dialog
initDialog
show
Overview
overview
4Static
static
309d9656737...18.exe
windows7-x64
309d9656737...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...mm.dll
windows7-x64
1$PLUGINSDI...mm.dll
windows10-2004-x64
1$PLUGINSDI...se.rtf
windows7-x64
4$PLUGINSDI...se.rtf
windows10-2004-x64
1$PLUGINSDI...NA.rtf
windows7-x64
4$PLUGINSDI...NA.rtf
windows10-2004-x64
1$_19_/Cust...ge.dll
windows7-x64
3$_19_/Cust...ge.dll
windows10-2004-x64
3$_19_/DNAAdmin.exe
windows7-x64
1$_19_/DNAAdmin.exe
windows10-2004-x64
1$_19_/DNAService.exe
windows7-x64
1$_19_/DNAService.exe
windows10-2004-x64
1$_19_/czlogclient.exe
windows7-x64
1$_19_/czlogclient.exe
windows10-2004-x64
1$_19_/dgs.dll
windows7-x64
1$_19_/dgs.dll
windows10-2004-x64
1$_19_/gicconn.dll
windows7-x64
1$_19_/gicconn.dll
windows10-2004-x64
1$_19_/license.rtf
windows7-x64
4$_19_/license.rtf
windows10-2004-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
09d965673713e5ba6cd0d308fb756840_JaffaCakes118.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
09d965673713e5ba6cd0d308fb756840_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/djcomm.dll
Resource
win7-20240220-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/djcomm.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/license.rtf
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/license.rtf
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/licenseDNA.rtf
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/licenseDNA.rtf
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
$_19_/CustomStorage.dll
Resource
win7-20240611-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
$_19_/CustomStorage.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
$_19_/DNAAdmin.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
$_19_/DNAAdmin.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
$_19_/DNAService.exe
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$_19_/DNAService.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$_19_/czlogclient.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
$_19_/czlogclient.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
$_19_/dgs.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral22
Sample
$_19_/dgs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral23
Sample
$_19_/gicconn.dll
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
$_19_/gicconn.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral25
Sample
$_19_/license.rtf
Resource
win7-20231129-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
$_19_/license.rtf
Resource
win10v2004-20240508-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
09d965673713e5ba6cd0d308fb756840_JaffaCakes118
-
Size
677KB
-
MD5
09d965673713e5ba6cd0d308fb756840
-
SHA1
0548e2d115018f7b3ddf53600e99ad980ac5627e
-
SHA256
47b97b8c666108c52703591b2fc88ff124805fd172de0c6a06898e1641a47ca7
-
SHA512
e495b10ff68758a134e973a2ca19b929d6e96f1dc78980ea0e5526a99d87d314bdb7d05381e5ea9855567496b6a3c57daa0e72ae5994817d8b12f81263b708c5
-
SSDEEP
12288:tg6Hh/THx1iCUYb5s7BN1Yli3Mg+CCfpkvrnILxwb1plSPk2N:tPHh/iHYb+d4i8FNFxwbo82N
Score
3/10
Malware Config
Signatures
-
Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource 09d965673713e5ba6cd0d308fb756840_JaffaCakes118 unpack001/$PLUGINSDIR/InstallOptions.dll unpack001/$PLUGINSDIR/System.dll unpack001/$PLUGINSDIR/djcomm.dll unpack001/$_19_/gicconn.dll -
NSIS installer 2 IoCs
resource yara_rule sample nsis_installer_1 sample nsis_installer_2
Files
-
09d965673713e5ba6cd0d308fb756840_JaffaCakes118.exe windows:4 windows x86 arch:x86
dfb06052e74b26a42b0e490bd1c07959
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
MulDiv
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
RegisterClassA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
wvsprintfA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
EmptyClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
SetForegroundWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ndata Size: - Virtual size: 64KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/InstallOptions.dll.dll windows:4 windows x86 arch:x86
b1cd0d78f652ce5fc63f0879371af012
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1012B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/System.dll.dll windows:4 windows x86 arch:x86
4ec328f99bdd944fc98d8a5cf11f7a62
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Exports
Exports
Alloc
Call
Copy
Free
Get
Int64Op
Store
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 784B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/ad.bmp
-
$PLUGINSDIR/djcomm.dll.dll windows:4 windows x86 arch:x86
bbdbccf46fb8a2be55b3726b63349598
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
e:\Work\Product\SourceCode\SetupTool\RunConsole\nsisdnas\Release\nsisdnas.pdb
Imports
wininet
InternetCloseHandle
InternetOpenW
InternetOpenUrlA
InternetAttemptConnect
InternetReadFile
kernel32
GetLastError
CloseHandle
DeviceIoControl
CreateFileW
DefineDosDeviceW
WideCharToMultiByte
MultiByteToWideChar
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
QueryDosDeviceA
Process32NextW
Sleep
TerminateProcess
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
lstrcpyA
CreateMutexA
MoveFileExW
lstrcatW
lstrcpyW
GetTempPathW
InterlockedExchange
GetACP
GetLocaleInfoA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
VirtualProtect
GetCurrentDirectoryW
GetTimeZoneInformation
GlobalFree
GetSystemInfo
LCMapStringA
LCMapStringW
IsBadReadPtr
IsBadCodePtr
GetCurrentProcessId
GetVersionExA
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetDriveTypeA
FlushFileBuffers
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
ReadFile
FreeLibrary
GetProcAddress
LoadLibraryW
GetVolumeInformationW
GetLogicalDriveStringsW
GetVersion
GetSystemDefaultLangID
GetTickCount
WriteFile
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
ExitProcess
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
GetLocalTime
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetModuleHandleA
GetFullPathNameW
GetCurrentDirectoryA
SetUnhandledExceptionFilter
VirtualQuery
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
SetFilePointer
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
GetOEMCP
GetCPInfo
GetStringTypeA
GetStringTypeW
LoadLibraryA
SetStdHandle
user32
wsprintfW
advapi32
ControlService
QueryServiceStatus
OpenSCManagerW
OpenServiceA
CloseServiceHandle
StartServiceW
CreateServiceA
ole32
CoCreateInstance
CoInitialize
CoUninitialize
OleRun
shlwapi
StrStrIW
ws2_32
gethostbyname
gethostname
WSAStartup
WSACleanup
Exports
Exports
CheckComInterface
CloseMutex
CreateDriver
DisMountAll
ExecWaitSilent
FindFVMounted
KillProc
SetMutex
StatGetInfo
StringTransfer
query_service
start_service
stop_service
urldownload
urlquery
urlread
Sections
.text Size: 62KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$PLUGINSDIR/io3.ini
-
$PLUGINSDIR/ioSpecial.ini
-
$PLUGINSDIR/left.bmp
-
$PLUGINSDIR/license.rtf.rtf
-
$PLUGINSDIR/licenseDNA.rtf.rtf
-
$PLUGINSDIR/modern-wizard.bmp
-
$_19_/CustomStorage.dll.dll windows:5 windows x86 arch:x86
789d77b543725bf3cd3e9689618a440b
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
74:94:07:54:e8:6f:44:20:75:fe:80:b3:91:c0:b8:13Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before21/06/2010, 00:00Not After21/06/2011, 23:59SubjectCN=BEIJING DIANJI TECHNOLOGY LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING DIANJI TECHNOLOGY LTD.,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
e0:9c:03:64:54:8e:ba:d5:ba:a7:05:e7:f5:59:33:10:85:06:61:97Signer
Actual PE Digeste0:9c:03:64:54:8e:ba:d5:ba:a7:05:e7:f5:59:33:10:85:06:61:97Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
WaitForSingleObject
SetEvent
CreateEventA
CloseHandle
Sleep
SetFilePointerEx
ReadFile
GetLastError
WriteFile
LoadLibraryW
GetProcAddress
GetModuleFileNameW
CreateFileW
GetFileSize
DeviceIoControl
SetEndOfFile
GetFileInformationByHandle
SetFileAttributesW
VirtualFree
VirtualAlloc
SetFilePointer
CreateDirectoryW
WideCharToMultiByte
MultiByteToWideChar
CreateFileA
HeapFree
GetLocalTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
RaiseException
RtlUnwind
HeapCreate
HeapDestroy
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
LoadLibraryA
SetStdHandle
FlushFileBuffers
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
shell32
SHGetFolderPathW
Exports
Exports
_CS_CloseFile@4
_CS_DeleteFile@4
_CS_FlushFileBuffers@4
_CS_OpenFile2@12
_CS_OpenFile@8
_CS_ReadFile@16
_CS_ReleaseOverlap@4
_CS_SetFilePointer@20
_CS_WriteFile@16
_CS_WriteFileEx@20
Sections
.text Size: 86KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_19_/DNAAdmin.exe.exe windows:4 windows x86 arch:x86
ce72261ba835e1666b9f2af4d51adce6
Code Sign
6c:21:3e:f2:63:cf:fd:1f:7a:54:b1:29:64:a1:5c:83Certificate
IssuerCN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=USNot Before12/11/2009, 00:00Not After12/11/2010, 23:59SubjectCN=北京点击科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京点击科技有限公司,L=北京,ST=北京,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Key Usages
KeyUsageDigitalSignature
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before25/04/2007, 00:00Not After09/07/2019, 18:40SubjectCN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before09/07/1999, 18:31Not After09/07/2019, 18:40SubjectCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before30/04/2007, 00:00Not After29/04/2012, 23:59SubjectCN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB Paths
d:\DailyBuild\LavaGame\dianji\ring\client\lnengn\bin\Release\lne.pdb
Imports
ws2_32
WSAStartup
gethostname
WSACleanup
WSAGetLastError
gethostbyname
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSACreateEvent
WSASetEvent
closesocket
WSAEventSelect
WSAResetEvent
connect
socket
WSAEnumNetworkEvents
WSACloseEvent
getsockname
recv
send
inet_addr
sqlite3
sqlite3_exec
sqlite3_open
sqlite3_close
kernel32
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
GetModuleFileNameW
ReleaseMutex
MoveFileExW
GetLastError
CreateMutexW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetCurrentThreadId
lstrlenW
lstrcpyW
GetModuleHandleW
FreeLibrary
LoadLibraryExW
lstrcmpiW
lstrcpynW
GetPrivateProfileSectionW
Sleep
lstrcpynA
lstrlenA
GlobalUnlock
GlobalLock
GetTickCount
MulDiv
CompareStringW
lstrcmpW
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
WriteFile
CreateFileW
ReadFile
GetFileSize
GlobalAlloc
WinExec
lstrcatW
GetFileAttributesW
GetProcAddress
LoadLibraryW
SizeofResource
LoadLibraryA
GetSystemDirectoryA
LocalFree
WaitForMultipleObjects
GetVolumeInformationW
GetLogicalDriveStringsW
GetSystemDefaultLangID
CreateThread
GetTempPathW
GetCurrentProcessId
DeleteFileW
GetTempFileNameW
SetFileAttributesW
GetFileSizeEx
GetSystemInfo
VirtualProtect
TerminateProcess
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThread
SetLastError
TlsAlloc
VirtualQuery
SetUnhandledExceptionFilter
GetModuleFileNameA
QueryPerformanceCounter
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
FatalAppExitA
GetLocalTime
FindFirstFileW
GetDriveTypeW
FindClose
GetStartupInfoW
GetModuleHandleA
ExitThread
RtlUnwind
ExitProcess
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
UnhandledExceptionFilter
GetStdHandle
FreeEnvironmentStringsA
DeleteCriticalSection
InitializeCriticalSection
RaiseException
WideCharToMultiByte
InterlockedIncrement
WaitForSingleObject
ResetEvent
InterlockedDecrement
SetEvent
CloseHandle
CreateEventW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFilePointer
IsBadReadPtr
IsBadCodePtr
GetTimeFormatA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
GetOEMCP
GetDateFormatA
GetCPInfo
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetTimeZoneInformation
GetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
GetDriveTypeA
GetStringTypeA
GetStringTypeW
GetFullPathNameW
GetFullPathNameA
SetEndOfFile
GetLocaleInfoW
CompareStringA
SetEnvironmentVariableA
LCMapStringA
GetVersion
LCMapStringW
user32
SetClipboardData
EmptyClipboard
InflateRect
FindWindowExW
GetSysColor
wsprintfW
LoadIconW
RedrawWindow
GetWindowTextLengthW
GetWindowTextW
SetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
EnableWindow
OffsetRect
SetWindowRgn
MoveWindow
GetDC
SetCapture
GetCapture
SetCursor
DrawEdge
FillRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetSystemMetrics
GetMessagePos
ReleaseCapture
DestroyIcon
SetRectEmpty
KillTimer
SetTimer
EnableMenuItem
ScreenToClient
CreateDialogParamW
IsWindowVisible
ShowWindow
IsIconic
GetWindow
GetClassNameW
GetMenu
IsMenu
AdjustWindowRectEx
GetWindowRgn
WindowFromDC
RegisterWindowMessageW
GetScrollInfo
BeginDeferWindowPos
DeferWindowPos
SetClipboardViewer
SystemParametersInfoW
GetDlgItem
SetWindowTextW
EndDialog
GetClipboardOwner
OpenClipboard
IsClipboardFormatAvailable
GetClipboardData
CloseClipboard
GetActiveWindow
DialogBoxParamW
ChangeClipboardChain
LoadStringA
SetFocus
PostQuitMessage
RemoveMenu
PtInRect
MapWindowPoints
TrackPopupMenuEx
CreatePopupMenu
EndDeferWindowPos
IntersectRect
MessageBoxW
UpdateWindow
GetMenuItemCount
AppendMenuW
MessageBeep
InvalidateRect
GetWindowRect
GetClientRect
SetWindowPos
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
GetSubMenu
MonitorFromPoint
GetMonitorInfoW
GetCursorPos
TrackPopupMenu
DestroyMenu
SetForegroundWindow
CallWindowProcW
GetWindowLongW
TranslateAcceleratorW
CharNextW
LoadStringW
LoadMenuW
LoadAcceleratorsW
CreateWindowExW
GetClassInfoExW
LoadCursorW
LoadImageW
RegisterClassExW
DestroyWindow
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
IsWindow
PostMessageW
SendMessageW
SetWindowLongW
wvsprintfW
UnregisterClassW
UnregisterClassA
GetParent
gdi32
CreateSolidBrush
CreatePen
RoundRect
OffsetRgn
CreateRectRgnIndirect
GetClipRgn
ExtSelectClipRgn
CreateRectRgn
GetPixel
BitBlt
CreatePolygonRgn
CreateCompatibleDC
CreateCompatibleBitmap
SetBkColor
ExtTextOutW
SetRectRgn
CreatePatternBrush
SelectObject
PatBlt
DeleteObject
DeleteDC
CreateBitmap
CombineRgn
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
shell32
Shell_NotifyIconW
ord155
SHGetPathFromIDListW
ord165
SHGetMalloc
ord152
SHGetDesktopFolder
SHGetFileInfoW
SHBrowseForFolderW
ShellExecuteW
ole32
StringFromGUID2
OleRun
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CoInitialize
CoInitializeEx
oleaut32
SafeArrayCreateVector
VariantInit
VariantClear
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarUI4FromStr
SysAllocString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
shlwapi
PathFindExtensionW
StrStrIW
PathFileExistsW
comctl32
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
InitCommonControlsEx
msimg32
GradientFill
Sections
.text Size: 304KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 52KB - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
$_19_/DNAService.exe.exe windows:5 windows x86 arch:x86
885e802c755ad5d0eee2ee8b0ab38153
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
74:94:07:54:e8:6f:44:20:75:fe:80:b3:91:c0:b8:13Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before21/06/2010, 00:00Not After21/06/2011, 23:59SubjectCN=BEIJING DIANJI TECHNOLOGY LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING DIANJI TECHNOLOGY LTD.,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
f0:81:4b:09:a5:cd:bd:22:a5:77:17:40:ef:75:aa:4a:7a:de:e7:e4Signer
Actual PE Digestf0:81:4b:09:a5:cd:bd:22:a5:77:17:40:ef:75:aa:4a:7a:de:e7:e4Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\MyProjects\Dianji\client\bin\dnaservice.pdb
Imports
ws2_32
setsockopt
send
socket
closesocket
WSAEventSelect
ntohs
recv
getsockname
listen
bind
inet_addr
WSAGetLastError
gethostbyname
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
getservbyport
WSASetLastError
WSASetEvent
WSAResetEvent
WSAEnumNetworkEvents
WSACreateEvent
connect
WSASend
accept
WSAIoctl
WSAStartup
WSACleanup
WSARecv
shutdown
sendto
recvfrom
select
rpcrt4
UuidCreate
kernel32
HeapSize
IsValidCodePage
CreateEventW
CloseHandle
WaitForSingleObject
SetEvent
Sleep
GetLocalTime
OpenEventW
ResetEvent
ReadFile
SetFilePointerEx
MultiByteToWideChar
CopyFileW
MoveFileExW
DeleteFileW
SetFileAttributesW
GetSystemTimeAsFileTime
GetModuleHandleW
WriteFile
CreateFileW
GetFileSize
lstrlenW
RaiseException
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
GetProcAddress
lstrcmpiW
GetModuleFileNameW
FormatMessageW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CreateMutexW
CreateThread
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
FreeLibrary
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
GetSystemDefaultUILanguage
ReleaseMutex
SetFilePointer
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetSystemDirectoryA
GetTickCount
CreateDirectoryW
GetDateFormatA
GetSystemTime
WaitForMultipleObjects
GetDiskFreeSpaceExW
LockResource
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
WideCharToMultiByte
SetFileTime
SetEndOfFile
VirtualAlloc
VirtualFree
SleepEx
TerminateThread
WaitForSingleObjectEx
QueueUserAPC
GetVolumeInformationW
GetLogicalDriveStringsW
HeapFree
HeapAlloc
GetProcessHeap
LoadLibraryW
GetSystemDefaultLangID
GetVersion
FindClose
FindNextFileW
FindFirstFileW
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
CreateFileA
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
GetTimeZoneInformation
GetExitCodeProcess
CreateProcessA
WriteConsoleA
GetConsoleOutputCP
TerminateProcess
GetModuleHandleA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoW
InterlockedExchange
RtlUnwind
ExitThread
HeapReAlloc
WriteConsoleW
FreeEnvironmentStringsA
GetEnvironmentStrings
CompareStringA
CompareStringW
SetEnvironmentVariableA
LoadLibraryA
user32
TranslateMessage
DispatchMessageW
GetMessageW
PostThreadMessageW
CharNextW
CharUpperW
MessageBoxW
LoadStringW
advapi32
CloseServiceHandle
LookupPrivilegeValueW
OpenProcessToken
QueryServiceStatus
ControlService
OpenServiceW
StartServiceW
ChangeServiceConfigW
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
RegEnumKeyExW
DeleteService
CreateServiceW
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
OpenSCManagerW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetServiceStatus
AdjustTokenPrivileges
shell32
ShellExecuteW
ole32
CoResumeClassObjects
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoSuspendClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
oleaut32
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysAllocStringLen
SysReAllocStringLen
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
customstorage
_CS_ReadFile@16
_CS_DeleteFile@4
_CS_SetFilePointer@20
_CS_OpenFile@8
_CS_WriteFile@16
_CS_CloseFile@4
gicconn
?GICConnSetBuddyItemEx@@YAHPBUBUDDYITEMEX@@@Z
?GICConnGetIPDistance@@YGG_K@Z
?GICConnStartup@@YAXPBG@Z
?GICConnAcceptEx@@YAIIIPAI@Z
?GICConnServiceListen@@YAHIIP6GHIIPAX@Z0@Z
?GICConnGetState@@YAIXZ
?GICConnSignout@@YAXXZ
?GICConnConnectGid@@YAI_KIAAI@Z
?GICConnOpenSocket@@YAIPBDG@Z
?GICConnPostReq2SCEx@@YAHI_KPBDHPAUHWND__@@I@Z
?GICConnSignin@@YAHPBUBUDDYITEM@@PBDPBG@Z
?GICConnGetBuddyItemEx@@YAHPAUBUDDYITEMEX@@@Z
sqlite3
sqlite3_exec
sqlite3_close
sqlite3_open
shlwapi
StrStrIW
Sections
.text Size: 276KB - Virtual size: 275KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_19_/P2PAgentLogo.gif.gif
-
$_19_/P2PConfig.xml.xml
-
$_19_/czlogclient.exe.exe windows:5 windows x86 arch:x86
b06e05f615f825232ad63e60f458b96f
Code Sign
6c:21:3e:f2:63:cf:fd:1f:7a:54:b1:29:64:a1:5c:83Certificate
IssuerCN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=USNot Before12/11/2009, 00:00Not After12/11/2010, 23:59SubjectCN=北京点击科技有限公司,OU=Class 3 - for Microsoft Authenticode Signing,O=北京点击科技有限公司,L=北京,ST=北京,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
Key Usages
KeyUsageDigitalSignature
42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before25/04/2007, 00:00Not After09/07/2019, 18:40SubjectCN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before09/07/1999, 18:31Not After09/07/2019, 18:40SubjectCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USExtended Key Usages
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate
IssuerCN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=USNot Before30/04/2007, 00:00Not After29/04/2012, 23:59SubjectCN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Signer
Actual PE DigestDigest AlgorithmPE Digest MatchesfalseHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
c:\MyProjects\dianji\ring\client\P2PFramework\Bin\czlogclient.pdb
Imports
ws2_32
WSAStartup
WSACleanup
socket
WSAIoctl
sendto
WSASocketW
WSAEventSelect
closesocket
bind
WSASend
WSARecvFrom
freeaddrinfo
getaddrinfo
recvfrom
recv
listen
gicconn
?GICConnPostReq2SCEx@@YAHI_KPBDHPAUHWND__@@I@Z
?GICConnGetState@@YAIXZ
?GICConnServiceListen@@YAHIIP6GHIIPAX@Z0@Z
?GICConnAcceptEx@@YAIIIPAI@Z
?GICConnStartup@@YAXPBG@Z
?GICConnSignout@@YAXXZ
?GICConnGetBuddyItemEx@@YAHPAUBUDDYITEMEX@@@Z
?GICConnSignin@@YAHPBUBUDDYITEM@@PBDPBG@Z
kernel32
TlsSetValue
FlushFileBuffers
CreateFileA
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetPrivateProfileStringW
CreateIoCompletionPort
GetQueuedCompletionStatus
CloseHandle
WritePrivateProfileStringW
Sleep
CreateEventW
SetEvent
WaitForSingleObject
GetLastError
PostQueuedCompletionStatus
ResetEvent
WaitForSingleObjectEx
LoadLibraryA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
IsValidCodePage
GetOEMCP
GetACP
ExitThread
GetCurrentThreadId
CreateThread
HeapAlloc
HeapFree
HeapReAlloc
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
RaiseException
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapCreate
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
user32
PostMessageW
SetWindowTextW
DialogBoxParamW
EndDialog
MessageBoxW
SetDlgItemTextW
shell32
SHGetFolderPathAndSubDirW
oleaut32
SysFreeString
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_19_/dgs.dll.dll windows:4 windows x86 arch:x86
ff346292afddf2c70fe2183f2bd23369
Code Sign
38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate
IssuerCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USNot Before15/06/2007, 00:00Not After14/06/2012, 23:59SubjectCN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before04/12/2003, 00:00Not After03/12/2013, 23:59SubjectCN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate
IssuerOU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=USNot Before21/05/2009, 00:00Not After20/05/2019, 23:59SubjectCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USExtended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
74:94:07:54:e8:6f:44:20:75:fe:80:b3:91:c0:b8:13Certificate
IssuerCN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=USNot Before21/06/2010, 00:00Not After21/06/2011, 23:59SubjectCN=BEIJING DIANJI TECHNOLOGY LTD.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING DIANJI TECHNOLOGY LTD.,L=Beijing,ST=Beijing,C=CNExtended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
a6:81:80:a4:7f:93:7c:47:28:ec:f1:45:1c:a9:5d:f0:6b:ad:87:39Signer
Actual PE Digesta6:81:80:a4:7f:93:7c:47:28:ec:f1:45:1c:a9:5d:f0:6b:ad:87:39Digest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
c:\BANDATA\Projects\lava.server\server\bin\release\dgs.pdb
Imports
ws2_32
__WSAFDIsSet
WSAGetLastError
ioctlsocket
getpeername
accept
bind
getsockname
gethostbyname
listen
getsockopt
inet_addr
select
send
WSAConnect
setsockopt
shutdown
ntohs
recvfrom
closesocket
socket
WSAStartup
htons
recv
sendto
massctl
_msc_deleteex@8
_msc_stop@4
_msc_restart@4
_msc_commit@4
_msc_build@20
_msc_rebuild2@28
_msc_getprogress@8
_msc_gettaskids@16
_msc_createseedid@12
_msc_init@8
gpctl
_gpc_mount@4
_gpc_stop@8
_gpc_init@8
_gpc_start@16
_gpc_setenv@8
_gpc_getprogressex@8
_gpc_getroot@8
_gpc_getmountgame@4
_gpc_unmount@4
rpcrt4
RpcStringFreeA
UuidToStringA
UuidFromStringA
kernel32
CreateProcessA
GetExitCodeProcess
FlushFileBuffers
SetStdHandle
LCMapStringW
LCMapStringA
GetSystemInfo
VirtualProtect
IsBadCodePtr
IsBadReadPtr
VirtualQuery
GetStringTypeW
GetStringTypeA
GetCPInfo
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
CreateEventW
CloseHandle
SetEvent
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
WritePrivateProfileStringA
WideCharToMultiByte
GetPrivateProfileStringA
GetPrivateProfileIntA
CreateDirectoryW
GetDiskFreeSpaceExW
GetLogicalDriveStringsW
GetLocalTime
OpenEventW
GetProcAddress
LoadLibraryW
FreeLibrary
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileAttributesExW
GetFileAttributesW
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleW
GetPrivateProfileStringW
ResetEvent
MoveFileW
GetTempPathW
CreateFileW
Module32FirstW
CreateToolhelp32Snapshot
DeleteFileW
RemoveDirectoryW
SetFileAttributesW
Process32NextW
Process32FirstW
GetDriveTypeA
GetPrivateProfileIntW
InterlockedExchange
GetPrivateProfileSectionW
OpenProcess
GetLastError
lstrcpyW
WriteFile
Sleep
TerminateThread
ResumeThread
CreateFileA
SetFilePointer
ReadFile
DeleteFileA
CreateDirectoryA
MoveFileExA
FindClose
FindFirstFileA
FindNextFileW
FindFirstFileW
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
LoadLibraryA
CreateEventA
GetFileSize
VirtualAlloc
VirtualFree
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
LocalFree
HeapFree
HeapAlloc
GetProcessHeap
WritePrivateProfileStringW
GetVolumeInformationW
lstrlenW
GetTickCount
lstrcatW
GetVersion
GetSystemDefaultLangID
CreateThread
MoveFileExW
RaiseException
GetCurrentThreadId
GetFileType
GetStdHandle
SetHandleCount
UnhandledExceptionFilter
GetFullPathNameA
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
IsBadWritePtr
HeapCreate
HeapDestroy
GetFileAttributesA
HeapSize
GetCurrentProcess
TerminateProcess
GetCurrentDirectoryA
GetFullPathNameW
SetUnhandledExceptionFilter
QueryPerformanceCounter
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
HeapReAlloc
GetVersionExA
GetCommandLineA
ExitThread
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
ExitProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
RtlUnwind
user32
wsprintfA
wsprintfW
advapi32
DuplicateTokenEx
CreateProcessAsUserW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
QueryServiceStatus
OpenProcessToken
shell32
ShellExecuteW
SHGetSpecialFolderPathW
ole32
OleRun
CoCreateInstance
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
wininet
InternetReadFile
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
shlwapi
StrStrIW
Exports
Exports
Startup
Stop
Wait
Sections
.text Size: 204KB - Virtual size: 202KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_19_/dgs.ini
-
$_19_/gicconn.dll.dll windows:5 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 190KB - Virtual size: 190KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
$_19_/license.rtf.rtf