E:\chenxiaoyu\baidu\_ggit-local\baidu\aip\csharp-sdk\src\CSharpSdk\AipSdk\obj\Release\net45\AipSdk.pdb
Overview
overview
7Static
static
3AipSdk.dll
windows7-x64
1AipSdk.dll
windows10-2004-x64
1NPOI.dll
windows7-x64
1NPOI.dll
windows10-2004-x64
1Newtonsoft.Json.dll
windows7-x64
1Newtonsoft.Json.dll
windows10-2004-x64
1PdfiumViewer.dll
windows7-x64
1PdfiumViewer.dll
windows10-2004-x64
1Xceed.Docu...ET.dll
windows7-x64
1Xceed.Docu...ET.dll
windows10-2004-x64
1Xceed.Words.NET.dll
windows7-x64
1Xceed.Words.NET.dll
windows10-2004-x64
1dotNetFx45...up.exe
windows7-x64
7dotNetFx45...up.exe
windows10-2004-x64
7pdfium.dll
windows7-x64
3pdfium.dll
windows10-2004-x64
3Сʶͼv1.7.exe
windows7-x64
1Сʶͼv1.7.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
AipSdk.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
AipSdk.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
NPOI.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
NPOI.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Newtonsoft.Json.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Newtonsoft.Json.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
PdfiumViewer.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
PdfiumViewer.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
Xceed.Document.NET.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
Xceed.Document.NET.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
Xceed.Words.NET.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
Xceed.Words.NET.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
dotNetFx45_Full_setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
dotNetFx45_Full_setup.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
pdfium.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
pdfium.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
Сʶͼv1.7.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Сʶͼv1.7.exe
Resource
win10v2004-20240508-en
General
-
Target
0849989e8709c10c7fe4c5e5ad3b67263b2686d5c09c40c8ee1e47cdd8c79fca
-
Size
8.3MB
-
MD5
1cd9aaddbdd802f52210c8da9cba6ce7
-
SHA1
fbec423e9db85cb0aa694391e7e0170a03ddff8d
-
SHA256
0849989e8709c10c7fe4c5e5ad3b67263b2686d5c09c40c8ee1e47cdd8c79fca
-
SHA512
91ffb903dc79c3eeffccbd56a1c4c05f022dd3ad0f97ab5876f82fb758ebd26b6c6c19163128f6f2436df52ca11c6dfaf24544f837e9c6d581ccf2df236d3be5
-
SSDEEP
196608:oMBjtpOnKe953ksnBXkRqkrMzs7zCGm4DM1q40FCfg/9JJW:o8xpO/kMXkISMzs7GGNDRuOvJW
Malware Config
Signatures
-
Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/AipSdk.dll unpack001/NPOI.dll unpack001/Newtonsoft.Json.dll unpack001/PdfiumViewer.dll unpack001/Xceed.Document.NET.dll unpack001/Xceed.Words.NET.dll unpack001/pdfium.dll unpack001/Сʶͼv1.7.exe
Files
-
0849989e8709c10c7fe4c5e5ad3b67263b2686d5c09c40c8ee1e47cdd8c79fca.zip
-
AipSdk.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
NPOI.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\github\npoi\main\obj\Debug\NPOI.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 868B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Newtonsoft.Json.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 636KB - Virtual size: 635KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
PdfiumViewer.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Projects\PdfiumViewer\PdfiumViewer\obj\Release\PdfiumViewer.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 972B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Xceed.Document.NET.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
mscoree
_CorDllMain
Sections
.text Size: 382KB - Virtual size: 381KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Xceed.Words.NET.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
D:\Dev\DocumentLibraries\Release\2.1\Words\OpenSource\Generated\Xceed.Words.NET\obj\Release\Xceed.Words.NET.pdb
Imports
mscoree
_CorDllMain
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
app.pap
-
dotNetFx45_Full_setup.exe.exe windows:5 windows x86 arch:x86
5e3ce2eed99c49477aed11aea6091114
Code Sign
33:00:00:00:88:59:0e:3c:51:1f:e2:6a:67:00:01:00:00:00:88Certificate
IssuerCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before26-07-2012 20:50Not After26-10-2013 20:50SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
61:02:92:4a:00:00:00:00:00:20Certificate
IssuerCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before09-01-2012 22:25Not After09-04-2013 22:25SubjectCN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
61:33:26:1a:00:00:00:00:00:31Certificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before31-08-2010 22:19Not After31-08-2020 22:29SubjectCN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
61:16:68:34:00:00:00:00:00:1cCertificate
IssuerCN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6dNot Before03-04-2007 12:53Not After03-04-2021 13:03SubjectCN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
33:00:00:00:08:e2:79:fa:0d:25:58:45:ea:00:00:00:00:00:08Certificate
IssuerCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before07-07-2012 00:14Not After07-10-2013 00:14SubjectCN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USExtended Key Usages
ExtKeyUsageCodeSigning
61:0e:90:d2:00:00:00:00:00:03Certificate
IssuerCN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USNot Before08-07-2011 20:59Not After08-07-2026 21:09SubjectCN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=USKey Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
e4:c0:b8:7b:95:13:be:32:3b:55:79:55:ba:d6:5a:13:04:c4:6c:1e:11:4a:8a:14:16:f6:3c:d3:b0:3c:7f:a1Signer
Actual PE Digeste4:c0:b8:7b:95:13:be:32:3b:55:79:55:ba:d6:5a:13:04:c4:6c:1e:11:4a:8a:14:16:f6:3c:d3:b0:3c:7f:a1Digest Algorithmsha256PE Digest Matchestrue44:3a:91:f3:fa:40:7b:1d:25:8a:80:73:bf:2d:cc:f9:69:6d:35:f4Signer
Actual PE Digest44:3a:91:f3:fa:40:7b:1d:25:8a:80:73:bf:2d:cc:f9:69:6d:35:f4Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
E:\clr\binaries\x86ret\bin\i386\VSSetup\Utils\boxstub.pdb
Imports
advapi32
CreateWellKnownSid
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
DecryptFileW
kernel32
CreateProcessW
Sleep
WaitForSingleObject
GetExitCodeProcess
CloseHandle
SetFileAttributesW
InitializeCriticalSection
CreateEventW
CreateThread
DeleteCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
SetEvent
GetCommandLineW
lstrlenW
CompareStringW
LocalFree
CreateDirectoryW
QueryDosDeviceW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
CreateFileW
DeviceIoControl
SetErrorMode
RemoveDirectoryW
MoveFileExW
LoadLibraryW
GetProcAddress
GetSystemDirectoryW
GetVersion
GetLastError
SetEnvironmentVariableW
ExitThread
GetTickCount
GetEnvironmentVariableW
GetModuleHandleW
LeaveCriticalSection
WaitForMultipleObjects
ResetEvent
CreateEventA
GetSystemInfo
FileTimeToSystemTime
FileTimeToLocalFileTime
FileTimeToDosDateTime
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetEndOfFile
DuplicateHandle
ReadFile
GetCommandLineA
HeapSetInformation
GetStartupInfoW
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
LCMapStringW
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
GetStringTypeW
HeapSize
HeapReAlloc
IsProcessorFeaturePresent
SetStdHandle
WriteConsoleW
FlushFileBuffers
CreateFileA
GetLocalTime
GetComputerNameW
lstrlenA
FormatMessageW
GetSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
DeleteFileW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
SetCurrentDirectoryW
GetProcessHeap
GlobalAlloc
GlobalFree
SetFilePointerEx
RaiseException
comctl32
ord17
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
shell32
SHBrowseForFolderW
SHGetPathFromIDListW
CommandLineToArgvW
shlwapi
PathRemoveExtensionW
user32
GetTopWindow
GetWindowThreadProcessId
GetWindow
SendMessageW
MessageBoxW
PostMessageW
DialogBoxParamW
GetDlgItem
SetWindowTextW
EndDialog
PostQuitMessage
SetWindowLongW
GetWindowLongW
LoadStringW
CharUpperW
cabinet
ord22
ord23
ord20
oleaut32
VariantClear
SysAllocString
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
Exports
Exports
?dwPlaceholder@@3PAEA
_DecodePointerInternal@4
_EncodePointerInternal@4
Sections
.text Size: 162KB - Virtual size: 162KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boxld01 Size: 512B - Virtual size: 182B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
pdfium.dll.dll windows:5 windows x86 arch:x86
70a80dbefa7ae6ade9f21245398e5b6e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
C:\Build\PdfiumBuild\Build\repo\pdfium\out\pdfium.dll.pdb
Imports
kernel32
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcessId
GetSystemTime
GetCurrentProcess
ResumeThread
GetThreadContext
SuspendThread
CloseHandle
OpenThread
GetCurrentThreadId
SwitchToThread
RaiseException
GetProcAddress
GetModuleHandleW
VirtualFree
VirtualAlloc
GetNativeSystemInfo
RtlCaptureStackBackTrace
IsWow64Process
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileExA
FindNextFileA
FindClose
GetLocalTime
CreateFileA
CreateFileW
GetFileSizeEx
SetFilePointerEx
ReadFile
WriteFile
FlushFileBuffers
SetEndOfFile
GetACP
GetWindowsDirectoryA
GetVersionExW
FreeLibrary
GetSystemDirectoryA
LoadLibraryA
Sleep
ResetEvent
SetEvent
CreateEventW
GetLastError
GetSystemTimeAsFileTime
GetUserDefaultLocaleName
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetTimeZoneInformation
GetUserGeoID
GetGeoInfoW
InitOnceExecuteOnce
ResolveLocaleName
GetLocaleInfoEx
GetCurrencyFormatEx
GetNumberFormatEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatEx
GetTimeFormatEx
GetCurrentThread
GetThreadTimes
DeleteFileA
GetTempPathA
GetTempFileNameA
GetStdHandle
GetFileType
OutputDebugStringA
GetSystemInfo
LoadLibraryW
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetThreadPriority
SetThreadPriority
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
CreateSemaphoreA
ReleaseSemaphore
WaitForSingleObjectEx
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleFileNameA
GetModuleFileNameW
HeapAlloc
HeapReAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetConsoleCP
GetConsoleMode
ReadConsoleW
DeleteFileW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
SetStdHandle
WriteConsoleW
WaitForSingleObject
SetLastError
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
gdi32
SetDIBitsToDevice
GdiComment
GetRegionData
GetClipRgn
CreateRectRgn
GetTextMetricsW
GetTextFaceA
CreateFontA
GetDIBits
BitBlt
CreateCompatibleBitmap
CreatePen
WidenPath
SelectClipPath
IntersectClipRect
EndPath
CreateFontIndirectA
CreateCompatibleDC
SelectObject
GetOutlineTextMetricsW
DeleteObject
DeleteDC
GetFontData
GetCharWidthW
EnumFontFamiliesExA
SetStretchBltMode
GetObjectType
CreateBitmap
GetObjectW
GetDeviceCaps
SaveDC
RestoreDC
StretchDIBits
EnumFontFamiliesExW
CreateSolidBrush
GetClipBox
MoveToEx
LineTo
SetMiterLimit
SetPolyFillMode
FillPath
StrokePath
StrokeAndFillPath
ExtCreatePen
BeginPath
PolyBezierTo
CloseFigure
user32
GetDC
ReleaseDC
FillRect
winmm
timeGetTime
dbghelp
SymGetModuleBase64
StackWalk64
SymFromAddr
SymGetLineFromAddr64
SymSetSearchPathW
SymGetSearchPathW
SymInitialize
SymSetOptions
SymFunctionTableAccess64
shlwapi
PathRemoveFileSpecW
Exports
Exports
_FORM_DoDocumentAAction@8
_FORM_DoDocumentJSAction@4
_FORM_DoDocumentOpenAction@4
_FORM_DoPageAAction@12
_FORM_ForceToKillFocus@4
_FORM_GetSelectedText@16
_FORM_OnAfterLoadPage@8
_FORM_OnBeforeClosePage@8
_FORM_OnChar@16
_FORM_OnFocus@28
_FORM_OnKeyDown@16
_FORM_OnKeyUp@16
_FORM_OnLButtonDown@28
_FORM_OnLButtonUp@28
_FORM_OnMouseMove@28
_FORM_OnRButtonDown@28
_FORM_OnRButtonUp@28
_FORM_ReplaceSelection@12
_FPDFAction_GetDest@8
_FPDFAction_GetFilePath@12
_FPDFAction_GetType@4
_FPDFAction_GetURIPath@16
_FPDFAnnot_AppendObject@8
_FPDFAnnot_CountAttachmentPoints@4
_FPDFAnnot_GetAP@16
_FPDFAnnot_GetAttachmentPoints@8
_FPDFAnnot_GetColor@24
_FPDFAnnot_GetFlags@4
_FPDFAnnot_GetFormFieldAtPoint@24
_FPDFAnnot_GetFormFieldFlags@8
_FPDFAnnot_GetLinkedAnnot@8
_FPDFAnnot_GetObject@8
_FPDFAnnot_GetObjectCount@4
_FPDFAnnot_GetRect@8
_FPDFAnnot_GetStringValue@16
_FPDFAnnot_GetSubtype@4
_FPDFAnnot_GetValueType@8
_FPDFAnnot_HasAttachmentPoints@4
_FPDFAnnot_HasKey@8
_FPDFAnnot_IsObjectSupportedSubtype@4
_FPDFAnnot_IsSupportedSubtype@4
_FPDFAnnot_RemoveObject@8
_FPDFAnnot_SetAP@12
_FPDFAnnot_SetAttachmentPoints@8
_FPDFAnnot_SetColor@24
_FPDFAnnot_SetFlags@8
_FPDFAnnot_SetRect@8
_FPDFAnnot_SetStringValue@12
_FPDFAnnot_UpdateObject@8
_FPDFAttachment_GetFile@12
_FPDFAttachment_GetName@12
_FPDFAttachment_GetStringValue@16
_FPDFAttachment_GetValueType@8
_FPDFAttachment_HasKey@8
_FPDFAttachment_SetFile@16
_FPDFAttachment_SetStringValue@12
_FPDFAvail_Create@8
_FPDFAvail_Destroy@4
_FPDFAvail_GetDocument@8
_FPDFAvail_GetFirstPageNum@4
_FPDFAvail_IsDocAvail@8
_FPDFAvail_IsFormAvail@8
_FPDFAvail_IsLinearized@4
_FPDFAvail_IsPageAvail@12
_FPDFBitmap_Create@12
_FPDFBitmap_CreateEx@20
_FPDFBitmap_Destroy@4
_FPDFBitmap_FillRect@24
_FPDFBitmap_GetBuffer@4
_FPDFBitmap_GetFormat@4
_FPDFBitmap_GetHeight@4
_FPDFBitmap_GetStride@4
_FPDFBitmap_GetWidth@4
_FPDFBookmark_Find@8
_FPDFBookmark_GetAction@4
_FPDFBookmark_GetDest@8
_FPDFBookmark_GetFirstChild@8
_FPDFBookmark_GetNextSibling@8
_FPDFBookmark_GetTitle@12
_FPDFCatalog_IsTagged@4
_FPDFDOC_ExitFormFillEnvironment@4
_FPDFDOC_InitFormFillEnvironment@8
_FPDFDest_GetDestPageIndex@8
_FPDFDest_GetLocationInPage@28
_FPDFDest_GetPageIndex@8
_FPDFDest_GetView@12
_FPDFDoc_AddAttachment@8
_FPDFDoc_DeleteAttachment@8
_FPDFDoc_GetAttachment@8
_FPDFDoc_GetAttachmentCount@4
_FPDFDoc_GetPageMode@4
_FPDFFont_Close@4
_FPDFImageObj_GetBitmap@4
_FPDFImageObj_GetImageDataDecoded@12
_FPDFImageObj_GetImageDataRaw@12
_FPDFImageObj_GetImageFilter@16
_FPDFImageObj_GetImageFilterCount@4
_FPDFImageObj_GetImageMetadata@12
_FPDFImageObj_LoadJpegFile@16
_FPDFImageObj_LoadJpegFileInline@16
_FPDFImageObj_SetBitmap@16
_FPDFImageObj_SetMatrix@52
_FPDFLink_CloseWebLinks@4
_FPDFLink_CountQuadPoints@4
_FPDFLink_CountRects@8
_FPDFLink_CountWebLinks@4
_FPDFLink_Enumerate@12
_FPDFLink_GetAction@4
_FPDFLink_GetAnnotRect@8
_FPDFLink_GetDest@8
_FPDFLink_GetLinkAtPoint@20
_FPDFLink_GetLinkZOrderAtPoint@20
_FPDFLink_GetQuadPoints@12
_FPDFLink_GetRect@28
_FPDFLink_GetURL@16
_FPDFLink_LoadWebLinks@4
_FPDFPageObjMark_GetName@12
_FPDFPageObj_CountMarks@4
_FPDFPageObj_CreateNewPath@8
_FPDFPageObj_CreateNewRect@16
_FPDFPageObj_CreateTextObj@12
_FPDFPageObj_Destroy@4
_FPDFPageObj_GetBounds@20
_FPDFPageObj_GetMark@8
_FPDFPageObj_GetType@4
_FPDFPageObj_HasTransparency@4
_FPDFPageObj_NewImageObj@4
_FPDFPageObj_NewTextObj@12
_FPDFPageObj_SetBlendMode@8
_FPDFPageObj_Transform@52
_FPDFPageObj_TransformClipPath@52
_FPDFPage_CloseAnnot@4
_FPDFPage_CountObject@4
_FPDFPage_CountObjects@4
_FPDFPage_CreateAnnot@8
_FPDFPage_Delete@8
_FPDFPage_Flatten@8
_FPDFPage_FormFieldZOrderAtPoint@24
_FPDFPage_GenerateContent@4
_FPDFPage_GetAnnot@8
_FPDFPage_GetAnnotCount@4
_FPDFPage_GetAnnotIndex@8
_FPDFPage_GetCropBox@20
_FPDFPage_GetMediaBox@20
_FPDFPage_GetObject@8
_FPDFPage_GetRotation@4
_FPDFPage_HasFormFieldAtPoint@24
_FPDFPage_HasTransparency@4
_FPDFPage_InsertClipPath@8
_FPDFPage_InsertObject@8
_FPDFPage_New@24
_FPDFPage_RemoveAnnot@8
_FPDFPage_RemoveObject@8
_FPDFPage_SetCropBox@20
_FPDFPage_SetMediaBox@20
_FPDFPage_SetRotation@8
_FPDFPage_TransFormWithClip@12
_FPDFPage_TransformAnnots@52
_FPDFPathSegment_GetClose@4
_FPDFPathSegment_GetPoint@12
_FPDFPathSegment_GetType@4
_FPDFPath_BezierTo@28
_FPDFPath_Close@4
_FPDFPath_CountSegments@4
_FPDFPath_GetFillColor@20
_FPDFPath_GetPathSegment@8
_FPDFPath_GetStrokeColor@20
_FPDFPath_LineTo@12
_FPDFPath_MoveTo@12
_FPDFPath_SetDrawMode@12
_FPDFPath_SetFillColor@20
_FPDFPath_SetLineCap@8
_FPDFPath_SetLineJoin@8
_FPDFPath_SetStrokeColor@20
_FPDFPath_SetStrokeWidth@8
_FPDFText_ClosePage@4
_FPDFText_CountChars@4
_FPDFText_CountRects@12
_FPDFText_FindClose@4
_FPDFText_FindNext@4
_FPDFText_FindPrev@4
_FPDFText_FindStart@16
_FPDFText_GetBoundedText@44
_FPDFText_GetCharBox@24
_FPDFText_GetCharIndexAtPos@36
_FPDFText_GetCharIndexFromTextIndex@8
_FPDFText_GetCharOrigin@16
_FPDFText_GetFontSize@8
_FPDFText_GetRect@24
_FPDFText_GetSchCount@4
_FPDFText_GetSchResultIndex@4
_FPDFText_GetText@16
_FPDFText_GetTextIndexFromCharIndex@8
_FPDFText_GetUnicode@8
_FPDFText_LoadFont@20
_FPDFText_LoadPage@4
_FPDFText_SetFillColor@20
_FPDFText_SetText@8
_FPDF_AddInstalledFont@12
_FPDF_AddRef@0
_FPDF_BStr_Clear@4
_FPDF_BStr_Init@4
_FPDF_BStr_Set@12
_FPDF_CloseDocument@4
_FPDF_ClosePage@4
_FPDF_CopyViewerPreferences@8
_FPDF_CountNamedDests@4
_FPDF_CreateClipPath@16
_FPDF_CreateNewDocument@0
_FPDF_DestroyClipPath@4
_FPDF_DestroyLibrary@0
_FPDF_DeviceToPage@40
_FPDF_FFLDraw@36
_FPDF_FreeDefaultSystemFontInfo@4
_FPDF_GetDefaultSystemFontInfo@0
_FPDF_GetDefaultTTFMap@0
_FPDF_GetDocPermissions@4
_FPDF_GetFileVersion@8
_FPDF_GetFormType@4
_FPDF_GetLastError@0
_FPDF_GetMetaText@16
_FPDF_GetNamedDest@16
_FPDF_GetNamedDestByName@8
_FPDF_GetPageBoundingBox@8
_FPDF_GetPageCount@4
_FPDF_GetPageHeight@4
_FPDF_GetPageLabel@16
_FPDF_GetPageSizeByIndex@16
_FPDF_GetPageWidth@4
_FPDF_GetSecurityHandlerRevision@4
_FPDF_ImportNPagesToOne@20
_FPDF_ImportPages@16
_FPDF_InitLibrary@0
_FPDF_InitLibraryWithConfig@4
_FPDF_LoadCustomDocument@8
_FPDF_LoadDocument@8
_FPDF_LoadMemDocument@12
_FPDF_LoadPage@8
_FPDF_LoadXFA@4
_FPDF_PageToDevice@48
_FPDF_Release@0
_FPDF_RemoveFormFieldHighlight@4
_FPDF_RenderPage@32
_FPDF_RenderPageBitmap@32
_FPDF_RenderPageBitmapWithMatrix@20
_FPDF_RenderPageBitmap_Start@36
_FPDF_RenderPage_Close@4
_FPDF_RenderPage_Continue@8
_FPDF_SaveAsCopy@12
_FPDF_SaveWithVersion@16
_FPDF_SetFormFieldHighlightAlpha@8
_FPDF_SetFormFieldHighlightColor@12
_FPDF_SetPrintMode@4
_FPDF_SetSandBoxPolicy@8
_FPDF_SetSystemFontInfo@4
_FPDF_StructElement_CountChildren@4
_FPDF_StructElement_GetAltText@12
_FPDF_StructElement_GetChildAtIndex@8
_FPDF_StructElement_GetMarkedContentID@4
_FPDF_StructElement_GetTitle@12
_FPDF_StructElement_GetType@12
_FPDF_StructTree_Close@4
_FPDF_StructTree_CountChildren@4
_FPDF_StructTree_GetChildAtIndex@8
_FPDF_StructTree_GetForPage@4
_FPDF_VIEWERREF_GetDuplex@4
_FPDF_VIEWERREF_GetName@16
_FPDF_VIEWERREF_GetNumCopies@4
_FPDF_VIEWERREF_GetPrintPageRange@4
_FPDF_VIEWERREF_GetPrintScaling@4
_FSDK_SetUnSpObjProcessHandler@4
Sections
.text Size: 9.5MB - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3.1MB - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 46KB - Virtual size: 111KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 340KB - Virtual size: 340KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Сʶͼv1.7.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
E:\Projects\xmst\xmst\obj\Debug\小马识图v1.7.pdb
Imports
mscoree
_CorExeMain
Sections
.text Size: 488KB - Virtual size: 488KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
ȿ.txt