18727f9489617c426cdd80939ecb9387_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

18727f9489617c426cdd80939ecb9387_JaffaCakes118
Size

721KB
MD5

18727f9489617c426cdd80939ecb9387
SHA1

b0fec0df599a67344322b3c05ba588597b5c869e
SHA256

d3351dfdcaa85cea4092b34fcc93b96636d43d32b6ad338208dcb2c124de1756
SHA512

2fd1b3fb8db38897a14473f70d88b15e4d23e6e35eeec6aaf63ae756dc7ec64f14affc8e4f8145075cbcd46226a459e62771f5249889f8f8a5effe7ecb4884ef
SSDEEP

12288:YB8CU3PBeV+qh8JTkTSudx9IbLSPyl13s+N92zcF+kI71rnEyZcsoI:YB85JeVbNS8uK23iIFvI71rnfWI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

18727f9489617c426cdd80939ecb9387_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:38:b4:23:5b:ed:35:45:46:65:1f:db:70:5f:24:40:90:5e:2c:a8
Signer

Actual PE Digest

18:38:b4:23:5b:ed:35:45:46:65:1f:db:70:5f:24:40:90:5e:2c:a8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 296KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
prio.dll
.dll windows:5 windows x64 arch:x64

b88aba07dbcfae573e9cf97aa63e4b78

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ea:b5:da:6b:c5:13:86:ef:60:01:d1:8d:11:71:7f:95:bd:a3:cc:3c
Signer

Actual PE Digest

ea:b5:da:6b:c5:13:86:ef:60:01:d1:8d:11:71:7f:95:bd:a3:cc:3c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\prio.pdb

Imports

kernel32

HeapAlloc
GetCurrentProcess
HeapFree
GetEnvironmentStringsW
CallNamedPipeW
GetModuleHandleW
GetProcessHeap
GetPrivateProfileStringW
LoadLibraryW
Sleep
GetVersionExW
lstrcpynW
GetModuleFileNameW
FreeLibrary
GetPrivateProfileIntW
DisableThreadLibraryCalls
ProcessIdToSessionId
SetProcessWorkingSetSize
lstrcmpiW
GetProcessAffinityMask
FreeEnvironmentStringsW
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
CreateThread
ExpandEnvironmentStringsW
SetPriorityClass
SetProcessAffinityMask
GetEnvironmentVariableW
GetCommandLineW
GetStartupInfoW
ExitProcess

user32

GetWindowLongW
AllowSetForegroundWindow
EnumThreadWindows
SetForegroundWindow

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 62B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
prio32.dll
.dll windows:5 windows x86 arch:x86

b88aba07dbcfae573e9cf97aa63e4b78

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

17:b9:e2:53:74:e9:cf:07:be:31:02:f7:64:8d:d4:79:3c:b2:02:d4
Signer

Actual PE Digest

17:b9:e2:53:74:e9:cf:07:be:31:02:f7:64:8d:d4:79:3c:b2:02:d4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\Win32\Release\prio.pdb

Imports

kernel32

HeapAlloc
GetCurrentProcess
HeapFree
GetEnvironmentStringsW
CallNamedPipeW
GetModuleHandleW
GetProcessHeap
GetPrivateProfileStringW
LoadLibraryW
Sleep
GetVersionExW
lstrcpynW
GetModuleFileNameW
FreeLibrary
GetPrivateProfileIntW
DisableThreadLibraryCalls
ProcessIdToSessionId
SetProcessWorkingSetSize
lstrcmpiW
GetProcessAffinityMask
FreeEnvironmentStringsW
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
CreateThread
ExpandEnvironmentStringsW
SetPriorityClass
SetProcessAffinityMask
GetEnvironmentVariableW
GetCommandLineW
GetStartupInfoW
ExitProcess

user32

GetWindowLongW
AllowSetForegroundWindow
EnumThreadWindows
SetForegroundWindow

advapi32

AllocateAndInitializeSid
FreeSid
CheckTokenMembership

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 298B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
prio_svc.exe
.exe windows:5 windows x64 arch:x64

0d37b80d638dad3df57cf36a1de3656b

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c7:94:0f:2b:14:14:66:e8:63:f4:77:32:19:53:9f:d0:0e:67:e8:f6
Signer

Actual PE Digest

c7:94:0f:2b:14:14:66:e8:63:f4:77:32:19:53:9f:d0:0e:67:e8:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Projects\Prio\Release1.99\prio_svc\x64\Release\prio_svc.pdb

Imports

wtsapi32

WTSQueryUserToken

kernel32

ConnectNamedPipe
WaitForMultipleObjects
GetOverlappedResult
ReadFile
DisconnectNamedPipe
ResetEvent
CloseHandle
GetLastError
OpenProcess
DuplicateHandle
GetCurrentProcess
WriteFile
CreateNamedPipeW
CreateEventW
RtlZeroMemory
SetEvent
HeapFree
GetProcessHeap
HeapAlloc
lstrcatW

advapi32

StartServiceCtrlDispatcherW
CreateProcessAsUserW
ImpersonateLoggedOnUser
GetTokenInformation
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegisterServiceCtrlHandlerW
SetServiceStatus
RevertToSelf

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
prio_uninstall.exe.nsis
prioinst.exe
.exe windows:5 windows x64 arch:x64

dfe61837ceac8d71cd645d3316842057

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8e:e4:89:6b:72:24:45:37:5e:e8:52:14:55:d7:1f:8b:6c:c6:ad:40
Signer

Actual PE Digest

8e:e4:89:6b:72:24:45:37:5e:e8:52:14:55:d7:1f:8b:6c:c6:ad:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\prioinst.pdb

Imports

kernel32

GetCommandLineA
GetModuleFileNameA
Sleep
GetLastError
GetVersion
GetStartupInfoA
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
HeapSize
CloseHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CreateFileA

advapi32

RegOpenKeyExA
StartServiceA
ControlService
QueryServiceStatus
OpenServiceA
DeleteService
RegSetValueExA
RegCloseKey
RegQueryValueExA
CloseServiceHandle
CreateServiceA
OpenSCManagerA

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ptm_nt.dll
.dll windows:5 windows x64 arch:x64

0f0d016fa726081140ea4e70bdc54eda

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:14:48:c0:fc:63:26:94:b1:5a:84:7a:f9:19:2e:43:49:21:ce:69
Signer

Actual PE Digest

47:14:48:c0:fc:63:26:94:b1:5a:84:7a:f9:19:2e:43:49:21:ce:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\ptm_nt.pdb

Imports

kernel32

GetCurrentThreadId
DisableThreadLibraryCalls
FlushInstructionCache
GetLastError
GetTickCount
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
lstrcmpiW
HeapSetInformation
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
GetCommandLineA
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
Sleep
MultiByteToWideChar
WideCharToMultiByte
RaiseException
LoadLibraryA
LocalAlloc
GetModuleFileNameW
GetCurrentProcess
QueryDosDeviceW
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
TerminateThread
lstrlenW
CompareStringW
GetProcessAffinityMask
GetPriorityClass
SetProcessWorkingSetSize
WritePrivateProfileStringW
EnterCriticalSection
LeaveCriticalSection
CreateFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
CloseHandle
ExpandEnvironmentStringsW
lstrcatW
lstrcpyW
OpenProcess
FindClose
FindFirstFileW
DeviceIoControl
GetProcAddress
HeapCreate

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

EnableWindow
TrackPopupMenuEx
EnableMenuItem
KillTimer
DestroyMenu
RemoveMenu
LoadMenuW
EndDeferWindowPos
DeferWindowPos
GetWindowRect
BeginDeferWindowPos
GetDialogBaseUnits
GetSystemMetrics
BeginPaint
EndPaint
FillRect
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetCursor
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
PtInRect
UpdateWindow
InvalidateRect
GetClassNameW
SetWindowLongW
LoadCursorW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
CharNextW
CallWindowProcW
SetRectEmpty
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
CheckMenuItem
DialogBoxParamW
GetWindowLongPtrW
GetDC
ReleaseDC
GetWindowLongW
DrawTextW
OffsetRect
IsWindow
GetParent
SetDlgItemTextW
SetDlgItemTextA
EndDialog
GetDlgItemTextW
SetWindowTextW
LoadStringW
SetWindowLongPtrW
MessageBoxW
GetSubMenu
GetMenuItemCount
GetMenuItemID
DrawMenuBar
AppendMenuW
CreatePopupMenu
GetMenu
MapWindowPoints
GetClientRect
ScreenToClient
GetCursorPos
GetDlgItem
DefWindowProcW
SetFocus
SetWindowPos
ShowWindow
DestroyWindow
SendMessageW
CreateDialogParamW
SetTimer

gdi32

SetRectRgn
CreateSolidBrush
CreateRectRgn
SetBkMode
SetTextColor
CombineRgn
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetStockObject
FillRgn

advapi32

EnumServicesStatusW
EnumDependentServicesW
ControlService
StartServiceW
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW

shell32

ShellExecuteW

comctl32

_TrackMouseEvent

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ptm_vista.dll
.dll windows:5 windows x64 arch:x64

37d380f7391f886c9c496e3a4de01bab

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:f3:f4:68:66:21:3d:d9:2f:af:31:91:27:6d:65:0a:fe:69:80:a9
Signer

Actual PE Digest

1e:f3:f4:68:66:21:3d:d9:2f:af:31:91:27:6d:65:0a:fe:69:80:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\ptm_vista.pdb

Imports

kernel32

DisableThreadLibraryCalls
FlushInstructionCache
GetLastError
GetTickCount
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
LeaveCriticalSection
GetCurrentThreadId
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
GetCommandLineA
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
Sleep
MultiByteToWideChar
WideCharToMultiByte
RaiseException
LoadLibraryA
LocalAlloc
lstrcmpiW
GetModuleFileNameW
EnterCriticalSection
GetCurrentThread
GetCurrentProcess
QueryDosDeviceW
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
TerminateThread
lstrlenW
CompareStringW
GetProcessAffinityMask
GetPriorityClass
SetProcessWorkingSetSize
WritePrivateProfileStringW
HeapSetInformation
CreateThread
SetThreadPriority
CreateFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
CloseHandle
ExpandEnvironmentStringsW
lstrcatW
lstrcpyW
OpenProcess
FindClose
FindFirstFileW
DeviceIoControl
GetProcAddress
HeapCreate
LoadLibraryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

EnableWindow
TrackPopupMenuEx
EnableMenuItem
KillTimer
DestroyMenu
RemoveMenu
LoadMenuW
EndDeferWindowPos
DeferWindowPos
GetWindowRect
BeginDeferWindowPos
GetDialogBaseUnits
GetSystemMetrics
BeginPaint
EndPaint
FillRect
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetCursor
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
PtInRect
UpdateWindow
InvalidateRect
GetClassNameW
SetWindowLongW
LoadCursorW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
CharNextW
CallWindowProcW
SetRectEmpty
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
CheckMenuItem
DialogBoxParamW
GetWindowLongPtrW
GetDC
ReleaseDC
GetWindowLongW
DrawTextW
OffsetRect
IsWindow
GetParent
SetDlgItemTextW
SetDlgItemTextA
EndDialog
GetDlgItemTextW
SetWindowTextW
LoadStringW
SetWindowLongPtrW
MessageBoxW
DeleteMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
DrawMenuBar
AppendMenuW
CreatePopupMenu
GetMenu
MapWindowPoints
GetClientRect
ScreenToClient
GetCursorPos
GetDlgItem
DefWindowProcW
SetFocus
SetWindowPos
ShowWindow
DestroyWindow
SendMessageW
CreateDialogParamW
SetTimer

gdi32

SetRectRgn
CreateSolidBrush
CreateRectRgn
SetBkMode
SetTextColor
CombineRgn
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetStockObject
FillRgn

advapi32

ChangeServiceConfigW
ControlService
StartServiceW
QueryServiceConfig2W
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
EnumServicesStatusExW
EnumDependentServicesW

shell32

ShellExecuteW

comctl32

_TrackMouseEvent

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ptm_win7.dll
.dll windows:5 windows x64 arch:x64

37d380f7391f886c9c496e3a4de01bab

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

80:15:27:86:ce:a0:ed:b4:69:3e:82:d9:93:b8:0a:96:75:4a:1f:6e
Signer

Actual PE Digest

80:15:27:86:ce:a0:ed:b4:69:3e:82:d9:93:b8:0a:96:75:4a:1f:6e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\ptm_win7.pdb

Imports

kernel32

DisableThreadLibraryCalls
FlushInstructionCache
GetLastError
GetTickCount
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
LeaveCriticalSection
GetCurrentThreadId
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
GetCommandLineA
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
Sleep
MultiByteToWideChar
WideCharToMultiByte
RaiseException
LoadLibraryA
LocalAlloc
lstrcmpiW
GetModuleFileNameW
EnterCriticalSection
GetCurrentThread
GetCurrentProcess
QueryDosDeviceW
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
TerminateThread
lstrlenW
CompareStringW
GetProcessAffinityMask
GetPriorityClass
SetProcessWorkingSetSize
WritePrivateProfileStringW
HeapSetInformation
CreateThread
SetThreadPriority
CreateFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
CloseHandle
ExpandEnvironmentStringsW
lstrcatW
lstrcpyW
OpenProcess
FindClose
FindFirstFileW
DeviceIoControl
GetProcAddress
HeapCreate
LoadLibraryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

EnableWindow
TrackPopupMenuEx
EnableMenuItem
KillTimer
DestroyMenu
RemoveMenu
LoadMenuW
EndDeferWindowPos
DeferWindowPos
GetWindowRect
BeginDeferWindowPos
GetDialogBaseUnits
GetSystemMetrics
BeginPaint
EndPaint
FillRect
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetCursor
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
PtInRect
UpdateWindow
InvalidateRect
GetClassNameW
SetWindowLongW
LoadCursorW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
CharNextW
CallWindowProcW
SetRectEmpty
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
CheckMenuItem
DialogBoxParamW
GetWindowLongPtrW
GetDC
ReleaseDC
GetWindowLongW
DrawTextW
OffsetRect
IsWindow
GetParent
SetDlgItemTextW
SetDlgItemTextA
EndDialog
GetDlgItemTextW
SetWindowTextW
LoadStringW
SetWindowLongPtrW
MessageBoxW
DeleteMenu
GetSubMenu
GetMenuItemCount
GetMenuItemID
DrawMenuBar
AppendMenuW
CreatePopupMenu
GetMenu
MapWindowPoints
GetClientRect
ScreenToClient
GetCursorPos
GetDlgItem
DefWindowProcW
SetFocus
SetWindowPos
ShowWindow
DestroyWindow
SendMessageW
CreateDialogParamW
SetTimer

gdi32

SetRectRgn
CreateSolidBrush
CreateRectRgn
SetBkMode
SetTextColor
CombineRgn
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetStockObject
FillRgn

advapi32

ChangeServiceConfigW
ControlService
StartServiceW
QueryServiceConfig2W
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
EnumServicesStatusExW
EnumDependentServicesW

shell32

ShellExecuteW

comctl32

_TrackMouseEvent

Sections

.text
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ptm_xp.dll
.dll windows:5 windows x64 arch:x64

3a0f305aea0ca414571c1e1886a28eb4

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

09/12/2009, 00:00

Not After

11/12/2010, 23:59

Subject

CN=O&K Software Ltd.,O=O&K Software Ltd.,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

08:bd:78:e7:0e:a3:2c:2b:7c:40:38:14:df:02:51:b5:1f:9c:59:ca
Signer

Actual PE Digest

08:bd:78:e7:0e:a3:2c:2b:7c:40:38:14:df:02:51:b5:1f:9c:59:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Prio\Release1.99\prio\x64\Release\ptm_xp.pdb

Imports

kernel32

DisableThreadLibraryCalls
FlushInstructionCache
GetLastError
GetTickCount
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleMode
GetConsoleCP
SetFilePointer
InitializeCriticalSectionAndSpinCount
HeapReAlloc
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
LeaveCriticalSection
GetCurrentThreadId
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
HeapSize
FlsAlloc
SetLastError
FlsFree
FlsGetValue
DecodePointer
EncodePointer
GetStringTypeW
LCMapStringW
LCMapStringA
GetCPInfo
RtlUnwindEx
RtlPcToFileHeader
GetCommandLineA
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
GetProcessHeap
HeapAlloc
HeapFree
InterlockedPushEntrySList
Sleep
MultiByteToWideChar
WideCharToMultiByte
RaiseException
LoadLibraryA
LocalAlloc
lstrcmpiW
GetModuleFileNameW
EnterCriticalSection
GetCurrentProcess
QueryDosDeviceW
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
TerminateThread
lstrlenW
CompareStringW
GetProcessAffinityMask
GetPriorityClass
SetProcessWorkingSetSize
WritePrivateProfileStringW
HeapSetInformation
CreateThread
GetCurrentThread
SetThreadPriority
CreateFileW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetModuleHandleW
CloseHandle
ExpandEnvironmentStringsW
lstrcatW
lstrcpyW
OpenProcess
FindClose
FindFirstFileW
DeviceIoControl
GetProcAddress
HeapCreate
LoadLibraryW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

user32

SetTimer
TrackPopupMenuEx
EnableMenuItem
KillTimer
DestroyMenu
RemoveMenu
LoadMenuW
EndDeferWindowPos
DeferWindowPos
GetWindowRect
BeginDeferWindowPos
GetDialogBaseUnits
GetSystemMetrics
BeginPaint
EndPaint
FillRect
IsWindowEnabled
GetSysColor
GetFocus
DrawFocusRect
SetCursor
SetCapture
GetCapture
ReleaseCapture
GetDlgCtrlID
PtInRect
UpdateWindow
InvalidateRect
GetClassNameW
SetWindowLongW
LoadCursorW
CreateWindowExW
GetWindowTextLengthW
GetWindowTextW
CharNextW
CallWindowProcW
SetRectEmpty
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetWindow
CheckMenuItem
DialogBoxParamW
GetWindowLongPtrW
GetDC
ReleaseDC
GetWindowLongW
DrawTextW
OffsetRect
IsWindow
GetParent
SetDlgItemTextW
SetDlgItemTextA
EndDialog
GetDlgItemTextW
SetWindowTextW
LoadStringW
SetWindowLongPtrW
MessageBoxW
GetSubMenu
GetMenuItemCount
GetMenuItemID
DrawMenuBar
AppendMenuW
CreatePopupMenu
GetMenu
MapWindowPoints
GetClientRect
ScreenToClient
GetCursorPos
GetDlgItem
DefWindowProcW
SetFocus
SetWindowPos
ShowWindow
DestroyWindow
SendMessageW
CreateDialogParamW
EnableWindow

gdi32

SetRectRgn
CreateSolidBrush
CreateRectRgn
SetBkMode
SetTextColor
CombineRgn
GetObjectW
CreateFontIndirectW
DeleteObject
SelectObject
GetStockObject
FillRgn

advapi32

EnumServicesStatusExW
EnumDependentServicesW
ControlService
StartServiceW
QueryServiceConfig2W
QueryServiceConfigW
QueryServiceStatus
CloseServiceHandle
OpenServiceW
OpenSCManagerW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ChangeServiceConfigW

shell32

ShellExecuteW

comctl32

_TrackMouseEvent

Sections

.text
Size: 227KB - Virtual size: 226KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

18:38:b4:23:5b:ed:35:45:46:65:1f:db:70:5f:24:40:90:5e:2c:a8Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 291KB

.ndata Size: - Virtual size: 296KB

.rsrc Size: 19KB - Virtual size: 19KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

b88aba07dbcfae573e9cf97aa63e4b78

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5Certificate

Extended Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

ea:b5:da:6b:c5:13:86:ef:60:01:d1:8d:11:71:7f:95:bd:a3:cc:3cSigner

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 1KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

18:38:b4:23:5b:ed:35:45:46:65:1f:db:70:5f:24:40:90:5e:2c:a8
Signer

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 291KB

.ndata
Size: - Virtual size: 296KB

.rsrc
Size: 19KB - Virtual size: 19KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

ea:b5:da:6b:c5:13:86:ef:60:01:d1:8d:11:71:7f:95:bd:a3:cc:3c
Signer

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 96B

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 512B - Virtual size: 62B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

17:b9:e2:53:74:e9:cf:07:be:31:02:f7:64:8d:d4:79:3c:b2:02:d4
Signer

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 512B - Virtual size: 298B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

c7:94:0f:2b:14:14:66:e8:63:f4:77:32:19:53:9f:d0:0e:67:e8:f6
Signer

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 48B

.pdata
Size: 512B - Virtual size: 36B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

18:5d:f9:c4:d5:3d:92:3e:3d:25:4f:d7:14:03:27:e5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate