15e39284f57c22f430d9788b8dc6093b_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

15e39284f57c22f430d9788b8dc6093b_JaffaCakes118
Size

12.9MB
MD5

15e39284f57c22f430d9788b8dc6093b
SHA1

e99508d2b388b9043645afeebb702398917a7e97
SHA256

b0db11cb8d232f65a27118734a477a2b3d3f0d5e8170f966ba82309cd437c114
SHA512

3b6956fd1ce0d6b521b32c4e65dad1a669e7a435ce3d6e8658bcd1dfc4789921dc3366f4c1decf9ff5fe2cd21528cbc52e3a96ca7145896acb420b8d683bde61
SSDEEP

196608:/IZ/PyVuF/+/c+kBZvtcgpi+H35ycfhVFlgadkhe3mPsMEa4CKnwW5rv9yble+YA:ePGkzvtHIGgcftlgHhe79CKOOfo

Score

1^/10

Malware Config

Signatures

Files

15e39284f57c22f430d9788b8dc6093b_JaffaCakes118
.rar
AVG Anti-Spyware/!)右鍵解除.bat
AVG Anti-Spyware/!)右鍵设置.bat
AVG Anti-Spyware/1)install.bat
AVG Anti-Spyware/1)uninstall.bat
AVG Anti-Spyware/Signatures/3100.dat
AVG Anti-Spyware/Signatures/3101.dat
AVG Anti-Spyware/Signatures/3102.dat
AVG Anti-Spyware/Signatures/3103.dat
AVG Anti-Spyware/Signatures/3104.dat
AVG Anti-Spyware/Signatures/3105.dat
AVG Anti-Spyware/Signatures/3106.dat
AVG Anti-Spyware/Signatures/3107.dat
AVG Anti-Spyware/Signatures/3108.dat
AVG Anti-Spyware/Signatures/3109.dat
AVG Anti-Spyware/Signatures/3110.dat
AVG Anti-Spyware/Signatures/3111.dat
AVG Anti-Spyware/Signatures/3112.dat
AVG Anti-Spyware/Signatures/3113.dat
AVG Anti-Spyware/Signatures/3114.dat
AVG Anti-Spyware/Signatures/3115.dat
AVG Anti-Spyware/Signatures/3116.dat
AVG Anti-Spyware/Signatures/3117.dat
AVG Anti-Spyware/Signatures/3118.dat
AVG Anti-Spyware/Signatures/3119.dat
AVG Anti-Spyware/Signatures/3120.dat
AVG Anti-Spyware/Signatures/3121.dat
AVG Anti-Spyware/Signatures/3122.dat
AVG Anti-Spyware/Translations/Chinese.mo
AVG Anti-Spyware/Translations/czech.mo
AVG Anti-Spyware/Translations/english.mo
AVG Anti-Spyware/Translations/french.mo
AVG Anti-Spyware/Translations/german.mo
AVG Anti-Spyware/Translations/italian.mo
AVG Anti-Spyware/Translations/portuguese.mo
AVG Anti-Spyware/Translations/slovak.mo
AVG Anti-Spyware/Translations/spanish.mo
AVG Anti-Spyware/avgas.exe
.exe windows:4 windows x86 arch:x86

854fe7213bf238113209bb3e0d0e9c43

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:e4:2c:91:36:da:5c:db:61:c0:b0:e0:ac:65:81:6c:35:3a:61:c7
Signer

Actual PE Digest

0b:e4:2c:91:36:da:5c:db:61:c0:b0:e0:ac:65:81:6c:35:3a:61:c7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\user\sandbox_2007_0611_105339_trunk_AVG_Anti_Spyware\source\ewido\home\ewido\Release\avgas.pdb

Imports

psapi

GetModuleFileNameExW
EmptyWorkingSet
GetProcessMemoryInfo

shlwapi

PathParseIconLocationW
PathIsDirectoryW
PathIsDirectoryEmptyA
PathIsDirectoryEmptyW
StrFormatByteSizeW
PathFileExistsW

engine

GetSignatureCount
ScanMemory
ScanRegistry
ScanDirectory
ScanFile
SetExtensionList
IngoreList_AddInfection
IngoreList_AddPath
WillRestoreOverwrite
IngoreList_Clear
GetQuarantineDirectoryPath
GetQuarantineList_Date2
SetScanSettings
GetQuarantineList_InfectionName
GetQuarantineList_Date
GetQuarantineList_InfectionRisk
GetQuarantineList_InfectionType
GetQuarantineListSize
RefreshQuarantineList
QuarantineList_RemoveBackup
RestoreQuarantineEntry
SetMessageHandler
SetInfectionHandler
LoadSignatureDatabase
SetDatabaseDirectoryPath
SetQuarantineDirectoryPath
GetQuarantineList_InfectionPath
SetInfectionFilter2
Init
SetQuarantineHandler2

msimg32

TransparentBlt

kernel32

SearchPathW
GlobalUnlock
GlobalLock
GlobalAlloc
WriteFile
GetTimeFormatW
GetDateFormatW
GetLocalTime
SetFilePointer
ResetEvent
OpenEventW
TerminateThread
GetACP
GetLocaleInfoA
RaiseException
DeviceIoControl
SetLastError
FreeLibrary
GetCurrentProcessId
GetCurrentThreadId
FormatMessageW
lstrcpynW
FileTimeToSystemTime
FileTimeToLocalFileTime
IsBadReadPtr
VirtualQuery
GetCurrentThread
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetUserDefaultLCID
SystemTimeToFileTime
GetFileSizeEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
DeleteTimerQueue
CreateProcessW
WritePrivateProfileStringW
UnmapViewOfFile
MultiByteToWideChar
MapViewOfFile
CreateFileMappingW
GetUserDefaultUILanguage
FindNextChangeNotification
FindFirstChangeNotificationW
InterlockedIncrement
GetNumberFormatW
ExitThread
ResumeThread
SuspendThread
GetDriveTypeW
CreateFileW
GetTickCount
UnlockFile
LockFile
SetFileAttributesW
DeleteFileW
SetEndOfFile
MoveFileExW
MoveFileExA
GetSystemDirectoryW
GetFileInformationByHandle
GetTempFileNameW
GetTempPathW
GetSystemTime
CopyFileW
MoveFileW
FindFirstFileA
GetProcessTimes
GetVersionExA
GetCPInfo
HeapFree
TerminateProcess
GetModuleFileNameA
HeapAlloc
GetFileType
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
HeapReAlloc
HeapSize
UnhandledExceptionFilter
QueryPerformanceCounter
GetStdHandle
GetOEMCP
GetFileSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
ExpandEnvironmentStringsW
SetStdHandle
VirtualProtect
GetSystemInfo
EnumSystemLocalesA
GetEnvironmentVariableW
GetPrivateProfileStringW
FindFirstFileW
FindNextFileW
FindClose
IsValidLocale
IsValidCodePage
IsBadCodePtr
WideCharToMultiByte
WinExec
LoadLibraryA
GetModuleHandleA
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
CreateNamedPipeW
ConnectNamedPipe
ReadFile
FlushFileBuffers
DisconnectNamedPipe
LocalAlloc
GetVersionExW
GetFileAttributesW
GetCurrentProcess
GetCommandLineW
Sleep
OpenMutexW
CreateMutexW
ExitProcess
GetModuleHandleW
CreateDirectoryW
GetLastError
GetModuleFileNameW
LoadLibraryW
GetProcAddress
CreateThread
WaitForSingleObject
SetEvent
InterlockedExchangeAdd
CreateEventW
WaitForMultipleObjects
CloseHandle
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetLocaleInfoW
GetStartupInfoW
RtlUnwind
GetLogicalDrives
InterlockedDecrement

user32

ExitWindowsEx
EnumWindows
GetWindowTextW
GetSystemMetrics
DialogBoxParamW
EndDialog
GetActiveWindow
LoadMenuW
GetSubMenu
wsprintfW
wvsprintfW
LoadImageW
CheckMenuItem
EnableMenuItem
SetFocus
GetFocus
GetMenuState
DeleteMenu
RegisterWindowMessageW
FillRect
TrackPopupMenu
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
DestroyCursor
DestroyMenu
SetMenuItemInfoW
IsDialogMessageW
GetParent
GetDesktopWindow
GetDC
ReleaseDC
LoadBitmapW
EnableWindow
MoveWindow
FindWindowExW
GetWindowThreadProcessId
SetRect
DrawTextW
DestroyWindow
CreateWindowExW
LoadIconW
RegisterClassExW
LoadCursorW
GetClientRect
PostQuitMessage
SystemParametersInfoW
ShowWindow
BeginPaint
EndPaint
ScreenToClient
SetForegroundWindow
ReleaseCapture
SetCursor
SetCapture
AppendMenuW
GetDlgItem
IsWindowVisible
RemoveMenu
IsDlgButtonChecked
CheckDlgButton
GetCursorPos
GetWindowRect
DefWindowProcW
InvalidateRect
UpdateWindow
GetWindowLongW
SetWindowLongW
SetWindowPos
GetForegroundWindow
MessageBoxW
FindWindowW
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CallWindowProcW
SetWindowTextW

gdi32

CreateSolidBrush
CreateFontW
DeleteDC
SetTextColor
GetTextExtentPoint32W
SetBkMode
CreateCompatibleDC
GetObjectW
SetBkColor
GetTextMetricsW
GetTextExtentPointW
LineTo
CreatePen
CreateCompatibleBitmap
SelectObject
DeleteObject
GetStockObject
BitBlt
GetBitmapDimensionEx
MoveToEx

comdlg32

GetSaveFileNameW

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ControlService
StartServiceW
LockServiceDatabase
ChangeServiceConfigW
RegOpenKeyW
RegCreateKeyW
RegSetValueW
RegCloseKey
UnlockServiceDatabase
LookupAccountNameW
RegNotifyChangeKeyValue
QueryServiceStatus
OpenSCManagerW
OpenServiceW
CloseServiceHandle
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
RegSetValueExW
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyW
RegEnumKeyExW
RegEnumValueW
RegCreateKeyExW
RegDeleteValueW

shell32

DragAcceptFiles
SHGetFolderPathW
SHGetFileInfoW
ShellExecuteW
Shell_NotifyIconW
SHFileOperationW
SHGetPathFromIDListW
SHBrowseForFolderW
SHFileOperationA
SHGetSpecialFolderPathW
DragQueryFileW

ole32

CoInitialize
CoUninitialize

comctl32

ImageList_Create
ImageList_Add
InitCommonControlsEx
ImageList_ReplaceIcon

winmm

timeGetTime

wsock32

htons
WSACleanup
inet_addr
ntohl
WSAGetLastError
gethostbyaddr
ioctlsocket
WSAStartup
recv
send
closesocket
setsockopt
connect
gethostbyname
socket

ws2_32

WSCGetProviderPath
WSCDeinstallProvider
WSCEnumProtocols

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 648KB - Virtual size: 647KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 220KB - Virtual size: 218KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/avgasc64.sys
.sys windows:5 windows x64 arch:x64

c1b7d847e4561789ee382771a5d51391

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:5b:d4:93:7e:6d:94:c6:9a:c6:09:0a:2d:a5:93:4a:fa:60:99:d7
Signer

Actual PE Digest

ab:5b:d4:93:7e:6d:94:c6:9a:c6:09:0a:2d:a5:93:4a:fa:60:99:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\src\trunk\ewido\home\cleanDriver\amd64\avgcln64.pdb

Imports

ntoskrnl.exe

ZwClose
ZwCreateFile
RtlInitUnicodeString
ZwSetInformationFile
RtlQueryRegistryValues
ZwOpenKey
InitSafeBootMode
KeBugCheckEx

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 456B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 512B - Virtual size: 386B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/avgascln.sys
.sys windows:5 windows x86 arch:x86

ed7a92782188b171f034cdad3f55ad1a

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:9e:cc:04:68:82:c2:14:89:ec:90:07:e6:3d:ee:79:4a:38:3c:8f
Signer

Actual PE Digest

67:9e:cc:04:68:82:c2:14:89:ec:90:07:e6:3d:ee:79:4a:38:3c:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build\user\sandbox_2006_0905_180122_trunk_avgarkt\source\ewido\home\cleanDriver\i386\avgclean.pdb

Imports

ntoskrnl.exe

ZwClose
ZwCreateFile
RtlInitUnicodeString
ZwSetInformationFile
RtlQueryRegistryValues
ZwOpenKey
InitSafeBootMode
KeTickCount
KeBugCheckEx

Sections

.text
Size: 1024B - Virtual size: 977B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 256B - Virtual size: 241B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 384B - Virtual size: 332B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 128B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/clsid.dat
AVG Anti-Spyware/context.dll
.dll regsvr32 windows:4 windows x86 arch:x86

25f3c414dff23d81839131383b95283c

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

94:c9:ec:f0:44:d1:8c:34:d5:d1:69:60:fd:69:d4:bb:23:db:31:25
Signer

Actual PE Digest

94:c9:ec:f0:44:d1:8c:34:d5:d1:69:60:fd:69:d4:bb:23:db:31:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\context\Release\Context.pdb

Imports

kernel32

GetLastError
lstrcpyW
GetModuleFileNameW
lstrcatW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetModuleHandleW
lstrcpynW
WriteFile
Sleep
CloseHandle
CreateProcessW
DeleteCriticalSection
CreateFileW
GetProcAddress
GlobalUnlock
GlobalLock
GetLocaleInfoW
FlushFileBuffers
GetSystemInfo
VirtualProtect
SetStdHandle
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
OutputDebugStringW
InterlockedExchange
GetStringTypeW
GetStringTypeA
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
LCMapStringW
LCMapStringA
GetCPInfo
GetOEMCP
SetFilePointer
IsBadCodePtr
IsBadReadPtr
LoadLibraryA
UnhandledExceptionFilter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetVersionExA
UnmapViewOfFile
MultiByteToWideChar
MapViewOfFile
CreateFileMappingW
GetFileSize
GetPrivateProfileStringW
GetUserDefaultUILanguage
HeapFree
ExitProcess
HeapAlloc
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
VirtualQuery
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

LoadBitmapW
InsertMenuW
SetMenuItemBitmaps
CharNextW
WaitForInputIdle
FindWindowW
SendMessageW

advapi32

RegQueryValueExW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetFileInfoW
DragQueryFileW

ole32

CoCreateInstance
StringFromCLSID
ReleaseStgMedium
CoTaskMemFree
StringFromGUID2

oleaut32

SysAllocString
LoadTypeLi
UnRegisterTypeLi
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
SysFreeString

shlwapi

PathFindExtensionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/context64.dll
.dll regsvr32 windows:4 windows x64 arch:x64

a1affce36af33a504116d60c9b106e6f

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

22:fe:13:1c:aa:c2:81:b7:b6:5e:95:f6:d2:56:93:c0:8c:93:59:e1
Signer

Actual PE Digest

22:fe:13:1c:aa:c2:81:b7:b6:5e:95:f6:d2:56:93:c0:8c:93:59:e1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\release\context64.pdb

Imports

kernel32

MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
SetThreadLocale
GetThreadLocale
LockResource
FindResourceExW
WriteFile
Sleep
CloseHandle
CreateProcessW
OutputDebugStringW
CreateFileW
FreeLibrary
GlobalUnlock
GlobalLock
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetPrivateProfileStringW
GetUserDefaultUILanguage
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
GetModuleFileNameW
lstrcmpiW
GetLastError
DeleteCriticalSection
InitializeCriticalSection
__C_specific_handler
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetProcAddress
lstrlenW
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadLibraryA
IsValidCodePage
GetOEMCP
GetCPInfo
GetSystemTimeAsFileTime
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
RtlVirtualUnwind
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId

user32

UnregisterClassA
SendMessageW
FindWindowW
WaitForInputIdle
LoadBitmapW
SetMenuItemBitmaps
CharNextW
InsertMenuW

advapi32

RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

DragQueryFileW
SHGetFileInfoW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromCLSID
ReleaseStgMedium
StringFromGUID2
CoTaskMemAlloc

oleaut32

LoadTypeLi
SysFreeString
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/engine.dll
.dll windows:4 windows x86 arch:x86

7d01c58289e18602aa09ad75a1c4cf19

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

84:04:e6:51:d4:96:a9:30:ec:c7:00:00:9d:32:d6:e1:70:63:74:e5
Signer

Actual PE Digest

84:04:e6:51:d4:96:a9:30:ec:c7:00:00:9d:32:d6:e1:70:63:74:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2007_0606_144840_trunk_AVG_Anti_Spyware\source\ewido\core\engine\Release\engine.pdb

Imports

shfolder

SHGetFolderPathW

shlwapi

SHDeleteKeyW
PathFileExistsW

winmm

timeGetTime

kernel32

ReadFile
GetFileSize
FindClose
QueryPerformanceCounter
GetLastError
Sleep
WaitForSingleObject
GetCurrentProcessId
TerminateProcess
OpenProcess
MoveFileExW
WriteFile
GetLocalTime
SetFilePointer
FindNextChangeNotification
WaitForMultipleObjects
ReadProcessMemory
VirtualQueryEx
UnmapViewOfFile
MapViewOfFile
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FreeLibrary
CompareStringA
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
SetLastError
GetCurrentProcess
LocalFree
CloseHandle
FlushFileBuffers
SetEndOfFile
GetFileType
CreateFileA
GetStdHandle
GetLocaleInfoA
ReadConsoleA
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByte
GetCPInfo
GetDriveTypeA
GetDiskFreeSpaceA
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
GetVersionExA
GetStringTypeA
GetSystemInfo
FindNextFileA
FindFirstFileA
GetTimeFormatW
VirtualAlloc
VirtualFree
FormatMessageA
GetFileAttributesA
ExitProcess
RtlUnwind
RaiseException
GetCurrentThreadId
GetCommandLineA
HeapFree
HeapAlloc
HeapReAlloc
MoveFileA
GetSystemTimeAsFileTime
DeleteFileA
GetTickCount
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
SetUnhandledExceptionFilter
HeapSize
VirtualQuery
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
HeapDestroy
HeapCreate
UnhandledExceptionFilter
IsBadWritePtr
LCMapStringA
GetACP
GetOEMCP
IsBadReadPtr
IsBadCodePtr
SetStdHandle
VirtualProtect

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCloseKey

user32

OemToCharA
GetForegroundWindow
OemToCharBuffA
CharLowerA
CharToOemBuffA
CharToOemA
CharUpperA

Exports

Exports

ActivateNewCookieBehavior
DeInit
GetDatabaseVersion
GetEngineVersion
GetQuarantineDirectoryPath
GetQuarantineListSize
GetQuarantineList_Date
GetQuarantineList_Date2
GetQuarantineList_InfectionName
GetQuarantineList_InfectionPath
GetQuarantineList_InfectionRisk
GetQuarantineList_InfectionType
GetSignatureCount
IgnoreList_AddInfection
IgnoreList_AddPath
IgnoreList_Clear
IngoreList_AddInfection
IngoreList_AddPath
IngoreList_Clear
Init
LoadSignatureDatabase
LoadSignatureDatabase_SingleFileOnly
QuarantineList_RemoveBackup
ReWaitForCookieDirectoryChange
RefreshQuarantineList
RemoveInfection
RemoveInfection2
RestoreQuarantineEntry
ScanCookies
ScanDirectory
ScanFile
ScanFileByBuffer
ScanFileByHandle
ScanFileByHandle2
ScanFileByMapping
ScanMemory
ScanProcess
ScanProcessModule
ScanProcessRegion
ScanRegistry
SetDatabaseDirectoryPath
SetExtensionList
SetInfectionFilter
SetInfectionFilter2
SetInfectionHandler
SetMessageHandler
SetQuarantineDirectoryPath
SetQuarantineHandler
SetQuarantineHandler2
SetScanSettings
WaitForCookieDirectoryChange
WillRestoreOverwrite

Sections

.text
Size: 340KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/guard.exe
.exe windows:4 windows x86 arch:x86

cde2e36b21991c2353e940d281cbf1da

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0e:12:a3:34:d2:61:67:6a:05:29:17:fc:6e:90:11:91:c6:8b:d4:09
Signer

Actual PE Digest

0e:12:a3:34:d2:61:67:6a:05:29:17:fc:6e:90:11:91:c6:8b:d4:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\guard\Release\guard.pdb

Imports

engine

SetDatabaseDirectoryPath
IngoreList_AddPath
IngoreList_AddInfection
IngoreList_Clear
SetQuarantineHandler2
LoadSignatureDatabase
ScanFile
ScanProcessModule
RemoveInfection2
SetQuarantineDirectoryPath
Init
SetMessageHandler
SetInfectionHandler
SetScanSettings
SetInfectionFilter2
GetSignatureCount
ReWaitForCookieDirectoryChange
WaitForCookieDirectoryChange
ScanCookies
RemoveInfection
ScanDirectory

psapi

EmptyWorkingSet
EnumProcesses
EnumProcessModules
GetModuleFileNameExW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

iphlpapi

GetUdpTable
SetTcpEntry
GetTcpTable

kernel32

VirtualFree
FreeLibrary
LoadLibraryW
GetProcAddress
GetModuleHandleW
CloseHandle
Module32FirstW
GetLastError
CreateToolhelp32Snapshot
OpenProcess
Process32NextW
Process32FirstW
HeapFree
GetProcessHeap
Sleep
CreateThread
LeaveCriticalSection
FindClose
FindFirstFileW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchangeAdd
LocalAlloc
InterlockedExchange
WaitForSingleObject
CreateEventW
TerminateThread
SetEvent
ResetEvent
GetModuleFileNameW
GetProcessTimes
GetSystemTimeAsFileTime
GetCurrentProcess
TerminateProcess
Module32NextW
DeviceIoControl
CreateFileW
OutputDebugStringW
WriteFile
HeapReAlloc
ReadFile
CreateNamedPipeW
GetTimeFormatW
GetDateFormatW
GetLocalTime
SetFilePointer
CopyFileW
GetSystemDirectoryW
DeleteFileW
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExW
RaiseException
GetVersion
ExpandEnvironmentStringsW
SetLastError
GetCurrentProcessId
GetCurrentThreadId
FormatMessageW
lstrcpynW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetModuleHandleA
IsBadReadPtr
VirtualQuery
GetCurrentThread
SetUnhandledExceptionFilter
MoveFileExW
CreateDirectoryW
FindNextFileW
WritePrivateProfileStringW
SetFileAttributesW
DisconnectNamedPipe
FlushFileBuffers
SystemTimeToFileTime
WaitForMultipleObjects
LCMapStringA
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
HeapSize
VirtualAlloc
IsBadWritePtr
LoadLibraryA
VirtualProtect
GetSystemInfo
LCMapStringW
GetCPInfo
FatalAppExitA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadCodePtr
SetConsoleCtrlHandler
GetOEMCP
GetLocaleInfoW
GetTimeZoneInformation
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
QueryPerformanceCounter
ConnectNamedPipe
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapAlloc
GetModuleFileNameA
GetVersionExA
GetCommandLineA
GetStdHandle
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
ExitProcess
RtlUnwind
GetStartupInfoA
GetTickCount

user32

wsprintfW
wvsprintfW
UnregisterClassA
UnregisterClassW
MessageBoxW

advapi32

OpenSCManagerA
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
EnumServicesStatusExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
CreateServiceW
ChangeServiceConfigW
StartServiceW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
ControlService
QueryServiceStatus
DeleteService
SetServiceStatus
AllocateAndInitializeSid
SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegNotifyChangeKeyValue

ole32

CoInitialize
StringFromGUID2
CoCreateInstance

oleaut32

VariantClear
SysAllocString
SysFreeString

winmm

timeGetTime

shlwapi

SHDeleteKeyW

Sections

.text
Size: 232KB - Virtual size: 228KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/guard.sys
.sys windows:5 windows x86 arch:x86

c1cc8b03ee7cab8fd08f706a230b2b1e

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:46:c7:7c:89:d2:cc:0f:a0:76:65:55:92:58:57:4d:27:6e:ad:b8
Signer

Actual PE Digest

cf:46:c7:7c:89:d2:cc:0f:a0:76:65:55:92:58:57:4d:27:6e:ad:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\guard\drv\i386\guard.pdb

Imports

ntoskrnl.exe

ZwClose
ObfDereferenceObject
KeSetEvent
ObReferenceObjectByHandle
ZwOpenEvent
RtlInitUnicodeString
_except_handler3
IofCompleteRequest
PsGetCurrentProcessId
IoDeleteDevice
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
ZwTerminateProcess
KeServiceDescriptorTable
ZwOpenProcess
KeGetPreviousMode
KeTickCount
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 128B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 640B - Virtual size: 596B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 256B - Virtual size: 214B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/guard64.sys
.sys windows:5 windows x64 arch:x64

29d9c0383a26fae0cd60dd97d70ba389

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0c:12:06:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23-05-2006 17:01

Not After

23-05-2016 17:11

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:68:f3:3e:65:f1:cd:ab:b4:56:9a:b5:9a:e1:34:37:ad:c4:5e:00
Signer

Actual PE Digest

4c:68:f3:3e:65:f1:cd:ab:b4:56:9a:b5:9a:e1:34:37:ad:c4:5e:00

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\guard\drv\amd64\guard64.pdb

Imports

ntoskrnl.exe

__C_specific_handler
ZwClose
ObfDereferenceObject
KeSetEvent
ObReferenceObjectByHandle
ZwOpenEvent
RtlInitUnicodeString
IofCompleteRequest
PsGetCurrentProcessId
IoDeleteDevice
PsSetLoadImageNotifyRoutine
IoCreateSymbolicLink
IoCreateDevice
KeBugCheckEx

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 356B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
AVG Anti-Spyware/help.chm
.chm
AVG Anti-Spyware/heuristic.dat
AVG Anti-Spyware/lang.ini
AVG Anti-Spyware/logfile.txt
AVG Anti-Spyware/setup.inf
AVG Anti-Spyware/shellexecutehook.dll
.dll regsvr32 windows:4 windows x86 arch:x86

d357985a4ef975b80f6dccec06897893

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

74:60:e0:a1:f1:1e:27:47:f2:bc:96:a8:c7:38:50:4f:a9:a6:c7:de
Signer

Actual PE Digest

74:60:e0:a1:f1:1e:27:47:f2:bc:96:a8:c7:38:50:4f:a9:a6:c7:de

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\shellexecutehook\Release\shellexecutehook.pdb

Imports

kernel32

GetLastError
lstrlenW
lstrcmpiW
lstrcpyW
GetModuleHandleW
GetModuleFileNameW
LeaveCriticalSection
InterlockedIncrement
EnterCriticalSection
DeleteCriticalSection
CloseHandle
ReadFile
WriteFile
CreateFileW
lstrcpynW
lstrcatW
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedDecrement
InterlockedExchange
GetSystemInfo
VirtualProtect
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
GetStringTypeA
GetCPInfo
GetOEMCP
GetVersionExA
HeapAlloc
HeapFree
ExitProcess
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
SetUnhandledExceptionFilter
VirtualQuery
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
LoadLibraryA
IsBadReadPtr
IsBadCodePtr

user32

CharNextW

advapi32

RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW

shell32

SHGetFileInfoW

ole32

StringFromCLSID
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysStringLen
LoadTypeLi
SysFreeString

shlwapi

PathFindExtensionW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/shellexecutehook64.dll
.dll regsvr32 windows:4 windows x64 arch:x64

472e23392e2e3ec7613a9abbfd3cf1e8

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04-12-2003 00:00

Not After

03-12-2008 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

07-07-2006 00:00

Not After

06-07-2008 23:59

Subject

CN=GRISOFT LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=GRISOFT LTD,L=NICOSIA,ST=CYPRUS,C=CY

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

bc:8a:7f:ed:30:c6:28:79:73:53:c9:af:7f:dd:6d:26:d1:93:01:c3
Signer

Actual PE Digest

bc:8a:7f:ed:30:c6:28:79:73:53:c9:af:7f:dd:6d:26:d1:93:01:c3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\build\user\sandbox_2007_0530_135210_trunk_AVG_Anti_Spyware\source\ewido\home\release\shellexecutehook64.pdb

Imports

kernel32

GetLastError
lstrlenW
lstrcmpiW
GetModuleHandleW
GetModuleFileNameW
CloseHandle
ReadFile
WriteFile
CreateFileW
FindResourceExW
LeaveCriticalSection
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
SetThreadLocale
GetThreadLocale
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
__C_specific_handler
EnterCriticalSection
RaiseException
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidCodePage
GetOEMCP
GetCPInfo
LoadLibraryA
GetACP
GetLocaleInfoA
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
GetProcAddress
GetModuleHandleA
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
HeapCreate
FlsGetValue
TlsFree
FlsFree
SetLastError
TlsSetValue
FlsAlloc
RtlVirtualUnwind
Sleep
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime

user32

UnregisterClassA
CharNextW

advapi32

RegDeleteValueW
RegEnumKeyExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW
RegQueryInfoKeyW

shell32

SHGetFileInfoW

ole32

CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
StringFromCLSID

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocString
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllMain
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AVG Anti-Spyware/un.inf
AVG Anti-Spyware/汉化说明.txt
安装说明.url
.url

Sharing

General

Malware Config

Signatures

Files

854fe7213bf238113209bb3e0d0e9c43

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72Certificate

Extended Key Usages

Key Usages

0b:e4:2c:91:36:da:5c:db:61:c0:b0:e0:ac:65:81:6c:35:3a:61:c7Signer

Headers

File Characteristics

PDB Paths

Imports

psapi

shlwapi

engine

msimg32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

comctl32

winmm

wsock32

ws2_32

version

Sections

.text Size: 648KB - Virtual size: 647KB

.rdata Size: 220KB - Virtual size: 218KB

.data Size: 24KB - Virtual size: 66KB

.rsrc Size: 5.5MB - Virtual size: 5.5MB

c1b7d847e4561789ee382771a5d51391

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72Certificate

Extended Key Usages

Key Usages

61:0c:12:06:00:00:00:00:00:1bCertificate

Key Usages

ab:5b:d4:93:7e:6d:94:c6:9a:c6:09:0a:2d:a5:93:4a:fa:60:99:d7Signer

Headers

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 512B - Virtual size: 312B

.data Size: 512B - Virtual size: 456B

.pdata Size: 512B - Virtual size: 72B

INIT Size: 512B - Virtual size: 386B

.rsrc Size: 1024B - Virtual size: 856B

.reloc Size: 512B - Virtual size: 48B

ed7a92782188b171f034cdad3f55ad1a

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

0b:e4:2c:91:36:da:5c:db:61:c0:b0:e0:ac:65:81:6c:35:3a:61:c7
Signer

.text
Size: 648KB - Virtual size: 647KB

.rdata
Size: 220KB - Virtual size: 218KB

.data
Size: 24KB - Virtual size: 66KB

.rsrc
Size: 5.5MB - Virtual size: 5.5MB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

ab:5b:d4:93:7e:6d:94:c6:9a:c6:09:0a:2d:a5:93:4a:fa:60:99:d7
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 512B - Virtual size: 312B

.data
Size: 512B - Virtual size: 456B

.pdata
Size: 512B - Virtual size: 72B

INIT
Size: 512B - Virtual size: 386B

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 512B - Virtual size: 48B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

61:0c:12:06:00:00:00:00:00:1b
Certificate

67:9e:cc:04:68:82:c2:14:89:ec:90:07:e6:3d:ee:79:4a:38:3c:8f
Signer

.text
Size: 1024B - Virtual size: 977B

.rdata
Size: 256B - Virtual size: 241B

.data
Size: 128B - Virtual size: 96B

INIT
Size: 384B - Virtual size: 332B

.rsrc
Size: 896B - Virtual size: 856B

.reloc
Size: 128B - Virtual size: 80B

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:bf:21:28:cc:40:54:d8:0b:ac:9e:9d:79:b5:53:72
Certificate

94:c9:ec:f0:44:d1:8c:34:d5:d1:69:60:fd:69:d4:bb:23:db:31:25
Signer

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 8KB - Virtual size: 38KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate