2cc4ad2052ef77117f9991dc5d6fd65a_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2cc4ad2052ef77117f9991dc5d6fd65a_JaffaCakes118
Size

3.3MB
MD5

2cc4ad2052ef77117f9991dc5d6fd65a
SHA1

c64880ec07eccf8dd7b008d33ce65eb93112b797
SHA256

e85b4bf11571d47b1773d33a6720addd2ac80e5e161fb9eb441f78d5569bf62c
SHA512

69978faf0d57e475ed09c9a9bfbecbe44214d600785c852e27cb507cbff8e9d1ebabe2fd6d56151a07a110c5fba432e308496bf22c43a9130c0b08a98792ff80
SSDEEP

49152:X8cXCjaE4CBNtgo76UIak4D3HvyrHrmOBmALonFAgxZIFkwvSgIZ+Km9BmATosFL:Mx7vBMo2U7ks3POyRKofUkGcwi8oi

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
2cc4ad2052ef77117f9991dc5d6fd65a_JaffaCakes118
unpack001/$PLUGINSDIR/Base64.dll
unpack001/$PLUGINSDIR/ExecCmd.dll
unpack001/$PLUGINSDIR/Inetc.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/ZipDLL.dll
unpack001/$PLUGINSDIR/setupdll.dll
unpack001/$PLUGINSDIR/soui-sys-resource.dll
unpack001/soui-sys-resource.dll
unpack001/uninst.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/setupdll.dll
unpack003/$PLUGINSDIR/soui-sys-resource.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

2cc4ad2052ef77117f9991dc5d6fd65a_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Base64.dll
.dll windows:4 windows x86 arch:x86

1ba6926a1ee4e4cda118768081f528d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
TerminateProcess

msvcr80

memset
atoi
_crt_debugger_hook

Exports

Exports

Decrypt
Encrypt

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ExecCmd.dll
.dll windows:4 windows x86 arch:x86

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
OpenProcess
CloseHandle
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
Sleep
CreateProcessA
GlobalAlloc
GetExitCodeThread
lstrcpyA
lstrcpynA
CreateThread
lstrcatA
GetEnvironmentVariableA
lstrcmpiA

user32

SendMessageA
EnumWindows
WaitForInputIdle
wsprintfA
GetWindowThreadProcessId

Exports

Exports

exec
wait

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Inetc.dll
.dll windows:4 windows x86 arch:x86

3f1149a3053980fe6b461521d2b55a2c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

CloseHandle
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
GetLastError
GlobalFree
lstrcmpiA
DeleteFileA
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize
CreateFileA

user32

MessageBoxA
GetParent
ShowWindow
PostMessageA
SetWindowTextA
GetWindowTextA
IsWindow
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
SetWindowLongA
GetWindowLongA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
SendMessageA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ZipDLL.dll
.dll windows:4 windows x86 arch:x86

f10b94e3705eae25c7617ba56a648b77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
GetLocaleInfoW
LoadLibraryA
IsBadCodePtr
LocalFree
FormatMessageA
GetLastError
MapViewOfFile
CreateFileMappingA
CloseHandle
UnmapViewOfFile
GetDiskFreeSpaceA
CreateFileA
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetDriveTypeA
SetVolumeLabelA
DeleteFileA
MoveFileA
CreateDirectoryA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetFileType
FlushFileBuffers
SetStdHandle
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetEndOfFile
ReadFile
SetFilePointer
GetACP
GetOEMCP
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetProcAddress
GetStringTypeA
GetStringTypeW
IsBadReadPtr

user32

SendMessageA
GetDlgItem
SetWindowTextA
FindWindowExA
OemToCharBuffA
CharToOemBuffA

Exports

Exports

extractall
extractfile

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/alitools.ico
$PLUGINSDIR/setupdll.dll
.dll windows:5 windows x86 arch:x86

485fb9c0d71d91c4cc14bc02d5d9468d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\NSIS脚本及示例(DEBUG)\setupdll\Release\setupdll.pdb

Imports

kernel32

GetVersionExW
GetTickCount
GetModuleFileNameW
GetModuleHandleW
GetVersionExA
FreeLibrary
GetProcAddress
MulDiv
HeapCreate
HeapAlloc
HeapFree
GetCurrentProcess
FlushInstructionCache
HeapDestroy
GetFullPathNameW
FreeResource
SetLastError
FindFirstFileW
FindClose
FindResourceW
SizeofResource
LoadResource
LockResource
LeaveCriticalSection
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
CreateFileW
SetFilePointer
ReadFile
CloseHandle
DosDateTimeToFileTime
lstrlenA
GlobalLock
GlobalUnlock
GetProcessHeap
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetLastError
GetSystemTimeAsFileTime
Sleep
lstrcpyA
GlobalFree
GlobalAlloc
lstrcpynA
ExitProcess
InterlockedIncrement
lstrcpyW
LoadLibraryW
SetCurrentDirectoryW
lstrcpynW
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement

user32

BeginPaint
GetWindowLongW
UpdateLayeredWindow
SetRectEmpty
GetDesktopWindow
IsWindowEnabled
EnableWindow
SetActiveWindow
MapVirtualKeyA
CharLowerBuffW
DrawTextW
SystemParametersInfoA
GetSystemMetrics
EnableMenuItem
GetKeyState
ClientToScreen
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetRect
IsMenu
AppendMenuW
CreatePopupMenu
DestroyMenu
SetForegroundWindow
TrackPopupMenu
GetSysColor
GetMenuItemCount
GetMenuItemInfoW
RegisterClassExW
CreateWindowExW
DefWindowProcW
GetDlgItem
UnregisterClassW
LoadIconW
GetIconInfo
CharNextW
SetWindowPos
SendMessageW
GetClientRect
GetParent
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
ShowWindow
MessageBoxW
CallWindowProcW
SetWindowLongW
FindWindowExW
GetCursorPos
IsIconic
PostMessageW
CopyRect
IsRectEmpty
GetActiveWindow
PtInRect
EqualRect
InflateRect
IntersectRect
MapWindowPoints
UnionRect
SetCursor
SetTimer
OffsetRect
SetLayeredWindowAttributes
KillTimer
EndPaint
TrackMouseEvent
GetFocus
PostQuitMessage
GetClassNameW
AnimateWindow
IsZoomed
SetCaretPos
GetCaretBlinkTime
CreateCaret
ReleaseCapture
DestroyIcon
IsWindowVisible
SetWindowTextW
SetCapture
ReleaseDC
GetDC
ScreenToClient
InvalidateRect
IsWindow
UpdateWindow
SetFocus
CreateIconFromResource
LoadImageW
DrawIconEx
FillRect
OemToCharBuffW
CreateIconIndirect
LoadBitmapW
LoadCursorW
DestroyCursor
DestroyWindow

gdi32

DeleteObject
GetObjectA
GetStockObject
GetDeviceCaps
GetClipBox
CreateFontIndirectW
GetObjectW
SetBkMode
Rectangle
SelectObject
CreateSolidBrush
DeleteDC
StretchBlt
CreateCompatibleDC
CreateBitmap
CreateDIBSection
CombineRgn
PtInRegion
RectInRegion
GetRgnBox
OffsetRgn
SetRectRgn
SetTextColor
GetTextColor
ExtSelectClipRgn
SaveDC
CreateRectRgnIndirect
RestoreDC
ExcludeClipRect
IntersectClipRect
CreateRectRgn
GetTextExtentPoint32W
RoundRect
Ellipse
Polyline
Arc
Chord
CreatePen
CreatePatternBrush
GetClipRgn
CreateDIBitmap
StretchDIBits
CreateDCW
CreateRoundRectRgn
GetCurrentObject
GetViewportOrgEx
CreateCompatibleBitmap
SetViewportOrgEx
BitBlt

shell32

ShellExecuteW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CLSIDFromString
OleLockRunning
CreateBindCtx
CoCreateInstance
CLSIDFromProgID
IIDFromString
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoTaskMemFree

oleaut32

GetErrorInfo
SysFreeString
SysAllocString

shlwapi

StrToIntExW

msvcr90

_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
fprintf
__iob_func
floor
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
printf
sin
cos
_setjmp3
longjmp
strcmp
strncmp
strtol
_lrotl
feof
fseek
pow
ldexp
_CxxThrowException
??3@YAXPAX@Z
wcscpy_s
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_wcsicmp
_purecall
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_invalid_parameter_noinfo
_vswprintf_c_l
?what@exception@std@@UBEPBDXZ
sprintf
atoi
memmove_s
wcslen
wcscmp
wcsstr
memset
__CxxFrameHandler3
memcpy
bsearch
qsort
strlen
wcschr
_wtoi
malloc
free
fread
fclose
_filelength
_fileno
_wfopen
_vswprintf
_vscwprintf
_wcslwr
abs
wcscpy
swscanf
tolower
_wtof
memcmp
isdigit
memmove
wcsrchr
wcsncmp
wcstok
_wcsdup
div
_localtime64_s
_time64
_swprintf
log
ceil
realloc
calloc
wcstol
wcstoul
_ftelli64
_fseeki64

msvcp90

?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??$?6GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

imm32

ImmReleaseContext
ImmGetContext

gdiplus

GdipGetImageEncodersSize
GdiplusStartup
GdipCloneImage
GdipDrawImageRectI
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown

msimg32

GradientFill
AlphaBlend

Exports

Exports

BindControlAndNSISScript
BindingProgress
ClosePage
FindChildByName
FindStringByName
GetControlProperties
InitWindow
NSISMessageBox
NSISOpenFolderDialog
NSISScriptSendMessage
SetControlProperties
ShowPage

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/soui-sys-resource.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\vc2008_project\soui2\trunk\bin\soui-sys-resource.pdb

Sections

.rdata
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ui.dll
.zip
Translator/lang_cn.xml
image/00020[48x12x8BPP].png
.png
image/bg.png
.png
image/custom_button.png
.png
image/finish_ads.png
.png
image/finish_feel.png
.png
image/finish_finish.png
.png
image/install.png
.png
image/logo.ico
image/logo.png
.png
image/logo24.png
.png
image/prog_bar.png
.png
image/prog_bkgnd.png
.png
image/ruyitao.png
.png
image/setup1.png
.png
image/setup2.png
.png
image/setup3.png
.png
image/setup4.png
.png
image/tab.png
.png
image/taobrowser.png
.png
image/traymenu_icons.png
.png
image/vscrollbar.png
.png
image/welcome_center.png
.png
rtf/Э.rtf
.rtf
uires.idx
xml/dlg_main.xml
xml/init.xml
xml/menu_tray.xml
xml/page_agreement.xml
.xml
xml/page_choose.xml
.xml
xml/page_finish.xml
.xml
xml/page_installing.xml
.xml
xml/page_unstallchoose.xml
.xml
xml/page_unstallfinish.xml
.xml
xml/page_unstalling.xml
.xml
xml/page_unstallstart.xml
.xml
xml/page_welcome.xml
.xml
alitools.ico
logo.ico
soui-sys-resource.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\soui.taobao\bin\soui-sys-resource.pdb

Sections

.rdata
Size: 512B - Virtual size: 93B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 90KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
uires/image/021.ani
uires/image/TreeCheckBox.png
.png
uires/image/TreeIcon.png
.png
uires/image/animode.png
.png
uires/image/apng_haha.png
.png
uires/image/appledock/1.png
.png
uires/image/appledock/10.png
.png
uires/image/appledock/2.png
.png
uires/image/appledock/3.png
.png
uires/image/appledock/4.png
.png
uires/image/appledock/5.png
.png
uires/image/appledock/6.png
.png
uires/image/appledock/7.png
.png
uires/image/appledock/8.png
.png
uires/image/appledock/9.png
.png
uires/image/avatar.png
.png
uires/image/bk_shadow.png
.png
uires/image/btn_expand.png
.png
uires/image/btn_menu.png
.png
uires/image/busy1.png
.png
uires/image/camera_capture.cur
uires/image/chromeTabClose.png
.png
uires/image/chromeTabNew.png
.png
uires/image/coin.png
.png
uires/image/horse.gif
.gif
uires/image/icon/1.png
.png
uires/image/icon/2.png
.png
uires/image/icon/3.png
.png
uires/image/icon/4.png
.png
uires/image/icon/5.png
.png
uires/image/icon/6.png
.png
uires/image/icon/7.png
.png
uires/image/icon/button_install.png
.png
uires/image/icon/star_green.png
.png
uires/image/icon/star_yellow.png
.png
uires/image/img_busy.png
.png
uires/image/img_logo.ico
uires/image/img_menu_bg.png
.png
uires/image/lcex_header.png
.png
uires/image/lcex_header_arrow.png
.png
uires/image/lcex_selectrange.png
.png
uires/image/mask.png
.png
uires/image/menuborder.png
.png
uires/image/menuskin.png
.png
uires/image/page_icons.png
.png
uires/image/penguin.gif
.gif
uires/image/propswitch.png
.png
uires/image/small_icons.png
.png
uires/image/tab_common.png
.png
uires/image/tab_left.png
.png
uires/image/tab_left_splitter.png
.png
uires/image/tab_main.png
.png
uires/image/vscrollbar.png
.png
uires/image/webbtn_back.png
.png
uires/image/webbtn_forward.png
.png
uires/image/webbtn_refresh.png
.png
uires/image/win.gif
.gif
uires/img.calendar2/button_radio_aio.png
.png
uires/img.calendar2/cal_arrow_left.png
.png
uires/img.calendar2/cal_arrow_right.png
.png
uires/img.calendar2/cal_day_skin.png
.png
uires/img.calendar2/gradient_1px.png
.png
uires/img.calendar2/skin_btn_curve.png
.png
uires/img.calendar2/skin_btn_semiarc.png
.png
uires/lua/test.lua
uires/rtf/RTF.rtf
.rtf
uires/translation files/lang_cn.xml
.xml
uires/uires.idx
uires/xml/calendar.xml
.xml
uires/xml/dlg_formatmsg.xml
uires/xml/dlg_main.xml
uires/xml/init.xml
.xml
uires/xml/menu_test.xml
uires/xml/page_about.xml
uires/xml/page_ctrls.xml
uires/xml/page_layout.xml
uires/xml/page_misc.xml
uires/xml/page_script.xml
.xml
uires/xml/page_skia.xml
uires/xml/page_treebox.xml
uires/xml/page_webkit.xml
uires/xml/treectrl.xml
.xml
uninst.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/setupdll.dll
.dll windows:5 windows x86 arch:x86

485fb9c0d71d91c4cc14bc02d5d9468d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\NSIS脚本及示例(DEBUG)\setupdll\Release\setupdll.pdb

Imports

kernel32

GetVersionExW
GetTickCount
GetModuleFileNameW
GetModuleHandleW
GetVersionExA
FreeLibrary
GetProcAddress
MulDiv
HeapCreate
HeapAlloc
HeapFree
GetCurrentProcess
FlushInstructionCache
HeapDestroy
GetFullPathNameW
FreeResource
SetLastError
FindFirstFileW
FindClose
FindResourceW
SizeofResource
LoadResource
LockResource
LeaveCriticalSection
LoadLibraryA
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
CreateFileW
SetFilePointer
ReadFile
CloseHandle
DosDateTimeToFileTime
lstrlenA
GlobalLock
GlobalUnlock
GetProcessHeap
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
GetLastError
GetSystemTimeAsFileTime
Sleep
lstrcpyA
GlobalFree
GlobalAlloc
lstrcpynA
ExitProcess
InterlockedIncrement
lstrcpyW
LoadLibraryW
SetCurrentDirectoryW
lstrcpynW
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement

user32

BeginPaint
GetWindowLongW
UpdateLayeredWindow
SetRectEmpty
GetDesktopWindow
IsWindowEnabled
EnableWindow
SetActiveWindow
MapVirtualKeyA
CharLowerBuffW
DrawTextW
SystemParametersInfoA
GetSystemMetrics
EnableMenuItem
GetKeyState
ClientToScreen
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SetRect
IsMenu
AppendMenuW
CreatePopupMenu
DestroyMenu
SetForegroundWindow
TrackPopupMenu
GetSysColor
GetMenuItemCount
GetMenuItemInfoW
RegisterClassExW
CreateWindowExW
DefWindowProcW
GetDlgItem
UnregisterClassW
LoadIconW
GetIconInfo
CharNextW
SetWindowPos
SendMessageW
GetClientRect
GetParent
GetWindowRect
GetMonitorInfoW
MonitorFromWindow
GetWindow
ShowWindow
MessageBoxW
CallWindowProcW
SetWindowLongW
FindWindowExW
GetCursorPos
IsIconic
PostMessageW
CopyRect
IsRectEmpty
GetActiveWindow
PtInRect
EqualRect
InflateRect
IntersectRect
MapWindowPoints
UnionRect
SetCursor
SetTimer
OffsetRect
SetLayeredWindowAttributes
KillTimer
EndPaint
TrackMouseEvent
GetFocus
PostQuitMessage
GetClassNameW
AnimateWindow
IsZoomed
SetCaretPos
GetCaretBlinkTime
CreateCaret
ReleaseCapture
DestroyIcon
IsWindowVisible
SetWindowTextW
SetCapture
ReleaseDC
GetDC
ScreenToClient
InvalidateRect
IsWindow
UpdateWindow
SetFocus
CreateIconFromResource
LoadImageW
DrawIconEx
FillRect
OemToCharBuffW
CreateIconIndirect
LoadBitmapW
LoadCursorW
DestroyCursor
DestroyWindow

gdi32

DeleteObject
GetObjectA
GetStockObject
GetDeviceCaps
GetClipBox
CreateFontIndirectW
GetObjectW
SetBkMode
Rectangle
SelectObject
CreateSolidBrush
DeleteDC
StretchBlt
CreateCompatibleDC
CreateBitmap
CreateDIBSection
CombineRgn
PtInRegion
RectInRegion
GetRgnBox
OffsetRgn
SetRectRgn
SetTextColor
GetTextColor
ExtSelectClipRgn
SaveDC
CreateRectRgnIndirect
RestoreDC
ExcludeClipRect
IntersectClipRect
CreateRectRgn
GetTextExtentPoint32W
RoundRect
Ellipse
Polyline
Arc
Chord
CreatePen
CreatePatternBrush
GetClipRgn
CreateDIBitmap
StretchDIBits
CreateDCW
CreateRoundRectRgn
GetCurrentObject
GetViewportOrgEx
CreateCompatibleBitmap
SetViewportOrgEx
BitBlt

shell32

ShellExecuteW
Shell_NotifyIconW
SHBrowseForFolderW
SHGetPathFromIDListW

ole32

CLSIDFromString
OleLockRunning
CreateBindCtx
CoCreateInstance
CLSIDFromProgID
IIDFromString
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoTaskMemFree

oleaut32

GetErrorInfo
SysFreeString
SysAllocString

shlwapi

StrToIntExW

msvcr90

_malloc_crt
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
fprintf
__iob_func
floor
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
printf
sin
cos
_setjmp3
longjmp
strcmp
strncmp
strtol
_lrotl
feof
fseek
pow
ldexp
_CxxThrowException
??3@YAXPAX@Z
wcscpy_s
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_wcsicmp
_purecall
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??_U@YAPAXI@Z
??_V@YAXPAX@Z
_invalid_parameter_noinfo
_vswprintf_c_l
?what@exception@std@@UBEPBDXZ
sprintf
atoi
memmove_s
wcslen
wcscmp
wcsstr
memset
__CxxFrameHandler3
memcpy
bsearch
qsort
strlen
wcschr
_wtoi
malloc
free
fread
fclose
_filelength
_fileno
_wfopen
_vswprintf
_vscwprintf
_wcslwr
abs
wcscpy
swscanf
tolower
_wtof
memcmp
isdigit
memmove
wcsrchr
wcsncmp
wcstok
_wcsdup
div
_localtime64_s
_time64
_swprintf
log
ceil
realloc
calloc
wcstol
wcstoul
_ftelli64
_fseeki64

msvcp90

?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??0?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??$?6GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ

imm32

ImmReleaseContext
ImmGetContext

gdiplus

GdipGetImageEncodersSize
GdiplusStartup
GdipCloneImage
GdipDrawImageRectI
GdipGraphicsClear
GdipGetImageGraphicsContext
GdipGetImageEncoders
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipGetImageHeight
GdipGetImageWidth
GdipSaveImageToFile
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown

msimg32

GradientFill
AlphaBlend

Exports

Exports

BindControlAndNSISScript
BindingProgress
ClosePage
FindChildByName
FindStringByName
GetControlProperties
InitWindow
NSISMessageBox
NSISOpenFolderDialog
NSISScriptSendMessage
SetControlProperties
ShowPage

Sections

.text
Size: 413KB - Virtual size: 413KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/soui-sys-resource.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\vc2008_project\soui2\trunk\bin\soui-sys-resource.pdb

Sections

.rdata
Size: 512B - Virtual size: 116B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ui.dll
.zip
Translator/lang_cn.xml
image/00020[48x12x8BPP].png
.png
image/bg.png
.png
image/custom_button.png
.png
image/finish_ads.png
.png
image/finish_feel.png
.png
image/finish_finish.png
.png
image/install.png
.png
image/logo.ico
image/logo.png
.png
image/logo24.png
.png
image/prog_bar.png
.png
image/prog_bkgnd.png
.png
image/ruyitao.png
.png
image/setup1.png
.png
image/setup2.png
.png
image/setup3.png
.png
image/setup4.png
.png
image/tab.png
.png
image/taobrowser.png
.png
image/traymenu_icons.png
.png
image/vscrollbar.png
.png
image/welcome_center.png
.png
rtf/Э.rtf
.rtf
uires.idx
xml/dlg_main.xml
xml/init.xml
xml/menu_tray.xml
xml/page_agreement.xml
.xml
xml/page_choose.xml
.xml
xml/page_finish.xml
.xml
xml/page_installing.xml
.xml
xml/page_unstallchoose.xml
.xml
xml/page_unstallfinish.xml
.xml
xml/page_unstalling.xml
.xml
xml/page_unstallstart.xml
.xml
xml/page_welcome.xml
.xml

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 135KB - Virtual size: 134KB

1ba6926a1ee4e4cda118768081f528d5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcr80

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 503B

.data Size: 512B - Virtual size: 828B

.rsrc Size: 512B - Virtual size: 428B

.reloc Size: 512B - Virtual size: 166B

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 802B

.data Size: 512B - Virtual size: 142B

.reloc Size: 512B - Virtual size: 200B

3f1149a3053980fe6b461521d2b55a2c

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 10KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 135KB - Virtual size: 134KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 503B

.data
Size: 512B - Virtual size: 828B

.rsrc
Size: 512B - Virtual size: 428B

.reloc
Size: 512B - Virtual size: 166B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 802B

.data
Size: 512B - Virtual size: 142B

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 10KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 21KB - Virtual size: 27KB

.reloc
Size: 12KB - Virtual size: 12KB

.text
Size: 413KB - Virtual size: 413KB

.rdata
Size: 93KB - Virtual size: 93KB

.data
Size: 3KB - Virtual size: 68KB

.rsrc
Size: 1024B - Virtual size: 688B

.reloc
Size: 36KB - Virtual size: 35KB

.rdata
Size: 512B - Virtual size: 116B

.rsrc
Size: 85KB - Virtual size: 84KB