7b11be2b7d46c6636f3586efd0357816_JaffaCakes118

resource	yara_rule
static1/unpack001/Codes/ffmpeg.exe	upx
static1/unpack001/Launcher.exe	upx

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/7z.dll
unpack001/Addin/npTongbuAddin.dll
unpack001/Addin/tbIEAddin.dll
unpack001/AppUnion.dll
unpack001/Codes/ffmpeg.exe
unpack002/out.upx
unpack001/Hash72.dll
unpack001/ICSharpCode.SharpZipLib.dll
unpack003/out.upx
unpack001/System.Data.SQLite.dll
unpack001/libWPD.dll
unpack001/libchara.dll
unpack001/libiTunes.dll
unpack001/zlib.net.dll

IMPHASH b729b61eb1515fcf7b3e511e4e66258b
SHA256 6dc3e8f3e9d416228fc641e19080298813d2a8fcd2840e6b13282f754b79f5da
MD5 7b11be2b7d46c6636f3586efd0357816
SHA1 b5487ef831dc11d9cb81670b7cd370ad88aa10d1
SHA512 7474315fdc77154502567194d93f90edec02128faa874995257cd8bd83b99d9e41095aa90a01c2982ba3a3e0181b8eb6c7537d87595783b2a449301fea06213b
SSDEEP 393216:kmfgNOWKmd5Dzsi8V52+LNhmQyQGn6GWRuwl15+13C36SO4kq/R/6pNPobGKuLpN:kmfgbKmdZzsiQZLbmqGX8Hz+13W6SO48
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b0:32:d9:64:31:5d:af:85:78:16:47:ae:55:d2:d8:3e:89:93:26:19

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

Apr 3, 2015

Minor OS version

0

Major OS version

5

Entry point

13643

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount CreateFileW GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte MulDiv lstrlenA WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx FindWindowExW GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint IsWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InstallOptions.dll

IMPHASH cd90e33ffbc335413a25300c682c83df
SHA256 fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
MD5 67d8f4d5acdb722e9cb7a99570b3ded1
SHA1 f4a729ba77332325ea4dbdeea98b579f501fd26f
SHA512 03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
SSDEEP 192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7419

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiW GetModuleHandleW GlobalLock GlobalUnlock GetCurrentDirectoryW SetCurrentDirectoryW GetPrivateProfileIntW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrcpynW lstrlenW lstrcpyW GlobalFree GlobalAlloc

user32

OpenClipboard DestroyIcon LoadCursorW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect GetClipboardData GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW wsprintfW CharNextW MessageBoxW CloseClipboard GetDlgCtrlID MapWindowPoints SetWindowPos PtInRect GetWindowTextW SetWindowTextW SendMessageW DestroyWindow

gdi32

SelectObject CreateRectRgn GetObjectW CombineRgn DeleteObject CreateCompatibleDC GetDIBits SetTextColor

shell32

SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteW SHGetDesktopFolder

comdlg32

GetOpenFileNameW CommDlgExtendedError GetSaveFileNameW

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH e981c0ab92cb1f191bb5e23392e14796
SHA256 b15b1fc88d1b56088b2d3738d76772a91fa186a316a3e0a154358820d0fb9005
MD5 410a586735f45164c86bda363ad8446f
SHA1 a68d18a8c72ffaa8f8d9ed9f76ea9b0ed397821b
SHA512 d12083f67df132b2be57c202601a0cf82dba4c234910e780d2723aac14ae68407b824405b04737b55104bc97750550a3271a944d647661b067ce134075e6cc2a
SSDEEP 48:aYZT4WeApYxYlxamAWHN+EuWkGWBBWAGr9SdLB8m+ofYZVSA:JCWGSxamjHNDuWRWBBWvmuV
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5444

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 689a67b30946cbe12dce92d17207ec0488e850a806be608e6fb174f853f86b57
MD5 6f98fcda445825382121e480a64ae24c
SHA1 d5071f4928fc8c38fc8d015501bfc1f4229b1799
SHA512 68cb5b4ec06e4955ea8b5208f5f8569a37120c185dc9a10966c89ab5fd2bb0c6038d901d7b0fd15b1db8409a2b1ede18451f3d09cb17156a14fe4940095a7d0d
MD5 SHA1 SHA512

$PLUGINSDIR/modern-wizard.bmp

SHA256 245159689e1bf40b3cc36bfbedf53eec06518f3c0971a5670fd129395bf38657
MD5 0dccad0dc7e54db5c3b72193cad6965a
SHA1 9dfa90bbaedc977331715c1be2e74c7ab7167439
SHA512 02b0e9e5e1c2421c4899d0f13adf45d795776e057e6e430686251f9124c892f4faf8c4a62d3a9d93e4cdab8e03b6e25ddd4bdb96bbafe4b8a1816b40f756222a
SSDEEP 1536:C23OsPV34mfthNQF+/mR9MF6kYK1U9HXStlBi2rYJivOvYh8Fxul1B:Rta+/rgolB
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

7z.dll

IMPHASH b8c3503499348048190b90e6971adc8d
SHA256 ea50f78c5b059d910a5f7cbd9ff8270006a75c218ea49d31e499984f0ff24a34
MD5 7ed8309941fa7ccf969a8d6a4e8c60e9
SHA1 e195dffc8801a18e618e5f621f3dec2978dc00d8
SHA512 552b7a4cc2cbd20f8719016c9865c1d82fd350678fc5ccd7180b53011891295c065b79a49340ba1e74c9d60d0bb35d0bb6bd6776cc88c361db8db70b9901817e
SSDEEP 24576:FV2HCCoh4NzNungvvkkMcrnZOLY3bdYUC:qi7yNzXh7rnZOM3JY
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

658105

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

oleaut32

SysAllocString VariantClear VariantCopy SysFreeString SysAllocStringByteLen

user32

CharLowerA CharNextA CharUpperW CharLowerW CharPrevExA CharUpperA

msvcrt

_adjust_fdiv _initterm ?terminate@@YAXXZ _onexit __dllonexit ??1type_info@@UAE@XZ _except_handler3 _beginthreadex memset strcmp realloc strlen free malloc memmove _CxxThrowException memcpy memcmp _purecall __CxxFrameHandler

kernel32

DeleteFileW InitializeCriticalSection ReleaseSemaphore CreateSemaphoreA ResetEvent SetEvent CreateEventA WaitForSingleObject VirtualFree VirtualAlloc QueryPerformanceCounter FileTimeToLocalFileTime DeleteCriticalSection LocalFileTimeToFileTime GetVersionExA WaitForMultipleObjects EnterCriticalSection LeaveCriticalSection GetSystemTime SystemTimeToFileTime FileTimeToDosDateTime DosDateTimeToFileTime GetModuleHandleA GetProcAddress GetSystemInfo CompareFileTime WriteFile ReadFile CreateFileA MultiByteToWideChar WideCharToMultiByte GetLastError CloseHandle CreateFileW SetLastError SetFileAttributesW SetFileAttributesA CreateDirectoryW CreateDirectoryA DeleteFileA GetTempPathW GetTempPathA GetCurrentProcessId GetTickCount GetCurrentThreadId FindClose FindFirstFileW FindFirstFileA

Name

.text

Size

679KB

Virtual Size

679KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sxdata

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Addin/npTongbuAddin.dll

IMPHASH baabecbd002b2925d7733d5576a1213d
SHA256 ddb0b302d6fb1291b8d6fc72163f9f3b1ef33fa1768a38e86859747318a67fd9
MD5 20f76a9a47c0ddc38c85505c004e311b
SHA1 e57cd89b59824307c3f4fd06d8b18d2aa17c124c
SHA512 be602d0f9911de5af1e41530b5335fce0ed5ff72dcc254c94ca4fceb126df70a376c066baba2b0ceb9c5ece6a863c2c28bfb042a6a92c491396c2d40a28c6b3d
SSDEEP 768:Qs4hbPUK8O9HLv0d37zi9hbfVkLhuCilrRSI7y1rNbthtqph6kgx4XOgNzl3:l4PvC/idkN70RZ7GFthUpYbxuOgNzl
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

37446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\Work\tbBHOPlugin\npTbChromeAddin\tbChromeAddin\plugin\npTongbuAddin.pdb

kernel32

GetPrivateProfileStringW MultiByteToWideChar lstrlenW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetLastError lstrcmpiW FindResourceExW InterlockedIncrement InterlockedDecrement FreeLibrary LoadLibraryExW GetModuleHandleW SetThreadLocale GetThreadLocale GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId FindResourceW LoadResource LockResource SizeofResource WideCharToMultiByte GetModuleFileNameW GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep GetLocaleInfoA GetACP InterlockedExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA

user32

UnregisterClassA CharNextW wsprintfW

advapi32

RegOpenKeyExW RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

SHGetSpecialFolderPathW ShellExecuteW

ole32

CoTaskMemRealloc CoTaskMemFree CoCreateInstance StringFromGUID2 CoTaskMemAlloc

oleaut32

VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

msvcp80

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z ?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ ??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z ??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ ?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ

msvcr80

??_V@YAXPAX@Z wcscat_s vswprintf_s memset __CxxFrameHandler3 memcpy_s _CxxThrowException _vscwprintf memmove_s _wcsicmp _wcslwr_s malloc free wcsstr ??2@YAPAXI@Z _invalid_parameter_noinfo ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABV01@@Z memcpy wcscpy_s wcsncpy_s _recalloc ?terminate@@YAXXZ _except_handler4_common _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal ??3@YAXPAX@Z

Addin/tbIEAddin.dll

IMPHASH 8a1b8aea273ae59adfd33456645c882c
SHA256 7f87f707d9caa79960e7d1ba3cde821a54168f16733f1b0ea45d08980ffc1f1f
MD5 bae453b9ec58c089066aa316d2c6c38e
SHA1 b8f0c04adeab06f8ddd18429b9b09e341e19234e
SHA512 5c6a8a5e7622be3b9e213341b35ccf55941dc155552b46c7dce39de5146de85ebb21734de4c5b68c8304aeee621dcf537c260c94e9ff9d47a55d7457295a0605
SSDEEP 1536:cLbTn9MKotCWfeI9rCSkNyjIxkqOA14dbHN:wT9Mdvfe4xkojIxdOA14dbH
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

36024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\work\tbbhoplugin\tbiebhoaddin\tbiebhoaddin\release\tbIEAddin.pdb

kernel32

lstrlenW lstrcmpiW GetModuleHandleW GetModuleFileNameW InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetLastError MultiByteToWideChar LoadLibraryExW SetThreadLocale GetThreadLocale GetSystemTimeAsFileTime GetCurrentProcessId FindResourceExW FindResourceW RaiseException LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection FreeLibrary GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetVersionExA GetLocaleInfoA GetACP InterlockedExchange

user32

UnregisterClassA CharNextW

advapi32

RegCreateKeyExW RegQueryInfoKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW

shell32

SHGetFileInfoW

ole32

CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance StringFromCLSID CoTaskMemAlloc

oleaut32

RegisterTypeLi UnRegisterTypeLi VarUI4FromStr LoadRegTypeLi GetErrorInfo LoadTypeLi VariantChangeType VariantCopy VariantClear VariantInit SysStringLen SysStringByteLen SysAllocStringByteLen SysAllocString SysFreeString

msvcr80

__clean_type_info_names_internal _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ __CppXcptFilter ??3@YAXPAX@Z memcpy_s malloc free _CxxThrowException wcscpy_s wcsncpy_s wcsstr _wcslwr_s ??_U@YAPAXI@Z __CxxFrameHandler3 ??_V@YAXPAX@Z memmove_s _purecall _recalloc ??2@YAPAXI@Z _wcsicmp memset wcscat_s _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit _adjust_fdiv

AppSite.ico

SHA256 957dca4f7e976459d09bc74fa39739b5d8b5615aafa38f1c8403796ac8dd580d
MD5 cc73bcadcfcb6d27f5e6c33034fc93e1
SHA1 ebd0c71511b0c548312cca14f533ccecd9c7aa3e
SHA512 cfb59116bf1179d3ba4a9e833bf059dc9ef1364fef86ec20af64815737d7329d56aa0706e78ba9c97ec146c035402fcc15f747cc6eb6ff1aafb77cd711a29394
SSDEEP 384:4O47VoIIIpJIIIIIpIIII92xajK3eaaaa0yM:347V026Kfy
MD5 SHA1 SHA512 SSDEEP

AppUnion.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7887d29cb9ddd14c46c43329dd56946bcad5d2c8d0998bb63df44b2a4f85bc87
MD5 94b2b17a8434fd1e8907e0c917d01aed
SHA1 6b3b19470bde1d0e51a9d998fa1ac747bb6ae156
SHA512 811815503ead796e3469995cc5227e69a0fd8b6635a3817408f965ab6c60c2490f67290d495709a6c8acfea575c613006d84f80cde4c289cf9157066ecaa4893
SSDEEP 196608:R7kO9ybKFxiYnr0tF8s4CvbktX5lKLE8+Ynw+gJanC:Rk6qKWYcGsZvMX5lKzHk
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11702542

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AppUnion.pdb

Biz.dll

SHA256 193ddee0d7da03b66f440df5dee6efc0d630c378ad5121980141785b5b28ca3b
MD5 a261db7c8aa1ed79b1bb0ec923d8f908
SHA1 34677fe8a8f02352c4290d42161266059180fecc
SHA512 d2a969baf1782bd7f7f8ebdef4044ce32badcd44e02f32d90cae091ac7b1d926ea68e4939eaa3325cda1d1b150cfbdf2c92fefa85209fa2a7647e23f494747e0
MD5 SHA1 SHA512

Codes/ffmpeg.exe

SHA256 7c5edec7615a71bdd22b6a6add273e910bc7364cb266e7cfd2d5a753216218e0
MD5 0bfb6cb6f957e89ab2ae65b410cf9f64
SHA1 70b69205072f0d2cd586738b39572910463510cc
SHA512 723b90c4fc9b273e269a1295249e612677aa17aa7cb7e0a281d298b2bfb368fd65860267107d0e7cc6f8475607bf50c96762bfd760b6bd9f75bf571fc10eec07
SSDEEP 49152:GPQakj9g+C5WYul343x++o0BveKrCo3BhC7rAT5IfZ/q:GOjUvAgro0QKrCA6ATu
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12941232

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

out.upx

SHA256 fdc8a39a2da32d098877c251517ad3f288bece1a0c6169a01d9a39d7f1c061a9
MD5 8566086d8c518bc2ba018a3e81b0d350
SHA1 cea9563e5b08703ae5507f4b170866e248fd4333
SHA512 ec8d3547faff097cb1ec81e0da05019fdb14b3df6a6e24d8b3910bccdaccaf39ef5a4f4c0db22ba9f94024c3f69a29aa6b2a5f05085e2fa460753bada5740cfd
SSDEEP 196608:StaSVkRixyfO4dA8mPFsRKAg/yV2Pk8igG8U2UPIZALeZYYPFzVTYpRjo15gDG1X:+U2XGvY9BT021SeEVoZPC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4400

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

6.3MB

Virtual Size

6.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1017KB

Virtual Size

1017KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Feedback.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 098fab95cb882645ecfe1ebae770c0909072d38f97ad2b6850dfeebb7d4cfb3d
MD5 b2702c48dd0513c26901a88ed90fda8e
SHA1 52bddadee61dccb06bf67e55f0764910e42b94ac
SHA512 ff9302afdd7c18db64015dd56a0ade9cffa81961a7b3a165dc62ff7424054fea6b4e1c582ad2067c2b48397f76b597c2bbb3a8946ba7b39c5eb40caf518f405a
SSDEEP 1536:1h6OZXJT5+HxB6uWqjt6r+vcI6RhZXJT5+HUu:1wOZN5+RTWqR6RhZN5+h
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

ae:79:76:de:e6:56:09:91:8a:79:fa:9f:55:43:7c:a5:2a:9d:d4:e7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

Apr 3, 2015

Minor OS version

0

Major OS version

4

Entry point

64414

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Work\iTong_New\Feedback\obj\x86\Release\Feedback.pdb

Hash72.dll

IMPHASH f4484863e0a1a966c531d5eef79dcbdc
SHA256 fff0098e9976a2a26a49a54cb133ae6acd29f98660314af9190d9edc6917acc0
MD5 70aad37d50f6f21c42266a98b7e665d6
SHA1 346cd54035e37f8c74d38542e301d7c05c4318b4
SHA512 21224488400a124f65cd147185d851e41e8089c31c9a80512cb66c077679cf2011d6b35315d1bd638e2c56d0bc36cc117c6062a3838402d446e485c7a4481c01
SSDEEP 6144:WPJbFOniW8UGjgpUnLO6AdFbFiiMNdg7ZXyRgZr0TED5RXH3x4rXtgrQtbguHKa:gb6qUaLOHkiryCrVRXHh6iMiDa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

23008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Shared\itdb_fix\msvc\hash72\Release\hash72.pdb

Helper.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 34cb735fe65d0b6e00886ee9cd73b86562dd1bf3c25d5147fe17035cdb9c0875
MD5 00fa398b8c5dae607879268d33adfd2f
SHA1 0e1aff2bf74077e5ab8f2d05cdcc2b1575fe3895
SHA512 6058431d2d31dc1bb1ca5f83fbbcf4a3769d2e2889fdc6347fd899da74673d50e46b99481c93a4919bd0282cd2d27c77321c7233792c97f83f3d0fb42209ed0a
SSDEEP 3072:WJKCzzm4lBL0x/Jq9fak+9fakMNpa+ga20Y3g3a0d6MczNC2d9zm4r:ku4lBkJG/S/YpV22MC2i4r
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

29:6e:08:ea:e9:b4:11:bd:9c:c3:15:a8:7d:8e:bb:b4:da:98:8b:02

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

Apr 3, 2015

Minor OS version

0

Major OS version

4

Entry point

164670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Work\iTong_New\Helper\obj\x86\Release\Helper.pdb

History.rtf

SHA256 ce04438ea65a55b1beefd801f19b81cea9fe44f933ac8a3ec06c00657e695bae
MD5 8848f77d9214b6ded4a3fd500856f651
SHA1 38c1a3eccbbeedf5a68dad736133ffaaeb8e135b
SHA512 134361272b5c6ecf154657ea72f8051e00fce4bee09ed3671948af5d96bb83c880e06646a37b7e4de52cb6e3d1956a40218f4e41cfa10371b30fec306d7d4400
SSDEEP 384:AAPbA+yE9K6mGmQOb6RBy96P5KEKPeo75Y3kMpwmBa5qd9:AAP9zKYZFb
MD5 SHA1 SHA512 SSDEEP

ICSharpCode.SharpZipLib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5f3275a619a224ff5e867039b30a147291db8d0508f72e8a24b674273062cff6
MD5 d462b957f90310ef2d4b3406b02b0887
SHA1 2b61ed8e77ab4d63bbb33894dddc56d35741d8a6
SHA512 41fa681124a3e5acf3edecd6d996b868aeaeb7e55cce2d9dbdafc12f2435c819133bd18105481ba20a05e174c617df777e5cddf6067cbb9df789b1d300de090e
SSDEEP 3072:EcVZDNmywB9hgBtZZXMDcpeCOIVyVQBpd2SzAfQFrr2b2DwiItzyxyAtwy8I:EsNwBjItZZXMgp5PVyVQBppzAf2uj
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

193934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/en-US.lang

SHA256 d0e5215051c0eeb957935eb79fbe26a32b7da48bd8ed922eca5834ff93ea89cf
MD5 3a9725e59c1a32a00112d55eeedee530
SHA1 cd313a40aaa28aaef01ee6b8f5d6ab1045c28035
SHA512 1434211b62cc4aa86af8997aaaf007f3d3af7aaae97a99416992790cc19ca0f91d7e84eca9afd28c3519243091bf7fc08adc4e72b78ba4702b7d508068923191
SSDEEP 1536:kkwQE+yhkNnKsDAmTm3FekQydxwfH7FW13psRqL7R:kBQE+oIDK7x8b813eK7R
MD5 SHA1 SHA512 SSDEEP

Lang/ja-JP.lang

SHA256 ed384ddaff694f35e2a81ae55ad494e2ed0e258d8fb6fc7111920a363bfeb6a0
MD5 1698d4e28150e2384401a28eda0d509a
SHA1 a61ee7e37b368975ad4455112607401dccace8ef
SHA512 07317aff26f210f03bb17c56a4cc612047b6286430664bf2f9546cf479c554dae88f791ec76357d7a152b6c61bccd6e1bbd10ea38666d8d0193b270043a223fe
SSDEEP 1536:deD6s/6xo9bEg4Fd8TENQca6WPQ0jqg1K7TaiY:nY6xo93IO6gQLoK7mJ
MD5 SHA1 SHA512 SSDEEP

Lang/zh-CN.lang

SHA256 11a2695acc9178cfaf304975d3073a9255e16cf62e9774fc5a7ec522dc20c897
MD5 8e16673e95f42b3af58d0809b5c940c8
SHA1 57df7ea90355b22e75e9ebdbe5c5ebadbaa068aa
SHA512 140637967e9f53b1bce9f4660c2a4bda51f9930dfb51ae2aebf9b94e74e02ec34e496164d611bada498415ca0d049d1cc6b6e126aa8becf418d66cc8afc27311
SSDEEP 1536:4DXdDPsc31hjCfTq6vUoIvt+RkqTzKR0qJl:4LdDPsuCbBvZqqTWRVl
MD5 SHA1 SHA512 SSDEEP

Lang/zh-TW.lang

SHA256 9a80c68e544f26fc0c1a2d1d1b2d1dd3d54f6011e240d0dfd9475d027b8b3c0f
MD5 49e9fd90c856396bd65026821de42aae
SHA1 1479806847810e92d494730c85d9984ccd6322d3
SHA512 056c8a9c670a798399009b88d180c229c21a89d1f0f38e9409f0821a03ac1e0d8d22ed471aa2afa9d272b7a4b9e0d79907cd5407262af4f3b5cfc12f5b5bc2b8
SSDEEP 1536:FvaEnD9zbA2xLSGhHhwA9+MxbhsJj1lQDUfiWs2yw6Vu9H8l:znD9nASm7nAsCf9VSu
MD5 SHA1 SHA512 SSDEEP

Launcher.exe

SHA256 fbe0dfcd053290c88edb9404ef78a8c890a6cfea499c5e596e22c492478a1228
MD5 9d8e49512087b973cb3f889043384915
SHA1 07d2b7661e9fcbfd7dbaa247b3ecd24ed613e8c7
SHA512 e939d5f552ccc5b613c403de46e72c5e59f4e8516c5e7b533320f9a39623bdd4861ba1bbf2a744c6da9dc13107e2ef901170478084b93a6c4876698a09515a1a
SSDEEP 1536:eiy8YBr321Er76ZUiCGDh2GWv6NJg59A4fkl6CxthIcYK2kpzKXJTC+hbeD:eiy8mDt76eGDKyNO55kljx2JXNC+Bc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx

PE Signature issue

Digest

06:82:73:e5:70:6f:2e:5b:1d:1e:ce:3e:8e:d1:4a:22:18:4a:26:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

May 23, 2024

Minor OS version

0

Major OS version

4

Entry point

154928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

out.upx

SHA256 70817598883b450933909161a12c1fbc4162a8ee6f4e6b600f2dfe8d023a5e2e
MD5 02c503ee91cad4356a577fb308e00b68
SHA1 13d6296bc1cb9b32e8274846fda507d9e2b062e5
SHA512 f9197aec66178fd65491583ccd68c33e8c70efbcaa9b89e89b8d25da75c0d5e1e5b5b18226c38d959da75256bd1108a540042d655b23c9dc75631372ab7f4229
SSDEEP 3072:2PmxO3ftrQeGbcc04pR+usAW6UE8GS8lG4tA9tjyNC+Bx:k3Fub35nZsAFVplG4ajyNC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

72788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

PkgInstaller.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 12e3f1537a2b9fefa811188346176dd6270a0ca1f4025ba103006e14935d3ec5
MD5 207948a05bffdbed333185ecf7ea57ab
SHA1 665484a229688ea6abea9bcac1fa521de43c1549
SHA512 84f7333404324340159a00c251ea729ff77b870f9d90907189acf3a815a4556e96f87085491516c63f163ad09f7cd5521ed68066b37a0e14df3c3312f61a0f97
SSDEEP 12288:9fkrWLnqrYalOLbqFRisoQ0Il5oNPmhwShQLbqo3L:9fXnIYacLCRisorUMPGw/aqL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

67:eb:0d:74:76:b3:b8:3c:b0:6d:b5:24:12:fb:95:8a:61:83:39:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

May 23, 2024

Minor OS version

0

Major OS version

4

Entry point

563422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

PkgInstaller.pdb

ServerSettings.ini

SHA256 fe05a4f61bf205e6987129e40ebd872628462eb81e90b09eb1fef6cd69ce7208
MD5 fc725272642742fc85a19b6dce5e8a43
SHA1 0586bd5a912bf5a290db5242b59bec7fe5abe768
SHA512 2777b5ba5516728695c417f52e70b583bb7b7113b4db1c58321f552c803a1fb3d73164ac85dc0df0874e0e6bcec7840bb28d15c933195506d0da546a8d9b64cf
MD5 SHA1 SHA512

System.Data.SQLite.dll

IMPHASH 331fdb7a6b0a87069bdab47a40418f92
SHA256 78e03894ae266b3125c0f2985c92636f67194d79db3ef1fd0f28230065ee0949
MD5 a94c51d2e614bfea904cd7ebafd0bc61
SHA1 1183f0ea09e300ce4622b4c85f0d730e5047e226
SHA512 86daadbd550607b41354e3e4ca7ed8ade7fbb86c55795f1646d12ab4e27767f3073c07d3e9488bf76d851bef3d20e96fcc541076cb8f0d5869af8f9db737e371
SSDEEP 12288:pwtq2h2sib7FWXP/NtsPPMhgTH4agkpoiz8DEBXtPFNsdwaHT8FNFGFOFwcGF6co:pwVtCPMhK4abo0MEBXtF4T1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

171120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFullPathNameW GetFullPathNameA CreateFileA GetFileSize SetFilePointer VirtualQuery SetEndOfFile FreeLibrary InterlockedIncrement QueryPerformanceCounter UnlockFile LockFile GetTickCount GetSystemTimeAsFileTime FormatMessageA WriteFile InitializeCriticalSection WideCharToMultiByte LoadLibraryW Sleep LeaveCriticalSection GetFileAttributesA GetFileAttributesW ReadFile CreateFileW MultiByteToWideChar FlushFileBuffers GetTempPathW GetLastError SetLastError GetProcAddress LockFileEx EnterCriticalSection LoadLibraryA DeviceIoControl GetModuleHandleA DeleteCriticalSection GetCurrentThreadId GetVersionExA CloseHandle DeleteFileW GetCurrentProcessId GetTempPathA GetSystemTime AreFileApisANSI DeleteFileA LocalAlloc InterlockedExchange RaiseException HeapFree HeapAlloc HeapReAlloc GetCommandLineA HeapCreate HeapDestroy VirtualFree VirtualAlloc GetCPInfo InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameA LCMapStringA LCMapStringW GetTimeZoneInformation SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW InitializeCriticalSectionAndSpinCount RtlUnwind GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize CompareStringA CompareStringW SetEnvironmentVariableA

__CorDllMainStub@12 _sqlite3_aggregate_context_interop@8 _sqlite3_aggregate_count_interop@4 _sqlite3_bind_blob_interop@20 _sqlite3_bind_double_interop@12 _sqlite3_bind_int64_interop@12 _sqlite3_bind_int_interop@12 _sqlite3_bind_null_interop@8 _sqlite3_bind_parameter_count_interop@4 _sqlite3_bind_parameter_index_interop@8 _sqlite3_bind_parameter_name_interop@12 _sqlite3_bind_text16_interop@20 _sqlite3_bind_text_interop@20 _sqlite3_busy_handler_interop@12 _sqlite3_busy_timeout_interop@8 _sqlite3_changes_interop@4 _sqlite3_close_interop@4 _sqlite3_column_blob_interop@8 _sqlite3_column_bytes16_interop@8 _sqlite3_column_bytes_interop@8 _sqlite3_column_count_interop@4 _sqlite3_column_database_name16_interop@12 _sqlite3_column_database_name_interop@12 _sqlite3_column_decltype16_interop@12 _sqlite3_column_decltype_interop@12 _sqlite3_column_double_interop@12 _sqlite3_column_int64_interop@12 _sqlite3_column_int_interop@8 _sqlite3_column_name16_interop@12 _sqlite3_column_name_interop@12 _sqlite3_column_origin_name16_interop@12 _sqlite3_column_origin_name_interop@12 _sqlite3_column_table_name16_interop@12 _sqlite3_column_table_name_interop@12 _sqlite3_column_text16_interop@12 _sqlite3_column_text_interop@12 _sqlite3_column_type_interop@8 _sqlite3_commit_hook_interop@8 _sqlite3_complete16_interop@4 _sqlite3_complete_interop@4 _sqlite3_compressfile@4 _sqlite3_create_collation16_interop@24 _sqlite3_create_collation_interop@24 _sqlite3_create_function16_interop@32 _sqlite3_create_function_interop@32 _sqlite3_cursor_rowid@12 _sqlite3_data_count_interop@4 _sqlite3_decompressfile@4 _sqlite3_detach_all_interop@4 _sqlite3_errcode_interop@4 _sqlite3_errmsg_interop@8 _sqlite3_errmsg_stmt_interop@8 _sqlite3_exec_interop@24 _sqlite3_finalize_interop@4 _sqlite3_free_interop@4 _sqlite3_free_table_interop@4 _sqlite3_function_free_callbackcookie@4 _sqlite3_get_table_interop@28 _sqlite3_interrupt_interop@4 _sqlite3_key_interop@12 _sqlite3_last_insert_rowid_interop@4 _sqlite3_libversion_interop@4 _sqlite3_libversion_number_interop@0 _sqlite3_open16_interop@8 _sqlite3_open_interop@8 _sqlite3_prepare16_interop@24 _sqlite3_prepare_interop@24 _sqlite3_rekey_interop@12 _sqlite3_reset_interop@4 _sqlite3_result_blob_interop@16 _sqlite3_result_double_interop@8 _sqlite3_result_error16_interop@12 _sqlite3_result_error_interop@12 _sqlite3_result_int64_interop@8 _sqlite3_result_int_interop@8 _sqlite3_result_null_interop@4 _sqlite3_result_text16_interop@16 _sqlite3_result_text_interop@16 _sqlite3_rollback_hook_interop@8 _sqlite3_sleep_interop@4 _sqlite3_step_interop@4 _sqlite3_table_column_metadata_interop@44 _sqlite3_table_cursor@12 _sqlite3_total_changes_interop@4 _sqlite3_update_hook_interop@8 _sqlite3_value_blob_interop@4 _sqlite3_value_bytes16_interop@4 _sqlite3_value_bytes_interop@4 _sqlite3_value_double_interop@8 _sqlite3_value_int64_interop@8 _sqlite3_value_int_interop@4 _sqlite3_value_text16_interop@8 _sqlite3_value_text_interop@8 _sqlite3_value_type_interop@4 sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_commit_hook sqlite3_complete sqlite3_complete16 sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_function sqlite3_create_function16 sqlite3_data_count sqlite3_db_handle sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_interrupt sqlite3_key sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_mprintf sqlite3_open sqlite3_open16 sqlite3_prepare sqlite3_prepare16 sqlite3_progress_handler sqlite3_rekey sqlite3_reset sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_snprintf sqlite3_step sqlite3_thread_cleanup sqlite3_total_changes sqlite3_transfer_bindings sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_vmprintf

Name

.text

Size

410KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.clr

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

System.Data.SQLite3.dll

IMPHASH 3e9ac7c70f925316525aedd20017a3dc
SHA256 a2cbf71c3449ba71739e9e805d2eb9f9242ad9d839af5b4c4f7adc00c239fb38
MD5 8ba9851e671e8b5e49e303748ffd530c
SHA1 f38d1617f21298b7aa27f7103b9666188db287a7
SHA512 a5e8bdfc3f97b2a517d462195a50db24ee16a85803722945f2a5703aa7602213177944c45c6e59252c5f2a4d1f6efcc3bc808ad1a17cc28f9bb64fccbb6b2d05
SSDEEP 6144:mEezhs2SwibDgOfvU11p4s/v7hmHmMoiKeL4g1rQPADs+vJubkAnQmAAK234YS/S:tmhs2SwibEO3GplmjwyFFubW8eS3/mi
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

98:23:ac:e3:d6:a1:bf:33:81:34:94:5f:76:fb:48:69:b1:2e:a9:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Jul 29, 2011

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Apple Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

5f:a2:a6:e5:14:b1:87:c5:2e:1f:ea:52:40:cb:04:e9

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 15, 2011 - Jun 25, 2013

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

4

Entry point

385463

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\bwa\sqlite-111.1\srcroot\visualstudio\release\SQLite3.pdb

kernel32

Sleep InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetVersionExW MultiByteToWideChar WideCharToMultiByte AreFileApisANSI GetLastError SetFilePointer CloseHandle ReadFile WriteFile SetEndOfFile FlushFileBuffers GetFileSize UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA DeleteFileA GetFileAttributesW DeleteFileW GetFileAttributesExW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTime GetSystemTimeAsFileTime UnmapViewOfFile GetTempPathA GetTempPathW LocalFree FormatMessageA FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileA CreateFileW GetSystemInfo CreateFileMappingW MapViewOfFile DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedExchange GetCurrentThreadId

msvcr80

_encode_pointer _malloc_crt _encoded_null _decode_pointer _initterm _initterm_e _amsg_exit _adjust_fdiv __CppXcptFilter _crt_debugger_hook __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common realloc strncmp memcpy memset malloc free _localtime64_s memmove

sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_backup_finish sqlite3_backup_init sqlite3_backup_pagecount sqlite3_backup_remaining sqlite3_backup_step sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_reopen sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_compileoption_get sqlite3_compileoption_used sqlite3_complete sqlite3_complete16 sqlite3_config sqlite3_context_db_handle sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_function_v2 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_config sqlite3_db_handle sqlite3_db_mutex sqlite3_db_status sqlite3_declare_vtab sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_errcode sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_initialize sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_limit sqlite3_log sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_leave sqlite3_mutex_try sqlite3_next_stmt sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_os_end sqlite3_os_init sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_randomness sqlite3_realloc sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_shutdown sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_soft_heap_limit64 sqlite3_sourceid sqlite3_sql sqlite3_status sqlite3_step sqlite3_stmt_readonly sqlite3_stmt_status sqlite3_strnicmp sqlite3_temp_directory sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf sqlite3_vsnprintf sqlite3_wal_autocheckpoint sqlite3_wal_checkpoint sqlite3_wal_hook sqlite3_win32_mbcs_to_utf8

Tongbu.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 c81e67e7a856088eebbe7207ee62cd52db8b5c158b00ff93a3eff5f52e1631e1
MD5 f92f2b7f18c86de00c3a18f2ab23ed34
SHA1 3eb6f5ed890390a972c0d73618560827c5d6ffbf
SHA512 a45cdfe55917ca1f86a057f5b4209fabdf1f0c3ca0194a3d0bb130b147acca1f2a0b783163d6590b831b3db2ca66ba1afb23f6bb8f5de3c7adf85e4efdaa8dc4
SSDEEP 196608:L+ME/voKVLApul8SPtNaFFJUa0l8Vn6PhH4UNwW71S6hC9WamPKPQetK0rsptl:LJfKV8putu0lm6H4g7M6gEZKPQ30Il
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

97:3a:d0:0e:3b:25:49:c1:2c:7f:2e:83:05:ba:57:ba:0c:a0:f2:4a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

May 23, 2024

Minor OS version

0

Major OS version

4

Entry point

15785774

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Tongbu.pdb

Tongbu.exe.config

SHA256 a867f954a5555f1ba715914d933dbd864f80074442efdf390063c72f5a1de1b8
MD5 e9ac1e54a27151b9f4ea23543d857587
SHA1 2b812d60ced85475db923f160a1d5eef585d0e60
SHA512 a668f8772b194f9a6d3a791333f326fd871497cf72828db2b71fa4dd6f6ec971848ca83820c79083f36bc713dcc7b8e77d00342bd59eb741248e04fddf717247
MD5 SHA1 SHA512

Tongbu.exe.manifest

SHA256 db7477a2d848834b95c900984bedcf5068a6b81082746dc74b3fa6b90f068074
MD5 1f333c2d83010e072fa9e3cdf167965f
SHA1 277e5faab45711e1d6eaee1d6616166ba5af5fb3
SHA512 8bfbef71f735d5f124fbc368df7febfcbf99b9849238cf2d83cbfba38174db82ec4bc1b39007dd7f2ea54d1d58b4c26a3302ab51ae62b6521cd44b4b405f09c9
MD5 SHA1 SHA512

libWPD.dll

IMPHASH 88b7fe6bb13f710be4377809f8a1a88b
SHA256 b8fedaa8109447f1da21b33a7e0299f9105c3b2bd9568c6fcc495d5f470f813e
MD5 2f65bdf3d2a2d4cfaf43399b543eaf49
SHA1 2b5dabb995f3469ac4dc6de3b8644cb5977e1603
SHA512 6c5df1a4f5c66f5a5cf43fcd1842379ef3134874c7343a7f7a67ed80c91cae8bc292accac89e5c351f6b432a52456aead557915536b640035d040b132980bc19
SSDEEP 192:WZB7xXbKp5cb9cvLcNiTQ8+apxIg3XzVR6mLOA:QBZ2ib9cvoNL5gDVF
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Project\Local Code\libWPD\Release\libWPD.pdb

libchara.dll

IMPHASH 834a3943ff2e09fe8219f169d5cfd37c
SHA256 cc7e7cec0a093acd36894c0c10cb59e66c5c21171b5681a01b3dc3ab477d9abd
MD5 ba757e3de83ffa6e218475809a270911
SHA1 afec7a14f19ee60e109d828e9484cfec28bcee4d
SHA512 cea2931b2df9d5a323976620de240da88ed794f2bb0be5bad63d79fb0efb64247cfbc37b6cf20b47319fa18e34479ebaca9723d925cf37c27f45e27af809e92e
SSDEEP 768:Ei0TEoC1HTdfftzK2oI2wnqP3vjRqhKwx/iB9oD9I5Huq2F4moce////MDS7:E5hC1HTdf5oI2RqBxb90UFoED8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

libiTunes.dll

IMPHASH 14550a9c90f8fdfb182ac0e55a6f67f8
SHA256 13eb7a6966c9a3f57b1751cd6c6ba2eaaf5f5bbd8a857ec16d5851e4ccc5f6a1
MD5 dd1fdf60df47b36d2565f6ed0fe6d18b
SHA1 54f83972625bcf6c514ad2a9fa3bce6b6dcf9a1b
SHA512 f693a165acbe3de905bf87b3f8b3af337f5ab11577584331ed7dff29d263364074243ce74e7aceb5261234a633f759e733e18cc9ef57215d72adfd250bd31b46
SSDEEP 768:P085vXuID2A8QhLsBjOcNhRKSk/vcM487KV/nn3xwitLmJ5stR6JBu:7XhDFBsBjrCSk/UpnuamJB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

17309

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Project\SVN Code\iLab\Release\libiTunes.pdb

kernel32

GetLastError CreateDirectoryA VerifyVersionInfoW VerSetConditionMask GetComputerNameW GetVolumeInformationW CloseHandle DisableThreadLibraryCalls GetCurrentProcess HeapFree HeapAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess HeapCreate HeapDestroy VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc RaiseException WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW

advapi32

AdjustTokenPrivileges OpenProcessToken RegOpenKeyExA GetCurrentHwProfileW RegCloseKey RegQueryValueExA LookupPrivilegeValueW

shell32

SHGetFolderPathA

iphlpapi

GetAdaptersInfo GetAdaptersAddresses

shlwapi

PathAppendA

site.xml

SHA256 cddf3fc899befa9b00ed076eea476104793ab1d7f908b8cf9eea984b3fce7c1f
MD5 72de4388044c5caefbe6212cbc424951
SHA1 8c66017b87d110e98fe07425bcf697d2afce8861
SHA512 1c304e444445443ac0aa631ebdac5e7722d19842c45334538aafa4dfe321befea94a255050c9d09fa1e940b65b06dec23dcb6560e98cdb668a2f0bd3cd97fb5d
MD5 SHA1 SHA512

tbMobileService.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b58a9a12812ef283757d75e087222a6125eac5a8680ef1c738b02c133d3b8995
MD5 fa787071201dc15fdef19da459710d68
SHA1 6e2ffda207a90f6675b4f9f432b6b63b2976d8bb
SHA512 aef28f045076feb120b241eff2da6a0c34fe22ff365cd9076e0e6736b4fb9bde5628dd59df3c7377f42db68dcf585f374105616a8d79c265479dc9cc2991ac2a
SSDEEP 6144:FImAq9GkpTJaUVnX+NbK5TKKQ3N5oRa1mF7KHHVDesT2GcjQcoN5V:FVXGkpd9RQvVm961D2GcMcOV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

63:03:43:d4:03:c1:e1:44:cb:e8:50:15:13:87:da:d3:a8:de:c7:a3

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Xiamen Tongbu Networks Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=IT,O=Xiamen Tongbu Networks Ltd.,L=Xiamen,ST=Fujian,C=CN

Chains

Apr 3, 2015

Minor OS version

0

Major OS version

4

Entry point

294670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

uninst.exe.nsis

SHA256 d5faa0b88ad3ff8db1dc9d0d0dc6e0560bc3fb96e8ae65c899c59740403120ea
MD5 ceda55e33796f99e24afe9663c177cfa
SHA1 3d4ef7a2d70e323a74329515cb39364230dcd17f
SHA512 295b49559320295c35e13d14c89b824e1dfffedbebc60f4f0767db7b3d91c9627c0f80edc6f658f3b4acb85b2bcc890150f0690dae1750dd4ca3a730ee7473a1
SSDEEP 96:O4JZ0J+TMWD6XAM5aWtGJ8RdWPP75XwAHtC3uM7/PPyZUDelfe:O4dTZD6XAKQCWPP7zsJjPPy+exe
MD5 SHA1 SHA512 SSDEEP

zlib.net.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7f5c9be60df013492eb8739f85be8c30e445fffe58ca1eb21b0b52c3642a71ac
MD5 cda0a9fbffe0ee4777bc88eaa6f9ff12
SHA1 6c45d7ff2620a1041c08a34fd48dd97d94c10dd1
SHA512 1c220cd082c47b3d235003c1637489bbd5434374431f49e6f06a3b10bbe7afcd39bab6c2ea3577692f4d873b77fdb8f7898ffd6cc228c6fa666ba7bb5b3dda9c
SSDEEP 1536:PPg4lHLhp50A07T4kQxlv0LB73WmWZI/F:PI4lD50A0jWc73WmWZI/F
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

61230

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer