KNV671116[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

KNV671116.zip
Size

127.6MB
MD5

f2d7312355a9865045c03ab926b5fe6c
SHA1

74049572d79aed8f53327f43bdfa213f35df8de2
SHA256

92853b65366d780bd7e3a7140cb645059f8faad7c70eacc8115a171baf11093f
SHA512

0e47625c06189408be38ef65bb3e86adcd514cceab62e8152391c19f3da7c03c35d64dbec08588d43df313228c28eb813481eabe1554f1bdadc453ccb5ba1c49
SSDEEP

3145728:bB5Y+cgNw9N+1VHTdlUX/9+CvfK5bjpUpEJDpSsZdVunq46vF:TkMwDutdlKfK3UpuDpSYzEq46vF

Score

3^/10

pdf link

Malware Config

Signatures

One or more HTTP URLs in PDF identified
Detects presence of HTTP links in PDF files.
pdf link

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/AddOn/MainTargetAddOn.dll
unpack001/KmInst32.exe
unpack001/KmInst64.exe

Files

KNV671116.zip
.zip
AddOn/MainTarget.ini
AddOn/MainTargetAddOn.dll
.dll windows:5 windows x86 arch:x86

f4a6e13ef282a471bc88356e7c67a541

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Workspace\Projects\Windows\Installer\KmUtilInstaller v4.0\ReleaseAll2\AddOn\MainTargetAddOn.pdb

Imports

kernel32

GlobalUnlock
GlobalFree
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEndOfFile
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
HeapSize
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ExitProcess
GlobalAlloc
VirtualAlloc
VirtualFree
HeapDestroy
HeapCreate
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringA
LCMapStringW
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
RaiseException
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
GlobalLock
LocalFileTimeToFileTime
GetCurrentDirectoryW
WriteFile
SystemTimeToFileTime
SetFilePointer
MulDiv
Sleep
GetWindowsDirectoryW
OutputDebugStringW
GetModuleHandleA
GetModuleFileNameA
SetLastError
GetTimeZoneInformation
GetSystemDirectoryA
GetVersionExW
GetSystemDirectoryW
GetWindowsDirectoryA
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
GetDiskFreeSpaceExW
lstrlenW
GetLogicalDriveStringsW
GetDriveTypeW
ReadFile
LoadLibraryA
GetProcAddress
lstrcpyA
CloseHandle
GetLocalTime
GetLastError
MultiByteToWideChar
GetACP
CreateFileW
WideCharToMultiByte
GetFileSize
CreateFileA
SetCurrentDirectoryW
LockResource
GetModuleFileNameW
SizeofResource
LoadResource
FindResourceW
FreeResource
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetCurrentThreadId
OutputDebugStringA
HeapReAlloc

user32

CallWindowProcW
SendMessageW
DefWindowProcW
UpdateWindow
GetPropW
ScreenToClient
SetWindowPos
FillRect
CreateDialogIndirectParamW
CreateDialogParamW
SetFocus
EndDialog
EnableWindow
SendMessageA
MessageBoxA
SetWindowTextA
SetCursor
LoadCursorW
SetWindowLongW
MapWindowPoints
ShowWindow
SetWindowTextW
MoveWindow
GetWindowLongW
GetDlgItem
wsprintfA
wvsprintfA
LoadImageW
LoadBitmapW
MessageBoxW
EndPaint
RemovePropW
GetWindowRect
PostMessageW
BeginPaint
wsprintfW
SetPropW
GetDC
InvalidateRect
GetWindowTextW
ReleaseDC

gdi32

CreateFontA
CreateFontW
EnumFontFamiliesExW
GetStockObject
CreateDIBSection
CreateSolidBrush
BitBlt
DeleteDC
GetDeviceCaps
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW
SHGetPathFromIDListW

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

netapi32

NetUseEnum
NetApiBufferFree

shlwapi

PathIsDirectoryW
PathIsDirectoryEmptyW

Exports

Exports

CreatePlugin

Sections

.text
Size: 142KB - Virtual size: 141KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Documents/KxRun.exe
.exe windows:6 windows x86 arch:x86

b34132414165667a8ef9756635b683e6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-09-2022 00:00

Not After

18-11-2023 23:59

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

97:e3:11:60:55:64:c2:17:66:0d:1a:08:c6:73:e9:0e:53:5e:25:0b:5b:cb:d6:62:ca:8b:7c:28:ba:aa:29:c6
Signer

Actual PE Digest

97:e3:11:60:55:64:c2:17:66:0d:1a:08:c6:73:e9:0e:53:5e:25:0b:5b:cb:d6:62:ca:8b:7c:28:ba:aa:29:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Perforce\depot\Projects\Windows\Installer\Tools\KxRun\Release\KxRun.pdb

Imports

kernel32

InterlockedDecrement
GetModuleHandleW
OpenProcess
Sleep
lstrlenA
WriteConsoleW
LocalFree
HeapReAlloc
LoadLibraryExW
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringEx
GetWindowsDirectoryW
GetModuleHandleA
GetProcAddress
SetLastError
GetSystemDirectoryA
GetModuleFileNameW
GetVersionExW
GetSystemDirectoryW
GetWindowsDirectoryA
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetLocaleInfoA
CloseHandle
GetLocalTime
GetLastError
MultiByteToWideChar
GetACP
CreateFileW
WideCharToMultiByte
OutputDebugStringW
LoadLibraryW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
WriteFile
HeapSize
GetModuleHandleExW
ExitProcess
InitOnceExecuteOnce
DeleteCriticalSection
GetFileType
GetStdHandle
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetStartupInfoW
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
GetCommandLineW
InterlockedIncrement
IsValidCodePage
GetOEMCP
GetCPInfo

user32

wsprintfW
GetWindowThreadProcessId
GetShellWindow

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RevertToSelf
ImpersonateLoggedOnUser
LookupAccountSidW
GetTokenInformation
OpenProcessToken

shell32

ShellExecuteW

ole32

CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance

oleaut32

SysFreeString
VariantInit
VariantClear
SysAllocString

shlwapi

AssocQueryStringW

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Documents/Net Viewer User Guide DE.pdf
.pdf
- http://.xmloder.zip
- http://GebenSieggf.im
- http://grupo.es
- http://hlenSieimDialogfeldAdressbucheinenKontaktodereineGruppeausundklickenSiedannaufEigenschaften.4BearbeitenSiedieInformationenimDialogfeldKontakteinstellungenbzw.im
- http://hnis.ist
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
- Show all
Documents/Net Viewer User Guide EN.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://kyoceradocumentsolutions.com
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide ES.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide FR.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide IT.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://kyoceradocumentsolutions.com
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide JA.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://kyoceradocumentsolutions.com
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide NL.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://kyoceradocumentsolutions.com
- http://nalsstandaarddomein.6SelecteereenServertypeuitdelijst.AlshetservertypenietExt.is
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- http://xporteerduitversie4.x.is
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
- Show all
Documents/Net Viewer User Guide PT.pdf
.pdf
- http://grupo.es
- http://hnis.ist
- http://kyoceradocumentsolutions.com
- http://www.kyoceradocumentsolutions.com/company/directory.html
- http://www.kyoceradocumentsolutions.com/company/directory.htmlA
- https://www.kyoceradocumentsolutions.co.jp/company/japan/outline.html
- https://www.kyoceradocumentsolutions.com/company/directory.html
- https://www.kyoceradocumentsolutions.com/company/directory.htmlKyocera
Documents/Net Viewer User Guide RU.pdf
.pdf
Files/kxLogo.png
.png
Files/root_cert.pem
KMNV.dll
.dll windows:6 windows x86 arch:x86

f27fee332eb670717dd910504291f821

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-09-2022 00:00

Not After

18-11-2023 23:59

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:ab:44:8c:64:6d:7b:65:6f:a9:a2:52:c6:cc:d4:dd:84:ca:82:1a:bf:ff:86:7c:7c:21:1b:81:34:b8:86:03
Signer

Actual PE Digest

c5:ab:44:8c:64:6d:7b:65:6f:a9:a2:52:c6:cc:d4:dd:84:ca:82:1a:bf:ff:86:7c:7c:21:1b:81:34:b8:86:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\cahuloganjd\Desktop\Workload\depot\KMNV_DLL\Src\KMNV\Release\KMNV.pdb

Imports

kernel32

LCMapStringEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetFilePointerEx
ReadConsoleW
GetConsoleMode
InitOnceExecuteOnce
DeleteCriticalSection
GetFileType
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetConsoleCP
GetModuleHandleExW
ExitProcess
GetStartupInfoW
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStdHandle
RaiseException
GetCPInfo
GetOEMCP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
SetStdHandle
FlushFileBuffers
HeapReAlloc
WriteConsoleW
HeapSize
GlobalFree
GlobalUnlock
GlobalAlloc
GlobalLock
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
SetFileTime
SystemTimeToFileTime
WriteFile
GetFileSize
GetTickCount
GetModuleHandleW
MulDiv
Sleep
OpenProcess
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
GetModuleHandleA
GetModuleFileNameA
SetLastError
GetTimeZoneInformation
GetSystemDirectoryA
CopyFileW
LoadLibraryW
GetSystemDirectoryW
GetWindowsDirectoryA
GetProcessHeap
CreateDirectoryW
HeapFree
GetCurrentProcess
MoveFileExW
HeapAlloc
GetLocaleInfoA
GetTempFileNameW
SetFilePointer
lstrcpyA
OutputDebugStringA
GetLocalTime
MultiByteToWideChar
GetACP
WideCharToMultiByte
OutputDebugStringW
CreateFileA
CreateThread
LocalFree
LockResource
GetTempPathW
GetModuleFileNameW
SizeofResource
CreateProcessW
LoadResource
FindResourceW
FreeResource
LocalAlloc
GetProcAddress
GetVersionExW
LoadLibraryExW
FreeLibrary
SetErrorMode
CloseHandle
GetLastError
CreateFileW
ReadFile
EnterCriticalSection

user32

IsDlgButtonChecked
SetWindowTextW
wsprintfW
ShowWindow
CheckDlgButton
SetWindowPos
GetDlgItem
GetWindowRect
DefWindowProcW
MessageBoxW
CreateWindowExW
SetWindowLongW
FillRect
CreateDialogIndirectParamW
CreateDialogParamW
EndPaint
BeginPaint
SetFocus
EndDialog
EnableWindow
SendMessageA
GetDC
SetWindowTextA
SendMessageW
SetCursor
MapWindowPoints
ScreenToClient
wsprintfA
wvsprintfA
GetMessageW
TranslateMessage
IsDialogMessageW
DispatchMessageW
DestroyWindow
PostQuitMessage
UnregisterClassW
PostMessageW
LoadCursorW
GetClassInfoExW
RegisterClassExW
GetWindowLongW

gdi32

CreateFontA
GetDeviceCaps
CreateFontW
BitBlt
DeleteDC
CreateDIBSection
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectW
SetBkColor
CreateSolidBrush

advapi32

CreateWellKnownSid
AddAccessAllowedAceEx
GetAclInformation
SetNamedSecurityInfoW
GetAce
GetNamedSecurityInfoW
InitializeAcl
AddAce
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
GetLengthSid

shell32

SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc

ole32

StringFromGUID2
CoCreateGuid
CLSIDFromString

crypt32

CertCloseStore
CertAddCertificateContextToStore
CryptMemFree
CryptMemAlloc
CertOpenStore
CryptStringToBinaryA
CertCreateCertificateContext

comctl32

InitCommonControlsEx

msimg32

AlphaBlend

lz32

LZOpenFileW
LZClose
LZCopy

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Exports

Exports

CreatePlugin

Sections

.text
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 177KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KMNV.pnf
KMNVUnzip.pnf
KMNV_AccountingManagement.pnf
KMNV_DeviceManagement.pnf
KMNV_HostManagement.pnf
KNV LA/License_DE.rtf
.rtf
KNV LA/License_EN.rtf
.rtf
KNV LA/License_ES.rtf
.rtf
KNV LA/License_FR.rtf
.rtf
KNV LA/License_IT.rtf
.rtf
KNV LA/License_JA.rtf
.rtf
KNV LA/License_KO.rtf
.rtf
KNV LA/License_NL.rtf
.rtf
KNV LA/License_PT-BR.rtf
.rtf
KNV LA/License_RU.rtf
.rtf
KNV LA/License_SCH.rtf
.rtf
KNV LA/License_TCH.rtf
.rtf
KNV/Netviewer.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-09-2022 00:00

Not After

18-11-2023 23:59

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:ad:61:37:34:ad:c6:2c:06:3b:e4:81:d6:d6:8a:5b:25:96:8d:14:38:22:2e:85:08:d7:a6:f6:ae:ed:20:fd
Signer

Actual PE Digest

be:ad:61:37:34:ad:c6:2c:06:3b:e4:81:d6:d6:8a:5b:25:96:8d:14:38:22:2e:85:08:d7:a6:f6:ae:ed:20:fd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Workspace\KNV\r6.X\Main\Src\Core\CoreMain\obj\Release\Netviewer.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KNV/Netviewer.exe.config
.xml
KNV/knv.zip
.zip
KmInst32.exe
.exe windows:5 windows x86 arch:x86

b242fcecbc25bcc8626bb3972eba1605

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringA
GetLocalTime
lstrcpyA
OutputDebugStringW
InterlockedDecrement
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
GetShortPathNameA
MoveFileExW
GetTempFileNameW
GetTimeZoneInformation
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
LoadLibraryA
lstrlenA
SetEndOfFile
InitializeCriticalSectionAndSpinCount
SetFileTime
GetStringTypeW
CreateNamedPipeW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
ExitProcess
LCMapStringA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
HeapReAlloc
VirtualAlloc
DeleteCriticalSection
VirtualFree
HeapCreate
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentThreadId
InterlockedIncrement
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
GetFileAttributesW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
RaiseException
RtlUnwind
GlobalAlloc
GlobalFree
OpenProcess
FlushFileBuffers
CreateThread
GetStringTypeA
ExitThread
DisconnectNamedPipe
GetSystemWow64DirectoryW
GetCurrentDirectoryW
GetTempPathW
GetLocaleInfoW
GetModuleHandleA
GetTickCount
FormatMessageW
lstrlenW
HeapAlloc
GetFileInformationByHandle
GetLastError
FileTimeToLocalFileTime
CompareFileTime
MoveFileW
GetModuleHandleW
GetProcessHeap
HeapFree
GetSystemWindowsDirectoryW
CopyFileW
SetFilePointer
CreateFileA
GetFileSize
RemoveDirectoryW
CreateProcessW
GetExitCodeProcess
GetFullPathNameW
GetWindowsDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
FindNextFileW
CreateFileW
CloseHandle
ReadFile
WriteFile
GetModuleFileNameW
GetCurrentProcess
DeleteFileW
CreateDirectoryW
FindClose
FindFirstFileW
GetSystemDirectoryW
GetACP
GetVersionExW
SetFileAttributesW
Sleep
HeapSize

user32

UpdateWindow
wsprintfA
SendMessageW
GetWindowRect
wsprintfW
PostQuitMessage
GetWindowLongW
DefWindowProcW
GetClientRect
GetAncestor
ShowWindow
SetWindowLongW
GetDC
CreateWindowExW
RegisterClassW
LoadCursorW
LoadIconW
ReleaseDC
DispatchMessageW
DestroyWindow
SendNotifyMessageW
GetDesktopWindow
PostMessageW
GetWindowThreadProcessId
TranslateMessage
GetMessageW
IsWindow
SendMessageTimeoutW
wvsprintfA
GetDlgCtrlID
GetClassNameA
EnumWindows
EnumChildWindows
GetWindowTextW
GetWindowTextA

gdi32

GetStockObject
DeleteObject
AddFontResourceW
EnumFontFamiliesExW
RemoveFontResourceW

winspool.drv

DeletePrinterConnectionW
OpenPrinterW
DeletePrinter
ClosePrinter
GetPrinterDriverDirectoryW
DeleteMonitorW
SetPrinterDataW
EnumPrintersW
AddMonitorW
EnumPrinterDriversW
AddPortW
PrinterProperties
DeletePortW
GetPrinterW
SetPrinterDataExW
GetPrinterDataExW
ord204
AddPrinterW
SetPrinterW
AddPrinterDriverW
DeletePrinterDriverW
DeletePrinterDriverExW
EnumJobsW
EnumMonitorsW
AddPrinterConnectionW
DocumentPropertiesW
EnumPortsW

advapi32

RegQueryInfoKeyW
QueryServiceStatus
DeleteService
CreateServiceW
RegCreateKeyExW
RegSetValueExW
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
ControlService
OpenServiceW
QueryServiceConfigW
StartServiceW
OpenSCManagerW
CloseServiceHandle
RegConnectRegistryW
RegCloseKey
RegDeleteKeyW
RegEnumValueW
RegEnumKeyW
RegDeleteValueW

shell32

SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetPathFromIDListW
SHGetMalloc
SHChangeNotify

ole32

CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromString
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
PropVariantClear

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
SysFreeString
SysAllocString

setupapi

SetupDiCreateDeviceInfoList
SetupFindNextMatchLineW
SetupIterateCabinetW
SetupCopyOEMInfW
SetupGetLineCountW
SetupOpenInfFileW
SetupCloseInfFile
SetupGetLineByIndexW
SetupOpenAppendInfFileW
SetupGetIntField
SetupFindFirstLineW
SetupGetStringFieldW
SetupDiRemoveDevice
SetupDiGetINFClassW
SetupDiGetDeviceRegistryPropertyW
SetupDiCreateDeviceInfoW
SetupDiCallClassInstaller
SetupDiGetDeviceInstanceIdW
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiSetDeviceRegistryPropertyW
SetupDiDeleteDeviceInfo

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertGetNameStringW
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey

mscms

GetColorDirectoryW

lz32

LZOpenFileW
LZClose
LZCopy

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueA

Sections

.text
Size: 420KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KmInst64.exe
.exe windows:5 windows x64 arch:x64

4e674d9e52d3f792d2524ccfc1a61e2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VerifyVersionInfoW
VerSetConditionMask
OutputDebugStringA
GetLocalTime
lstrcpyA
OutputDebugStringW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
GetShortPathNameA
MoveFileExW
GetTempFileNameW
GetTimeZoneInformation
GetSystemDirectoryA
SetLastError
GetModuleFileNameA
LoadLibraryA
lstrlenA
HeapReAlloc
SetEndOfFile
InitializeCriticalSectionAndSpinCount
SetFileTime
GetStringTypeW
GetStringTypeA
HeapSize
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
CreateNamedPipeW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
ExitProcess
LCMapStringA
DeleteCriticalSection
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
LCMapStringW
HeapCreate
HeapSetInformation
FlsAlloc
GetCurrentThreadId
FlsFree
FlsSetValue
FlsGetValue
DecodePointer
EncodePointer
IsValidCodePage
GetOEMCP
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
GetFileAttributesW
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
RtlPcToFileHeader
RaiseException
RtlUnwindEx
RtlLookupFunctionEntry
GlobalAlloc
GlobalFree
OpenProcess
FlushFileBuffers
CreateThread
GetCurrentDirectoryW
ExitThread
GetTempPathW
GetLocaleInfoW
GetModuleHandleA
GetTickCount
FormatMessageW
lstrlenW
HeapAlloc
DisconnectNamedPipe
FreeEnvironmentStringsW
GetSystemWow64DirectoryW
GetLastError
GetFileInformationByHandle
FileTimeToLocalFileTime
CompareFileTime
MoveFileW
GetModuleHandleW
GetProcessHeap
HeapFree
GetSystemWindowsDirectoryW
CopyFileW
SetFilePointer
CreateFileA
GetFileSize
RemoveDirectoryW
CreateProcessW
GetExitCodeProcess
GetFullPathNameW
GetWindowsDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
FindNextFileW
CreateFileW
CloseHandle
ReadFile
WriteFile
GetModuleFileNameW
GetCurrentProcess
DeleteFileW
FindFirstFileW
CreateDirectoryW
FindClose
GetSystemDirectoryW
GetACP
GetVersionExW
SetFileAttributesW
Sleep
GetCurrentProcessId

user32

SendMessageW
GetWindowRect
wsprintfW
SendNotifyMessageW
GetDesktopWindow
PostMessageW
GetDC
DestroyWindow
GetWindowThreadProcessId
GetAncestor
GetClientRect
DefWindowProcW
GetWindowLongPtrW
PostQuitMessage
wsprintfA
ReleaseDC
UpdateWindow
ShowWindow
SetWindowLongPtrW
CreateWindowExW
RegisterClassW
wvsprintfA
GetDlgCtrlID
GetClassNameA
GetWindowTextA
LoadCursorW
LoadIconW
DispatchMessageW
TranslateMessage
GetMessageW
IsWindow
SendMessageTimeoutW
EnumWindows
EnumChildWindows
GetWindowTextW

gdi32

GetStockObject
DeleteObject
AddFontResourceW
EnumFontFamiliesExW
RemoveFontResourceW

winspool.drv

AddMonitorW
DeleteMonitorW
GetPrinterDriverDirectoryW
ClosePrinter
DeletePrinter
OpenPrinterW
EnumPrintersW
SetPrinterDataW
DeletePrinterConnectionW
EnumPrinterDriversW
AddPortW
EnumJobsW
DeletePrinterDriverExW
DeletePrinterDriverW
AddPrinterDriverW
SetPrinterW
DeletePortW
EnumPortsW
GetPrinterW
SetPrinterDataExW
GetPrinterDataExW
ord204
AddPrinterW
EnumMonitorsW
AddPrinterConnectionW
DocumentPropertiesW
PrinterProperties

advapi32

RegCloseKey
RegEnumValueW
RegQueryInfoKeyW
QueryServiceStatus
DeleteService
CreateServiceW
RegCreateKeyExW
RegSetValueExW
CryptReleaseContext
RegOpenKeyExW
RegQueryValueExW
ControlService
OpenServiceW
QueryServiceConfigW
StartServiceW
OpenSCManagerW
CloseServiceHandle
RegConnectRegistryW
RegDeleteValueW
RegDeleteKeyW
RegEnumKeyW

shell32

SHChangeNotify
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW

ole32

CoInitializeSecurity
CoSetProxyBlanket
CLSIDFromString
PropVariantClear
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance

oleaut32

SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
VariantInit
VariantClear
SysFreeString
SysAllocString

setupapi

SetupDiSetDeviceRegistryPropertyW
SetupFindNextMatchLineW
SetupIterateCabinetW
SetupCopyOEMInfW
SetupGetLineCountW
SetupOpenInfFileW
SetupCloseInfFile
SetupGetLineByIndexW
SetupOpenAppendInfFileW
SetupGetIntField
SetupFindFirstLineW
SetupGetStringFieldW
SetupDiRemoveDevice
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiGetDeviceInstanceIdW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsExW
SetupDiDeleteDeviceInfo
SetupDiOpenDevRegKey
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoW

crypt32

CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CertGetNameStringW
CertEnumCertificatesInStore
CryptAcquireCertificatePrivateKey

mscms

GetColorDirectoryW

lz32

LZOpenFileW
LZClose
LZCopy

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
VerQueryValueA

Sections

.text
Size: 466KB - Virtual size: 466KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KmInstall.exe
.exe windows:6 windows x86 arch:x86

95f2f0d22434602a8718534d6e65002d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-09-2022 00:00

Not After

18-11-2023 23:59

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:26:57:2b:88:3f:be:cd:df:60:08:b3:3e:81:3c:2e:d8:48:69:f7:c1:91:96:7d:12:e1:47:7b:29:0a:0c:e8
Signer

Actual PE Digest

1f:26:57:2b:88:3f:be:cd:df:60:08:b3:3e:81:3c:2e:d8:48:69:f7:c1:91:96:7d:12:e1:47:7b:29:0a:0c:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\cahuloganjd\Desktop\Workload\depot\KmUtilInstaller v5.0_DVD_Rebranding\Src\AllInOne\Release\KmInstall.pdb

Imports

kernel32

FlushFileBuffers
SetStdHandle
GetConsoleCP
LCMapStringEx
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetFilePointerEx
ReadConsoleW
GetConsoleMode
HeapSize
GetModuleHandleExW
ExitProcess
InitOnceExecuteOnce
GetFileType
GetStdHandle
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetStartupInfoW
TerminateProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
GetCurrentThreadId
GetCPInfo
GetOEMCP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExW
HeapReAlloc
SetEndOfFile
GetCurrentProcessId
FreeResource
LocalFileTimeToFileTime
GetCurrentDirectoryW
GetFileAttributesW
SystemTimeToFileTime
SetFilePointer
OpenProcess
FormatMessageW
LockResource
GlobalFree
GlobalUnlock
SizeofResource
GlobalAlloc
GlobalLock
LoadResource
FindResourceW
LoadLibraryW
SetFileAttributesW
LocalFree
GetWindowsDirectoryW
GetModuleHandleA
GetCurrentProcess
SetLastError
GetTempPathW
GetTimeZoneInformation
GetSystemDirectoryA
CopyFileW
GetWindowsDirectoryA
GetProcessHeap
HeapFree
MoveFileExW
HeapAlloc
GetLocaleInfoA
GetTempFileNameW
CreateProcessW
FreeLibrary
MulDiv
lstrcpyA
GetLocalTime
WideCharToMultiByte
OutputDebugStringA
OutputDebugStringW
CreateThread
DeleteFileW
GetVersionExW
Sleep
GetSystemDirectoryW
WriteFile
CreateDirectoryW
CloseHandle
MultiByteToWideChar
GetACP
CreateFileW
ReadFile
GetFileSize
CreateFileA
GetProcAddress
GetLastError
GetModuleFileNameW
GetTickCount
GetModuleHandleW
DeleteCriticalSection
WriteConsoleW

user32

MapWindowPoints
EnumChildWindows
GetWindowTextA
LoadImageW
EnumWindows
GetClassNameA
SetCursor
SetWindowTextW
wsprintfW
SetWindowPos
GetWindowRect
GetDlgCtrlID
GetWindowThreadProcessId
GetDesktopWindow
DialogBoxParamW
CreateDialogParamW
CheckRadioButton
DialogBoxIndirectParamW
SetWindowTextA
MessageBoxA
SendMessageA
IsDlgButtonChecked
CheckDlgButton
LoadBitmapW
ExitWindowsEx
AdjustWindowRect
GetAsyncKeyState
CreateDialogIndirectParamW
SetForegroundWindow
EnableWindow
UpdateWindow
SendMessageW
ShowWindow
EndDialog
GetWindowRgn
SetScrollRange
SetScrollPos
ShowScrollBar
ScrollWindowEx
SetScrollInfo
DestroyWindow
ScreenToClient
FillRect
GetFocus
LoadCursorW
LoadIconW
GetWindowLongW
RedrawWindow
CreateWindowExW
RegisterClassW
MoveWindow
MessageBoxW
wsprintfA
wvsprintfA
EndPaint
ClientToScreen
RemovePropW
SetCapture
DrawTextW
GetParent
WindowFromPoint
BeginPaint
SetPropW
GetDC
GetCapture
DrawFocusRect
GetWindowTextW
ReleaseDC
SetWindowLongW
IsWindow
ReleaseCapture
GetPropW
CallWindowProcW
DefWindowProcW
GetSystemMenu
PostMessageW
GetClientRect
SetFocus
InvalidateRect
EnableMenuItem
GetDlgItem

gdi32

DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetObjectW
CreateRectRgn
GetStockObject
BitBlt
GetDeviceCaps
CreateSolidBrush
CreatePen
GetDIBColorTable
SelectPalette
SetDIBits
CreateBitmap
CreatePalette
DeleteDC
LineTo
MoveToEx
CreateFontW
Rectangle
StretchBlt
CreateDIBSection
SetStretchBltMode
Ellipse
SetBrushOrgEx
Pie
EnumFontFamiliesExW
CreateFontA
GetTextColor
TextOutW
SetTextColor
SetBkColor
FrameRgn
RealizePalette
SetBkMode

advapi32

RegCreateKeyExW
RegEnumKeyW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteValueW

shell32

SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteW

ole32

CoCreateGuid
StringFromGUID2

comctl32

ImageList_LoadImageW
InitCommonControlsEx
ImageList_Draw

msimg32

AlphaBlend
GradientFill

lz32

LZOpenFileW
LZClose
LZCopy

version

GetFileVersionInfoSizeW
VerQueryValueW
VerQueryValueA
GetFileVersionInfoW

Exports

Exports

??0?$TARRAY@PAUCONTROL@@$00@@QAE@XZ
??1?$TARRAY@PAUCONTROL@@$00@@QAE@XZ
??4?$TARRAY@PAUCONTROL@@$00@@QAEAAV0@ABV0@@Z
??A?$TARRAY@PAUCONTROL@@$00@@QBEABQAUCONTROL@@I@Z
?Add@?$TARRAY@PAUCONTROL@@$00@@QAEHPAUCONTROL@@@Z
?Clear@?$TARRAY@PAUCONTROL@@$00@@QAEXXZ
?Init@?$TARRAY@PAUCONTROL@@$00@@QAEXXZ
?Length@?$TARRAY@PAUCONTROL@@$00@@QAEIXZ
?Remove@?$TARRAY@PAUCONTROL@@$00@@QAE_NI@Z
?Remove@?$TARRAY@PAUCONTROL@@$00@@QAE_NPAUCONTROL@@@Z
?Resize@?$TARRAY@PAUCONTROL@@$00@@QAE_NI@Z

Sections

.text
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KmInstall.ini
KmNetViewer.pnf
KmSetup.ini
KyoRm.ini
Readme.html
Readme_j.html
Setup.exe
.exe windows:4 windows x86 arch:x86

1bc8a8ab15f37dfcacba988951c15280

Code Sign

02:b8:a4:00:11:98:e5:6f:c6:84:dc:99:b1:66:5c:14
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-05-2017 00:00

Not After

08-08-2018 12:00

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Chuo-ku,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2014 00:00

Not After

22-10-2024 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2021 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:13:77:aa:15:84:f8:eb:29:3c:61:2e:eb:9d:41:ed
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

17-05-2017 00:00

Not After

08-08-2018 12:00

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Chuo-ku,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04-01-2017 00:00

Not After

18-01-2028 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

49:11:71:69:4f:4b:03:8b:a2:32:4a:72:88:7a:52:7a:e4:78:a4:b6:8a:8a:8d:d2:02:0a:68:ed:4e:20:67:2b
Signer

Actual PE Digest

49:11:71:69:4f:4b:03:8b:a2:32:4a:72:88:7a:52:7a:e4:78:a4:b6:8a:8a:8d:d2:02:0a:68:ed:4e:20:67:2b

Digest Algorithm

sha256

PE Digest Matches

true

b0:56:57:8d:a3:23:34:f2:c6:ef:ef:36:b6:09:af:50:93:21:57:e1
Signer

Actual PE Digest

b0:56:57:8d:a3:23:34:f2:c6:ef:ef:36:b6:09:af:50:93:21:57:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentProcess
GetProcAddress
GetModuleHandleA
GetSystemDirectoryW
GetSystemDirectoryA
GetACP
GetLocaleInfoA
GetVersionExA
SetLastError
CopyFileW
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
LoadLibraryA
CreateProcessA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetFilePointer
InitializeCriticalSection
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
GetTempPathW
GetWindowsDirectoryW
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryA
MultiByteToWideChar
WideCharToMultiByte
ReadFile
CreateFileW
CreateFileA
GetLastError
GetFileSize
CloseHandle
OutputDebugStringA
OutputDebugStringW
lstrcpyA
GetLocalTime
HeapSize
Sleep
GetStringTypeW
GetStringTypeA
HeapReAlloc
VirtualAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
RtlUnwind
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
LCMapStringA
LCMapStringW
ExitProcess
WriteFile
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

wsprintfA
wvsprintfA
MessageBoxA
wsprintfW

lz32

LZClose
LZOpenFileW
LZCopy

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

Sections

.text
Size: 72KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
lang.dat
.zip
setup/BG_Panel_Slice.png
.png
setup/BG_Slice.png
.png
setup/BottomCornerLeft.png
.png
setup/BottomCornerRight.png
.png
setup/BottomCornerRightWhite.png
.png
setup/BottomEdgeFill.png
.png
setup/KMPMSetup.png
.png
setup/Splash.png
.png
setup/Title_Gradient.PNG
.png
setup/TopCornerLeft.png
.png
setup/TopCornerRight.png
.png
setup/TopEdgeFill.png
.png
setup/kxLogo.png
.png
setup/kxLogo_black.png
.png
setup/kxLogoold.png
.png
support/Files/kxLogo.png
.png
support/KmInstall.ini
support/Setup.exe
.exe windows:5 windows x86 arch:x86

251c2a5d5bcd8f930e54d024bbc38d04

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02-09-2022 00:00

Not After

18-11-2023 23:59

Subject

CN=KYOCERA Document Solutions Inc.,O=KYOCERA Document Solutions Inc.,L=Osaka,ST=Osaka,C=JP

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ff:1a:53:a9:6c:01:ec:e1:0b:84:83:6b:90:33:59:d7:56:e2:0d:33:5c:ec:23:41:9b:82:6d:ed:15:1e:40:13
Signer

Actual PE Digest

ff:1a:53:a9:6c:01:ec:e1:0b:84:83:6b:90:33:59:d7:56:e2:0d:33:5c:ec:23:41:9b:82:6d:ed:15:1e:40:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetStringTypeA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStartupInfoA
GetFileType
SetHandleCount
RtlUnwind
HeapSize
GetStdHandle
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
VirtualFree
HeapCreate
RaiseException
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsValidCodePage
GetOEMCP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
SetEndOfFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MulDiv
WaitForSingleObject
OpenProcess
DeleteFileA
SetFileAttributesW
DeleteFileW
GetWindowsDirectoryW
RemoveDirectoryW
WritePrivateProfileStringA
GetPrivateProfileStringA
GetFileSize
SetFileAttributesA
SetLastError
GetShortPathNameA
MultiByteToWideChar
GetACP
GetSystemDirectoryA
CopyFileW
WideCharToMultiByte
GetSystemDirectoryW
GetWindowsDirectoryA
GetProcessHeap
CreateDirectoryW
HeapFree
MoveFileExW
HeapAlloc
MoveFileExA
GetLocaleInfoA
GetTempFileNameW
LoadLibraryA
lstrcpyA
OutputDebugStringA
GetLocalTime
OutputDebugStringW
GetVolumeInformationW
FindNextFileW
FindClose
lstrlenW
GetLogicalDriveStringsW
GetDriveTypeW
FindFirstFileW
CreateThread
LocalFree
GetTempPathA
GetCurrentProcessId
GetModuleFileNameA
SetCurrentDirectoryW
LockResource
GetTempPathW
GetModuleFileNameW
SizeofResource
CreateProcessW
LoadResource
FreeResource
FindResourceA
LocalFileTimeToFileTime
GetCurrentDirectoryA
CreateDirectoryA
GetFileAttributesA
SetFileTime
SystemTimeToFileTime
SetFilePointer
CreatePipe
CreateProcessA
Sleep
WriteFile
CreateFileA
GetVersionExA
LocalAlloc
LoadLibraryExW
FreeLibrary
SetErrorMode
GetModuleHandleA
GetProcAddress
GetTickCount
GetCurrentProcess
CloseHandle
GetLastError
CreateFileW
ReadFile
ExitProcess

user32

CreateWindowExA
MessageBoxA
wsprintfA
wsprintfW
IsWindow
RegisterClassA
MessageBoxW
ShowWindow
GetDesktopWindow
ReleaseDC
BringWindowToTop
GetDC
GetClassNameA
EnumWindows
GetWindowTextA
EnumChildWindows
GetDlgCtrlID
GetWindowThreadProcessId
DrawTextW
DrawTextA
wvsprintfA
CreateDialogParamA
FillRect
CreateDialogParamW
LoadIconA
EndPaint
DestroyWindow
SetCursor
ScreenToClient
BeginPaint
SetWindowLongA
DefWindowProcA
LoadCursorA
DialogBoxParamA
CheckDlgButton
CheckRadioButton
DialogBoxParamW
GetWindowTextW
GetClientRect
GetMessagePos
GetSystemMenu
GetWindowRect
IsWindowEnabled
SetFocus
SendMessageA
InvalidateRect
GetWindowLongA
EnableMenuItem
GetDlgItem
EndDialog
SetWindowPos
IsDlgButtonChecked
PostMessageA
SetWindowTextA
SendMessageW
MapWindowPoints
UpdateWindow
EnableWindow
SetWindowTextW
MoveWindow
LoadImageW
SetForegroundWindow
LoadBitmapA
ExitWindowsEx

gdi32

SetBrushOrgEx
CreateCompatibleBitmap
Ellipse
SetStretchBltMode
CreateDIBSection
Pie
Rectangle
CreatePen
BitBlt
DeleteDC
DeleteObject
SelectObject
CreateCompatibleDC
SetTextColor
SetBkMode
GetObjectA
GetStockObject
CreateSolidBrush
GetDeviceCaps
CreateFontW
CreateFontA
StretchBlt

advapi32

GetAclInformation
InitializeAcl
AllocateAndInitializeSid
CryptReleaseContext
CreateWellKnownSid
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
AddAccessAllowedAceEx
FreeSid
SetNamedSecurityInfoW
GetAce
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegDeleteValueW
RegOpenKeyExA
RegDeleteKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
RegEnumKeyW
CheckTokenMembership
GetLengthSid
AddAce
GetNamedSecurityInfoW

shell32

ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetMalloc
SHBrowseForFolderW

crypt32

CertAddCertificateContextToStore
CryptMemFree
CertCloseStore
CertOpenStore
CryptStringToBinaryA
CryptMemAlloc
CertCreateCertificateContext

comctl32

ImageList_LoadImageA
InitCommonControlsEx

netapi32

NetApiBufferFree
NetUseEnum

msimg32

GradientFill
AlphaBlend

lz32

LZOpenFileW
LZClose
LZCopy

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

Sections

.text
Size: 320KB - Virtual size: 320KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 297KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
support/lang.dat
.zip

Sharing

General

Malware Config

Signatures

Files

f4a6e13ef282a471bc88356e7c67a541

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

msimg32

netapi32

shlwapi

Exports

Exports

Sections

.text Size: 142KB - Virtual size: 141KB

.rdata Size: 30KB - Virtual size: 30KB

.data Size: 4KB - Virtual size: 13KB

.rsrc Size: 45KB - Virtual size: 44KB

.reloc Size: 10KB - Virtual size: 10KB

b34132414165667a8ef9756635b683e6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

97:e3:11:60:55:64:c2:17:66:0d:1a:08:c6:73:e9:0e:53:5e:25:0b:5b:cb:d6:62:ca:8b:7c:28:ba:aa:29:c6Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 23KB - Virtual size: 22KB

.data Size: 5KB - Virtual size: 14KB

.rsrc Size: 48KB - Virtual size: 48KB

.reloc Size: 16KB - Virtual size: 15KB

f27fee332eb670717dd910504291f821

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c5:ab:44:8c:64:6d:7b:65:6f:a9:a2:52:c6:cc:d4:dd:84:ca:82:1a:bf:ff:86:7c:7c:21:1b:81:34:b8:86:03Signer

Headers

.text
Size: 142KB - Virtual size: 141KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 4KB - Virtual size: 13KB

.rsrc
Size: 45KB - Virtual size: 44KB

.reloc
Size: 10KB - Virtual size: 10KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

97:e3:11:60:55:64:c2:17:66:0d:1a:08:c6:73:e9:0e:53:5e:25:0b:5b:cb:d6:62:ca:8b:7c:28:ba:aa:29:c6
Signer

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 23KB - Virtual size: 22KB

.data
Size: 5KB - Virtual size: 14KB

.rsrc
Size: 48KB - Virtual size: 48KB

.reloc
Size: 16KB - Virtual size: 15KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c5:ab:44:8c:64:6d:7b:65:6f:a9:a2:52:c6:cc:d4:dd:84:ca:82:1a:bf:ff:86:7c:7c:21:1b:81:34:b8:86:03
Signer

.text
Size: 212KB - Virtual size: 212KB

.rdata
Size: 76KB - Virtual size: 75KB

.data
Size: 5KB - Virtual size: 14KB

.rsrc
Size: 178KB - Virtual size: 177KB

.reloc
Size: 19KB - Virtual size: 19KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

08:57:b2:cc:ff:62:af:fd:2a:85:38:7a:0d:c2:b2:f0
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

be:ad:61:37:34:ad:c6:2c:06:3b:e4:81:d6:d6:8a:5b:25:96:8d:14:38:22:2e:85:08:d7:a6:f6:ae:ed:20:fd
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rsrc
Size: 121KB - Virtual size: 121KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 420KB - Virtual size: 419KB