347f8ae436fa70890c1965a2f844b159_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

347f8ae436fa70890c1965a2f844b159_JaffaCakes118
Size

30.9MB
MD5

347f8ae436fa70890c1965a2f844b159
SHA1

c9c82b2177a8da7fde5477d7bf6b880865bae6ce
SHA256

437cea8c73421ce9980f514e17efbcc9ffdf53a5b98d5ad1d1582a80e5f85338
SHA512

e9b9d0a4ae181a1a092e1ad1c5f62b4c563e79490bd08a700531329147f752eceecdd2daca6325a775ef0ca99c105df564dbaa50c60108f0feb0fb3f5724d685
SSDEEP

786432:RrSeBRTVQnVhWhcuJnloicFBH8MSne/zjIzqvHFLQv:Rr1TVQnVecEGiUfSne/zj9K

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
347f8ae436fa70890c1965a2f844b159_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

Files

347f8ae436fa70890c1965a2f844b159_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLib.dll
.dll windows:5 windows x86 arch:x86

35c80f4de5633145b8518a9f7994a287

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SetupLib.pdb

Imports

shlwapi

StrToIntW
PathFileExistsW
SHDeleteKeyW

wininet

HttpQueryInfoW
InternetReadFile
InternetOpenUrlW
InternetSetOptionW
InternetCloseHandle
InternetOpenW

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

SuspendThread
GetThreadContext
SetThreadContext
VirtualProtect
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetModuleHandleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
TerminateProcess
Sleep
GetCurrentProcessId
DeleteFileW
CloseHandle
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GlobalFree
EnterCriticalSection
SetLastError
GetLastError
SetEvent
RaiseException
FlushInstructionCache
MultiByteToWideChar
CreateFileW
ReadFile
GetExitCodeProcess
LeaveCriticalSection
WideCharToMultiByte
GetSystemDirectoryW
GlobalAlloc
OpenProcess
WriteFile
WaitForSingleObject
GetCurrentProcess
MoveFileExW
CreateProcessW
FreeLibrary
DebugBreak
OutputDebugStringW
lstrlenA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
LoadLibraryW
FindNextFileW
FindClose
GetProcAddress
GetStdHandle
ExitProcess
HeapCreate
GetCurrentDirectoryA
GetFullPathNameW
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
lstrlenW
RtlUnwind
GetFileType
TlsFree
GetModuleHandleW
FindFirstFileW
TlsSetValue
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
TlsAlloc
TlsGetValue
GetCommandLineA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResumeThread
GetSystemTimeAsFileTime
GetDriveTypeW
GetCurrentThread
GetDiskFreeSpaceExW
GetProcessHeap
CreateEventW
OpenEventW
GetFileAttributesW
SetFileAttributesW
GetCommandLineW
GetTempPathW
SetFilePointer
FormatMessageW
ExitThread
CreateThread
GetVersionExW
CreateDirectoryW
CopyFileW
FileTimeToSystemTime
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileSize
FlushFileBuffers
CreateMutexW
OpenMutexW
ReleaseMutex
UnmapViewOfFile
QueryPerformanceFrequency
GetTickCount
InitializeCriticalSection
HeapFree
FileTimeToLocalFileTime

user32

PtInRect
DrawTextW
GetDesktopWindow
ClientToScreen
GetFocus
UnregisterClassA
UpdateLayeredWindow
OffsetRect
GetSystemMenu
DeleteMenu
GetMenuItemInfoW
SendMessageTimeoutW
GetMenuItemCount
GetWindowTextLengthW
PostMessageW
KillTimer
GetParent
GetForegroundWindow
GetWindowTextW
GetDlgItem
SetWindowPos
EnableWindow
SetWindowTextW
UnloadKeyboardLayout
LoadCursorW
GetClientRect
GetClassInfoExW
CharLowerW
LoadKeyboardLayoutW
RegisterClassExW
IsWindow
FindWindowExW
CreateWindowExW
MessageBoxW
SendMessageW
GetKeyboardLayoutList
EndPaint
SetTimer
GetWindowRect
CharNextW
FillRect
wvsprintfW
LoadImageW
BeginPaint
InvalidateRect
GetWindowLongW
SetWindowLongW
CallWindowProcW
DefWindowProcW
CopyRect
LoadStringW
MessageBoxIndirectW
ShowWindow
LoadIconW
SetParent
MoveWindow
SystemParametersInfoW
SetFocus
SetForegroundWindow
DestroyWindow
DispatchMessageW
GetMonitorInfoW
IsWindowVisible
MonitorFromWindow
TranslateMessage
GetMessageW
SetActiveWindow
ReleaseDC
GetDC
IsWindowEnabled
GetSystemMetrics
SetRectEmpty
GetPropW
ReleaseCapture
GetCursorPos
SetPropW
TrackMouseEvent
GetKeyState
SetCapture
IsIconic
PostQuitMessage
ScreenToClient
SetCursor

gdi32

GetFontData
CreateCompatibleDC
SelectObject
GetTextExtentExPointW
GetStockObject
SetTextColor
CreateFontIndirectW
SetBkMode
CreateDIBSection
CreateCompatibleBitmap
BitBlt
SetViewportOrgEx
DeleteDC
StretchBlt
DeleteObject

advapi32

RegSetValueExW
RegDeleteValueW
LookupAccountSidW
GetTokenInformation
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
AdjustTokenPrivileges
RegEnumKeyExW
RegFlushKey
RegEnumValueW
LookupPrivilegeValueW
LookupAccountNameW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorSacl
GetLengthSid
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

VariantInit
SysStringLen
SysAllocString
SysFreeString

imm32

ImmInstallIMEW
ImmGetIMEFileNameW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

msimg32

AlphaBlend

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
CancelDelayDelDir
CheckAccess
CmpFile
DefaultBrowserIsIE
DelayDelFile
DelayDelReg
DownloadQuiet
ExecWait
FilterSid
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetHWID
GetHwndImage
GetHwndMain
GetInstallPath
GetPPName
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstallIME
InstalledIMEIsPre30b1
IsInWin8
MonitorUninstallCompleted
MonitorVerifyEdit
MonitorVerifyUninstallSelect
MoveImeDir
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
ReadIniStr
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SetCheckBoxState
SetLowLabel
SetMutex
SetReadSecond
SetReboot
SetUrlInvite
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall

Sections

.text
Size: 608KB - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

8ab7717bd56e9290c74679a407fe5d1f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
GetCommandLineA

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SogouPY64.ime
.dll windows:5 windows x64 arch:x64

a910924858bc8b01997a32299f3f111c

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy64.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
GetCurrentThread
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
SetFilePointer
RtlCaptureContext
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
RtlVirtualUnwind
FormatMessageW
lstrlenW
RtlLookupFunctionEntry
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
DuplicateHandle
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
GetExitCodeProcess
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FlsSetValue
GetCommandLineA
FileTimeToLocalFileTime
Module32NextW
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
RtlUnwindEx
GetDriveTypeA
FindFirstFileA
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetDateFormatA
GetTimeFormatA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
Module32FirstW
OutputDebugStringW
GetDriveTypeW

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
ScreenToClient
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetSysColorBrush
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
RedrawWindow
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
TranslateMessage
PeekMessageW
GetAsyncKeyState
GetCursor
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
GetWindowLongW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongPtrW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongPtrW
PostMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
GetObjectW
GetPixel
StretchBlt
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CombineRgn
CreateSolidBrush
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

RegEnumValueW
RegSetValueExW
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 204KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SogouIn
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/install0.bmp
$PLUGINSDIR/install1.bmp
$PLUGINSDIR/install2.bmp
$PLUGINSDIR/install3.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

8ab7717bd56e9290c74679a407fe5d1f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
GetCommandLineA

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime~
.dll windows:5 windows x86 arch:x86

8ab7717bd56e9290c74679a407fe5d1f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
GetCommandLineA

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPy.ime
.dll windows:5 windows x86 arch:x86

8ab7717bd56e9290c74679a407fe5d1f

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
GetCommandLineA

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.7.0.0329/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.7.0.0329/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.3MB

.rsrc Size: 143KB - Virtual size: 142KB

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

35c80f4de5633145b8518a9f7994a287

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.3MB

.rsrc
Size: 143KB - Virtual size: 142KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 608KB - Virtual size: 607KB

.rdata
Size: 125KB - Virtual size: 125KB

.data
Size: 19KB - Virtual size: 42KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 39KB - Virtual size: 38KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 2.2MB - Virtual size: 2.2MB

.rdata
Size: 484KB - Virtual size: 484KB

.data
Size: 90KB - Virtual size: 148KB

.rsrc
Size: 74KB - Virtual size: 74KB

.reloc
Size: 140KB - Virtual size: 140KB