4e9e6d1788281fbfaefce9967905314f_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

4e9e6d1788281fbfaefce9967905314f_JaffaCakes118
Size

3.5MB
MD5

4e9e6d1788281fbfaefce9967905314f
SHA1

e2e7196b3b1c0b4a24912b8f054d5a418f60258b
SHA256

59da8af052c7b31220c8077fd998cb8f136294e31b774dc5431efb655a07d62a
SHA512

2eebf3f39d3d3742ac6ce316de813d38da06dfc1a490ce2a0cbace36f1a9cf5acfb84632b6a69cf20b3a168ee8b24a9240472264da28c0a39c2510f351ca3816
SSDEEP

98304:wZ2w7nSNYW+Qt3ctXnSNuhEp/uZQ9VTXjo:Tw7SNCQtMRS6IuZoVPo

Score

7^/10

aspackv2 upx

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/zdgqyx/PlayGame.exe	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/安装程序.exe	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/zdgqyx/asabilli.dll
unpack001/zdgqyx/d3dx10.dll
unpack001/zdgqyx/r8E.dll
unpack003/out.upx

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/zdgqyx/xinwan.exe	nsis_installer_1
static1/unpack001/zdgqyx/xinwan.exe	nsis_installer_2

Files

4e9e6d1788281fbfaefce9967905314f_JaffaCakes118
.rar
zdgqyx/CustomizeGame.xml
zdgqyx/InstallCfg.config
zdgqyx/PlayGame.exe
.exe windows:4 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:b1:93:a7:41:09:c3:69:9c:ec:1a:a4:ea:94:38:33
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-08-2013 00:00

Not After

07-08-2015 23:59

Subject

CN=Wuhan Weijun Technology Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术部,O=Wuhan Weijun Technology Co. Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

30:6d:20:74:43:60:3f:cd:67:fb:f3:5f:d5:9f:80:fe:86:09:4b:75
Signer

Actual PE Digest

30:6d:20:74:43:60:3f:cd:67:fb:f3:5f:d5:9f:80:fe:86:09:4b:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 406KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 8KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zdgqyx/asabilli.cnt
zdgqyx/asabilli.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zdgqyx/asabilli.hlp
zdgqyx/bgm1.mid
zdgqyx/d3dx10.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

code
Size: - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zdgqyx/r8E.dll
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

code
Size: - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 131KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zdgqyx/readme.txt
zdgqyx/rungame.ini
zdgqyx/unins000.dat
zdgqyx/xinwan.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$APPDATA/Baidu/Toolbar/Custom Buttons/custom.xml
$PROFILE/AppData/LocalLow/Baidu/Toolbar/Custom Buttons/custom.xml
$PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduBarX.dll
.dll regsvr32 windows:4 windows x86 arch:x86

dbb6ae12303c20296c693f51a2687989

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

setupapi

SetupIterateCabinetW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

RemoveDirectoryW
FindClose
FindNextFileW
FindFirstFileW
SetFilePointer
GetFileSize
Process32NextW
GetCurrentProcessId
Process32FirstW
CreateToolhelp32Snapshot
ReadProcessMemory
OpenProcess
GlobalFree
GlobalAlloc
GlobalUnlock
GlobalLock
SetCurrentDirectoryW
TerminateThread
GetExitCodeThread
OpenMutexW
ReadFile
UnmapViewOfFile
SetUnhandledExceptionFilter
TerminateProcess
MapViewOfFile
CreateFileMappingW
Thread32Next
SuspendThread
OpenThread
Thread32First
SetPriorityClass
GetCommandLineW
SwitchToThread
ExpandEnvironmentStringsW
GetPrivateProfileIntW
WritePrivateProfileStringW
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
lstrcmpW
HeapFree
HeapAlloc
GetProcessHeap
GetEnvironmentVariableW
SystemTimeToFileTime
GetCurrentDirectoryW
LocalFileTimeToFileTime
SetFileTime
SetErrorMode
FileTimeToSystemTime
MoveFileExW
GetLocalTime
GetLocaleInfoW
SetEndOfFile
SetConsoleCtrlHandler
GetOEMCP
GetDriveTypeA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
GetCPInfo
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
UnhandledExceptionFilter
SetCurrentDirectoryA
GetCurrentDirectoryA
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetVersionExA
GetEnvironmentVariableA
GetModuleFileNameA
HeapSize
GetCurrentThread
FatalAppExitA
ExitProcess
GetCommandLineA
GetFullPathNameW
RaiseException
ExitThread
GetDriveTypeW
FileTimeToLocalFileTime
GetSystemTime
GetTimeZoneInformation
HeapReAlloc
RtlUnwind
GetACP
GetPrivateProfileStringW
SetThreadPriority
ResumeThread
SetFileAttributesW
GetWindowsDirectoryW
DeviceIoControl
GetSystemDirectoryW
CopyFileW
GetVersionExW
CreateThread
CreateMutexW
WaitForSingleObject
GetTempFileNameW
DeleteFileW
ReleaseMutex
CompareStringW
LoadLibraryA
lstrcatW
lstrcpyW
DisableThreadLibraryCalls
TryEnterCriticalSection
HeapDestroy
lstrcpynW
LoadLibraryExW
MultiByteToWideChar
lstrcmpiW
GetShortPathNameW
FreeLibrary
LocalFree
FindResourceW
LoadResource
LockResource
SizeofResource
CreateFileW
WideCharToMultiByte
WriteFile
CloseHandle
GetTempPathW
CreateDirectoryW
CreateProcessW
GetModuleFileNameW
LoadLibraryW
GetModuleHandleW
OutputDebugStringA
GetVersion
GetFileAttributesW
GetModuleHandleA
GetProcAddress
SetLastError
GetCurrentThreadId
GetTickCount
Sleep
EnterCriticalSection
InterlockedIncrement
LeaveCriticalSection
GetLastError
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
OutputDebugStringW
DebugBreak
GetCurrentProcess
FlushInstructionCache
lstrlenW
InterlockedDecrement
CompareStringA
SetEnvironmentVariableA
GetFileInformationByHandle

user32

GetSysColorBrush
MonitorFromRect
GetMonitorInfoW
SetRect
PostThreadMessageW
DrawIconEx
GetMessageW
WindowFromPoint
InflateRect
FindWindowExW
GetUpdateRect
ClientToScreen
DeleteMenu
GetTopWindow
MenuItemFromPoint
GetMenuItemID
IsRectEmpty
SetDlgItemTextW
CreateDialogParamW
GetDlgItemTextW
GetWindowDC
AdjustWindowRect
LoadIconW
EnumWindows
IsChild
IsDialogMessageW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CharUpperW
CharUpperBuffA
GetAsyncKeyState
CharNextA
WaitForInputIdle
SetForegroundWindow
GetForegroundWindow
AttachThreadInput
CharLowerBuffW
CreatePopupMenu
AppendMenuW
CreateMenu
EnableMenuItem
TrackPopupMenu
RemoveMenu
DestroyMenu
CopyRect
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
LoadImageW
RedrawWindow
GetMenuItemInfoW
GetMenuItemCount
InsertMenuItemW
SetScrollPos
SetScrollInfo
GetScrollInfo
SetWindowRgn
GetMenuItemRect
RemovePropW
SetPropW
GetPropW
SetWindowLongA
DefWindowProcW
EndDialog
ShowWindow
SetWindowTextW
LoadStringW
IsWindow
SetWindowLongW
GetDlgItem
EndPaint
BeginPaint
GetDC
CallWindowProcW
GetWindowLongW
wvsprintfW
CharNextW
GetKeyState
CharLowerW
EnableWindow
DestroyIcon
DialogBoxParamW
FindWindowW
MessageBoxW
GetWindowThreadProcessId
GetGUIThreadInfo
IsWindowVisible
GetActiveWindow
AdjustWindowRectEx
MoveWindow
DrawTextW
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
FillRect
IsWindowUnicode
GetWindowLongA
EnumChildWindows
GetMessagePos
MessageBeep
SetMenuItemInfoW
FrameRect
GetSystemMetrics
GetDesktopWindow
ScrollWindow
GetClassLongW
SetClassLongW
CreateIconFromResourceEx
CharLowerBuffA
TrackPopupMenuEx
ModifyMenuW
GetSubMenu
DrawStateW
InsertMenuW
LoadBitmapW
DispatchMessageW
TranslateMessage
PeekMessageW
PostMessageW
DestroyWindow
KillTimer
SetTimer
CreateWindowExW
wsprintfW
LoadCursorW
RegisterClassExW
GetClassInfoExW
IsMenu
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindowRect
GetWindow
GetParent
SendMessageW
RegisterWindowMessageW
PtInRect
SetRectEmpty
ScreenToClient
GetCursorPos
ReleaseCapture
GetCapture
SetCapture
SetFocus
UpdateWindow
SetCursor
InvalidateRect
GetDlgCtrlID
OffsetRect
ReleaseDC
GetWindowTextW
GetWindowTextLengthW
GetClassNameW
CallWindowProcA

gdi32

PatBlt
GetTextColor
Rectangle
CreateRoundRectRgn
FillRgn
CreateRectRgn
ExcludeClipRect
GetDeviceCaps
DPtoLP
SelectObject
MoveToEx
LineTo
DeleteObject
GetClipBox
ExtTextOutW
SaveDC
RestoreDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
CreateBitmap
GetCurrentObject
CreateSolidBrush
GetTextExtentPoint32W
GetPixel
TextOutW
SetTextColor
DeleteDC
CreateFontIndirectW
SetBkMode
SetBkColor
GetStockObject
GetObjectW
CreatePen
SetViewportOrgEx

advapi32

RegCreateKeyW
GetUserNameW
RegSetKeySecurity
AllocateAndInitializeSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegQueryValueExW
RegOpenKeyW
SetSecurityInfo
GetSecurityDescriptorSacl
RegEnumKeyW
SetTokenInformation
GetLengthSid
ConvertStringSidToSidW
DuplicateTokenEx
OpenProcessToken
CreateProcessAsUserW
CopySid

shell32

DuplicateIcon
DragQueryFileA
ExtractIconW
SHGetSpecialFolderPathW
SHFileOperationW
ShellExecuteW
SHGetMalloc
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetFileInfoW
SHGetFolderPathW

ole32

OleInitialize
OleUninitialize
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
CLSIDFromProgID
StringFromGUID2
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoCreateGuid

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
LoadTypeLi
VariantCopy
SysAllocString
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
VariantChangeType
SetErrorInfo
GetErrorInfo
VariantInit
SysFreeString
CreateErrorInfo

shlwapi

SHCopyKeyW
StrStrIW
SHGetValueW
SHDeleteKeyW
PathFileExistsW
SHDeleteValueW
SHSetValueW
UrlCombineW
PathFindFileNameW
PathRemoveExtensionW
StrCmpIW
UrlUnescapeA
StrRetToStrW
StrRetToStrA
PathIsDirectoryA
PathRemoveFileSpecA
UrlUnescapeW
UrlCanonicalizeW
PathIsDirectoryW
PathRemoveFileSpecW

wininet

InternetCanonicalizeUrlW
GetUrlCacheEntryInfoW
InternetCloseHandle
InternetReadFile
InternetSetFilePointer
FindFirstUrlCacheGroup
DeleteUrlCacheGroup
FindNextUrlCacheGroup
FindCloseUrlCache
FindFirstUrlCacheEntryW
FindNextUrlCacheEntryW
InternetOpenUrlW
HttpSendRequestExW
HttpEndRequestW
InternetGetConnectedState
DeleteUrlCacheEntryW
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
InternetQueryDataAvailable
InternetQueryOptionW
InternetGetCookieW
InternetSetCookieW
InternetCrackUrlW
HttpQueryInfoW
InternetOpenW
InternetSetOptionW
InternetConnectW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW

urlmon

URLDownloadToFileW
CoInternetGetSession

rpcrt4

UuidCreate

iphlpapi

GetNetworkParams
GetAdaptersInfo

ws2_32

gethostname
gethostbyname

msimg32

AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
RunOnceRemove
RunOnceUpdate
SVCUninstall
Uninstall
UpdateBaiduToolbar

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 152KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.Shared
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 264KB - Virtual size: 261KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/BaiduService.exe
.exe windows:4 windows x86 arch:x86

b2e7f59043adad73fe020115daa83498

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW

kernel32

GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcpynW
InitializeCriticalSection
lstrcpyW
lstrcatW
InterlockedDecrement
InterlockedIncrement
CloseHandle
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
lstrlenW
GetCPInfo
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
WideCharToMultiByte
LoadLibraryA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetCommandLineW
lstrcmpiW
LoadLibraryW
GetProcAddress
FreeLibrary
GetACP
GetOEMCP
FreeEnvironmentStringsW
GetCurrentProcess
WriteFile
GetStartupInfoA
GetFileType
FreeEnvironmentStringsA
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
UnhandledExceptionFilter
TerminateProcess
TlsGetValue
SetLastError
TlsAlloc
TlsSetValue
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
GetModuleHandleA
GetStartupInfoW
GetVersion
ExitProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetEnvironmentStringsW

user32

CharNextW
DispatchMessageW
GetMessageW
ShowWindow
PostThreadMessageW
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
CreateWindowExW
CallWindowProcW
GetWindowLongW
SetWindowLongW
PostQuitMessage
DestroyWindow
DefWindowProcW
FindWindowW
IsWindow
GetWindowThreadProcessId

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCloseKey
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumValueW

ole32

CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoInitializeEx
CoTaskMemFree

oleaut32

SysAllocStringLen
RegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
VarUI4FromStr

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/BarBroker.exe
.exe windows:4 windows x86 arch:x86

10c4284ada8f296e35a475657fe1334f

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Sleep
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
lstrlenW
GetShortPathNameW
GetModuleHandleW
GetModuleFileNameW
MultiByteToWideChar
lstrlenA
SizeofResource
LoadResource
FindResourceW
GetLastError
LoadLibraryExW
lstrcpynW
HeapDestroy
lstrcpyW
lstrcatW
InterlockedIncrement
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
CreateFileW
DeleteFileW
GetTempPathW
OpenThread
GetModuleFileNameA
VirtualQueryEx
WideCharToMultiByte
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
FlushInstructionCache
GetCurrentProcess
DebugBreak
OutputDebugStringW
WriteFile
CopyFileW
CreateEventW
GetVersionExW
ReadFile
GetFileSize
SetFilePointer
SystemTimeToFileTime
FileTimeToSystemTime
GetFileInformationByHandle
GetLocalTime
GetTickCount
SetStdHandle
LoadLibraryA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCommandLineA
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapSize
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
FlushFileBuffers
HeapCreate
GetVersionExA
CreateThread
WaitForSingleObject
CloseHandle
InterlockedDecrement
SetEvent
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LoadLibraryW
GetProcAddress
FreeLibrary
LeaveCriticalSection
CreateDirectoryW
LocalFree
GetEnvironmentVariableA
ExitProcess
GetVersion
GetStartupInfoW
GetModuleHandleA
RaiseException
GetFileAttributesA
HeapReAlloc
HeapAlloc
HeapFree
RtlUnwind

user32

DispatchMessageW
GetMessageW
DialogBoxParamW
GetActiveWindow
DestroyWindow
EndDialog
SetWindowLongW
wvsprintfW
LoadStringW
CharNextW
LoadImageW
GetSystemMetrics
ShowWindow
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
SystemParametersInfoW
GetWindowRect
GetWindow
GetParent
GetWindowLongW
CharLowerBuffW
GetDesktopWindow
PostThreadMessageW
SendMessageW

advapi32

RegOpenKeyW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyW

shell32

SHGetFolderPathW

ole32

CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoUninitialize
CoTaskMemAlloc

oleaut32

SysFreeString
SysAllocString
LoadTypeLi
RegisterTypeLi
VarUI4FromStr

psapi

GetModuleFileNameExW

dbghelp

SymGetModuleInfo
SymLoadModule
StackWalk
SymFunctionTableAccess
SymInitialize
SymGetOptions
SymSetOptions

wininet

HttpOpenRequestA
HttpEndRequestA
InternetWriteFile
HttpSendRequestExA
HttpAddRequestHeadersA
InternetConnectA
InternetSetOptionA
InternetOpenA
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetCloseHandle

Sections

.text
Size: 68KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/Baidu/Toolbar/BaiduBarX_Tmp/rc.dll
.dll windows:4 windows x86 arch:x86

90fb0d3b9147b78e7ee69fa48ce244a0

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

28-07-2006 00:00

Not After

12-08-2009 23:59

Subject

CN=Baidu.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Internet,O=Baidu.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
GetCurrentThread
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FatalAppExitA
HeapAlloc
UnhandledExceptionFilter
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
IsBadWritePtr
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Sleep
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetTimeZoneInformation
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 208KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zdgqyx/游戏说明.txt
zdgqyx/经典台球游戏.ico
zdgqyx/经典桌球游戏.url
安装程序.exe
.exe windows:5 windows x86 arch:x86

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

6d:b1:93:a7:41:09:c3:69:9c:ec:1a:a4:ea:94:38:33
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

07-08-2013 00:00

Not After

07-08-2015 23:59

Subject

CN=Wuhan Weijun Technology Co. Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=技术部,O=Wuhan Weijun Technology Co. Ltd.,L=Wuhan,ST=Hubei,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:4e:36:4e:65:9d:9a:2c:f2:9b:10:16:a7:55:08:28:f5:90:ad:19
Signer

Actual PE Digest

ae:4e:36:4e:65:9d:9a:2c:f2:9b:10:16:a7:55:08:28:f5:90:ad:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 632KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 135KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 400KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 274KB - Virtual size: 274KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 399KB - Virtual size: 399KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

6d:b1:93:a7:41:09:c3:69:9c:ec:1a:a4:ea:94:38:33Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

30:6d:20:74:43:60:3f:cd:67:fb:f3:5f:d5:9f:80:fe:86:09:4b:75Signer

Headers

File Characteristics

Sections

CODE Size: 406KB - Virtual size: 1.0MB

DATA Size: 6KB - Virtual size: 16KB

BSS Size: - Virtual size: 8KB

.idata Size: 4KB - Virtual size: 12KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 76KB

.rsrc Size: 1.9MB - Virtual size: 2.3MB

.aspack Size: 97KB - Virtual size: 100KB

.adata Size: - Virtual size: 4KB

Headers

File Characteristics

Sections

.rsrc Size: 3.9MB - Virtual size: 3.9MB

.reloc Size: 4KB - Virtual size: 12B

Headers

File Characteristics

Sections

code Size: - Virtual size: 304KB

text Size: 131KB - Virtual size: 132KB

.rsrc Size: 9KB - Virtual size: 12KB

Headers

File Characteristics

Sections

code Size: - Virtual size: 304KB

text Size: 131KB - Virtual size: 132KB

.rsrc Size: 9KB - Virtual size: 12KB

099c0646ea7282d232219f8807883be0

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:feCertificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 36KB

.rsrc Size: 24KB - Virtual size: 24KB

dbb6ae12303c20296c693f51a2687989

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

6d:b1:93:a7:41:09:c3:69:9c:ec:1a:a4:ea:94:38:33
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

30:6d:20:74:43:60:3f:cd:67:fb:f3:5f:d5:9f:80:fe:86:09:4b:75
Signer

CODE
Size: 406KB - Virtual size: 1.0MB

DATA
Size: 6KB - Virtual size: 16KB

BSS
Size: - Virtual size: 8KB

.idata
Size: 4KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 76KB

.rsrc
Size: 1.9MB - Virtual size: 2.3MB

.aspack
Size: 97KB - Virtual size: 100KB

.adata
Size: - Virtual size: 4KB

.rsrc
Size: 3.9MB - Virtual size: 3.9MB

.reloc
Size: 4KB - Virtual size: 12B

code
Size: - Virtual size: 304KB

text
Size: 131KB - Virtual size: 132KB

.rsrc
Size: 9KB - Virtual size: 12KB

code
Size: - Virtual size: 304KB

text
Size: 131KB - Virtual size: 132KB

.rsrc
Size: 9KB - Virtual size: 12KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 36KB

.rsrc
Size: 24KB - Virtual size: 24KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 264KB - Virtual size: 263KB

.data
Size: 152KB - Virtual size: 165KB

.Shared
Size: 4KB - Virtual size: 4B

.rsrc
Size: 264KB - Virtual size: 261KB

.reloc
Size: 148KB - Virtual size: 147KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 12KB - Virtual size: 13KB

.rsrc
Size: 96KB - Virtual size: 95KB

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

23:89:03:55:99:b2:04:cb:18:73:d5:5a:bd:23:83:fe
Certificate