0ad90a49f771bea7d61045a784ed1895_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0ad90a49f771bea7d61045a784ed1895_JaffaCakes118
Size

1.8MB
MD5

0ad90a49f771bea7d61045a784ed1895
SHA1

c92eb4207aa5a2bc8ef9618c0e3c194d253d45bc
SHA256

38e986550c6550ef26cf41861823625db0fc3c9b6318f8c756fcfced5975dce7
SHA512

c1f55d8ba37aeca77f963b9034f97218c0f25f07687a1ddb9570a1f09bb9ac7aa70653c1f0da4cf3ce73b879a5c2b4539d4102a4add530ecbfb122b94f1a4028
SSDEEP

49152:BZqizU7AMeDVL5GuMOZ14CsopDSweCTEq84rr:nH3MsVdlT1MopD4gE0

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/ZipDLL.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack004/out.upx
unpack001/$PLUGINSDIR/nsislog.dll
unpack001/$PLUGINSDIR/nsisos.dll
unpack001/$PLUGINSDIR/text.txt
unpack001/$_73_

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

0ad90a49f771bea7d61045a784ed1895_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28a099a911237a28521d8b7ea250f089

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

01/05/2013, 23:59

Subject

CN=Friendly Apps,O=Friendly Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:4b:84:ef:82:a8:75:dd:53:54:52:c9:c1:95:a8:99:09:14:4c:c8
Signer

Actual PE Digest

b9:4b:84:ef:82:a8:75:dd:53:54:52:c9:c1:95:a8:99:09:14:4c:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/Savings Sidekick/Chrome/Savings Sidekick.crx
.zip
background.html
.html
crossriderManifest.json
icons/actions/icon1.png
.png
icons/icon128.png
.png
icons/icon16.png
.png
icons/icon48.png
.png
js/api/chrome.js
.js
js/api/cookie.js
.js
js/api/message.js
.js
js/background.js
.js
js/lib/app_api.js
.js
js/lib/async_api.js
.js
js/lib/bg_app_api.js
.js
js/lib/cookie_store.js
.js
js/lib/data_store.js
.js
js/lib/delegate.js
.js
js/lib/events.js
.js
js/lib/onBGDocumentLoad.js
.js
js/lib/reports.js
.js
js/lib/util.js
.js
manifest.json
$PLUGINSDIR/CleanChromePrefs.vbs
.vbs
$PLUGINSDIR/Dialer.dll
.dll windows:4 windows x86 arch:x86

6504337db30ea93d33d7a714fefff047

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
lstrcpynA
GlobalAlloc

Exports

Exports

AttemptConnect
AutodialHangup
AutodialOnline
AutodialUnattended
GetConnectedState

Sections

.text
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 375B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ExecDos.dll
.dll windows:5 windows x86 arch:x86

b997a221e444f5e6463b28778735cf2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
Sleep
lstrcatA
lstrcmpiA
TerminateProcess
ReadFile
GetExitCodeProcess
PeekNamedPipe
CreateFileA
FlushFileBuffers
WriteFile
lstrlenA
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
GetProcAddress
GetModuleHandleA
GlobalAlloc
GetExitCodeThread
WaitForSingleObject
CreateThread
lstrcpyA
lstrcpynA

user32

wsprintfA
GetClassNameA
GetDlgItem
FindWindowExA
SendMessageA

Exports

Exports

exec
isdone
wait

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Processes.dll
.dll windows:4 windows x86 arch:x86

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
WriteFile
SetFilePointer
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo

user32

FindWindowA
GetDesktopWindow
wsprintfA
UpdateWindow

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/RemoveFromList.vbs
.vbs
$PLUGINSDIR/Savings Sidekick.xpi
.zip
chrome.manifest
chrome/content/background.html
.html .js polyglot
chrome/content/browser.xul
.xml
chrome/content/crossrider.js
.js
chrome/content/crossriderapi.js
.js
chrome/content/dialog.js
.js
chrome/content/options.js
.js
chrome/content/options.xul
.xml
chrome/content/search_dialog.xul
.xml
chrome/content/update.html
.html .js polyglot
defaults/preferences/prefs.js
install.rdf
.xml
locale/en-US/translations.dtd
skin/button1.png
.png
skin/button2.png
.png
skin/button3.png
.png
skin/button4.png
.png
skin/button5.png
.png
skin/crossrider_statusbar.png
.png
skin/icon128.png
.png
skin/icon16.png
.png
skin/icon24.png
.png
skin/icon48.png
.png
skin/panelarrow-up.png
.png
skin/popup.css
skin/popup.html
.html
skin/popup_binding.xml
.xml
skin/skin.css
skin/update.css
$PLUGINSDIR/StdUtils.dll
.dll windows:5 windows x86 arch:x86

6aa1fb50f909cdf4bea3d3523348e900

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

srand
sscanf
_snprintf
rand
time
memset
??2@YAPAXI@Z
strncpy
_stricmp
strchr
??3@YAXPAX@Z

shlwapi

ord176

kernel32

GlobalFree
MultiByteToWideChar
GetVersionExA
CreateThread
WaitForSingleObject
CloseHandle
TerminateThread
GetCommandLineA
GlobalAlloc
lstrcpynA

user32

wsprintfA
MessageBoxA
MessageBoxW

shell32

ShellExecuteExA
ShellExecuteA
SHFileOperationA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysAllocString

Exports

Exports

DisableVerboseMode
Dummy
EnableVerboseMode
ExecShellAsUser
ExecShellWait
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetParameter
Rand
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
Time
TrimStr
TrimStrLeft
TrimStrRight
WaitForProc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ZipDLL.dll
.dll windows:4 windows x86 arch:x86

f10b94e3705eae25c7617ba56a648b77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
GetLocaleInfoW
LoadLibraryA
IsBadCodePtr
LocalFree
FormatMessageA
GetLastError
MapViewOfFile
CreateFileMappingA
CloseHandle
UnmapViewOfFile
GetDiskFreeSpaceA
CreateFileA
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetDriveTypeA
SetVolumeLabelA
DeleteFileA
MoveFileA
CreateDirectoryA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetFileType
FlushFileBuffers
SetStdHandle
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetEndOfFile
ReadFile
SetFilePointer
GetACP
GetOEMCP
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetProcAddress
GetStringTypeA
GetStringTypeW
IsBadReadPtr

user32

SendMessageA
GetDlgItem
SetWindowTextA
FindWindowExA
OemToCharBuffA
CharToOemBuffA

Exports

Exports

extractall
extractfile

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bringtofront.exe
.exe windows:5 windows x86 arch:x86

7149c505d102f407bf2c196880b13ae8

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

01/05/2013, 23:59

Subject

CN=Friendly Apps,O=Friendly Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe
Signer

Actual PE Digest

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetSetCookieA
InternetGetCookieA
InternetOpenA

kernel32

LoadLibraryW
IsValidLocale
InterlockedDecrement
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
DebugBreak
OutputDebugStringA
CloseHandle
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
InitializeCriticalSectionAndSpinCount
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
InterlockedExchange
LoadLibraryExA
GetExitCodeProcess
Sleep
OpenProcess
TerminateProcess
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
ExitProcess
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
GetStringTypeW
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetSystemTimeAsFileTime
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
LCMapStringA
RtlUnwind
FindResourceA
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapAlloc
EncodePointer
DecodePointer
GetLocalTime
HeapFree

user32

CharLowerA
MessageBoxA
LoadStringA
CharNextA
SendMessageA
SetWindowLongA
wvsprintfA
UnregisterClassA
PostMessageA
IsWindowVisible
FindWindowExA
GetParent
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SetFocus
GetWindowThreadProcessId
GetForegroundWindow
EnumWindows
GetWindowTextA
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SetTimer
GetDesktopWindow
DestroyWindow
CallWindowProcA
GetWindowLongA
CreateWindowExA
RegisterClassExA
DefWindowProcA
LoadCursorA
GetClassInfoExA

advapi32

RegCreateKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
VariantInit
SysAllocStringLen
VariantChangeType
SysAllocString
VariantClear

shlwapi

ord176

Sections

.text
Size: 643KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsislog.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Log

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisos.dll
.dll windows:1 windows x86 arch:x86

a70233c77fd258ec47709388c2338273

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetEnvironmentStringsA
GetVersionExA
RtlUnwind
RtlZeroMemory
lstrcpyA

crtdll

_fdopen
_open_osfhandle
_ultoa
fclose
_cexit
malloc
printf
raise
setbuf
strcpy

Exports

Exports

osplatform
osversion

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 588B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 156B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE

.edata
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/text.txt
.exe windows:4 windows x86 arch:x86

0047888f327cf14ecbaf4755bc6d52a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\source\notepad++\trunk\PowerEditor\bin\npp.pdb

Imports

comctl32

InitCommonControlsEx
ImageList_SetIconSize
ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Draw

shlwapi

PathStripPathW
PathIsRelativeW
PathAddExtensionW
PathFindExtensionW
PathRemoveExtensionW
PathMatchSpecW
PathIsDirectoryW
PathCompactPathExW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW

shell32

SHGetMalloc
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellExecuteW
DragQueryPoint
SHGetPathFromIDListW
SHBrowseForFolderW
DragFinish
DragQueryFileW

kernel32

GlobalAlloc
CreateDirectoryW
GlobalSize
FindClose
FindNextFileW
FindFirstFileW
TerminateThread
CreateThread
CopyFileW
lstrcpynW
GetSystemInfo
GetModuleHandleW
GetVersionExW
ExpandEnvironmentStringsW
GetTimeFormatW
GetDateFormatW
GetLocalTime
MulDiv
WaitForMultipleObjects
WaitForSingleObject
OpenEventW
SetEvent
GetExitCodeProcess
ReadFile
PeekNamedPipe
Sleep
ResumeThread
CreateEventW
CreateProcessW
CreatePipe
GetACP
SizeofResource
LockResource
LoadResource
FindResourceW
LocalLock
LocalAlloc
GetTempPathW
CreateMutexW
SetLastError
GetCommandLineW
HeapReAlloc
VirtualAlloc
VirtualFree
GlobalLock
HeapDestroy
SetFilePointer
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
ExitProcess
HeapSize
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentDirectoryA
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetProcessHeap
HeapAlloc
GetVersionExA
GetCommandLineA
HeapFree
GetSystemTimeAsFileTime
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
LocalUnlock
LoadLibraryW
GetProcAddress
CreateFileW
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GlobalFree
FreeLibrary
SetCurrentDirectoryW
GetCurrentThreadId
GetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
FormatMessageW
LocalFree
GetFileAttributesW
SetFileAttributesW
MoveFileW
GetFullPathNameW
GetLongPathNameW
lstrcmpiW
DeleteFileW
lstrcpyW
lstrlenW
GetModuleFileNameW
lstrcatW
lstrcmpW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
SetStdHandle
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
HeapCreate

user32

FindWindowW
ReleaseCapture
RegisterClassExW
CreateDialogIndirectParamW
GetCapture
DragDetect
AppendMenuW
RegisterWindowMessageW
IsWindow
DestroyCursor
CreateCursor
ScrollWindow
SetScrollInfo
SetMenuItemInfoW
InsertMenuItemW
LoadStringW
TranslateAcceleratorW
GetMessageA
GetMessageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetMenuItemCount
IsClipboardFormatAvailable
GetClipboardData
GetMenuStringW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MonitorFromWindow
GetMonitorInfoW
SetForegroundWindow
SetWindowPlacement
GetMenuState
EnableMenuItem
CheckMenuRadioItem
DestroyAcceleratorTable
GetSubMenu
GetMenuItemID
ModifyMenuW
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
RemoveMenu
LoadIconW
DestroyIcon
mouse_event
WindowFromPoint
PtInRect
SetDlgItemInt
MapWindowPoints
GetKeyState
CreatePopupMenu
InsertMenuW
DestroyMenu
TrackPopupMenu
GetWindowTextW
MessageBoxA
SetCapture
GetActiveWindow
IsChild
GetDlgCtrlID
RedrawWindow
GetCursorPos
CreateAcceleratorTableW
IsWindowUnicode
SetWindowLongA
CallWindowProcA
CharUpperW
SetWindowsHookExW
UnhookWindowsHookEx
SetParent
SetWindowTextW
LoadBitmapW
CallNextHookEx
ScreenToClient
GetDlgItemTextW
SetDlgItemTextW
MessageBoxW
GetDlgItemInt
CharLowerW
DrawIcon
TranslateMessage
CreateDialogParamW
DrawFocusRect
FillRect
FrameRect
SendDlgItemMessageW
SetWindowLongW
GetWindowLongW
GetSysColor
InflateRect
ClientToScreen
CallWindowProcW
IsWindowVisible
GetWindowRect
ShowWindow
SetWindowPos
RegisterClassW
BeginPaint
EndPaint
GetFocus
PostMessageW
LoadCursorW
SetCursor
DestroyWindow
CreateCaret
DestroyCaret
GetSystemMetrics
GetWindowPlacement
MoveWindow
CreateWindowExW
SetFocus
GetScrollPos
GetScrollRange
UpdateWindow
DefWindowProcW
DrawFrameControl
GetMenu
ShowCaret
MessageBeep
DrawTextW
SetCaretPos
HideCaret
GetParent
ShowScrollBar
SetScrollRange
InvalidateRect
SetScrollPos
GetKeyboardState
ToAscii
wsprintfW
GetDC
DrawEdge
DrawTextExW
ReleaseDC
GetClientRect
LoadImageW
DrawIconEx
GetDlgItem
SendMessageW
EnableWindow
DispatchMessageW
CreateMenu
GetClassNameW
PostQuitMessage
LoadMenuW
SystemParametersInfoW
SetMenu
IsDialogMessageW
IsDialogMessageA
PeekMessageW
IsZoomed
DeleteMenu
RealChildWindowFromPoint
IsIconic
DrawMenuBar
CheckMenuItem

gdi32

GetTextMetricsW
CreateHatchBrush
LineTo
MoveToEx
RestoreDC
SaveDC
DeleteDC
BitBlt
CreateCompatibleBitmap
GetObjectW
CreateFontW
SetBkColor
SetWindowOrgEx
OffsetWindowOrgEx
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateBitmap
EnumFontFamiliesExW
EndDoc
EndPage
ExtTextOutW
SetTextAlign
StartPage
StartDocW
DPtoLP
GetDeviceCaps
GetTextExtentPointW
CreateFontIndirectW
GetPixel
SetTextColor
CreateSolidBrush
GetTextExtentPoint32W
GetROP2
SetROP2
GetStockObject
CreatePen
Rectangle
DeleteObject
SetBkMode
CreateCompatibleDC
SelectObject

comdlg32

ChooseColorW
GetOpenFileNameW
PrintDlgW
GetSaveFileNameW

advapi32

RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
IsTextUnicode
RegQueryInfoKeyW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 792KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_72_
$_73_
.exe windows:4 windows x86 arch:x86

a4f7472959bb80652b46ef53fc672202

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
ExitProcess
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
Sleep
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_access
_assert
_cexit
_flsbuf
_iob
_isatty
_isctype
_onexit
_pctype
_setmode
_winmajor
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
free
fwrite
getenv
localtime
malloc
memcmp
memmove
memset
printf
putchar
puts
qsort
realloc
signal
strcmp
strncmp
strncpy
strtol
tolower
vfprintf

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$_75_/$_76_
Savings Sidekick-bg.exe
.exe windows:5 windows x86 arch:x86

7149c505d102f407bf2c196880b13ae8

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

01/05/2013, 23:59

Subject

CN=Friendly Apps,O=Friendly Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe
Signer

Actual PE Digest

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetSetCookieA
InternetGetCookieA
InternetOpenA

kernel32

LoadLibraryW
IsValidLocale
InterlockedDecrement
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
DebugBreak
OutputDebugStringA
CloseHandle
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
InitializeCriticalSectionAndSpinCount
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
InterlockedExchange
LoadLibraryExA
GetExitCodeProcess
Sleep
OpenProcess
TerminateProcess
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
ExitProcess
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
GetStringTypeW
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetSystemTimeAsFileTime
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
LCMapStringA
RtlUnwind
FindResourceA
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapAlloc
EncodePointer
DecodePointer
GetLocalTime
HeapFree

user32

CharLowerA
MessageBoxA
LoadStringA
CharNextA
SendMessageA
SetWindowLongA
wvsprintfA
UnregisterClassA
PostMessageA
IsWindowVisible
FindWindowExA
GetParent
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SetFocus
GetWindowThreadProcessId
GetForegroundWindow
EnumWindows
GetWindowTextA
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SetTimer
GetDesktopWindow
DestroyWindow
CallWindowProcA
GetWindowLongA
CreateWindowExA
RegisterClassExA
DefWindowProcA
LoadCursorA
GetClassInfoExA

advapi32

RegCreateKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
VariantInit
SysAllocStringLen
VariantChangeType
SysAllocString
VariantClear

shlwapi

ord176

Sections

.text
Size: 643KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Savings Sidekick.dll
.dll regsvr32 windows:5 windows x86 arch:x86

028605b94c7e91932ad48136b49ce158

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

01/05/2013, 23:59

Subject

CN=Friendly Apps,O=Friendly Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:48:64:f0:53:79:fe:6b:72:ec:a7:e4:12:b8:e6:45:a2:f5:3e:aa
Signer

Actual PE Digest

75:48:64:f0:53:79:fe:6b:72:ec:a7:e4:12:b8:e6:45:a2:f5:3e:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleacc

AccessibleObjectFromWindow

urlmon

CoInternetGetSession
URLDownloadToCacheFileA

wininet

HttpOpenRequestA
InternetSetCookieA
InternetReadFile
HttpQueryInfoA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetGetCookieA

ws2_32

inet_ntoa
gethostbyname
WSAStartup
WSACleanup

kernel32

QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcAddress
GetModuleHandleA
lstrlenA
InterlockedDecrement
InterlockedIncrement
DebugBreak
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
FreeLibrary
LoadLibraryA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
Sleep
TerminateProcess
WaitForSingleObject
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
SetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrlenW
ReleaseMutex
SetEvent
CreateThread
CreateEventA
InitializeCriticalSectionAndSpinCount
lstrcmpiA
DisableThreadLibraryCalls
GetTickCount
GetModuleHandleW
IsDBCSLeadByte
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
OpenMutexA
CreateMutexA
GetVersion
ExpandEnvironmentStringsA
GetStartupInfoW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapDestroy
HeapCreate
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
GetStringTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetCommandLineA
VirtualQuery
GetSystemInfo
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapFree
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
GetStringTypeExA
LCMapStringA
InterlockedPushEntrySList
GetModuleFileNameA
VirtualProtect
HeapReAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
InterlockedCompareExchange

user32

CharNextA
UnregisterClassA
LoadStringA
wvsprintfA
LoadCursorA
IsWindowVisible
GetWindowTextA
FindWindowExA
GetParent
SendMessageA
CharLowerA
MessageBoxA
CharNextW
PostMessageA
SetTimer
GetDesktopWindow
DestroyWindow
CallWindowProcA
GetWindowLongA
CreateWindowExA
RegisterClassExA
DefWindowProcA
KillTimer
GetClassInfoExA
SetWindowLongA
EnumWindows
GetWindowThreadProcessId

advapi32

RegQueryValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteKeyA
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegCreateKeyExA
RegOpenKeyExA

shell32

ShellExecuteA
SHGetFolderPathA
ShellExecuteExA

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromProgID
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoGetClassObject

oleaut32

VariantClear
DispCallFunc
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
VariantChangeType
VariantCopy
VariantInit
SysStringLen
SysFreeString
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 392KB - Virtual size: 391KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Savings Sidekick.exe
.exe windows:5 windows x86 arch:x86

7149c505d102f407bf2c196880b13ae8

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

01/05/2013, 23:59

Subject

CN=Friendly Apps,O=Friendly Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe
Signer

Actual PE Digest

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

InternetReadFile
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetConnectA
InternetCrackUrlA
InternetSetCookieA
InternetGetCookieA
InternetOpenA

kernel32

LoadLibraryW
IsValidLocale
InterlockedDecrement
lstrlenA
WideCharToMultiByte
MultiByteToWideChar
InterlockedIncrement
DebugBreak
OutputDebugStringA
CloseHandle
WaitForSingleObject
CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
LocalAlloc
DeleteCriticalSection
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
InitializeCriticalSectionAndSpinCount
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
InterlockedExchange
LoadLibraryExA
GetExitCodeProcess
Sleep
OpenProcess
TerminateProcess
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
HeapSize
ExitProcess
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
GetStringTypeW
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetSystemTimeAsFileTime
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
LCMapStringA
RtlUnwind
FindResourceA
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
VirtualProtect
HeapAlloc
EncodePointer
DecodePointer
GetLocalTime
HeapFree

user32

CharLowerA
MessageBoxA
LoadStringA
CharNextA
SendMessageA
SetWindowLongA
wvsprintfA
UnregisterClassA
PostMessageA
IsWindowVisible
FindWindowExA
GetParent
AttachThreadInput
SetForegroundWindow
BringWindowToTop
SetFocus
GetWindowThreadProcessId
GetForegroundWindow
EnumWindows
GetWindowTextA
GetMessageA
TranslateMessage
DispatchMessageA
KillTimer
SetTimer
GetDesktopWindow
DestroyWindow
CallWindowProcA
GetWindowLongA
CreateWindowExA
RegisterClassExA
DefWindowProcA
LoadCursorA
GetClassInfoExA

advapi32

RegCreateKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA
RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenProcessToken
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitialize
CLSIDFromProgID
CoTaskMemAlloc

oleaut32

SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysFreeString
VariantInit
SysAllocStringLen
VariantChangeType
SysAllocString
VariantClear

shlwapi

ord176

Sections

.text
Size: 643KB - Virtual size: 643KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Savings Sidekick.ico
Uninstall.exe.nsis

Sharing

General

Malware Config

Signatures

Files

28a099a911237a28521d8b7ea250f089

Code Sign

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

b9:4b:84:ef:82:a8:75:dd:53:54:52:c9:c1:95:a8:99:09:14:4c:c8Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

Sections

.text Size: 33KB - Virtual size: 32KB

.data Size: 512B - Virtual size: 140B

.rdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 107KB

.idata Size: 5KB - Virtual size: 4KB

.ndata Size: 1024B - Virtual size: 120KB

.rsrc Size: 13KB - Virtual size: 12KB

6504337db30ea93d33d7a714fefff047

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 570B

.rdata Size: 512B - Virtual size: 375B

.data Size: 512B - Virtual size: 156B

.reloc Size: 512B - Virtual size: 166B

b997a221e444f5e6463b28778735cf2b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 20B

.reloc Size: 512B - Virtual size: 290B

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

6aa1fb50f909cdf4bea3d3523348e900

Headers

DLL Characteristics

File Characteristics

Imports

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

b9:4b:84:ef:82:a8:75:dd:53:54:52:c9:c1:95:a8:99:09:14:4c:c8
Signer

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 140B

.rdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 107KB

.idata
Size: 5KB - Virtual size: 4KB

.ndata
Size: 1024B - Virtual size: 120KB

.rsrc
Size: 13KB - Virtual size: 12KB

.text
Size: 1024B - Virtual size: 570B

.rdata
Size: 512B - Virtual size: 375B

.data
Size: 512B - Virtual size: 156B

.reloc
Size: 512B - Virtual size: 166B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 20B

.reloc
Size: 512B - Virtual size: 290B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 28B

.rsrc
Size: 1024B - Virtual size: 864B

.reloc
Size: 1024B - Virtual size: 832B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1024B - Virtual size: 741B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 88B

.reloc
Size: 512B - Virtual size: 190B

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 21KB - Virtual size: 27KB

.reloc
Size: 12KB - Virtual size: 12KB

56:d1:7d:2d:52:c2:bc:3a:2c:ec:da:12:9c:a3:36:19
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

64:44:d9:26:55:dd:2a:b9:0f:d1:7b:e1:50:46:57:35:18:20:db:fe
Signer