28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118

resource	yara_rule
sample	upx

resource
28edcb1ff25cd616bc9709b9dded1261_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

SHA256 15d38a01c168d7a82ae39f5ffbbdd0cf482d53f2d54b747ff0d936395a016583
MD5 28edcb1ff25cd616bc9709b9dded1261
SHA1 d127c38e5ba60af11f55ea919caded6f65b788c7
SHA512 3a0f7b5242bda03ec1bce572dfeb5a59a5c3aca103b04822d5eee64c63ae7bd4809ce51c190d4f5f0a12c4cb5c94e2d607ee4c5ba13093d16829fbf2e310449f
SSDEEP 98304:3//78eyjX2D3uw0axTiJ13y3AB2YfvLSioCsjNutnQBlYjEFy+u27gD2DyjU/YlL:vDGGLuw+v3JXZsjM6cQ827gD2OjFQaTP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

2563600

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/HWSignature.dll

IMPHASH de18af259ae709a6bea8669b60fd1118
SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
MD5 87c80914dfc65df16f5ff36040666da3
SHA1 06aefe9570ef484a322c53297152f1ea50746878
SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

16955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\HWSignature.pdb

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

ExitProcess FlushFileBuffers CreateFileA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA lstrcatA CopyFileA DeviceIoControl CloseHandle lstrcpyA lstrlenA GlobalAlloc FreeLibrary GetLastError GetProcAddress LoadLibraryA LocalAlloc GetVersionExA LocalFree HeapReAlloc GetTickCount SetLastError GlobalFree WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar HeapSize GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc GetModuleHandleW Sleep WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

wsprintfA IsCharAlphaNumericA

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4
MD5 6e663f1a0de94bc05d64d020da5d6f36
SHA1 c5abb0033776d6ab1f07e5b3568f7d64f90e5b04
SHA512 2a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5
SSDEEP 192:VsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5mj8ozxGUWumle:VsUHd9GN2d2iwl0impATIPdAj8Ov6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/SetupFlash.swf

SHA256 4732f8479106608a6c529d97d4ff47ed1ec147e1c96c81ea3a8f448ec5c529da
MD5 4367fdba2f67ce227ba5115358380be9
SHA1 b469da8c4bdef410044d1177e711b2dfa21bd0c5
SHA512 f35a1a366bf1a954892067aa9d8f802102c57b56bc1bf46b2d7da982231dbd6228c1d3544ad2034031021aaf460e1c6f0be99352359cebb64916d68297bd84ac
SSDEEP 1536:Y4msC1JOALbksCqcSEsytharH7f0NctYn:fjnAnjCq5geH7Jg
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/SetupLib.dll

IMPHASH 2ed2acfe7f1960a737c7780454fa29d3
SHA256 ae9897c5aa08185050742ba4b982732d6b4e71565af2f94622e9bb8998f69dbb
MD5 129db08e936fd574643aea1bb88d1459
SHA1 147391794348b4e78c6240a7b550e01e0ae1d0fb
SHA512 b814619f93668aac550d169bcff2b40cef39d07cb3d32d2454b3233fc459bd4ac87bf58f6d009616abb4f863c3d423f2f80e4803abc1ee064660b779ddf5472b
SSDEEP 24576:xXSULtoXic6SrKO8yzZqL0IiurkhER/QWcihDHl3lBkqRm5cQtMOt2uzsSylJYxV:xunhWcE3lEyc8LKLMREgWE8T9T9AF8p
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

1413809

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SetupLib.pdb

shlwapi

StrStrIW StrRetToBufW StrToIntW SHDeleteKeyW PathFileExistsW SHGetValueW

wininet

InternetOpenUrlA InternetOpenA InternetReadFile HttpQueryInfoA InternetCloseHandle InternetSetOptionW InternetOpenUrlW InternetOpenW InternetQueryOptionW InternetErrorDlg

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory

kernel32

InterlockedExchange VirtualProtect VirtualFree LoadLibraryA VirtualAlloc HeapFree HeapReAlloc GetProcessHeap HeapAlloc GetVersionExW GetTempPathW DeleteFileW Sleep lstrcpyW GetCurrentProcessId CloseHandle GetCurrentThreadId CreateToolhelp32Snapshot Process32NextW CreateFileMappingW Process32FirstW GlobalFree EnterCriticalSection SuspendThread GetThreadContext SetThreadContext VirtualQuery SetEnvironmentVariableA CompareStringW CompareStringA SetLastError GetLastError RaiseException FlushInstructionCache MultiByteToWideChar CreateFileW ReadFile TerminateProcess GetExitCodeProcess LeaveCriticalSection WideCharToMultiByte GetSystemDirectoryW GlobalAlloc OpenProcess GetTickCount WaitForSingleObject GetCurrentProcess MoveFileExW CreateProcessW FreeLibrary UnmapViewOfFile MapViewOfFile DebugBreak OutputDebugStringW lstrlenA GetModuleFileNameW InterlockedDecrement InterlockedIncrement LocalFree LocalAlloc LoadLibraryW FindNextFileW FindClose GetProcAddress lstrlenW GetModuleHandleW FindFirstFileW FlushFileBuffers QueryPerformanceFrequency TlsGetValue GetLocalTime InterlockedCompareExchange lstrcatW TlsSetValue TlsAlloc TlsFree GetCommandLineW QueryDosDeviceW RemoveDirectoryW GetLogicalDriveStringsW SetFileAttributesW WriteConsoleW GetConsoleOutputCP WriteConsoleA GetProcessId FileTimeToSystemTime GetFileAttributesW CopyFileW GetLocaleInfoA GetStringTypeW GetStringTypeA SetEndOfFile GetCurrentDirectoryA GetFullPathNameA SetStdHandle GetModuleHandleA GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount LCMapStringA LCMapStringW IsValidCodePage GetOEMCP GetCPInfo GetModuleFileNameA HeapCreate ExitProcess GetDriveTypeW RtlUnwind GetTimeZoneInformation FindFirstFileA GetDriveTypeA GetFileInformationByHandle FileTimeToLocalFileTime GetCommandLineA ResumeThread GetFullPathNameW IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime HeapSize HeapDestroy IsProcessorFeaturePresent GetWindowsDirectoryW InitializeCriticalSectionAndSpinCount CreateFileA GetACP CreateMutexW CreateThread DuplicateHandle ExitThread GetFileAttributesExW FormatMessageW SetNamedPipeHandleState CreateDirectoryW OpenEventW CreateEventW SetEvent SetThreadPriority GetDiskFreeSpaceExW ReleaseMutex WaitNamedPipeW CreateIoCompletionPort TransactNamedPipe GetQueuedCompletionStatus WaitForSingleObjectEx OpenFileMappingW GlobalHandle GlobalUnlock GetExitCodeThread GlobalLock OpenMutexW TerminateThread GetCurrentThread WriteFile GetTempFileNameW GetFileSize SetFilePointer SleepEx GetSystemDirectoryA DeleteCriticalSection InitializeCriticalSection PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA

user32

GetPropW GetFocus OffsetRect GetCursor PtInRect UpdateLayeredWindow DrawTextW ClientToScreen SetCursor ScreenToClient SetCapture GetKeyState TrackMouseEvent SetPropW GetAsyncKeyState GetCursorPos ReleaseCapture SetRectEmpty LoadStringW CopyRect DefWindowProcW CallWindowProcW SetWindowLongW GetWindowLongW InvalidateRect BeginPaint LoadImageW wvsprintfW FillRect CharNextW GetWindowRect SetTimer EndPaint GetKeyboardLayoutList SendMessageW MessageBoxW CreateWindowExW FindWindowExW IsWindow RegisterClassExW LoadKeyboardLayoutW GetClassInfoExW GetClientRect LoadCursorW UnloadKeyboardLayout SetWindowTextW EnableWindow ShowWindow SetWindowPos GetDlgItem GetWindowTextW GetForegroundWindow GetParent KillTimer PostMessageW GetWindowTextLengthW GetMenuItemCount SendMessageTimeoutW UnregisterClassA WindowFromPoint IsIconic GetDesktopWindow GetSystemMetrics UnionRect MonitorFromPoint SubtractRect FindWindowW wsprintfA DestroyIcon GetSystemMenu DeleteMenu GetMenuItemInfoW wsprintfW MessageBoxIndirectW LoadIconW SetParent MoveWindow SystemParametersInfoW SetFocus SetForegroundWindow DestroyWindow DispatchMessageW GetMonitorInfoW IsWindowVisible MonitorFromWindow SetRect TranslateMessage GetMessageW SetActiveWindow ReleaseDC GetDC IsWindowEnabled GetWindowThreadProcessId NotifyWinEvent IntersectRect

gdi32

DeleteDC StretchBlt DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetTextExtentExPointW SetTextCharacterExtra SetBkMode CreateDIBSection SetTextColor GetStockObject CreateFontIndirectW GetObjectW GetFontData GetDeviceCaps SetViewportOrgEx BitBlt

advapi32

CryptSetKeyParam CryptDecrypt CryptReleaseContext CryptDestroyKey CryptImportKey CryptAcquireContextW RegUnLoadKeyW RegLoadKeyW ConvertSidToStringSidW AdjustTokenPrivileges RegEnumKeyExW RegFlushKey RegEnumValueW LookupPrivilegeValueW LookupAccountNameW RegQueryInfoKeyW RegOpenKeyW RegQueryValueExW RegEnumKeyW RegCreateKeyW OpenProcessToken SetSecurityDescriptorSacl GetLengthSid BuildExplicitAccessWithNameW GetSecurityDescriptorSacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeAcl GetNamedSecurityInfoW SetNamedSecurityInfoW SetSecurityDescriptorDacl InitializeSecurityDescriptor AddAccessAllowedAceEx RegSetValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyExW RegDeleteValueW LookupAccountSidW GetTokenInformation

shell32

SHGetPathFromIDListW SHGetFolderPathW ShellExecuteExW SHGetSpecialFolderPathW ShellExecuteW SHFileOperationW SHGetDesktopFolder SHGetFileInfoW SHBrowseForFolderW

ole32

OleCreate OleSetContainedObject OleDraw CoTaskMemFree CoCreateGuid CoInitialize CoUninitialize CoCreateInstance

oleaut32

GetErrorInfo SysStringByteLen SysAllocStringByteLen VariantInit SysStringLen SysAllocString SysFreeString VariantClear

ws2_32

setsockopt connect socket inet_addr gethostbyname inet_ntoa getpeername getservbyname gethostbyaddr getservbyport WSASetLastError gethostname sendto recvfrom getsockopt htons bind ntohs getsockname send recv WSAGetLastError closesocket WSAStartup WSACleanup accept listen __WSAFDIsSet ioctlsocket htonl select

wldap32

ord33 ord60 ord143 ord50 ord22 ord26 ord30 ord32 ord35 ord79 ord200 ord211 ord301 ord27 ord41 ord46

imm32

ImmNotifyIME ImmSetOpenStatus ImmGetContext ImmInstallIMEW ImmGetIMEFileNameW ImmDisableIME

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

psapi

GetModuleFileNameExW GetProcessMemoryInfo

msimg32

AlphaBlend

oleacc

LresultFromObject AccessibleObjectFromWindow

AddAccess AddAccessExec AddAccessOnReg AddAccess_RX AddIE7ElevationPolicy AddSogouImeMgrSchTasks AttachProgressBar BackupExe BackupOtherFile CancelDelayDelDir CheckAccess CmpFile CreateSmartInfoUid DefaultBrowserIsIE DelBackupExe DelayDelFile DelayDelReg DelayDeleteSogouImeFile DeleteShortcut DeleteShortcutWithPath DeleteUsbdt DownloadQuiet ExecWait FilterSid GetCheckBoxState GetFeedBackContact GetFeedBackReason GetHWID GetHwndImage GetHwndMain GetInstallPath GetOSVersionTime GetPPName GetQQStatistics GetSmartInfoOption GetVerifyText GuiInitAndAttach HideChildWindows ImageInstallingStart InitResource InstSuccessUserNetSchedule InstallIME InstalledIMEIsPre30b1 IsFullScreenActivated IsInWin8 IsInXP IsReadScreenEnable IsShowOpenMedal IsSmartInfoEnable IsSogouExplorerInstalled IsSogouMobileInstalled KillProcess MonitorUninstallCompleted MonitorVerifyEdit MonitorVerifyUninstallSelect MoveImeDir OnAbort OnPageLeave OnPagePre OnPageShow OpenPage Ping PluginToComp QQMgrSetIESP ReadIniStr ReadSmartInfoOption RemoveCommonDir RemoveDir RemoveFireWall RemoveIE7ElevationPolicy RemoveSogouImeMgrSchTasks RunLotus SECheckOSInstalled SaveInstallTime SetCheckBoxState SetGuideQQUrl SetLowLabel SetMutex SetQQShowType SetReadSecond SetReboot SetShowQQ SetSmartInfoOption SetUrlInvite SetWithType ShowQQOrNot SwitchIme UnGuiInitAndAttach UninstallInstPath UninstallReg UninstallUsrReg UpdateFireWall UpdateFireWall_OctopusDownloader WaitAccountThread

$PLUGINSDIR/SetupUi.cupf

SHA256 e46617d75a129ba18eba5e82a8b94ad751426ec44bf32565fc77dfcd8b7336df
MD5 bd74c20be48f2a3ee1d78ef94811d717
SHA1 08a428e81b32ef104d6fb8cbef5723fedb47ddcb
SHA512 4c7c2c8bd74fa6d3253c31954997f70367166a92532eefb116180828ef9e542de578880d1272688339d5a524a956c5d1156da1874061fd09e42a71472d60b0f9
SSDEEP 12288:qKvpfR5QAzBqMGH0ZpZ/Ro7Gxy0FSGUfkUmYWnBjzO:qiXzYMGUZ8f7mYWBji
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/SogouPY.ime

IMPHASH 0fd6c2568420f823cf69e793ed85f7c5
SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
MD5 67878eda87845d76dc5cf786568c3b5a
SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

3282544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess InterlockedIncrement ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread InterlockedCompareExchange GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetLastError GlobalAddAtomW GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP InterlockedDecrement GetCurrentProcessId OutputDebugStringW GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock TlsGetValue GetCommandLineW WideCharToMultiByte CloseHandle OpenEventW GetProcAddress SetEnvironmentVariableA CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetFullPathNameA SetEndOfFile SetStdHandle GetStringTypeW GetStartupInfoA SetHandleCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetCurrentDirectoryA GetFullPathNameW LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetQueuedCompletionStatus TransactNamedPipe InterlockedExchange CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree GetConsoleMode FlushFileBuffers VirtualQuery SetUnhandledExceptionFilter TerminateProcess lstrlenW lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW RtlUnwind GetFileInformationByHandle GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy HeapSize GetConsoleCP FreeEnvironmentStringsA

user32

PeekMessageW PostThreadMessageW GetKeyboardState GetForegroundWindow MessageBoxW SendMessageW SetWindowLongW PostMessageW GetMessageW SetTimer IsWindow wsprintfW wsprintfA WindowFromPoint IsCharAlphaNumericW SetRectEmpty SetWindowPos MsgWaitForMultipleObjectsEx wvsprintfW CopyRect GetMonitorInfoW ReleaseCapture EqualRect CreateWindowExW ReleaseDC OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetClassLongW GetClassLongW SetWindowRgn mouse_event GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty EndDialog LoadIconW FindWindowW GetParent GetFocus SetForegroundWindow DestroyWindow GetMenuItemCount GetCursorPos GetMenuItemInfoW LoadImageW GetWindowLongW UnhookWindowsHookEx SetWindowsHookExW GetDesktopWindow GetClassNameW GetWindowTextW GetAsyncKeyState CallNextHookEx GetKeyState GetMessageExtraInfo SendInput keybd_event GetSystemMetrics DispatchMessageW TranslateMessage SendMessageTimeoutW GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW

gdi32

SetMapMode ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps StretchDIBits GetFontData CreateFontIndirectW BitBlt SetTextColor GetStockObject StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetBkColor CreateFontW

advapi32

LookupAccountSidW OpenProcessToken GetTokenInformation RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptDecrypt CryptReleaseContext CryptDestroyKey CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptGetKeyParam RegCreateKeyExA RegNotifyChangeKeyValue

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

ws2_32

WSAStartup WSACleanup closesocket WSAGetLastError recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect socket inet_addr gethostbyname inet_ntoa htonl getservbyname gethostbyaddr getservbyport WSASetLastError gethostname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket

shlwapi

wnsprintfA SHGetValueW SHDeleteKeyA

oleacc

LresultFromObject AccessibleObjectFromWindow

$PLUGINSDIR/SogouPY64.ime

IMPHASH 792ef1c1b1d1afbe31eaee5afc9eb35b
SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
MD5 d6bb082f1fd6edcd000e75d3822adbc8
SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

2598244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy64.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

GlobalGetAtomNameW LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore GlobalAddAtomW CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread GetProcAddress InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW GetLastError CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile OpenEventW CloseHandle WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP GetCurrentProcessId GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock GetQueuedCompletionStatus TransactNamedPipe CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree OutputDebugStringW FlushFileBuffers RtlCaptureContext VirtualQuery SetUnhandledExceptionFilter RtlVirtualUnwind TerminateProcess lstrlenW RtlLookupFunctionEntry lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW WideCharToMultiByte SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess FlsSetValue GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc RtlUnwindEx GetFileInformationByHandle GetDriveTypeA FindFirstFileA RtlPcToFileHeader GetCPInfo GetOEMCP IsValidCodePage HeapSetInformation HeapCreate HeapDestroy HeapSize GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA GetFullPathNameW GetCurrentDirectoryA GetDateFormatA GetTimeFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile GetFullPathNameA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA SetEnvironmentVariableA TlsGetValue GetCommandLineW

user32

OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW ReleaseDC DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetWindowRgn GetSysColorBrush GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty IsCharAlphaNumericW WindowFromPoint wsprintfA wsprintfW GetClassLongPtrW SetClassLongPtrW mouse_event PostMessageW SetWindowLongPtrW SendMessageW MessageBoxW GetForegroundWindow GetKeyboardState CreateWindowExW EqualRect ReleaseCapture GetMonitorInfoW CopyRect wvsprintfW MsgWaitForMultipleObjectsEx SetWindowPos SetRectEmpty GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic GetWindowLongW SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW SendMessageTimeoutW TranslateMessage DispatchMessageW GetSystemMetrics keybd_event SendInput GetMessageExtraInfo GetKeyState CallNextHookEx GetAsyncKeyState GetWindowTextW GetClassNameW GetDesktopWindow SetWindowsHookExW UnhookWindowsHookEx GetWindowLongPtrW LoadImageW GetMenuItemInfoW GetCursorPos GetMenuItemCount GetMenuInfo DestroyMenu DestroyWindow SetForegroundWindow GetFocus GetParent FindWindowW LoadIconW EndDialog IsWindow SetTimer GetMessageW PeekMessageW PostThreadMessageW

gdi32

SetBkColor ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject SetPixel CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetStockObject GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps CreateFontW GetFontData CreateFontIndirectW BitBlt SetTextColor StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetMapMode StretchDIBits

advapi32

CryptDestroyKey CryptDecrypt CryptGetKeyParam OpenProcessToken GetTokenInformation LookupAccountSidW RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptReleaseContext RegNotifyChangeKeyValue RegCreateKeyExA

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

shlwapi

StrStrIW wnsprintfA SHDeleteKeyA SHGetValueW

oleacc

AccessibleObjectFromWindow LresultFromObject

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

355KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SogouIn

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/SogouTSF.ime

IMPHASH c3a3f156413a2410d2eaca99664701f9
SHA256 500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
MD5 b6a3aa486dd89f66d2811144d4e089e2
SHA1 931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
SHA512 a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
SSDEEP 24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

561618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouTSF.pdb

kernel32

GetTickCount GetCurrentThreadId GetProcAddress TlsAlloc TlsFree SetFilePointer GetCurrentProcess WriteFile GlobalAlloc FormatMessageW CreateFileW ExitThread GetLastError SetLastError GlobalFree CreateEventW CloseHandle LocalFree CreateThread GetCommandLineW GetModuleHandleW GetSystemDirectoryW GetTempPathW GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar GetLogicalDriveStringsW OpenProcess GetFileAttributesW FindClose lstrlenW SetFileAttributesW FindResourceW LoadResource SizeofResource LockResource LocalAlloc CreateDirectoryW WaitForSingleObject Sleep FileTimeToSystemTime GetFileSize ReadFile FlushFileBuffers GetVersionExW CreateMutexW OpenMutexW ReleaseMutex MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW SetEvent GlobalLock GlobalUnlock GlobalReAlloc GetWindowsDirectoryA GetACP CreateFileA CreateFileMappingA OpenFileMappingA HeapFree HeapAlloc HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetSystemTimeAsFileTime GetTimeZoneInformation FileTimeToLocalFileTime ResumeThread RtlUnwind RaiseException GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy VirtualFree VirtualAlloc ExitProcess GetStdHandle GetModuleFileNameA HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter LCMapStringA LCMapStringW GetCurrentDirectoryA GetModuleHandleA GetFullPathNameA GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap CompareStringA CompareStringW SetEnvironmentVariableA LoadLibraryW FreeLibrary DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue InterlockedDecrement InterlockedIncrement QueryDosDeviceW GetModuleFileNameW GlobalHandle

user32

MoveWindow ReleaseCapture GetCursor RedrawWindow GetAsyncKeyState OffsetRect SetCapture SetWindowRgn UpdateLayeredWindow SetCursor LoadImageW SetCursorPos IntersectRect SubtractRect MonitorFromPoint GetWindowRect GetDesktopWindow SetWindowPos ShowWindow IsWindow EndPaint FillRect PostMessageW DrawTextW LoadCursorW BeginPaint InflateRect DestroyWindow SetTimer UnregisterClassW KillTimer SetRectEmpty RegisterClassExW GetWindowLongW GetLastInputInfo PtInRect GetDC SetRect ReleaseDC SetWindowLongW GetCursorPos CreateWindowExW DefWindowProcW EnumThreadWindows ClientToScreen GetCaretPos GetSystemMetrics SetCaretPos GetMonitorInfoW MonitorFromRect IsRectEmpty GetFocus GetParent FindWindowW GetClassNameW IsWindowVisible GetForegroundWindow MapVirtualKeyW GetKeyboardState ToUnicode GetKeyState SendMessageW ToAscii

advapi32

GetNamedSecurityInfoW RegSetValueExW RegCloseKey RegDeleteValueW RegOpenKeyW RegCreateKeyExW RegQueryValueExW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW AddAccessAllowedAceEx InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW RegEnumValueW RegQueryInfoKeyW SetSecurityDescriptorSacl GetLengthSid BuildExplicitAccessWithNameW GetSecurityDescriptorSacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeAcl

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

imm32

ImmDisableIME ImmCreateContext ImmDestroyContext ImmLockIMCC ImmUnlockIMCC ImmLockIMC ImmGetIMCCSize ImmCreateIMCC ImmUnlockIMC ImmReSizeIMCC

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

msimg32

AlphaBlend TransparentBlt

gdi32

DeleteDC SelectObject GetPixel GetStockObject SetTextColor Rectangle CreatePen StretchDIBits GetTextExtentPoint32W GetCharABCWidthsFloatW ExtCreateRegion StretchBlt OffsetRgn CombineRgn CreateDIBSection SetBkMode SelectClipRgn CreateSolidBrush GetTextMetricsW CreateFontIndirectW DeleteObject CreateCompatibleBitmap GetObjectW GetTextExtentExPointW CreateRectRgn GetFontData LineTo BitBlt CreateCompatibleDC MoveToEx

shell32

SHGetFolderPathW ShellExecuteW

$PLUGINSDIR/SogouTSF64.ime

IMPHASH 6c181573b0a8b6dd129b9b500dc75330
SHA256 894efa9aa999124ab5bdc3e04aab2ac31cb02258c6a814e4c758796c1ce1daf5
MD5 9781b5a306c996fe6408686b167c6750
SHA1 446c816ca849bd023d111acdd5cda94b7dd47099
SHA512 bd8c55ec6cf516404a19a9bd7a6ba787fb298a39cb474322c54fa839821bbc11f96fde19f5e76c4b5042e536ecfc79386ec446356f8da0fa920b4e5f3a9b7bca
SSDEEP 24576:oDBeZWKf0RfvAHIhMGas/wQ1d4DwE7QEOvJ1NZV5TWcj8c1es/+NrWQzI:oVeZWnACMGawdd3TEcYiUrWX
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

560368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouTSF6464.pdb

kernel32

GlobalAlloc FormatMessageW CreateFileW ExitThread GetLastError SetLastError GlobalFree CreateEventW DuplicateHandle CloseHandle LocalFree CreateThread GetCommandLineW GetModuleHandleW GetSystemDirectoryW GetTempPathW GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar FindFirstFileW MoveFileExW GetLogicalDriveStringsW OpenProcess GetFileAttributesW FindClose RemoveDirectoryW QueryDosDeviceW FindNextFileW SetFileAttributesW FindResourceW LoadResource SizeofResource LockResource LocalAlloc CreateProcessW CreateDirectoryW WaitForSingleObject WriteFile Sleep CopyFileW FileTimeToSystemTime DeleteFileW GetFileSize ReadFile FlushFileBuffers QueryPerformanceCounter GetVersionExW CreateMutexW OpenMutexW ReleaseMutex MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW SetEvent GlobalLock GlobalUnlock GlobalReAlloc GetCurrentProcess GetACP CreateFileA CreateFileMappingA OpenFileMappingA HeapFree HeapAlloc HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FlsSetValue GetCommandLineA GetSystemTimeAsFileTime GetTimeZoneInformation FileTimeToLocalFileTime ResumeThread EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc RtlUnwindEx RaiseException RtlPcToFileHeader GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapSetInformation HeapCreate HeapDestroy ExitProcess GetStdHandle GetModuleFileNameA HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA LCMapStringW GetCurrentDirectoryA GetDateFormatA GetTimeFormatA GetFullPathNameA GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap CompareStringA CompareStringW SetEnvironmentVariableA SetFilePointer TlsFree TlsAlloc GetWindowsDirectoryA GetTickCount GetCurrentThreadId GetProcAddress lstrlenW LoadLibraryW FreeLibrary DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue GetModuleFileNameW GlobalHandle

user32

SetCapture SetWindowRgn UpdateLayeredWindow SetCursor LoadImageW SetCursorPos IntersectRect SubtractRect MonitorFromPoint CallWindowProcW GetSysColorBrush InvalidateRect GetClientRect ToAscii IsWindow TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx DispatchMessageW GetWindowRect GetDesktopWindow SetWindowPos ShowWindow MessageBoxW MoveWindow EndPaint FillRect DrawTextW OffsetRect PostMessageW BeginPaint SendMessageW GetKeyState ToUnicode InflateRect GetKeyboardState MapVirtualKeyW GetForegroundWindow IsWindowVisible DestroyWindow SetTimer UnregisterClassW KillTimer GetWindowLongPtrW SetRectEmpty RegisterClassExW GetLastInputInfo PtInRect GetDC SetRect ReleaseDC GetCursorPos CreateWindowExW SetWindowLongPtrW DefWindowProcW EnumThreadWindows ClientToScreen GetCaretPos GetSystemMetrics SetCaretPos GetMonitorInfoW MonitorFromRect IsRectEmpty GetFocus GetParent FindWindowW GetAsyncKeyState RedrawWindow GetCursor LoadCursorW ReleaseCapture GetClassNameW

advapi32

GetLengthSid RegSetValueExW RegCloseKey RegDeleteValueW RegOpenKeyW RegCreateKeyExW OpenProcessToken GetTokenInformation LookupAccountSidW RegQueryValueExW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW AddAccessAllowedAceEx InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo SetEntriesInAclW GetSecurityDescriptorSacl RegEnumValueW RegQueryInfoKeyW SetSecurityDescriptorSacl BuildExplicitAccessWithNameW

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysStringLen SysAllocString SysFreeString

imm32

ImmDisableIME ImmCreateContext ImmDestroyContext ImmUnlockIMCC ImmLockIMC ImmLockIMCC ImmUnlockIMC ImmCreateIMCC ImmReSizeIMCC ImmGetIMCCSize

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

msimg32

TransparentBlt AlphaBlend GradientFill

gdi32

GetFontData CreateCompatibleDC MoveToEx SelectObject BitBlt LineTo DeleteDC GetPixel GetStockObject SetTextColor Rectangle CreatePen StretchDIBits GetTextExtentPoint32W GetCharABCWidthsFloatW CreateSolidBrush GetTextMetricsW CreateFontIndirectW DeleteObject ExtCreateRegion StretchBlt OffsetRgn CombineRgn CreateDIBSection SetBkMode SelectClipRgn CreateRectRgn CreateCompatibleBitmap GetFontUnicodeRanges GetObjectW GetTextExtentExPointW

shell32

SHFileOperationW SHGetFolderPathW ShellExecuteW

$PLUGINSDIR/System.dll

IMPHASH 6c41c5e4d44f55745b925cc4e42b7fab
SHA256 b496e81a74ce871236abcd096fb9a6b210b456bebaa7464fa844b3241e51a655
MD5 b9f430f71c7144d8ff4ab94be2785aa6
SHA1 c5c1e153caff7ad1d221a9acc8bbb831f05ccb05
SHA512 c7ce431b6a1493fd7d1fe1b1c823ad22b582c43c8eb2fb6a471c648dd9df9953277c89932c66afd598d43ea36f4a8602e84cd175115266943071cbc8ce204099
SSDEEP 192:hClej3uzvJwqJMQKN4GbeWZksMI4ETWcEbcBZ8ep2Kra7yOG:hCm2HgN4GbeWmbI4Eybogia7yO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9889

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/install0.png

SHA256 c14a9347b49ad321d977b54878b8572840788b1e969f1b098e6cc525ab905d49
MD5 1ffb85bd5f8d84dd4bb55d509d91b85f
SHA1 c2e757bf39622e9db1542a32d7241ba8380849d5
SHA512 83d8ac06e8a24f1d8e729eb5fad65a3256e63a1a8597d74d3792244c685f84ddb0be62e8a20ede749d136a0ca0586c05670b544aca0f7496377593a968cddcca
SSDEEP 768:jWdA+lWl/VeEVTy/KK8H1fv/QuEKVwgeqyYFpXoZsYep8Lp:jWddWl/VRcaHZv/tEceYFpXosp8d
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/install1.png

SHA256 a38ee498c4b454ae10abc1dfef345946d870aecee4744ee7a5aeacc4a46db3d2
MD5 219867128a590d3ee7718d93aaf556af
SHA1 1b4c2decc22f167275c50b48174e51932a587812
SHA512 272c2d9feded38121c653817a86d785bd39a692f405640c751ee0182b021f741dbaf6a24a746468cb002138edbc8366ec019c1cdbd705de6543e3ac6d610803b
SSDEEP 768:Jb6+6wOyAtP/D8NOMb2sYTHxpd1iRclG7k2HBrKc4qpIloqW73p61dIQD97kcfyE:Jb76wOyeP/CEVz1s6H2HBrKcT4HI097j
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/install2.png

SHA256 0b8f4a9ce0d1fe753af58068574a7ea4c062a55125349ce866c6ee3259237886
MD5 e1c83d688b8a0d86b00252727a290229
SHA1 39c778e19ad5360a955ba6fb0ac7cfac47e44d7c
SHA512 5d2136528829d505f1b3c29e5cc77b4e43b175cf207d3ad0cdd9953ec7d870c6195b0e24129b76645d16f0c85b6d0ddbdd82479a96b3dc2d11ddc404c656ef6e
SSDEEP 768:Szv1NgovtvEuO5jT6Jn9gIlXqC5sFK/QmyhiNqGy9kcPeK:0v1NpvEusP6Jn6IlltfsGskBK
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/install3.png

SHA256 a7b92f436d226aad2580e5775c3cc866b0a01cead089b2721beb26d53000ee7b
MD5 9cf40266606f6a66ca94825dbead5d67
SHA1 fb6b2b033a1cc047131f8fa06fa0fb39d096edb6
SHA512 76098e1120c9de6945eda2ae1c9b74bef2e207533b966b1eead8b32d365fe699cabe8857480689c3eb698d64bca1fd5e39e5808865072d823d156e47c4cb5902
SSDEEP 768:kuvRIHpW5Bwb+65EKO9L6xsiZPaWPN9Tq1SX3KvYUwUoxKdkhNxoR:k5pWN65EKO9IP7FHabahNm
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
MD5 SHA1 SHA512

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-header.bmp

SHA256 3276c748d277d635b570e367d37f2608713e23c30b5c9823109ba8513b92c0d1
MD5 df4699852a66052a9202b0b91e7c71d2
SHA1 e89f2147d4875d401900a7b6c99daa4a8da89eea
SHA512 afee4d9e3da7461e2f4a5e43b9ce599a06e18e91f4fd7069ee74043e1442f91ab43d8be140042f9a92b40a0d4f92488c5131dbad5a03549f56d9b6b2a5bbfdae
SSDEEP 192:73lTJs0O+pOFt+g/DQUGO2+FJQMvFbVmw4UclSg0phAQJAUbxOxGHnvDKlIf6yP/:73P4+pPgDQw6MvFbowZcq+G6Fg
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/modern-wizard.bmp

SHA256 def16f9cb85d9da758071659be0ff7a51a24e53b72fca0316e6258c6754b7fa6
MD5 0d479fe7a43a151511ce61b4264e1ffc
SHA1 1f1dd58b766deb34ce2998219b98790525bd23b5
SHA512 191bb1fb282e49429840ba0ffd1102688f80472f5e722b80ca656995c0669af0e82c87788c9264c8029d60e93fc283b73a339b5870501b931efbdcc7da0faf86
SSDEEP 3072:cDnYu83SU/z2tlY888888888888888888888888888888888888888888J88888B:cLv8f2k888888888888888888888888K
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 ca869d6c6752aa4a8a6c874a694b543442992d7e854d0c48a1b60bca01a8c8c6
MD5 7823fc560926dcd8741de6f0b900083f
SHA1 93dc0a704bc0b8f90668548e36daf459be0ae10a
SHA512 c79509cd306638ea9badec64ed9f7d0690e46fcab7ac77f25134065b628e76d2812f2d874ea2cc4283685c567b613a39d27b9fc4a6de2d4b9d30131f3161c4e9
SSDEEP 192:SzQhZDqlJcKISw99ioU3MSfwLF/+nhHUVsdz:SzoZDGKYw9goWyFGBU4z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7449

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$SYSDIR/SogouPY.ime

IMPHASH 792ef1c1b1d1afbe31eaee5afc9eb35b
SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
MD5 d6bb082f1fd6edcd000e75d3822adbc8
SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

2598244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy64.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

GlobalGetAtomNameW LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore GlobalAddAtomW CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread GetProcAddress InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW GetLastError CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile OpenEventW CloseHandle WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP GetCurrentProcessId GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock GetQueuedCompletionStatus TransactNamedPipe CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree OutputDebugStringW FlushFileBuffers RtlCaptureContext VirtualQuery SetUnhandledExceptionFilter RtlVirtualUnwind TerminateProcess lstrlenW RtlLookupFunctionEntry lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW WideCharToMultiByte SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess FlsSetValue GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc RtlUnwindEx GetFileInformationByHandle GetDriveTypeA FindFirstFileA RtlPcToFileHeader GetCPInfo GetOEMCP IsValidCodePage HeapSetInformation HeapCreate HeapDestroy HeapSize GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA GetFullPathNameW GetCurrentDirectoryA GetDateFormatA GetTimeFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile GetFullPathNameA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA SetEnvironmentVariableA TlsGetValue GetCommandLineW

user32

OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW ReleaseDC DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetWindowRgn GetSysColorBrush GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty IsCharAlphaNumericW WindowFromPoint wsprintfA wsprintfW GetClassLongPtrW SetClassLongPtrW mouse_event PostMessageW SetWindowLongPtrW SendMessageW MessageBoxW GetForegroundWindow GetKeyboardState CreateWindowExW EqualRect ReleaseCapture GetMonitorInfoW CopyRect wvsprintfW MsgWaitForMultipleObjectsEx SetWindowPos SetRectEmpty GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic GetWindowLongW SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW SendMessageTimeoutW TranslateMessage DispatchMessageW GetSystemMetrics keybd_event SendInput GetMessageExtraInfo GetKeyState CallNextHookEx GetAsyncKeyState GetWindowTextW GetClassNameW GetDesktopWindow SetWindowsHookExW UnhookWindowsHookEx GetWindowLongPtrW LoadImageW GetMenuItemInfoW GetCursorPos GetMenuItemCount GetMenuInfo DestroyMenu DestroyWindow SetForegroundWindow GetFocus GetParent FindWindowW LoadIconW EndDialog IsWindow SetTimer GetMessageW PeekMessageW PostThreadMessageW

gdi32

SetBkColor ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject SetPixel CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetStockObject GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps CreateFontW GetFontData CreateFontIndirectW BitBlt SetTextColor StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetMapMode StretchDIBits

advapi32

CryptDestroyKey CryptDecrypt CryptGetKeyParam OpenProcessToken GetTokenInformation LookupAccountSidW RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptReleaseContext RegNotifyChangeKeyValue RegCreateKeyExA

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

shlwapi

StrStrIW wnsprintfA SHDeleteKeyA SHGetValueW

oleacc

AccessibleObjectFromWindow LresultFromObject

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

355KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SogouIn

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$SYSDIR/SogouPY.ime~

IMPHASH 792ef1c1b1d1afbe31eaee5afc9eb35b
SHA256 4740bea98228b4590d45b5ee6cf598187eab63f3768d625cb9c23f97d4bc59aa
MD5 d6bb082f1fd6edcd000e75d3822adbc8
SHA1 04783fa76820795009ce0c2ba176e2996b9b4acc
SHA512 4f5101ac97b1823b411af792fec1ce1f5b5c09bdbdf137a101fc5cf48eec5732f1a8e3a7e7ff3b67eb387b5ab14fd4894c9b1b5a6b2d44e89de051fbf3a99009
SSDEEP 49152:Jq5Z5ld5xWqHcqoEgrgD8WLJiqaa6kwJZSaBpi6euv3/NyZO3s3m5fUfwGl+tZ5u:Kn7casHi6ps2Re6FHlSuYYy4p4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

2

Major OS version

5

Entry point

2598244

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy64.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

GlobalGetAtomNameW LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore GlobalAddAtomW CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread GetProcAddress InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW GetLastError CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile OpenEventW CloseHandle WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP GetCurrentProcessId GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock GetQueuedCompletionStatus TransactNamedPipe CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree OutputDebugStringW FlushFileBuffers RtlCaptureContext VirtualQuery SetUnhandledExceptionFilter RtlVirtualUnwind TerminateProcess lstrlenW RtlLookupFunctionEntry lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW WideCharToMultiByte SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess FlsSetValue GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW EncodePointer DecodePointer FlsGetValue FlsFree FlsAlloc RtlUnwindEx GetFileInformationByHandle GetDriveTypeA FindFirstFileA RtlPcToFileHeader GetCPInfo GetOEMCP IsValidCodePage HeapSetInformation HeapCreate HeapDestroy HeapSize GetConsoleCP GetConsoleMode SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringA GetFullPathNameW GetCurrentDirectoryA GetDateFormatA GetTimeFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetStdHandle SetEndOfFile GetFullPathNameA GetLocaleInfoW WriteConsoleA GetConsoleOutputCP WriteConsoleW CompareStringA SetEnvironmentVariableA TlsGetValue GetCommandLineW

user32

OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW ReleaseDC DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetWindowRgn GetSysColorBrush GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty IsCharAlphaNumericW WindowFromPoint wsprintfA wsprintfW GetClassLongPtrW SetClassLongPtrW mouse_event PostMessageW SetWindowLongPtrW SendMessageW MessageBoxW GetForegroundWindow GetKeyboardState CreateWindowExW EqualRect ReleaseCapture GetMonitorInfoW CopyRect wvsprintfW MsgWaitForMultipleObjectsEx SetWindowPos SetRectEmpty GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic GetWindowLongW SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW SendMessageTimeoutW TranslateMessage DispatchMessageW GetSystemMetrics keybd_event SendInput GetMessageExtraInfo GetKeyState CallNextHookEx GetAsyncKeyState GetWindowTextW GetClassNameW GetDesktopWindow SetWindowsHookExW UnhookWindowsHookEx GetWindowLongPtrW LoadImageW GetMenuItemInfoW GetCursorPos GetMenuItemCount GetMenuInfo DestroyMenu DestroyWindow SetForegroundWindow GetFocus GetParent FindWindowW LoadIconW EndDialog IsWindow SetTimer GetMessageW PeekMessageW PostThreadMessageW

gdi32

SetBkColor ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject SetPixel CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetStockObject GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps CreateFontW GetFontData CreateFontIndirectW BitBlt SetTextColor StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetMapMode StretchDIBits

advapi32

CryptDestroyKey CryptDecrypt CryptGetKeyParam OpenProcessToken GetTokenInformation LookupAccountSidW RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptReleaseContext RegNotifyChangeKeyValue RegCreateKeyExA

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

shlwapi

StrStrIW wnsprintfA SHDeleteKeyA SHGetValueW

oleacc

AccessibleObjectFromWindow LresultFromObject

Name

.text

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

162KB

Virtual Size

344KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

355KB

Virtual Size

355KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SogouIn

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

152KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$SYSDIR/SogouTSF.ime

IMPHASH c3a3f156413a2410d2eaca99664701f9
SHA256 500d36c3c9e11e246fd9f1e616f806a833e02ff9283152d3a94649ba08e4a602
MD5 b6a3aa486dd89f66d2811144d4e089e2
SHA1 931b3a5beb0ff1f1bd4a7dce4264a28e71aa3fc3
SHA512 a759445c5a7b31574046382f3ecdb2c4a5b5d67f989cfe8bc91683161cd265e3c91c4b157ae63e06388ca903b404e35d068bc80b4b4157e01cfc5f05540614d1
SSDEEP 24576:IXULxRXSnM/6f/M2dx5N5cxnC279V+jTi6yTxcjGHX6RF:GMi/B6C279ylyThKRF
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

561618

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouTSF.pdb

kernel32

GetTickCount GetCurrentThreadId GetProcAddress TlsAlloc TlsFree SetFilePointer GetCurrentProcess WriteFile GlobalAlloc FormatMessageW CreateFileW ExitThread GetLastError SetLastError GlobalFree CreateEventW CloseHandle LocalFree CreateThread GetCommandLineW GetModuleHandleW GetSystemDirectoryW GetTempPathW GetCurrentProcessId WideCharToMultiByte MultiByteToWideChar GetLogicalDriveStringsW OpenProcess GetFileAttributesW FindClose lstrlenW SetFileAttributesW FindResourceW LoadResource SizeofResource LockResource LocalAlloc CreateDirectoryW WaitForSingleObject Sleep FileTimeToSystemTime GetFileSize ReadFile FlushFileBuffers GetVersionExW CreateMutexW OpenMutexW ReleaseMutex MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW SetEvent GlobalLock GlobalUnlock GlobalReAlloc GetWindowsDirectoryA GetACP CreateFileA CreateFileMappingA OpenFileMappingA HeapFree HeapAlloc HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetSystemTimeAsFileTime GetTimeZoneInformation FileTimeToLocalFileTime ResumeThread RtlUnwind RaiseException GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy VirtualFree VirtualAlloc ExitProcess GetStdHandle GetModuleFileNameA HeapSize SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter LCMapStringA LCMapStringW GetCurrentDirectoryA GetModuleHandleA GetFullPathNameA GetStringTypeA GetStringTypeW GetLocaleInfoA LoadLibraryA GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetEndOfFile GetProcessHeap CompareStringA CompareStringW SetEnvironmentVariableA LoadLibraryW FreeLibrary DeleteCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TlsSetValue TlsGetValue InterlockedDecrement InterlockedIncrement QueryDosDeviceW GetModuleFileNameW GlobalHandle

user32

MoveWindow ReleaseCapture GetCursor RedrawWindow GetAsyncKeyState OffsetRect SetCapture SetWindowRgn UpdateLayeredWindow SetCursor LoadImageW SetCursorPos IntersectRect SubtractRect MonitorFromPoint GetWindowRect GetDesktopWindow SetWindowPos ShowWindow IsWindow EndPaint FillRect PostMessageW DrawTextW LoadCursorW BeginPaint InflateRect DestroyWindow SetTimer UnregisterClassW KillTimer SetRectEmpty RegisterClassExW GetWindowLongW GetLastInputInfo PtInRect GetDC SetRect ReleaseDC SetWindowLongW GetCursorPos CreateWindowExW DefWindowProcW EnumThreadWindows ClientToScreen GetCaretPos GetSystemMetrics SetCaretPos GetMonitorInfoW MonitorFromRect IsRectEmpty GetFocus GetParent FindWindowW GetClassNameW IsWindowVisible GetForegroundWindow MapVirtualKeyW GetKeyboardState ToUnicode GetKeyState SendMessageW ToAscii

advapi32

GetNamedSecurityInfoW RegSetValueExW RegCloseKey RegDeleteValueW RegOpenKeyW RegCreateKeyExW RegQueryValueExW RegDeleteKeyW RegOpenKeyExW RegEnumKeyExW AddAccessAllowedAceEx InitializeSecurityDescriptor SetSecurityDescriptorDacl SetNamedSecurityInfoW RegEnumValueW RegQueryInfoKeyW SetSecurityDescriptorSacl GetLengthSid BuildExplicitAccessWithNameW GetSecurityDescriptorSacl SetEntriesInAclW SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW InitializeAcl

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

imm32

ImmDisableIME ImmCreateContext ImmDestroyContext ImmLockIMCC ImmUnlockIMCC ImmLockIMC ImmGetIMCCSize ImmCreateIMCC ImmUnlockIMC ImmReSizeIMCC

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

msimg32

AlphaBlend TransparentBlt

gdi32

DeleteDC SelectObject GetPixel GetStockObject SetTextColor Rectangle CreatePen StretchDIBits GetTextExtentPoint32W GetCharABCWidthsFloatW ExtCreateRegion StretchBlt OffsetRgn CombineRgn CreateDIBSection SetBkMode SelectClipRgn CreateSolidBrush GetTextMetricsW CreateFontIndirectW DeleteObject CreateCompatibleBitmap GetObjectW GetTextExtentExPointW CreateRectRgn GetFontData LineTo BitBlt CreateCompatibleDC MoveToEx

shell32

SHGetFolderPathW ShellExecuteW

$_13_/HWSignature.dll

IMPHASH de18af259ae709a6bea8669b60fd1118
SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
MD5 87c80914dfc65df16f5ff36040666da3
SHA1 06aefe9570ef484a322c53297152f1ea50746878
SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

16955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\HWSignature.pdb

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

ExitProcess FlushFileBuffers CreateFileA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA lstrcatA CopyFileA DeviceIoControl CloseHandle lstrcpyA lstrlenA GlobalAlloc FreeLibrary GetLastError GetProcAddress LoadLibraryA LocalAlloc GetVersionExA LocalFree HeapReAlloc GetTickCount SetLastError GlobalFree WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar HeapSize GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc GetModuleHandleW Sleep WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

wsprintfA IsCharAlphaNumericA

7.8.0.7088/HWSignature.dll

IMPHASH de18af259ae709a6bea8669b60fd1118
SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
MD5 87c80914dfc65df16f5ff36040666da3
SHA1 06aefe9570ef484a322c53297152f1ea50746878
SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

16955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\HWSignature.pdb

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

ExitProcess FlushFileBuffers CreateFileA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA lstrcatA CopyFileA DeviceIoControl CloseHandle lstrcpyA lstrlenA GlobalAlloc FreeLibrary GetLastError GetProcAddress LoadLibraryA LocalAlloc GetVersionExA LocalFree HeapReAlloc GetTickCount SetLastError GlobalFree WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar HeapSize GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc GetModuleHandleW Sleep WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

wsprintfA IsCharAlphaNumericA

7.8.0.7088/SetupUi.cupf

SHA256 e46617d75a129ba18eba5e82a8b94ad751426ec44bf32565fc77dfcd8b7336df
MD5 bd74c20be48f2a3ee1d78ef94811d717
SHA1 08a428e81b32ef104d6fb8cbef5723fedb47ddcb
SHA512 4c7c2c8bd74fa6d3253c31954997f70367166a92532eefb116180828ef9e542de578880d1272688339d5a524a956c5d1156da1874061fd09e42a71472d60b0f9
SSDEEP 12288:qKvpfR5QAzBqMGH0ZpZ/Ro7Gxy0FSGUfkUmYWnBjzO:qiXzYMGUZ8f7mYWBji
MD5 SHA1 SHA512 SSDEEP

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

7.8.0.7088/SogouPY.ime

IMPHASH 0fd6c2568420f823cf69e793ed85f7c5
SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
MD5 67878eda87845d76dc5cf786568c3b5a
SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

3282544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess InterlockedIncrement ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread InterlockedCompareExchange GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetLastError GlobalAddAtomW GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP InterlockedDecrement GetCurrentProcessId OutputDebugStringW GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock TlsGetValue GetCommandLineW WideCharToMultiByte CloseHandle OpenEventW GetProcAddress SetEnvironmentVariableA CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetFullPathNameA SetEndOfFile SetStdHandle GetStringTypeW GetStartupInfoA SetHandleCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetCurrentDirectoryA GetFullPathNameW LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetQueuedCompletionStatus TransactNamedPipe InterlockedExchange CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree GetConsoleMode FlushFileBuffers VirtualQuery SetUnhandledExceptionFilter TerminateProcess lstrlenW lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW RtlUnwind GetFileInformationByHandle GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy HeapSize GetConsoleCP FreeEnvironmentStringsA

user32

PeekMessageW PostThreadMessageW GetKeyboardState GetForegroundWindow MessageBoxW SendMessageW SetWindowLongW PostMessageW GetMessageW SetTimer IsWindow wsprintfW wsprintfA WindowFromPoint IsCharAlphaNumericW SetRectEmpty SetWindowPos MsgWaitForMultipleObjectsEx wvsprintfW CopyRect GetMonitorInfoW ReleaseCapture EqualRect CreateWindowExW ReleaseDC OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetClassLongW GetClassLongW SetWindowRgn mouse_event GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty EndDialog LoadIconW FindWindowW GetParent GetFocus SetForegroundWindow DestroyWindow GetMenuItemCount GetCursorPos GetMenuItemInfoW LoadImageW GetWindowLongW UnhookWindowsHookEx SetWindowsHookExW GetDesktopWindow GetClassNameW GetWindowTextW GetAsyncKeyState CallNextHookEx GetKeyState GetMessageExtraInfo SendInput keybd_event GetSystemMetrics DispatchMessageW TranslateMessage SendMessageTimeoutW GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW

gdi32

SetMapMode ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps StretchDIBits GetFontData CreateFontIndirectW BitBlt SetTextColor GetStockObject StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetBkColor CreateFontW

advapi32

LookupAccountSidW OpenProcessToken GetTokenInformation RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptDecrypt CryptReleaseContext CryptDestroyKey CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptGetKeyParam RegCreateKeyExA RegNotifyChangeKeyValue

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

ws2_32

WSAStartup WSACleanup closesocket WSAGetLastError recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect socket inet_addr gethostbyname inet_ntoa htonl getservbyname gethostbyaddr getservbyport WSASetLastError gethostname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket

shlwapi

wnsprintfA SHGetValueW SHDeleteKeyA

oleacc

LresultFromObject AccessibleObjectFromWindow

7.8.0.7088/SogouPY.ime~

IMPHASH 0fd6c2568420f823cf69e793ed85f7c5
SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
MD5 67878eda87845d76dc5cf786568c3b5a
SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

3282544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess InterlockedIncrement ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread InterlockedCompareExchange GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetLastError GlobalAddAtomW GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP InterlockedDecrement GetCurrentProcessId OutputDebugStringW GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock TlsGetValue GetCommandLineW WideCharToMultiByte CloseHandle OpenEventW GetProcAddress SetEnvironmentVariableA CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetFullPathNameA SetEndOfFile SetStdHandle GetStringTypeW GetStartupInfoA SetHandleCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetCurrentDirectoryA GetFullPathNameW LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetQueuedCompletionStatus TransactNamedPipe InterlockedExchange CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree GetConsoleMode FlushFileBuffers VirtualQuery SetUnhandledExceptionFilter TerminateProcess lstrlenW lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW RtlUnwind GetFileInformationByHandle GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy HeapSize GetConsoleCP FreeEnvironmentStringsA

user32

PeekMessageW PostThreadMessageW GetKeyboardState GetForegroundWindow MessageBoxW SendMessageW SetWindowLongW PostMessageW GetMessageW SetTimer IsWindow wsprintfW wsprintfA WindowFromPoint IsCharAlphaNumericW SetRectEmpty SetWindowPos MsgWaitForMultipleObjectsEx wvsprintfW CopyRect GetMonitorInfoW ReleaseCapture EqualRect CreateWindowExW ReleaseDC OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetClassLongW GetClassLongW SetWindowRgn mouse_event GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty EndDialog LoadIconW FindWindowW GetParent GetFocus SetForegroundWindow DestroyWindow GetMenuItemCount GetCursorPos GetMenuItemInfoW LoadImageW GetWindowLongW UnhookWindowsHookEx SetWindowsHookExW GetDesktopWindow GetClassNameW GetWindowTextW GetAsyncKeyState CallNextHookEx GetKeyState GetMessageExtraInfo SendInput keybd_event GetSystemMetrics DispatchMessageW TranslateMessage SendMessageTimeoutW GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW

gdi32

SetMapMode ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps StretchDIBits GetFontData CreateFontIndirectW BitBlt SetTextColor GetStockObject StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetBkColor CreateFontW

advapi32

LookupAccountSidW OpenProcessToken GetTokenInformation RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptDecrypt CryptReleaseContext CryptDestroyKey CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptGetKeyParam RegCreateKeyExA RegNotifyChangeKeyValue

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

ws2_32

WSAStartup WSACleanup closesocket WSAGetLastError recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect socket inet_addr gethostbyname inet_ntoa htonl getservbyname gethostbyaddr getservbyport WSASetLastError gethostname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket

shlwapi

wnsprintfA SHGetValueW SHDeleteKeyA

oleacc

LresultFromObject AccessibleObjectFromWindow

7.8.0.7088/SogouPY7.ime

IMPHASH 0fd6c2568420f823cf69e793ed85f7c5
SHA256 29a7c9c9f2399827c4ae67a62c414750e8ce26b46103dac3db5dbc17c4559716
MD5 67878eda87845d76dc5cf786568c3b5a
SHA1 1c190bcac6dfb8fa7bf9cb3d65fbda5a679db21b
SHA512 53b42078098788d7f4f66779946483aafa0711459daca4905b0e9a6286175aeeb109b8a8d528b9c59622162b249bd961a11c9186c07e76946007f5b9605e58e0
SSDEEP 49152:58nRUi+g6jbcNvrmWpqpSJn7CqSw18eS4d7OE4WrWRTXOGfTixiia+TQZLtC:+n6j4PpqK7piyBO9WrWRTXT+OY
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

3282544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\SogouPy.pdb

msimg32

GradientFill TransparentBlt AlphaBlend

kernel32

LCMapStringW DuplicateHandle OpenProcess GetCurrentProcess InterlockedIncrement ResetEvent QueryPerformanceFrequency QueryPerformanceCounter DeleteFileW LoadLibraryW CreateSemaphoreW ReleaseSemaphore CreateEventW OpenThread SetEvent CreateThread ReleaseMutex OpenFileMappingW CreateFileMappingW OpenMutexW WaitForSingleObject UnmapViewOfFile MapViewOfFile MultiByteToWideChar ResumeThread InterlockedCompareExchange GlobalGetAtomNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetNamedPipeHandleState EnterCriticalSection GetLastError GlobalAddAtomW GetCurrentThread SetThreadPriority GetTempPathW GetSystemDirectoryW GetFileAttributesExW CreateFileW ReadFile LeaveCriticalSection Sleep InitializeCriticalSection WriteFile WaitNamedPipeW GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetCurrentThreadId GetACP InterlockedDecrement GetCurrentProcessId OutputDebugStringW GetModuleFileNameA GlobalFree GlobalUnlock GetModuleFileNameW GlobalAlloc TlsSetValue GlobalLock TlsGetValue GetCommandLineW WideCharToMultiByte CloseHandle OpenEventW GetProcAddress SetEnvironmentVariableA CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW GetFullPathNameA SetEndOfFile SetStdHandle GetStringTypeW GetStartupInfoA SetHandleCount GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetCurrentDirectoryA GetFullPathNameW LCMapStringA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetQueuedCompletionStatus TransactNamedPipe InterlockedExchange CreateIoCompletionPort ExitThread GetVersionExW IsBadReadPtr CreateMutexW FindFirstFileW FindClose FileTimeToSystemTime GetLocalTime HeapAlloc GetProcessHeap VirtualAlloc LoadLibraryA VirtualProtect VirtualFree GetFileTime CreateDirectoryW FindNextFileW RemoveDirectoryW GetFileSize lstrlenA FreeLibrary HeapFree LocalAlloc LocalFree DeviceIoControl CreateFileA lstrcpyA GetSystemDirectoryA lstrcatA CopyFileA HeapReAlloc SetLastError Process32FirstW Process32NextW CreateToolhelp32Snapshot GetTempFileNameW CreateProcessW MoveFileExW CopyFileW GetExitCodeProcess GetFileAttributesW GetProcessId SetFileAttributesW SetFilePointer FormatMessageW GetLogicalDriveStringsW QueryDosDeviceW TlsAlloc TlsFree GetConsoleMode FlushFileBuffers VirtualQuery SetUnhandledExceptionFilter TerminateProcess lstrlenW lstrcatW IsDebuggerPresent lstrcpyW FindResourceW LoadResource SizeofResource LockResource GlobalHandle WaitForSingleObjectEx SetWaitableTimer CreateWaitableTimerW OpenWaitableTimerW SleepEx PeekNamedPipe WaitForMultipleObjects GetFileType GetStdHandle ExpandEnvironmentStringsA FormatMessageA LoadLibraryExW ExpandEnvironmentStringsW GetEnvironmentVariableW CompareStringW MulDiv GetWindowsDirectoryA GlobalReAlloc CreateFileMappingA OpenFileMappingA GetModuleHandleA SwitchToThread RaiseException UnhandledExceptionFilter ExitProcess GetCommandLineA GetTimeZoneInformation FileTimeToLocalFileTime GetDriveTypeW RtlUnwind GetFileInformationByHandle GetDriveTypeA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage HeapCreate HeapDestroy HeapSize GetConsoleCP FreeEnvironmentStringsA

user32

PeekMessageW PostThreadMessageW GetKeyboardState GetForegroundWindow MessageBoxW SendMessageW SetWindowLongW PostMessageW GetMessageW SetTimer IsWindow wsprintfW wsprintfA WindowFromPoint IsCharAlphaNumericW SetRectEmpty SetWindowPos MsgWaitForMultipleObjectsEx wvsprintfW CopyRect GetMonitorInfoW ReleaseCapture EqualRect CreateWindowExW ReleaseDC OffsetRect GetDC GetClientRect LoadCursorW SetCapture MonitorFromPoint UpdateLayeredWindow SetCursor DefWindowProcW CallWindowProcW EnableWindow RegisterClassExW SetPropW BeginPaint IsWindowEnabled TrackMouseEvent UnregisterClassW NotifyWinEvent ScreenToClient EndPaint DrawTextW IntersectRect SubtractRect RedrawWindow GetCursor SetMenuItemInfoW FillRect GetMenuItemRect MenuItemFromPoint GetMenuItemID GetKeyboardLayoutList LoadStringW DestroyIcon CreateDialogParamW DialogBoxParamW SetClipboardData SetCaretPos OpenClipboard EmptyClipboard CloseClipboard GetWindowPlacement InflateRect SetCursorPos SetClassLongW GetClassLongW SetWindowRgn mouse_event GetClassInfoExW SetScrollInfo PostQuitMessage LoadBitmapW IsRectEmpty EndDialog LoadIconW FindWindowW GetParent GetFocus SetForegroundWindow DestroyWindow GetMenuItemCount GetCursorPos GetMenuItemInfoW LoadImageW GetWindowLongW UnhookWindowsHookEx SetWindowsHookExW GetDesktopWindow GetClassNameW GetWindowTextW GetAsyncKeyState CallNextHookEx GetKeyState GetMessageExtraInfo SendInput keybd_event GetSystemMetrics DispatchMessageW TranslateMessage SendMessageTimeoutW GetWindowTextLengthW SetRect MoveWindow EnumWindows KillTimer UnregisterHotKey RegisterHotKey InvalidateRect IsWindowVisible GetWindowRect IsIconic SystemParametersInfoW ShowWindow ClientToScreen PtInRect GetAncestor GetCaretPos FindWindowExW GetPropW GetWindowThreadProcessId GetWindow RegisterWindowMessageW

gdi32

SetMapMode ExtCreateRegion GetTextExtentPoint32W GetCharABCWidthsFloatW CombineRgn OffsetRgn Rectangle GetPixel GetObjectW CreateCompatibleDC SelectObject DeleteObject CreateDIBSection DeleteDC GetClipRgn MoveToEx LineTo SelectClipRgn CreateCompatibleBitmap GetFontUnicodeRanges GetTextExtentExPointW CreateRectRgn CreatePen GetTextMetricsW GetTextExtentPointW CreateSolidBrush GetDeviceCaps StretchDIBits GetFontData CreateFontIndirectW BitBlt SetTextColor GetStockObject StretchBlt SetBkMode SetTextCharacterExtra CreateDCW SetBkColor CreateFontW

advapi32

LookupAccountSidW OpenProcessToken GetTokenInformation RegOpenKeyW RegCreateKeyExW AddAccessAllowedAceEx SetNamedSecurityInfoW GetNamedSecurityInfoW InitializeAcl ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityInfo GetSecurityDescriptorSacl BuildExplicitAccessWithNameW GetLengthSid SetSecurityDescriptorSacl RegQueryValueW CryptDecrypt CryptReleaseContext CryptDestroyKey CryptEncrypt CryptSetKeyParam CryptImportKey CryptAcquireContextW RegQueryValueExW RegCloseKey RegOpenKeyExW RegDeleteKeyW RegCreateKeyW RegSetValueExW RegEnumValueW RegEnumKeyW RegQueryInfoKeyW SetSecurityDescriptorDacl InitializeSecurityDescriptor SetEntriesInAclW AllocateAndInitializeSid RegDeleteValueA RegEnumValueA CryptGetKeyParam RegCreateKeyExA RegNotifyChangeKeyValue

imm32

ImmGetHotKey ImmGenerateMessage ImmGetIMCCSize ImmCreateIMCC ImmReSizeIMCC ImmNotifyIME ImmDisableIME ImmLockIMCC ImmUnlockIMC ImmAssociateContextEx ImmLockIMC ImmUnlockIMCC

ws2_32

WSAStartup WSACleanup closesocket WSAGetLastError recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect socket inet_addr gethostbyname inet_ntoa htonl getservbyname gethostbyaddr getservbyport WSASetLastError gethostname sendto recvfrom accept listen __WSAFDIsSet select ioctlsocket

shlwapi

wnsprintfA SHGetValueW SHDeleteKeyA

oleacc

LresultFromObject AccessibleObjectFromWindow

SogouExe/HWSignatureEx.dll

IMPHASH de18af259ae709a6bea8669b60fd1118
SHA256 db94c2c836176fd0a96b8333437c82b3482a39c6ae2eefe295c981954e7a487e
MD5 87c80914dfc65df16f5ff36040666da3
SHA1 06aefe9570ef484a322c53297152f1ea50746878
SHA512 bd8b685b9e698593f885dcab587ba6d61612e88d25c2a290cac3e61fded732ff493508d22d394d903f3a4f4c88c7533c3f534890c40df37114c8b640022c788f
SSDEEP 1536:+yy9dfS2m0a5Yn7ar2X9Pm8BamPP5w2xGEmkl:+yy9deHKo8BamPP5wY/mM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Timespan

Jan 29, 1996 - Aug 1, 2028

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageNetscapeServerGatedCrypto

Timespan

Nov 8, 2006 - Nov 7, 2021

Subject

CN=Sogou.com,OU=Desktop Business Division,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Serial Number

76:57:c3:39:eb:73:c7:6d:7d:f6:a2:ad:47:8e:66:e3

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 28, 2015 - Sep 26, 2017

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Dec 10, 2013 - Dec 9, 2023

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

16955

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\project\sogouime\branch\PinyinDev_R_7_8\Bin\SogouPdb\SogouInput\HWSignature.pdb

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

kernel32

ExitProcess FlushFileBuffers CreateFileA HeapAlloc HeapFree GetProcessHeap GetSystemDirectoryA lstrcatA CopyFileA DeviceIoControl CloseHandle lstrcpyA lstrlenA GlobalAlloc FreeLibrary GetLastError GetProcAddress LoadLibraryA LocalAlloc GetVersionExA LocalFree HeapReAlloc GetTickCount SetLastError GlobalFree WideCharToMultiByte GetModuleFileNameW MultiByteToWideChar HeapSize GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc GetModuleHandleW Sleep WriteFile GetStdHandle GetModuleFileNameA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement InterlockedDecrement SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

user32

wsprintfA IsCharAlphaNumericA

out.upx

SHA256 d138e2061fa350540d08063097f5094b9169f26eb5abfa003dcd2892de15980b
MD5 d1db718e6779a17d595afbbf85011dd7
SHA1 5736d0da4db6b5310603dd0fed1e0b3ab37745e0
SHA512 3207d19c52b0c288740c87a776101667c50beaec821c659e01e036b116ad579c37acbba93c5a3c98e41f39b7cc747a6d615dd7529874e107db193fac51331c84
SSDEEP 3072:VcmVWD5ltbme3HgR4ISEb4kVdnqfPQSiyfdxSRN2IaJ:qmJAAR4dQeXSfS
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer