PBCCRCPassGuardEdge[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

PBCCRCPassGuardEdge.exe
Size

2.7MB
MD5

c0568331b9984599f57d7bbe11e17cd9
SHA1

4860334bc492832586a10f28aaa4c1e9c59ed847
SHA256

57a1929e2863a92d4e1dfdc5c0f34edfd28e7b7a8995a5afb5da3653d1ca4856
SHA512

cb58825cef114ca73eac6bbf5995077c5b34a627a36b5557c1be591aec5312b2ce1708b01cfe7db665f8586e3e5181e2ff455a487a2ea6718784ae8cbbd226f6
SSDEEP

49152:FtXXx7d5hSa3sWgOAhnvpAyw0rqMjdomso+NMnCPFLesr8xEZgCCDPLpGrpWBATJ:h7d5IalgOAjyaqM59sbNMnyezxEZ87LS

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/killer.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

PBCCRCPassGuardEdge.exe
.exe windows:4 windows x86 arch:x86

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:96:9d:5e:3b:1b:50:e2:0b:4f:f8:42:9c:f0:1e:6a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:3c:25:43:23:a8:6b:33:e8:41:02:39:7a:40:f3:99
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

31:da:64:20:05:e9:ac:7d:be:94:0b:8a:ba:e4:b0:d7:ae:8e:27:fb:98:31:cc:21:40:d7:ec:56:82:62:30:09
Signer

Actual PE Digest

31:da:64:20:05:e9:ac:7d:be:94:0b:8a:ba:e4:b0:d7:ae:8e:27:fb:98:31:cc:21:40:d7:ec:56:82:62:30:09

Digest Algorithm

sha256

PE Digest Matches

true

5a:84:01:4c:cf:55:9c:65:04:b1:f2:08:b3:dc:55:a9:9b:1d:ab:65
Signer

Actual PE Digest

5a:84:01:4c:cf:55:9c:65:04:b1:f2:08:b3:dc:55:a9:9b:1d:ab:65

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary

user32

CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 68KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersionExA
TerminateProcess
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
FreeLibrary
GlobalFree
lstrcpyA
DisableThreadLibraryCalls

msvcrt

strcmp
_strupr
toupper
strlen
free
_initterm
malloc
_adjust_fdiv
strcpy
_itoa

Exports

Exports

KillProc

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 835B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 582B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/killer.dll
.dll windows:6 windows x86 arch:x86

1e610ae5b22b178828e96c6a76ffe702

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateToolhelp32Snapshot
Process32First
GetCurrentProcessId
lstrcmpiA
CloseHandle
TerminateProcess
Process32Next
lstrcpynA
GetCurrentProcess
GlobalFree
OpenProcess
GlobalAlloc
IsProcessorFeaturePresent

user32

wsprintfA

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

IsProcessRunning
KillProcess

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

38e7b5c3ee58b43a91f9679e94aabd09

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
GetPropA
CharPrevA
MapWindowPoints
DrawFocusRect
GetWindowLongA
GetClientRect
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
LoadCursorA
RemovePropA
DrawTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 616B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/certmgr.exe
.exe windows:6 windows x86 arch:x86

bd490e9e0eeda7d29c71947cf7f73ea0

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:32

Not After

10-01-2013 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:19:96:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25-07-2011 20:42

Not After

25-10-2012 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10-10-2011 20:45

Not After

10-01-2013 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:16:bc:15:52:dc:9f:0a:0e:6b:fe:3f:ae:29:0e:19:83:b7:17:d9:5f:0e:2d:b5:b8:a4:90:17:08:af:1a:8c
Signer

Actual PE Digest

0c:16:bc:15:52:dc:9f:0a:0e:6b:fe:3f:ae:29:0e:19:83:b7:17:d9:5f:0e:2d:b5:b8:a4:90:17:08:af:1a:8c

Digest Algorithm

sha256

PE Digest Matches

true

cb:e0:44:03:8d:d3:5f:41:25:2f:61:98:ba:f2:e1:24:5e:68:60:ae
Signer

Actual PE Digest

cb:e0:44:03:8d:d3:5f:41:25:2f:61:98:ba:f2:e1:24:5e:68:60:ae

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

CertMgr.pdb

Imports

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

GetSystemTime
CreateFileW
CreateFileMappingA
WideCharToMultiByte
WriteFile
MapViewOfFile
GetFileSize
GetTickCount
GetSystemTimeAsFileTime
MultiByteToWideChar
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
Sleep
GetCurrentThreadId
SystemTimeToFileTime
UnmapViewOfFile
FileTimeToSystemTime
GetLastError
SetLastError
GetModuleHandleA
HeapSetInformation
CloseHandle
FileTimeToLocalFileTime
CompareFileTime

msvcrt

free
scanf
wprintf
strtok
printf
_vsnwprintf
_wasctime
realloc
towupper
_wtol
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
?terminate@@YAXXZ
_controlfp
_except_handler4_common
_wcsicmp
malloc
vwprintf
memcmp
memcpy
memset

user32

LoadStringA
LoadStringW

crypt32

CryptHashPublicKeyInfo
CertSetCertificateContextProperty
CryptEncodeObject
CryptMsgGetAndVerifySigner
CertSaveStore
CertAddEncodedCRLToStore
CertDeleteCTLFromStore
CryptMsgOpenToDecode
CertRDNValueToStrW
CryptStringToBinaryW
CertDuplicateCTLContext
CertAddCRLContextToStore
CertDuplicateCertificateContext
CryptMsgGetParam
CryptInitOIDFunctionSet
CertFreeCTLContext
CertDuplicateCRLContext
CertEnumCertificatesInStore
CertGetCTLContextProperty
CertEnumCTLsInStore
CertGetCertificateContextProperty
CryptMsgUpdate
CertGetCRLContextProperty
CertAddEncodedCTLToStore
CertGetCRLFromStore
CryptInstallOIDFunctionAddress
CertCloseStore
CertFindCertificateInStore
CryptSIPRetrieveSubjectGuid
CertAddCertificateContextToStore
CertFindCTLInStore
CertFreeCertificateContext
CertGetPublicKeyLength
CertOpenStore
CertAddEncodedCertificateToStore
CryptGetOIDFunctionAddress
CertFreeCRLContext
CryptSIPLoad
CryptStringToBinaryA
CryptFreeOIDFunctionAddress
CertRDNValueToStrA
CertEnumCertificateContextProperties
CryptDecodeObject
CertDeleteCertificateFromStore
CryptFindOIDInfo
CertAddCTLContextToStore
CertDeleteCRLFromStore
CryptMsgClose

cryptui

CryptUIDlgCertMgr

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/certutil.exe
.exe windows:6 windows x86 arch:x86

43467bab58091396e54cd8edc93c68f5

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:c1:71:19:42:f3:07:78:05:5a:15:59:74:e6:45:81
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13-01-2015 00:00

Not After

11-02-2017 23:59

Subject

CN=北京微通新成网络科技有限公司,O=北京微通新成网络科技有限公司,L=BeiJing,ST=BeiJing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ce:e8:34:39:1a:77:2d:ae:30:c2:d3:bf:ec:9a:42:60:6f:7d:94:6f
Signer

Actual PE Digest

ce:e8:34:39:1a:77:2d:ae:30:c2:d3:bf:ec:9a:42:60:6f:7d:94:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

certutil.pdb

Imports

advapi32

CryptAcquireContextW
CryptReleaseContext
RevertToSelf
ImpersonateSelf
GetSecurityDescriptorLength
IsValidSecurityDescriptor
CryptDestroyHash
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyKey
CryptEncrypt
CryptDuplicateKey
CryptDecrypt
CryptImportKey
CryptGenKey
CryptGetUserKey
CryptGenRandom
CryptSetKeyParam
CopySid
GetLengthSid
GetTokenInformation
LookupAccountSidW
OpenProcessToken
CryptGetProvParam
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegEnumValueW
RegCreateKeyW
RegEnumKeyW
RegDeleteKeyW
RegDeleteValueW
CryptSetProvParam
CryptVerifySignatureW
RegOpenKeyW
CryptExportKey
CryptDuplicateHash
CryptSetHashParam
CryptGetKeyParam
CryptSignHashW
SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorDacl
SetEntriesInAclW
GetSecurityDescriptorDacl
EqualSid
GetAce
GetAclInformation
GetSecurityDescriptorControl
ConvertStringSidToSidW
LookupAccountNameW
MakeSelfRelativeSD
MakeAbsoluteSD
OpenThreadToken
FreeSid
CheckTokenMembership
DuplicateToken
AllocateAndInitializeSid
LsaClose
LsaFreeMemory
LsaOpenPolicy
ConvertSidToStringSidW
CryptGetDefaultProviderW
CryptEnumProvidersA
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCreateKeyExW
CryptContextAddRef
RegConnectRegistryW
LsaRetrievePrivateData
LsaStorePrivateData
AddAccessDeniedObjectAce
AddAccessAllowedObjectAce
AddAccessDeniedAce
AddAccessAllowedAce
InitializeSecurityDescriptor
SetNamedSecurityInfoW
InitializeAcl
AddAce

kernel32

FindFirstFileW
FindNextFileW
FindClose
GetFullPathNameW
LocalFileTimeToFileTime
FileTimeToSystemTime
GetCurrentThread
HeapSetInformation
WriteFile
MultiByteToWideChar
UnhandledExceptionFilter
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
OutputDebugStringA
GetStartupInfoW
Sleep
InterlockedExchange
DelayLoadFailureHook
GetSystemInfo
CompareStringW
LoadLibraryExW
GetSystemDirectoryW
LockResource
LoadResource
FindResourceW
GetTimeFormatW
RemoveDirectoryW
GetConsoleOutputCP
FileTimeToLocalFileTime
GetEnvironmentVariableA
WideCharToMultiByte
GetACP
WriteConsoleW
VirtualAlloc
VirtualFree
lstrlenW
SetEvent
InterlockedDecrement
CreateEventW
ResetEvent
InterlockedIncrement
GetProfileStringA
LoadLibraryExA
GetCommandLineW
FindResourceExW
GetLocaleInfoW
LoadLibraryA
InterlockedCompareExchange
VerSetConditionMask
VerifyVersionInfoW
EnterCriticalSection
SetConsoleCtrlHandler
LeaveCriticalSection
GetVersionExW
GetTickCount
GetComputerNameW
CreateDirectoryW
FoldStringW
UnmapViewOfFile
MapViewOfFile
GetDateFormatW
CreateFileMappingW
GetComputerNameExW
CreateFileW
GetFileSize
SetFilePointer
ReadFile
LoadLibraryW
DecodePointer
EncodePointer
GetFileAttributesExW
GetCurrentProcess
GetEnvironmentVariableW
GetTempFileNameW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
OpenEventW
PulseEvent
GetModuleHandleW
LocalReAlloc
GetLastError
InitializeCriticalSection
DeleteCriticalSection
GetSystemDefaultLangID
HeapFree
GetProcessHeap
HeapAlloc
FormatMessageW
DeleteFileW
lstrcmpiW
GetProcAddress
SetLastError
GetStdHandle
GetFileType
GetConsoleMode
SetConsoleMode
CreateThread
WaitForSingleObject
GetExitCodeThread
CloseHandle
GetSystemTime
SystemTimeToFileTime
lstrcmpW
CompareFileTime
FreeLibrary
LocalAlloc
GetSystemTimeAsFileTime
GetFileAttributesW
LocalFree
SearchPathW

msvcrt

_wgetenv
getenv
_wsetlocale
atoi
fgetc
_wfopen
fgetws
wcstoul
fwrite
ftell
sscanf
strspn
strpbrk
bsearch
vfwprintf
__iob_func
??1type_info@@UAE@XZ
isxdigit
_controlfp
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
malloc
_callnewh
free
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
_errno
__CxxFrameHandler
_ultow
_purecall
wcsncmp
_wcsnicmp
_wcslwr
_swab
fopen
fgets
strchr
strstr
fputs
fseek
strcspn
ferror
fclose
fprintf
_strlwr
qsort
strncmp
atol
isdigit
_vsnprintf
_wcsicmp
_wtoi
_stricmp
swscanf
_strnicmp
_fileno
_setmode
wcscspn
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsstr
wcsspn
_iob
fflush
_fgetwchar
_CxxThrowException
iswdigit
wcsrchr
_vsnwprintf
wcschr
wcstok
memcpy
memmove
memset
iswspace
__isascii
iswalpha
_wtol
iswxdigit
gmtime
feof

certcli

ord217
ord225
ord223
ord254
ord207
ord206
ord213
CACloseCertType
CAFreeCertTypeProperty
CAGetCertTypeProperty
CAFindCertTypeByName
CAFreeCertTypeExtensions
CAGetCertTypeExtensions
CAGetCertTypeExpiration
CAGetCertTypeKeySpec
CAGetCertTypePropertyEx
CAGetCertTypeFlagsEx
CAUpdateCA
ord242
ord211
ord208
ord252
ord255
ord253
ord205
ord203
ord215
ord260
ord247
ord210
CACreateNewCA
CASetCAProperty
CASetCAFlags
CASetCACertificate
CASetCASecurity
ord246
CAEnumFirstCA
CACountCAs
CAGetCACertificate
CAGetCAExpiration
CACountCertTypes
ord218
ord256
ord258
CAAccessCheck
CAFindByCertType
CAFindByName
CAGetCAProperty
CAFreeCAProperty
CAEnumNextCA
CACloseCA
CAEnumCertTypesForCA
CAEnumCertTypes
CACertTypeAccessCheck
CAEnumNextCertType

comctl32

InitCommonControlsEx

cryptui

CryptUIDlgFreeCAContext
CryptUIDlgViewCRLW
CryptUIDlgViewCertificateW

gdi32

GetStockObject

netapi32

NetUserGetGroups
DsGetDcNameW
NetApiBufferFree

ntdll

RtlFindMessage
RtlTimeToSecondsSince1970
NtQuerySystemTime
RtlUnwind

ntdsapi

DsGetDomainControllerInfoW
DsBindW
DsFreeDomainControllerInfoW
DsCrackNamesW
DsUnBindW
DsFreeNameResultW

setupapi

SetupFindNextLine
SetupGetFieldCount
SetupGetStringFieldW
SetupFindFirstLineW
SetupOpenInfFileW
SetupCloseInfFile
SetupGetIntField
SetupGetLineCountW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wldap32

ord147
ord167
ord142
ord79
ord140
ord224
ord127
ord41
ord27
ord26
ord36
ord210
ord208
ord73
ord14
ord145
ord13
ord113
ord203
ord155
ord16
ord18
ord12
ord65

crypt32

CertAddCTLContextToStore
CertAddCRLContextToStore
CryptImportPublicKeyInfo
CertEnumSystemStoreLocation
CertEnumSystemStore
CertEnumPhysicalStore
CertControlStore
CertDeleteCRLFromStore
CertDuplicateCRLContext
CertSetCTLContextProperty
CertSetCRLContextProperty
CertEnumCertificateContextProperties
CertEnumCRLContextProperties
CertGetCRLContextProperty
CertEnumCTLContextProperties
CertGetCTLContextProperty
CertSetStoreProperty
CryptExportPublicKeyInfo
CertEnumCTLsInStore
CertDeleteCertificateFromStore
CertGetNameStringW
CertSaveStore
CertGetCertificateChain
CertFreeCertificateChain
CertCreateCTLContext
CertFreeCTLContext
CertDuplicateCertificateContext
CryptVerifyCertificateSignature
CertAddCertificateContextToStore
PFXIsPFXBlob
CryptMsgGetParam
CryptMsgGetAndVerifySigner
CryptMsgControl
CertGetPublicKeyLength
CryptFormatObject
CryptFindCertificateKeyProvInfo
CryptAcquireCertificatePrivateKey
CertAddEncodedCertificateToStore
CertEnumCertificatesInStore
CertCompareCertificateName
CryptEnumOIDInfo
CryptDecodeObject
CertCreateCRLContext
CertEnumCRLsInStore
CertFreeCRLContext
CertFindCertificateInStore
CertSetCertificateContextProperty
CertOpenStore
CertCreateCertificateContext
CryptMsgClose
CertCloseStore
CertGetCertificateContextProperty
CryptFindOIDInfo
CryptEncodeObjectEx
CertFreeCertificateContext
CertComparePublicKeyInfo
CertVerifyRevocation
CertVerifyTimeValidity
CertVerifyCRLTimeValidity
CryptHashCertificate
CertFindExtension
CertGetEnhancedKeyUsage
CryptVerifyCertificateSignatureEx
CertVerifySubjectCertificateContext
CryptSignAndEncodeCertificate
CryptSignMessage
CryptHashPublicKeyInfo
CryptDecryptMessage
PFXImportCertStore
CertStrToNameW
CertNameToStrW
CryptEncryptMessage
CertVerifyCertificateChainPolicy
CertGetIntendedKeyUsage
CryptFreeOIDFunctionAddress
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertAddCertificateLinkToStore
PFXExportCertStore
PFXExportCertStoreEx
CryptMsgUpdate
CryptMsgOpenToDecode
CryptSignCertificate
CryptDecodeObjectEx

ole32

CoUninitialize
CoInitialize
CoCreateInstance
CoInitializeEx
CoTaskMemFree
StringFromCLSID
ProgIDFromCLSID
CLSIDFromString
CLSIDFromProgID
CoCreateInstanceEx
CoSetProxyBlanket
CoTaskMemAlloc

oleaut32

VariantTimeToSystemTime
SystemTimeToVariantTime
VariantCopyInd
SetErrorInfo
CreateErrorInfo
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysAllocStringLen
SysStringLen

rpcrt4

NdrClientCall2
UuidCreate

secur32

GetComputerObjectNameW
TranslateNameW
GetUserNameExW

user32

IsDlgButtonChecked
ShowWindow
GetWindowLongW
CallWindowProcW
LoadStringW
SetFocus
GetWindowTextW
PostQuitMessage
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
PostMessageW
UpdateWindow
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
SendMessageW
MessageBoxW
EnableWindow
GetDlgItem
SetDlgItemTextW
SetCursor
SetDlgItemInt
CheckDlgButton
SendDlgItemMessageA
EndDialog
GetDlgItemInt
GetDlgItemTextW
SetWindowTextW
DialogBoxParamW
SetWindowLongW

Sections

.text
Size: 713KB - Virtual size: 713KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/wosign.cer
PBCCRCPassGuardX.exe
.exe windows:5 windows x86 arch:x86

93b5873eff41c5658dfd93d0d99b64ea

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:96:9d:5e:3b:1b:50:e2:0b:4f:f8:42:9c:f0:1e:6a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:3c:25:43:23:a8:6b:33:e8:41:02:39:7a:40:f3:99
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

9e:b4:e8:f1:40:fd:66:bf:ab:46:4e:14:d5:6c:7d:8d:85:bb:15:47:5b:59:e5:4d:80:5d:66:c7:22:33:8c:f5
Signer

Actual PE Digest

9e:b4:e8:f1:40:fd:66:bf:ab:46:4e:14:d5:6c:7d:8d:85:bb:15:47:5b:59:e5:4d:80:5d:66:c7:22:33:8c:f5

Digest Algorithm

sha256

PE Digest Matches

true

2b:00:4d:bf:d4:b0:08:0c:fd:e2:93:4d:3e:58:e0:3a:97:1a:c8:19
Signer

Actual PE Digest

2b:00:4d:bf:d4:b0:08:0c:fd:e2:93:4d:3e:58:e0:3a:97:1a:c8:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\PassGuard\PassGuard_IE\PassGuard_general\Release\passguardwin7ins.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

LocalAlloc
DeviceIoControl
CloseHandle
GetVersion
DebugBreak
LocalFree
FreeResource
FindResourceExW
FindResourceW
FreeLibrary
LoadResource
MoveFileExW
GetCurrentProcess
GetModuleHandleW
GetLastError
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
SizeofResource
GetModuleFileNameW
MultiByteToWideChar
GetProcAddress
LockResource
OutputDebugStringA
FlushFileBuffers
lstrlenW
CreateFileW
Sleep
OutputDebugStringW
InterlockedDecrement
lstrlenA
WriteConsoleW
SetEndOfFile
WriteFile
HeapDestroy
SetStdHandle
CreateFileA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
ReadFile
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
MoveFileA
GetFileAttributesA
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetStringTypeW
IsProcessorFeaturePresent
ExitProcess
GetStdHandle
HeapCreate
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
LCMapStringW

user32

CharNextW
wvsprintfW
MessageBoxW

advapi32

ControlService
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
CreateServiceW
QueryServiceConfigW

shlwapi

StrCmpIW
PathFileExistsW

Sections

.text
Size: 61KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 939KB - Virtual size: 938KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PBCCRCPassGuardXInput.exe
.exe windows:5 windows x86 arch:x86

2dbdcfa87d330575c724e3290b991423

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

05:96:9d:5e:3b:1b:50:e2:0b:4f:f8:42:9c:f0:1e:6a
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:3c:25:43:23:a8:6b:33:e8:41:02:39:7a:40:f3:99
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21-03-2019 00:00

Not After

25-03-2021 12:00

Subject

CN=北京微通新成网络科技有限公司,OU=软件部,O=北京微通新成网络科技有限公司,L=北京,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

92:49:65:8a:a4:cf:33:0c:85:b3:9f:8d:92:26:94:45:20:a8:7c:ab:f0:a1:13:b2:f7:87:51:26:de:05:97:b8
Signer

Actual PE Digest

92:49:65:8a:a4:cf:33:0c:85:b3:9f:8d:92:26:94:45:20:a8:7c:ab:f0:a1:13:b2:f7:87:51:26:de:05:97:b8

Digest Algorithm

sha256

PE Digest Matches

true

cc:09:d7:4c:b1:4b:ef:98:a9:1d:b1:bc:05:c7:16:d3:e7:af:76:24
Signer

Actual PE Digest

cc:09:d7:4c:b1:4b:ef:98:a9:1d:b1:bc:05:c7:16:d3:e7:af:76:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\LYB_WORK\PassGuardNew\Release\SecurityInput.pdb

Imports

kernel32

WriteFile
ReadFile
CreateDirectoryA
CreateSemaphoreA
ReleaseSemaphore
CreateMutexA
GetCurrentThreadId
ReleaseMutex
SetUnhandledExceptionFilter
LocalFree
CreateThread
ExitProcess
SetFilePointer
CreateProcessA
GetTimeZoneInformation
GetStartupInfoA
FindFirstFileA
FindClose
LoadLibraryA
CreatePipe
FindNextFileA
PeekNamedPipe
GetFileInformationByHandle
GetFullPathNameA
FindFirstFileExA
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
SetConsoleMode
ReadConsoleInputA
GetLocalTime
GetLocaleInfoA
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
ExpandEnvironmentStringsA
GetCurrentProcessId
GetModuleHandleA
GetModuleFileNameA
GetExitCodeThread
EnterCriticalSection
GetProcAddress
lstrcmpiA
GetSystemDirectoryA
LeaveCriticalSection
Sleep
OpenProcess
GetTickCount
WaitForSingleObject
GetModuleHandleExA
CloseHandle
GetVersionExA
DeviceIoControl
GetLastError
GetCurrentProcess
SetPriorityClass
CreateFileA
LockResource
RaiseException
SizeofResource
VirtualFree
GetVersionExW
FlushConsoleInputBuffer
GlobalMemoryStatus
GetVersion
SetEnvironmentVariableA
SetEndOfFile
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
FreeLibrary
WideCharToMultiByte
LoadResource
FindResourceW
GetCurrentDirectoryW
FindResourceExW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleMode
GetDriveTypeW
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
LCMapStringW
GetCPInfo
CompareStringW
RtlUnwind
HeapSetInformation
GetCommandLineA
GetModuleHandleW
ResumeThread
ExitThread
GetSystemTimeAsFileTime
MultiByteToWideChar
InterlockedExchange
DecodePointer
EncodePointer
InterlockedDecrement
InterlockedIncrement
HeapSize
HeapReAlloc
HeapDestroy
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetProcAddress
GetLastError
FreeLibrary
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
HeapAlloc
HeapFree
HeapDestroy
HeapCreate
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
LCMapStringA
LCMapStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
RtlUnwind
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

TranslateMessage
SendMessageA
CallNextHookEx
GetKeyboardState
ToAscii
PostQuitMessage
GetMessageA
keybd_event
GetForegroundWindow
GetMonitorInfoA
MessageBeep
GetProcessWindowStation
GetUserObjectInformationW
CreateWindowExA
DefWindowProcA
SetWindowsHookExA
ShowWindow
MessageBoxA
RegisterClassA
LoadCursorA
EnumDisplayMonitors
DispatchMessageA
UnhookWindowsHookEx
UpdateWindow
GetKeyState
MessageBoxW
CharUpperBuffW

advapi32

ReportEventA
DeregisterEventSource
CloseServiceHandle
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegisterEventSourceA

shell32

ShellExecuteExA
SHGetFolderPathA

ole32

CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoInitialize

shlwapi

PathRemoveFileSpecA
PathAppendA
PathFileExistsA
SHRegGetUSValueA

iphlpapi

GetAdaptersInfo

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

psapi

GetModuleBaseNameA
GetModuleFileNameExA
EnumProcesses

ws2_32

getaddrinfo
listen
accept
gethostname
ntohs
ioctlsocket
WSAGetLastError
recv
bind
gethostbyname
closesocket
socket
WSACleanup
htons
inet_ntoa
WSAStartup
shutdown
WSASetLastError
send

oleaut32

SysAllocStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString

Exports

Exports

h��d@��1K.��?C#�\ �:aQY�o��Q0w�b�t��Y*]W��7 ��@(7�� ,��H� �(I��}�c�ge�s�]�m��e/s��,g�xH��_��w�̾)e��I��&�f'�/K��#4�%~O/�g�}��+�<R )��¦[oC3ɉɸA��c��/�Z&�/%U>�:#�Շȹ�$�]�Y�BT�֗�H��)J2)�h��]��%\yPX}(ۜ��\��t�Fr��C(ئ4ʐ�m�WI_LG*i��B��հ]Jt�8�'��A��/��I��C��}wd\�y6x�.�y�m�z��=��$D~ ׾q��0A֍Z��b��ô�{��<��F�~�U1K�u�j�l�\� ��K��=�g�� g��R�b?-W!�ד_EQE��4��?��OϞ'O>`yn;�b��=~�z�m(>)�� s�[Z6�%1��@uXY/4S�D�@�p�o��py�.�«Hs`.��H�:!b��#�g]kW��ʬ�ӆ2��r�gt��87A�y; U��RN��gbV�ű��э�jf��3ސ�7�k]�[��8w��b}2J��Q�L<��"��/��ͷ��D��a7nsj�I�!�9Y�=Q��w��~�B`�vF ��a�I=;��*Ω�AȌ��)��2�� ~ҧ@b�pLay �RWJ�\�H��W�| � L��R�<��w��/xW��u��_;-�>��!H��4o"b��utJ�<\K6I\Q),J�t?�D�L�d��+Q��C��G̵��B��߆�>��e��qONu��7ӆ��B��rn��$z��*�k��>�V8Q��1��T��H��6+3��0#�"��.��,��wE��{K��I�^��{��ɻ�w�d�I|��2��x�0�� к�fBZ�1�v��4��$e��x�y�8HE��#f��9#�n��x��]��O��C��I�[��L/��wp��=�%��]op�#,UG�;��&z�x ��y�gH �K��Ǟ��Δ�*V�Tg��q��#�Ō��i�,�^>�lK�R~Z�P��d��'`�p_Pŝh�Fm%��D!��G]O��=��6�w�/!��@�G�oeF�9U[mEl��]d��S��I��c��/��m��`�R��[��d�̸�|��$��u#K�gE+��_MO�gr��}��^#V�#��j�ᑨJV$��6�:[:��t"d¤�2 ��Y>7��*suOt��s�Q҆��2�-�5��H��i��$9Iz�P��{�W�&�[�B,tA;&��0��)"bQ��E`Y��x��K,�Zr��e��w��V��Z�)��O��jݠ�+��ty.[y��֟��@E��Z&J$�bd��ċ�C��1��5ڱ�h�o,�!Y�CG;�Y#�E;ᑧ!��c��p��w��;UhC��'� �pR��*��u�Ń��{�yL+�Ϭ-��h�=�o�sKF}��D��D�\ �i�~D��Y3�wu4AT2��8]�66�߀��б��?A߰u��v�m_�:��|[��k-��A�?N�g��a�x�ӧ��j$�rW`��к�z�UW�h��"�W��m��0LT��X��v�dr��b�솵h�;�t�]��E!yxϦH�t�MGQ�X3��y�Ip$X*�(��i��%�[o�TA>]g�;�]3��hk�:*ں�5��Xi�нD(��"��:�}��$��[�#l ��Ϡޜ��nM��IZ�1[�$x��h2YĘ��@��a��H�>��v�i��L��?�1�#[ �}��(�[q+��$�*š�=l��-�A�q��~|�н�[u�� P��I�T/�ҋv�N(��kE�q�P��Zɨ��2^��&�:��H%֜Q��<�=��&@��yl�߀A�?@4�d��n��ަf1�>�I^-�}�P��S��f�5 L��@�b�l�i�W�pX��56:�B�g\)Կ�P��h�B��|��T��>�Z�^��}˳�|�j�=�-)J�bnc�RW8� l�9H ;|��.�X�{|�v�p�� k��K��0�E��gԝ��+G��Q�B��(v��2�ԡֿ��]��r��WZ#ƚe)��vLQ6��)"��ob�j�x��٤�/s��A��ʚ2d6~�Y(!�6�gxt:�̯��e�?�'�L��۽GBe(��}��K(cah9ƥ��2�eK��<*�pTl:�[{�2�y];nςGh�WF�,R��@g��y��a$��Vk�8��6'fG�T׈��m�D�~��4(�*�cC����C�şI��~p�#��d�ƂթF�T�#��Ŀ��C$φl3��ސ�_{(f �]��;�M�B��?�4CW��5�ݎ|��Tx/�3��Q��o+d⨀�4��b��7��|�/6��&��^�H�K�Ax�:a͵^C�Y��߄��u[�� 2y�U��n0iMz��/N[I�s��Oc�e�w^@��\Qf�� c4��SI$�\��S�Ew�i*�^]�v��jk��!U��CN��W��K+5��@w�D:�P�U1��;ڶZ�❸jm,U^<$�ף��,K��"��_@� ��a}.E �(��b�`��nG��8嚐P��+��+��fX��8�b)x@�Sƹ[�e&"&��J �3f(�Ȳ��W�1�N��{O+T��A*�(��E̼=�5N�PE�T��@��ъ,n:sFG��SN+a��0�V��9GD��35��p�a��-�Tڊ��j��U��b�=��6�

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic0
Size: 719KB - Virtual size: 718KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic1
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
PBCCRCPassGuardXInputService.exe
.exe windows:5 windows x86 arch:x86

1e259b8fedffa590de5130b84ee1fc10

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

7f:46:22:30:22:0d:09:c0:79:4c:89:93:99:94:35:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

06-02-2018 00:00

Not After

07-04-2019 23:59

Subject

CN=北京微通新成网络科技有限公司,OU=研发部,O=北京微通新成网络科技有限公司,L=BeiJing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7d:78:08:bc:0a:5c:52:a7:46:e6:ed:85:20:01:9d:6d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

06-02-2018 00:00

Not After

07-04-2019 23:59

Subject

CN=北京微通新成网络科技有限公司,OU=研发部,O=北京微通新成网络科技有限公司,L=BeiJing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23-12-2017 00:00

Not After

22-03-2029 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a0:99:68:4c:a1:7d:00:9b:4b:c0:f5:51:f3:33:ee:73:77:32:13:68:0c:53:c9:cc:5d:e5:81:73:d4:fc:f7:1f
Signer

Actual PE Digest

a0:99:68:4c:a1:7d:00:9b:4b:c0:f5:51:f3:33:ee:73:77:32:13:68:0c:53:c9:cc:5d:e5:81:73:d4:fc:f7:1f

Digest Algorithm

sha256

PE Digest Matches

true

77:bb:8b:a0:6c:68:78:6d:fb:66:25:f6:83:43:7d:73:31:a4:22:8f
Signer

Actual PE Digest

77:bb:8b:a0:6c:68:78:6d:fb:66:25:f6:83:43:7d:73:31:a4:22:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\LYB_WORK\PassGuardNew\Release\getip.pdb

Imports

kernel32

HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
OpenProcess
CreateToolhelp32Snapshot
Process32Next
GetModuleFileNameA
Sleep
LocalAlloc
CreateEventA
CreateThread
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
CreateFileW
WriteConsoleW
ExpandEnvironmentStringsA
WriteFile
ReadFile
GetFileSize
CreateFileA
GetLastError
CloseHandle
SetFileAttributesA
GetFileAttributesExA
GetCurrentProcess
GetModuleHandleA
Process32First
GetProcAddress
SetStdHandle
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LoadLibraryExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameW
GetFileType
GetStdHandle
EncodePointer
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
GetCommandLineA
RtlUnwind
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCurrentThreadId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

advapi32

RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
QueryServiceConfigA
EnumServicesStatusA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
CreateProcessAsUserA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
StartServiceCtrlDispatcherA

shlwapi

PathFileExistsA

ws2_32

inet_ntoa
WSACleanup
gethostbyname
gethostname
WSAStartup

psapi

EnumProcesses
GetModuleFileNameExA
EnumProcessModules

Exports

Exports

= �c�Yy�8��ŀ��j�� |)J��W� ��C=��ڱ5㋏na�2Z�X,ٳ��uI/:Gf��!��m%��K��0�;��y΅�i�!z��t{�d��fԩM��)R�k��< ^��Y�!��4Fk��׿3毕ck��=��`�u\^��כS��9�쵻��w�,�dE&�4��dw�]%팸��L��8 ��(ը�nC+�ӎ��3��9�j�M]�8ԯdR��^�}�&�K&ǟ��}��2C��e�%I|��F�� 9ր�OOLhoO-'v��K"��}V>"��^�̣j�g�*ۨ�_�� %��x�#Ε��H"8`��%\~vzQ�#=�W4�^S�1i�j��T��Bl�Бw@��4��>iHM�[�Һ�C��<��j�-O#T�'��:�@ V�}~�`zh��"8F�ȷd��F��yv��!7}�@��]�;�@�IRD�.��+k��?L�f�2L��҂�q7�@�G��w��! C��o��G��,쟉�VO��,q�j5��m[�X!B�n�u Tӹ�1 Jڦ^ɰJ�d�C�6��C�=��#��\�8�Ő �_Lr<��DL��Ú��ַ�JC�E_.�yހ�v�RR��J&aȃ��-�D��U��>Aw�K��͈�Iq�u'�� f�%zJ��^Op�7��Gy&̋��}RD�k��$��cS3C�D�G/��c��>ޭ�+��3 �6�L�e,�O��(`��{=��/\%��r��`��f�e�x�p��V��ݤ��rI�HAd��1HF�;��<P��[�\��`��c%��I��R[��o50��]�*k�j�E (�W�&�b��fU��0��c$�0H3��)�Y��9�G6�u�p��_�}:� ~A%�.��}O��c��T��3K�F�L��h��:`3OE��ݺ~L{��h�'��Ǜ�d�!8IضG�j�wZ��MNQUBK�3h��َ��z1�2�A��IS��e;��9#e�ř��B��%p+}�^j�� ˦�$Fؠ�� d_��h�o�DF��_[9\˙?K��Gv1��}��E��=O[3�w��k'��Id��xt��b��w�Rei��*��Z��'Ø��C@B��v��S��^�>��X��0�:٤�4��'��P�H�Tߐڞ�uw3qq�� l�$��nf�3M׋�ȅ.��rIJNF��}�Rd�ע�%��]O��SS��qZVk+=w�ܤb�y��G%��ܷ1%�"��0��~�a�gq w�f��;�v=>8JDm-j��ί��O�#��Q��Ƕ��/��O��5�ݓ��9��p�2\@��x2�=T-�m�A��¶��ev�"�b��<k�F8)4�\�Q3*�b-NLr�� SWR��i�{��o�`e��Jt��ԇ��t#N�b��+��?��1�Y�SVk��9i�xb*d�U��a|#dc��Q]�<P�@� 8>��P�r�uµ��Mz �%�4��]��ʝB!K�zLV�8=[d�yh*�*Zb��z��m ��s0��kl��]u�iS�6�㠉'�g��,��7��RI'-$�i7��e��V�`o5�A�ߓ(�z7��T��R��@\�ht?�r?�Fܓ�t��&�^�ȡtXP��@�6u�� cj$=��d��>2s��8颔P}�})J��x� �?�J3��cnhlP�~�NF��^�7��&�P��Ql��l��E�bG�Q<9(&��d%b��4�U��*ٞ��v~6To��W�ɏ�s�k��v��=��*��SN��?�غ�ͶD��|?��ӊ�%D��~�G^�Y_��W+s�,��9�K��oҟ^�M��dN�c��D��[�5�I.�&S��D�[@��y�� aPC̙x�b��>��Ɍ~ �8��<S)ӝAJ�Tb[�%�>C9�ң��2�j+!AAh�,��w�a��۽��U�)Y��"��%�K��٦# ��k�2�f�{�*��ɮ�6�q,��rc&��E[�b(�O~�-tp#�!TB2s�\= E��6�b��q)5�\��hi�_��I�iA�L>��3��8��Ic�K��kFm��ۡ��m��ˤbȠDyŎ��6��5t�X��M2��^��Q��!�(��&�>'4F�bW?��j�M N/��d��]�r��,�>�D��I��}��b0z4�U��[°�+䳨Z��Rq�7�uu��s�E�n#��S��E��F!��A��,6��E��p�`��u��Yi��N��K�T�L��&D��3�ɉZ��ϱ�@.�r�/ݱ �fm6kmQa�R��p�fA�~��ӠjA��\,��%3��ql��7S�{��]F��m�c�o�%�s��zO.;��6;*��p&0��P�G0�@�E7^�ź+O��$��p+>�x� �� ^�Z��;na:�+�gٖmD2��|�~c7�su�4p��v��/��E�(�M*M�Z�@��vd�_��tZ�Z�#E�ҙ��S2�[6��&\l�puY��@?��H��߄J`��޲��;��=��p��tۗ]l��Q��o��^��=51@��^qvM9��ɛ�r��)��Q\��"�{ E��8Đ��Zs��OX��z�w�u�3�R�J��~]��6BA�Jn6��b��S�ԣ�h�"��R7�E�М��t�5}�2ƹ49��~?�|n�@�OW��a�(��\Wh!��ZB�L'��H��1��⃏��uU@�K�jl��)Y�Tt��l��+c�.x�bkJm��~�M��&�C��H@��v$�!�v�q��k�?�� p?֮V=갴�XӔ(��/�JŸ ��^��l

Sections

.text
Size: 147KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic0
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mic1
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uninst.exe.nsis

Sharing

General

Malware Config

Signatures

Files

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

05:96:9d:5e:3b:1b:50:e2:0b:4f:f8:42:9c:f0:1e:6aCertificate

Extended Key Usages

Key Usages

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bdCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

06:3c:25:43:23:a8:6b:33:e8:41:02:39:7a:40:f3:99Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

31:da:64:20:05:e9:ac:7d:be:94:0b:8a:ba:e4:b0:d7:ae:8e:27:fb:98:31:cc:21:40:d7:ec:56:82:62:30:09Signer

5a:84:01:4c:cf:55:9c:65:04:b1:f2:08:b3:dc:55:a9:9b:1d:ab:65Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 105KB

.ndata Size: - Virtual size: 68KB

.rsrc Size: 20KB - Virtual size: 19KB

153027ec3b10bcea606b777657dd3402

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 172B

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 835B

.data Size: 512B - Virtual size: 104B

.reloc Size: 1024B - Virtual size: 582B

1e610ae5b22b178828e96c6a76ffe702

Headers

DLL Characteristics

File Characteristics

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

05:96:9d:5e:3b:1b:50:e2:0b:4f:f8:42:9c:f0:1e:6a
Certificate

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

06:3c:25:43:23:a8:6b:33:e8:41:02:39:7a:40:f3:99
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

31:da:64:20:05:e9:ac:7d:be:94:0b:8a:ba:e4:b0:d7:ae:8e:27:fb:98:31:cc:21:40:d7:ec:56:82:62:30:09
Signer

5a:84:01:4c:cf:55:9c:65:04:b1:f2:08:b3:dc:55:a9:9b:1d:ab:65
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 105KB

.ndata
Size: - Virtual size: 68KB

.rsrc
Size: 20KB - Virtual size: 19KB

.text
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 172B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 835B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 582B

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 724B

.data
Size: 512B - Virtual size: 36B

.CRT
Size: 512B - Virtual size: 4B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 152B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 616B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:05:19:96:00:00:00:00:00:1b
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:05:49:55:00:00:00:00:00:0b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

0c:16:bc:15:52:dc:9f:0a:0e:6b:fe:3f:ae:29:0e:19:83:b7:17:d9:5f:0e:2d:b5:b8:a4:90:17:08:af:1a:8c
Signer

cb:e0:44:03:8d:d3:5f:41:25:2f:61:98:ba:f2:e1:24:5e:68:60:ae
Signer

.text
Size: 32KB - Virtual size: 31KB

.data
Size: 512B - Virtual size: 9KB

.idata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 22KB - Virtual size: 22KB

.reloc
Size: 3KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate