6e9bee606de3796673a8c1b2855cb9f2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6e9bee606de3796673a8c1b2855cb9f2_JaffaCakes118
Size

29.4MB
MD5

6e9bee606de3796673a8c1b2855cb9f2
SHA1

9c160c12fd9738572733bd53ff8385feb64f1469
SHA256

183f6d3cf733bf536b127a367ace2946670ca6590c4957b30b62e2038993b80b
SHA512

1db7cfc1ecf2a563975204f68afb1aea94bb934ee5dd030bf36d89d3518e88d1234957368e77b2541e36d6ffca0d1823d62fe8363b3fd5442f7de24041ef213b
SSDEEP

786432:w6bpI/kO3SmgoVrTYcIGJhNL1ZMkG2aTLrp8ZB183uXZpL2w:uzSSrTYCRjq/rptw

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/FileInfo.dll
unpack001/$PLUGINSDIR/RCWidgetPlugin.dll
unpack001/$PLUGINSDIR/System.dll

Files

6e9bee606de3796673a8c1b2855cb9f2_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2013, 00:00

Not After

22/05/2016, 23:59

Subject

CN=2345.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=总办,O=2345.com,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

22:e8:de:be:5a:a3:cc:da:88:5d:a1:e7:b4:60:55:40:82:be:4b:47
Signer

Actual PE Digest

22:e8:de:be:5a:a3:cc:da:88:5d:a1:e7:b4:60:55:40:82:be:4b:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 240KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FileInfo.dll
.dll windows:5 windows x86 arch:x86

8a323b382692f8fdc340c0b10b95dc98

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

kernel32

CreateToolhelp32Snapshot
CloseHandle
GetCurrentProcessId
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
lstrcpyW
Process32NextW
GetCurrentProcess
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringW
GetStringTypeW
SetFilePointerEx
GetConsoleMode
TerminateProcess
Process32FirstW
OpenProcess
lstrcpynW
MulDiv
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateProcessW
HeapAlloc
EncodePointer
DecodePointer
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
GetProcAddress
HeapSize
CreateFileW
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetStdHandle
GetFileType
DeleteCriticalSection
GetModuleFileNameA
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
EnterCriticalSection
LeaveCriticalSection
WriteFile
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
LCMapStringW
GetConsoleCP

user32

wsprintfW
GetDC
ReleaseDC

gdi32

GetDeviceCaps

advapi32

FreeSid
AllocateAndInitializeSid
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
OpenProcessToken
GetLengthSid

Exports

Exports

CheckInstallTime
CreateLowIntegrityProcess
DPIScaleX
DPIScaleY
FindProc
GetSpecialBuild
GetSpreadUserID
KillProc

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/RCWidgetPlugin.dll
.dll windows:4 windows x86 arch:x86

c5021a6b990dc93d269b65980ec7c537

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\2345Input\code\2345input\bin\build_temp\Win32\compile\Release\RCWidgetPlugin\RCWidgetPlugin.pdb

Imports

gdiplus

GdipSetCompositingMode
GdipCreateFromHDC
GdipFree
GdipAlloc
GdipDrawImageRectRect
GdipGetClip
GdipBitmapUnlockBits
GdipTranslateWorldTransform
GdipCreateMatrix
GdipGetWorldTransform
GdipGraphicsClear
GdipGetDC
GdipRestoreGraphics
GdipBitmapLockBits
GdipGetMatrixElements
GdipScaleWorldTransform
GdipDrawImagePointRectI
GdipReleaseDC
GdipDeleteMatrix
GdipGetRegionHRgn
GdipSaveGraphics
GdipTransformPointsI
GdipSetClipRectI
GdipDeleteRegion
GdipCreateRegion
GdipGetClipBoundsI
GdipCloneBitmapAreaI
GdipDrawString
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetTextRenderingHint
GdipDrawImageRectRectI
GdipCreateImageAttributes
GdipCreateStringFormat
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateFontFromDC
GdipSetStringFormatLineAlign
GdipCreateFontFromLogfontW
GdipCreateHBITMAPFromBitmap
GdipMeasureString
GdipDeleteFont
GdipCreateBitmapFromStream
GdipCloneImage
GdipGetImagePalette
GdiplusShutdown
GdipCreateSolidFill
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize
GdipFillRectangleI
GdipGetImagePixelFormat
GdipCloneBrush
GdipSetPixelOffsetMode
GdipGetImageWidth
GdipDisposeImage
GdipGetImageHeight
GdiplusStartup
GdipGetImageGraphicsContext
GdipDeleteBrush
GdipDeleteGraphics

kernel32

InterlockedDecrement
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapSize
GetModuleFileNameA
GetStdHandle
ExitProcess
GetModuleHandleA
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
CreateThread
ExitThread
GetProcessHeap
GetVersionExA
GetCommandLineA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MulDiv
lstrlenW
GlobalFree
lstrcpyW
GlobalAlloc
WideCharToMultiByte
lstrcpynW
MultiByteToWideChar
FindClose
lstrcatW
GetVersion
GetLastError
GetFileAttributesW
FindFirstFileW
FindResourceW
UpdateResourceW
GetVersionExW
LockResource
LoadResource
EndUpdateResourceW
SizeofResource
FreeResource
MoveFileExW
BeginUpdateResourceW
SetErrorMode
LocalFree
GetCommandLineW
GetModuleHandleW
GetProcAddress
GlobalUnlock
FlushInstructionCache
GlobalLock
GetCurrentProcess
RaiseException
LeaveCriticalSection
SetLastError
GetCurrentThreadId
EnterCriticalSection
GetACP
FreeLibrary
LoadLibraryW
DeleteCriticalSection
CloseHandle
WriteFile
LoadLibraryA
InitializeCriticalSection
GetFileSizeEx
ReadFile
GetComputerNameW
SetFilePointer
GetModuleFileNameW
CreateFileW
ExpandEnvironmentStringsW
GetFileAttributesExW
lstrcmpiW
ResumeThread
CreateEventW
ResetEvent
SetEvent
InterlockedExchangeAdd
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
HeapAlloc
HeapReAlloc
HeapFree
TerminateProcess
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
RtlUnwind
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
InterlockedCompareExchange
IsProcessorFeaturePresent

user32

GetPropW
RegisterClassExW
GetForegroundWindow
SetPropW
CallWindowProcW
GetClassLongW
TrackMouseEvent
SetCapture
RedrawWindow
UnionRect
SetCursor
SetRectEmpty
IsRectEmpty
GetWindowTextW
GetDlgItem
GetWindowTextLengthW
MapWindowPoints
SetRect
SetWindowRgn
SystemParametersInfoW
DialogBoxParamW
GetWindow
OffsetRect
SetForegroundWindow
LoadCursorW
ReleaseDC
GetDesktopWindow
GetParent
BeginPaint
IsWindow
UnregisterClassA
GetWindowRect
EndPaint
CopyRect
GetWindowLongW
SetWindowPos
SetFocus
PostMessageW
ShowWindow
EnableWindow
CreateWindowExW
SetWindowTextW
GetActiveWindow
DefWindowProcW
SetWindowLongW
LoadIconW
GetWindowThreadProcessId
DestroyWindow
UpdateLayeredWindow
RemovePropW
GetClassInfoExW
IsIconic
GetDC
EndDialog
CharNextW
SendMessageW
InflateRect
InvalidateRect
PtInRect
ReleaseCapture
wsprintfW
CharPrevW
GetClientRect
ScreenToClient

gdi32

SetWorldTransform
SetStretchBltMode
SetBrushOrgEx
SelectClipRgn
SetROP2
SetDCPenColor
SetTextColor
SetDCBrushColor
SetBkMode
SetGraphicsMode
CreatePolygonRgn
ExtTextOutW
SetBkColor
SelectObject
CreateCompatibleDC
SetViewportOrgEx
BitBlt
CreateCompatibleBitmap
DeleteDC
EnumFontsW
SetArcDirection
CreateFontIndirectW
GetObjectW
GetStockObject
DeleteObject

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenCurrentUser
RegEnumKeyExW
RegDeleteKeyW

shell32

SHGetFolderPathW
SHBrowseForFolderW
SHFileOperationW
SHGetPathFromIDListW
CommandLineToArgvW

ole32

CreateStreamOnHGlobal
OleInitialize
OleUninitialize

shlwapi

StrToIntA

comctl32

InitCommonControlsEx
_TrackMouseEvent

Exports

Exports

ChangeLoaderRes
CheckSignerInfo
CheckSoftwareIsInstall
DeleteFileUntilReboot
DisableRunSetupWizard
DisableSelectDir
GetCheckValue
GetInstDir
GetInstallResult
GetQQInstDir
GetRandomFileName
Init
IsRunSetupWizard
IsSpecailInstall
OnRepair
OnSetup
OnSetupPost
OnUninstall
PopInt
PopString
PushInt
PushString
SetProgress
SetRTL
ShowInstall
ShowUnInstall

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 448KB - Virtual size: 446KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$SYSDIR/2345Pinyin.ime
.dll windows:5 windows x86 arch:x86

3019cac8cd2eda0ee68e85145875286a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2013, 00:00

Not After

22/05/2016, 23:59

Subject

CN=2345.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=总办,O=2345.com,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:49:c5:4d:8c:90:21:2f:0e:f6:3d:9e:4b:3f:2b:74:2a:f3:05:5d
Signer

Actual PE Digest

63:49:c5:4d:8c:90:21:2f:0e:f6:3d:9e:4b:3f:2b:74:2a:f3:05:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\xuyc\2345input12\bin\Win32\Release\pdb\2345Pinyin.pdb

Imports

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent

imm32

ImmUnlockIMC
ImmLockIMC
ImmDestroyIMCC
ImmGenerateMessage
ImmGetIMCCSize
ImmSetConversionStatus
ImmDisableIME
ImmCreateIMCC
ImmLockIMCC
ImmGetConversionStatus
ImmReSizeIMCC
ImmCreateSoftKeyboard
ImmDestroySoftKeyboard
ImmShowSoftKeyboard
ImmUnlockIMCC

gdiplus

GdipDisposeImage
GdipAlloc
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipLoadImageFromStream
GdiplusShutdown
GdipDeleteBrush
GdipDeletePen
GdipCloneBrush
GdipFree
GdipCloneImage
GdipSetCompositingMode
GdipCreateImageAttributes
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesColorKeys
GdipDisposeImageAttributes
GdipSetSmoothingMode
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipDrawRectangleI
GdipCreateFromHWND
GdipDeleteStringFormat
GdipCreatePen1
GdipReleaseDC
GdipGetImageWidth
GdipCreateStringFormat
GdipFillRectangleI
GdipStringFormatGetGenericTypographic
GdipCreateFromHDC
GdipCreateFontFromLogfontW
GdipDrawString
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawImageI
GdipCreateSolidFill
GdipCreateTexture
GdipFlush
GdipSetStringFormatAlign
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipGetImagePixelFormat
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawImageRectRectI
GdipGetImageHeight
GdipCloneBitmapAreaI

kernel32

GetCurrentThreadId
GetCurrentProcessId
GlobalLock
GlobalAlloc
Sleep
GlobalUnlock
CloseHandle
HeapReAlloc
FreeResource
FindResourceW
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
SizeofResource
RaiseException
HeapSize
GlobalFree
LockResource
DecodePointer
DeleteCriticalSection
lstrcpyW
WaitForSingleObject
GetTickCount
lstrlenW
DeleteFileW
FindFirstFileW
GetPrivateProfileStringW
GetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
ReleaseMutex
CreateMutexW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
GetVersionExW
GetModuleFileNameW
MultiByteToWideChar
GetTempPathW
OpenMutexW
GetLocalTime
CreateFileMappingW
OpenFileMappingW
LocalFree
CopyFileW
MoveFileW
SetFileAttributesW
TerminateProcess
WritePrivateProfileStringW
CreateFileW
FreeLibrary
OpenProcess
LoadLibraryW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
GetModuleHandleW
SetLastError
lstrcmpiW
GetFileSize
ReadFile
MoveFileExW
CreateProcessW
GetVersion
ExpandEnvironmentStringsW
WriteFile
GetComputerNameW
SetFilePointer
SystemTimeToFileTime
FileTimeToSystemTime
GetFileType
GetLastError
GetFileInformationByHandle
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
GetCurrentDirectoryW
GetDiskFreeSpaceW
GetVolumeInformationW
ResumeThread
GetDriveTypeW
lstrcatW
GetACP
GetFullPathNameW
GetTempFileNameW
GetLongPathNameW
GetWindowsDirectoryW
SetEndOfFile
SetEvent
ResetEvent
CreateEventW
GetFileSizeEx
GetFileAttributesExW
InterlockedExchangeAdd
FileTimeToLocalFileTime
FormatMessageW
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrW
MulDiv
ExitThread
CreateThread
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetOEMCP
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
PeekNamedPipe
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareFileTime

user32

DispatchMessageW
GetActiveWindow
PeekMessageW
TranslateMessage
GetDesktopWindow
DestroyIcon
IsRectEmpty
SetRectEmpty
SetMenuItemInfoW
DestroyMenu
InsertMenuW
CreatePopupMenu
AppendMenuW
IntersectRect
InflateRect
GetUpdateRect
SetPropW
SetFocus
IsWindowEnabled
DeleteMenu
IsMenu
RemovePropW
GetPropW
CallWindowProcW
GetClassLongW
GetCapture
WaitMessage
WindowFromPoint
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
DrawIconEx
FillRect
MonitorFromPoint
IsIconic
GetParent
InvalidateRect
GetClassNameW
EnableWindow
CopyRect
DrawTextW
GetClientRect
EqualRect
GetMonitorInfoW
MonitorFromRect
MoveWindow
GetKeyboardState
EndPaint
DestroyWindow
SetCursor
UpdateLayeredWindow
KillTimer
SetForegroundWindow
LoadCursorW
FindWindowW
ModifyMenuW
BeginPaint
GetDC
SetCursorPos
LoadMenuW
SystemParametersInfoW
ReleaseDC
EnableMenuItem
SetWindowPos
GetCaretPos
ShowWindow
WindowFromDC
FindWindowExW
MessageBoxW
GetSystemMetrics
UpdateWindow
CheckMenuItem
LoadImageW
CreateWindowExW
ReleaseCapture
ScreenToClient
GetWindowRect
GetMenuItemID
SetCapture
GetSubMenu
CallNextHookEx
GetMenuStringW
GetMenuItemInfoW
PtInRect
LoadIconW
SetRect
GetCursorPos
GetMenuItemCount
SetWindowsHookExW
UnhookWindowsHookEx
CloseClipboard
SendInput
GetFocus
AttachThreadInput
GetForegroundWindow
GetWindowLongW
EmptyClipboard
SetWindowLongW
IsWindow
OpenClipboard
DefWindowProcW
SendMessageW
IsWindowVisible
RegisterClassExW
GetClassInfoExW
GetKeyState
PostMessageW
UnregisterClassW
SetTimer
ClientToScreen
GetWindowThreadProcessId
SetClipboardData
GetGUIThreadInfo

gdi32

CreateDIBSection
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
GetTextExtentPointW
CreatePen
CreateSolidBrush
ExtCreatePen
MoveToEx
LineTo
SelectClipRgn
CreateRectRgn
DeleteDC
GetObjectW
SetTextColor
EnumFontFamiliesExW
BitBlt

advapi32

RegQueryValueExW
RegOpenKeyW
RegOpenCurrentUser
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
OpenProcessToken
GetTokenInformation
GetUserNameW

shell32

SHGetFileInfoW
ShellExecuteExW
SHGetFolderPathW
SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal
CoCreateInstance
RevokeDragDrop
RegisterDragDrop

oleaut32

VariantClear
SysAllocString

psapi

GetProcessImageFileNameW

wininet

HttpSendRequestW
HttpOpenRequestW
InternetWriteFile
HttpAddRequestHeadersW
InternetCrackUrlW
HttpEndRequestW
InternetOpenW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
HttpSendRequestExW
InternetOpenUrlW
InternetReadFile
InternetConnectW

Exports

Exports

ExportGetDemoWindowSize
ExportPaintDemoWindow
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
UIWindowProcedure
UpdateWordLibrary

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcshare
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
2345DirectUI.dll
2345Pinyin.ime
.dll windows:5 windows x86 arch:x86

3019cac8cd2eda0ee68e85145875286a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/05/2013, 00:00

Not After

22/05/2016, 23:59

Subject

CN=2345.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=总办,O=2345.com,L=上海,ST=上海,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:49:c5:4d:8c:90:21:2f:0e:f6:3d:9e:4b:3f:2b:74:2a:f3:05:5d
Signer

Actual PE Digest

63:49:c5:4d:8c:90:21:2f:0e:f6:3d:9e:4b:3f:2b:74:2a:f3:05:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\xuyc\2345input12\bin\Win32\Release\pdb\2345Pinyin.pdb

Imports

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent

imm32

ImmUnlockIMC
ImmLockIMC
ImmDestroyIMCC
ImmGenerateMessage
ImmGetIMCCSize
ImmSetConversionStatus
ImmDisableIME
ImmCreateIMCC
ImmLockIMCC
ImmGetConversionStatus
ImmReSizeIMCC
ImmCreateSoftKeyboard
ImmDestroySoftKeyboard
ImmShowSoftKeyboard
ImmUnlockIMCC

gdiplus

GdipDisposeImage
GdipAlloc
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipLoadImageFromStream
GdiplusShutdown
GdipDeleteBrush
GdipDeletePen
GdipCloneBrush
GdipFree
GdipCloneImage
GdipSetCompositingMode
GdipCreateImageAttributes
GdipCreateBitmapFromHBITMAP
GdipSetImageAttributesColorKeys
GdipDisposeImageAttributes
GdipSetSmoothingMode
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromStream
GdiplusStartup
GdipDrawRectangleI
GdipCreateFromHWND
GdipDeleteStringFormat
GdipCreatePen1
GdipReleaseDC
GdipGetImageWidth
GdipCreateStringFormat
GdipFillRectangleI
GdipStringFormatGetGenericTypographic
GdipCreateFromHDC
GdipCreateFontFromLogfontW
GdipDrawString
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipDrawImageI
GdipCreateSolidFill
GdipCreateTexture
GdipFlush
GdipSetStringFormatAlign
GdipGetImageGraphicsContext
GdipDeleteGraphics
GdipCreateBitmapFromScan0
GdipDeleteFont
GdipGetImagePixelFormat
GdipSetTextRenderingHint
GdipMeasureString
GdipDrawImageRectRectI
GdipGetImageHeight
GdipCloneBitmapAreaI

kernel32

GetCurrentThreadId
GetCurrentProcessId
GlobalLock
GlobalAlloc
Sleep
GlobalUnlock
CloseHandle
HeapReAlloc
FreeResource
FindResourceW
LoadResource
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
SizeofResource
RaiseException
HeapSize
GlobalFree
LockResource
DecodePointer
DeleteCriticalSection
lstrcpyW
WaitForSingleObject
GetTickCount
lstrlenW
DeleteFileW
FindFirstFileW
GetPrivateProfileStringW
GetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
ReleaseMutex
CreateMutexW
MapViewOfFile
UnmapViewOfFile
WideCharToMultiByte
GetVersionExW
GetModuleFileNameW
MultiByteToWideChar
GetTempPathW
OpenMutexW
GetLocalTime
CreateFileMappingW
OpenFileMappingW
LocalFree
CopyFileW
MoveFileW
SetFileAttributesW
TerminateProcess
WritePrivateProfileStringW
CreateFileW
FreeLibrary
OpenProcess
LoadLibraryW
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
GetCurrentProcess
GetModuleHandleW
SetLastError
lstrcmpiW
GetFileSize
ReadFile
MoveFileExW
CreateProcessW
GetVersion
ExpandEnvironmentStringsW
WriteFile
GetComputerNameW
SetFilePointer
SystemTimeToFileTime
FileTimeToSystemTime
GetFileType
GetLastError
GetFileInformationByHandle
DosDateTimeToFileTime
CreateDirectoryW
SetFileTime
GetCurrentDirectoryW
GetDiskFreeSpaceW
GetVolumeInformationW
ResumeThread
GetDriveTypeW
lstrcatW
GetACP
GetFullPathNameW
GetTempFileNameW
GetLongPathNameW
GetWindowsDirectoryW
SetEndOfFile
SetEvent
ResetEvent
CreateEventW
GetFileSizeEx
GetFileAttributesExW
InterlockedExchangeAdd
FileTimeToLocalFileTime
FormatMessageW
IsBadReadPtr
IsBadWritePtr
IsBadStringPtrW
MulDiv
ExitThread
CreateThread
GetStringTypeW
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
CompareStringW
LCMapStringW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetOEMCP
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
PeekNamedPipe
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
FindFirstFileExW
SystemTimeToTzSpecificLocalTime
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CompareFileTime

user32

DispatchMessageW
GetActiveWindow
PeekMessageW
TranslateMessage
GetDesktopWindow
DestroyIcon
IsRectEmpty
SetRectEmpty
SetMenuItemInfoW
DestroyMenu
InsertMenuW
CreatePopupMenu
AppendMenuW
IntersectRect
InflateRect
GetUpdateRect
SetPropW
SetFocus
IsWindowEnabled
DeleteMenu
IsMenu
RemovePropW
GetPropW
CallWindowProcW
GetClassLongW
GetCapture
WaitMessage
WindowFromPoint
GetKeyNameTextW
MapVirtualKeyExW
GetKeyboardLayout
DrawIconEx
FillRect
MonitorFromPoint
IsIconic
GetParent
InvalidateRect
GetClassNameW
EnableWindow
CopyRect
DrawTextW
GetClientRect
EqualRect
GetMonitorInfoW
MonitorFromRect
MoveWindow
GetKeyboardState
EndPaint
DestroyWindow
SetCursor
UpdateLayeredWindow
KillTimer
SetForegroundWindow
LoadCursorW
FindWindowW
ModifyMenuW
BeginPaint
GetDC
SetCursorPos
LoadMenuW
SystemParametersInfoW
ReleaseDC
EnableMenuItem
SetWindowPos
GetCaretPos
ShowWindow
WindowFromDC
FindWindowExW
MessageBoxW
GetSystemMetrics
UpdateWindow
CheckMenuItem
LoadImageW
CreateWindowExW
ReleaseCapture
ScreenToClient
GetWindowRect
GetMenuItemID
SetCapture
GetSubMenu
CallNextHookEx
GetMenuStringW
GetMenuItemInfoW
PtInRect
LoadIconW
SetRect
GetCursorPos
GetMenuItemCount
SetWindowsHookExW
UnhookWindowsHookEx
CloseClipboard
SendInput
GetFocus
AttachThreadInput
GetForegroundWindow
GetWindowLongW
EmptyClipboard
SetWindowLongW
IsWindow
OpenClipboard
DefWindowProcW
SendMessageW
IsWindowVisible
RegisterClassExW
GetClassInfoExW
GetKeyState
PostMessageW
UnregisterClassW
SetTimer
ClientToScreen
GetWindowThreadProcessId
SetClipboardData
GetGUIThreadInfo

gdi32

CreateDIBSection
SetBkMode
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
CreateFontIndirectW
GetTextExtentPointW
CreatePen
CreateSolidBrush
ExtCreatePen
MoveToEx
LineTo
SelectClipRgn
CreateRectRgn
DeleteDC
GetObjectW
SetTextColor
EnumFontFamiliesExW
BitBlt

advapi32

RegQueryValueExW
RegOpenKeyW
RegOpenCurrentUser
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
OpenProcessToken
GetTokenInformation
GetUserNameW

shell32

SHGetFileInfoW
ShellExecuteExW
SHGetFolderPathW
SHCreateDirectoryExW

ole32

CreateStreamOnHGlobal
CoCreateInstance
RevokeDragDrop
RegisterDragDrop

oleaut32

VariantClear
SysAllocString

psapi

GetProcessImageFileNameW

wininet

HttpSendRequestW
HttpOpenRequestW
InternetWriteFile
HttpAddRequestHeadersW
InternetCrackUrlW
HttpEndRequestW
InternetOpenW
InternetSetOptionW
HttpQueryInfoW
InternetCloseHandle
HttpSendRequestExW
InternetOpenUrlW
InternetReadFile
InternetConnectW

Exports

Exports

ExportGetDemoWindowSize
ExportPaintDemoWindow
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
UIWindowProcedure
UpdateWordLibrary

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 223KB - Virtual size: 223KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 8.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rcshare
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
2345PinyinConfig.exe
2345PinyinExtract.dll
2345PinyinInstall.exe
2345PinyinSkinUtil.exe
2345PinyinSvc.exe
2345PinyinSymbol.exe
2345PinyinUpdate.exe
2345PinyinWizard.exe

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

22:e8:de:be:5a:a3:cc:da:88:5d:a1:e7:b4:60:55:40:82:be:4b:47Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 129KB

.ndata Size: - Virtual size: 240KB

.rsrc Size: 25KB - Virtual size: 24KB

8a323b382692f8fdc340c0b10b95dc98

Headers

DLL Characteristics

File Characteristics

Imports

version

kernel32

user32

gdi32

advapi32

Exports

Exports

Sections

.text Size: 64KB - Virtual size: 63KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 14KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 5KB - Virtual size: 4KB

c5021a6b990dc93d269b65980ec7c537

Headers

File Characteristics

PDB Paths

Imports

gdiplus

kernel32

user32

gdi32

advapi32

shell32

ole32

shlwapi

comctl32

Exports

Exports

Sections

.text Size: 184KB - Virtual size: 183KB

.rdata Size: 44KB - Virtual size: 41KB

.data Size: 12KB - Virtual size: 19KB

.rsrc Size: 448KB - Virtual size: 446KB

.reloc Size: 20KB - Virtual size: 17KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

22:e8:de:be:5a:a3:cc:da:88:5d:a1:e7:b4:60:55:40:82:be:4b:47
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 129KB

.ndata
Size: - Virtual size: 240KB

.rsrc
Size: 25KB - Virtual size: 24KB

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 14KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB

.text
Size: 184KB - Virtual size: 183KB

.rdata
Size: 44KB - Virtual size: 41KB

.data
Size: 12KB - Virtual size: 19KB

.rsrc
Size: 448KB - Virtual size: 446KB

.reloc
Size: 20KB - Virtual size: 17KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

63:49:c5:4d:8c:90:21:2f:0e:f6:3d:9e:4b:3f:2b:74:2a:f3:05:5d
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 223KB - Virtual size: 223KB

.data
Size: 1.2MB - Virtual size: 8.5MB

.rcshare
Size: 166KB - Virtual size: 165KB

.rsrc
Size: 305KB - Virtual size: 305KB

.reloc
Size: 171KB - Virtual size: 170KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

63:b4:d4:81:05:76:53:2e:1b:10:b9:9d:39:89:4c:78
Certificate