jAfhi6BgLkobwIjd09q+5GMNFLeHSF0nm2jUGee/QDqiUdEXzi:8Ji620g+EaN1FGee/QeP0zi
- MD5 SHA1 SHA512 SSDEEP
skin/main.skn
- SHA256 5437773b2822629f500e862948769512d4b7aa017b3dd45b0c833b95f1c428ca
- MD5 2810f33296bc2f5ad02ea698e41f7b39
- SHA1 586332339368e21481426b64da68fd90452daa82
- SHA512 e20d960a7196ef9121d0a7d79e45acd3d6c1f764beafff4c43eff59e2022d17743166477e122a9dba3e7d5abc8f7993cc608c47f4a1497b1697a28c05a611983
- SSDEEP 3072:/D3ONt51IrO6pd7jpmEuA5mgpCgCl15noGkPu+lnU16aymq8:TOH51QOa7jpcSmgIgC5nzkP/ln46a/
- MD5 SHA1 SHA512 SSDEEP
skin/roster.skn
- SHA256 8b583785cad71921e868fc6e9b5b59933d5ef2830b2745ea806c838aeb0d3303
- MD5 b090c2346dd8a4abcf61fec37100a8c1
- SHA1 83f624e8bc805749420279480e4e957f8f0348f1
- SHA512 f08a0a7ec69a99dda45994443b6822d97289adbb27a3ed61c6601f4a8c35993b5d38a0e0c246ccc77a86b2ad9be74eca3487e5b17597400d14756bf0e638b8c1
- SSDEEP 192:tsSuvF/+18lHE82qVdVhffcsNNLYhkefG6VRmAmgundAG:tsSuvFo8G78jh8s3MGefJSHn+G
- MD5 SHA1 SHA512 SSDEEP
skin/search.skn
- SHA256 5989ac22e160ca3db6e4a9e46f6c7bc5084f8109d4290b4a24e97bfb15148b38
- MD5 8aa1486d89a0275dd1d048ad130dd57a
- SHA1 76c01e1ee49f1b70a49ea485d1613f62c33c8840
- SHA512 37c55f21282135361c60045d8f6591b0e619be738944f3cc9aca7439cda272b7c1a751a98b34d22a78c73a3c9740a7ed0ba5eb022b6afaa177b6e22dd114ab00
- SSDEEP 384:/8NtAz8nA1pt+xGQfdVQPXvwD2o0txonQzfKq0xQainIKizjA4Z:0znAfIxGQjQPoyo0t5zfKF9/LHAU
- MD5 SHA1 SHA512 SSDEEP
skin/window.skn
- SHA256 a41a882fade9067d5cafe197e09039cb01390653d2f38a3c8526841f9996e34b
- MD5 60592496c2353be1d5faeb4d2a1078d2
- SHA1 129de8a2540428b1cf4abee2910530a0424ab55b
- SHA512 aadb4be6d7583c1395a261db180364ef86c640bf0bf529782a3c9c0dbb8dcda8bbbebbb56d340e2504a2f66117c25d7b27586b9e1b7931748583eedf7e416315
- SSDEEP 3072:DGtQre5tyjc3oPC3QPeNB6CLC7A+u34A6h/7uaC:nYsB2NB6CO8+u36XC
- MD5 SHA1 SHA512 SSDEEP
uninst.exe
- IMPHASH 099c0646ea7282d232219f8807883be0
- SHA256 ca93836e0a2d4607980af0dafbe1a4efbc2e1f2d4339553575baf0f5bf0cb2ef
- MD5 ccd08e1b075afd5fa9f4634dafe1b2b5
- SHA1 df67e014ac58a1206d52032d280072493efdd23e
- SHA512 713c2212b4e7b4da8a38dc1a348f0a3ce898310b23f86645ed06c1b35f65aa3c34be9010936fbdf1244c1e746f4ac0ab0e3750a478b446a2f955d934c35baf08
- SSDEEP 6144:Asj70WsLD8k0I00P0e0d0Aj0+E0s000B0M0u00EU0bI0bAUT0gP7228opf9sXMg3:rMRtC3UwcAyC
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12860
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/modern-header.bmp
- SHA256 4b7461502c18c189d100b158298fd037212af26db287235c0d369f98388c1ffd
- MD5 3ac35b8734d0ee1cb9127720e9329d35
- SHA1 5e391b7914ce3225b1e7141c7b856e83f237d5e2
- SHA512 57c33bfbd1d9abb460a818cf09dab79014579c78bc214c7fcd06b890d8d41537aa2b7275e8db5c3642579c65ba109f8d008e843016bc00fa4274c7baadfaea59
- SSDEEP 192:TK3Taw+vkhRK0ki+SRiwNFGae0OWSfIqonliMn1tvrUVIzXtatKWRo9vZsRfnQ4:TMOkhRK0kijIwN0ISfIqoli41tvrU2Dc
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/processwork.dll
- SHA256 27329ea7002d9ce81c8e28e97a5c761922097b33cedeada4db30d2b9d505007c
- MD5 0a4fa7a9ba969a805eb0603c7cfe3378
- SHA1 0f018a8d5b42c6ce8bf34b4a6422861c327af88c
- SHA512 e13e29712457d5e6351bfd69cba6320795d8b2fd1a047923814f8699f7188ec730ec7f0d946fdff66c8b430fef011415ed045b6ea56e4cc0b1d010171ab88178
- SSDEEP 3072:n/93Fm9hfGIGjk1qc55CDoGowH6Fb/CcXwuCoty1IKYOlIa+zUk9sfqQAPfujRzS:/94yj9c55CDorNqot43ndqQpzjIKW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
208948
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
CloseProcess
ExistsProcess
KillProcess
QuitProcess
Name
CODE
Size
200KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
147B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
512B
Virtual Size
47B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
update.exe
- SHA256 772bd3ed50e281cb9a597bad7a7c118aa082d6bdec0e7a2e106594ceb9d3c23d
- MD5 e96eaf17a7f5f88204a59103f0025af1
- SHA1 8c64cc3a4963bf00bacbc7f13ca7c8735eff6202
- SHA512 4aa3650d6492e3bc04a01a38d336c351268c94daf5a239f8dc66a8cabf65c1aef3b9ab5b27cb38681205e37a3cf539eb85ee7ca8bff9793cafb5e35d4f8ad279
- SSDEEP 12288:F4Qr1qprz13k28/yS5w+6weSFz5i4SnccZMTNuYI32Xm:F4QRqpr58/1w+6VSFvSnNZwNhI32X
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1303536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
Virtual Size
864KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
405KB
Virtual Size
408KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 908ed13914065dde523088526ef98b332a9b0440a616860373d71d3028faff90
- MD5 bfa6fd41a6fb6924ddbeac6f97a09648
- SHA1 b57f48ba82f39f6796a8dd35a1544c78ed51b77f
- SHA512 1eaaea1882bfb83be48b6ebcd67a266219c31794431221220ee0be1f896b0c71eb03dd9145a0cea473f50b72fd394ec77d9c6498e9a333ca4922193f8adca605
- SSDEEP 24576:9SZu5NE3+TxcuhCXflE/SahyQdCQJw8Tih0eOXpWmA9lj+zDEC2Ts32X:9Yh+TnzI0CGw+DuhC2T4C
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
997244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
.text
Size
961KB
Virtual Size
961KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
33KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
52B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
140KB
Virtual Size
140KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
新云软件.url
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512
软件介绍.txt
- SHA256 e410eba4a07f45c6679cd837bc390d2914b2e0e3a91fa3f59531ed983a2f51bd
- MD5 105de922be4a5b1797360af045fa8bf2
- SHA1 a26774abc320f2e0e69ab89d3afccae555e8aa05
- SHA512 490bf258f1891e2840326990a44390542f4a9ea3db19ba14f8672500335c83d901d8c8516eae3fff255019adf2dccb325c076b75e16182af8c45fea4eb9fbfa7
- MD5 SHA1 SHA512