7d5e2c970558e8fe03e1f331be72074d_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

7d5e2c970558e8fe03e1f331be72074d_JaffaCakes118
Size

3.3MB
MD5

7d5e2c970558e8fe03e1f331be72074d
SHA1

acd2e8d977ef12419eb8391bd0784cba12337068
SHA256

af0931d0a99dfeb843fe83dc3f8c39f47ad0a20c1fefa1cca24c4bd2b839bc3f
SHA512

72829a0309e67ca2767a97480655eba76dcec73c99634c2b419a68228cd3d4419629b5dacfa9617fc6e8c21616c71f9061a35b3abf457d94d0db0fead57fb5af
SSDEEP

98304:rGMhNq7ywoKzLIvNHJoO3ucLrkwmNwa9sTElk:KKYzM1JoOucLrL5Ish

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	acprotect
static1/unpack004/$PLUGINSDIR/nsRandom.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/nsRandom.dll	upx
static1/unpack004/$PLUGINSDIR/nsRandom.dll	upx

Unsigned PE 22 IoCs

Checks for missing Authenticode signature.

resource
7d5e2c970558e8fe03e1f331be72074d_JaffaCakes118
unpack001/$PLUGINSDIR/ButtonEvent.dll
unpack001/$PLUGINSDIR/MyNsisExtend.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsRandom.dll
unpack002/out.upx
unpack001/$TEMP/$_83_/MyNsisSkin.dll
unpack001/PCkekeNES.exe
unpack001/bkDLControl.ocx
unpack001/uninst.exe
unpack004/$PLUGINSDIR/ButtonEvent.dll
unpack004/$PLUGINSDIR/MyNsisExtend.dll
unpack004/$PLUGINSDIR/NSISdl.dll
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/nsDialogs.dll
unpack004/$PLUGINSDIR/nsRandom.dll
unpack005/out.upx
unpack004/$TEMP/$_84_/MyNsisExtend.dll
unpack004/$TEMP/$_84_/MyNsisSkin.dll
unpack001/ս޵а.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Files

7d5e2c970558e8fe03e1f331be72074d_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ButtonEvent.dll
.dll windows:4 windows x86 arch:x86

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpyA
lstrcpynA
GlobalFree

user32

PostMessageA
CallWindowProcA
GetDlgItem
FindWindowExA
SetWindowLongA
wsprintfA

Exports

Exports

AddEventHandler
Unload
UnsetEventHandler
WhichButtonId

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MyNsisExtend.dll
.dll windows:4 windows x86 arch:x86

d5fdbf71a74f3a5f78815dc26c4d999f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.3.3\TextAD\build_temp\Win32\compile\release_staticA2\tool\GMNsisExtend\MyNsisExtend.pdb

Imports

shlwapi

PathSkipRootA
PathCombineA
StrStrIA

wininet

InternetOpenUrlA
InternetSetOptionA
InternetSetFilePointer
HttpQueryInfoA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetOpenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

psapi

GetModuleFileNameExA

kernel32

InterlockedExchange
GetLocaleInfoW
TlsFree
TlsSetValue
SetEvent
Sleep
ResetEvent
CreateEventA
ReadFile
GetFileSize
CreateFileA
SetEndOfFile
WriteFile
SetFilePointer
lstrlenA
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
CloseHandle
GetPrivateProfileIntA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrcmpiA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
OpenProcess
DisableThreadLibraryCalls
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExA
lstrcmpA
CreateFileW
GetVersionExA
GetCurrentThreadId
ResumeThread
GetTickCount
CreateToolhelp32Snapshot
Module32First
Process32First
Process32Next
Module32Next
WideCharToMultiByte
MultiByteToWideChar
RemoveDirectoryA
CopyFileA
SetFileAttributesA
CreateDirectoryA
FindNextFileA
FindClose
WriteConsoleA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetVersion
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
LoadLibraryA
GetSystemInfo
GetSystemDirectoryA
lstrcatA
SearchPathA
GetFullPathNameA
GetFileInformationByHandle
GetTempFileNameA
GetTempPathA
GetFileSizeEx
SetCurrentDirectoryA
SetFileTime
MoveFileA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetLongPathNameA
DeviceIoControl
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetFileTime
GetLocaleInfoA
SetConsoleCtrlHandler
InitializeCriticalSection
LCMapStringW
LCMapStringA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
IsValidCodePage
TlsAlloc
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetTimeZoneInformation
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringA
CompareStringW
InterlockedIncrement
SetLastError
InterlockedDecrement
FindFirstFileA
InterlockedCompareExchange
TlsGetValue
CreateThread
ExitThread
GetProcessHeap
GetCommandLineA
HeapAlloc
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RaiseException
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetCurrentThread

user32

ShowWindow
wsprintfA
SetTimer
KillTimer
GetWindowLongA
SystemParametersInfoA
AttachThreadInput
IsWindowVisible
SetWindowTextA
MapWindowPoints
GetForegroundWindow
IsIconic
SetWindowPos
GetWindow
GetWindowTextA
IsZoomed
GetClientRect
GetWindowTextLengthA
SetForegroundWindow
GetWindowRect
GetParent
LoadStringW
GetActiveWindow
GetDlgItem
GetSystemMetrics
EnumThreadWindows
GetClassNameA
SendMessageA
SendMessageTimeoutA
GetWindowThreadProcessId

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegLoadKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegDeleteValueA
RegSaveKeyA
RegRestoreKeyA
RegDeleteKeyA
FreeSid

shell32

ShellExecuteExA
SHGetFolderPathA
ShellExecuteA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddExistAdvertID
AddInsAdvertID
AddToFirewall
AllHomePageChecksOut
ChangeInstDirtoMax
Check360Install
CheckHomeState
CheckInstallLimit
CheckInstalled
CheckKuaibaInstalled
ConvertSoftInstallTime
CreateShortcut
CreateTimer
DestroyTimer
Exec
ExecWait
ForceDeleteFile
Get7zOriginalSize
GetAdvertFileName
GetAdvertID
GetAdvertIDEx
GetAdvertIcon
GetAdvertLocalFile
GetAdvertName
GetAdvertUrl
GetBaiduHomePageURL
GetChromeHomePageURL
GetExeFileNameFromUrl
GetForceAdvertFileName
GetForceAdvertID
GetForceAdvertIDEx
GetForceAdvertLocalFile
GetForceAdvertName
GetForceAdvertUrl
GetHomePageName
GetHomePageName2
GetIEHomePageURL
GetSingleFileSize
GetSougouHomePageURL
GetSpecialBuild
GetSubChannel
HomePageChecksOut
InitPopUpInfo
IsAdvertExist
IsAdvertInstalled
IsAutoRun
IsCurrHomePageURL
LoadEncrypedXML
LoadEncrypedXMLFromUrl
LoadEncrypedXMLFromUrlEx
LoadXMLFromUrl
LoadXml
OpenUrl
PinToTaskbar
PopUp
PopupAD
SendExitInstallStat
SendResearchResult
SetAllHomePage
SetHomePage
SetHomePageUrl
SetUnGameList
TaskKillByHwnd
TaskKillByWindow
UnPinFromTaskBar

Sections

.text
Size: 828KB - Virtual size: 826KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsRandom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetRandom

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/$_83_/GMSkin_Image_2012_v1.zip
.zip
skin.xml
skin/Thumbs.db
skin/icon1.png
.png
skin/保存目录.png
.png
skin/关闭.png
.png
skin/协议背景.png
.png
skin/卸载完成.png
.png
skin/卸载完成按钮.png
.png
skin/卸载背景.png
.png
skin/取消.png
.png
skin/图片背景框.png
.png
skin/多选.png
.png
skin/多选2.png
.png
skin/安装.png
.png
skin/安装01.png
.png
skin/安装02.png
.png
skin/安装03.png
.png
skin/安装04.png
.png
skin/安装05.png
.png
skin/安装协议.png
.png
skin/安装完成.png
.png
skin/安装完成按钮.png
.png
skin/完成.png
.png
skin/广告关闭.png
.png
skin/底部背景.png
.png
skin/开始安装.png
.png
skin/按钮.png
.png
skin/最小化.png
.png
skin/最小化2.png
.png
skin/格子.png
.png
skin/欢迎.png
.png
skin/浏览.png
.png
skin/游戏弹出.png
.png
skin/立即卸载.png
.png
skin/软件弹出.png
.png
skin/进度条.png
.png
skin/进度条背景.png
.png
skin/退出.png
.png
skin/选项.png
.png
skin/默认背景.png
.png
$TEMP/$_83_/MyNsisSkin.dll
.dll windows:4 windows x86 arch:x86

8b2c18b411d31cbef33f61e5be07509a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMSkin\release_static2\MyNsisSkin.pdb

Imports

msimg32

TransparentBlt
AlphaBlend

kernel32

DosDateTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
SetFileTime
WriteFile
SetEndOfFile
GetLastError
GetFileTime
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
SystemTimeToFileTime
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
GetCurrentProcess
DuplicateHandle
GetFileType
SetFilePointer
WideCharToMultiByte
lstrcpyW
GetCurrentThreadId
MulDiv
lstrcatW
CreateFileW
GetFileSize
CreateFileA
ReadFile
CloseHandle
MultiByteToWideChar
lstrcmpiW
DisableThreadLibraryCalls
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
HeapCreate
HeapDestroy
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess

user32

ScreenToClient
ClientToScreen
UpdateWindow
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
SetWindowTextW
CharNextW
InvalidateRect
EnumChildWindows
SetCapture
ReleaseCapture
ShowWindow
SetWindowRgn
OffsetRect
wsprintfW
GetSystemMetrics
SetWindowPos
GetSystemMenu
GetMenuItemInfoW
PostMessageW
PtInRect
SetTimer
GetClassNameW
GetParent
MapWindowPoints
SetPropW
CallWindowProcW
GetPropW
DefWindowProcW
GetClientRect
GetWindowRect
IsWindow
GetWindowLongW
LoadCursorW
SetCursor
TrackMouseEvent
BeginPaint
EndPaint
IsWindowEnabled
GetWindowTextW
SendMessageW
DrawTextW
SetWindowLongW
GetCursorPos
KillTimer

gdi32

CreatePen
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateDIBSection
SetBkColor
CreateSolidBrush
CreateRoundRectRgn
RoundRect
GetStockObject
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
SetBkMode
SetTextColor
BitBlt
DeleteObject

oleaut32

SysFreeString

Exports

Exports

AddShowImage
AddShowImageFromFile
AddShowText
ClearAllShow
DelShowImage
DelShowText
InitSkin
SetBkImage
SetBtnImage
SetCloseBtnImage
SetEditBkColor
SetProgressBKImage
SetProgressImage
SetProgressTextWindow
SetTextClr
SetWindowID
SlideOff
SlideOn

Sections

.text
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_83_/config.dat
$TEMP/$_83_/game.jpg
.jpg
1.jpg
.gif
2.jpg
.jpg
3.jpg
.jpg
ExeConfig.ini
PCkekeNES.exe
.exe windows:4 windows x86 arch:x86

ad59a46f9818b175eb5acedb36835d0c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

IsBadCodePtr
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
FlushFileBuffers
HeapSize
GetFileType
GetStdHandle
SetHandleCount
SetFilePointer
TerminateProcess
WriteFile
SetStdHandle
IsBadWritePtr
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
ExitProcess
GetVersion
GetStartupInfoA
GetLastError
RtlUnwind
RaiseException
HeapFree
HeapAlloc
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
GetFullPathNameA
FindFirstFileA
FindClose
GetTempPathA
IsDBCSLeadByte
DeleteFileA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleA
GetFileAttributesA
GetCurrentProcess
SetPriorityClass
QueryPerformanceFrequency
QueryPerformanceCounter
GetCommandLineA
Sleep
CreateFileA
GetFileSize
ReadFile
CloseHandle
CreateDirectoryA
GetModuleFileNameA
SetUnhandledExceptionFilter
SetEndOfFile

user32

SetFocus
EndPaint
BeginPaint
DefWindowProcA
PostQuitMessage
GetMessageA
UpdateWindow
ShowWindow
CreateWindowExA
LoadAcceleratorsA
RegisterClassExA
LoadCursorA
LoadIconA
TranslateAcceleratorA
SetCursorPos
ClientToScreen
GetAsyncKeyState
ScreenToClient
PostMessageA
KillTimer
GetCursorPos
EndDialog
SendDlgItemMessageA
GetDlgItemTextA
EnableWindow
GetDlgItem
SendMessageA
IsDlgButtonChecked
SetWindowTextA
CheckDlgButton
SetDlgItemTextA
GetParent
CheckRadioButton
GetWindowTextA
GetDlgCtrlID
ChildWindowFromPoint
GetForegroundWindow
ReleaseDC
SetCursor
SetMenuItemInfoA
SetForegroundWindow
GetSystemMetrics
SetRect
GetWindowLongA
AdjustWindowRectEx
SetWindowLongA
SetMenu
SetWindowPos
GetWindowRect
SetTimer
DialogBoxParamA
MessageBoxA
PeekMessageA
TranslateMessage
DispatchMessageA
GetSystemMenu
EnableMenuItem
GetMenuItemCount
DeleteMenu
AppendMenuA
DrawMenuBar
GetMenu
GetSubMenu
CheckMenuRadioItem
GetClientRect
GetDC

gdi32

SetDIBColorTable
SetPaletteEntries
CreateCompatibleDC
BitBlt
DeleteDC
GetStockObject
CreateDCA
CreateDIBSection
DeleteObject
RealizePalette
SelectPalette
CreatePalette
GetDeviceCaps
SelectObject
AnimatePalette
StretchBlt

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegSetValueA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey

shlwapi

PathRemoveArgsA
StrChrA
PathAddBackslashA
PathUnquoteSpacesA
PathRemoveFileSpecA
PathFindFileNameA
PathRemoveExtensionA

shell32

DragAcceptFiles
DragQueryFileA
DragQueryPoint
DragFinish
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc

winmm

timeBeginPeriod
timeEndPeriod
timeGetTime

comctl32

ord17

comdlg32

GetSaveFileNameA
GetOpenFileNameA

wsock32

socket
htonl
bind
listen
accept
WSAGetLastError
WSAAsyncSelect
recv
shutdown
closesocket
ioctlsocket
connect
WSAStartup
send
WSACleanup

ddraw

DirectDrawEnumerateA
DirectDrawCreate

dsound

ord1

dinput

DirectInputCreateA

Sections

.text
Size: 312KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bkDLControl.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

1870592d014da225bf92c949ce61cc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaAryMove
__vbaFreeVar
__vbaAptOffset
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
ord516
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaAryDestruct
__vbaExitProc
__vbaObjSet
__vbaOnError
ord595
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaStrFixstr
__vbaBoolVar
_CIsin
ord709
ord631
ord525
__vbaVarCmpGt
__vbaChkstk
__vbaFileClose
ord526
EVENT_SINK_AddRef
ord528
ord529
__vbaStrCmp
__vbaPutOwner3
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaCastObjVar
_adj_fpatan
__vbaFixstrConstruct
__vbaRecUniToAnsi
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord712
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
ord607
__vbaFPException
__vbaInStrVar
__vbaI2Var
__vbaLsetFixstrFree
ord537
_CIlog
__vbaErrorOverflow
__vbaFileOpen
ord648
__vbaVar2Vec
__vbaInStr
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaStrToAnsi
__vbaVarDup
__vbaFpI4
ord616
ord617
__vbaRecDestructAnsi
_CIatan
__vbaStrMove
ord618
ord619
_allmul
_CItan
ord546
__vbaFpCSngR8
_CIexp
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
game.ico
nesver.ini
new.htm
uninst.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 168KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ButtonEvent.dll
.dll windows:4 windows x86 arch:x86

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalAlloc
lstrcpyA
lstrcpynA
GlobalFree

user32

PostMessageA
CallWindowProcA
GetDlgItem
FindWindowExA
SetWindowLongA
wsprintfA

Exports

Exports

AddEventHandler
Unload
UnsetEventHandler
WhichButtonId

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 503B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MyNsisExtend.dll
.dll windows:4 windows x86 arch:x86

d5fdbf71a74f3a5f78815dc26c4d999f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.3.3\TextAD\build_temp\Win32\compile\release_staticA2\tool\GMNsisExtend\MyNsisExtend.pdb

Imports

shlwapi

PathSkipRootA
PathCombineA
StrStrIA

wininet

InternetOpenUrlA
InternetSetOptionA
InternetSetFilePointer
HttpQueryInfoA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetOpenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

psapi

GetModuleFileNameExA

kernel32

InterlockedExchange
GetLocaleInfoW
TlsFree
TlsSetValue
SetEvent
Sleep
ResetEvent
CreateEventA
ReadFile
GetFileSize
CreateFileA
SetEndOfFile
WriteFile
SetFilePointer
lstrlenA
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
CloseHandle
GetPrivateProfileIntA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrcmpiA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
OpenProcess
DisableThreadLibraryCalls
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExA
lstrcmpA
CreateFileW
GetVersionExA
GetCurrentThreadId
ResumeThread
GetTickCount
CreateToolhelp32Snapshot
Module32First
Process32First
Process32Next
Module32Next
WideCharToMultiByte
MultiByteToWideChar
RemoveDirectoryA
CopyFileA
SetFileAttributesA
CreateDirectoryA
FindNextFileA
FindClose
WriteConsoleA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetVersion
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
LoadLibraryA
GetSystemInfo
GetSystemDirectoryA
lstrcatA
SearchPathA
GetFullPathNameA
GetFileInformationByHandle
GetTempFileNameA
GetTempPathA
GetFileSizeEx
SetCurrentDirectoryA
SetFileTime
MoveFileA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetLongPathNameA
DeviceIoControl
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetFileTime
GetLocaleInfoA
SetConsoleCtrlHandler
InitializeCriticalSection
LCMapStringW
LCMapStringA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
IsValidCodePage
TlsAlloc
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetTimeZoneInformation
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringA
CompareStringW
InterlockedIncrement
SetLastError
InterlockedDecrement
FindFirstFileA
InterlockedCompareExchange
TlsGetValue
CreateThread
ExitThread
GetProcessHeap
GetCommandLineA
HeapAlloc
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RaiseException
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetCurrentThread

user32

ShowWindow
wsprintfA
SetTimer
KillTimer
GetWindowLongA
SystemParametersInfoA
AttachThreadInput
IsWindowVisible
SetWindowTextA
MapWindowPoints
GetForegroundWindow
IsIconic
SetWindowPos
GetWindow
GetWindowTextA
IsZoomed
GetClientRect
GetWindowTextLengthA
SetForegroundWindow
GetWindowRect
GetParent
LoadStringW
GetActiveWindow
GetDlgItem
GetSystemMetrics
EnumThreadWindows
GetClassNameA
SendMessageA
SendMessageTimeoutA
GetWindowThreadProcessId

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegLoadKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegDeleteValueA
RegSaveKeyA
RegRestoreKeyA
RegDeleteKeyA
FreeSid

shell32

ShellExecuteExA
SHGetFolderPathA
ShellExecuteA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddExistAdvertID
AddInsAdvertID
AddToFirewall
AllHomePageChecksOut
ChangeInstDirtoMax
Check360Install
CheckHomeState
CheckInstallLimit
CheckInstalled
CheckKuaibaInstalled
ConvertSoftInstallTime
CreateShortcut
CreateTimer
DestroyTimer
Exec
ExecWait
ForceDeleteFile
Get7zOriginalSize
GetAdvertFileName
GetAdvertID
GetAdvertIDEx
GetAdvertIcon
GetAdvertLocalFile
GetAdvertName
GetAdvertUrl
GetBaiduHomePageURL
GetChromeHomePageURL
GetExeFileNameFromUrl
GetForceAdvertFileName
GetForceAdvertID
GetForceAdvertIDEx
GetForceAdvertLocalFile
GetForceAdvertName
GetForceAdvertUrl
GetHomePageName
GetHomePageName2
GetIEHomePageURL
GetSingleFileSize
GetSougouHomePageURL
GetSpecialBuild
GetSubChannel
HomePageChecksOut
InitPopUpInfo
IsAdvertExist
IsAdvertInstalled
IsAutoRun
IsCurrHomePageURL
LoadEncrypedXML
LoadEncrypedXMLFromUrl
LoadEncrypedXMLFromUrlEx
LoadXMLFromUrl
LoadXml
OpenUrl
PinToTaskbar
PopUp
PopupAD
SendExitInstallStat
SendResearchResult
SetAllHomePage
SetHomePage
SetHomePageUrl
SetUnGameList
TaskKillByHwnd
TaskKillByWindow
UnPinFromTaskBar

Sections

.text
Size: 828KB - Virtual size: 826KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsRandom.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetRandom

Sections

UPX0
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 73B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/$_84_/GMSkin_Image_2012_v1.zip
.zip
skin.xml
skin/Thumbs.db
skin/icon1.png
.png
skin/保存目录.png
.png
skin/关闭.png
.png
skin/协议背景.png
.png
skin/卸载完成.png
.png
skin/卸载完成按钮.png
.png
skin/卸载背景.png
.png
skin/取消.png
.png
skin/图片背景框.png
.png
skin/多选.png
.png
skin/多选2.png
.png
skin/安装.png
.png
skin/安装01.png
.png
skin/安装02.png
.png
skin/安装03.png
.png
skin/安装04.png
.png
skin/安装05.png
.png
skin/安装协议.png
.png
skin/安装完成.png
.png
skin/安装完成按钮.png
.png
skin/完成.png
.png
skin/广告关闭.png
.png
skin/底部背景.png
.png
skin/开始安装.png
.png
skin/按钮.png
.png
skin/最小化.png
.png
skin/最小化2.png
.png
skin/格子.png
.png
skin/欢迎.png
.png
skin/浏览.png
.png
skin/游戏弹出.png
.png
skin/立即卸载.png
.png
skin/软件弹出.png
.png
skin/进度条.png
.png
skin/进度条背景.png
.png
skin/退出.png
.png
skin/选项.png
.png
skin/默认背景.png
.png
$TEMP/$_84_/MyNsisExtend.dll
.dll windows:4 windows x86 arch:x86

d5fdbf71a74f3a5f78815dc26c4d999f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.3.3\TextAD\build_temp\Win32\compile\release_staticA2\tool\GMNsisExtend\MyNsisExtend.pdb

Imports

shlwapi

PathSkipRootA
PathCombineA
StrStrIA

wininet

InternetOpenUrlA
InternetSetOptionA
InternetSetFilePointer
HttpQueryInfoA
InternetCloseHandle
HttpOpenRequestA
HttpSendRequestA
InternetConnectA
InternetReadFile
InternetOpenA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

psapi

GetModuleFileNameExA

kernel32

InterlockedExchange
GetLocaleInfoW
TlsFree
TlsSetValue
SetEvent
Sleep
ResetEvent
CreateEventA
ReadFile
GetFileSize
CreateFileA
SetEndOfFile
WriteFile
SetFilePointer
lstrlenA
GetPrivateProfileStringA
WritePrivateProfileStringA
DeleteFileA
CloseHandle
GetPrivateProfileIntA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrcmpiA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
GetLastError
CreateProcessA
OpenProcess
DisableThreadLibraryCalls
GetFileAttributesA
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
MoveFileExA
lstrcmpA
CreateFileW
GetVersionExA
GetCurrentThreadId
ResumeThread
GetTickCount
CreateToolhelp32Snapshot
Module32First
Process32First
Process32Next
Module32Next
WideCharToMultiByte
MultiByteToWideChar
RemoveDirectoryA
CopyFileA
SetFileAttributesA
CreateDirectoryA
FindNextFileA
FindClose
WriteConsoleA
ExpandEnvironmentStringsA
SetEnvironmentVariableA
GetVersion
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
LoadLibraryA
GetSystemInfo
GetSystemDirectoryA
lstrcatA
SearchPathA
GetFullPathNameA
GetFileInformationByHandle
GetTempFileNameA
GetTempPathA
GetFileSizeEx
SetCurrentDirectoryA
SetFileTime
MoveFileA
GetCurrentDirectoryA
GetWindowsDirectoryA
GetLongPathNameA
DeviceIoControl
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetFileTime
GetLocaleInfoA
SetConsoleCtrlHandler
InitializeCriticalSection
LCMapStringW
LCMapStringA
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
IsValidCodePage
TlsAlloc
GetOEMCP
GetACP
GetCPInfo
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
ExitProcess
GetTimeZoneInformation
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
CompareStringA
CompareStringW
InterlockedIncrement
SetLastError
InterlockedDecrement
FindFirstFileA
InterlockedCompareExchange
TlsGetValue
CreateThread
ExitThread
GetProcessHeap
GetCommandLineA
HeapAlloc
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RaiseException
RtlUnwind
HeapFree
GetSystemTimeAsFileTime
GetCurrentThread

user32

ShowWindow
wsprintfA
SetTimer
KillTimer
GetWindowLongA
SystemParametersInfoA
AttachThreadInput
IsWindowVisible
SetWindowTextA
MapWindowPoints
GetForegroundWindow
IsIconic
SetWindowPos
GetWindow
GetWindowTextA
IsZoomed
GetClientRect
GetWindowTextLengthA
SetForegroundWindow
GetWindowRect
GetParent
LoadStringW
GetActiveWindow
GetDlgItem
GetSystemMetrics
EnumThreadWindows
GetClassNameA
SendMessageA
SendMessageTimeoutA
GetWindowThreadProcessId

advapi32

AllocateAndInitializeSid
CheckTokenMembership
RegCloseKey
RegCreateKeyExA
RegQueryInfoKeyA
RegQueryValueExA
RegSetValueExA
RegLoadKeyA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegDeleteValueA
RegSaveKeyA
RegRestoreKeyA
RegDeleteKeyA
FreeSid

shell32

ShellExecuteExA
SHGetFolderPathA
ShellExecuteA
SHGetSpecialFolderPathA
SHBrowseForFolderA
SHGetPathFromIDListA

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddExistAdvertID
AddInsAdvertID
AddToFirewall
AllHomePageChecksOut
ChangeInstDirtoMax
Check360Install
CheckHomeState
CheckInstallLimit
CheckInstalled
CheckKuaibaInstalled
ConvertSoftInstallTime
CreateShortcut
CreateTimer
DestroyTimer
Exec
ExecWait
ForceDeleteFile
Get7zOriginalSize
GetAdvertFileName
GetAdvertID
GetAdvertIDEx
GetAdvertIcon
GetAdvertLocalFile
GetAdvertName
GetAdvertUrl
GetBaiduHomePageURL
GetChromeHomePageURL
GetExeFileNameFromUrl
GetForceAdvertFileName
GetForceAdvertID
GetForceAdvertIDEx
GetForceAdvertLocalFile
GetForceAdvertName
GetForceAdvertUrl
GetHomePageName
GetHomePageName2
GetIEHomePageURL
GetSingleFileSize
GetSougouHomePageURL
GetSpecialBuild
GetSubChannel
HomePageChecksOut
InitPopUpInfo
IsAdvertExist
IsAdvertInstalled
IsAutoRun
IsCurrHomePageURL
LoadEncrypedXML
LoadEncrypedXMLFromUrl
LoadEncrypedXMLFromUrlEx
LoadXMLFromUrl
LoadXml
OpenUrl
PinToTaskbar
PopUp
PopupAD
SendExitInstallStat
SendResearchResult
SetAllHomePage
SetHomePage
SetHomePageUrl
SetUnGameList
TaskKillByHwnd
TaskKillByWindow
UnPinFromTaskBar

Sections

.text
Size: 828KB - Virtual size: 826KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_84_/MyNsisSkin.dll
.dll windows:4 windows x86 arch:x86

8b2c18b411d31cbef33f61e5be07509a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\SVN\v2.2\install\build\MSVC.2005\Tool\GMSkin\release_static2\MyNsisSkin.pdb

Imports

msimg32

TransparentBlt
AlphaBlend

kernel32

DosDateTimeToFileTime
CreateDirectoryW
GetCurrentDirectoryW
SetFileTime
WriteFile
SetEndOfFile
GetLastError
GetFileTime
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTimeZoneInformation
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
LCMapStringW
SystemTimeToFileTime
InitializeCriticalSection
LoadLibraryA
InterlockedExchange
FreeLibrary
SetConsoleCtrlHandler
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
VirtualAlloc
EnterCriticalSection
FatalAppExitA
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
GetCurrentProcess
DuplicateHandle
GetFileType
SetFilePointer
WideCharToMultiByte
lstrcpyW
GetCurrentThreadId
MulDiv
lstrcatW
CreateFileW
GetFileSize
CreateFileA
ReadFile
CloseHandle
MultiByteToWideChar
lstrcmpiW
DisableThreadLibraryCalls
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
HeapCreate
HeapDestroy
RaiseException
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapReAlloc
HeapAlloc
GetCommandLineA
GetVersionExA
GetProcessHeap
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
Sleep
HeapSize
ExitProcess

user32

ScreenToClient
ClientToScreen
UpdateWindow
SetWindowsHookExW
CallNextHookEx
UnhookWindowsHookEx
SetWindowTextW
CharNextW
InvalidateRect
EnumChildWindows
SetCapture
ReleaseCapture
ShowWindow
SetWindowRgn
OffsetRect
wsprintfW
GetSystemMetrics
SetWindowPos
GetSystemMenu
GetMenuItemInfoW
PostMessageW
PtInRect
SetTimer
GetClassNameW
GetParent
MapWindowPoints
SetPropW
CallWindowProcW
GetPropW
DefWindowProcW
GetClientRect
GetWindowRect
IsWindow
GetWindowLongW
LoadCursorW
SetCursor
TrackMouseEvent
BeginPaint
EndPaint
IsWindowEnabled
GetWindowTextW
SendMessageW
DrawTextW
SetWindowLongW
GetCursorPos
KillTimer

gdi32

CreatePen
SetStretchBltMode
StretchBlt
CreateFontIndirectW
CreateDIBSection
SetBkColor
CreateSolidBrush
CreateRoundRectRgn
RoundRect
GetStockObject
GetObjectW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
SetBkMode
SetTextColor
BitBlt
DeleteObject

oleaut32

SysFreeString

Exports

Exports

AddShowImage
AddShowImageFromFile
AddShowText
ClearAllShow
DelShowImage
DelShowText
InitSkin
SetBkImage
SetBtnImage
SetCloseBtnImage
SetEditBkColor
SetProgressBKImage
SetProgressImage
SetProgressTextWindow
SetTextClr
SetWindowID
SlideOff
SlideOn

Sections

.text
Size: 260KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/$_84_/unconfig.dat
ս޵а.exe
.exe windows:4 windows x86 arch:x86

7a1d7915c5672e105e5b515bd1f9b7f7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\work\GMApps\GMStartGame\bin\win32\release\startgame.pdb

Imports

wininet

InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetCloseHandle
InternetSetOptionW
InternetReadFile

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

msimg32

AlphaBlend

comctl32

_TrackMouseEvent

riched20

ord4

kernel32

CreateDirectoryW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
GetCurrentThreadId
ResumeThread
ResetEvent
SetEvent
CreateEventW
MultiByteToWideChar
WideCharToMultiByte
FindNextFileW
FindFirstFileW
FindClose
FreeLibrary
GetProcAddress
LoadLibraryW
GetWindowsDirectoryW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetLongPathNameW
MoveFileW
GetFullPathNameW
MoveFileExW
GetSystemInfo
GetVersionExW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
GetEnvironmentVariableW
VirtualProtectEx
VirtualAllocEx
WriteProcessMemory
VirtualQueryEx
ReadProcessMemory
TerminateProcess
SetLastError
GetTempFileNameW
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentProcess
MulDiv
InterlockedDecrement
InterlockedIncrement
FreeResource
FindResourceW
LoadResource
LockResource
SizeofResource
HeapFree
GetProcessHeap
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetStringTypeW
GetStringTypeA
ExitProcess
GetModuleHandleA
GetCPInfo
LCMapStringW
LCMapStringA
RaiseException
HeapReAlloc
RtlUnwind
CreateThread
ExitThread
GetStartupInfoW
GetVersionExA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapAlloc
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
SetHandleCount
GetFileType
GetStartupInfoA
GetTimeZoneInformation
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
SetEnvironmentVariableW
lstrcmpW
GetCommandLineW
GetModuleHandleW
GetModuleFileNameW
FreeEnvironmentStringsW
GetTempPathW
FlushFileBuffers
Sleep
GetLocalTime
GetEnvironmentStringsW
GetLastError
OpenMutexW
OpenProcess
ReleaseMutex
CreateMutexW
GetExitCodeProcess
lstrlenW
GetFileSize
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrlenA
WritePrivateProfileStringW
CreateFileW
SetFilePointer
ReadFile
DeleteFileW
SetEndOfFile
WriteFile
CreateProcessW
WaitForSingleObject
CloseHandle
GetTickCount
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameA
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalFree

user32

SetCapture
MonitorFromWindow
GetUpdateRect
TranslateAcceleratorW
GetCursorPos
UpdateLayeredWindow
SetWindowRgn
IsWindowEnabled
GetKeyState
HideCaret
ScreenToClient
IsWindow
CreateWindowExW
RegisterClassExW
RegisterClassW
SendMessageW
GetMessageW
EnableWindow
SetFocus
LoadImageW
DestroyIcon
GetClassInfoExW
CharNextA
MoveWindow
ReleaseDC
RedrawWindow
GetDC
SetCursor
DrawFocusRect
LoadCursorW
IsRectEmpty
IntersectRect
DestroyWindow
EndPaint
SetCaretPos
BeginPaint
ReleaseCapture
GetMonitorInfoW
ShowCaret
GetFocus
InvalidateRect
LoadStringW
GetActiveWindow
IsChild
MapWindowPoints
GetWindowTextW
IsZoomed
GetWindowTextLengthW
SetForegroundWindow
GetWindowRect
GetParent
AttachThreadInput
IsIconic
SetWindowTextW
GetWindowThreadProcessId
CreateCaret
LoadBitmapW
OffsetRect
CopyImage
DrawIconEx
DrawTextW
GetAsyncKeyState
ChildWindowFromPointEx
CharNextW
SetWindowsHookExW
EnumThreadWindows
FindWindowW
MessageBoxW
GetForegroundWindow
GetSystemMetrics
ShowWindow
IsWindowVisible
PostQuitMessage
CallNextHookEx
GetDesktopWindow
GetClientRect
SystemParametersInfoW
wsprintfA
wsprintfW
SetWindowPos
PostMessageW
KillTimer
TranslateMessage
PeekMessageW
DispatchMessageW
SetTimer
CallWindowProcW
DefWindowProcW
SetPropW
GetClassNameW
SetWindowLongW
GetPropW
GetWindow
GetWindowLongW
ClientToScreen
GetSysColor
CreateAcceleratorTableW
InvalidateRgn
DestroyAcceleratorTable
FillRect
CharPrevW
PtInRect

gdi32

CreateRoundRectRgn
EnumFontsW
GetTextExtentPoint32W
SetBkMode
CombineRgn
CreateRectRgn
Rectangle
DeleteDC
SetBitmapBits
RoundRect
GetBitmapBits
ExtTextOutW
CreateSolidBrush
GetClipBox
SetBkColor
SetStretchBltMode
SelectClipRgn
GetCharABCWidthsW
StretchBlt
CreateCompatibleBitmap
CreateDIBSection
ExtSelectClipRgn
CreateFontIndirectW
GetTextMetricsW
CreatePen
CreateEllipticRgn
MoveToEx
LineTo
GetStockObject
BitBlt
CreateCompatibleDC
CreateRectRgnIndirect
GetDeviceCaps
DeleteObject
GetObjectW
TextOutW
SelectObject
SetTextColor

advapi32

RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
CoUninitialize
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
OleLockRunning
DoDragDrop
CreateStreamOnHGlobal
OleDuplicateData
ReleaseStgMedium

oleaut32

SysAllocString
SysFreeString
OleLoadPicture

shlwapi

StrStrIA
StrStrIW

Sections

.text
Size: 840KB - Virtual size: 839KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 160KB - Virtual size: 157KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ս޵а.nes

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 168KB

.rsrc Size: 8KB - Virtual size: 7KB

0ece15e7d9bb35972aec701f46192460

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 512B - Virtual size: 503B

.data Size: 512B - Virtual size: 128B

.reloc Size: 512B - Virtual size: 220B

d5fdbf71a74f3a5f78815dc26c4d999f

Headers

File Characteristics

PDB Paths

Imports

shlwapi

wininet

version

psapi

kernel32

user32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 828KB - Virtual size: 826KB

.rdata Size: 112KB - Virtual size: 109KB

.data Size: 16KB - Virtual size: 33KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 36KB - Virtual size: 34KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 168KB

.rsrc
Size: 8KB - Virtual size: 7KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 512B - Virtual size: 503B

.data
Size: 512B - Virtual size: 128B

.reloc
Size: 512B - Virtual size: 220B

.text
Size: 828KB - Virtual size: 826KB

.rdata
Size: 112KB - Virtual size: 109KB

.data
Size: 16KB - Virtual size: 33KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 36KB - Virtual size: 34KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

UPX0
Size: - Virtual size: 44KB

UPX1
Size: 19KB - Virtual size: 20KB

.rsrc
Size: 1024B - Virtual size: 4KB

CODE
Size: 28KB - Virtual size: 28KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 1KB

.edata
Size: 512B - Virtual size: 73B

.reloc
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 260KB - Virtual size: 258KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 8KB - Virtual size: 13KB

.rsrc
Size: 4KB - Virtual size: 744B

.reloc
Size: 12KB - Virtual size: 9KB