Skillbrains - LBBH3S9D3[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Skillbrains - LBBH3S9D3.zip
Size

2.3MB
MD5

7f4585d265eb8c941870b5e5696579c4
SHA1

6e3ed3d4f12334fb10717f5e7034e0c733091426
SHA256

c35ab9b660dcefa76deaab18b599ab35cf22f48e9efa3ab8fddbbefa0a0e153f
SHA512

2009fb6f5737392523bece3313375f8fb1f9e6bfa19a11fadaf60bbfd7310ccb3c4edc4aabaebf71b6a5a643349dcae74249e2ca2af03d5a6375e7eec4ea504d
SSDEEP

49152:PVjK/EPXgoDe/W/OZmG7UQyaxP6e68EgkRh5fra3LqS03:djlPXMhZm8U5S9kRjeqSs

Score

1^/10

Malware Config

Signatures

Files

Skillbrains - LBBH3S9D3.zip
.zip
Skillbrains/Updater/1.8.0.0/Updater.exe
.exe windows:5 windows x86 arch:x86

6c0552d294568c9d955df768391ff0c2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

08/07/2016, 00:00

Not After

08/07/2019, 23:59

Subject

CN=OOO Lightshot,O=OOO Lightshot,L=Novosibirsk,ST=Novosibirsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7f:47:36:71:91:08:3e:f1:67:e6:60:99:fa:2b:b8:96:d0:10:d1:b7:0d:dd:d3:96:57:31:66:8f:f3:52:e5:66
Signer

Actual PE Digest

7f:47:36:71:91:08:3e:f1:67:e6:60:99:fa:2b:b8:96:d0:10:d1:b7:0d:dd:d3:96:57:31:66:8f:f3:52:e5:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\sources\lightshot\DeployingSystem\Updater\bin\1.0.0.0\Updater.pdb

Imports

kernel32

LoadLibraryExW
GetModuleFileNameW
GetModuleHandleW
OpenProcess
TerminateProcess
SetLastError
WriteFile
FindClose
LoadLibraryW
CreateProcessW
GetTempPathW
RemoveDirectoryW
CreateFileW
GetFileAttributesW
FindFirstFileW
CreateMutexW
WTSGetActiveConsoleSessionId
ReadFile
GetSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentProcess
GetVersionExW
WriteConsoleW
FlushFileBuffers
GetTickCount
WaitForMultipleObjectsEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
FindNextFileW
lstrcmpiW
CloseHandle
Sleep
WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
DeleteFileW
FindResourceExW
FindResourceW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
LockResource
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
FatalAppExitA
SetConsoleCtrlHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetStringTypeW
GetFileType
SetEndOfFile
SetFilePointerEx
ReadConsoleW
GetConsoleMode
GetCPInfo
GetOEMCP
GetACP
SetStdHandle
DecodePointer
IsValidCodePage
SetProcessAffinityMask
VirtualProtect
VirtualFree
VirtualAlloc
UnregisterWaitEx
InitializeSListHead
ReleaseSemaphore
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
GetStdHandle
AreFileApisANSI
IsDebuggerPresent
OutputDebugStringW
GetSystemTimeAsFileTime
DuplicateHandle
GetCurrentThread
GetExitCodeThread
EncodePointer
RtlUnwind
TryEnterCriticalSection
CreateTimerQueue
IsProcessorFeaturePresent
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
RtlCaptureStackBackTrace
SetEvent
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCommandLineW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateEventW
GetStartupInfoW
CreateSemaphoreW
ExitThread
ExitProcess
GetModuleHandleExW

user32

DestroyWindow
DefWindowProcW
GetSystemMetrics
UnregisterClassW
CharNextW
GetWindowLongW
SetWindowLongW
GetWindowDC

gdi32

GetDeviceCaps

advapi32

CryptReleaseContext
RegOpenKeyW
RegEnumValueW
RegEnumKeyW
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
GetTokenInformation
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
RegCloseKey
CryptAcquireContextW
CheckTokenMembership
CreateProcessAsUserW
GetUserNameW
FreeSid
AllocateAndInitializeSid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW

shell32

SHGetFolderPathW

ole32

CoTaskMemRealloc
CoCreateInstance
StringFromCLSID
CoInitialize
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize

oleaut32

SysFreeString
VarUI4FromStr

shlwapi

PathFindFileNameW
PathAppendW
PathRemoveFileSpecW
PathCanonicalizeW
PathAddBackslashW

comctl32

InitCommonControlsEx

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

wtsapi32

WTSQueryUserToken

rpcrt4

UuidCreate

urlmon

URLDownloadToFileW
URLOpenBlockingStreamW

wininet

DeleteUrlCacheEntryW

Sections

.text
Size: 641KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/Updater/MachineProducts.xml
.xml
Skillbrains/Updater/Updater.exe
.exe windows:5 windows x86 arch:x86

04d8c0d95175abb34cd9a1d78b8f7ee3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7a
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

08/07/2016, 00:00

Not After

08/07/2019, 23:59

Subject

CN=OOO Lightshot,O=OOO Lightshot,L=Novosibirsk,ST=Novosibirsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a6:59:f4:e1:65:a7:16:7b:4f:86:2e:89:74:00:1c:22:68:ec:ca:6a:ee:0e:85:8f:60:7c:bf:83:65:a2:09:da
Signer

Actual PE Digest

a6:59:f4:e1:65:a7:16:7b:4f:86:2e:89:74:00:1c:22:68:ec:ca:6a:ee:0e:85:8f:60:7c:bf:83:65:a2:09:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\sources\lightshot\DeployingSystem\Starter\Starter\Release\Starter.pdb

Imports

kernel32

LockResource
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
RaiseException
LoadResource
SizeofResource
FindClose
FindResourceW
FindResourceExW
FindFirstFileW
FindNextFileW
DecodePointer
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
CloseHandle
GetModuleFileNameW
CreateProcessW
GetTempPathW
GetFileAttributesW
WriteConsoleW
EncodePointer
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
CreateThread
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
SetLastError
RtlUnwind
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
WriteFile
GetACP
GetCurrentThread
GetStringTypeW
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileExA
FindFirstFileExW
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetConsoleCtrlHandler
OutputDebugStringA
CreateFileW

user32

UnregisterClassW

oleaut32

SysFreeString

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

Sections

.text
Size: 242KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/Updater/updater.log
Skillbrains/lightshot/5.5.0.4/DXGIODScreenshot.dll
.dll windows:5 windows x86 arch:x86

8e55ea89e532d567e141d1a61186f294

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72
Signer

Actual PE Digest

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\DXGIODScreenshot.pdb

Imports

kernel32

HeapAlloc
DecodePointer
GetProcAddress
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
SetLastError
GetCurrentProcess
FindClose
MultiByteToWideChar
FreeLibrary
VerSetConditionMask
VerifyVersionInfoW
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
RaiseException
CloseHandle
HeapReAlloc
GetLastError
HeapSize
GetCurrentThreadId
CreateFileW
InitializeCriticalSectionAndSpinCount
WriteFile
HeapFree
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
LeaveCriticalSection
EnterCriticalSection
OutputDebugStringW
IsDebuggerPresent

user32

CopyRect
ReleaseDC
GetWindowDC
EnumDisplayMonitors

gdi32

CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
EqualRgn
DeleteDC
CreateRectRgnIndirect
CombineRgn
DeleteObject
BitBlt

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

Exports

Exports

TakeScreenshotExp

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/5.5.0.4/Lightshot.dll
.dll windows:5 windows x86 arch:x86

6a76fa6ec8daa78854b0e42a457b5f9e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5
Signer

Actual PE Digest

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot.pdb

Imports

gdiplus

GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipDeleteGraphics
GdipCreatePen1
GdipDrawImageRectRectI
GdipDeletePen
GdipCreateFromHDC
GdipReleaseDC
GdipGetDC
GdipDrawRectangleI
GdipDrawLinesI
GdipFillEllipse
GdipCreateStringFormat
GdipDeleteFontFamily
GdipSetCompositingQuality
GdipCreateFontFamilyFromName
GdipDeleteBrush
GdipCreateFont
GdipSetInterpolationMode
GdipCreateSolidFill
GdipSetPixelOffsetMode
GdipGetGenericFontFamilySansSerif
GdipDrawString
GdipCloneBrush
GdipMeasureString
GdipDeleteStringFormat
GdipDeleteFont
GdipSetStringFormatAlign
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipDrawImageRectI
GdipDrawEllipseI
GdipSetSmoothingMode
GdipSaveImageToFile
GdipSetPenColor
GdipSetPenStartCap
GdipSetPenWidth
GdipSetPenLineJoin
GdipSetPenEndCap
GdipCreateAdjustableArrowCap
GdipSetPenCustomEndCap
GdipDeleteCustomLineCap
GdipDrawLineI
GdipGetImageHeight
GdipSetImageAttributesColorMatrix
GdipGetImageEncoders
GdipDrawImageRectRect
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImageAttributes
GdipDeletePath
GdipDisposeImage
GdipCreatePath
GdipResetPath
GdipFillPath
GdipGetImagePixelFormat
GdipCreateHBITMAPFromBitmap
GdipSetPageUnit
GdipClosePathFigure
GdipCreateImageAttributes
GdipFree
GdipGetImageGraphicsContext
ord1
GdipGetImageEncodersSize

kernel32

EncodePointer
OutputDebugStringW
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
SetEvent
SizeofResource
HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
LockResource
HeapReAlloc
RaiseException
LoadLibraryW
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
DeleteCriticalSection
ResetEvent
GetProcessHeap
FreeLibrary
VerifyVersionInfoW
WriteFile
CreateMutexW
CreateFileW
GetCurrentThreadId
ReleaseMutex
CloseHandle
GetModuleHandleW
WideCharToMultiByte
SetLastError
GetCurrentProcess
GetModuleFileNameW
GetTempPathW
FindClose
MultiByteToWideChar
GetTempFileNameW
EnterCriticalSection
LeaveCriticalSection
MulDiv
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceCounter
CreateDirectoryW
lstrcmpiW
LoadLibraryExW
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
SetStdHandle
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
VerSetConditionMask

user32

TrackPopupMenu
CreatePopupMenu
MonitorFromPoint
CreateDialogParamW
IntersectRect
OffsetRect
GetCursorInfo
DrawIcon
GetIconInfo
GetDesktopWindow
DestroyWindow
CharNextW
UpdateWindow
ShowWindow
DestroyMenu
IsRectEmpty
DialogBoxParamW
MoveWindow
GetDlgItem
BeginPaint
EndPaint
GetActiveWindow
InflateRect
GetWindowTextLengthW
PostMessageW
GetDC
FillRect
SetWindowTextW
RegisterClassExW
IsWindow
GetAsyncKeyState
RedrawWindow
CreateCaret
GetMonitorInfoW
SetCapture
SetCursor
DrawTextW
ShowCaret
GetClassInfoExW
ReleaseCapture
InvalidateRect
GetWindowTextW
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetWindowRect
SetWindowLongW
RegisterWindowMessageW
SetWindowPos
CreateWindowExW
ScreenToClient
ClientToScreen
SetRectEmpty
GetParent
GetCursorPos
EqualRect
UnionRect
TrackMouseEvent
GetWindowDC
SetRect
ReleaseDC
EnumDisplayMonitors
CopyRect
SendMessageW
FindWindowW
UnregisterClassW
SetFocus
AppendMenuW
EnableMenuItem
PtInRect
SetForegroundWindow
EndDialog
MessageBeep
OpenClipboard
CloseClipboard
EmptyClipboard
LoadCursorW
SetClipboardData
GetSystemMetrics

gdi32

GetTextMetricsW
CreateDIBSection
EqualRgn
RectInRegion
SetTextColor
StartPage
StretchBlt
EndDoc
StartDocW
CreateRectRgnIndirect
EndPage
SetBkMode
SetBkColor
ExtTextOutW
CreateCompatibleBitmap
BitBlt
SelectObject
CreateCompatibleDC
CreateFontW
GetStockObject
GetDeviceCaps
CreatePen
Rectangle
CreateSolidBrush
CreateBitmap
CombineRgn
GetObjectW
DeleteObject
GetDIBits
DeleteDC

comdlg32

GetSaveFileNameW
PrintDlgExW
GetOpenFileNameW
ChooseColorW

advapi32

RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathAppendW
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathAddBackslashW
PathCombineW

comctl32

InitCommonControlsEx

Exports

Exports

DeinitLightshot
InitLightshot
MakeScreenshot
MakeScreenshotByCommand
SetTranslations

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 247KB - Virtual size: 246KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/5.5.0.4/Lightshot.exe
.exe windows:5 windows x86 arch:x86

2f0381ca527366dde0bbef4148ecb54a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c
Signer

Actual PE Digest

c3:fc:67:ca:51:64:9a:12:d3:21:53:24:a7:c3:2f:99:d2:65:bd:2d:9f:8a:30:54:6a:18:a4:10:53:5b:54:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\Lightshot_exe.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

FreeLibrary
FindFirstFileW
SetLastError
FindNextFileW
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
GetTickCount
CompareStringW
lstrlenW
GetVersionExW
GetLocalTime
lstrcmpiW
MulDiv
InterlockedDecrement
InterlockedIncrement
LoadLibraryExW
GetComputerNameW
LCMapStringW
GetStringTypeW
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
LoadLibraryW
RtlUnwind
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
EncodePointer
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GlobalFree
ResetEvent
SetEvent
CreateEventW
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetConsoleCP
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
GetModuleHandleW
GetFileSize
GetProcAddress
FindResourceW
LoadResource
FindResourceExW
LockResource
ReleaseMutex
GetCurrentThreadId
CreateFileW
CreateMutexW
WriteFile
SizeofResource
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
CreateThread
RaiseException
CloseHandle
HeapReAlloc
TerminateThread
GetLastError
HeapSize
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
HeapFree
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
WriteConsoleW

user32

PostQuitMessage
DialogBoxParamW
SetTimer
MoveWindow
PostMessageW
RegisterWindowMessageW
GetMessageW
DispatchMessageW
TranslateMessage
KillTimer
MapVirtualKeyW
RemoveMenu
LoadIconW
DestroyMenu
GetKeyNameTextW
EnableWindow
GetAsyncKeyState
GetWindowLongW
GetWindowTextLengthW
DefWindowProcW
CallWindowProcW
GetWindow
GetWindowRect
RegisterHotKey
DestroyIcon
GetActiveWindow
GetSubMenu
TrackPopupMenu
MonitorFromPoint
LoadMenuW
UnregisterHotKey
GetClassInfoExW
RegisterWindowMessageA
RegisterClassExW
MessageBoxW
GetFocus
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
FillRect
CreateWindowExW
ScreenToClient
EndDialog
SetWindowTextW
IsWindow
OffsetRect
GetCapture
GetMonitorInfoW
GetDlgCtrlID
MapWindowPoints
DrawFocusRect
GetSysColor
IsWindowEnabled
SetFocus
CharNextW
LoadCursorW
GetClassNameW
SetCapture
SetCursor
SetRectEmpty
SetWindowLongW
GetClientRect
GetDlgItem
DrawTextW
SystemParametersInfoW
GetParent
PtInRect
UpdateWindow
ReleaseCapture
InvalidateRect
GetCursorPos
BeginPaint
EndPaint
GetWindowTextW
InsertMenuItemW
SetMenuItemInfoW
TrackMouseEvent
ReleaseDC
GetSystemMetrics
GetWindowDC
SendMessageW
UnregisterClassW
SetForegroundWindow

gdi32

SelectObject
CreateFontW
GetDeviceCaps
DeleteObject
GetObjectW
CreateFontIndirectW
CreateSolidBrush
SetBkColor
SetBkMode
GetStockObject
SetTextColor

advapi32

RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegEnumKeyExW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptSetKeyParam
CryptImportKey
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegDeleteValueW
RegEnumValueW
RegCloseKey

shell32

ShellExecuteW
Shell_NotifyIconW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathFileExistsW
PathCanonicalizeW
PathAppendW
PathRemoveFileSpecW
PathAddBackslashW
PathIsDirectoryW

comctl32

DestroyPropertySheetPage
PropertySheetW
CreatePropertySheetPageW

wininet

InternetQueryOptionW

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/5.5.0.4/learnmore.url
Skillbrains/lightshot/5.5.0.4/learnmore_ru.url
Skillbrains/lightshot/5.5.0.4/locales/ar.txt
Skillbrains/lightshot/5.5.0.4/locales/be.txt
Skillbrains/lightshot/5.5.0.4/locales/bg.txt
Skillbrains/lightshot/5.5.0.4/locales/bn-BD.txt
Skillbrains/lightshot/5.5.0.4/locales/bs.txt
Skillbrains/lightshot/5.5.0.4/locales/ca.txt
Skillbrains/lightshot/5.5.0.4/locales/cs.txt
Skillbrains/lightshot/5.5.0.4/locales/da.txt
Skillbrains/lightshot/5.5.0.4/locales/de.txt
Skillbrains/lightshot/5.5.0.4/locales/el.txt
Skillbrains/lightshot/5.5.0.4/locales/en.txt
Skillbrains/lightshot/5.5.0.4/locales/es.txt
Skillbrains/lightshot/5.5.0.4/locales/et.txt
Skillbrains/lightshot/5.5.0.4/locales/fa.txt
Skillbrains/lightshot/5.5.0.4/locales/fi.txt
Skillbrains/lightshot/5.5.0.4/locales/fr.txt
Skillbrains/lightshot/5.5.0.4/locales/gl.txt
Skillbrains/lightshot/5.5.0.4/locales/he.txt
Skillbrains/lightshot/5.5.0.4/locales/hr.txt
Skillbrains/lightshot/5.5.0.4/locales/hu.txt
Skillbrains/lightshot/5.5.0.4/locales/hy.txt
Skillbrains/lightshot/5.5.0.4/locales/id.txt
Skillbrains/lightshot/5.5.0.4/locales/is.txt
Skillbrains/lightshot/5.5.0.4/locales/it.txt
Skillbrains/lightshot/5.5.0.4/locales/ja.txt
Skillbrains/lightshot/5.5.0.4/locales/ka.txt
Skillbrains/lightshot/5.5.0.4/locales/ko.txt
Skillbrains/lightshot/5.5.0.4/locales/ku.txt
Skillbrains/lightshot/5.5.0.4/locales/lt.txt
Skillbrains/lightshot/5.5.0.4/locales/lv.txt
Skillbrains/lightshot/5.5.0.4/locales/mk.txt
Skillbrains/lightshot/5.5.0.4/locales/nb-NO.txt
Skillbrains/lightshot/5.5.0.4/locales/nl.txt
Skillbrains/lightshot/5.5.0.4/locales/pl.txt
Skillbrains/lightshot/5.5.0.4/locales/pt-PT.txt
Skillbrains/lightshot/5.5.0.4/locales/pt-br.txt
Skillbrains/lightshot/5.5.0.4/locales/ro.txt
Skillbrains/lightshot/5.5.0.4/locales/ru.txt
Skillbrains/lightshot/5.5.0.4/locales/sk.txt
Skillbrains/lightshot/5.5.0.4/locales/sl.txt
Skillbrains/lightshot/5.5.0.4/locales/sq.txt
Skillbrains/lightshot/5.5.0.4/locales/sr-Cyrl.txt
Skillbrains/lightshot/5.5.0.4/locales/sr.txt
Skillbrains/lightshot/5.5.0.4/locales/sv.txt
Skillbrains/lightshot/5.5.0.4/locales/th.txt
Skillbrains/lightshot/5.5.0.4/locales/tr.txt
Skillbrains/lightshot/5.5.0.4/locales/uk.txt
Skillbrains/lightshot/5.5.0.4/locales/ur.txt
Skillbrains/lightshot/5.5.0.4/locales/vi.txt
Skillbrains/lightshot/5.5.0.4/locales/zh-CN.txt
Skillbrains/lightshot/5.5.0.4/locales/zh-TW.txt
Skillbrains/lightshot/5.5.0.4/net.dll
.dll windows:5 windows x86 arch:x86

a5b3d7433e243b1161624084925ada53

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7e:a3:f0:38:aa:0f:12:95:9e:48:38:0d:bb:9c:32:7c:56:95:15:e7:d8:8d:33:35:70:fc:0e:60:b1:2a:5c:7a
Signer

Actual PE Digest

7e:a3:f0:38:aa:0f:12:95:9e:48:38:0d:bb:9c:32:7c:56:95:15:e7:d8:8d:33:35:70:fc:0e:60:b1:2a:5c:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\net.pdb

Imports

advapi32

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
CryptAcquireContextA
CryptGenRandom
CryptDestroyKey
CryptImportKey
CryptEncrypt

ws2_32

accept
listen
__WSAFDIsSet
ioctlsocket
gethostname
htonl
ntohl
WSAGetLastError
WSACleanup
WSAStartup
select
WSASetLastError
recv
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAIoctl
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
socket

crypt32

CertFreeCertificateContext

wldap32

ord46
ord143
ord32
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord33
ord35
ord301
ord200
ord30
ord79

kernel32

FlushFileBuffers
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
GetStringTypeW
FindFirstFileExA
FindNextFileA
LCMapStringW
CompareStringW
GetTimeZoneInformation
GetACP
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetModuleFileNameA
ExitProcess
SetFilePointerEx
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
FileTimeToSystemTime
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
InterlockedFlushSList
RtlUnwind
TlsFree
TlsSetValue
ReadFile
SizeofResource
HeapFree
WriteFile
GetCommandLineW
SetEndOfFile
WaitForSingleObject
CreateFileW
GetCurrentThreadId
HeapSize
GetLastError
LockResource
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
DecodePointer
HeapDestroy
GetProcAddress
GetFileSize
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
GlobalFree
SetLastError
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
FreeLibrary
GetTickCount
EnterCriticalSection
InterlockedDecrement
LeaveCriticalSection
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
InitializeCriticalSection
Sleep
SleepEx
FormatMessageA
VerSetConditionMask
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
VerifyVersionInfoA
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
GetFileAttributesExW
InitializeCriticalSectionAndSpinCount
ResetEvent
SetEvent
OutputDebugStringW
IsDebuggerPresent

user32

CharNextW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW

wininet

HttpSendRequestW
HttpOpenRequestW
InternetOpenUrlW
HttpAddRequestHeadersW
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetQueryOptionW
HttpSendRequestExW
HttpEndRequestW
HttpQueryInfoW
InternetOpenW
InternetWriteFile

Exports

Exports

PostExp
SetCustomProxyExp
UrlReadToString

Sections

.text
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/5.5.0.4/uploader.dll
.dll windows:5 windows x86 arch:x86

3f0ea857b844fec98c79341d21783cfa

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

60:52:b7:c6:7b:f9:96:b1:a4:b6:08:a4:35:b1:26:67:8c:8a:d2:a1:c0:14:c2:18:db:e2:2e:53:f7:40:e0:2e
Signer

Actual PE Digest

60:52:b7:c6:7b:f9:96:b1:a4:b6:08:a4:35:b1:26:67:8c:8a:d2:a1:c0:14:c2:18:db:e2:2e:53:f7:40:e0:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Dev\skillbrains\lightshot-windows-app\Screenshot\StandAloneApp\Release\curl_uploader.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

FindResourceW
GetProcAddress
GetModuleHandleW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
ResetEvent
GlobalFree
LoadLibraryW
FreeLibrary
SetLastError
GetCurrentProcess
GetModuleFileNameW
FindClose
MultiByteToWideChar
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
DeleteFileW
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadResource
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
FindFirstFileExA
LCMapStringW
GetStringTypeW
GetFileType
GetStdHandle
GetACP
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
QueryPerformanceFrequency
InterlockedFlushSList
RtlUnwind
FindNextFileA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FindResourceExW
LockResource
GetCurrentThreadId
CreateFileW
WriteFile
SizeofResource
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
CreateThread
RaiseException
CloseHandle
HeapReAlloc
TerminateThread
GetLastError
HeapSize
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
HeapFree
SetFilePointerEx
FlushFileBuffers
WriteConsoleW
InitializeSListHead
GetConsoleMode
GetConsoleCP
SetStdHandle
FreeEnvironmentStringsW

user32

CharNextW
KillTimer
SetTimer
FlashWindow
SetWindowPos
SetFocus
PostMessageW
MessageBoxW
GetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SystemParametersInfoW
SetWindowTextW
MoveWindow
GetDlgItem
GetDC
GetMessageW
DestroyWindow
ShowWindow
DispatchMessageW
IsDialogMessageW
TranslateMessage
SetWindowLongW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
ReleaseDC
GetSystemMetrics
GetWindowDC
SendMessageW
FindWindowW
UnregisterClassW
CreateDialogParamW

advapi32

RegDeleteKeyW
RegEnumKeyExW
CryptDestroyKey
CryptEncrypt
CryptDecrypt
CryptSetKeyParam
CryptImportKey
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CryptReleaseContext
RegQueryInfoKeyW

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoTaskMemFree

shell32

ShellExecuteW

oleaut32

VarUI4FromStr
SysFreeString
SysAllocString

shlwapi

PathAddBackslashW
PathFileExistsW
PathAppendW
PathRemoveFileSpecW

gdi32

GetDeviceCaps

wininet

InternetQueryOptionW

Exports

Exports

SetLocaleString
UploadImage

Sections

.text
Size: 147KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/Lightshot.exe
.exe windows:5 windows x86 arch:x86

ff49fc5a9a7c8e3ae3ba4abbcff60845

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

b5:45:9b:84:8b:2f:54:eb:6d:5c:90:eb:6a:db:34:dc:ee:c4:28:f5:72:e0:9d:ed:8a:20:40:8f:8f:c3:83:ef
Signer

Actual PE Digest

b5:45:9b:84:8b:2f:54:eb:6d:5c:90:eb:6a:db:34:dc:ee:c4:28:f5:72:e0:9d:ed:8a:20:40:8f:8f:c3:83:ef

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceExW
FindClose
FindNextFileW
FindFirstFileW
GetCurrentThreadId
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
GetModuleHandleW
lstrlenW
GetLastError
InitializeCriticalSection
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
lstrcmpiW
LoadResource
FlushFileBuffers
CreateFileA
LockResource
SizeofResource
FindResourceW
RaiseException
GetFileAttributesW
WaitForSingleObject
CloseHandle
CreateProcessW
GetTempPathW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetModuleFileNameW
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
ExitProcess
RtlUnwind
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetFilePointer
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LoadLibraryA
LCMapStringA
LCMapStringW

user32

DefWindowProcW
CharNextW
DestroyWindow

advapi32

RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW

ole32

CoUninitialize
CoTaskMemFree
CoInitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameW
PathRemoveFileSpecW
PathAddBackslashW

comctl32

InitCommonControlsEx

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/unins000.dat
Skillbrains/lightshot/unins000.exe
.exe windows:5 windows x86 arch:x86

f62b90e31eca404f228fcf7068b00f31

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07
Certificate

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

03/05/2011, 07:00

Not After

03/05/2031, 07:00

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c9:34:23:ce:0c:60:66:67
Certificate

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Not Before

30/05/2019, 00:39

Not After

30/05/2022, 00:39

Subject

CN=Kilonova LLC,O=Kilonova LLC,L=Seattle,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

df:d6:c0:42:1b:76:41:3e:55:92:91:9b:31:be:4d:78:a6:21:68:46:33:37:2d:24:14:5e:01:ed:27:ac:7e:17
Signer

Actual PE Digest

df:d6:c0:42:1b:76:41:3e:55:92:91:9b:31:be:4d:78:a6:21:68:46:33:37:2d:24:14:5e:01:ed:27:ac:7e:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
GetActiveObject
RegisterTypeLib
LoadTypeLib
SysFreeString
SafeArrayPtrOfIndex
SafeArrayPutElement
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopyInd
VariantCopy
VariantClear
VariantInit
SysFreeString

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
OpenThreadToken
OpenProcessToken
LookupPrivilegeValueW
InitializeSecurityDescriptor
GetUserNameW
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
AdjustTokenPrivileges

user32

GetKeyboardType
LoadStringW
MessageBoxA
CharNextW
CreateWindowExW
WindowFromPoint
WaitMessage
WaitForInputIdle
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetWindowLongW
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRectEmpty
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursor
SetClassLongW
SetCapture
SetActiveWindow
SendNotifyMessageW
SendMessageTimeoutW
SendMessageA
SendMessageW
ScrollWindowEx
ScrollWindow
ScreenToClient
ReplyMessage
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OffsetRect
OemToCharBuffA
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowLongW
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageW
GetMenuStringW
GetMenuState
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClientRect
GetClassLongW
GetClassInfoW
GetCapture
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
ExitWindowsEx
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EnableWindow
EnableScrollBar
EnableMenuItem
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIcon
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BringWindowToTop
BeginPaint
AppendMenuW
CharToOemBuffA
AdjustWindowRectEx
ActivateKeyboardLayout

kernel32

GetACP
Sleep
VirtualFree
VirtualAlloc
GetSystemInfo
GetTickCount
QueryPerformanceCounter
GetVersion
GetCurrentThreadId
VirtualQuery
WideCharToMultiByte
SetCurrentDirectoryW
MultiByteToWideChar
lstrlenW
lstrcpynW
LoadLibraryExW
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetCurrentDirectoryW
GetCommandLineW
FreeLibrary
FindFirstFileW
FindClose
ExitProcess
ExitThread
CreateThread
CompareStringW
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleW
lstrcpyW
lstrcmpW
WriteProfileStringW
WritePrivateProfileStringW
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualFree
VirtualAlloc
TransactNamedPipe
TerminateProcess
SwitchToThread
SizeofResource
SignalObjectAndWait
SetThreadLocale
SetNamedPipeHandleState
SetLastError
SetFileTime
SetFilePointer
SetFileAttributesW
SetEvent
SetErrorMode
SetEndOfFile
SetCurrentDirectoryW
ResumeThread
ResetEvent
RemoveDirectoryW
ReleaseMutex
ReadFile
QueryPerformanceCounter
OpenProcess
OpenMutexW
MultiByteToWideChar
MulDiv
MoveFileExW
MoveFileW
LockResource
LocalFree
LocalFileTimeToFileTime
LoadResource
LoadLibraryExW
LoadLibraryW
LeaveCriticalSection
IsDBCSLeadByte
IsBadWritePtr
InitializeCriticalSection
GlobalFindAtomW
GlobalDeleteAtom
GlobalAddAtomW
GetWindowsDirectoryW
GetVersionExW
GetVersion
GetUserDefaultLangID
GetTickCount
GetThreadLocale
GetSystemTimeAsFileTime
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetShortPathNameW
GetProfileStringW
GetProcAddress
GetPrivateProfileStringW
GetOverlappedResult
GetModuleHandleW
GetModuleFileNameW
GetLogicalDrives
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileSize
GetFileAttributesW
GetExitCodeThread
GetExitCodeProcess
GetEnvironmentVariableW
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCurrentDirectoryW
GetComputerNameW
GetCommandLineW
GetCPInfo
FreeResource
InterlockedIncrement
InterlockedExchangeAdd
InterlockedExchange
InterlockedDecrement
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FlushFileBuffers
FindResourceW
FindNextFileW
FindFirstFileW
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
EnumCalendarInfoW
EnterCriticalSection
DeviceIoControl
DeleteFileW
DeleteCriticalSection
CreateThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateFileW
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareFileTime
CloseHandle
Sleep

msimg32

AlphaBlend

gdi32

UnrealizeObject
StretchBlt
SetWindowOrgEx
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
RemoveFontResourceW
Rectangle
RectVisible
RealizePalette
Polyline
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
LineDDA
IntersectClipRect
GetWindowOrgEx
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetDCOrgEx
GetCurrentPositionEx
GetClipBox
GetBrushOrgEx
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExcludeClipRect
EnumFontsW
Ellipse
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
Chord
BitBlt
Arc
AddFontResourceW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

mpr

WNetOpenEnumW
WNetGetUniversalNameW
WNetGetConnectionW
WNetEnumResourceW
WNetCloseEnum

comctl32

InitCommonControls
InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Remove
ImageList_DrawEx
ImageList_Draw
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CLSIDFromProgID
CLSIDFromString
StringFromCLSID
CoCreateInstance
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
IsEqualGUID
CoDisconnectObject

shell32

ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
ExtractIconW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

Sections

.text
Size: 1016KB - Virtual size: 1016KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 24KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 60B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 458KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Skillbrains/lightshot/unins000.msg

Sharing

General

Malware Config

Signatures

Files

6c0552d294568c9d955df768391ff0c2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7aCertificate

Extended Key Usages

Key Usages

7f:47:36:71:91:08:3e:f1:67:e6:60:99:fa:2b:b8:96:d0:10:d1:b7:0d:dd:d3:96:57:31:66:8f:f3:52:e5:66Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

psapi

wtsapi32

rpcrt4

urlmon

wininet

Sections

.text Size: 641KB - Virtual size: 640KB

.rdata Size: 145KB - Virtual size: 145KB

.data Size: 19KB - Virtual size: 35KB

.rsrc Size: 10KB - Virtual size: 10KB

.reloc Size: 32KB - Virtual size: 31KB

04d8c0d95175abb34cd9a1d78b8f7ee3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7aCertificate

Extended Key Usages

Key Usages

a6:59:f4:e1:65:a7:16:7b:4f:86:2e:89:74:00:1c:22:68:ec:ca:6a:ee:0e:85:8f:60:7c:bf:83:65:a2:09:daSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

shlwapi

Sections

.text Size: 242KB - Virtual size: 242KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 2KB - Virtual size: 7KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 104KB - Virtual size: 103KB

.reloc Size: 9KB - Virtual size: 9KB

8e55ea89e532d567e141d1a61186f294

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7a
Certificate

7f:47:36:71:91:08:3e:f1:67:e6:60:99:fa:2b:b8:96:d0:10:d1:b7:0d:dd:d3:96:57:31:66:8f:f3:52:e5:66
Signer

.text
Size: 641KB - Virtual size: 640KB

.rdata
Size: 145KB - Virtual size: 145KB

.data
Size: 19KB - Virtual size: 35KB

.rsrc
Size: 10KB - Virtual size: 10KB

.reloc
Size: 32KB - Virtual size: 31KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

56:29:7b:78:d8:b9:b2:28:15:f2:26:b9:97:43:d4:7a
Certificate

a6:59:f4:e1:65:a7:16:7b:4f:86:2e:89:74:00:1c:22:68:ec:ca:6a:ee:0e:85:8f:60:7c:bf:83:65:a2:09:da
Signer

.text
Size: 242KB - Virtual size: 242KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 2KB - Virtual size: 7KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 104KB - Virtual size: 103KB

.reloc
Size: 9KB - Virtual size: 9KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate

4e:3f:00:ce:85:7a:2a:56:69:b5:87:89:a1:67:b2:fc:df:98:2e:e6:d3:4a:06:34:8e:11:9e:cd:b1:47:7d:72
Signer

.text
Size: 52KB - Virtual size: 51KB

.rdata
Size: 25KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 5KB

.gfids
Size: 512B - Virtual size: 216B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

07
Certificate

c9:34:23:ce:0c:60:66:67
Certificate

0d:2d:69:7f:6c:bf:47:69:d9:4f:2f:1d:57:b5:a2:f7:48:24:17:9d:f6:bf:5c:1d:20:7d:40:59:b6:eb:71:c5
Signer

.text
Size: 167KB - Virtual size: 166KB

.rdata
Size: 51KB - Virtual size: 51KB

.data
Size: 5KB - Virtual size: 9KB

.gfids
Size: 512B - Virtual size: 276B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 247KB - Virtual size: 246KB

.reloc
Size: 11KB - Virtual size: 11KB