7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118
- SHA256 1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e
Overview
overview
7Static
static
3WebEx/Ateditor.dll
windows7-x64
1WebEx/Ateditor.dll
windows10-2004-x64
1WebEx/Atrcp.dll
windows7-x64
1WebEx/Atrcp.dll
windows10-2004-x64
1WebEx/UILibRes.dll
windows7-x64
1WebEx/UILibRes.dll
windows10-2004-x64
1WebEx/asaudio.dll
windows7-x64
3WebEx/asaudio.dll
windows10-2004-x64
3WebEx/atWbxUI3.dll
windows7-x64
1WebEx/atWbxUI3.dll
windows10-2004-x64
1WebEx/atas32.dll
windows7-x64
1WebEx/atas32.dll
windows10-2004-x64
3WebEx/atasanot.exe
windows7-x64
1WebEx/atasanot.exe
windows10-2004-x64
1WebEx/atasctrl.dll
windows7-x64
1WebEx/atasctrl.dll
windows10-2004-x64
1WebEx/atasnt40.dll
windows7-x64
1WebEx/atasnt40.dll
windows10-2004-x64
1WebEx/ataudio.dll
windows7-x64
1WebEx/ataudio.dll
windows10-2004-x64
1WebEx/atauthor.exe
windows7-x64
7WebEx/atauthor.exe
windows10-2004-x64
7WebEx/atinet.dll
windows7-x64
1WebEx/atinet.dll
windows10-2004-x64
1WebEx/atjpeg60.dll
windows7-x64
3WebEx/atjpeg60.dll
windows10-2004-x64
3WebEx/atkbctl.dll
windows7-x64
1WebEx/atkbctl.dll
windows10-2004-x64
1WebEx/atmdctl.dll
windows7-x64
3WebEx/atmdctl.dll
windows10-2004-x64
3WebEx/atnetext.dll
windows7-x64
3WebEx/atnetext.dll
windows10-2004-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WebEx/Ateditor.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
WebEx/Ateditor.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
WebEx/Atrcp.dll
Resource
win7-20240508-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
WebEx/Atrcp.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
WebEx/UILibRes.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral6
Sample
WebEx/UILibRes.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
WebEx/asaudio.dll
Resource
win7-20240215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
WebEx/asaudio.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
WebEx/atWbxUI3.dll
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
WebEx/atWbxUI3.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
WebEx/atas32.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
WebEx/atas32.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
WebEx/atasanot.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
WebEx/atasanot.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
WebEx/atasctrl.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
WebEx/atasctrl.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
WebEx/atasnt40.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
WebEx/atasnt40.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
WebEx/ataudio.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
WebEx/ataudio.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
WebEx/atauthor.exe
Resource
win7-20240508-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
WebEx/atauthor.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral23
Sample
WebEx/atinet.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
WebEx/atinet.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
WebEx/atjpeg60.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
WebEx/atjpeg60.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
WebEx/atkbctl.dll
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
WebEx/atkbctl.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
WebEx/atmdctl.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
WebEx/atmdctl.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
WebEx/atnetext.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
WebEx/atnetext.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118
- Size 2.4MB
- Sample240527-2cre5add32
- SHA256 1741be55d741c6d4cba3d685241aa1f10c05517bc6dab5392ce4b4f945ff184e
- MD5 7ac0c6b9db7f41a283667b9b7994a56a
- SHA1 7bd40c9ded32aa0a2be03f1b902136837f1c72c1
- SHA512 9077548d208d544ed19894384334cdb6213f68c2674beb4e04f9af64cb66f0f80107975b47712236a4ac4411d522206976e59108ae78ad9f57afb5419976a6fa
- SSDEEP 49152:yTfno1caNfe84rigelADN5VDFgdl9NOilgSozbVtBZVarBqO0xWgX:6oKuR4rigelOVFcOSof1ZVKnmr
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 24 IoCs
Checks for missing Authenticode signature.
resource unpack001/WebEx/Ateditor.dll unpack001/WebEx/UILibRes.dll unpack001/WebEx/asaudio.dll unpack001/WebEx/atWbxUI3.dll unpack001/WebEx/atas32.dll unpack001/WebEx/atasctrl.dll unpack001/WebEx/atasnt40.dll unpack001/WebEx/ataudio.dll unpack001/WebEx/atinet.dll unpack001/WebEx/atjpeg60.dll unpack001/WebEx/atkbctl.dll unpack001/WebEx/atmdctl.dll unpack001/WebEx/atnetext.dll unpack001/WebEx/atnt40k.sys unpack001/WebEx/atpack.dll unpack001/WebEx/atpng.dll unpack001/WebEx/atrecply.dll unpack001/WebEx/atres.dll unpack001/WebEx/atrpui.dll unpack001/WebEx/atstmget.dll unpack001/WebEx/atwmvdrv.dll unpack001/WebEx/edconvrt.dll unpack001/WebEx/wmasf.dll unpack001/WebEx/快捷方式管理器.exe
File Explorer
-
7ac0c6b9db7f41a283667b9b7994a56a_JaffaCakes118.rar 2.4MB
-
WebEx/Ateditor.dll.dll 316KB
-
WebEx/Atrcp.dll.dll 45KB
-
WebEx/UILibRes.dll.dll 48KB
-
WebEx/asaudio.dll.dll 24KB
-
WebEx/atWbxUI3.dll.dll 264KB
-
WebEx/atas32.dll.dll 115KB
-
WebEx/atasanot.exe.exe 63KB
-
WebEx/atasctrl.dll.dll 360KB
-
WebEx/atasnt40.dll.dll 182KB
-
WebEx/ataudio.dll.dll 212KB
-
WebEx/atauthor.exe.exe 57KB
-
WebEx/atinet.dll.dll 28KB
-
WebEx/atjpeg60.dll.dll 79KB
-
WebEx/atkbctl.dll.dll 24KB
-
WebEx/atmdctl.dll.dll 40KB
-
WebEx/atnetext.dll.dll 64KB
-
WebEx/atnt40k.sys.sys 50KB
-
WebEx/atpack.dll.dll 36KB
-
WebEx/atpng.dll.dll 132KB
-
WebEx/atrecply.dll.dll 388KB
-
WebEx/atres.dll.dll 1.6MB
-
WebEx/atrpui.dll.dll 200KB
-
WebEx/atstmget.dll.dll 28KB
-
WebEx/atwmvdrv.dll.dll 36KB
-
WebEx/audio.gsm39KB
-
WebEx/edconvrt.dll.dll 160KB
-
WebEx/wmasf.dll.dll 213KB
-
WebEx/wmvcore.dll.dll 2.0MB
-
WebEx/快捷方式管理器.exe.exe 683KB
WebEx/Ateditor.dll
- IMPHASH 0f3d8eb6c3a9f2759217e3aa15997315
- SHA256 9940de24584d7c63d811e9b2acc58d3fce078f28937adeeeb8cbc6e2844f8bad
- MD5 78c21544a2fbb660f002089d17f6ebb0
- SHA1 2e0f0fa6a6ad18b953037d31a04ff22f5fbaef52
- SHA512 107998debb73c2847dab75f6ed11a0bb94c1d218f617fa51eaebfb8742433610a0e35cabee66d514b65b2ec6e05518752a730d50369f60012dd791b4f9995a92
- SSDEEP 6144:NlFVRntXFdhWTKSwRrfTgv5r/mHzXOgcog+BfumP:NlTXFdhOrwRDTgl/mTVjn8m
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
236282
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetStringTypeW
GetStringTypeA
WriteFile
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
RaiseException
GetOEMCP
GetCPInfo
LCMapStringW
LCMapStringA
RtlUnwind
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
HeapSize
ExitProcess
GetModuleHandleA
GetVersion
HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
SetStdHandle
FlushFileBuffers
MulDiv
LocalAlloc
LocalFree
lstrcmpiA
CreateSemaphoreA
ReadFile
GetCommandLineA
GlobalGetAtomNameA
FindClose
GlobalLock
GlobalUnlock
TerminateProcess
GlobalDeleteAtom
CreateThread
SetThreadPriority
GetWindowsDirectoryA
GetTempPathA
GetFileAttributesA
GetVersionExA
GetDiskFreeSpaceA
GetFileSize
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
UnmapViewOfFile
SetFilePointer
SetEndOfFile
DeleteFileA
CreateFileA
CreateFileMappingA
MapViewOfFile
CloseHandle
GlobalAddAtomA
FindFirstFileA
CompareStringA
WinExec
GetSystemDefaultLangID
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetLastError
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
FreeLibrary
GetTickCount
GetModuleFileNameA
WideCharToMultiByte
lstrcatA
lstrlenA
MultiByteToWideChar
lstrcpyA
GetACP
user32
GetSysColor
SetDlgItemInt
GetDlgItemTextA
CheckRadioButton
FindWindowExA
IsRectEmpty
FrameRect
DestroyCursor
GetCapture
GetDlgCtrlID
CreateCursor
GetClassNameA
GetClipboardData
IsIconic
ChangeClipboardChain
DestroyAcceleratorTable
IsZoomed
CheckMenuItem
SetMenu
LoadAcceleratorsA
SetForegroundWindow
CreateDialogParamA
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
PostThreadMessageA
ModifyMenuA
EnableScrollBar
SetScrollRange
SetScrollInfo
GetWindowPlacement
SetWindowPlacement
GetClassLongA
SetClassLongA
GetSystemMenu
DeleteMenu
GetScrollRange
GetScrollPos
SetScrollPos
GetKeyState
RedrawWindow
ClientToScreen
DrawFocusRect
GetMenuState
GetPropA
DestroyMenu
WindowFromPoint
SetRectEmpty
UpdateWindow
EnableMenuItem
GetMenu
DrawMenuBar
GetClipboardViewer
SetClipboardViewer
SetActiveWindow
LoadMenuA
LoadStringA
SetDlgItemTextA
OpenClipboard
EmptyClipboard
CloseClipboard
wvsprintfA
CharNextA
InflateRect
DefWindowProcA
MessageBeep
RegisterHotKey
UnregisterHotKey
SystemParametersInfoA
IsDlgButtonChecked
GetActiveWindow
DialogBoxParamA
GetWindowTextLengthA
SetCursor
CheckDlgButton
GetClientRect
EndPaint
FillRect
BeginPaint
KillTimer
CallWindowProcA
ReleaseDC
GetDC
SetTimer
SetCapture
PtInRect
ScreenToClient
GetCursorPos
TranslateAcceleratorA
GetSubMenu
EnumWindows
ReleaseCapture
SendMessageA
GetParent
GetMenuItemCount
AppendMenuA
RegisterClipboardFormatA
TrackPopupMenu
IsClipboardFormatAvailable
GetFocus
PostMessageA
OffsetRect
LoadBitmapA
SetFocus
DestroyWindow
GetWindowTextA
SendDlgItemMessageA
IsWindowEnabled
GetWindow
IsWindowVisible
RemovePropA
DrawTextA
MessageBoxA
GetDlgItem
MapWindowPoints
GetWindowRect
GetSystemMetrics
SetWindowPos
InvalidateRect
LoadImageA
DrawIconEx
DestroyIcon
EndDialog
SetWindowTextA
SetPropA
LoadIconA
EnableWindow
ShowWindow
CreateWindowExA
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
IsWindow
MoveWindow
CopyRect
SetWindowLongA
GetWindowLongA
GetWindowDC
gdi32
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
GetObjectA
GetStockObject
CreateSolidBrush
CreateFontA
GetTextMetricsA
FillRgn
SetBkMode
GetTextExtentPoint32A
CombineRgn
CreateRectRgn
GetWindowExtEx
CreateFontIndirectA
RestoreDC
GetDeviceCaps
SetWindowOrgEx
SetViewportOrgEx
SetGraphicsMode
SaveDC
IntersectClipRect
SelectClipRgn
CreateRectRgnIndirect
StretchBlt
GetTextExtentPointA
CreateBrushIndirect
GetObjectType
SetPixel
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
SetBkColor
BitBlt
DeleteDC
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
TextOutA
DeleteObject
LineTo
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
winmm
mixerGetNumDevs
waveOutGetDevCapsA
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerOpen
mixerGetDevCapsA
mixerGetLineInfoA
mixerClose
waveInGetNumDevs
waveInGetDevCapsA
waveOutGetNumDevs
shell32
ShellExecuteExA
ShellExecuteA
ole32
OleInitialize
OleUninitialize
comctl32
ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Create
ImageList_Draw
_TrackMouseEvent
WOTExitEditor
WOTInitEditor
WOTIsDialogMessage
Name
.text
Size
260KB
Virtual Size
257KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=25, id=14, version=7299,
count=110, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=8, productName=Unmarked objects (old),
count=6, id=19, version=8022,
count=17, id=19, version=8034,
count=328, id=1, productName=Unmarked objects,
count=47, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/Atrcp.dll
- IMPHASH 78f58eb5a4f783a6d7c1ed32ff9f6ae0
- SHA256 98a40d5b7a308d496457c2a52b9ac1f44904dd5874634863788b97fbec3f48b7
- MD5 0c908117329400bfcdfa04af0c017ae9
- SHA1 b77189293e6e056c63a7e00dcd98ad1f87911e70
- SHA512 faa93c94acee138aee6ab928616f2a378ea68d17a29cb9aabbde3d971b39dcd61984e7e40e4b360c2392766b89c390c0cb08c6da3357af45abc25817033c33a6
- SSDEEP 768:Gu3KZzmPmjFrzf35cYSFwT//T4vYWnL3Jbec/:Gu3KgmhPqYA0/r4AWnV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US
Serial Number
15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 24, 2006 - Apr 7, 2009
Minor OS version
0
Major OS version
4
Entry point
17169
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcessId
lstrlenW
WideCharToMultiByte
GetProcAddress
GetCurrentProcess
FlushInstructionCache
lstrcatA
FreeLibrary
LoadLibraryA
WinExec
GetSystemDefaultLangID
lstrlenA
lstrcpyA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA
lstrcpynA
DisableThreadLibraryCalls
user32
IsIconic
GetParent
CreateWindowExA
RegisterClassExA
LoadCursorA
GetClassInfoExA
GetSystemMetrics
GetWindow
GetPropA
GetWindowThreadProcessId
SetDlgItemTextA
MapWindowPoints
SetWindowPos
GetWindowRect
LoadStringA
LoadIconA
MoveWindow
FindWindowA
PeekMessageA
DispatchMessageA
ShowWindow
SetRectEmpty
SetTimer
KillTimer
IsWindow
RegisterWindowMessageA
DefWindowProcA
BeginPaint
EndPaint
CopyRect
InflateRect
GetScrollPos
OffsetRect
InvalidateRect
GetSysColor
FillRect
GetWindowLongA
SetWindowLongA
SendMessageA
CallWindowProcA
DestroyWindow
GetClientRect
wsprintfA
PostMessageA
SystemParametersInfoA
gdi32
SetBkMode
GetStockObject
SelectObject
GetTextExtentPoint32A
ExtTextOutA
CreateSolidBrush
LineTo
MoveToEx
CreatePen
DeleteObject
SetTextColor
CreateFontIndirectA
oleaut32
SysAllocStringLen
SysFreeString
atkbctl
KbSetFocus
KbUninstallFocusControl
KbInstallFocusControl
msvcrt
malloc
_adjust_fdiv
_initterm
_strlwr
_ftol
memset
free
??3@YAXPAX@Z
memcpy
atol
??2@YAPAXI@Z
strrchr
sscanf
ATDeleteInstance
ATNewInstance
ExitControl
InitControl
WebEx_SetControlType
WebEx_SetControlType2
Name
.text
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=4, productName=Unmarked objects (old),
count=4, id=19, version=8022,
count=7, id=19, version=8034,
count=130, id=1, productName=Unmarked objects,
count=11, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/UILibRes.dll
- IMPHASH 5c54715227e960c5019e7a45d4b9d02a
- SHA256 57c8a42271ab6247772f1a2c7007b521b357fb1883cc0e17502d6ac1f232fa16
- MD5 b0b463e1c92b3acbb6fcf7bbaa17a4fb
- SHA1 6cfc4a8b452a65df72714e39b619cde24d4cc5b4
- SHA512 be1299b19e3e73b203f5976fb814a8488c46033b9e5f87789c8b70339eeec0416085005bdc47ddeb64f1ae4989af68c851027019e9c8b51fde7829673dc51f81
- SSDEEP 384:lPAb3GBThfmkfJHC8C7jDjCr7jCs87l3Dyu1SYr1z2uV+cA/8odwbXUA666666bh:W2TVmkf9eD2rytDXS41z29/8oqUMr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4329
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
VirtualAlloc
HeapReAlloc
GetProcAddress
LoadLibraryA
RtlUnwind
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=14, version=7299,
count=56, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=65, id=1, productName=Unmarked objects,
count=3, id=19, version=8034,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
WebEx/asaudio.dll
- IMPHASH d65f4a892bf740040f401267fd91eeb0
- SHA256 0029546c38d9a98cbf3376c8ddf9119b962c32487379804c4ccdec0e18cb08e1
- MD5 dcaf7723e19970547bcfa6a79666acfd
- SHA1 39755f302b426fa5447b48b27ead00f649b727ad
- SHA512 1f80897432ec82b815677c7b9b9f1178fa2367d8656d84a1f3a31601330961427068baa130ba6d2d7f93e1cc4440d1a20de1e0da582e6744264a2f326e0af4a3
- SSDEEP 96:FiLcpM72saH/Hv84/FKdjo0oZCs+M8HGXpckaes2SpccpAH3m4uXfee8QXZ3:q0sIPVqWCoakaeHcpAH3Xu38QXR
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
7567
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
CreateFileA
GetTimeFormatA
CloseHandle
SetFilePointer
WriteFile
GetLastError
GetFileAttributesA
CreateDirectoryA
GetModuleFileNameA
FreeLibrary
GetProcAddress
LoadLibraryA
GetDateFormatA
user32
wsprintfA
wvsprintfA
SetWindowLongA
msvcrt
_splitpath
_adjust_fdiv
malloc
_purecall
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_makepath
_itoa
__dllonexit
_onexit
free
_initterm
MDDeleteInstance
MDNewInstance
WOTInitPlayer
WOTInitRecorder
WOTKillPlayer
WOTKillRecorder
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
676B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
524B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=39, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=5, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atWbxUI3.dll
- IMPHASH b62282b623caba77a3d3d93bc02fe7f5
- SHA256 bce33e2d14c5be43ac72cc87eeff02b1c5852bc67999c63bbb868564705e5222
- MD5 1e1fc38b1d922118c617e786b789cdf0
- SHA1 0448fdcbf91e88876dc21a4fca7790fba92d1d48
- SHA512 2b48d41fad5b1af0769326162c8fe5fbfbab13a840921965e3c0a187c5d9a3e2b531716d49bf5a378ccc97f0176de0be9b40bdeea90dc43af72ff1ea8310c7c1
- SSDEEP 6144:pNU5eYthng5IHiSwAdE2Zx+PJU1JlNQdT2:LKeBex+Y/N42
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
209169
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FindAtomA
GetProcAddress
LoadLibraryA
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
lstrcpynA
lstrcmpA
lstrlenA
GetVersionExA
GetCurrentProcessId
lstrcpyA
IsBadWritePtr
lstrcmpiA
CompareStringA
GetLastError
GetModuleHandleA
GetTickCount
lstrcatA
IsDBCSLeadByte
lstrcpynW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
DisableThreadLibraryCalls
EnumResourceLanguagesA
GetModuleFileNameA
GetSystemDefaultLangID
FreeLibrary
AddAtomA
DeleteAtom
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalFree
user32
GetScrollPos
GetClassLongA
LoadIconA
SetDlgItemTextA
EnableWindow
RedrawWindow
GetPropA
GetMenuStringA
GetMenuItemID
GetTopWindow
GetMenuItemRect
AppendMenuA
CreatePopupMenu
EnableMenuItem
IsRectEmpty
IsIconic
GetSystemMenu
DrawIconEx
PostQuitMessage
LoadStringW
SetCapture
DestroyCursor
SetRect
GetDesktopWindow
RemovePropA
SetPropA
SetParent
LoadStringA
WindowFromDC
GetWindowRgn
CreateDialogParamA
DialogBoxParamA
EndDialog
ShowWindow
SetWindowTextA
ClientToScreen
GetWindowTextLengthA
CreateCursor
EndPaint
BeginPaint
FindWindowExA
GetWindow
GetCapture
MapWindowPoints
GetSubMenu
PeekMessageA
IsMenu
RegisterWindowMessageA
GetMessagePos
GetSysColorBrush
GetKeyState
GetActiveWindow
GetWindowThreadProcessId
CharNextA
CharLowerA
GetFocus
MessageBeep
PostMessageA
DestroyMenu
InflateRect
DrawStateA
DestroyIcon
FillRect
GetClassNameA
SetWindowPos
SetRectEmpty
CallNextHookEx
SystemParametersInfoA
SetWindowsHookExA
TrackPopupMenuEx
UnhookWindowsHookEx
UpdateWindow
GetMenuItemCount
GetMenuItemInfoA
SetMenuItemInfoA
ModifyMenuA
OffsetRect
GetWindowDC
LoadImageA
LoadBitmapA
ReleaseDC
GetDlgItem
GetDC
GetSystemMetrics
ValidateRect
SetCursor
GetNextDlgTabItem
SetFocus
GetDlgCtrlID
ReleaseCapture
SendMessageA
GetCursorPos
ChildWindowFromPoint
WindowFromPoint
IsWindowVisible
IsWindowEnabled
PtInRect
DrawFocusRect
FrameRect
SetWindowRgn
GetWindowTextA
DrawTextA
GetSysColor
GetWindowRect
GetParent
ScreenToClient
InvalidateRect
DestroyWindow
CreateWindowExA
GetWindowLongA
SetWindowLongA
IsWindow
MoveWindow
CopyRect
KillTimer
CallWindowProcA
SetTimer
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
GetClientRect
DefWindowProcA
EqualRect
gdi32
GetDIBits
SetDIBitsToDevice
SetStretchBltMode
StretchDIBits
SelectClipRgn
GetDeviceCaps
CreateFontIndirectA
Rectangle
Polygon
CreatePatternBrush
CreateBitmap
StretchBlt
CreateRectRgn
CreateRoundRectRgn
GetTextColor
OffsetRgn
GetRgnBox
CombineRgn
GetTextExtentPoint32A
CreateCompatibleBitmap
RestoreDC
ExtTextOutA
ExcludeClipRect
SaveDC
CreatePolygonRgn
FillRgn
Arc
GetPixel
SetPolyFillMode
TextOutA
SetWindowExtEx
GetWindowExtEx
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
DPtoLP
ExtCreateRegion
CreateDIBSection
GetObjectType
SetBkColor
CreateCompatibleDC
BitBlt
DeleteDC
GetTextMetricsA
RoundRect
CreateSolidBrush
SetBkMode
SetTextColor
CreatePen
SelectObject
DeleteObject
MoveToEx
LineTo
GetStockObject
GetObjectA
PatBlt
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
shell32
ShellExecuteA
comctl32
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_AddMasked
ImageList_DrawEx
ImageList_Add
ImageList_GetImageInfo
_TrackMouseEvent
ImageList_GetIcon
ImageList_Draw
ImageList_Create
ImageList_Destroy
InitCommonControlsEx
msvcrt
_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
_except_handler3
_mbsrchr
_mbsnbcpy
abs
_mbscmp
memcmp
_ftol
atoi
_mbschr
memmove
realloc
malloc
free
memset
strlen
??2@YAPAXI@Z
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
BitmapToRegion
DisableXPVisualStyle
DrawArrow
DrawGradientLine
DrawRoundRectBorder
ExDrawLine
GetBitmapSize
GetBmpHeight
GetBmpWidth
GetHScrollBar
GetVScrollBar
GradientRectangle
Init_UILibResourceDLL
InitializeWbxSB
Internal_DrawButton_BK
Internal_LoadUILibString
MakeToolbarImageList
UnInit_UILibResourceDLL
WbxDrawTransparentBitmap
WbxSB_InitializeApp
WbxSB_SetStyle
WbxSB_UninitializeApp
WbxSynchronizeDCMap
WbxUI_ClearMagicWindow
WbxUI_Draw3DRect
WbxUI_DrawBKBmp
WbxUI_DrawBK_UsedBmp
WbxUI_DrawHypeLinkText
WbxUI_DrawText
WbxUI_ExtractSubBitmap
WbxUI_FillSolidRect
WbxUI_GetBmpFromImgList
WbxUI_GetCharSet
WbxUI_GetFont
WbxUI_GetFontByLOGFONT
WbxUI_GetFontByPT
WbxUI_GetMagicWindowFlag
WbxUI_GetOSVersion
WbxUI_GetResourceHandle
WbxUI_GetTextHeight
WbxUI_GetTextLength
WbxUI_Initialize
WbxUI_IsMagicWindow
WbxUI_MapToGray
WbxUI_SetDefaultFont
WbxUI_SetMagicWindow
WbxUI_SetMagicWindowFlag
WbxUI_SetResourceHandle
WbxUI_Uninitialize
Name
.text
Size
208KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=14, productName=Unmarked objects (old),
count=259, id=1, productName=Unmarked objects,
count=11, id=19, version=8034,
count=43, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atas32.dll
- IMPHASH 2be6902f6ef7585872434d13b6f1b496
- SHA256 4e5d3b111eea5b6ec2488efe79cd833cd29ea5afbb59876e2535c1650d6865ff
- MD5 15d665bb2b0c9373bb61763bd0db02d6
- SHA1 4a1d34e28340e88547df3c0d4d3112ff96c1730f
- SHA512 8f4a5b2b478f78fbac7f382f2bd2aba4b095d1ef38bf60b1e4b02e6bb393d0903cad49c78f1ff0ddbc5db25005782f61a84d155818ecc9368caff2149af8b9f1
- SSDEEP 3072:irbYH7/1/WyFXQBbVB1CO0JudUUBMerVcedYV+juFwimTtqMh:iAH7N/WOXQBbVB1nOuJpVceaV+jLimTX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
107991
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
FreeLibrary
LoadLibraryA
GetProcAddress
GetShortPathNameA
lstrcpyA
CreateFileA
GetModuleFileNameA
GetCurrentProcess
WriteConsoleOutputA
SetConsoleCursorInfo
SetConsoleCursorPosition
EnterCriticalSection
LeaveCriticalSection
FlushConsoleInputBuffer
GetNumberOfConsoleInputEvents
ReadConsoleInputA
GetStdHandle
WriteConsoleInputA
WaitForSingleObject
TerminateThread
CloseHandle
FreeConsole
CreateThread
SetThreadPriority
AllocConsole
SetConsoleTitleA
SetConsoleCtrlHandler
ResumeThread
DeviceIoControl
MulDiv
GetSystemDirectoryA
lstrcatA
GetFileAttributesA
GetVersion
WideCharToMultiByte
GetACP
MultiByteToWideChar
GetTickCount
user32
ReleaseDC
GetDC
DestroyCursor
DestroyIcon
UnionRect
GetWindowDC
GetSystemMetrics
MessageBeep
PostThreadMessageA
mouse_event
GetDoubleClickTime
keybd_event
MapVirtualKeyA
CreateCursor
CreateIconIndirect
GetMessageExtraInfo
ExitWindowsEx
RedrawWindow
IntersectRect
SetRectEmpty
gdi32
TextOutA
GetTextExtentPoint32A
SetBkMode
SetROP2
CreatePenIndirect
Rectangle
UnrealizeObject
SetBrushOrgEx
GetBkColor
GetTextColor
SelectClipRgn
SetBkColor
SetTextColor
BitBlt
FlattenPath
GetTextExtentPoint32W
PolyDraw
PolyBezierTo
CloseFigure
LineTo
CreateRectRgn
ExtTextOutW
GetDeviceCaps
Ellipse
AngleArc
MoveToEx
SetArcDirection
ArcTo
BeginPath
RoundRect
EndPath
CreateDIBPatternBrushPt
TextOutW
CreateFontIndirectA
SetTextAlign
SetTextCharacterExtra
ExtTextOutA
Polygon
CreateDIBSection
GetBitmapBits
StretchBlt
Arc
Chord
Pie
FrameRgn
GetRgnBox
ExtFloodFill
SetPolyFillMode
ExtCreatePen
StrokeAndFillPath
FillPath
StrokePath
DeleteObject
CreateBitmap
CreatePalette
CombineRgn
CreateBitmapIndirect
CreateCompatibleBitmap
GetDIBits
GetObjectA
DeleteDC
PatBlt
CreateSolidBrush
SelectObject
CreateCompatibleDC
GetPath
ExtCreateRegion
GetRegionData
RealizePalette
SelectPalette
GetStockObject
SetDIBits
CreatePatternBrush
CreateBrushIndirect
Polyline
advapi32
RegCloseKey
RegOpenKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegQueryValueExA
msvcrt
_adjust_fdiv
_initterm
realloc
strncpy
_splitpath
strcpy
strcat
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
free
malloc
memcmp
abs
strlen
memcpy
memset
AppShareJpegCompressBitmap
AppShareJpegDecompressBitmap
AppShareSetMode
AppShareZipCompress
AppShareZipDecompress
GetAtas32Version
GetFunctionPoints
SetAtasctrlVersion
Name
.text
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=160, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=17, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atasanot.exe
- IMPHASH 251c884d8341c8d5c12ae387accaed16
- SHA256 500fd368097787e2fc4805dc171ac6495df9e6f27e409d63103e85fcde1a5158
- MD5 ba5a763abe330e986475da23dd6f5d14
- SHA1 f05c31f2fc47cc077190e1ea810d0207093e322d
- SHA512 59b35f922fadf17b453bcfb6cb63c1ccd06288d7be921877b0056133e30f3577393db7dd8b1a2e2f85215e56d8b874c6f6c59e690844b1a32bdd2df1142acabe
- SSDEEP 768:fQWA7QDYB/Y33xOlKDDtoPiHvl/uvt+hJVzyJvvfsOMDbnrdP0Wi93eUl621ELOD:IR7QDI/yGiHdX9O0nPW3XEg+GBGsvV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US
Serial Number
15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 24, 2006 - Apr 7, 2009
Minor OS version
0
Major OS version
4
Entry point
48348
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GlobalGetAtomNameA
GlobalDeleteAtom
GetStartupInfoA
GetCommandLineA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
GetModuleFileNameA
GetDateFormatA
GetTimeFormatA
GetVersion
GetSystemDefaultLangID
GetVersionExA
lstrcatA
lstrlenA
MulDiv
WideCharToMultiByte
lstrcpyA
Sleep
MultiByteToWideChar
user32
HideCaret
MessageBeep
ShowCaret
SetFocus
GetAsyncKeyState
GetCursorPos
ScreenToClient
TabbedTextOutA
GetTabbedTextExtentA
TabbedTextOutW
GetTabbedTextExtentW
FillRect
PtInRect
GetFocus
PostMessageA
SetCursor
InflateRect
GetDC
ReleaseDC
RedrawWindow
InvalidateRect
UpdateWindow
SendMessageA
GetClientRect
ReleaseCapture
SetCapture
LoadCursorA
CreateCaret
SetCaretPos
DestroyCaret
SetRect
DefWindowProcA
SetWindowLongA
GetWindowLongA
CallWindowProcA
wvsprintfA
LoadBitmapA
GetDesktopWindow
DispatchMessageA
TranslateMessage
GetMessageA
FindWindowA
KillTimer
GetClassLongA
DestroyWindow
SetForegroundWindow
SetClassLongA
SetTimer
GetWindowRect
GetWindowThreadProcessId
ClientToScreen
GetKeyState
BeginPaint
EndPaint
PostQuitMessage
GetSystemMetrics
CreateWindowExA
ShowWindow
LoadIconA
IsWindow
RegisterClassA
gdi32
SetViewportExtEx
SetWindowOrgEx
SetWindowExtEx
SetBrushOrgEx
SetStretchBltMode
SetMapMode
LPtoDP
RestoreDC
DeleteObject
Rectangle
GetStockObject
SelectObject
CreatePen
SetBkMode
SelectClipRgn
SaveDC
Polyline
SetROP2
FillRgn
CreatePolygonRgn
CreateSolidBrush
LineTo
MoveToEx
Ellipse
GetObjectType
CreateDIBSection
GetObjectA
DPtoLP
GetDeviceCaps
GetTextMetricsA
CreateBitmap
PatBlt
SetBkColor
BitBlt
GetTextExtentPoint32A
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
CreateFontIndirectA
TextOutW
DeleteDC
Polygon
CreateEllipticRgn
CombineRgn
PtInRegion
SetViewportOrgEx
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
_stricmp
_except_handler3
_splitpath
_makepath
strcat
fputs
fflush
wcscpy
wcslen
memmove
sqrt
abs
_ftol
strcmp
memcmp
strlen
strcpy
memcpy
free
malloc
memset
??2@YAPAXI@Z
??3@YAXPAX@Z
Name
.text
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=19, version=8022,
count=188, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=11, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
WebEx/atasctrl.dll
- IMPHASH c59e0cd4ab4440b63ed00bfd880ba53f
- SHA256 f7877316792a1cf5c922d2edf2a51a9d4ffe7ec0b4573b26736bca000450d617
- MD5 9b6066ef9291ff8a87699cc2be9820a5
- SHA1 20cc466a801718de1d13e0b1a9c3176e12e00e36
- SHA512 c802bc97be6c3724520a441d1a7d2514c77df5ef204351b7cf0247a0e256e6102429a746f25f556511c70d8e43664627219d56a2e14259e7ebade554fb9cf5fa
- SSDEEP 6144:SQKrBilOrvR2XQSdV4pi51GNhHy2aGPzIP6XlCXG0QXxQ8il5:8We3iuphNhHy2aGPzI8sJQXxsv
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
254378
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetFileSize
CreateFileMappingA
HeapDestroy
DisableThreadLibraryCalls
lstrlenW
GetCommandLineA
WaitForSingleObject
GetExitCodeThread
DeleteCriticalSection
InitializeCriticalSection
GetTempPathA
GetTempFileNameA
SetFilePointer
WriteFile
FlushFileBuffers
ReadFile
GlobalFree
LockResource
IsBadWritePtr
FindFirstFileA
FindClose
GlobalDeleteAtom
OpenProcess
LoadLibraryA
TerminateProcess
FindNextFileA
MapViewOfFile
UnmapViewOfFile
GlobalAlloc
GlobalLock
GlobalUnlock
ExpandEnvironmentStringsA
AddAtomA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetExitCodeProcess
IsBadReadPtr
CreateToolhelp32Snapshot
Thread32First
Thread32Next
CreateThread
ResumeThread
GetCurrentProcessId
GetAtomNameA
DeleteAtom
GetTickCount
lstrcmpiA
GetACP
CreateProcessA
GlobalAddAtomA
GetWindowsDirectoryA
OpenFileMappingA
GetSystemDirectoryA
CreateFileA
GetSystemDefaultLangID
lstrcatA
MulDiv
WideCharToMultiByte
Sleep
MultiByteToWideChar
GetVersion
OutputDebugStringA
GetVersionExA
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
GetProcAddress
GetModuleFileNameA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetModuleHandleA
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
GetCurrentThreadId
LeaveCriticalSection
SetLastError
CreateMutexA
GetLastError
lstrlenA
lstrcpyA
ReleaseMutex
CloseHandle
FreeLibrary
user32
CheckMenuRadioItem
DialogBoxParamA
ScrollWindowEx
GetMessageExtraInfo
ScrollDC
ShowScrollBar
SetScrollInfo
GetScrollInfo
DrawFocusRect
GetSysColorBrush
SetDlgItemTextA
EnableWindow
CheckDlgButton
GetDlgItem
IsDlgButtonChecked
SetMenu
LoadImageA
DispatchMessageA
TranslateMessage
IsDialogMessageA
ChangeClipboardChain
SetClipboardViewer
OpenInputDesktop
GetUserObjectInformationA
CloseDesktop
DestroyMenu
IsZoomed
AdjustWindowRect
SetRectEmpty
SubtractRect
GetCapture
GetKeyState
FlashWindow
DrawTextA
RegisterClassA
GetParent
mouse_event
ChildWindowFromPointEx
FindWindowExA
IsRectEmpty
IntersectRect
EqualRect
UnregisterClassA
CreateDialogParamA
GetLastActivePopup
IsWindowEnabled
GetSubMenu
GetWindowTextA
OpenClipboard
EmptyClipboard
GetWindowDC
CloseClipboard
GetWindow
GetWindowTextLengthA
SystemParametersInfoA
CharNextA
WaitForInputIdle
EnumChildWindows
IsIconic
GetForegroundWindow
BringWindowToTop
PostThreadMessageA
EnumThreadWindows
GetClassNameA
GetWindowThreadProcessId
EnumDisplaySettingsA
PeekMessageA
TrackPopupMenu
keybd_event
GetClassLongA
DestroyIcon
FindWindowA
SetRect
DestroyCaret
CreateCaret
SetCaretPos
GetFocus
HideCaret
ShowCaret
GetAsyncKeyState
TabbedTextOutA
GetTabbedTextExtentA
TabbedTextOutW
GetTabbedTextExtentW
PtInRect
InflateRect
RedrawWindow
UpdateWindow
SetTimer
LoadIconA
DrawIconEx
KillTimer
EndDialog
SetForegroundWindow
SetActiveWindow
CopyRect
SendDlgItemMessageA
SetWindowPos
GetDC
ReleaseDC
GetMenuItemCount
GetMenuItemInfoA
InvalidateRgn
GetSysColor
CreatePopupMenu
AppendMenuA
SetClipboardData
CheckMenuItem
RemovePropA
GetPropA
SetPropA
GetDesktopWindow
LoadBitmapA
LoadMenuA
LoadStringA
GetSystemMetrics
GetClientRect
InvalidateRect
IsWindow
EndPaint
FillRect
BeginPaint
CallWindowProcA
SetFocus
PostMessageA
MoveWindow
GetScrollRange
GetScrollPos
SetScrollPos
DestroyWindow
DefWindowProcA
ShowWindow
ClientToScreen
GetCursorPos
SetCapture
OffsetRect
GetWindowRect
ReleaseCapture
IsWindowVisible
GetClipboardOwner
MapVirtualKeyA
GetClipboardData
GetActiveWindow
MessageBoxA
wvsprintfA
ScreenToClient
DeferWindowPos
EndDeferWindowPos
BeginDeferWindowPos
MessageBeep
GetClassInfoExA
wsprintfA
RegisterClassExA
CreateWindowExA
GetWindowLongA
SetWindowLongA
ChangeDisplaySettingsA
SendMessageA
SetClassLongA
SetCursor
LoadCursorA
SendMessageTimeoutA
GetMenu
EnableMenuItem
DrawMenuBar
EnumWindows
gdi32
GetClipBox
ExtTextOutW
GetTextExtentPointA
TextOutA
IntersectClipRect
GetRgnBox
ExtSelectClipRgn
SetRectRgn
CreateRectRgn
EnumFontFamiliesA
GetObjectType
DPtoLP
GetTextMetricsA
CreateBitmap
PatBlt
SetBkColor
GetStockObject
CreateCompatibleBitmap
SetTextColor
CreateFontIndirectA
TextOutW
Polygon
CreateEllipticRgn
CombineRgn
PtInRegion
Ellipse
CreatePolygonRgn
FillRgn
SetROP2
Polyline
SelectClipRgn
SetBkMode
Rectangle
LPtoDP
SetMapMode
SetStretchBltMode
SetBrushOrgEx
SetWindowExtEx
SetWindowOrgEx
SetViewportExtEx
SetViewportOrgEx
CreateDIBSection
GetCurrentObject
GetDIBits
GetDeviceCaps
CreateHalftonePalette
SelectPalette
RealizePalette
StretchDIBits
BitBlt
CreatePen
MoveToEx
LineTo
CreateSolidBrush
CreateCompatibleDC
SelectObject
StretchBlt
DeleteDC
GetObjectA
DeleteObject
SaveDC
ExcludeClipRect
RestoreDC
GetTextExtentPoint32A
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegCreateKeyExA
RegEnumValueA
RegQueryInfoKeyA
RegCreateKeyA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
RegSetValueExA
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHAppBarMessage
Shell_NotifyIconA
FindExecutableA
ShellExecuteExA
ExtractIconExA
imm32
ImmAssociateContext
atkbctl
KbInstallFocusControl
KbUninstallFocusControl
KbSetFocus
KbSetDialogFocus
atwbxui3
ord198
ord1059
ord1202
ord1209
ord1797
ord1256
ord1097
ord3
ord1121
ord1020
ord1042
ord1071
ord1208
ord111
ord206
ord456
ord1677
ord1395
ord1640
ord1636
ord1656
ord1681
ord94
ole32
CoCreateInstance
oleaut32
SysFreeString
SysAllocStringLen
comctl32
ord17
msvcrt
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
free
malloc
_except_handler3
memcpy
strlen
strcpy
memset
strcmp
_makepath
_splitpath
_purecall
fopen
fclose
fflush
fprintf
ctime
_ftime
fputc
fputs
strcat
abs
strchr
sprintf
_ftol
sqrt
memmove
wcslen
wcscpy
atoi
_stricmp
strstr
strrchr
strncmp
strncpy
_strdup
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_strupr
_strnicmp
memcmp
ATDeleteInstance
ATNewInstance
ApASEscape
ApActiveSharingApplication
ApAnnotationPrivilegeStatus
ApAnnounceNodeInfo
ApEnterAnnotation
ApEnumRunningApplications
ApFullScreen
ApGetOnlineRecordingStatus
ApGetSharingApplicationList
ApGpcExitInstance
ApGpcInitInstance
ApIsAnnotationOpen
ApIsApplicationShared
ApIsFullScreen
ApLeaveAnnotation
ApOnlineWebExRecord
ApOnlineWebExRecordStop
ApPreLeave
ApPrepareQuit
ApQuitAppLeaveRecord
ApRAGetLastActiveTick
ApRASettings
ApRemoteControlPrivilegeStatus
ApRemoteShareApplication
ApRemoveAnnotationPrivilege
ApRemoveRemoteControlPrivilege
ApSelectColorSet
ApSessionEnroll2
ApSetAnnotationPrivilegeTo
ApSetAppsharingParameter
ApSetControlTo
ApSetHost
ApSetHwndforBacktoMeeting
ApSetMeetingType
ApSetPresenter
ApSetRemoteControlPrivilegeTo
ApSetSessionCtrlInfo
ApShareApplication
ApShareProgram
ApShareShortcut
ApStartShareApplication
ApStartShareApplicationWithoutDelay
ApStopShareApplication
ApSwitchApplication
ApSwitchCmdSet
ApWOTAutoPlay
ApWOTCallWebExPlayer
ApWOTCallWebExRecorder
ApWOTSaveRecordStatus
ApWebExPlayback
ApWebExRecord
ApWebExRecordOptions
AsAdjustPrivilege
AsAssignAnnotation
AsAssignRemoteControl
AsChangeScreenResolution
AsClearAnnotation
AsEmulateKeyStrike
AsEnterAnnotation
AsGetAnnotationPalette
AsGetAnnotationTool
AsGetCurrentAnnotationColor
AsGetInternalUserList
AsGetRunningState
AsGetShareMode
AsGetUserInfo
AsInterIOControl
AsIsAnnotationMode
AsIsAnnotationObjectExist
AsIsRemoteController
AsLeaveAnnotation
AsNodeIDToUserID
AsPause
AsQuit
AsRefresh
AsRegisterServiceInfo
AsResume
AsSendControlCommand
AsSetAnnotationTool
AsSetCurrentAnnotationColor
AsSetLogoState
AsSetShareMode
AsSetViewMode
ServerSideRecordingStatus
SetARMPath
SetServerSideRecordingProvider
Name
.text
Size
252KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
32KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=2, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=4, id=19, version=8022,
count=6, productName=Unmarked objects (old),
count=424, id=1, productName=Unmarked objects,
count=15, id=19, version=8034,
count=28, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atasnt40.dll
- IMPHASH 39e5abba5ebff1ee6d2308e48374dd16
- SHA256 c946d87da5928394923d7956b960174574f4409595f93e98d9bd4fbd4b958628
- MD5 a5164a8051c481126a165f340eee7379
- SHA1 900b8fb216a2fcd5779b058e8d7e1522a67eaba1
- SHA512 3c30f91ffa612107c6598e2aad5f3ca419a5e2ae9e42ab56f974c72a04aafc416cde792492eb5cd0e7ea6d89b239b3b583e8d26286a827242a0cbe736748ba45
- SSDEEP 3072:tR3fCJmlJN+rBRslrRiq3EluVt9LvNHzphypOCFNK2:e2JN+rB8RF/xvNT+pOY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121466
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ExpandEnvironmentStringsA
WriteProfileStringA
GetProfileStringA
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetSystemDirectoryA
DeleteCriticalSection
GetACP
ReadFile
GlobalGetAtomNameA
InterlockedExchange
EnterCriticalSection
OutputDebugStringA
GetDateFormatA
GetTimeFormatA
Sleep
GetPrivateProfileIntA
GetPrivateProfileStringA
DeleteFileA
lstrcatA
CopyFileA
GetModuleFileNameW
lstrlenA
lstrcpyA
TryEnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
IsBadCodePtr
VirtualLock
VirtualUnlock
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleW
VirtualAlloc
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
LoadLibraryA
FreeLibrary
CreateFileA
WriteFile
GetTempPathA
GetLocalTime
lstrcmpA
GetVersion
GetCurrentProcess
OpenProcess
SetPriorityClass
CloseHandle
lstrcmpiA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetProcessVersion
GetLastError
IsBadReadPtr
GetTickCount
GetCurrentThread
GetThreadPriority
GetModuleHandleA
GetVersionExA
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
SetThreadPriority
InitializeCriticalSection
user32
GetWindowLongW
SystemParametersInfoA
SetRect
WaitMessage
MsgWaitForMultipleObjects
GetThreadDesktop
OpenInputDesktop
SetThreadDesktop
CloseDesktop
InflateRect
LoadBitmapA
LoadStringA
MessageBoxA
GetIconInfo
GetWindowTextA
DrawTextA
GetPropA
wsprintfA
RegisterClassA
ChildWindowFromPointEx
SetCursorPos
GetMessageExtraInfo
LoadCursorA
RegisterClassExA
EnumDisplaySettingsA
CreateWindowExA
MoveWindow
SetWindowLongA
InvalidateRect
SetActiveWindow
BeginPaint
EndPaint
ClientToScreen
SetCapture
ClipCursor
OffsetRect
ReleaseCapture
DefWindowProcA
PostThreadMessageA
GetFocus
WindowFromPoint
EnumChildWindows
CallNextHookEx
IsWindow
CallWindowProcA
PtInRect
GetClientRect
EqualRect
GetForegroundWindow
CopyRect
IntersectRect
PeekMessageA
GetDC
wvsprintfA
SendMessageA
GetWindow
GetWindowRect
IsRectEmpty
GetWindowRgn
GetWindowDC
ReleaseDC
WindowFromDC
GetWindowLongA
GetClassNameA
GetCursor
GetSystemMetrics
GetCursorPos
UnhookWindowsHookEx
SendNotifyMessageA
DestroyWindow
EnumWindows
RedrawWindow
GetWindowThreadProcessId
FindWindowA
GetDesktopWindow
GetParent
SetWindowsHookExA
KillTimer
SetTimer
RegisterWindowMessageA
GetLastActivePopup
IsIconic
ShowWindow
IsWindowVisible
PostMessageA
SendMessageTimeoutA
UnregisterClassA
ShowCursor
gdi32
GetRgnBox
GetDCOrgEx
GetNearestColor
GetPaletteEntries
GetBitmapBits
CreateDIBSection
CreateDCA
DescribePixelFormat
GetPixelFormat
PatBlt
GetTextExtentPoint32A
SetBkMode
Rectangle
GetArcDirection
PtInRegion
GetPolyFillMode
GetPath
CreateBrushIndirect
FillRgn
GetGraphicsMode
GetTextMetricsA
GetTextMetricsW
GetTextCharacterExtra
GetTextAlign
GetTextExtentPoint32W
CreateFontIndirectA
GetCurrentPositionEx
GetBkMode
GetROP2
IntersectClipRect
SetDIBits
GetBoundsRect
SetBoundsRect
GetStretchBltMode
GetRegionData
DeleteObject
CreateRectRgn
OffsetRgn
CreateRectRgnIndirect
CombineRgn
EqualRgn
CreateSolidBrush
SetStretchBltMode
CreateCompatibleDC
BitBlt
GetDeviceCaps
GetObjectType
DeleteDC
GetBrushOrgEx
GetDIBits
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
GetViewportOrgEx
SetWindowOrgEx
GetWindowOrgEx
SetMapMode
SetBkColor
SaveDC
RestoreDC
GetCurrentObject
GetObjectA
GetMapMode
GetWindowExtEx
GetViewportExtEx
LPtoDP
DPtoLP
RectInRegion
SelectClipRgn
GetStockObject
GetSystemPaletteEntries
CreatePalette
SelectPalette
RealizePalette
CreateBitmap
CreateCompatibleBitmap
GetTextColor
SetTextColor
GetBkColor
SelectObject
advapi32
RegCreateKeyA
CreateServiceA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ControlService
StartServiceA
RegQueryValueExA
RegSetValueExA
RegFlushKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegCloseKey
RegOpenKeyA
msvcrt
_wcsupr
memset
memcpy
memmove
strcpy
??3@YAXPAX@Z
malloc
free
strlen
sprintf
strcat
fprintf
_purecall
abs
memcmp
_makepath
_splitpath
wcsstr
fflush
fwrite
fopen
fclose
??2@YAPAXI@Z
wcslen
wcscpy
_strnicmp
strstr
__dllonexit
_onexit
_initterm
_adjust_fdiv
_strcmpi
_wcsicmp
AppsEnterSpecialWinMode
AppsEscape
AppsFreeDLL
AppsGetSharingAppCount
AppsIsShared
AppsRecordHostedWindow
AppsRetrieveData
AppsSessionEnd
AppsSessionStart
AppsSetCollaborate
AppsTellDeviceCaps
Name
.text
Size
115KB
Virtual Size
114KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=297, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=16, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/ataudio.dll
- IMPHASH 5f02925649795d538ae47a912dba42e2
- SHA256 2aa5fae9597bf75497683f49d28df0763bf143b125346ffec2ef7c00a63bb095
- MD5 d482ae16356a021f42245cab8f8d2ac7
- SHA1 060d656d9210e99f2bf0117c0766b667b1db4b0d
- SHA512 ea5b339ad99f4d9182b1dca09288e53c09cbb828584f304f7fb29ef4207a0ed3d2e497b80f46cc00d9f4e602d0ce09f11a75790d8ee178f2879a7d101e5063c7
- SSDEEP 3072:K7Y5AP1tkLNxvSspA5JkgmynC1f7aDlXkuHzLk0vR0oo0Y4:v5K1tkLlXGnDlXkuHzo0pO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
137229
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MulDiv
GetSystemDefaultLangID
InterlockedExchange
SetCurrentDirectoryA
lstrcpynA
InterlockedIncrement
InterlockedDecrement
FlushInstructionCache
GetCurrentProcess
FindResourceA
LocalAlloc
UnmapViewOfFile
OpenFileMappingA
MapViewOfFile
CreateFileMappingA
ResetEvent
SetEvent
CreateEventA
GetVersion
LocalFree
GetCurrentThread
SetThreadPriority
WaitForSingleObject
GetExitCodeThread
TerminateThread
CloseHandle
GetLastError
GetModuleHandleA
Sleep
GetTickCount
DisableThreadLibraryCalls
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
GetModuleFileNameA
lstrlenA
lstrcpyA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
FreeLibrary
LoadLibraryA
user32
SetTimer
DialogBoxParamA
IsChild
GetMessageA
SetActiveWindow
ShowWindow
LoadIconA
GetDesktopWindow
EndPaint
PostQuitMessage
EnableWindow
DrawTextA
GetSysColor
BeginPaint
DefWindowProcA
InvalidateRect
ReleaseDC
SetWindowRgn
GetClassInfoExA
LoadCursorA
wsprintfA
PeekMessageA
PostThreadMessageA
CreateWindowExA
SetWindowLongA
GetWindowLongA
RegisterClassExA
EndDialog
KillTimer
LoadBitmapA
TranslateMessage
SetWindowTextA
DispatchMessageA
FillRect
FrameRect
IsWindow
GetSystemMetrics
OffsetRect
GetCursorPos
GetClientRect
GetWindowRect
LoadStringA
CallWindowProcA
GetActiveWindow
DestroyWindow
GetWindow
GetDlgItem
SendMessageA
SetWindowPos
SendNotifyMessageA
WindowFromPoint
GetDC
gdi32
GetObjectA
CreateCompatibleDC
LineTo
MoveToEx
CreatePen
BitBlt
GetTextExtentPoint32A
TextOutA
CreateSolidBrush
SetTextColor
DeleteDC
SelectObject
SetBkColor
SetBkMode
GetStockObject
Rectangle
DeleteObject
CreateRoundRectRgn
CreateFontA
winmm
waveOutWrite
waveOutClose
waveOutReset
waveInOpen
waveInStart
waveOutUnprepareHeader
waveInAddBuffer
waveInClose
waveInReset
waveOutPrepareHeader
waveInPrepareHeader
waveInUnprepareHeader
mixerGetID
mmioOpenA
mmioStringToFOURCCA
mmioDescend
mmioRead
mmioClose
mmioAscend
mixerGetLineControlsA
mixerGetControlDetailsA
mixerSetControlDetails
mixerGetDevCapsA
mixerGetLineInfoA
waveInGetNumDevs
waveInGetDevCapsA
waveOutGetNumDevs
waveOutGetDevCapsA
mixerGetNumDevs
mixerOpen
mixerClose
waveOutOpen
advapi32
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey
atwbxui3
ord1679
ord3
ord1097
ord1059
ord1202
ord1209
ord1797
ord1256
ord1677
ord1636
ord1642
ord1407
ord1409
ord1464
ord198
ord196
ord217
ord237
ord133
ord90
ord94
ord102
ord173
dsound
ord7
ord2
msvcrt
_itoa
vsprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
memcpy
free
strcpy
strcmp
_ftol
_purecall
_beginthreadex
strstr
atoi
sprintf
_beginthread
strrchr
_endthread
strlen
malloc
log10
_initterm
_adjust_fdiv
msvcp60
??_F?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
ATCloseAudio
ATConvertWRAToPCM
ATEditSetCodecProperty
ATGetAudioDeviceInfo
ATGetCodecInfo
ATGetMapHandle
ATGetVolume
ATInitAudio
ATIsInstanceHere
ATPlay
ATPlayAdjustQueueTime
ATPlayEx
ATPlayExEx
ATPlayPause
ATPlaySetCodecProperty
ATPlayStop
ATRecPause
ATRecStart
ATRecStop
ATRecordAudioCloseSetting
ATRecordAudioRunSetting
ATRecordAudioRunSetupWizard
ATRecorderGetCodecProperty
ATRecorderGetFrameSize
ATReleaseMem
ATSetAudioNeedFlag
ATSetMapFlag
Name
.text
Size
132KB
Virtual Size
130KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=4, id=4, version=8047,
count=2, id=25, version=9210,
count=14, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, productName=Unmarked objects (old),
count=6, id=19, version=8022,
count=13, id=19, version=8034,
count=220, id=1, productName=Unmarked objects,
count=33, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=3, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atauthor.exe
- IMPHASH f41df666b6daca4201a99abd2f45a1b0
- SHA256 61efac1dd3f13fbb7bdaba66b1c0bb3c9af5bc92591eaadfcef1bb3dcbc452c1
- MD5 cbc6e32f9a8af08c98900d785cb11a01
- SHA1 e2f7f1cfa43b3d19252ec6251fc32d234aa6b893
- SHA512 40e17cf072b6b968f9e0464304bfced44aee5d8574e0afcd2063cd626ebe37b16e47b52c859bd0287b4c3515ff3eb9ff3335b34f7f93926e69036ea48f438804
- SSDEEP 768:Am8HSB+ixUch+DLA2UdqzdVf1bpof3dwvYV6XbuHAbuHSdbhHc7TxL3JbeC:5+CU7HAIbsdSYVMbTb1bh87NV
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US
Serial Number
0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2008
Subject
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Serial Number
41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Jul 16, 2004 - Jul 15, 2014
Subject
CN=WebEx Communications Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Engineering,O=WebEx Communications Inc.,L=Santa Clara,ST=California,C=US
Serial Number
15:75:9a:ef:5b:8a:e7:ef:58:67:5a:32:c4:e8:99:e7
Issuer
CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 24, 2006 - Apr 7, 2009
Minor OS version
0
Major OS version
4
Entry point
15126
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpynA
DeleteFileA
MultiByteToWideChar
RemoveDirectoryA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
FreeLibrary
LoadLibraryA
GetProcAddress
GlobalDeleteAtom
GlobalGetAtomNameA
CloseHandle
OpenMutexA
Sleep
GetFileAttributesA
WriteFile
CreateFileA
GetSystemDirectoryA
LockResource
SizeofResource
LoadResource
FindResourceA
AreFileApisANSI
GetFullPathNameA
GetStartupInfoA
GetModuleHandleA
GetModuleFileNameA
lstrcatA
lstrlenA
lstrcpyA
GetCommandLineA
WaitForSingleObject
lstrcmpiA
user32
DispatchMessageA
LoadStringA
wsprintfA
MessageBoxA
GetMessageA
TranslateMessage
SetWindowTextA
GetClientRect
LoadIconA
PostMessageA
KillTimer
DestroyWindow
PostQuitMessage
DefWindowProcA
SetTimer
LoadCursorA
RegisterClassA
CreateWindowExA
advapi32
RegQueryValueExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
shell32
SHGetSpecialFolderLocation
SHChangeNotify
ShellExecuteExA
SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListA
ole32
OleUninitialize
CoInitialize
CoCreateInstance
CoUninitialize
OleInitialize
shlwapi
SHDeleteKeyA
msvcrt
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_onexit
__dllonexit
strcmp
_splitpath
_strupr
_makepath
strcpy
strrchr
memset
strlen
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_adjust_fdiv
??2@YAPAXI@Z
strstr
??3@YAXPAX@Z
strchr
WOTAssocation
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=11, id=10, version=8047,
count=1, id=14, version=7299,
count=2, id=4, version=8047,
count=3, id=19, version=8022,
count=6, productName=Unmarked objects (old),
count=11, id=19, version=8034,
count=111, id=1, productName=Unmarked objects,
count=3, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atinet.dll
- IMPHASH cb5373b7854032b02af4663bf975492e
- SHA256 fcaf3cacd43c567f793aefd60f67915381af7401662b500d60c07f08d636d18b
- MD5 eab06f7bf49098521e917fcdf81d3ec4
- SHA1 f4a1695f974203947576131afcb49e0066b47f8a
- SHA512 b529c6263f4f0d9dc04c736d0534bf709d2edf2d9fb4dc5a09a798e734010b59dd05e3a5daec0bdab05b9b96839fe29433da0f3dc12f9a848663bd54e721edbd
- SSDEEP 192:U6aB0Wdsm1xx5mJ4RtRKgP2rIg77d5UNwyyk4:UlC2ggRKgPWIw7PUtz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9503
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcAddress
LoadLibraryA
GetModuleHandleA
FreeLibrary
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
CreateSemaphoreA
CreateEventA
CloseHandle
WaitForSingleObject
SetEvent
lstrcatA
lstrcpyA
lstrcmpiA
ReleaseSemaphore
WaitForMultipleObjects
ResetEvent
SetLastError
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
lstrlenA
user32
wsprintfA
RegisterWindowMessageA
IsWindow
GetWindowThreadProcessId
GetPropA
GetParent
SendMessageA
msvcrt
_adjust_fdiv
malloc
_initterm
??2@YAPAXI@Z
memcpy
??3@YAXPAX@Z
_purecall
memcmp
memset
free
_HttpAddRequestHeadersA@16
_HttpOpenRequestA@32
_HttpQueryInfoA@20
_HttpSendRequestA@20
_InternetCloseHandle@4
_InternetConnectA@32
_InternetCrack@4
_InternetEnableWinINET@0
_InternetInitialize@8
_InternetOpenA@20
_InternetQueryDataAvailable@16
_InternetReadFile@16
_InternetSetOptionA@16
_InternetSetStatusCallback@8
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
564B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=5, id=19, version=8034,
count=46, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atjpeg60.dll
- IMPHASH 83fe5294b6e5eb78cbda216e0e5325fa
- SHA256 1a45932e2f842ed2f2d464e79ead58c1a1fc7deb6085f0b67b8d323d80aadb6b
- MD5 a6b21c5b5db9d84e0aa792469e373588
- SHA1 1847d8abe87227624f424b99881bff0705d588c7
- SHA512 59e9066f1d170a696fc001e828ef34e34d931b76df07da1242d85b20e5adf9ac260f8b5b6f276479f51ac01a9f1fa005b19e6c780111b9c47e612ea96411e92f
- SSDEEP 1536:4SZdbHrruFq2cdnx0SUeesU3F3xoeZLD8giKKla/5fDJ1539Fr7+I9:4k9Hrruk10SUlsU3sRKKla/5T539FrB9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
73040
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
fclose
_ftol
exit
sprintf
sscanf
fopen
memcpy
free
_initterm
_adjust_fdiv
fflush
fwrite
getenv
memset
malloc
kernel32
DisableThreadLibraryCalls
GlobalAlloc
GlobalFree
GetVersion
jpeg_calc_output_dimensions
jpeg_close_file
jpeg_consume_input
jpeg_create_compress
jpeg_create_decompress
jpeg_destroy_compress
jpeg_destroy_decompress
jpeg_file_dest
jpeg_finish_compress
jpeg_finish_decompress
jpeg_finish_output
jpeg_has_multiple_scans
jpeg_read_header
jpeg_read_scanlines
jpeg_resync_to_restart
jpeg_set_defaults
jpeg_set_marker_processor
jpeg_set_quality
jpeg_start_compress
jpeg_start_decompress
jpeg_start_output
jpeg_std_error
jpeg_stdio_dest
jpeg_write_scanlines
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
474B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
WebEx/atkbctl.dll
- IMPHASH 7a3f89d8b6f5b7d017d6cc527c8be5c5
- SHA256 2c1214f6612611656b65b14f9505c68d6835272d5b2de374474592c4720f266a
- MD5 120fbc0bb16a0a9200e400f54c1f20b8
- SHA1 3d064165d6228acf83afc8c88be9e6901e88d65e
- SHA512 31e607f6e4717a9f20d116c0a91874d90ddc81159482e44bbe577d1c42580ca4df5b2728c9c28bdb0e264709179f6c7da185791c414c73809803189653b9c7d2
- SSDEEP 48:a70gxYAokXz+NLB/6U03yQtXynZiZpiXON88fsslV0zONZG+VlgAc16rUcsnIevP:Kx4LUNXyCoON88fRAzONZGERcd2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5002
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
TlsGetValue
TlsSetValue
GetCurrentThreadId
TlsFree
TlsAlloc
user32
UnhookWindowsHookEx
MessageBeep
CallNextHookEx
SetActiveWindow
IsWindow
IsDialogMessageA
GetWindowLongA
GetParent
SetWindowsHookExA
msvcrt
_adjust_fdiv
malloc
_initterm
free
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
KbGetFocus
KbInstallFocusControl
KbSetDialogFocus
KbSetEnvironment
KbSetFocus
KbUninstallFocusControl
Name
.text
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
950B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
960B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=25, id=1, productName=Unmarked objects,
count=5, id=19, version=8034,
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atmdctl.dll
- IMPHASH 9acc17ee23088cf14d1dea78bd2e59e7
- SHA256 71e80b508bb5c98bc48739889b8366bfc9e76638ea78df95c1053729ae60cd11
- MD5 5e1f53937a40a56d492211c5b0cfd762
- SHA1 7e88ddffcf37ae437fbc8d4a52e7f373d0108f33
- SHA512 c2648819af6d2f3d26bbd5a805ad570cf4347202a783fc8f24c19f8de595ea38eb859d418cc27c8cff8ea6a285bd2d0f85bb79a09989d1f4bc3f7e0d20f29474
- SSDEEP 384:XuZZ9Y+C3SI87oW4AdAC3O0l4IH811Nk/9MCBBH:X6Z9Yh3SPvAC+4Wvk/9bBx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
21603
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetFilePointer
CloseHandle
CreateFileA
GetTimeFormatA
GetDateFormatA
DeleteFileA
SetEndOfFile
WriteFile
GetTempPathA
ReadFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
GetLastError
GetFileAttributesA
CreateDirectoryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
FreeLibrary
GetCurrentThreadId
GetModuleFileNameA
LoadLibraryA
GetProcAddress
GetTempFileNameA
user32
wsprintfA
wvsprintfA
PostMessageA
DestroyWindow
gdi32
GetDIBits
GetObjectA
DeleteDC
SelectObject
CreateCompatibleDC
msvcrt
strrchr
_adjust_fdiv
_initterm
_onexit
__dllonexit
??3@YAXPAX@Z
strcpy
memset
??2@YAPAXI@Z
memcpy
__CxxFrameHandler
free
abs
_itoa
strlen
strcat
_purecall
malloc
_makepath
_splitpath
sprintf
MDDeleteInstance
MDNewInstance
Name
.text
Size
20KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=1, id=11, version=8047,
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=19, version=8022,
count=68, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=6, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atnetext.dll
- IMPHASH dd355eed42675e22ad8fcb07c46731c7
- SHA256 7cfb907d3bb1e9a2f5793f3274c4bc3b0a893a3d51649bc239f9269ca11a9464
- MD5 27a92552723bdc1c1a216c1d1ac83deb
- SHA1 9b7def3937fde108da64b6f91d08403a55598cec
- SHA512 ab972435cea0d4f5fb5e8d94e8f9d07065fc71ca40955760212fbb7c637f5cb07dc33cd9bdee6a1914f900d3fb2d3aebb090f4a444825059ea0625662e856158
- SSDEEP 768:AHQlQwtYw2SULog4wIAY6ZRxmFNWPhIyQkAMD:Oe/2wK+ID
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14413
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetCurrentProcess
GetCurrentThreadId
VirtualProtect
VirtualQuery
FlushInstructionCache
VirtualFree
GetProcAddress
GetModuleHandleA
GetLocalTime
lstrcpyA
lstrlenA
VirtualAlloc
lstrcatA
user32
wsprintfA
advapi32
RegCloseKey
RegCreateKeyA
RegOpenKeyExA
RegQueryValueExA
wsock32
inet_addr
ntohs
msvcrt
_adjust_fdiv
malloc
_initterm
free
_vsnprintf
isprint
memset
??3@YAXPAX@Z
memcpy
??2@YAPAXI@Z
strlen
strstr
atoi
strcpy
strcat
sprintf
abs
strchr
__dllonexit
_onexit
NSpyCalcInstructionBoundary
NSpyGetLogData
NSpyGetLogDataLength
NSpyGetVersion
NSpyIsPluginPatchEnabled
NSpySetPluginVersion
NSpySetSocketContext
NSpyStart
NSpyStop
Name
.text
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
36KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
856B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=40, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atnt40k.sys
- IMPHASH 8dd8195d5c51322d76fc009cd5a32157
- SHA256 e8da71f4932ea83d19b7c2acc02938870047e9f567a8fe0e845d8e561fed5e64
- MD5 a9a124c15b5f2fe1ffd1ea238bd5aeed
- SHA1 916f1730d7a6fc930eb32a1043f2ecfc24f24f51
- SHA512 38475d73b87c08f567e46bb4cd7a8a8849314894de2a131864a3e8add012121758defa43699a56b96155136e6ddd08659d769e226d9211c6cc0cecb05251b50f
- SSDEEP 768:r8X5h88+8hIzpRX4bxZ9TTXWkD5hYZQqpgzj+UGZ:r8ph8DjUxZlKkD7YZmQZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntoskrnl.exe
RtlInitUnicodeString
IofCompleteRequest
IoDeleteSymbolicLink
memmove
ProbeForWrite
PsGetVersion
IoFreeMdl
MmUnlockPages
MmUnmapLockedPages
MmMapLockedPages
MmProbeAndLockPages
IoAllocateMdl
DbgPrint
PsGetCurrentProcessId
MmGetPhysicalAddress
IoCreateDevice
ExFreePool
ExAllocatePoolWithTag
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
KeTickCount
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwClose
RtlFreeUnicodeString
ZwCreateSection
ZwCreateFile
RtlAnsiStringToUnicodeString
RtlInitAnsiString
sprintf
IoCreateSymbolicLink
IoDeleteDevice
MmIsAddressValid
KeInitializeEvent
hal
ExReleaseFastMutex
KeGetCurrentIrql
ExAcquireFastMutex
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
INIT
Size
992B
Virtual Size
962B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, productName=Unmarked objects (old),
count=1, id=10, productName=VS98 (6.0) build 8168, version=8168,
WebEx/atpack.dll
- IMPHASH 7c83bc45b3cb6a6882f5e88a7c2d5f54
- SHA256 2ef0163bc6b08f2d5e7e714031399415fefa27e07a7dce806c698fdfb03114ab
- MD5 18f21dde685aa5fb750eebeb4b812354
- SHA1 4702426cc0b68bcea3053e8ceb7f180dca6b1eea
- SHA512 16af43cce95bb8a84374ce0adb9d4b8bbd27d2c53a3f98d0ff193017e349cb1cfddb23c147809b894131623efbb0093f575e3b1fa193628c3201ebb2ffbfd5f1
- SSDEEP 384:vpHSketBJsckx+7n5PYjWa5vtZoC8JJHslrw9NYv9uwHOS:vpHfetBJsjSn2Wa5vtZQJMlYS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18849
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_setjmp3
longjmp
malloc
free
fprintf
_iob
_errno
memmove
_pctype
__mb_cur_max
_isctype
_initterm
_adjust_fdiv
Compress
Decompress
strlwr
Name
.text
Size
16KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
428B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
320KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=3, id=4, version=8047,
count=19, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=9, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atpng.dll
- IMPHASH ac32296004c20b034b182bde907ea93d
- SHA256 5f5b514fdef937af4c558752e87088c5427f49f33a843ddb927300876df293d4
- MD5 ad4f7bc2633a364b8d2bc572292fc634
- SHA1 831e0276ae86c3ba8e52dcb74b118c5ab820fac1
- SHA512 e8c8c0f498bbdccdd176d1047aeed902d394ccdcfc1bfd54996d9278d03a89a7d5cd012366c89283d0ec00a1680c9b7d131954fd6fc29f642e71dde2e83b2bb9
- SSDEEP 3072:Gjt6IyJK7rhbL9qwnwqNGoXnYn4ywm5zJMlV:GqsFq2jI1wm5zJM3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
98161
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
ReadFile
GetFileSize
CreateFileA
CloseHandle
gdi32
CreateCompatibleDC
BitBlt
DeleteObject
SelectObject
DeleteDC
CreateDIBSection
msvcrt
_iob
_adjust_fdiv
_initterm
__CxxFrameHandler
??3@YAXPAX@Z
free
malloc
memcpy
memset
_ftol
strncpy
floor
_CxxThrowException
strcpy
fclose
fopen
_purecall
fread
fwrite
fseek
ftell
fflush
fputc
getc
calloc
abs
longjmp
strcmp
??2@YAPAXI@Z
_setjmp3
__CxxLongjmpUnwind
sin
cos
acos
strlen
realloc
abort
sprintf
memcmp
fabs
pow
fprintf
strtod
??1type_info@@UAE@XZ
ConverBmpToPng
IsPngTransparent
Png12Draw
Name
.text
Size
96KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=1, id=11, version=8047,
count=1, id=12, version=7291,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=84, id=1, productName=Unmarked objects,
count=7, id=19, version=8034,
count=27, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=11, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atrecply.dll
- IMPHASH 721a13d693acfc654429af9a7f60c1dd
- SHA256 93aa3ee26aa271e83969f7b90efcdac93c139f802bd7f51624b72664f82993a2
- MD5 ca2f07ef3534f9d3d6fe34a4372bf4fa
- SHA1 203e200df46f1bb81452727b42b65f107e7a0c15
- SHA512 f32f9723adc352d3a85bad6996d25367c5be6e2f4c607eab575becc11e17ee5ef2b01a267e323e68b0a7e8bc2fc8282ba8b8c62586df025836348bc13a43b992
- SSDEEP 6144:+asmtF3h6BxS/2bWqllJ5pOjoqWlNE/7Z0wJzUkrGRkkXpT:R53h0xS/2bWqllLpOjoTAt0w1U4Gma
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
331315
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetVersion
FlushFileBuffers
FormatMessageA
MoveFileA
ReleaseMutex
WaitForSingleObject
GetLocalTime
FindFirstFileA
FindClose
SetFileAttributesA
TerminateThread
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetProcAddress
GetDiskFreeSpaceA
GetAtomNameA
DeleteAtom
AddAtomA
CreateThread
GetTickCount
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
OpenMutexA
CreateMutexA
GetModuleFileNameA
lstrcpynA
lstrcatA
LoadLibraryA
FreeLibrary
GetVersionExA
WriteFile
CreateFileMappingA
lstrcpyA
lstrlenA
DeleteFileA
CopyFileA
GetTempFileNameA
LocalAlloc
LocalFree
CreateFileA
ReadFile
CloseHandle
GetLastError
GetTempPathA
GlobalAlloc
GlobalLock
GlobalUnlock
GetFileSize
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
user32
SetWindowPos
EnableWindow
WindowFromDC
GetWindowDC
SetFocus
UnregisterHotKey
MessageBeep
IsWindowVisible
ShowWindow
IsIconic
SetForegroundWindow
FindWindowA
PostMessageA
wvsprintfA
RegisterClassA
CreateWindowExA
CallWindowProcA
SetWindowLongA
GetParent
InflateRect
ReleaseDC
GetDC
MessageBoxA
SendMessageA
SetActiveWindow
SetCapture
IsWindowEnabled
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
EndPaint
BeginPaint
MapWindowPoints
ScreenToClient
GetClientRect
GetWindowLongA
DefWindowProcA
PtInRect
DrawTextA
GetCursorPos
GetKeyState
ReleaseCapture
FillRect
GetSystemMetrics
SetCursor
CopyRect
SetRectEmpty
DestroyWindow
LoadMenuA
LoadCursorA
LoadBitmapA
LoadStringA
IsWindow
wsprintfA
IsClipboardFormatAvailable
GetClipboardData
RegisterClipboardFormatA
GetActiveWindow
OpenClipboard
SetClipboardData
CloseClipboard
RegisterHotKey
gdi32
SetBrushOrgEx
StretchBlt
IntersectClipRect
SaveDC
RestoreDC
CreateRectRgn
GetObjectType
GetClipRgn
SelectClipRgn
SetBkMode
SetStretchBltMode
Polygon
CreateFontA
CreateSolidBrush
DeleteObject
LineTo
MoveToEx
SelectObject
CreatePen
Arc
CreatePatternBrush
CreateBitmap
DeleteDC
BitBlt
SetBkColor
SetTextColor
PatBlt
CreateCompatibleDC
GetBkColor
GetTextColor
SetWindowExtEx
GetWindowExtEx
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
CreateDIBitmap
GetCurrentObject
GetObjectA
CreatePalette
CreateDIBSection
RealizePalette
SelectPalette
CreateHalftonePalette
StretchDIBits
GetDeviceCaps
GetDIBits
SetViewportOrgEx
GetStockObject
SetPixel
advapi32
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
comdlg32
GetSaveFileNameA
GetOpenFileNameA
ole32
OleInitialize
comctl32
ImageList_Draw
ImageList_GetIconSize
msvcrt
_strcmpi
abs
??3@YAXPAX@Z
??2@YAPAXI@Z
memset
memcpy
memmove
strcat
_except_handler3
strcpy
strncpy
strrchr
strlen
_local_unwind2
realloc
free
memcmp
strstr
tolower
_ftol
_strupr
_makepath
_splitpath
fwrite
fclose
fopen
fread
ftell
fseek
strcmp
fprintf
sprintf
sscanf
__CxxFrameHandler
__dllonexit
_onexit
_initterm
_adjust_fdiv
_stricmp
malloc
WOTInitPlayer
WOTInitRecorder
WOTKillPlayer
WOTKillRecorder
Name
.text
Size
320KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=4, productName=Unmarked objects (old),
count=3, id=19, version=8022,
count=224, id=1, productName=Unmarked objects,
count=13, id=19, version=8034,
count=3, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=37, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atres.dll
- IMPHASH e07e00e45407ff0dd6abc9eaa981fa7b
- SHA256 a1fe6920145197cfe4b6dcb05f80a0510791de08854c3e18304b41c0f38e8fcf
- MD5 f15cdfb0f93f30764e8a735f0040d4c5
- SHA1 959f3ddc06cd111728b46d7f741caf19bc65695c
- SHA512 ab1176be34fbd5ec21bc7b197903071534ed48a7accaa98a55c0aa1e7e5f215c323495ea6bab80b87f7b11124ef4f367d01050dc0ec09eee3299b16791d80336
- SSDEEP 49152:wR9yQm1QIKOrfmzhJYM8AbMV7777/7w1k:wR9yQm1QIKOrfmzhJYM8Ab
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4273
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
msvcrt
_initterm
malloc
_adjust_fdiv
free
Name
.text
Size
4KB
Virtual Size
340B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
138B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.6MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=10, version=8047,
count=6, id=1, productName=Unmarked objects,
count=3, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
WebEx/atrpui.dll
- IMPHASH bb1b74d06454f114672556ae5221a749
- SHA256 dfd86aecf5be8cbb215f34f03c458d4df393fa2fd665f6ae6a2f32d0227a5044
- MD5 c3b8e22abe848b3ef7cd7ae357f9d80f
- SHA1 50507fe88d7035978e959946cf63ceb3cfe8c3b0
- SHA512 f509622dfedfbc1408113d8bca922ed026439f154923724acb34987e512f3878dd811903c136bf59bf246ec50433d7a496ffda340ef8191bc31d7748c3de0929
- SSDEEP 3072:QYYIw9MBRA4Z6zemovmBzQR4ID3DnlMrUUDRZndOMuDTaAwI/KEhmF0GtyS:Pwxzavi0RrTnlMwOROMuqLwKESry
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
175729
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MulDiv
LocalAlloc
LocalFree
GetCurrentDirectoryA
GetFileAttributesA
CreateDirectoryA
InitializeCriticalSection
DisableThreadLibraryCalls
DeleteCriticalSection
HeapDestroy
GlobalGetAtomNameA
GlobalDeleteAtom
GetSystemDefaultLangID
lstrcmpiA
CompareStringA
WinExec
FindFirstFileA
FindClose
GetExitCodeProcess
TerminateProcess
CreateFileA
GetFileSize
CloseHandle
GetModuleFileNameA
lstrcpynA
lstrcatA
lstrlenA
lstrcpyA
GetCurrentProcess
FlushInstructionCache
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetTickCount
FreeLibrary
user32
FindWindowA
DeleteMenu
SetPropA
EndDialog
MessageBoxA
RegisterClassA
DrawIconEx
GetDesktopWindow
ModifyMenuA
SetClassLongA
GetSysColorBrush
SetFocus
IsDlgButtonChecked
LoadIconA
SetDlgItemTextA
SendDlgItemMessageA
GetWindow
SystemParametersInfoA
GetDlgItemTextA
SetParent
SetWindowTextA
BringWindowToTop
LoadMenuA
LoadStringA
FrameRect
GetSystemMetrics
OffsetRect
GetWindowRect
PostMessageA
DestroyWindow
WindowFromPoint
GetSysColor
SetWindowPos
IsWindowVisible
GetWindowTextLengthA
IsRectEmpty
GetDlgItem
EnableWindow
FindWindowExA
RemovePropA
DrawTextA
IsWindowEnabled
GetKeyState
MapWindowPoints
RedrawWindow
InvalidateRect
UpdateWindow
SetRectEmpty
GetClassInfoExA
LoadCursorA
wsprintfA
RegisterClassExA
IsWindow
MoveWindow
CopyRect
CreateWindowExA
SetWindowLongA
GetWindowLongA
GetParent
SendMessageA
ReleaseCapture
GetCursorPos
ScreenToClient
PtInRect
SetCapture
SetTimer
GetDC
CharNextA
GetDlgCtrlID
GetCapture
GetMenuState
CheckDlgButton
CheckMenuItem
DestroyCursor
GetWindowTextA
GetActiveWindow
IsIconic
SetForegroundWindow
MessageBeep
SetMenu
UnregisterClassA
wvsprintfA
GetFocus
DrawFocusRect
GetClassNameA
LoadBitmapA
CreateCursor
ReleaseDC
CallWindowProcA
KillTimer
BeginPaint
IsMenu
DestroyMenu
GetMenuItemCount
GetMenuItemInfoA
SetMenuItemInfoA
EnableMenuItem
GetSubMenu
DestroyIcon
LoadImageA
ShowWindow
InflateRect
DefWindowProcA
GetClientRect
EndPaint
FillRect
SetCursor
gdi32
SetViewportExtEx
GetViewportExtEx
SetMapMode
GetMapMode
CreateCompatibleBitmap
DPtoLP
GetObjectA
GetStockObject
CreateFontA
GetObjectType
GetWindowExtEx
SetPixel
SetBkMode
GetTextExtentPoint32A
CreateBrushIndirect
TextOutA
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
SetBkColor
DeleteDC
BitBlt
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
LineTo
CreateSolidBrush
CreateRectRgn
CombineRgn
FillRgn
LPtoDP
Ellipse
GetTextMetricsA
CreateFontIndirectA
DeleteObject
advapi32
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegCloseKey
winmm
waveOutGetDevCapsA
waveOutGetNumDevs
waveInGetDevCapsA
waveInGetNumDevs
mixerClose
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerSetControlDetails
mixerGetControlDetailsA
mixerGetLineControlsA
mixerGetNumDevs
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
ShellExecuteExA
ShellExecuteA
SHBrowseForFolderA
comctl32
_TrackMouseEvent
atwbxui3
ord189
ord32
ord158
ord230
ord1683
ord90
ord181
ord241
ord196
ord198
ord94
ord78
ord1059
ord1202
ord1209
ord1797
ord1256
ord1097
ord3
ord1121
ord1020
ord206
ord111
ord456
ord500
ord1042
ord1071
ord1208
ord1681
ord1520
ord1391
ord1421
ord1550
ord1301
ord1677
ord1636
ord113
ord207
atkbctl
KbInstallFocusControl
KbUninstallFocusControl
KbSetFocus
KbSetDialogFocus
msvcrt
_initterm
??3@YAXPAX@Z
??2@YAPAXI@Z
strrchr
strstr
tolower
sprintf
_itoa
strchr
_makepath
_splitpath
free
malloc
_strlwr
_strnset
atoi
_ftol
strncat
__dllonexit
_onexit
_adjust_fdiv
CleanRecorderPanel
InitOnlinePlayerConsole
InitPlayerPanel
InitRecorderConsole
InitRecorderPanel
KillOnlinePlayerConsole
KillPlayerPanel
KillRecorderConsole
KillRecorderPanel
Name
.text
Size
168KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=19, version=8022,
count=5, productName=Unmarked objects (old),
count=281, id=1, productName=Unmarked objects,
count=13, id=19, version=8034,
count=21, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=5, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atstmget.dll
- IMPHASH b9db8be23153c53f3454f4b551d9defb
- SHA256 1113e0337e5927f0897c2dd2d035338400ecd937f4022e28dfb7434b9e2696c0
- MD5 39b66f463c80725d9419fc8cb7f0bc04
- SHA1 4dc61314536854ed42139dff2b6fb711e31be296
- SHA512 709e3b17df8e8bb3fbfbeef6e81a06876982d2d701dbaf7620c23fb9f9a7dd32db801ddb18c8156bd9bcc163ec42a218f806f33f0bb9d48ac7fbd2a5d938b84f
- SSDEEP 192:2i/uky7JvWlF2uG3l3B7kVwq2rDBLJepvGAglD9AsouN0J5:2XkyRWlwrVRsEhJepvGAglD9ABo0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
atinet
_InternetEnableWinINET@0
_HttpOpenRequestA@32
_HttpSendRequestA@20
_HttpQueryInfoA@20
_InternetReadFile@16
_InternetQueryDataAvailable@16
_InternetOpenA@20
_InternetConnectA@32
_InternetCloseHandle@4
kernel32
DisableThreadLibraryCalls
GetModuleHandleA
GetProcAddress
lstrcpyA
WaitForSingleObject
CloseHandle
GetLastError
lstrcmpiA
lstrlenA
OutputDebugStringA
user32
PostThreadMessageA
msvcrt
__CxxFrameHandler
memmove
free
_initterm
malloc
_adjust_fdiv
strstr
_beginthreadex
_purecall
_strlwr
??2@YAPAXI@Z
sprintf
memset
??3@YAXPAX@Z
memcpy
strlen
strcpy
ATInitStreamGet
ATShutdownStreamGet
ATStreamGet
GpcExitInstance
GpcInitInstance
Name
.text
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
416B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
526B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=5, id=10, version=8047,
count=2, id=4, version=8047,
count=4, id=19, version=8034,
count=43, id=1, productName=Unmarked objects,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=4, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/atwmvdrv.dll
- IMPHASH ce88f5c8c8a3a7ccbff27f45f1fa7a02
- SHA256 de5ab9c20041b3df81121bc39c538fe41a3635d1513421a3da18de55eb91b520
- MD5 62c2be5f7354960607a18b28024b250b
- SHA1 cf61771eac67fc797a706a873996e3c77288543a
- SHA512 8764234a2007458d1fab2e4f4bfbbe400057f23cfa5f0bc9dce7af16c62934e4ac16cbf4f8e1712819072c566bbd685ac9d014ee0a4ac38d14ed9567da56d70e
- SSDEEP 768:RFZYuV/8y4RcyoPE+Z3XCsmrJUZwWclK:RFFV0y4RG9Cs0lK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
19264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetModuleFileNameA
GetCurrentThreadId
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteFileA
GetDateFormatA
lstrlenA
MulDiv
ReadFile
GetFileSize
GetFileType
GetTimeFormatA
GetLastError
CreateFileA
CloseHandle
SetFilePointer
WriteFile
GetFileAttributesA
CreateDirectoryA
MultiByteToWideChar
lstrcpynA
user32
PeekMessageA
TranslateMessage
DispatchMessageA
DestroyWindow
wvsprintfA
wsprintfA
wmvcore
WMCreateWriter
WMCreateProfileManager
ole32
CoUninitialize
CoInitialize
msvcrt
free
_adjust_fdiv
malloc
_initterm
_onexit
__dllonexit
swprintf
wcscmp
??2@YAPAXI@Z
strlen
memcmp
memset
memcpy
strrchr
strcat
_itoa
_purecall
_makepath
_splitpath
strcpy
__CxxFrameHandler
time
wcscpy
wcslen
MDDeleteInstance
MDNewInstance
Name
.text
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=6, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, version=8047,
count=3, id=19, version=8022,
count=1, productName=Unmarked objects (old),
count=2, id=93, version=2067,
count=77, id=1, productName=Unmarked objects,
count=9, id=19, version=8034,
count=5, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/audio.gsm
- SHA256 31fa9321b6702440fc0810d3762d036003a83d21f8dcfaac80ff42474f5f3675
- MD5 a6a90ffa0f452f823d91f5e57d6e8bbd
- SHA1 37a56b541b6f7ab2f6828af0c817a98c23b2d3a6
- SHA512 43425a041de0e764502c0bec350a239f7b15106742165106480e13765d54e6344f3197983e9cbca6abe528a072afc03c621e1bcf156233d4b7bdc2fc7f6f2d8c
- SSDEEP 768:ww394+2TC7owXeqiasKtg3hdLR+Io4eL4YStia0TFSsHUTLn95:wwN4G0Ezi1h3ZtoTL4YStFAaR5
- MD5 SHA1 SHA512 SSDEEP
WebEx/edconvrt.dll
- IMPHASH c163363d2c2b8845fb121941bbb2aefc
- SHA256 cfd1aebcd4bd1d996df1d70ada664295ba57de2ceafa6d646ce79068a24eeaff
- MD5 a3303107f7268e6757b738941a27eb39
- SHA1 147393da5f47ebe4be5068392689ac9b8812b106
- SHA512 e0915bc18e52e232769819d7d5a451b0dd1d82ea37b7d503f1488f13292b36a48d7bdf099ff0643d7b6c21a8f921166c0daba847b01fc5b1842300fd0b04d7f3
- SSDEEP 3072:2FQ5ijsEjG0C7+5YuM4gcMotUzCLFi4VdHonWi64:oQIi0C7+5Yuvg5ofNTmO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
88636
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetStdHandle
GetStringTypeW
GetStringTypeA
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
HeapSize
TerminateProcess
ExitProcess
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
GetModuleHandleA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
HeapAlloc
GetVersion
GetCommandLineA
InterlockedIncrement
FlushFileBuffers
GetFileSize
GetVersionExA
GetDiskFreeSpaceA
GetAtomNameA
DeleteAtom
GetTickCount
AddAtomA
CreateThread
GetDateFormatA
GetTimeFormatA
OutputDebugStringA
UnmapViewOfFile
SetFilePointer
SetEndOfFile
CreateFileMappingA
MapViewOfFile
lstrcmpiA
lstrcmpA
GetSystemDefaultLCID
GetCurrentProcess
FlushInstructionCache
GetFileAttributesA
CreateDirectoryA
CreateFileA
CloseHandle
DeleteFileA
lstrcpynA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
lstrcatA
lstrlenA
lstrcpyA
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
InterlockedDecrement
HeapFree
RtlUnwind
WriteFile
GetLastError
GetCurrentThreadId
DisableThreadLibraryCalls
GetCPInfo
user32
GetParent
InflateRect
DestroyWindow
wvsprintfA
EndDialog
GetDlgItem
EnableWindow
SetWindowTextA
SetFocus
GetWindowTextLengthA
GetWindowRect
MoveWindow
GetWindowTextA
CallWindowProcA
DefWindowProcA
SendMessageA
SetCapture
SetTimer
PtInRect
DrawTextA
IsWindowEnabled
GetWindowLongA
ScreenToClient
GetCursorPos
CharNextA
KillTimer
ReleaseCapture
GetKeyState
MapWindowPoints
GetClientRect
FillRect
RedrawWindow
EndPaint
BeginPaint
InvalidateRect
UpdateWindow
CopyRect
SetRectEmpty
GetDC
ReleaseDC
wsprintfA
LoadMenuA
LoadCursorA
LoadBitmapA
LoadStringA
SetWindowLongA
DialogBoxParamA
CreateDialogParamA
CreateWindowExA
ShowWindow
MessageBoxA
IsWindow
gdi32
CreateBrushIndirect
SetBkMode
SetPixel
GetStockObject
CreateSolidBrush
GetObjectType
GetObjectA
CreateFontA
GetCurrentObject
GetDIBits
GetDeviceCaps
StretchDIBits
CreateHalftonePalette
SelectPalette
RealizePalette
CreateDIBSection
DPtoLP
CreateCompatibleBitmap
GetMapMode
SetMapMode
GetViewportExtEx
SetViewportExtEx
GetWindowExtEx
SetWindowExtEx
GetTextColor
GetBkColor
CreateCompatibleDC
PatBlt
SetTextColor
BitBlt
DeleteDC
CreateBitmap
CreatePatternBrush
Arc
CreatePen
SelectObject
MoveToEx
LineTo
DeleteObject
SetBkColor
advapi32
RegCreateKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
wmvcore
WMCreateProfileManager
ole32
CoCreateInstance
oleaut32
SysAllocString
LoadTypeLi
RegisterTypeLi
SysFreeString
comctl32
ImageList_GetIconSize
ImageList_Draw
ATDeleteInstance
ATNewInstance
ATPrepare
ATSetInPutFile
ATSetOutPutFile
ATSetParent
AtRun
Name
.text
Size
108KB
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=14, version=7299,
count=86, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=6, id=19, version=8022,
count=10, productName=Unmarked objects (old),
count=2, id=93, version=2067,
count=11, id=19, version=8034,
count=202, id=1, productName=Unmarked objects,
count=25, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
WebEx/wmasf.dll
- IMPHASH 7f54fbd6c699bd468624d69053eae4cb
- SHA256 6262cda055aac6e1de520b5823f2464270fc03e2b8732b4fd3230c435fab755f
- MD5 c1335c62aad768048fc06fe61b0c886a
- SHA1 95ceb9abd387c7429e3ecf383ab8349e6730a9b3
- SHA512 f40d66494321956fa956a69495151ffd27af4ce31f34e0db9f8438977f7da5da5f0bd7da2303f52257b0749da3d311d6e723fd56f235c3957f5326e870d6aea5
- SSDEEP 6144:M4G2xsg+5Ao4LP6ImsnVR9plseaKHQEyDJ5nnVrT6mF/9SApABsKc:XPfVvlWpzW8z
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4280
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
GetProcAddress
GetCurrentProcess
TerminateProcess
Sleep
CloseHandle
GetLastError
WriteFile
FlushFileBuffers
WideCharToMultiByte
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
HeapAlloc
GetProcessHeap
HeapFree
MultiByteToWideChar
MulDiv
InitializeCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
msvcrt
_purecall
malloc
_adjust_fdiv
_initterm
free
_wcsicmp
wcscmp
wcscpy
wcslen
memmove
??2@YAPAXI@Z
??3@YAXPAX@Z
ole32
CoCreateGuid
ASFAddPresDelta
ASFAddSendDelta
ASFCalculatePresDelta
ASFCreateBitrateTracker
ASFCreateIOMonitor
ASFCreateIndexMaker
ASFCreateIndexMakerFileSink
ASFCreateLibrary
ASFCreateMediaObjectIndexMaker
ASFCreateStreamSelector
ASFFindHeaderObject
ASFFindRootObject
ASFFindStreamPropertiesObject
ASFGUIDFromCodecID
ASFGUIDToCodecID
ASFGetDataUnitInfo
ASFGetHeaderObject
ASFGetRootObject
ASFGetStreamPropertiesObject
ASFGetTimeBase
ASFPresDeltaTimeToTime
ASFPresDeltaToFull
ASFPresFullToDelta
ASFPresTimeToSendTime
ASFPresTimeToTime
ASFReadHeaderFromFile
ASFReadHeaderFromFileHandle
ASFSendTimeToPresTime
ASFSendTimeToTime
ASFSetDataUnitInfo
ASFTimeToPresDeltaTime
ASFTimeToPresTime
ASFTimeToSendTime
ASFWriteHeaderToFile
CreateAsfCellPoolAllocator
Name
.text
Size
201KB
Virtual Size
200KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
844B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2035,
count=5, id=64, version=9210,
count=5, id=93, version=2067,
count=47, id=1, productName=Unmarked objects,
count=9, id=95, version=2067,
count=1, id=92, version=2067,
count=80, id=96, version=2067,
count=1, id=69, version=9111,
count=1, id=90, version=2067,
WebEx/wmvcore.dll
- IMPHASH 6f3c714b8cb3ad114b9e28d99535c21e
- SHA256 e79cace0a0c1495275b794cda6c96f0bada550cf2ce4bdf435cd59dc8f1f48d2
- MD5 a51732857fa86427441c47b7f65fefed
- SHA1 bcdb21a0ad47fc1a2034baeb913960fe6a1fd8ef
- SHA512 d4b4df56719a19c6adb199702658a76674020c12809605b6a27934676c8570a65a34bea5690c02aa4f613d514f7647d0ee8431717b6e63843c30cfa54653afc3
- SSDEEP 24576:m8QJx7yxOx6yyuAnsy1Fpvgd+hjsNz7zsRYhHOsu3V6xM0KnSDv7Tv/RHW+Dzly3:m8Qr4O+szfQYRG3VEZpDzllRnLlz9hQ5
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
N/A
Digest Algorithm
N/A
PE Digests Matches
Not matched
Trusted
Not trusted
Subject
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Serial Number
4a:19:d2:38:8c:82:59:1c:a5:5d:73:5f:15:5d:dc:a3
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Timespan
May 12, 1997 - Jan 7, 2004
Subject
CN=VeriSign Time Stamping Service,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)01,O=VeriSign\, Inc.
Serial Number
08:7a:6d:5c:6f:62:93:4f:ba:c4:fd:43:e1:14:18:9d
Issuer
OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 28, 2001 - Jan 6, 2004
Subject
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Serial Number
c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Timespan
Jan 10, 1997 - Dec 31, 2020
Subject
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Issuer
CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation
Key Usages
KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 10, 2000 - Nov 12, 2005
Subject
CN=Microsoft Corporation,OU=Copyright (c) 2002 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:11:43:00:00:00:00:00:34
Issuer
CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2002 - Nov 25, 2003
Minor OS version
1
Major OS version
5
Entry point
5328
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
FreeResource
CloseHandle
WriteFile
SleepEx
OpenProcess
GetExitCodeProcess
GetVersion
HeapSize
RaiseException
FlushInstructionCache
DuplicateHandle
SizeofResource
LockResource
LoadResource
TerminateProcess
GetCurrentProcess
GetProcAddress
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
InterlockedCompareExchange
InterlockedIncrement
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
InterlockedDecrement
ReadFile
GetFileType
InitializeCriticalSection
SetEvent
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
WaitForSingleObject
GetFileSize
ReleaseSemaphore
MultiByteToWideChar
IsBadReadPtr
SetFilePointer
WideCharToMultiByte
lstrlenA
CompareFileTime
Sleep
FreeLibrary
InterlockedExchange
WaitForMultipleObjects
ResetEvent
MulDiv
VirtualFree
VirtualAlloc
GlobalMemoryStatus
ReleaseMutex
WaitForSingleObjectEx
GlobalLock
GlobalAlloc
GetSystemDefaultLangID
GetUserDefaultLCID
IsBadWritePtr
FileTimeToSystemTime
GetFileTime
SetEndOfFile
CreateSemaphoreA
SetThreadPriority
GetThreadPriority
GetCurrentThread
GetExitCodeThread
CreateThread
GetComputerNameA
GetDiskFreeSpaceA
GetLocalTime
DeviceIoControl
LoadLibraryA
GetModuleHandleW
GetVersionExA
GetSystemInfo
LocalAlloc
LocalFree
SetLastError
GetVersionExW
LoadLibraryW
HeapReAlloc
lstrlenW
CreateEventA
CreateEventW
CreateFileA
CreateFileW
CreateSemaphoreW
DeleteFileA
DeleteFileW
FindResourceA
FindResourceW
GetModuleFileNameA
GetModuleFileNameW
GetTempPathA
GetTempPathW
GetVolumeInformationA
GetVolumeInformationW
IsBadStringPtrA
IsBadStringPtrW
OutputDebugStringA
SetFileAttributesA
SetFileAttributesW
GetLocaleInfoA
GetLocaleInfoW
CreateMutexA
CreateMutexW
GetComputerNameW
GetSystemDirectoryA
GetSystemDirectoryW
wmasf
ASFSendTimeToTime
ASFPresTimeToTime
ord18
ASFTimeToSendTime
ASFSetDataUnitInfo
ord24
ord11
ASFTimeToPresTime
ord10
ord6
ord8
ord17
ord7
ord5
ASFGetTimeBase
ASFCreateStreamSelector
ord9
msvcrt
isalnum
_except_handler3
free
strcpy
realloc
abs
_waccess
_wcsupr
_ui64toa
strlen
srand
_beginthread
memmove
_wcslwr
longjmp
_setjmp3
sprintf
strncpy
strpbrk
memchr
wcstombs
_stricmp
_ultow
_wtol
wcsncmp
_wcsicmp
_set_error_mode
_purecall
wcscmp
wcscpy
wcslen
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsnicmp
wcscat
_itoa
towupper
iswprint
_errno
strtoul
isdigit
strchr
strstr
isspace
sscanf
rand
memcpy
memcmp
memset
iswdigit
wcsncat
iswspace
_vsnwprintf
_vsnprintf
swscanf
wcstoul
wcspbrk
setlocale
_wtoi
_snwprintf
swprintf
wcstol
wcsstr
wcsncpy
_snprintf
_strnicmp
wcsrchr
wcschr
_itow
__CxxFrameHandler
_ultoa
calloc
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_onexit
__dllonexit
_adjust_fdiv
_initterm
vswprintf
_CIpow
printf
strcspn
strspn
abort
exit
fprintf
_iob
getenv
ceil
toupper
isxdigit
iswcntrl
iswascii
wcsspn
wcscspn
_ltoa
isalpha
wcsftime
gmtime
wcstok
strcmp
malloc
_strcmpi
time
strncmp
advapi32
RegQueryValueExW
CryptGenRandom
CryptAcquireContextA
CryptReleaseContext
GetUserNameA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExW
GetUserNameW
RegCreateKeyExW
RegEnumKeyA
RegEnumKeyW
RegEnumValueA
RegEnumValueW
RegOpenKeyA
RegDeleteKeyA
RegDeleteKeyW
RegDeleteValueA
RegDeleteValueW
RegOpenKeyExA
RegQueryInfoKeyA
RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
user32
wsprintfA
MsgWaitForMultipleObjects
ReleaseDC
GetDC
GetDesktopWindow
DispatchMessageA
DispatchMessageW
PeekMessageA
PeekMessageW
PostThreadMessageA
PostThreadMessageW
RegisterWindowMessageA
wvsprintfW
ole32
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoCreateGuid
CoTaskMemAlloc
StringFromCLSID
CoCreateInstance
CLSIDFromString
CoGetTreatAsClass
oleaut32
VariantCopy
VariantInit
SysFreeString
VariantChangeType
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysAllocStringLen
VariantTimeToSystemTime
SysStringByteLen
SysStringLen
SysAllocString
VariantClear
gdi32
GetSystemPaletteEntries
DllRegisterServer
WMCheckURLExtension
WMCheckURLScheme
WMCreateBackupRestorer
WMCreateBackupRestorerPrivate
WMCreateEditor
WMCreateIndexer
WMCreateProfileManager
WMCreateReader
WMCreateReaderPriv
WMCreateSyncReader
WMCreateSyncReaderPriv
WMCreateWriter
WMCreateWriterFileSink
WMCreateWriterNetworkSink
WMCreateWriterPriv
WMCreateWriterPushSink
WMIsAvailableOffline
WMIsContentProtected
WMValidateData
Name
.text
Size
1.6MB
Virtual Size
1.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
24KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
312KB
Virtual Size
310KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=13, id=64, version=9210,
count=1, id=22, productName=VC++ 6.0 SP5 build 8804, version=8966,
count=23, id=21, productName=VC++ 6.0 SP5 build 8804, version=8966,
count=4, id=14, version=8204,
count=12, productName=Unmarked objects (old),
count=3, id=29, version=9249,
count=6, id=25, version=9210,
count=2, id=37, version=8755,
count=2, id=93, version=2035,
count=15, id=93, version=2067,
count=908, id=1, productName=Unmarked objects,
count=1, id=92, version=2067,
count=66, id=95, version=2067,
count=324, id=96, version=2067,
count=1, id=69, version=9111,
count=1, id=90, version=2067,
WebEx/快捷方式管理器.exe
- SHA256 bad0699a3ed61c48139da045c31e4519101e84d9b9b467d4a980c71a7551293d
- MD5 96c698846e343bc6555f3e7f6bbc635e
- SHA1 b1a4a17ec70d5b072281147fdeb3572d899037a7
- SHA512 0120b795868c0a62c4ce2e5a9dd2219073c082c0c8af0e63619270c21ce9f22c9b1939e6fe5a256f8c92cafe985560f1f325386b8661ad61a03707b34a0e3261
- SSDEEP 12288:0cNO9MdtPUOjj7awzy6jB3te5FjX8MRHH9jLVoeyW3bUZ4CAwh:0cMwUOWwDVo5FRHHh3yYi4c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
553340
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
536KB
Virtual Size
536KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ