b6a00a719bcfc5ba21fc31b24af233b5_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

b6a00a719bcfc5ba21fc31b24af233b5_JaffaCakes118
Size

6.5MB
MD5

b6a00a719bcfc5ba21fc31b24af233b5
SHA1

72e06f1771779ac2c62e8b672407d31a487e0b68
SHA256

65795b9bd6cc4f8bce8458ab995feaf21f5710e0a09a8891fa72366e7c07577a
SHA512

a4390a183538b9f349465e2b7f25e7584231521f6158ea132fbb6aa6b07331d725b18fb490c220765c74173afe9b2a73495f3a8ef93347a3053b0658899c7b9b
SSDEEP

196608:XtKiWwEwZAq/QjDaePhYzCeOhqILl/aop9evS:9KiWed/QDZZYzCeO9LK6

Score

1^/10

Malware Config

Signatures

Files

b6a00a719bcfc5ba21fc31b24af233b5_JaffaCakes118
.cab
Add_App.png
.png
Add_App.xml
.xml
Comodo.png
.png
Config.xml
.xml
Desklist.html
.html .js polyglot
Sciter
.dll windows:5 windows x64 arch:x64

feb30e9aa5a77d0d1aa9b6417cd34ef4

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1e:9b:0d:86:37:c9:34:77:ef:4d:7d:38:b7:bb:59:2f:c0:c9:3b:08
Signer

Actual PE Digest

1e:9b:0d:86:37:c9:34:77:ef:4d:7d:38:b7:bb:59:2f:c0:c9:3b:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Repositories\Sciter1_Build\sdk\x64\Release\cmdhtml.pdb

Imports

winmm

PlaySoundA
timeGetDevCaps
timeGetTime
timeSetEvent
timeKillEvent

oleacc

AccessibleObjectFromWindow
LresultFromObject

urlmon

FindMimeFromData

kernel32

GetSystemDefaultLCID
GetModuleFileNameW
MultiByteToWideChar
AllocConsole
GetLocaleInfoA
Sleep
GetCurrentThreadId
GetTempFileNameA
GetTempPathA
TlsGetValue
TlsSetValue
TlsAlloc
GetLastError
GlobalUnlock
GlobalSize
GlobalLock
GlobalFree
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
SetStdHandle
IsValidLocale
EnumSystemLocalesA
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetConsoleMode
GetConsoleCP
FatalAppExitA
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
HeapSize
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsValidCodePage
GetOEMCP
GetACP
GetStdHandle
ExitProcess
GetModuleHandleW
FlsAlloc
GetCurrentThread
SetLastError
FlsFree
FlsGetValue
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetCommandLineA
FlsSetValue
GetTimeFormatA
GetDateFormatA
HeapReAlloc
GetSystemTimeAsFileTime
DeleteFileA
RtlPcToFileHeader
RaiseException
EncodePointer
DecodePointer
GetUserDefaultLCID
RtlUnwindEx
RtlLookupFunctionEntry
HeapFree
lstrlenW
LocalFree
GetNumberFormatW
GetCurrencyFormatW
GetFileAttributesW
CreateThread
ExitThread
SetThreadLocale
GetCPInfo
GetStringTypeW
GetStringTypeA
GlobalAlloc
GetModuleFileNameA
FindResourceA
FindClose
GetComputerNameA
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
MulDiv
LeaveCriticalSection
EnterCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
GetVersionExA
VirtualProtect
VirtualAlloc
FlushFileBuffers
CreateFileW
ReadFile
WriteFile
VirtualFree
SetEndOfFile
SetFilePointer
CreateFileA
GetCurrentProcessId
ReleaseMutex
DuplicateHandle
CreateMutexA
WaitForMultipleObjects
CreateFileMappingA
OpenProcess
FormatMessageA
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FindNextFileW
CompareStringW
TlsFree
CloseHandle
CreateEventA
SetEvent
WaitForSingleObject
FileTimeToLocalFileTime
GetTimeZoneInformation
FileTimeToSystemTime
GetTimeFormatW
GetTickCount
GetDateFormatW
LoadLibraryW
DisableThreadLibraryCalls
FlushViewOfFile
GetFileSize
GetSystemTime
GetLocalTime
GetThreadLocale
GetLocaleInfoW
HeapAlloc
SystemTimeToFileTime
FindFirstFileW

user32

EndPaint
BeginPaint
SendMessageA
FillRect
MapWindowPoints
CreateWindowExA
SetWindowLongPtrA
GetActiveWindow
IsChild
RegisterWindowMessageA
UnregisterClassW
RegisterClassW
UnregisterClassA
RegisterClassExA
RegisterClassExW
RegisterClassA
SetCaretPos
DestroyCaret
CreateCaret
GetKeyboardLayout
ScrollWindowEx
GetDC
GetWindowThreadProcessId
GetDlgCtrlID
GetParent
GetWindowLongA
GetAsyncKeyState
GetKeyState
ReleaseDC
DefWindowProcA
GetClassLongPtrA
OffsetRect
MessageBeep
LoadStringW
CloseClipboard
ScrollDC
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetForegroundWindow
SetScrollInfo
CreateWindowExW
SetWindowLongPtrW
DefWindowProcW
DestroyWindow
SetActiveWindow
GetWindowLongPtrA
GetWindow
EnableWindow
SendMessageTimeoutA
GetUpdateRect
DrawTextA
IsWindowUnicode
MoveWindow
InvalidateRect
IsWindowEnabled
AdjustWindowRectEx
IsClipboardFormatAvailable
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
GetSysColor
LoadCursorFromFileA
DestroyIcon
SetWindowPos
GetClientRect
SetCursor
GetWindowPlacement
UpdateWindow
SetWindowTextW
IsWindowVisible
PeekMessageA
PostQuitMessage
NotifyWinEvent
KillTimer
GetCursorPos
WindowFromPoint
GetFocus
SetFocus
GetDoubleClickTime
SetTimer
GetScrollInfo
GetMessageA
TranslateMessage
DispatchMessageA
SetCapture
GetCapture
ReleaseCapture
SetWindowLongA
ShowWindow
GetWindowTextW
LoadCursorA
CreateCursor
GetDesktopWindow
GetAncestor
SystemParametersInfoA
IsWindow
GetWindowDC
GetSystemMetrics
GetWindowRect
InflateRect
DrawFocusRect
DrawTextW
InvertRect
DrawFrameControl
GetSysColorBrush
DrawEdge
GetIconInfo
CreateIconFromResourceEx
DrawIconEx
GetCaretBlinkTime
SetClipboardData
CountClipboardFormats
RegisterClipboardFormatW
GetClipboardSequenceNumber
OpenClipboard
EmptyClipboard
GetClipboardData
EnumClipboardFormats
PostMessageA

gdi32

EnumFontFamiliesExA
AddFontMemResourceEx
EnumFontFamiliesExW
CreateDIBPatternBrushPt
CreateDIBSection
StretchBlt
GetDIBits
StretchDIBits
SetStretchBltMode
GetWindowOrgEx
GetTextExtentPoint32W
PatBlt
GetTextExtentPoint32A
CreateFontA
SetBrushOrgEx
SetPixel
CreateBitmap
SetBkMode
Rectangle
GetTextExtentExPointW
GetTextAlign
CreatePatternBrush
CreatePen
GetTextMetricsA
RectVisible
RoundRect
SetTextAlign
IntersectClipRect
GetPixel
TextOutW
TextOutA
EndDoc
StartDocA
StartPage
EndPage
GetGlyphOutlineW
GetKerningPairsA
CreateHatchBrush
SetBkColor
GetDeviceCaps
GdiFlush
GetObjectA
SetTextColor
GetCurrentObject
GetClipBox
SaveDC
SetLayout
RestoreDC
CreateRectRgnIndirect
CombineRgn
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
BitBlt
DeleteDC
CreateCompatibleDC
LPtoDP
CreateCompatibleBitmap
SelectObject
GetStockObject
GetMapMode
SetMapMode
GetWindowExtEx
SetWindowExtEx
GetViewportExtEx
SetViewportExtEx
DPtoLP
SetViewportOrgEx
DeleteObject

comdlg32

CommDlgExtendedError
PrintDlgW
PrintDlgA
GetOpenFileNameW
GetSaveFileNameW

advapi32

IsTextUnicode
GetUserNameA

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ord74
DragQueryFileW
ShellExecuteExA
SHGetFileInfoW
ord727
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA

ole32

CoCreateGuid
OleInitialize
RevokeDragDrop
ReleaseStgMedium
RegisterDragDrop
DoDragDrop

oleaut32

VariantChangeType
GetErrorInfo
VariantInit
SetErrorInfo
VariantClear
SysAllocStringLen
SysFreeString
SysAllocString
CreateErrorInfo

imm32

ImmIsIME
ImmReleaseContext
ImmGetContext
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContextEx
ImmSetCandidateWindow

ws2_32

ioctlsocket
__WSAFDIsSet
gethostname
connect
inet_ntoa
WSAStartup
inet_addr
htonl
select
WSAGetLastError
htons
ntohs
getsockname
shutdown
setsockopt
accept
send
WSACleanup
recv
bind
socket
closesocket
gethostbyname
listen

comctl32

ImageList_DrawEx
ImageList_GetIconSize

wininet

InternetQueryOptionA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
InternetErrorDlg
HttpOpenRequestA
InternetCombineUrlA
InternetSetOptionA
InternetReadFile
InternetGetLastResponseInfoA
InternetConnectA
HttpQueryInfoA

Exports

Exports

?SciterCallV@@YAHPEAUHWND__@@PEB_WPEAUtagVARIANT@@I2@Z
GraphinAPI
GraphinRenderElement
SciliteAdvanceFocus
SciliteCreateInstance
SciliteDestroyInstance
SciliteFindElement
SciliteGetDocumentMinHeight
SciliteGetDocumentMinWidth
SciliteGetRootElement
SciliteGetTag
SciliteLoadFromBytes
SciliteLoadFromFile
SciliteRender
SciliteRenderOnBitmap
SciliteReplace
SciliteSetCallback
SciliteSetDataReady
SciliteSetDataReadyAsync
SciliteSetMediaType
SciliteSetTag
SciliteTraverseUIEvent
SciliteUpdateView
SciterAppendMasterCSS
SciterAttachEventHandler
SciterAttachHwndToElement
SciterCall
SciterCallBehaviorMethod
SciterCallScriptingFunction
SciterCallScriptingMethod
SciterCall_V
SciterClassNameA
SciterClassNameW
SciterClearAttributes
SciterCloneElement
SciterCombineURL
SciterControlGetType
SciterCreateElement
SciterCreateObject
SciterDataReady
SciterDataReadyAsync
SciterDeleteElement
SciterDetachElement
SciterDetachEventHandler
SciterDialogProc
SciterEval
SciterFindElement
SciterGetAttributeByName
SciterGetAttributeCount
SciterGetChildrenCount
SciterGetElementByUID
SciterGetElementHtml
SciterGetElementHtmlCB
SciterGetElementHwnd
SciterGetElementIndex
SciterGetElementIntrinsicHeight
SciterGetElementIntrinsicWidths
SciterGetElementLocation
SciterGetElementNamespace
SciterGetElementRawText
SciterGetElementState
SciterGetElementText
SciterGetElementTextCB
SciterGetElementType
SciterGetElementUID
SciterGetExpando
SciterGetFocusElement
SciterGetMinHeight
SciterGetMinWidth
SciterGetNthAttribute
SciterGetNthChild
SciterGetObject
SciterGetParentElement
SciterGetRootElement
SciterGetScrollInfo
SciterGetStyleAttribute
SciterGetVM
SciterGetValue
SciterHidePopup
SciterHttpRequest
SciterInsertElement
SciterIsElementEnabled
SciterIsElementVisible
SciterLoadFile
SciterLoadHtml
SciterMoveElement
SciterMoveElementEx
SciterNativeDefineClass
SciterPostEvent
SciterProc
SciterProcND
SciterRefreshElementArea
SciterReleaseCapture
SciterRender
SciterRequestElementData
SciterResetURLData
SciterScrollToView
SciterSelectElements
SciterSelectElementsW
SciterSelectParent
SciterSelectParentW
SciterSendEvent
SciterSetAttributeByName
SciterSetCSS
SciterSetCallback
SciterSetCapture
SciterSetElementHtml
SciterSetElementState
SciterSetElementText
SciterSetExceptionValue
SciterSetHomeURL
SciterSetHttpHeaders
SciterSetMasterCSS
SciterSetMediaType
SciterSetMediaVars
SciterSetOption
SciterSetScrollPos
SciterSetStyleAttribute
SciterSetTimer
SciterSetValue
SciterSetupDebugOutput
SciterShowPopup
SciterShowPopupAt
SciterSortElements
SciterSwapElements
SciterTrackPopupAt
SciterTranslateMessage
SciterTraverseUIEvent
SciterUpdateElement
SciterUpdateWindow
SciterVersion
SciterVmEval
SciterWindowAttachEventHandler
SciterWindowDetachEventHandler
Sciter_UnuseElement
Sciter_UseElement
Sciter_V2v
Sciter_v2V
TIScriptAPI
ValueBinaryData
ValueBinaryDataSet
ValueClear
ValueCompare
ValueCopy
ValueElementsCount
ValueEnumElements
ValueFloatData
ValueFloatDataSet
ValueFromString
ValueGetValueOfKey
ValueInit
ValueInt64Data
ValueInt64DataSet
ValueIntData
ValueIntDataSet
ValueInvoke
ValueIsolate
ValueNthElementKey
ValueNthElementValue
ValueNthElementValueSet
ValueSetValueToKey
ValueStringData
ValueStringDataSet
ValueToString
ValueType

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 936KB - Virtual size: 936KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 167KB - Virtual size: 185KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SevenZ
.dll windows:4 windows x64 arch:x64

e4baea09ee90a9bf95ce46f4d6ac1b20

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:25:12:41:fe:be:6d:76:4b:83:c4:4c:10:dc:6a:64:ea:f3:09:a5
Signer

Actual PE Digest

46:25:12:41:fe:be:6d:76:4b:83:c4:4c:10:dc:6a:64:ea:f3:09:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

oleaut32

VariantClear
SysAllocString
SysAllocStringByteLen
SysFreeString
VariantCopy

user32

CharUpperW
CharLowerW

msvcrt

memcmp
_purecall
memmove
realloc
__CxxFrameHandler
free
_CxxThrowException
malloc
memset
_beginthreadex
__C_specific_handler
__dllonexit
??1type_info@@UEAA@XZ
_onexit
?terminate@@YAXXZ
_initterm
memcpy

kernel32

Sleep
InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetTickCount
DeleteCriticalSection
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetSystemInfo
WriteFile
ReadFile
CloseHandle
CreateFileW
SetFileAttributesW
DeleteFileW
GetTempPathW
GetTempFileNameW
GetLastError

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
adpkifcfcacgmnggcbpbjbkdijciiigm.png
.png
adpkifcfcacgmnggcbpbjbkdijciiigm.xml
.xml
aknpkdffaafgjchaibgeefbgmgeghloj.png
.png
aknpkdffaafgjchaibgeefbgmgeghloj.xml
.xml
alert.wav
appmanifest.xaml
bfe_vista.reg
bfe_win7.reg
bfe_win8.reg
block.html
.html .js polyglot
blpcfgokakmgnkcojhhkbfbldkacnbeo.png
.png
blpcfgokakmgnkcojhhkbfbldkacnbeo.xml
.xml
bottomBar.png
.png
btnShadow.png
.png
cmdvirth.exe
.exe windows:5 windows x64 arch:x64

51b7c041fc8b8b0ef3a5b8b17f5471e5

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:3d:84:ed:dc:9e:4b:49:72:51:99:2b:51:23:4f:e7:e6:86:71:80
Signer

Actual PE Digest

0a:3d:84:ed:dc:9e:4b:49:72:51:99:2b:51:23:4f:e7:e6:86:71:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVNStorage\Projects\CIS_7.0\Release\x64\Symbols\cmdvirth.pdb

Imports

user32

IsRectEmpty
KillTimer
SetTimer
DeleteMenu
ShowOwnedPopups
SetCursor
InvalidateRect
IsIconic
SetLayeredWindowAttributes
EnumDisplayMonitors
SetRectEmpty
CopyImage
PostQuitMessage
SystemParametersInfoW
DestroyMenu
GetMenuItemInfoW
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
CharUpperW
DestroyIcon
RegisterWindowMessageW
LoadIconW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
GetClassLongPtrW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
DestroyWindow
GetWindowLongPtrW
SetWindowLongPtrW
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoW
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
RedrawWindow
UpdateWindow
GetClientRect
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
ToUnicodeEx
MapVirtualKeyW
GetKeyboardLayout
DeferWindowPos
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetWindowPlacement
DefWindowProcW
OffsetRect
CallWindowProcW
GetMenu
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
LoadCursorW
GetSystemMetrics
GetSysColorBrush
IntersectRect
InflateRect
CopyRect
RealChildWindowFromPoint
GetWindowRect
GetClassNameW
PtInRect
GetWindowTextLengthW
GetWindowTextW
GetFocus
SetFocus
SetWindowPos
ShowWindow
MoveWindow
SetWindowLongW
GetDlgCtrlID
IsWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
GetDlgItem
CheckDlgButton
GetWindow
GetWindowThreadProcessId
SendMessageW
GetWindowLongW
GetParent
GetLastActivePopup
IsWindowEnabled
EnableWindow
MessageBoxW
UnhookWindowsHookEx
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
GetSubMenu
RemoveMenu
GetSysColor
EndPaint
IsZoomed
SetWindowRgn
SetParent
DestroyAcceleratorTable
CreatePopupMenu
WindowFromPoint
NotifyWinEvent
GetAsyncKeyState
SetClassLongPtrW
LoadMenuW
GetSystemMenu
SetCapture
ReleaseCapture
MessageBeep
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
DrawStateW
DrawIconEx
DrawEdge
DrawFrameControl
DrawFocusRect
GetKeyboardState
CopyAcceleratorTableW
LoadAcceleratorsW
CreateAcceleratorTableW
SetRect
SetCursorPos
BringWindowToTop
LockWindowUpdate
GetMenuDefaultItem
InvertRect
HideCaret
EnableScrollBar
GetNextDlgTabItem
GetIconInfo
LoadImageW
GetNextDlgGroupItem
EndDialog
CreateDialogIndirectParamW
TranslateAcceleratorW
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
UnionRect
UpdateLayeredWindow
IsMenu
CreateMenu
PostThreadMessageW
WaitMessage
SetMenuDefaultItem
IsClipboardFormatAvailable
FrameRect
GetUpdateRect
OpenClipboard
SetClipboardData
CloseClipboard
EmptyClipboard
RegisterClipboardFormatW
CopyIcon
FillRect
GetDesktopWindow
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
GetKeyNameTextW
MapVirtualKeyExW
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn

kernel32

SetEnvironmentVariableA
WriteConsoleW
GetConsoleMode
GetConsoleCP
LCMapStringW
GetTimeZoneInformation
GetStringTypeW
GetProcAddress
CreateFileMappingW
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CreateThread
WaitForSingleObject
ResetEvent
SetEvent
WaitForMultipleObjects
ReleaseMutex
GetCurrentThreadId
GetLastError
CreateEventW
LocalAlloc
LocalFree
LoadLibraryW
FreeLibrary
InitializeCriticalSectionAndSpinCount
DuplicateHandle
GetCurrentProcess
GetVersionExW
GetCurrentProcessId
ExpandEnvironmentStringsW
ConnectNamedPipe
CancelIo
GetOverlappedResult
ReadFile
TransactNamedPipe
WriteFile
OpenProcess
GetProcessHeap
GetModuleHandleW
ReadProcessMemory
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetComputerNameW
ResumeThread
CreateNamedPipeW
CreateProcessW
SetLastError
TerminateProcess
ExitThread
CreateMutexW
SizeofResource
LockResource
LoadResource
FindResourceW
WideCharToMultiByte
lstrcmpA
lstrlenW
lstrlenA
MulDiv
GlobalUnlock
GlobalLock
FormatMessageW
GlobalAlloc
GlobalSize
CopyFileW
GlobalFree
MultiByteToWideChar
DeactivateActCtx
ReleaseActCtx
ActivateActCtx
GetModuleFileNameW
TlsGetValue
TlsAlloc
GlobalReAlloc
GlobalHandle
TlsSetValue
LocalReAlloc
lstrcmpW
GlobalFlags
CompareStringW
GlobalGetAtomNameW
FileTimeToSystemTime
SetThreadPriority
GlobalDeleteAtom
GlobalFindAtomW
GlobalAddAtomW
FreeResource
lstrcmpiW
CreateFileW
SetFilePointer
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetFileSize
FindClose
FindFirstFileW
GetVolumeInformationW
GetFullPathNameW
GetLocaleInfoW
GetUserDefaultUILanguage
GetSystemDirectoryW
lstrcpyW
GetFileAttributesExW
FileTimeToLocalFileTime
GetFileAttributesW
GetFileSizeEx
GetFileTime
GetCurrentDirectoryW
GetTempFileNameW
GetTempPathW
GetWindowsDirectoryW
GetNumberFormatW
GetTickCount
GetProfileIntW
Sleep
SearchPathW
VirtualProtect
FindResourceExW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCommandLineW
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
HeapReAlloc
HeapSize
HeapQueryInformation
ExitProcess
VirtualAlloc
SetThreadStackGuarantee
GetSystemInfo
VirtualQuery
SetStdHandle
GetFileType
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsSetValue
FlsFree
FlsAlloc
GetStdHandle
HeapSetInformation
GetVersion
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetStartupInfoW
QueryPerformanceCounter

gdi32

SetBkMode
SetPolyFillMode
SetBkColor
RestoreDC
SetPixelV
GetTextFaceW
SetPaletteEntries
ExtFloodFill
GetBoundsRect
FrameRgn
FillRgn
PtInRegion
GetViewportOrgEx
GetWindowOrgEx
LPtoDP
EnumFontFamiliesExW
Rectangle
SetPixel
StretchBlt
SetDIBColorTable
GetRgnBox
OffsetRgn
GetSystemPaletteEntries
RealizePalette
GetNearestPaletteIndex
GetPaletteEntries
CreatePalette
Polygon
Ellipse
Polyline
CreateEllipticRgn
GetTextColor
GetBkColor
CreatePolygonRgn
CreateRoundRectRgn
CreateDIBSection
GetTextCharsetInfo
EnumFontFamiliesW
GetTextMetricsW
CreateCompatibleBitmap
CreateDIBitmap
GetTextExtentPoint32W
DPtoLP
PatBlt
CombineRgn
SetRectRgn
CreateRectRgnIndirect
CreateFontIndirectW
CreateDCW
CopyMetaFileW
CreateHatchBrush
CreateSolidBrush
CreatePen
GetDeviceCaps
GetObjectType
SelectPalette
GetStockObject
CreateCompatibleDC
CreateBitmap
CreatePatternBrush
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
GetObjectW
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetTextColor
SetROP2
SaveDC

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegEnumKeyExW
SetServiceStatus
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
RevertToSelf
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
GetServiceDisplayNameW
StartServiceW
ImpersonateLoggedOnUser
CreateProcessAsUserW
LsaLookupSids
LsaQueryInformationPolicy
LogonUserW
EnumServicesStatusW
LsaFreeMemory
LsaClose
LsaLookupNames
LsaOpenPolicy
QueryServiceStatusEx
QueryServiceConfigA
ChangeServiceConfigW
QueryServiceStatus
DeleteService
ControlService
RegFlushKey
RegDeleteKeyW
RegEnumKeyW
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
QueryServiceConfigW
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW

shell32

SHAppBarMessage
SHGetFileInfoW
SHGetDesktopFolder
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHBrowseForFolderW
DragQueryFileW
DragFinish
ShellExecuteW

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathRemoveFileSpecW

ntdll

ZwOpenFile
RtlUnicodeStringToAnsiString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
RtlCopyLuid
ZwUnloadDriver
RtlEqualUnicodeString
RtlRegisterWait
ZwLoadDriver
RtlCompareUnicodeString
ZwQueryDirectoryObject
ZwOpenDirectoryObject
ZwAcceptConnectPort
ZwCompleteConnectPort
ZwReplyWaitReceivePortEx
RtlInitUnicodeString
ZwCreatePort
RtlNtStatusToDosError
ZwImpersonateClientOfPort
RtlValidSecurityDescriptor
RtlDeleteSecurityObject
RtlLengthSecurityDescriptor
RtlDosPathNameToNtPathName_U
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
ZwClose
RtlFreeUnicodeString
RtlLengthSid
RtlCopySid
RtlAreAllAccessesGranted
RtlDeregisterWait
RtlAllocateHeap
RtlCreateAcl
RtlAddAce
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlSetGroupSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlSetSaclSecurityDescriptor
RtlFreeHeap
ZwOpenThreadToken
ZwOpenProcessToken
RtlNewSecurityObject
RtlGetNtProductType
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthorityCountSid
RtlSubAuthoritySid
RtlMapGenericMask
ZwQueryInformationToken
ZwDuplicateToken
ZwAdjustPrivilegesToken
ZwSetInformationThread
RtlCopyUnicodeString

psapi

GetModuleFileNameExW

rpcrt4

NdrServerCall2
I_RpcBindingInqLocalClientPID
RpcRevertToSelf
RpcImpersonateClient
RpcServerUseProtseqEpW
I_RpcMapWin32Status
RpcServerRegisterIf
RpcServerListen

ntdsapi

DsCrackNamesW
DsUnBindW
DsFreeNameResultW
DsBindW

userenv

LoadUserProfileW
DestroyEnvironmentBlock
UnloadUserProfile
CreateEnvironmentBlock

fltlib

FilterSendMessage
FilterConnectCommunicationPort

ole32

RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoInitializeEx
CoUninitialize
CoInitialize
CoCreateInstance
OleDuplicateData
CoTaskMemAlloc
ReleaseStgMedium
CoTaskMemFree

oleaut32

SysAllocString
VariantInit
SysFreeString
VariantClear
VariantChangeType
VarBstrFromDate
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocStringLen

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

gdiplus

GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipDrawImageI
GdipCloneImage
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImageGraphicsContext
GdipGetImagePalette
GdipGetImagePaletteSize
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundW

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 531KB - Virtual size: 530KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
comodo_dragon.png
.png
comodo_dragon.xml
.xml
drvhlpr.dll
.dll windows:5 windows x64 arch:x64

6f6773d7201f72b5d3d3636c5ca69431

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3f:38:b1:ce:bd:37:e6:5d:5c:0c:dd:65:22:10:f4:19:99:b3:75:d8
Signer

Actual PE Digest

3f:38:b1:ce:bd:37:e6:5d:5c:0c:dd:65:22:10:f4:19:99:b3:75:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\SVNStorage\Projects\CIS_7.0\Installer_Wix\installer_data\helper_x64\Installer_Xp64DriverHelper.pdb

Imports

kernel32

OutputDebugStringW
LoadLibraryExW
GetLastError
FreeLibrary
FindResourceW
LoadResource
LockResource
GetLocaleInfoW
GetUserDefaultLCID
CloseHandle
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
HeapAlloc
GetCPInfo
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSize
GetProcAddress
GetModuleHandleW
ExitProcess
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
FlsGetValue
FlsFree
SetLastError
FlsAlloc
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
FlushFileBuffers

user32

SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
PostMessageW
RealGetWindowClassW
IsWindow
GetWindow
GetWindowTextW
LoadStringW
GetDlgCtrlID

shell32

SHGetSpecialFolderPathW

Exports

Exports

StartWinXPx64DrvHlpr
StopWinXPx64DrvHlpr

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ejjicmeblgpmajnghnpcppodonldlgfn.png
.png
ejjicmeblgpmajnghnpcppodonldlgfn.xml
.xml
flip_in.png
.png
flip_out.png
.png
flip_press.png
.png
hbdpomandigafcibbmofojjchbcdagbl.png
.png
hbdpomandigafcibbmofojjchbcdagbl.xml
.xml
icppfcnhkcmnfdhfhphakoifcfokfdhg.png
.png
icppfcnhkcmnfdhfhphakoifcfokfdhg.xml
.xml
ihdkejbciahopmbagpnjmmkkdpfpaaak.png
.png
ihdkejbciahopmbagpnjmmkkdpfpaaak.xml
.xml
lbfehkoinhhcknnbdgnnmjhiladcgbol.png
.png
lbfehkoinhhcknnbdgnnmjhiladcgbol.xml
.xml
lfbgimoladefibpklnfmkpknadbklade.png
.png
lfbgimoladefibpklnfmkpknadbklade.xml
.xml
lneaknkopdijkpnocmklfnjbeapigfbh.png
.png
lneaknkopdijkpnocmklfnjbeapigfbh.xml
.xml
mkojhhiphdgeliplnclnbmdiofhgnimi.png
.png
mkojhhiphdgeliplnclnbmdiofhgnimi.xml
.xml
mmimngoggfoobjdlefbcabngfnmieonb.png
.png
mmimngoggfoobjdlefbcabngfnmieonb.xml
.xml
onlgmecjpnejhfeofkgbfgnmdlipdejb.png
.png
onlgmecjpnejhfeofkgbfgnmdlipdejb.xml
.xml
page_dot.png
.png
page_dot_on.png
.png
pfpeapihoiogbcmdmnibeplnikfnhoge.png
.png
pfpeapihoiogbcmdmnibeplnikfnhoge.xml
.xml
pjkljhegncpnkpknbcohdijeoejaedia.png
.png
pjkljhegncpnkpknbcohdijeoejaedia.xml
.xml
redirect.html
.html .js polyglot
remove.png
.png
thDefault_BlockIcon.png
.png
thDefault_ButtonHover.png
.png
thDefault_ButtonNormal.png
.png
thDefault_ButtonPressedl.png
.png
thDefault_Footer.png
.png
thDefault_Header.png
.png
thModern_BlockIcon.png
.png
virtkiosk.exe
.exe windows:5 windows x64 arch:x64

2d81d9ef7ac9ff0904b8080539b3d8f7

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d8:42:ca:92:35:5f:e6:a4:3a:0c:c5:16:97:53:38:2b:05:d5:0a:cc
Signer

Actual PE Digest

d8:42:ca:92:35:5f:e6:a4:3a:0c:c5:16:97:53:38:2b:05:d5:0a:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\SVNStorage\Projects\CIS_7.0\Release\x64\Symbols\virtkiosk.pdb

Imports

kernel32

IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
CreateFileA
LocalSize
WriteConsoleW
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
LoadLibraryA
EnumResourceTypesW
EnumResourceNamesW
EnumResourceLanguagesW
GetProcessHeap
SetEnvironmentVariableA
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetVersion
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
HeapSize
HeapQueryInformation
SetStdHandle
RtlPcToFileHeader
RtlUnwindEx
RtlLookupFunctionEntry
VirtualQuery
SetThreadStackGuarantee
VirtualAlloc
GetTimeZoneInformation
HeapReAlloc
CreateThread
ExitThread
GetTimeFormatW
GetDateFormatW
HeapAlloc
DecodePointer
EncodePointer
HeapFree
GetStartupInfoW
GetCommandLineW
SearchPathW
GetNumberFormatW
GetUserDefaultLCID
GlobalFlags
GlobalGetAtomNameW
VirtualProtect
TlsFree
LocalReAlloc
TlsSetValue
GlobalHandle
GlobalReAlloc
TlsAlloc
TlsGetValue
GetPrivateProfileIntW
SetErrorMode
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GetProfileIntW
GetFileSizeEx
GetFileAttributesExW
SuspendThread
SetThreadPriority
ReleaseActCtx
CreateActCtxW
GlobalFindAtomW
CompareStringW
lstrcmpW
lstrcmpA
ReleaseMutex
FormatMessageW
lstrlenA
GetCurrentDirectoryW
WriteFile
DuplicateHandle
FileTimeToDosDateTime
SetFilePointer
GetFileInformationByHandle
GetFileType
LocalAlloc
GetCurrentThread
GetExitCodeProcess
FindResourceExW
DeleteFileW
GetTempFileNameW
GetSystemInfo
GetExitCodeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetLogicalDriveStringsW
GetSystemTimeAsFileTime
WritePrivateProfileStringW
GetPrivateProfileStringW
MulDiv
FreeResource
lstrcmpiW
SetThreadLocale
OutputDebugStringA
HeapSetInformation
GlobalDeleteAtom
GlobalAddAtomW
ProcessIdToSessionId
OpenEventW
OpenMutexW
ExitProcess
lstrcpynW
TerminateThread
ResetEvent
WaitForMultipleObjects
GetDriveTypeW
GetModuleFileNameW
SystemTimeToFileTime
ExpandEnvironmentStringsW
LocalFree
GetWindowsDirectoryW
GetVersionExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
GlobalFree
LoadLibraryExW
FreeLibrary
IsDebuggerPresent
GetLocalTime
GetTempPathW
RaiseException
GetFullPathNameW
SetUnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
CreateProcessW
GetSystemWow64DirectoryW
GetCurrentThreadId
InitializeCriticalSection
ActivateActCtx
LoadLibraryW
DeactivateActCtx
SetLastError
CreateMutexW
PostQueuedCompletionStatus
WaitForSingleObject
ResumeThread
SetEvent
CreateEventW
GetCurrentProcess
FindNextFileW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
GetSystemDirectoryW
GetLongPathNameW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
CopyFileW
CreateDirectoryW
Sleep
QueryDosDeviceW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetModuleHandleW
GetProcAddress
OpenProcess
lstrcpyW
lstrlenW
ReadFile
GetFileSize
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileAttributesW
FindClose
FindFirstFileW
CloseHandle
CreateFileW

user32

SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
DefWindowProcW
GetMenu
LoadMenuW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
ShowWindow
LoadImageW
LoadStringW
GetKeyNameTextW
EndDialog
GetNextDlgTabItem
UpdateWindow
InflateRect
MapDialogRect
CharNextW
TranslateAcceleratorW
CreateDialogIndirectParamW
IntersectRect
GetMenuItemInfoW
EnableWindow
GetDC
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumChildWindows
PostThreadMessageW
DeleteMenu
SetMenuItemBitmaps
GetClassLongW
OpenInputDesktop
DrawIcon
LoadAcceleratorsW
SetPropW
GetClassInfoW
GetMessagePos
PostQuitMessage
EqualRect
SendNotifyMessageW
ClientToScreen
AllowSetForegroundWindow
SetWindowPos
CopyIcon
RegisterShellHookWindow
GetWindow
DrawIconEx
ReleaseCapture
DrawAnimatedRects
GetWindowPlacement
SetCapture
RegisterWindowMessageW
SetForegroundWindow
SetActiveWindow
AttachThreadInput
SetKeyboardState
GetKeyboardState
SetWindowRgn
wsprintfW
CreateDesktopW
GetDesktopWindow
RegisterHotKey
CloseDesktop
SwitchDesktop
SetThreadDesktop
CallWindowProcW
SetWindowLongPtrW
GetSubMenu
GetWindowTextLengthW
LoadIconW
GetUserObjectInformationW
DestroyMenu
OpenDesktopW
EnumWindows
GetWindowTextW
GetClassNameW
IsWindowVisible
MapVirtualKeyW
GetGUIThreadInfo
KillTimer
PtInRect
GetMessageExtraInfo
SendInput
VkKeyScanW
UnhookWindowsHookEx
SetWindowsHookExA
GetWindowLongPtrW
DestroyWindow
GetTopWindow
GetDlgItem
EndDeferWindowPos
BeginDeferWindowPos
GetLastActivePopup
SetFocus
RemovePropW
GetPropW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckDlgButton
IsClipboardFormatAvailable
IsDialogMessageW
SetWindowTextW
MoveWindow
SetTimer
SetWindowsHookExW
GetKeyState
ScreenToClient
CallNextHookEx
WindowFromPoint
GetCursorPos
OffsetRect
CopyRect
GetMonitorInfoW
MonitorFromWindow
SetLayeredWindowAttributes
GetScrollInfo
DeferWindowPos
AdjustWindowRectEx
RegisterClassW
GetClassInfoExW
CreateWindowExW
MessageBoxW
ValidateRect
RedrawWindow
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
TrackPopupMenu
TrackPopupMenuEx
ScrollWindow
MapWindowPoints
GetParent
ReleaseDC
IsWindow
SendMessageW
IsWindowEnabled
GetFocus
GetWindowLongW
InvalidateRect
GetWindowRect
GetClientRect
SetCursor
LoadCursorW
PostMessageW
GetForegroundWindow
SendMessageTimeoutW
DestroyIcon
GetIconInfo
CreateIconIndirect
GetClassLongPtrW
GetWindowThreadProcessId
GetSystemMenu
IsIconic
GetTabbedTextExtentA
GetCursor
GetKeyboardLayoutList
ShowCaret
AdjustWindowRect
RegisterClassA
DefMDIChildProcA
GetDoubleClickTime
DefDlgProcW
DefDlgProcA
DefFrameProcA
DefWindowProcA
CallWindowProcA
IsWindowUnicode
GetWindowLongPtrA
SetWindowLongPtrA
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
IsZoomed
EnableMenuItem
PeekMessageW
TranslateMessage
DispatchMessageW
SystemParametersInfoW
GetSystemMetrics
GetActiveWindow
FindWindowW
RegisterClipboardFormatW
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SetWindowLongW
CharUpperW
UnregisterClassW
ShowOwnedPopups
GetAsyncKeyState
UpdateLayeredWindow
GetSysColor
SetParent
IsRectEmpty
GetSysColorBrush
CheckMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
FillRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetWindowDC
BeginPaint
EndPaint
RealChildWindowFromPoint
CopyImage
SetRectEmpty
EnumDisplayMonitors
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
CopyAcceleratorTableW
SetRect
InvalidateRgn
SetWindowContextHelpId
DestroyAcceleratorTable
NotifyWinEvent
SetClassLongPtrW
MessageBeep
DrawStateW
DrawEdge
DrawFrameControl
DrawFocusRect
ToUnicodeEx
GetKeyboardLayout
CreateAcceleratorTableW
SetCursorPos
LockWindowUpdate
GetMenuDefaultItem
InvertRect
HideCaret
EnableScrollBar
GetNextDlgGroupItem
UnionRect
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
IsMenu
CreateMenu
WaitMessage
SetMenuDefaultItem
FrameRect
GetUpdateRect
CharUpperBuffW
GetWindowRgn
DestroyCursor
GetDCEx
SubtractRect
GetMessageW
GetMessageTime
MapVirtualKeyExW
IsCharLowerW
GetThreadDesktop

gdi32

GetBkColor
GetTextColor
EnumFontFamiliesExW
GetCurrentObject
CreatePolygonRgn
Polyline
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
RoundRect
Rectangle
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
GetTextAlign
GetTextFaceW
SetPixelV
GetRgnBox
StretchDIBits
CreateFontW
GetCharWidthW
GetTextCharsetInfo
ExtSelectClipRgn
PolyBezierTo
GetCurrentPositionEx
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
Ellipse
EnumFontFamiliesW
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
GetClipRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
CopyMetaFileW
CreateFontIndirectW
DeleteDC
CreateDCW
BitBlt
CreateRoundRectRgn
GetDeviceCaps
CreateSolidBrush
CreateDIBSection
SelectObject
CreateCompatibleBitmap
LPtoDP
CreateEllipticRgn
DPtoLP
GetMapMode
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
GetTextMetricsW
SetViewportExtEx
CreateDIBitmap
SetBrushOrgEx
GetBitmapBits
ExtCreateRegion
GetTextExtentPoint32A
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
GetObjectType
SelectPalette
GetStockObject
ScaleViewportExtEx
CreatePatternBrush
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetTextExtentPoint32W
GetObjectW
SetPaletteEntries
SetWindowOrgEx
DeleteObject

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegQueryValueW
AddAccessAllowedAceEx
SetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
GetLengthSid
InitializeSid
GetUserNameA
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegFlushKey
RegEnumKeyExW
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
LookupAccountSidW
ConvertStringSidToSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
GetUserNameW
RegQueryValueExW
RegEnumKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW

shell32

SHAppBarMessage
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragFinish
SHBrowseForFolderW
ShellExecuteExW
ord680
SHCreateDirectoryExW
SHGetPathFromIDListW
DragQueryFileW
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW
ord727
SHGetFileInfoW
SHGetFolderPathW

comctl32

ImageList_GetBkColor
ImageList_GetImageInfo
ImageList_DrawIndirect
ImageList_DrawEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent
FlatSB_GetScrollProp

shlwapi

PathIsUNCW
PathQuoteSpacesW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashW
PathAddBackslashW
SHGetValueW
SHDeleteKeyW

ole32

CoRegisterMessageFilter
CoRevokeClassObject
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoFreeUnusedLibraries
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CoDisconnectObject
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
OleDuplicateData
CLSIDFromProgID
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
OleUninitialize
CoInitializeEx
CoInitialize
CLSIDFromString
StringFromCLSID
ProgIDFromCLSID
ReleaseStgMedium
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
OleInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
RevokeDragDrop

oleaut32

SafeArrayDestroy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
DispCallFunc
VariantCopy
VarDateFromStr
SysStringLen
VariantChangeType
VarUI4FromStr
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysAllocStringLen
VariantClear
SysAllocString
VarBstrFromDate
VarUdateFromDate
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
VariantChangeTypeEx
LoadTypeLi
OleLoadPicturePath

oledlg

OleUIBusyW
OleUIAddVerbMenuW

uxtheme

SetWindowTheme

gdiplus

GdipCreateMatrix
GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatHotkeyPrefix
GdipSetTextRenderingHint
GdipDrawString
GdipResetWorldTransform
GdipDrawImageRectRect
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipGetImagePixelFormat
GdipBitmapGetPixel
GdipGetImageThumbnail
GdipLoadImageFromFile
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePen1
GdipGetImageWidth
GdipDrawPolygon
GdipCreateBitmapFromScan0
GdipDrawLine
GdipDrawImageRectRectI
GdipSetSmoothingMode
GdipReleaseDC
GdipFillRectangle
GdipDrawImageRect
GdipSetPenLineJoin
GdipLoadImageFromStream
GdipCreateTexture
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipDrawRectangleI
GdipCreatePen2
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipSetInterpolationMode
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipDeletePen
GdipGetImageHeight
GdipDeleteGraphics
GdipCreateFromHDC
GdipSetImageAttributesOutputChannel
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetPixelOffsetMode
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipFillRectangleI
GdipCloneFont
GdipDrawImageRectI
GdipDrawImageI
GdipGraphicsClear
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipFree
GdipAlloc
GdipDeleteFontFamily
GdipDeleteFont
GdipCreateHICONFromBitmap
GdipGetImageGraphicsContext
GdipCloneImage
GdipDisposeImage
GdipCreateFontFamilyFromName
GdipFillPolygon

dbghelp

ImageDirectoryEntryToData

ntdll

NtQuerySystemInformation
NtSuspendProcess
NtTerminateProcess
NtClose
NtOpenProcess
NtResumeProcess
pow
_snprintf
_setjmp
longjmp
atan

rpcrt4

RpcAsyncCompleteCall
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcAsyncInitializeHandle
RpcBindingFree
RpcAsyncCancelCall
RpcServerListen
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcMgmtStopServerListening
NdrAsyncClientCall
NdrAsyncServerCall

mpr

WNetGetUniversalNameW

crypt32

CryptProtectData
CryptUnprotectData

ws2_32

ntohl
htonl

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 183KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 649KB - Virtual size: 649KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
virtkiosk.exeV64
.exe windows:5 windows x86 arch:x86

dac0e373c3892b1d6f4b15b9f322adb0

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:50:38:01:70:9c:bf:17:10:6b:e4:a0:77:96:17:c1:c6:99:a8:be
Signer

Actual PE Digest

83:50:38:01:70:9c:bf:17:10:6b:e4:a0:77:96:17:c1:c6:99:a8:be

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\SVNStorage\Projects\CIS_7.0\Release\x32\Symbols\virtkiosk.pdb

Imports

kernel32

LocalSize
GetModuleFileNameA
GetModuleHandleA
CreateFileA
LoadLibraryA
EnumResourceTypesW
EnumResourceNamesW
EnumResourceLanguagesW
GetProcessHeap
SetEnvironmentVariableA
LoadLibraryExA
WriteConsoleW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
GetStringTypeW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
UnhandledExceptionFilter
QueryPerformanceCounter
HeapDestroy
HeapCreate
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
HeapSize
HeapQueryInformation
SetStdHandle
RtlUnwind
VirtualQuery
VirtualAlloc
GetTimeZoneInformation
HeapReAlloc
CreateThread
ExitThread
GetDateFormatW
GetTimeFormatW
HeapAlloc
DecodePointer
EncodePointer
HeapFree
GetStartupInfoW
GetCommandLineW
SearchPathW
GetNumberFormatW
GetUserDefaultLCID
GlobalFlags
GlobalGetAtomNameW
VirtualProtect
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetPrivateProfileIntW
SetErrorMode
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoW
GetVolumeInformationW
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetThreadLocale
GetProfileIntW
GetFileSizeEx
GetFileAttributesExW
SuspendThread
SetThreadPriority
ReleaseActCtx
CreateActCtxW
GlobalFindAtomW
CompareStringW
lstrcmpW
lstrcmpA
ReleaseMutex
FormatMessageW
lstrlenA
GetCurrentDirectoryW
WriteFile
DuplicateHandle
FileTimeToDosDateTime
SetFilePointer
GetFileInformationByHandle
GetFileType
LocalAlloc
GetCurrentThread
GetExitCodeProcess
FindResourceExW
DeleteFileW
GetTempFileNameW
GetSystemInfo
InterlockedExchange
GetExitCodeThread
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetLogicalDriveStringsW
GetSystemTimeAsFileTime
WritePrivateProfileStringW
GetPrivateProfileStringW
MulDiv
FreeResource
InterlockedCompareExchange
lstrcmpiW
SetThreadLocale
OutputDebugStringA
HeapSetInformation
GlobalDeleteAtom
GlobalAddAtomW
ProcessIdToSessionId
OpenEventW
OpenMutexW
ExitProcess
lstrcpynW
TerminateThread
CreateProcessW
ResetEvent
WaitForMultipleObjects
GetDriveTypeW
GetModuleFileNameW
SystemTimeToFileTime
ExpandEnvironmentStringsW
LocalFree
GetWindowsDirectoryW
GetVersionExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileTime
GlobalFree
LoadLibraryExW
FreeLibrary
GetFullPathNameW
IsDebuggerPresent
GetLocalTime
GetTempPathW
RaiseException
SetUnhandledExceptionFilter
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
InitializeCriticalSection
ActivateActCtx
LoadLibraryW
DeactivateActCtx
SetLastError
CreateMutexW
PostQueuedCompletionStatus
InterlockedDecrement
WaitForSingleObject
InterlockedIncrement
ResumeThread
SetEvent
CreateEventW
FindNextFileW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
GetSystemDirectoryW
GetLongPathNameW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
CopyFileW
CreateDirectoryW
Sleep
QueryDosDeviceW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
OpenProcess
lstrcpyW
lstrlenW
ReadFile
GetFileSize
GetCurrentProcess
GetModuleHandleW
GetProcAddress
FindResourceW
LoadResource
LockResource
SizeofResource
GetFileAttributesW
FindClose
FindFirstFileW
CloseHandle
CreateFileW

user32

GetDlgCtrlID
DefWindowProcW
GetMenu
LoadMenuW
GetMenuState
GetMenuStringW
AppendMenuW
GetMenuItemID
InsertMenuW
GetMenuItemCount
RemoveMenu
ShowWindow
IsClipboardFormatAvailable
GetKeyNameTextW
EndDialog
LoadImageW
LoadStringW
UpdateWindow
InflateRect
GetNextDlgTabItem
CreateDialogIndirectParamW
IntersectRect
EnableWindow
GetDC
MapDialogRect
CharNextW
TranslateAcceleratorW
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumChildWindows
PostThreadMessageW
DeleteMenu
SetMenuItemBitmaps
SetClassLongW
OpenInputDesktop
DrawIcon
LoadAcceleratorsW
SetPropW
GetClassInfoW
GetMessagePos
PostQuitMessage
EqualRect
SendNotifyMessageW
ClientToScreen
AllowSetForegroundWindow
SetWindowPos
CopyIcon
RegisterShellHookWindow
GetWindow
DrawIconEx
ReleaseCapture
DrawAnimatedRects
GetWindowPlacement
SetCapture
RegisterWindowMessageW
SetForegroundWindow
SetActiveWindow
AttachThreadInput
SetKeyboardState
GetKeyboardState
SetWindowRgn
wsprintfW
CreateDesktopW
GetDesktopWindow
RegisterHotKey
CloseDesktop
SwitchDesktop
SetThreadDesktop
CallWindowProcW
GetSubMenu
GetWindowTextLengthW
LoadIconW
GetUserObjectInformationW
GetThreadDesktop
OpenDesktopW
GetMenuItemInfoW
GetWindowTextW
GetClassNameW
IsWindowVisible
MapVirtualKeyW
GetGUIThreadInfo
KillTimer
PtInRect
GetMessageExtraInfo
SendInput
VkKeyScanW
UnhookWindowsHookEx
MapWindowPoints
GetMessageTime
DestroyWindow
GetTopWindow
GetDlgItem
EndDeferWindowPos
BeginDeferWindowPos
GetLastActivePopup
SetFocus
RemovePropW
GetPropW
GetCapture
IsChild
WinHelpW
SendDlgItemMessageA
SendDlgItemMessageW
CheckDlgButton
IsDialogMessageW
SetWindowTextW
SetWindowsHookExA
SetTimer
SetWindowsHookExW
GetKeyState
ScreenToClient
CallNextHookEx
WindowFromPoint
GetCursorPos
OffsetRect
CopyRect
GetMonitorInfoW
MonitorFromWindow
SetWindowPlacement
SetScrollInfo
GetScrollInfo
DeferWindowPos
AdjustWindowRectEx
RegisterClassW
GetClassInfoExW
CreateWindowExW
MessageBoxW
ValidateRect
RedrawWindow
ShowScrollBar
GetScrollPos
SetScrollPos
GetScrollRange
SetScrollRange
SetMenu
TrackPopupMenu
TrackPopupMenuEx
GetParent
ReleaseDC
IsWindow
SendMessageW
MoveWindow
GetFocus
GetWindowLongW
InvalidateRect
GetWindowRect
GetClientRect
SetCursor
LoadCursorW
PostMessageW
GetForegroundWindow
SendMessageTimeoutW
DestroyIcon
GetIconInfo
CreateIconIndirect
GetClassLongW
GetWindowThreadProcessId
GetSystemMenu
IsIconic
GetTabbedTextExtentA
GetCursor
GetKeyboardLayoutList
ShowCaret
AdjustWindowRect
RegisterClassA
DefMDIChildProcA
DefDlgProcW
DefDlgProcA
DestroyCursor
DefFrameProcA
DefWindowProcA
CallWindowProcA
IsWindowUnicode
GetWindowLongA
SetWindowLongA
LoadMenuIndirectW
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
IsZoomed
EnableMenuItem
PeekMessageW
TranslateMessage
DispatchMessageW
SystemParametersInfoW
GetSystemMetrics
GetActiveWindow
FindWindowW
RegisterClipboardFormatW
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SetWindowLongW
UpdateLayeredWindow
DestroyMenu
CharUpperW
UnregisterClassW
ShowOwnedPopups
GetSysColor
SetParent
SetLayeredWindowAttributes
GetAsyncKeyState
IsRectEmpty
IsWindowEnabled
CheckMenuItem
ModifyMenuW
LoadBitmapW
GetMenuCheckMarkDimensions
FillRect
TabbedTextOutW
DrawTextW
DrawTextExW
GrayStringW
GetWindowDC
GetSysColorBrush
RealChildWindowFromPoint
CopyImage
SetRectEmpty
EnumDisplayMonitors
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
ReuseDDElParam
UnpackDDElParam
CopyAcceleratorTableW
SetRect
InvalidateRgn
SetWindowContextHelpId
DestroyAcceleratorTable
NotifyWinEvent
MessageBeep
DrawStateW
DrawEdge
DrawFrameControl
DrawFocusRect
ToUnicodeEx
GetKeyboardLayout
CreateAcceleratorTableW
SetCursorPos
LockWindowUpdate
GetMenuDefaultItem
InvertRect
HideCaret
EnableScrollBar
GetNextDlgGroupItem
UnionRect
DefFrameProcW
DefMDIChildProcW
DrawMenuBar
TranslateMDISysAccel
MonitorFromPoint
IsMenu
CreateMenu
WaitMessage
SetMenuDefaultItem
FrameRect
GetUpdateRect
CharUpperBuffW
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
SubtractRect
GetDCEx
BeginPaint
EndPaint
GetMessageW
ScrollWindow
GetWindowRgn
EnumWindows

gdi32

GetBkColor
GetTextColor
EnumFontFamiliesExW
GetCurrentObject
CreatePolygonRgn
Polyline
Polygon
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
RealizePalette
GetSystemPaletteEntries
OffsetRgn
SetDIBColorTable
GetDIBits
StretchBlt
SetPixel
RoundRect
Rectangle
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextAlign
GetTextFaceW
SetPixelV
GetRgnBox
StretchDIBits
CreateFontW
GetCharWidthW
GetTextCharsetInfo
ExtSelectClipRgn
PolyBezierTo
ScaleWindowExtEx
Ellipse
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
EnumFontFamiliesW
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
TextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
GetClipRgn
SelectClipRgn
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
GetClipBox
SetMapMode
SetStretchBltMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
CreateBitmap
SetBkColor
SetTextColor
CopyMetaFileW
CreateFontIndirectW
DeleteDC
CreateDCW
BitBlt
CreateRoundRectRgn
GetDeviceCaps
CreateSolidBrush
CreateDIBSection
SelectObject
CreateCompatibleBitmap
LPtoDP
CreateEllipticRgn
DPtoLP
GetMapMode
SetRectRgn
PatBlt
CreateRectRgnIndirect
CreateHatchBrush
CreatePen
GetTextMetricsW
SetViewportExtEx
CreateDIBitmap
SetBrushOrgEx
GetBitmapBits
ExtCreateRegion
GetTextExtentPoint32A
GetObjectType
SelectPalette
GetStockObject
SetWindowExtEx
CreatePatternBrush
CreateCompatibleDC
CombineRgn
CreateRectRgn
GetTextExtentPoint32W
GetObjectW
FrameRgn
GetCurrentPositionEx
BeginPath
CloseFigure
EndPath
StrokeAndFillPath
FillPath
StrokePath
DeleteObject

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegQueryValueW
AddAccessAllowedAceEx
SetSecurityDescriptorDacl
InitializeAcl
InitializeSecurityDescriptor
GetLengthSid
InitializeSid
GetUserNameA
SetSecurityInfo
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegDeleteKeyW
RegFlushKey
RegEnumKeyExW
RegDeleteValueW
RegEnumValueW
RegSetValueExW
RegCreateKeyExW
LookupAccountSidW
ConvertStringSidToSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
FreeSid
GetUserNameW
RegQueryValueExW
RegEnumKeyW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW

shell32

SHAppBarMessage
SHGetDesktopFolder
DragFinish
SHBrowseForFolderW
ShellExecuteExW
ord680
SHCreateDirectoryExW
SHGetPathFromIDListW
DragQueryFileW
ExtractIconExW
ShellExecuteW
SHGetSpecialFolderPathW
SHFileOperationW
ord727
SHGetFileInfoW
SHGetFolderPathW
SHGetSpecialFolderLocation

comctl32

ImageList_GetBkColor
ImageList_GetImageInfo
ImageList_DrawIndirect
ImageList_DrawEx
ImageList_Destroy
ImageList_GetImageCount
ImageList_GetIconSize
InitCommonControlsEx
_TrackMouseEvent
FlatSB_GetScrollProp

shlwapi

PathIsUNCW
PathQuoteSpacesW
PathStripToRootW
PathFindFileNameW
PathFindExtensionW
PathAppendW
PathRemoveFileSpecW
PathRemoveBackslashW
PathAddBackslashW
SHGetValueW
SHDeleteKeyW

ole32

CoRegisterMessageFilter
CoRevokeClassObject
DoDragDrop
OleFlushClipboard
OleIsCurrentClipboard
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CoFreeUnusedLibraries
OleRun
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoDisconnectObject
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
OleDuplicateData
CLSIDFromProgID
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
OleUninitialize
CoInitializeEx
CoInitialize
CLSIDFromString
StringFromCLSID
ProgIDFromCLSID
ReleaseStgMedium
CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
OleInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoGetClassObject

oleaut32

SafeArrayDestroy
SafeArrayCreate
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
DispCallFunc
VariantCopy
VarDateFromStr
SysStringLen
VariantChangeType
VarUI4FromStr
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserMarshal
BSTR_UserSize
SysAllocStringByteLen
SysStringByteLen
VariantInit
SysAllocStringLen
VariantClear
SysAllocString
VarBstrFromDate
VarUdateFromDate
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
OleCreateFontIndirect
VariantChangeTypeEx
LoadTypeLi
OleLoadPicturePath

oledlg

OleUIBusyW
OleUIAddVerbMenuW

uxtheme

SetWindowTheme

gdiplus

GdipDeleteMatrix
GdipTranslateMatrix
GdipRotateMatrix
GdipGetWorldTransform
GdipSetWorldTransform
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatHotkeyPrefix
GdipSetTextRenderingHint
GdipDrawString
GdipResetWorldTransform
GdipDrawImageRectRect
GdipCreateBitmapFromHICON
GdipCreateBitmapFromHBITMAP
GdipBitmapLockBits
GdipGetImagePixelFormat
GdipBitmapGetPixel
GdipGetImageThumbnail
GdipLoadImageFromFile
GdipSaveImageToFile
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreatePen1
GdipCreateMatrix
GdipDrawPolygon
GdipFillPolygon
GdipGetImageGraphicsContext
GdipCreateHICONFromBitmap
GdipGetImageHeight
GdipReleaseDC
GdipFillRectangle
GdipDrawImageRect
GdipSetPenLineJoin
GdipLoadImageFromStream
GdipCreateTexture
GdipSetStringFormatTrimming
GdipSetStringFormatFlags
GdipDrawRectangleI
GdipCreatePen2
GdipCreateHBITMAPFromBitmap
GdiplusStartup
GdiplusShutdown
GdipSetInterpolationMode
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipBitmapUnlockBits
GdipDeletePen
GdipGetImageWidth
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipSetImageAttributesOutputChannel
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipSetPixelOffsetMode
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipFillRectangleI
GdipCloneFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFont
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipCreateFontFamilyFromName
GdipDrawImageRectI
GdipDrawImageI
GdipSetSmoothingMode
GdipGraphicsClear
GdipDeleteFont
GdipCloneImage
GdipDisposeImage
GdipDrawLine

dbghelp

ImageDirectoryEntryToData

ntdll

NtQuerySystemInformation
NtSuspendProcess
NtTerminateProcess
NtClose
NtOpenProcess
NtResumeProcess
_CIpow
_snprintf
NtQueryVirtualMemory

rpcrt4

RpcAsyncCompleteCall
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcStringFreeA
RpcAsyncInitializeHandle
RpcBindingFree
RpcAsyncCancelCall
RpcServerListen
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcServerRegisterIf
RpcMgmtStopServerListening
NdrAsyncClientCall
NdrAsyncServerCall

mpr

WNetGetUniversalNameW

crypt32

CryptProtectData
CryptUnprotectData

ws2_32

ntohl
htonl

oleacc

CreateStdAccessibleObject
AccessibleObjectFromWindow
LresultFromObject

imm32

ImmGetOpenStatus
ImmGetContext
ImmReleaseContext

winmm

PlaySoundW

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 791KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 57KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 649KB - Virtual size: 649KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vkhlp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

07/06/2005, 08:09

Not After

30/05/2020, 10:48

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

24/08/2011, 00:00

Not After

30/05/2020, 10:48

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/04/2013, 00:00

Not After

08/04/2014, 23:59

Subject

CN=Comodo Security Solutions,O=Comodo Security Solutions,POSTALCODE=07013,STREET=Suite 100+STREET=1255 Broad St.,L=Clifton,ST=New Jersey,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

83:47:77:1c:a2:b0:72:27:4a:f2:db:c0:f2:ce:73:74:10:b0:0b:97
Signer

Actual PE Digest

83:47:77:1c:a2:b0:72:27:4a:f2:db:c0:f2:ce:73:74:10:b0:0b:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SVNStorage\Projects\CIS_7.0\vkhlp\obj\Release\vkhlp.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

feb30e9aa5a77d0d1aa9b6417cd34ef4

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90Certificate

Extended Key Usages

Key Usages

1e:9b:0d:86:37:c9:34:77:ef:4d:7d:38:b7:bb:59:2f:c0:c9:3b:08Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

winmm

oleacc

urlmon

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

imm32

ws2_32

comctl32

wininet

Exports

Exports

Sections

.text Size: 3.5MB - Virtual size: 3.5MB

.rdata Size: 936KB - Virtual size: 936KB

.data Size: 167KB - Virtual size: 185KB

.pdata Size: 164KB - Virtual size: 163KB

text Size: 7KB - Virtual size: 7KB

data Size: 25KB - Virtual size: 24KB

.rsrc Size: 80KB - Virtual size: 80KB

.reloc Size: 52KB - Virtual size: 52KB

e4baea09ee90a9bf95ce46f4d6ac1b20

Code Sign

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4bCertificate

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bbCertificate

Extended Key Usages

Key Usages

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90Certificate

Extended Key Usages

Key Usages

46:25:12:41:fe:be:6d:76:4b:83:c4:4c:10:dc:6a:64:ea:f3:09:a5Signer

Headers

File Characteristics

Imports

oleaut32

user32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 259KB - Virtual size: 259KB

.rdata Size: 70KB - Virtual size: 70KB

.data Size: 2KB - Virtual size: 21KB

.pdata Size: 23KB - Virtual size: 22KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

1e:9b:0d:86:37:c9:34:77:ef:4d:7d:38:b7:bb:59:2f:c0:c9:3b:08
Signer

.text
Size: 3.5MB - Virtual size: 3.5MB

.rdata
Size: 936KB - Virtual size: 936KB

.data
Size: 167KB - Virtual size: 185KB

.pdata
Size: 164KB - Virtual size: 163KB

text
Size: 7KB - Virtual size: 7KB

data
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 80KB - Virtual size: 80KB

.reloc
Size: 52KB - Virtual size: 52KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

46:25:12:41:fe:be:6d:76:4b:83:c4:4c:10:dc:6a:64:ea:f3:09:a5
Signer

.text
Size: 259KB - Virtual size: 259KB

.rdata
Size: 70KB - Virtual size: 70KB

.data
Size: 2KB - Virtual size: 21KB

.pdata
Size: 23KB - Virtual size: 22KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

0a:3d:84:ed:dc:9e:4b:49:72:51:99:2b:51:23:4f:e7:e6:86:71:80
Signer

.text
Size: 1.4MB - Virtual size: 1.4MB

.rdata
Size: 531KB - Virtual size: 530KB

.data
Size: 32KB - Virtual size: 81KB

.pdata
Size: 76KB - Virtual size: 76KB

text
Size: 3KB - Virtual size: 2KB

data
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 75KB - Virtual size: 75KB

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b
Certificate

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb
Certificate

07:1a:e4:a2:40:2b:b0:ad:40:f3:fb:d4:40:2b:92:90
Certificate

3f:38:b1:ce:bd:37:e6:5d:5c:0c:dd:65:22:10:f4:19:99:b3:75:d8
Signer