2d277ca24b98618f6545b1930137bfcb9f85b6c72f0ee44979566624d2454367

Sharing

Copy URL Twitter E-mail

General

Target

2d277ca24b98618f6545b1930137bfcb9f85b6c72f0ee44979566624d2454367
Size

4.3MB
MD5

702ee3ba734f7eb21ab42a1372d5c479
SHA1

189210debdbe076172a5bd417a45cc2df5eb5161
SHA256

2d277ca24b98618f6545b1930137bfcb9f85b6c72f0ee44979566624d2454367
SHA512

c5c8d6709668106a140ca1d35dbf7090d3bf2f43447707a18d06253c745ef44879ae27b799dfd3a6bcb230b68c0d560b3aa91094982cf35e6c4a3b660c85a8cd
SSDEEP

98304:gLX4v6QfA+P3cMfd2q0JnxZtUbaDqTTRqrEj/Hcb82zQGEKLMbESvgQ3rZW:gD4vmGRw1xZtUbZlj/HvGENZ4b

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BOX/DebugX.exe
unpack001/BOX/SimHB.exe

Files

2d277ca24b98618f6545b1930137bfcb9f85b6c72f0ee44979566624d2454367
.zip
BOX/Dbgview.exe
.exe windows:5 windows x86 arch:x86

aa2d0e076b2d23e260f768512e06ebce

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/09/2012, 21:42

Not After

04/03/2013, 21:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:02:8e:42:00:00:00:00:00:1f
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

09/01/2012, 22:25

Not After

09/04/2013, 22:25

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:b2:f7:21:ae:f3:c5:42:72:3a:a8:34:2d:bd:2c:3f:62:ce:1e:20
Signer

Actual PE Digest

25:b2:f7:21:ae:f3:c5:42:72:3a:a8:34:2d:bd:2c:3f:62:ce:1e:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\src\DbgView\Exe\Release\Dbgview.pdb

Imports

ws2_32

htonl
bind
getsockname
listen
accept
inet_ntoa
WSAStartup
inet_addr
gethostbyaddr
htons
gethostbyname
socket
connect
WSAGetLastError
closesocket

mpr

WNetAddConnection2A
WNetCancelConnection2A

comctl32

ord17
CreateToolbarEx

kernel32

lstrlenA
GetTimeFormatA
InitializeCriticalSection
GetCurrentProcessId
GetComputerNameA
GetFullPathNameA
GetModuleFileNameA
GetCommandLineA
GetVersion
GetCommandLineW
GetOverlappedResult
WriteFile
ResetEvent
WaitForMultipleObjects
ReadFile
LockResource
SizeofResource
LoadResource
FindResourceA
LocalAlloc
RaiseException
GetTickCount
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyA
lstrcatA
HeapFree
HeapAlloc
GetProcessHeap
GetDateFormatA
DosDateTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileSize
GlobalFree
WriteFileEx
QueueUserAPC
SleepEx
ExpandEnvironmentStringsA
FindFirstFileA
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
GetStdHandle
ExitProcess
Sleep
HeapReAlloc
VirtualAlloc
FatalAppExitA
DeleteCriticalSection
VirtualFree
HeapDestroy
HeapCreate
LCMapStringW
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
GetCPInfo
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
CreateThread
ResumeThread
ExitThread
SearchPathA
FindClose
GlobalMemoryStatus
LoadLibraryA
FreeLibrary
CreateFileA
QueryPerformanceFrequency
GetLocaleInfoA
GetCurrentDirectoryA
GetSystemDirectoryA
DeviceIoControl
GetCurrentThreadId
WaitForSingleObject
TerminateThread
SetLastError
EnterCriticalSection
LeaveCriticalSection
OpenMutexA
CreateMutexA
CreateFileMappingA
MapViewOfFile
CreateEventA
UnmapViewOfFile
GetSystemTime
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
InterlockedIncrement
CloseHandle
lstrcpynA
GetLastError
FormatMessageA
LocalFree
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetEnvironmentVariableA
DeleteFileA
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
InterlockedExchange
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
HeapSize
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
SetFilePointer
SetEnvironmentVariableA

user32

DrawTextA
EndPaint
GetFocus
ClientToScreen
ScreenToClient
GetDialogBaseUnits
DrawFocusRect
GetParent
IsDlgButtonChecked
PostMessageA
CheckRadioButton
DialogBoxIndirectParamA
InflateRect
RegisterClassExA
FindWindowA
LoadAcceleratorsA
RegisterWindowMessageA
MsgWaitForMultipleObjects
PeekMessageA
TranslateAcceleratorA
IsWindow
IsDialogMessageA
TranslateMessage
DispatchMessageA
GetMessageA
RegisterClassA
LoadBitmapA
SetTimer
MoveWindow
DefWindowProcA
KillTimer
GetClientRect
InvalidateRgn
CreateDialogParamA
GetCursorPos
BeginPaint
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
CallWindowProcA
GetWindowThreadProcessId
SetWindowLongA
DestroyWindow
SetForegroundWindow
TrackPopupMenu
CreateWindowExA
UpdateWindow
SetWindowPos
SetDlgItemTextA
SendDlgItemMessageA
AttachThreadInput
AppendMenuA
SetMenuItemBitmaps
DialogBoxParamA
SetFocus
GetDlgItemTextA
SetCapture
ReleaseCapture
EnableMenuItem
DeleteMenu
GetWindowRect
IsIconic
IsZoomed
SendMessageA
GetSystemMetrics
LoadIconA
GetWindowTextA
ShowWindow
GetDC
GetMenuCheckMarkDimensions
ReleaseDC
PostQuitMessage
SetWindowTextA
EndDialog
GetDlgItem
LoadCursorA
GetSysColorBrush
GetSysColor
ChildWindowFromPoint
InvalidateRect
SetCursor
GetSubMenu
GetMenuItemCount
InsertMenuItemA
MessageBoxA
GetMenu
CheckMenuItem
EnableWindow
CheckDlgButton
LoadStringA

gdi32

CreateFontA
GetTextExtentPointA
TextOutA
AbortDoc
GetTextExtentPoint32A
ExtTextOutA
SetAbortProc
SetBkColor
GetDeviceCaps
SetMapMode
StartDocA
StartPage
EndPage
EndDoc
GetTextMetricsA
DeleteObject
SelectObject
SetTextColor
SetBkMode
CreateFontIndirectA
GetObjectA
GetStockObject
DeleteDC
StretchBlt
CreateCompatibleBitmap
CreateSolidBrush
CreateCompatibleDC

comdlg32

GetSaveFileNameA
GetOpenFileNameA
ChooseColorA
FindTextA
ChooseFontA
PrintDlgA

advapi32

OpenSCManagerA
DeleteService
ControlService
OpenServiceA
StartServiceA
QueryServiceStatus
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ConvertStringSecurityDescriptorToSecurityDescriptorA
InitializeSecurityDescriptor
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegDeleteValueA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA

shell32

CommandLineToArgvW
ShellExecuteExA
SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderA
Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 202KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 205KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
BOX/DebugX.exe
.exe windows:5 windows x86 arch:x86

031b4a3b0d51e47b634207a1fb250f6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NSEC-Common\tools\DebugX\Release\DebugX.pdb

Imports

kernel32

GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
SetStdHandle
SetFilePointerEx
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
GetCommandLineW
DeviceIoControl
CreateFileW
CreateDirectoryA
GetComputerNameW
GetDriveTypeA
OutputDebugStringW
GetFileType
ExitProcess
GetStdHandle
CompareStringW
LCMapStringW
GetStringTypeW
GetCommandLineA
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapQueryInformation
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
QueryPerformanceFrequency
UnhandledExceptionFilter
CreateEventW
GetTempFileNameA
SearchPathA
GetProfileIntA
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
FindResourceExW
GetTickCount
GetWindowsDirectoryA
SystemTimeToTzSpecificLocalTime
SetFileAttributesA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
lstrcpyA
FileTimeToSystemTime
GetCPInfo
GetOEMCP
VirtualProtect
GetACP
GetThreadLocale
GetVolumeInformationA
lstrcmpiA
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
HeapFree
FlushFileBuffers
FindFirstFileA
FindClose
CreateFileA
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CopyFileA
FormatMessageA
LocalFree
GlobalSize
LeaveCriticalSection
EnterCriticalSection
MulDiv
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
LoadLibraryA
GetSystemDirectoryW
EncodePointer
FindResourceA
GlobalFree
GlobalUnlock
FreeResource
GlobalAddAtomA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
GetVersionExA
GetCurrentThread
SetLastError
OutputDebugStringA
ResumeThread
SetThreadPriority
GetCurrentThreadId
WaitForSingleObject
DeleteFileA
GetLogicalDrives
GetLocalTime
CreateThread
Sleep
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
CloseHandle
HeapReAlloc
GetLastError
HeapSize
CreateMutexW
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
RtlUnwind

user32

WaitMessage
InvalidateRect
KillTimer
SetTimer
RealChildWindowFromPoint
DeleteMenu
SystemParametersInfoA
CopyImage
RemoveMenu
AppendMenuA
InsertMenuA
GetMenuState
GetMenuStringA
OffsetRect
SetRectEmpty
FillRect
ClientToScreen
ReleaseDC
GetWindowDC
DestroyCursor
GetWindowRgn
ReleaseCapture
WindowFromPoint
LoadCursorA
LoadCursorW
GetSysColorBrush
DestroyIcon
CharUpperA
CharNextA
GetDC
TabbedTextOutA
CopyAcceleratorTableA
InvalidateRgn
SetRect
IntersectRect
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
DestroyMenu
GetMenuItemInfoA
InflateRect
GetAsyncKeyState
TrackMouseEvent
LoadImageW
SetCapture
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcA
DefFrameProcA
DrawMenuBar
GetUpdateRect
IsClipboardFormatAvailable
CharUpperBuffA
ModifyMenuA
GetDoubleClickTime
SetMenuDefaultItem
UnregisterClassA
MessageBoxW
EnableWindow
IsIconic
GetClientRect
SendMessageA
SetDlgItemTextA
LoadIconW
SetDlgItemTextW
DrawIcon
GetSystemMetrics
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
PostMessageA
PostQuitMessage
ShowOwnedPopups
SetCursor
IsWindowEnabled
MessageBoxA
GetWindowLongA
GetParent
GetWindowThreadProcessId
GetLastActivePopup
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
SetActiveWindow
GetDesktopWindow
SetWindowPos
SetWindowContextHelpId
GetWindow
MapDialogRect
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsMenu
IsChild
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgCtrlID
SetFocus
BringWindowToTop
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
CreatePopupMenu
InsertMenuItemA
LoadImageA
UnpackDDElParam
ReuseDDElParam
GetMenuDefaultItem
RegisterClipboardFormatA
DrawFocusRect
DrawIconEx
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
MapVirtualKeyA
GetKeyNameTextA
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongA
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
DrawStateA
DrawEdge
DrawFrameControl
IsZoomed
LoadMenuW
GetSystemMenu
SetCursorPos
CopyIcon
FrameRect
UnionRect
PostThreadMessageA
UpdateLayeredWindow
MonitorFromPoint
GetCapture
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
TrackPopupMenu
UpdateWindow
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetWindowTextLengthA
GetWindowRect
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
CreateAcceleratorTableA
GetSysColor
CopyRect
EqualRect
PtInRect
SetWindowLongA
GetClassLongA
GetClassNameA
GetTopWindow
UnhookWindowsHookEx
LoadIconA
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
MoveWindow
CheckDlgButton
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GrayStringA
DrawTextExA
DrawTextA
IsDialogMessageA
SendDlgItemMessageA
SetWindowTextA
GetKeyboardState
ToAsciiEx
LockWindowUpdate
DestroyAcceleratorTable
LoadAcceleratorsW

gdi32

SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileA
CreateDCA
CreateFontIndirectA
GetTextExtentPoint32A
GetTextMetricsA
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
CombineRgn
GetMapMode
PatBlt
SetRectRgn
DPtoLP
CreateCompatibleBitmap
EnumFontFamiliesExA
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
SetWindowExtEx
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceA
SetViewportOrgEx
SetViewportExtEx
ExtTextOutA
TextOutA
MoveToEx
SetTextAlign
GetStockObject
CreateBitmap
SetBkColor
SetTextColor
GetObjectA
BitBlt
CreateCompatibleDC
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
CreateSolidBrush
DeleteDC
DeleteObject
Escape
ExcludeClipRect
GetClipBox
GetDeviceCaps
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
Polygon
CreatePalette
SetROP2

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterA
ClosePrinter
DocumentPropertiesA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
InitiateSystemShutdownExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExW
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegQueryValueExW
OpenProcessToken
RegSetValueExW
RegCreateKeyExW

shell32

SHGetSpecialFolderPathW
SHGetFileInfoA
DragQueryFileA
DragFinish
SHGetPathFromIDListA
SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHBrowseForFolderA
SHAppBarMessage

comctl32

InitCommonControlsEx

shlwapi

PathStripToRootA
PathIsUNCA
PathFindFileNameA
PathFindExtensionA
PathFileExistsA
SHDeleteValueW
SHSetValueW
SHGetValueW
wnsprintfA
wnsprintfW
StrFormatKBSizeA
SHSetValueA
PathAppendA
PathAppendW
PathRemoveFileSpecW

uxtheme

GetThemePartSize
IsAppThemed
GetWindowTheme
GetThemeSysColor
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
DrawThemeText

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
DoDragDrop

oleaut32

SysAllocStringByteLen
OleCreateFontIndirect
SysAllocString
SysStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocStringLen
SafeArrayDestroy
LoadTypeLi
VarBstrFromDate
VariantCopy

oledlg

ord8

gdiplus

GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdipGetImageHeight
GdipFree
GdipAlloc
GdiplusShutdown
GdipGetImageWidth
GdiplusStartup
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImagePaletteSize

ws2_32

gethostbyname
gethostname
inet_ntoa

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BOX/Procmon.exe
.exe windows:5 windows x86 arch:x86

0f29c813bbd017f1e200bfd2d6cb9ed7

Code Sign

33:00:00:00:d7:78:5e:7e:ac:3f:2a:41:8b:00:00:00:00:00:d7
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/10/2017, 22:57

Not After

02/01/2019, 22:57

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=Thales TSS ESN:96FF-4BC5-A7DC,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c4:8c:65:69:56:da:74:a3:73:c7:02:fe:2e:92:8b:42:3a:ca:1c:07:ad:ff:7a:8a:b8:01:22:ba:47:0b:c5:b5
Signer

Actual PE Digest

c4:8c:65:69:56:da:74:a3:73:c7:02:fe:2e:92:8b:42:3a:ca:1c:07:ad:ff:7a:8a:b8:01:22:ba:47:0b:c5:b5

Digest Algorithm

sha256

PE Digest Matches

true

f5:75:e2:9a:a2:8b:9d:ed:81:7c:88:59:19:6b:7b:88:a7:2c:21:43
Signer

Actual PE Digest

f5:75:e2:9a:a2:8b:9d:ed:81:7c:88:59:19:6b:7b:88:a7:2c:21:43

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\13810\Tools\Procmon_master\bin\Win32\Release\Procmon.pdb

Imports

ws2_32

closesocket
listen
recv
bind
accept
getsockname
connect
inet_ntoa
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
htons
inet_addr
htonl
WSAStartup
ntohs
WSAGetLastError
gethostbyname
socket
send

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

ord17
ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Add
ImageList_SetOverlayImage
ImageList_GetIcon
ImageList_GetIconSize
CreateStatusWindowW
ImageList_Destroy
ImageList_DrawEx
InitCommonControlsEx

fltlib

FilterReplyMessage
FilterGetMessage
FilterSendMessage
FilterConnectCommunicationPort

kernel32

CompareStringW
GetLocaleInfoW
TryEnterCriticalSection
GetFileSize
SetEndOfFile
SetFilePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
GetVersion
WriteFile
ReadFile
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
FormatMessageW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapSize
ExitProcess
GetCurrentThread
GlobalUnlock
SetEvent
ResetEvent
ReleaseSemaphore
WaitForMultipleObjects
CreateEventW
CreateSemaphoreW
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
SetProcessShutdownParameters
GetFileAttributesExW
GetComputerNameW
SetConsoleCtrlHandler
GetCurrentProcessId
OpenThread
GetThreadContext
LoadLibraryA
GetSystemDirectoryA
FindClose
FindFirstFileW
FindNextFileW
DecodePointer
HeapReAlloc
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
GetConsoleMode
GetModuleHandleExW
EncodePointer
RtlUnwind
OutputDebugStringW
IsDebuggerPresent
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GlobalLock
GlobalAlloc
SetCurrentDirectoryW
CreateProcessW
OpenProcess
EnumResourceNamesW
LoadLibraryExW
GetVersionExW
GetFileAttributesW
GetFullPathNameW
GetSystemInfo
VirtualFree
GlobalMemoryStatusEx
DeleteFileW
SetFileAttributesW
GetCurrentDirectoryW
GetSystemDirectoryW
FindResourceW
SetConsoleMode
IsProcessorFeaturePresent
ExitThread
GetCurrentThreadId
IsValidCodePage
GetACP
GetOEMCP
ExpandEnvironmentStringsW
SizeofResource
LoadResource
SetLastError
GetLastError
GetCurrentProcess
LockResource
VirtualAlloc
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
CloseHandle
Sleep
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CreateThread
GetModuleFileNameW
GetCommandLineW
GetStdHandle
GetFileType
LocalFree
LocalAlloc
GlobalAddAtomW
GetModuleHandleW
LoadLibraryW
GetTickCount
MulDiv
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetConsoleCP
GetStringTypeW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
WriteConsoleW
SetStdHandle
FlushFileBuffers
ReadConsoleW
SetThreadPriority
ReadConsoleInputA

user32

MessageBeep
ScreenToClient
UnionRect
EqualRect
EnumChildWindows
GetClassNameW
LoadBitmapW
CopyImage
IsDialogMessageW
GetWindowDC
WindowFromPoint
CreatePopupMenu
GetMenu
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
KillTimer
CheckRadioButton
GetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
CreateDialogParamW
IsZoomed
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
FlashWindowEx
RegisterClassW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
DrawFrameControl
RegisterWindowMessageW
GetWindow
GetActiveWindow
LoadImageW
ClientToScreen
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
PtInRect
GetMonitorInfoW
SetWindowTextA
GetIconInfo
DrawIconEx
DestroyIcon
LoadIconW
SetClassLongW
CheckMenuItem
GetCursor
IsDlgButtonChecked
CheckDlgButton
DestroyWindow
PostMessageW
MessageBoxW
GetAncestor
GetDesktopWindow
EnableWindow
DialogBoxParamW
ChildWindowFromPoint
GetWindowTextW
SetDlgItemTextW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
LoadCursorW
GetParent
GetClassLongW
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
SetActiveWindow
SetMenuDefaultItem
GetMenuItemInfoW
InsertMenuItemW
SetMenuInfo
TrackPopupMenu
DeleteMenu
InsertMenuW
GetMenuItemCount
GetSubMenu
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
DrawTextW
GetSystemMetrics
SetTimer
ReleaseCapture
SetCapture
MonitorFromPoint
EnableMenuItem
GetCapture
GetKeyState
GetFocus
SetFocus
SetWindowPos
ShowWindow
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
SendMessageW
FrameRect
DestroyMenu
LoadStringW

gdi32

SetMapMode
SetROP2
SaveDC
RestoreDC
Rectangle
GdiFlush
SetPixel
GetPixel
CreateFontW
CreateBitmap
Polygon
MoveToEx
LineTo
GetBitmapBits
GetObjectW
CreateFontIndirectW
EndPage
StartPage
EndDoc
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
Polyline
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
RectInRegion
GetStockObject
GetDeviceCaps
GetBkMode
GetBkColor
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreateRectRgn
CreatePen
StartDocW

comdlg32

ChooseColorW
FindTextW
GetOpenFileNameW
PrintDlgW
ChooseFontW
GetSaveFileNameW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
RegCreateKeyExW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegCreateKeyW
RegOpenKeyW
RegOpenKeyExW

shell32

SHChangeNotify
SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
ShellExecuteExW
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetMalloc
SHGetFileInfoW

ole32

CoSetProxyBlanket
CoCreateInstance
CreateBindCtx
OleInitialize
RegisterDragDrop
ReleaseStgMedium
CoInitialize

oleaut32

SysAllocString
SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
VariantInit
VariantClear
VariantCopy
VariantChangeType
SysAllocStringByteLen
VariantTimeToSystemTime
SysAllocStringLen

shlwapi

SHAutoComplete

Sections

.text
Size: 571KB - Virtual size: 571KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 175KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BOX/SimHB.exe
.exe windows:5 windows x86 arch:x86

798e2a1d40b9f89149f6a683c11c71e2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Client\Client-TestToolsets\SimHB\SimHB\Release\SimHB.pdb

Imports

kernel32

GetLastError
CreateThread
ExitThread
CloseHandle
OpenMutexW
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapFree
HeapAlloc
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
RtlUnwind
MultiByteToWideChar
ReadFile
WriteFile
GetModuleFileNameW
SetFilePointer
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
WideCharToMultiByte
LCMapStringW
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
CreateFileA
SetStdHandle
LoadLibraryW
FlushFileBuffers
GetStringTypeW
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetProcessHeap
CreateFileW
WaitForSingleObject
GetLogicalDrives
GetDriveTypeA
GetVolumeInformationA
GetPrivateProfileStringA
Process32FirstW
CreateEventW
DeviceIoControl
Process32NextW
GetModuleHandleA
CancelIo
CreateToolhelp32Snapshot
Sleep

shlwapi

wnsprintfW
SHGetValueA
SHGetValueW
StrToIntExA
PathFileExistsA
SHSetValueA
wnsprintfA
PathAppendW

ws2_32

inet_addr
htons
WSASocketW
WSAGetLastError
WSAStartup
WSAIoctl
WSASendTo
WSAGetOverlappedResult
WSARecvFrom
closesocket

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

user32

wsprintfA

advapi32

RegSetValueExW
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

Sections

.text
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
BOX/processhacker-2.39-setup.exe
.exe windows:1 windows x86 arch:x86

Code Sign

0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f
Certificate

Issuer

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/10/2013, 00:00

Not After

04/01/2017, 12:00

Subject

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert High Assurance Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f
Certificate

Issuer

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

30/10/2013, 00:00

Not After

04/01/2017, 12:00

Subject

CN=Wen Jia Liu,O=Wen Jia Liu,L=Sydney,ST=New South Wales,C=AU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 High Assurance Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/12/2015, 00:00

Not After

07/01/2025, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:33:12:d6:73:40:58:da:f9:36:91:31:58:17:af:f2:3f:e7:11:0a:e3:31:bd:85:7b:43:70:47:90:53:db:12
Signer

Actual PE Digest

83:33:12:d6:73:40:58:da:f9:36:91:31:58:17:af:f2:3f:e7:11:0a:e3:31:bd:85:7b:43:70:47:90:53:db:12

Digest Algorithm

sha256

PE Digest Matches

true

b1:cd:ff:77:4a:7c:de:e6:76:24:73:fd:3c:9a:c6:c7:05:79:d7:d3
Signer

Actual PE Digest

b1:cd:ff:77:4a:7c:de:e6:76:24:73:fd:3c:9a:c6:c7:05:79:d7:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aa2d0e076b2d23e260f768512e06ebce

Code Sign

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9dCertificate

Extended Key Usages

61:02:8e:42:00:00:00:00:00:1fCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

25:b2:f7:21:ae:f3:c5:42:72:3a:a8:34:2d:bd:2c:3f:62:ce:1e:20Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

mpr

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Sections

.text Size: 202KB - Virtual size: 201KB

.rdata Size: 36KB - Virtual size: 35KB

.data Size: 6KB - Virtual size: 94KB

.rsrc Size: 205KB - Virtual size: 204KB

031b4a3b0d51e47b634207a1fb250f6e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

ws2_32

oleacc

imm32

winmm

iphlpapi

netapi32

Sections

.text Size: 1.5MB - Virtual size: 1.5MB

.rdata Size: 320KB - Virtual size: 320KB

.data Size: 22KB - Virtual size: 39KB

.rsrc Size: 105KB - Virtual size: 105KB

.reloc Size: 137KB - Virtual size: 136KB

0f29c813bbd017f1e200bfd2d6cb9ed7

Code Sign

33:00:00:00:d7:78:5e:7e:ac:3f:2a:41:8b:00:00:00:00:00:d7Certificate

Extended Key Usages

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79Certificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4Certificate

33:00:00:00:9d:1e:8d:27:ae:b8:f3:d8:38:00:01:00:00:00:9d
Certificate

61:02:8e:42:00:00:00:00:00:1f
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

25:b2:f7:21:ae:f3:c5:42:72:3a:a8:34:2d:bd:2c:3f:62:ce:1e:20
Signer

.text
Size: 202KB - Virtual size: 201KB

.rdata
Size: 36KB - Virtual size: 35KB

.data
Size: 6KB - Virtual size: 94KB

.rsrc
Size: 205KB - Virtual size: 204KB

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 320KB - Virtual size: 320KB

.data
Size: 22KB - Virtual size: 39KB

.rsrc
Size: 105KB - Virtual size: 105KB

.reloc
Size: 137KB - Virtual size: 136KB

33:00:00:00:d7:78:5e:7e:ac:3f:2a:41:8b:00:00:00:00:00:d7
Certificate

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

c4:8c:65:69:56:da:74:a3:73:c7:02:fe:2e:92:8b:42:3a:ca:1c:07:ad:ff:7a:8a:b8:01:22:ba:47:0b:c5:b5
Signer

f5:75:e2:9a:a2:8b:9d:ed:81:7c:88:59:19:6b:7b:88:a7:2c:21:43
Signer

.text
Size: 571KB - Virtual size: 571KB

.rdata
Size: 175KB - Virtual size: 174KB

.data
Size: 6KB - Virtual size: 37KB

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

.reloc
Size: 36KB - Virtual size: 36KB

.text
Size: 112KB - Virtual size: 112KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 10KB - Virtual size: 10KB

0f:f1:ef:66:bd:62:1c:65:b7:4b:4d:e4:14:25:71:7f
Certificate

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

02:c4:d1:e5:8a:4a:68:0c:56:8d:a3:04:7e:7e:4d:5f
Certificate

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

04:0c:b4:1e:4f:b3:70:c4:5c:43:44:76:51:62:58:2f
Certificate

0b:7e:10:90:3c:38:49:0f:fa:2f:67:9a:87:a1:a7:b9
Certificate

02:ce:42:94:59:02:a4:f3:c0:40:b0:ff:77:93:d1:4f
Certificate