26b96ef6997d2cda5172b89e244271e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

26b96ef6997d2cda5172b89e244271e0_JaffaCakes118
Size

4.2MB
MD5

26b96ef6997d2cda5172b89e244271e0
SHA1

2ef0e67320cabf2e4e230a437f6f2a56d2097355
SHA256

e772837b81a5d8c3edfb9cb1d76ea3e5a5fb2489a62d855857d309d26351ab65
SHA512

fa6d1a800c4704c33fa4127999dedbf89a9c4687f816e9eccc62d2ba89eb5dd91e3384b6e46170267f1850f8e0296fa45c2a8a2755e786c051e2ab34888aa084
SSDEEP

98304:fyp0h17qyvQZpG7mqi02gTI/3C8Lvs9c7V9pI/5:fyp0v7qPZpGK3gTIK8bs9G/pg

Score

1^/10

Malware Config

Signatures

Files

26b96ef6997d2cda5172b89e244271e0_JaffaCakes118
.zip
CreativeCloudSet-Up.exe
.exe windows:5 windows x86 arch:x86

824e53f29985d8728e2bb3948405d31a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf
Signer

Actual PE Digest

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

shlwapi

PathIsDirectoryW

shell32

ShellExecuteExW

winhttp

WinHttpOpenRequest

comctl32

ord17

setupapi

SetupDiGetDeviceRegistryPropertyW

gdi32

GetDeviceCaps

version

GetFileVersionInfoW

user32

EnableMenuItem

advapi32

RegQueryValueExA

ole32

CoInitialize

oleaut32

SysAllocString

crypt32

CertGetIssuerCertificateFromStore

wintrust

WinVerifyTrust

Sections

.text
Size: 605KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
packages/Utils/Utils.pima
.zip
Creative Cloud Uninstaller.exe
.exe windows:5 windows x86 arch:x86

4f733f71ae001909489626ad5ae7a385

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:69:76:28:b9:34:df:a6:43:f6:99:2b:6f:3a:85:16:76:cb:c9:5f
Signer

Actual PE Digest

14:69:76:28:b9:34:df:a6:43:f6:99:2b:6f:3a:85:16:76:cb:c9:5f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\builds\ACC\GM\source\dev\target\win32\Release\Utils\Creative Cloud Uninstaller.pdb

Imports

psapi

GetModuleFileNameExW

winhttp

WinHttpSetStatusCallback
WinHttpQueryOption
WinHttpReceiveResponse
WinHttpSetTimeouts
WinHttpGetIEProxyConfigForCurrentUser
WinHttpSendRequest
WinHttpConnect
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpReadData
WinHttpSetCredentials
WinHttpAddRequestHeaders
WinHttpQueryAuthSchemes

msi

ord113
ord70

kernel32

ResumeThread
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalReAlloc
GlobalGetAtomNameW
GetThreadLocale
GlobalFlags
CompareStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GlobalFindAtomW
GetVolumeInformationW
GetTempFileNameW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
SetErrorMode
FileTimeToLocalFileTime
GetFileTime
VirtualProtect
GetCommandLineW
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
HeapQueryInformation
VirtualAlloc
VirtualQuery
SetStdHandle
GetFileType
GetStdHandle
GetStartupInfoW
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleCP
GetConsoleMode
SetFilePointerEx
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsValidLocale
EnumSystemLocalesW
GetStringTypeW
WriteConsoleW
SetEnvironmentVariableA
lstrlenW
GlobalAddAtomW
GlobalDeleteAtom
LoadLibraryExW
GetModuleHandleA
FreeResource
GetSystemDirectoryW
EncodePointer
MulDiv
GlobalUnlock
GlobalLock
GlobalSize
SuspendThread
LCMapStringW
LCMapStringA
GetStringTypeExA
GetUserDefaultLCID
WaitForMultipleObjects
lstrcpyW
DuplicateHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GlobalFree
TerminateProcess
GlobalAlloc
OpenProcess
FindResourceExW
GetUserDefaultLangID
VerifyVersionInfoW
VerSetConditionMask
lstrlenA
CopyFileW
MoveFileExW
CreateThread
SetThreadPriority
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
OpenMutexW
GetLocalTime
GetFileSizeEx
FileTimeToSystemTime
GetTimeFormatW
GetDateFormatW
GetCurrentThreadId
lstrcmpW
CreateDirectoryW
CreateSemaphoreW
OpenSemaphoreW
ReleaseSemaphore
GetUserDefaultUILanguage
lstrcmpiW
LocalAlloc
GetModuleFileNameW
GetCurrentProcess
CreateEventW
ReleaseMutex
ResetEvent
SetEvent
SetLastError
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
FindClose
CreateProcessW
GetUserDefaultLocaleName
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
RaiseException
DecodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
lstrcmpA
GetCurrentThread
IsDBCSLeadByteEx
GetCurrentDirectoryW

user32

GetKeyboardLayout
ToUnicodeEx
DrawIconEx
DrawFocusRect
DrawFrameControl
DrawEdge
GetNextDlgGroupItem
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
WaitMessage
MonitorFromPoint
UnionRect
EnableScrollBar
UpdateLayeredWindow
IsMenu
IsRectEmpty
SetMenuDefaultItem
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
OffsetRect
WindowFromPoint
MessageBeep
SetWindowRgn
DeleteMenu
GetSystemMenu
KillTimer
SetTimer
ReleaseCapture
SetCapture
GetAsyncKeyState
CharUpperW
IsZoomed
TrackMouseEvent
CopyImage
GetMenuItemInfoW
DestroyMenu
RealChildWindowFromPoint
IntersectRect
InflateRect
EnumDisplayMonitors
SystemParametersInfoW
LoadCursorW
SetRectEmpty
GetSysColorBrush
SetLayeredWindowAttributes
MapDialogRect
SetWindowContextHelpId
SetCursor
ShowOwnedPopups
TranslateMessage
GetMessageW
PostQuitMessage
MapVirtualKeyW
GetKeyNameTextW
GetCursorPos
LoadMenuW
GetDesktopWindow
GetActiveWindow
GetNextDlgTabItem
EndDialog
CreateDialogIndirectParamW
IsDialogMessageW
SetWindowTextW
IsWindowEnabled
CheckDlgButton
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
GetScrollInfo
SetScrollInfo
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetWindow
GetLastActivePopup
GetTopWindow
GetKeyboardState
SetWindowLongW
GetWindowLongW
PtInRect
EqualRect
CopyRect
MapWindowPoints
MessageBoxW
GetIconInfo
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
RemovePropW
GetPropW
SetPropW
ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
RedrawWindow
ValidateRect
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
TrackPopupMenu
SetMenu
GetMenu
GetCapture
GetKeyState
SetFocus
GetDlgCtrlID
GetDlgItem
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
SetWindowPos
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
GetParent
SendDlgItemMessageA
GetSysColor
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
GetWindowDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
RemoveMenu
AppendMenuW
InsertMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
LoadBitmapW
GetClassNameW
FillRect
InvalidateRect
UpdateWindow
DrawStateW
LoadAcceleratorsW
CreateAcceleratorTableW
DestroyAcceleratorTable
SetCursorPos
GetWindowRgn
DestroyCursor
GetComboBoxInfo
CreateMenu
SubtractRect
GetUpdateRect
IsClipboardFormatAvailable
TranslateMDISysAccel
DefMDIChildProcW
LoadStringA
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
GetDoubleClickTime
PostThreadMessageW
FrameRect
CopyIcon
ReuseDDElParam
UnpackDDElParam
InsertMenuItemW
TranslateAcceleratorW
ModifyMenuW
CharUpperBuffW
RegisterClipboardFormatW
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
InvertRect
GetClassLongW
HideCaret
GetWindowThreadProcessId
ReleaseDC
GetDC
wsprintfW
LoadImageW
DestroyIcon
GetClientRect
DrawIcon
GetSystemMetrics
EnableWindow
IsIconic
UnregisterClassW
SendMessageW
SetClassLongW
LockWindowUpdate
BringWindowToTop
AdjustWindowRectEx
SetParent
MoveWindow

gdi32

TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CreateRectRgnIndirect
PatBlt
CreateCompatibleBitmap
CreateDIBitmap
CreateFontIndirectW
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetTextExtentPoint32W
CreateRoundRectRgn
CreateDIBSection
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
Rectangle
RoundRect
EnumFontFamiliesExW
ExtFloodFill
MoveToEx
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetWindowOrgEx
LPtoDP
GetViewportOrgEx
SetPixelV
GetTextFaceW
SetTextAlign
SetTextColor
SetROP2
SetPolyFillMode
LineTo
IntersectClipRect
GetWindowExtEx
GetViewportExtEx
GetPixel
GetObjectType
GetClipBox
ExcludeClipRect
Escape
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
SetPaletteEntries
CreateCompatibleDC
CreateBitmap
BitBlt
CreateDCW
CopyMetaFileW
GetObjectW
GetStockObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
RealizePalette
DeleteDC
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
RestoreDC
RectVisible
PtVisible

msimg32

AlphaBlend
TransparentBlt

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
AdjustTokenPrivileges
LookupAccountSidW
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetFolderLocation
ord51
SHGetMalloc
SHGetSpecialFolderLocation
SHBrowseForFolderW
SHGetDesktopFolder
SHGetFileInfoW
SHAppBarMessage
DragQueryFileW
DragFinish
SHCreateDirectoryExW

comctl32

InitCommonControlsEx

shlwapi

PathIsDirectoryW
PathFileExistsW
PathRemoveFileSpecW
PathAppendW
PathRemoveExtensionW
PathIsFileSpecW
PathAddExtensionW
PathRenameExtensionW
PathFileExistsA
PathIsDirectoryEmptyW
PathStripPathW
PathFindExtensionW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
PathFindFileNameW
PathRemoveBackslashW

uxtheme

GetWindowTheme
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
IsAppThemed
DrawThemeParentBackground
DrawThemeText
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName

ole32

CoDisconnectObject
ReleaseStgMedium
OleDuplicateData
OleGetClipboard
CoGetClassObject
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes
CoLockObjectExternal
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
StringFromGUID2
CoCreateGuid
CoInitialize
CoUninitialize
CoTaskMemFree
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoTaskMemAlloc
CoCreateInstance
CLSIDFromProgID
CLSIDFromString
OleRun
OleLockRunning
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard

oleaut32

SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
LoadTypeLi
SysAllocStringLen
VariantChangeType
VarBstrFromDate
OleCreateFontIndirect
SysFreeString
SysAllocString
VariantInit
VariantCopy
VariantClear
SysStringLen
GetErrorInfo

oledlg

OleUIBusyW

gdiplus

GdipDrawImageI
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown

crypt32

CertGetIssuerCertificateFromStore
CertGetNameStringW

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetContext
ImmGetOpenStatus

winmm

PlaySoundW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 467KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 325KB - Virtual size: 325KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CreativeCloud(URIHandler).exe
.exe windows:5 windows x86 arch:x86

9bce865d9c331592b434601f1eb487e4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

64:ef:5c:83:1a:b7:d8:36:7f:dd:7b:96:67:a2:da:c6:14:2b:2c:15
Signer

Actual PE Digest

64:ef:5c:83:1a:b7:d8:36:7f:dd:7b:96:67:a2:da:c6:14:2b:2c:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\builds\ACC\GM\source\dev\target\win32\Release\Utils\CreativeCloud(URIHandler).pdb

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW

shlwapi

PathFileExistsW
PathIsDirectoryW
PathRemoveFileSpecW
PathIsFileSpecW
PathFindFileNameW
PathAddExtensionW
PathRenameExtensionW
PathAppendW
PathRemoveExtensionW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

wininet

InternetCanonicalizeUrlW

kernel32

FindFirstFileW
FreeLibrary
CreateProcessW
GetCurrentProcess
WaitForSingleObject
OpenProcess
WideCharToMultiByte
LoadLibraryW
Sleep
GetExitCodeProcess
TerminateProcess
GetModuleFileNameW
MultiByteToWideChar
GetTempPathW
GetLastError
GetProcAddress
FindClose
Process32FirstW
RemoveDirectoryW
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
SetFileAttributesW
GetUserDefaultLocaleName
FindResourceW
LoadResource
WriteFile
SizeofResource
CreateFileW
LockResource
GetModuleHandleW
GetEnvironmentVariableW
SetDllDirectoryW
GetCurrentProcessId
lstrlenW
InitializeCriticalSectionEx
RaiseException
DecodePointer
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetFilePointer
lstrcmpW
GetCurrentThreadId
GetDateFormatW
SystemTimeToFileTime
GetTimeFormatW
FileTimeToSystemTime
ReadFile
GetFileSizeEx
GetLocalTime
CreateMutexW
OpenMutexW
ReleaseMutex
LocalFree
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
lstrlenA
MoveFileExW
FlushFileBuffers
GetUserDefaultLCID
LCMapStringW
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
IsDBCSLeadByteEx
GetStringTypeW
EncodePointer
GetCommandLineW
GetFileAttributesExW
GetSystemTimeAsFileTime
GetTimeZoneInformation
IsDebuggerPresent
IsProcessorFeaturePresent
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
GetConsoleCP
GetConsoleMode
IsValidCodePage
GetACP
GetOEMCP
ReadConsoleW
LoadLibraryExW
OutputDebugStringW
SetStdHandle
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableA

ole32

StringFromGUID2
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromProgID
CLSIDFromString
OleRun

oleaut32

GetErrorInfo
VariantClear
VariantCopy
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 427KB - Virtual size: 426KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CreativeCloudSet-Up.exe
.exe windows:5 windows x86 arch:x86

824e53f29985d8728e2bb3948405d31a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf
Signer

Actual PE Digest

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

shlwapi

PathIsDirectoryW

shell32

ShellExecuteExW

winhttp

WinHttpOpenRequest

comctl32

ord17

setupapi

SetupDiGetDeviceRegistryPropertyW

gdi32

GetDeviceCaps

version

GetFileVersionInfoW

user32

EnableMenuItem

advapi32

RegQueryValueExA

ole32

CoInitialize

oleaut32

SysAllocString

crypt32

CertGetIssuerCertificateFromStore

wintrust

WinVerifyTrust

Sections

.text
Size: 605KB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
npAdobeAAMDetect32.dll
.dll regsvr32 windows:6 windows x86 arch:x86

43505881eefbe6a362dac828262ac906

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6e:72:b0:5e:ed:ac:15:41:c8:ed:2a:a8:35:43:03:90:53:55:0a:05
Signer

Actual PE Digest

6e:72:b0:5e:ed:ac:15:41:c8:ed:2a:a8:35:43:03:90:53:55:0a:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SizeofResource
ReleaseSemaphore
GetCurrentProcess
GetSystemTimeAsFileTime
LeaveCriticalSection
MulDiv
GetModuleFileNameW
MultiByteToWideChar
FlushInstructionCache
RaiseException
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
lstrlenW
GetTickCount
DuplicateHandle
CreateSemaphoreA
TlsAlloc
TlsFree
TlsGetValue
SetWaitableTimer
TlsSetValue
WaitForMultipleObjects
SystemTimeToFileTime
OpenEventA
GetProcessHeap
HeapAlloc
ResetEvent
GetCurrentProcessId
HeapFree
Sleep
CreateWaitableTimerW
FormatMessageA
LocalFree
WideCharToMultiByte
GetStringTypeW
EncodePointer
InitializeCriticalSectionAndSpinCount
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
WriteFile
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
InterlockedCompareExchange
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
GetModuleHandleW
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
lstrlenA
GlobalAlloc
GlobalFree
lstrcpyA
SetThreadLocale
GetThreadLocale
SetEvent
WaitForSingleObject
CloseHandle
CreateEventA
DecodePointer
GetCurrentThreadId

ws2_32

WSAStartup
WSACleanup

user32

SetWindowPos
ShowWindow
SetFocus
GetClientRect
LoadCursorW
GetFocus
GetKeyState
IsChild
CharNextW
SetWindowRgn
DestroyWindow
SetWindowLongW
ReleaseDC
GetWindowLongW
InvalidateRect
UnionRect
IntersectRect
OffsetRect
RegisterClassExW
GetDC
GetClassInfoExW
PtInRect
IsWindow
CreateWindowExW
EqualRect
CallWindowProcW
DefWindowProcW
EndPaint
GetWindowRect
ScreenToClient
BeginPaint
SetCursor
PostMessageW
UnregisterClassW

gdi32

TextOutW
SetWindowOrgEx
SetViewportOrgEx
LPtoDP
DeleteDC
GetDeviceCaps
CreateDCW
CreateRectRgnIndirect
SetMapMode
SetTextAlign
RestoreDC
SaveDC

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
OleRegGetMiscStatus
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
StringFromGUID2

oleaut32

VariantInit
SysStringLen
RegisterTypeLi
UnRegisterTypeLi
SafeArrayCopy
SafeArrayGetUBound
SysStringByteLen
SafeArrayGetVartype
SafeArrayLock
SafeArrayRedim
VariantChangeType
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SysAllocStringByteLen
VariantCopy
VariantCopyInd
SafeArrayGetLBound
LoadRegTypeLi
SysFreeString
VarUI4FromStr
OleCreatePropertyFrame
SysAllocStringLen
VariantClear
LoadTypeLi
SysAllocString

advapi32

RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegDeleteValueW

wininet

InternetQueryOptionW

urlmon

CreateURLMonikerEx
IsValidURL
CreateAsyncBindCtx

psapi

EnumProcessModules

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 859KB - Virtual size: 858KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
npAdobeAAMDetect64.dll
.dll regsvr32 windows:6 windows x64 arch:x64

dda0e537191abbe0d841e23166219b34

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

18:15:16:e6:d4:0d:f1:ab:c1:a2:c2:44:ca:f1:f1:15:f7:b9:29:7a
Signer

Actual PE Digest

18:15:16:e6:d4:0d:f1:ab:c1:a2:c2:44:ca:f1:f1:15:f7:b9:29:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SizeofResource
ReleaseSemaphore
GetCurrentProcess
GetSystemTimeAsFileTime
LeaveCriticalSection
MulDiv
GetModuleFileNameW
MultiByteToWideChar
FlushInstructionCache
RaiseException
GetLastError
SetLastError
GetProcAddress
EnterCriticalSection
lstrcmpiW
DeleteCriticalSection
lstrlenW
GetTickCount
DuplicateHandle
CreateSemaphoreA
TlsAlloc
TlsFree
TlsGetValue
SetWaitableTimer
TlsSetValue
WaitForMultipleObjects
SystemTimeToFileTime
OpenEventA
GetProcessHeap
HeapAlloc
ResetEvent
GetCurrentProcessId
HeapFree
Sleep
CreateWaitableTimerW
FormatMessageA
LocalFree
WideCharToMultiByte
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetFileType
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
WriteFile
HeapReAlloc
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
VirtualAlloc
VirtualFree
GetModuleHandleW
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
lstrlenA
GlobalAlloc
GlobalFree
lstrcpyA
SetThreadLocale
GetThreadLocale
SetEvent
WaitForSingleObject
CloseHandle
CreateEventA
GetCommandLineA
GetCurrentThreadId

ws2_32

WSAStartup
WSACleanup

user32

ShowWindow
IsWindow
GetClientRect
GetWindowLongPtrW
LoadCursorW
GetFocus
GetKeyState
IsChild
CharNextW
SetWindowRgn
DestroyWindow
SetWindowPos
ReleaseDC
InvalidateRect
UnionRect
IntersectRect
OffsetRect
RegisterClassExW
GetDC
GetClassInfoExW
PtInRect
BeginPaint
CreateWindowExW
EqualRect
SetWindowLongPtrW
CallWindowProcW
DefWindowProcW
EndPaint
GetWindowRect
ScreenToClient
SetFocus
SetCursor
PostMessageW
UnregisterClassW

gdi32

TextOutW
SetWindowOrgEx
SetViewportOrgEx
LPtoDP
DeleteDC
GetDeviceCaps
CreateDCW
CreateRectRgnIndirect
SetMapMode
SetTextAlign
RestoreDC
SaveDC

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
OleRegGetMiscStatus
CoTaskMemFree
OleRegEnumVerbs
OleRegGetUserType
CreateOleAdviseHolder
StringFromGUID2

oleaut32

VariantInit
SysStringLen
RegisterTypeLi
UnRegisterTypeLi
SafeArrayCopy
SafeArrayGetUBound
SysStringByteLen
SafeArrayGetVartype
SafeArrayLock
SafeArrayRedim
VariantChangeType
SafeArrayCreate
SafeArrayUnlock
SafeArrayDestroy
SysAllocStringByteLen
VariantCopy
VariantCopyInd
SafeArrayGetLBound
LoadRegTypeLi
SysFreeString
VarUI4FromStr
OleCreatePropertyFrame
SysAllocStringLen
VariantClear
LoadTypeLi
SysAllocString

advapi32

RegOpenKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegDeleteValueW

wininet

InternetQueryOptionW

urlmon

CreateURLMonikerEx
IsValidURL
CreateAsyncBindCtx

psapi

EnumProcessModules

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
NP_GetEntryPoints
NP_Initialize
NP_Shutdown

Sections

.text
Size: 969KB - Virtual size: 968KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zip/7za.exe
.exe windows:4 windows x86 arch:x86

15847eb10d7d06dcd5980e8a9b786fd6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

07/06/2012, 00:00

Not After

06/06/2022, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/01/2014, 00:00

Not After

07/01/2016, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=AAM 256,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

e4:c7:20:be:41:df:b9:34:cb:44:28:a2:b2:e6:c2:4c:2b:40:59:4c
Signer

Actual PE Digest

e4:c7:20:be:41:df:b9:34:cb:44:28:a2:b2:e6:c2:4c:2b:40:59:4c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysAllocString
SysAllocStringByteLen
VariantClear
VariantCopy
SysFreeString

user32

CharLowerA
CharUpperA
CharLowerW
CharPrevExA
CharNextA
CharUpperW

kernel32

SetEndOfFile
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
SetConsoleCtrlHandler
FileTimeToLocalFileTime
GetCommandLineW
SetFileApisToOEM
GetVersionExA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
SetConsoleMode
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
GetLastError
FreeLibrary
LoadLibraryA
AreFileApisANSI
GetModuleFileNameA
LocalFree
FormatMessageA
FormatMessageW
GetWindowsDirectoryA
GetWindowsDirectoryW
CloseHandle
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryA
CreateDirectoryW
DeleteFileA
DeleteFileW
lstrlenA
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
SearchPathA
SearchPathW
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
CreateFileA
GetFileSize
SetFilePointer
DeviceIoControl
ReadFile
WriteFile
GetCurrentProcess
GetProcAddress
CompareFileTime
FileTimeToSystemTime
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
WaitForMultipleObjects
OpenEventA
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
GetTickCount
GetProcessTimes
LocalFileTimeToFileTime
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
VirtualAlloc
VirtualFree
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
TlsAlloc
SetUnhandledExceptionFilter
TerminateProcess
HeapSize
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
SetHandleCount
GetFileType
GetStartupInfoA
FlushFileBuffers
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
SetStdHandle
GetCPInfo
GetACP
GetOEMCP

Sections

.text
Size: 483KB - Virtual size: 483KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 27KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
zip/license.txt
packages/Utils/Utils.pimx
packages/Utils/Utils.sig
.xml

Sharing

General

Malware Config

Signatures

Files

824e53f29985d8728e2bb3948405d31a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70Certificate

Extended Key Usages

Key Usages

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bfSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

shlwapi

shell32

winhttp

comctl32

setupapi

gdi32

version

user32

advapi32

ole32

oleaut32

crypt32

wintrust

Sections

.text Size: 605KB - Virtual size: 2.2MB

.rsrc Size: 60KB - Virtual size: 60KB

.reloc Size: 512B - Virtual size: 512B

4f733f71ae001909489626ad5ae7a385

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59Certificate

Extended Key Usages

Key Usages

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70Certificate

Extended Key Usages

Key Usages

14:69:76:28:b9:34:df:a6:43:f6:99:2b:6f:3a:85:16:76:cb:c9:5fSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

winhttp

msi

kernel32

user32

gdi32

msimg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

uxtheme

ole32

oleaut32

oledlg

gdiplus

crypt32

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf
Signer

.text
Size: 605KB - Virtual size: 2.2MB

.rsrc
Size: 60KB - Virtual size: 60KB

.reloc
Size: 512B - Virtual size: 512B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

14:69:76:28:b9:34:df:a6:43:f6:99:2b:6f:3a:85:16:76:cb:c9:5f
Signer

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 467KB - Virtual size: 467KB

.data
Size: 35KB - Virtual size: 68KB

.rsrc
Size: 325KB - Virtual size: 325KB

.reloc
Size: 146KB - Virtual size: 145KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

64:ef:5c:83:1a:b7:d8:36:7f:dd:7b:96:67:a2:da:c6:14:2b:2c:15
Signer

.text
Size: 427KB - Virtual size: 426KB

.rdata
Size: 100KB - Virtual size: 99KB

.data
Size: 15KB - Virtual size: 28KB

.rsrc
Size: 57KB - Virtual size: 57KB

.reloc
Size: 23KB - Virtual size: 23KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6c:59:ef:a9:e1:00:e1:0e:e3:06:ba:8f:e0:29:25:59
Certificate

58:a0:b9:25:d5:bd:9e:14:2f:9e:9b:39:4e:ce:62:70
Certificate

f7:46:d0:82:f6:f1:c1:76:ac:eb:f1:c4:fa:9b:e3:b8:9e:ce:00:bf
Signer