4bb8b78c71c4d4acaa90b51ad2a94ec9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4bb8b78c71c4d4acaa90b51ad2a94ec9_JaffaCakes118
Size

1.3MB
MD5

4bb8b78c71c4d4acaa90b51ad2a94ec9
SHA1

adb0850a82c2b8049b7939344ec60e8d1e30f5d3
SHA256

338cfe0d9b06096b8a146e9956cd7bf8d306160789d0441d72d3a69e907b6c99
SHA512

97652c13c8c1836915daa8add0d25dff595e195b2494377db0a516f19d2b3dba64ad0cb45fac92e01eb43dc41bcbcbae1f9efccc122f79be608bc30c433101ed
SSDEEP

24576:bLvkK0RYmdVL609Ve21Ilddc6yfv5Aqrvx3EnQrUlbQsjF1tDNSYJ:bQK0bVRzQdXmprvx3EkUlU8BSYJ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/4399生死狙击刷金币修改器/s_ju/asmls/need/ssjj.dll	aspack_v212_v242

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/4399生死狙击刷金币修改器/4399生死狙击刷金币修改器.exe
unpack001/4399生死狙击刷金币修改器/s_ju/asmls/need/ssjj.dll

Files

4bb8b78c71c4d4acaa90b51ad2a94ec9_JaffaCakes118
.rar
4399生死狙击刷金币修改器/4399生死狙击刷金币修改器.exe
.exe windows:4 windows x86 arch:x86

ab5c6c5ba22a1fcd233f6e317ae0bdbb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord626
ord553
ord666
ord595
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord531
ord681
ord576
ord100
ord610
ord545

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
4399生死狙击刷金币修改器/s_ju/asmls/Dir.dll
.dll windows:4 windows x86 arch:x86

c9f423990106792d73744f584215634e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:8d:1e:b5:26:62:6b:e3:ba:50:ce:78:28:80:7d:a9:35:41:fe:1e
Signer

Actual PE Digest

6a:8d:1e:b5:26:62:6b:e3:ba:50:ce:78:28:80:7d:a9:35:41:fe:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DefWindowProcW
SetWindowLongW
CreateWindowExW
DestroyWindow
DispatchMessageW
TranslateMessage
PeekMessageW
IsWindow
PostMessageW
RegisterClassW
UnregisterClassW
SetTimer
KillTimer
GetWindowLongW

ws2_32

recv
send
WSACleanup
WSAStartup
__WSAFDIsSet
htons
WSAGetLastError
inet_ntoa
inet_addr
select
setsockopt
connect
closesocket
socket
sendto
recvfrom
ioctlsocket
WSAAsyncSelect
getsockopt
ntohl
ntohs
htonl
gethostbyname

msvcp60

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXPAGPBG1@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@IIABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0Init@ios_base@std@@QAE@XZ

msvcrt

fwrite
_wfopen
swprintf
_wsplitpath
fread
_waccess
wcschr
wcsstr
wcsrchr
wcslen
_stricmp
wcsncpy
wcsncat
_wcslwr
fclose
_snprintf
atoi
_snwprintf
strstr
rand
srand
time
_ftol
_beginthreadex
memmove
_wtoi
strcmp
atof
fprintf
ftell
fseek
fputc
sscanf
isalpha
isalnum
isspace
strncmp
strchr
tolower
_wcsicmp
_itow
_itoa
_wcsnicmp
sprintf
strerror
_errno
fopen
strtol
_strnicmp
_wctime
_ftime
_wtol
wcstod
wcstok
calloc
rewind
free
strtod
toupper
vfprintf
_vsnprintf
mbstowcs
setlocale
wcstombs
malloc
_pctype
_isctype
__mb_cur_max
mktime
strrchr
localtime
__dllonexit
_onexit
_except_handler3
?terminate@@YAXXZ
_initterm
_adjust_fdiv
strcpy
strncpy
wcscpy
strlen
memcpy
memset
_purecall
__CxxFrameHandler
wcscmp
??2@YAPAXI@Z
_vsnwprintf

kernel32

LoadLibraryW
ReadFile
WriteFile
GetFileSize
CreateDirectoryW
DeleteFileW
CreateFileW
GetThreadPriority
SuspendThread
SetEvent
CreateEventW
SetThreadPriority
ResumeThread
GetCurrentProcess
FlushInstructionCache
CreateThread
GetLocalTime
MoveFileW
GetFileAttributesW
SetFileAttributesW
CopyFileW
Sleep
WaitForSingleObject
CloseHandle
TerminateThread
GetLastError
GetTickCount
FormatMessageW
LocalFree
WideCharToMultiByte
lstrlenW
DebugBreak
SetLastError
GetPrivateProfileStringW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
OutputDebugStringW
GetProcAddress

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 18.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4399生死狙击刷金币修改器/s_ju/asmls/Dnz_30.dll
.dll windows:4 windows x86 arch:x86

a07e2b03025f6d400ea5f168e05474e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

26/01/2010, 00:00

Not After

25/01/2013, 23:59

Subject

CN=Tencent Technology(Shenzhen) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Tencent Technology(Shenzhen) Company Limited,L=shenzhen,ST=guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f4:d4:72:5a:eb:20:e6:44:2f:ef:5a:06:86:24:8a:7f:20:ad:f7:fa
Signer

Actual PE Digest

f4:d4:72:5a:eb:20:e6:44:2f:ef:5a:06:86:24:8a:7f:20:ad:f7:fa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DefWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
DestroyWindow
DispatchMessageW
KillTimer
PeekMessageW
IsWindow
PostMessageW
RegisterClassW
UnregisterClassW
TranslateMessage
MessageBoxW
SetTimer

shell32

SHFileOperationW

ws2_32

WSAStartup
gethostbyname
WSACleanup
inet_addr
WSAGetLastError
inet_ntoa
send
recv
__WSAFDIsSet
select
setsockopt
connect
closesocket
socket
sendto
recvfrom
ioctlsocket
WSAAsyncSelect
getsockopt
ntohl
ntohs
htonl
htons

msvcrt

rewind
mbstowcs
setlocale
wcstombs
malloc
_pctype
_isctype
__mb_cur_max
mktime
vfprintf
_vsnprintf
strtok
fgets
toupper
_strdup
ldexp
strpbrk
strspn
realloc
strncat
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
strtod
free
localtime
wcsftime
wcstok
calloc
tolower
isspace
isalnum
isalpha
sscanf
fputc
fprintf
atof
strcmp
_ftime
_wctime
_strnicmp
strtol
strncmp
strchr
fwrite
fopen
_errno
strerror
sprintf
_wcsnicmp
_wfopen
fseek
ftell
fread
fclose
_itoa
_itow
swscanf
_wtoi64
memcmp
_beginthreadex
_ftol
time
srand
rand
strstr
atoi
_wcslwr
wcsncat
wcsncpy
_wtol
_wtoi
_vsnwprintf
memmove
strlen
printf
strrchr
_wcsicmp
wcsrchr
wcsstr
_waccess
strncpy
wcschr
_snwprintf
wcscmp
wcslen
memcpy
_purecall
??2@YAPAXI@Z
memset
??3@YAXPAX@Z
__CxxFrameHandler
_snprintf
_stricmp
wcstod
_iob

msvcp60

?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXPAGPBG1@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
?capacity@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDIABV?$allocator@D@1@@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z

kernel32

EnterCriticalSection
GetCurrentProcess
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentProcessId
GetTempPathW
GetTempFileNameW
GetPrivateProfileStringW
SetFilePointer
WriteFile
ReadFile
GetFileSize
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetThreadPriority
SuspendThread
SetEvent
CreateEventW
SetThreadPriority
ResumeThread
GetCurrentThreadId
CreateThread
WritePrivateProfileStringW
GetPrivateProfileIntW
GetLocalTime
MoveFileW
CopyFileW
Sleep
WaitForSingleObject
TerminateThread
GetTickCount
LoadLibraryW
GetProcAddress
FormatMessageW
LocalFree
SetLastError
OutputDebugStringW
LeaveCriticalSection
FlushInstructionCache
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
GetModuleFileNameA
GetLastError
CreateFileW
CloseHandle
GetFileAttributesW
SetFileAttributesW
DeleteFileW
DebugBreak
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
lstrlenW
DeleteCriticalSection

Exports

Exports

??_C@_05KEJO@?$CFs?2?$CFs?$AA@
??_C@_0CB@POLM@5f2f35579ee731720f84eaa69ab2eb5f@
??_C@_0O@EIMA@mmog_data?4xml?$AA@
??_C@_17OLID@?$AAt?$AAd?$AAr?$AA?$AA@
??_C@_1CA@MDBB@?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
GetVersionByVersionString
Invoke
VersionInt2String

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 88KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4399生死狙击刷金币修改器/s_ju/asmls/need/Core.xml
4399生死狙击刷金币修改器/s_ju/asmls/need/Fonts.xml
.xml
4399生死狙击刷金币修改器/s_ju/asmls/need/Layers.xml
.xml
4399生死狙击刷金币修改器/s_ju/asmls/need/Settings.xml
.xml
4399生死狙击刷金币修改器/s_ju/asmls/need/Skin.xml
4399生死狙击刷金币修改器/s_ju/asmls/need/ssjj.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 108KB - Virtual size: 560KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4399生死狙击刷金币修改器/s_ju/down_01/Basement.dll
.dll regsvr32 windows:4 windows x86 arch:x86

09c0e2393463ee3e628559f2bcab9d33

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/02/2012, 00:00

Not After

26/02/2015, 23:59

Subject

CN=Beijing baidu Netcom science and technology co.ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing baidu Netcom science and technology co.ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\cygwin\home\scmpf\compiler_src\wangrui02_976161_win32\0\mc\wangpan\windows\common\output\basegui\basement_unicoderelease\Basement.pdb

Imports

bull80u

?GuidToString@BULL@@YAPA_WABU_GUID@@@Z
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?StringToUuidW@BULL@@YA?AU_GUID@@PA_W@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?LoadStringW@BULL@@YAPB_WH@Z
?MD5@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?CompareByPY@BULL@@YAJPA_W0PAH@Z
?MatchByPY@BULL@@YAJPA_W0PAH@Z
?MultiByteToWideChar@BULL@@YAJIPBDPAPA_W@Z
?QueryObjectClsid@BULL@@YAJABU_GUID@@PAU2@@Z
?WideCharToMultiByte@BULL@@YAPBDIPB_W@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?KillTimer@BULL@@YAJK@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z

ximage

?DestroyFrames@CxImage@@QAE_NXZ
??0CxImage@@QAE@K@Z
?GetHeight@CxImage@@QBEKXZ
?GetWidth@CxImage@@QBEKXZ
?GetFrameDelay@CxImage@@QBEKXZ
?Draw@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@PAU3@_N@Z
?DrawPart@CxImage@@QAEJPAUHDC__@@ABUtagRECT@@1_N2@Z
?Rotate@CxImage@@QAE_NMPAV1@@Z
?LoadGif@@YAPAVCxImage@@PAVCxFile@@AAH@Z
?LoadGif@@YAPAVCxImage@@PB_WAAH@Z
?Destroy@CxImage@@QAE_NXZ
?Load@CxImage@@QAE_NPB_WK@Z
?FindFormat@@YAKPB_WPAH@Z
?GetImageRgn@CxImage@@QAE_NAAPAUHRGN__@@PAUtagRECT@@@Z
?AlphaIsValid@CxImage@@QAE_NXZ
?Draw@CxImage@@QAEJPAUHDC__@@JJJJPAUtagRECT@@_N@Z
?Decode@CxImage@@QAE_NPAEKK@Z
?CreateFromHBITMAP@CxImage@@QAE_NPAUHBITMAP__@@PAUHPALETTE__@@@Z
?CreateFromHICON@CxImage@@QAE_NPAUHICON__@@@Z
?GetDIB@CxImage@@QBEPAXXZ
?GetSize@CxImage@@QAEJXZ
?Resample@CxImage@@QAE_NJJHPAV1@@Z
?Save@CxImage@@QAE_NPB_WK@Z
?ColorizeEx@CxImage@@QAE_NKEEM@Z
?LightEx@CxImage@@QAE_NKJJ@Z
??0CxImage@@QAE@ABV0@_N11@Z
?RGBtoHSL@CxImage@@SA?AUtagRGBQUAD@@U2@@Z
?RGBtoRGBQUAD@CxImage@@SA?AUtagRGBQUAD@@K@Z
?Erode@CxImage@@QAE_NJ@Z
?Filter@CxImage@@QAE_NPAJJJJ@Z
?GrayScale@CxImage@@QAE_NXZ
?SetTransColor@CxImage@@QAEXUtagRGBQUAD@@@Z
?SetTransIndex@CxImage@@QAEXJ@Z
?RGBQUADtoRGB@CxImage@@SAKUtagRGBQUAD@@@Z
?GetPaletteColor@CxImage@@QAE?AUtagRGBQUAD@@E@Z
?GetNearestIndex@CxImage@@QAEEUtagRGBQUAD@@@Z
?GetColorType@CxImage@@QAEEXZ
?LoadResource@CxImage@@QAE_NPAUHRSRC__@@KPAUHINSTANCE__@@@Z
?HSLtoRGB@CxImage@@SA?AUtagRGBQUAD@@U2@@Z
?Decode@CxImage@@QAE_NPAVCxFile@@K@Z

kernel32

SetThreadLocale
GetThreadLocale
LockResource
FindResourceExW
GetCurrentProcess
GetProcAddress
GetCurrentThreadId
WideCharToMultiByte
GetTickCount
FlushInstructionCache
SetLastError
CloseHandle
WriteFile
CreateFileW
GetTempPathW
DeleteFileW
ExpandEnvironmentStringsW
GlobalAlloc
GetModuleHandleW
GetSystemDirectoryW
MulDiv
GetVersionExW
GlobalUnlock
GlobalLock
GlobalSize
MultiByteToWideChar
SizeofResource
LoadResource
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
LoadLibraryExW
GlobalFree
FindResourceW
InterlockedExchange
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedCompareExchange
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
LCMapStringW
GetStringTypeExW
GetUserDefaultLCID
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
FreeLibrary

user32

GetDlgItem
SetCapture
MoveWindow
ReleaseCapture
GetDesktopWindow
GetClassInfoExW
DrawTextW
GetMessageW
GetForegroundWindow
TranslateMessage
DispatchMessageW
PostQuitMessage
AnimateWindow
SystemParametersInfoW
MapWindowPoints
SetWindowRgn
FindWindowExW
EnumChildWindows
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
GetSystemMetrics
GetCursorPos
SetForegroundWindow
LoadCursorW
TrackPopupMenuEx
TrackPopupMenu
IsMenu
MonitorFromPoint
GetMonitorInfoW
ModifyMenuW
GetMenuState
GetMenuItemID
GetMenuItemCount
AppendMenuW
SetMenuInfo
GetMenuInfo
DeleteMenu
DestroyMenu
CreatePopupMenu
SetParent
ShowWindow
EnableWindow
GetDoubleClickTime
MonitorFromWindow
EqualRect
OffsetRect
PtInRect
DestroyWindow
CreateWindowExW
BringWindowToTop
SetCursor
GetFocus
RegisterClassExW
SetRect
DestroyIcon
GetSubMenu
GetActiveWindow
GetWindowTextW
GetKeyState
GetCursor
SetFocus
IsWindowEnabled
GetClientRect
GetWindowTextLengthW
SetWindowTextW
IsIconic
GetWindowLongW
UnregisterClassA
LoadStringW
SetWindowLongW
GetWindow
GetParent
PostMessageW
DefWindowProcW
CallWindowProcW
SetLayeredWindowAttributes
SetWindowPos
UpdateWindow
IntersectRect
GetGUIThreadInfo
IsChild
ClientToScreen
GetDC
UpdateLayeredWindow
ReleaseDC
IsWindow
IsWindowVisible
GetWindowRect
ScreenToClient
SendMessageW
CopyRect
SetRectEmpty
IsRectEmpty
InvalidateRect
EndPaint
BeginPaint
CharNextW
TrackMouseEvent
DrawIcon
GetCaretBlinkTime
GetSysColor
DestroyCursor
LoadCursorFromFileW
CopyIcon
LoadImageW
RegisterClipboardFormatW
MessageBoxW
FillRect
InvalidateRgn
GetWindowDC
CreateMenu

gdi32

CreateMetaFileW
SetWindowOrgEx
SetWindowExtEx
CloseMetaFile
GetMetaFileBitsEx
DeleteMetaFile
OffsetRgn
RestoreDC
SaveDC
CreateRectRgnIndirect
ExtSelectClipRgn
GetTextColor
CreatePen
CreateFontW
CreateBrushIndirect
GetObjectW
StretchDIBits
EnumFontFamiliesExW
GetStockObject
CreateRoundRectRgn
RoundRect
MoveToEx
LineTo
Rectangle
Ellipse
CreateRectRgn
CombineRgn
CreateCompatibleBitmap
SetBkMode
StretchBlt
GetDeviceCaps
CreateSolidBrush
PtInRegion
CreateEllipticRgn
SetTextColor
SetBkColor
ExtTextOutW
GetPixel
SetPixel
CreateCompatibleDC
CreateDIBSection
SelectObject
BitBlt
DeleteDC
DeleteObject

advapi32

RegDeleteKeyW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegDeleteValueW

shell32

SHGetFileInfoW
SHCreateDirectoryExW
DragQueryFileW
ShellExecuteW

ole32

ReleaseStgMedium
OleDuplicateData
StgCreateDocfile
OleUninitialize
OleInitialize
RegisterDragDrop
RevokeDragDrop
DoDragDrop
CreateStreamOnHGlobal
CoCreateGuid
CLSIDFromProgID
StringFromCLSID
CoCreateInstance
StringFromGUID2
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CLSIDFromString

oleaut32

SysStringByteLen
SysAllocStringByteLen
DispCallFunc
VariantClear
VariantInit
SafeArrayGetVartype
SysStringLen
SysFreeString
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
SysAllocStringLen
LoadRegTypeLi
VarBstrCmp
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayUnlock
SafeArrayLock
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim

shlwapi

PathFileExistsW

msimg32

TransparentBlt
AlphaBlend

msvcp80

?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@_W@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?data@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@1@0@Z
?length@?$char_traits@_W@std@@SAIPB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z

msvcr80

_wcslwr_s
__clean_type_info_names_internal
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_except_handler4_common
??8type_info@@QBE_NABV0@@Z
memmove
vsprintf_s
_vscprintf
wcsncmp
wcschr
vswprintf_s
_vscwprintf
memcpy
towlower
wcscspn
wcsspn
iswspace
swscanf_s
_wtoi64
_wtof
_wtol
_wtoi
strncpy_s
_wcsupr_s
wcsstr
_wcsicmp
ldiv
swprintf_s
malloc
wcsrchr
_purecall
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memmove_s
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
memset
_recalloc
__CxxFrameHandler3
??_V@YAXPAX@Z
wcscat_s
wcsncpy_s
wcscpy_s
_CxxThrowException
memcpy_s
free
??3@YAXPAX@Z

wininet

DeleteUrlCacheEntryW

riched20

ord4

imm32

ImmReleaseContext
ImmGetContext

Exports

Exports

?AddDataElement@DataPack@Help@@YAJPAUIGeneralData@BULL@@0@Z
?CreateDataPack@DataPack@Help@@YAJPAPAUIGeneralData@BULL@@@Z
?CreateDropSource@BASEGUI@@YAJPAPAUIDropSource@@PAPAUIDataObject@@IPAE@Z
?CreatePaintDevice@BASEGUI@@YAJPAUHDC__@@PAPAUIDispatch@@@Z
?ExtractOleData@BASEGUI@@YAJPAUIDataObject@@HPAPAUIGeneralData@BULL@@@Z
?GetRTFContentLength@RTF@BG@Help@@YAIPBDPAUIGeneralArray@BULL@@@Z
?GuiCellPoint2WindowPoint@BASEGUI@@YAJPAUIDispatch@@AAUtagPOINT@@@Z
?InsertDataElement@DataPack@Help@@YAJPAUIGeneralData@BULL@@0H@Z
?MakeRTFContent2@RTF@BG@Help@@YAJPBDPAUIGeneralArray@BULL@@PAEPAI@Z
?MakeRTFContent@RTF@BG@Help@@YAJPBDPAUIGeneralArray@BULL@@PAXPAI@Z
?ScreenPoint2GuiCellPoint@BASEGUI@@YAJPAUIDispatch@@AAUtagPOINT@@@Z
?SetDataObject@BASEGUI@@YAJPAUIDataObject@@PAUIGeneralData@BULL@@@Z
?WindowPoint2GuiCellPoint@BASEGUI@@YAJPAUIDispatch@@AAUtagPOINT@@@Z
DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer
_BGMessageBox@16

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 492KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 688B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
4399生死狙击刷金币修改器/s_ju/down_01/VSMsgBox.layout
4399生死狙击刷金币修改器/s_ju/down_01/VsHelper.layout
4399生死狙击刷金币修改器/s_ju/down_01/VsKeyMap.layout
4399生死狙击刷金币修改器/s_ju/tp/nizhan.jpg
.jpg
4399生死狙击刷金币修改器/s_ju/tp/smls.jpg
.jpg
4399生死狙击刷金币修改器/s_ju/tp/timg.jpg
.jpg
4399生死狙击刷金币修改器/s_ju/tp/timg2.jpg
.jpg
4399生死狙击刷金币修改器/s_ju/tp/timg3.jpg
.jpg
4399生死狙击刷金币修改器/s_ju/tp/timg4.jpg
.jpg
使用说明.url
极速软件下载.url
.url

Sharing

General

Malware Config

Signatures

Files

ab5c6c5ba22a1fcd233f6e317ae0bdbb

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 16KB - Virtual size: 15KB

.data Size: - Virtual size: 2KB

.rsrc Size: 12KB - Virtual size: 8KB

c9f423990106792d73744f584215634e

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

6a:8d:1e:b5:26:62:6b:e3:ba:50:ce:78:28:80:7d:a9:35:41:fe:1eSigner

Headers

File Characteristics

Imports

user32

ws2_32

msvcp60

msvcrt

kernel32

Sections

.text Size: 1.4MB - Virtual size: 1.4MB

.rdata Size: 96KB - Virtual size: 93KB

.data Size: 44KB - Virtual size: 18.2MB

.idata Size: 12KB - Virtual size: 9KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 88KB - Virtual size: 84KB

a07e2b03025f6d400ea5f168e05474e9

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0Certificate

Extended Key Usages

Key Usages

f4:d4:72:5a:eb:20:e6:44:2f:ef:5a:06:86:24:8a:7f:20:ad:f7:faSigner

Headers

File Characteristics

Imports

user32

shell32

ws2_32

msvcrt

msvcp60

kernel32

Exports

Exports

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 104KB - Virtual size: 102KB

.data Size: 88KB - Virtual size: 107KB

.idata Size: 12KB - Virtual size: 10KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 44KB - Virtual size: 40KB

Headers

File Characteristics

Sections

.text
Size: 16KB - Virtual size: 15KB

.data
Size: - Virtual size: 2KB

.rsrc
Size: 12KB - Virtual size: 8KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

6a:8d:1e:b5:26:62:6b:e3:ba:50:ce:78:28:80:7d:a9:35:41:fe:1e
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 96KB - Virtual size: 93KB

.data
Size: 44KB - Virtual size: 18.2MB

.idata
Size: 12KB - Virtual size: 9KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 88KB - Virtual size: 84KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

5d:06:88:f9:04:0a:d5:22:87:fc:32:ad:ec:eb:85:b0
Certificate

f4:d4:72:5a:eb:20:e6:44:2f:ef:5a:06:86:24:8a:7f:20:ad:f7:fa
Signer

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 104KB - Virtual size: 102KB

.data
Size: 88KB - Virtual size: 107KB

.idata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 40KB

.text
Size: 108KB - Virtual size: 560KB

.data
Size: 512B - Virtual size: 28KB

.rsrc
Size: 23KB - Virtual size: 80KB

.aspack
Size: 5KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

56:65:97:19:56:9b:e0:7b:77:5a:1b:22:75:e2:d8:3a
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 492KB - Virtual size: 491KB

.data
Size: 136KB - Virtual size: 137KB

.rsrc
Size: 4KB - Virtual size: 688B

.reloc
Size: 208KB - Virtual size: 205KB