NCH Software[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

NCH Software.rar
Size

3.4MB
MD5

fb9993ca5c0d14a1066da8550c413162
SHA1

615b30df637843e0530fe19a1b02060012835336
SHA256

ce426055645c0280fe8fcfa8415a82695ae8ea4396be7e908f7a0e9425d9270b
SHA512

0e8968566099076acbe33f83109202520dac5a18781a2dcd20e285ac3e0b5487b5a99cb44744e0dbfaa3f7b99a3f6b25ae0ff80b07b59ef787a512f7e5d508a4
SSDEEP

98304:ehmIngCBEhXqqY/Firb48CDegb5jYeGddYS:ehmC3q1ql4rbCDei5jYdddP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NCH Software/ClickCharts/shellmenu.dll

Files

NCH Software.rar
.rar
NCH Software/ClickCharts/clickcharts.exe
.exe windows:4 windows x86 arch:x86

8c1362edd5817c09bfef382fe761977e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/03/2022, 00:00

Not After

02/04/2025, 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/03/2022, 00:00

Not After

02/04/2025, 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19/01/2024, 16:46

Not After

01/06/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c5:1a:38:12:aa:9d:09:8e:96:59:73:a9:49:ed:74:d6:2e:c4:e4:da:80:d8:ca:a0:fa:24:77:ba:64:af:bf:47
Signer

Actual PE Digest

c5:1a:38:12:aa:9d:09:8e:96:59:73:a9:49:ed:74:d6:2e:c4:e4:da:80:d8:ca:a0:fa:24:77:ba:64:af:bf:47

Digest Algorithm

sha256

PE Digest Matches

true

26:48:a0:6d:cc:34:0f:58:ea:79:74:9f:6e:f3:fa:06:d5:9c:d0:32
Signer

Actual PE Digest

26:48:a0:6d:cc:34:0f:58:ea:79:74:9f:6e:f3:fa:06:d5:9c:d0:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\sourcecode\diagrams\release\ClickCharts.pdb

Imports

imm32

ImmNotifyIME
ImmGetVirtualKey
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow

kernel32

GetDiskFreeSpaceExW
SetThreadPriority
GetPrivateProfileIntW
ReadProcessMemory
GetVersionExA
CreateHardLinkW
Process32FirstW
VirtualQuery
GetPrivateProfileSectionNamesW
CreateThread
GetProcessHeap
SetEvent
GetSystemTime
QueryPerformanceFrequency
GetCurrentProcessId
ExitProcess
SetFileTime
GetStdHandle
GlobalUnlock
SetLastError
RtlCaptureContext
FreeResource
FileTimeToSystemTime
FormatMessageW
GetCPInfo
GetLongPathNameW
MoveFileA
GetComputerNameW
ReleaseMutex
CancelIo
GetPrivateProfileStringW
GlobalLock
GlobalMemoryStatusEx
SetUnhandledExceptionFilter
LocalFree
DuplicateHandle
CreatePipe
SizeofResource
HeapFree
LockResource
GetCurrentThread
Process32NextW
WaitForMultipleObjects
CreateNamedPipeW
GetThreadContext
FindResourceW
GlobalAlloc
WaitNamedPipeW
PeekNamedPipe
ProcessIdToSessionId
HeapAlloc
CreateMutexW
SetFileAttributesW
GetShortPathNameW
lstrcpyW
GetTimeZoneInformation
MoveFileExW
GetModuleHandleW
ResumeThread
TerminateProcess
ConnectNamedPipe
WriteFile
GetFileSizeEx
CloseHandle
lstrlenA
SetEnvironmentVariableA
CompareStringW
ResetEvent
QueryPerformanceCounter
GlobalHandle
SetEnvironmentVariableW
SystemTimeToTzSpecificLocalTime
GetCommandLineW
RemoveDirectoryW
InterlockedExchange
GetThreadPriority
GetACP
GetModuleFileNameA
SuspendThread
GetEnvironmentVariableA
GetModuleFileNameW
SetEndOfFile
CreateToolhelp32Snapshot
GetOverlappedResult
GetDriveTypeW
GetSystemInfo
CopyFileW
GetExitCodeProcess
LoadResource
SetCurrentDirectoryW
LoadLibraryW
GetEnvironmentVariableW
GetStartupInfoW
FileTimeToLocalFileTime
GetCurrentDirectoryA
LocalAlloc
GetFileAttributesA
GlobalSize
GetCurrentProcess
VerifyVersionInfoW
GetVersionExW
CreateProcessW
GlobalFree
CreateEventW
GetSystemDirectoryW
OpenProcess
GetCurrentThreadId
VerSetConditionMask
GetTickCount
LoadLibraryA
MulDiv
DeleteCriticalSection
InterlockedExchangeAdd
CreateFileW
InterlockedIncrement
GetLocaleInfoW
FindNextFileW
LeaveCriticalSection
FreeLibrary
InitializeCriticalSection
FindClose
EnterCriticalSection
DisconnectNamedPipe
GetTempPathW
FindFirstFileW
FlushFileBuffers
WideCharToMultiByte
ReadFile
SetFilePointerEx
GetProcAddress
InterlockedDecrement
MoveFileW
MultiByteToWideChar
GetFileAttributesW
WaitForSingleObject
CompareStringA
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
RaiseException
RtlUnwind
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileTime
CreateDirectoryW
GetLastError
SetFilePointer
Sleep
DeleteFileW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
HeapCreate
HeapDestroy
VirtualAlloc
VirtualFree
HeapReAlloc
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
HeapSize
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStartupInfoA

advapi32

CryptDeriveKey
RegSetValueExW
RegSetKeySecurity
GetUserNameW
RegCreateKeyExW
InitializeSecurityDescriptor
GetSidSubAuthority
GetAce
OpenProcessToken
DuplicateTokenEx
SetFileSecurityW
CryptDestroyHash
RegEnumKeyW
RegEnumValueW
RegOpenKeyW
InitializeSid
AddAccessAllowedAce
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
CryptDuplicateKey
RegDeleteKeyW
RegQueryValueExW
ConvertSidToStringSidW
CryptHashData
CryptDestroyKey
AllocateAndInitializeSid
CryptCreateHash
RegEnumKeyExW
GetSidLengthRequired
InitializeAcl
FreeSid
CryptEncrypt
CheckTokenMembership
SetSecurityDescriptorDacl
GetTokenInformation
CryptDecrypt
CryptAcquireContextW
RegCloseKey

comctl32

ImageList_Destroy
_TrackMouseEvent
CreatePropertySheetPageW
ord17
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_Add
ImageList_Create
ImageList_Remove
PropertySheetW
InitCommonControlsEx
ImageList_ReplaceIcon
ImageList_GetIcon
ImageList_Replace
ImageList_GetImageCount

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameW

gdi32

MoveToEx
GetStockObject
SetBkMode
DeleteDC
CreateFontW
DeleteObject
StartPage
CreateSolidBrush
CreatePen
EndDoc
EndPage
CreateBitmap
GetTextCharset
SetTextAlign
CreateDIBitmap
BitBlt
GetTextAlign
GetDIBits
GetTextExtentPoint32W
SetBrushOrgEx
GetOutlineTextMetricsW
StretchBlt
PolyPolyline
SetDIBitsToDevice
SetPixel
SetWinMetaFileBits
CreateCompatibleDC
CreateFontIndirectW
DeleteEnhMetaFile
CreateCompatibleBitmap
SetEnhMetaFileBits
CreateDIBSection
SetBkColor
CombineRgn
CreateDCW
GetFontData
GetDeviceCaps
Polygon
SetStretchBltMode
GetWindowExtEx
CreateRectRgnIndirect
TextOutW
EnumEnhMetaFile
SetViewportExtEx
SetBitmapBits
Polyline
CreatePatternBrush
GetViewportExtEx
GetBkMode
GetObjectA
GetBitmapBits
GetGlyphOutlineW
SetWindowExtEx
SetDIBits
SelectObject
GetGlyphIndicesW
GetCurrentObject
GetTextMetricsW
StartDocW
LineTo
GetEnhMetaFileBits
SetTextColor
GetObjectW

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoRegisterClassObject
CoInitializeSecurity
CoRevokeClassObject
CoInitialize
CoResumeClassObjects
CoTaskMemAlloc
CoUninitialize
CoAddRefServerProcess
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
OleLoadPicture
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
OleLoadPicturePath

shell32

SHCreateShellItem
SHGetMalloc
DragQueryFileW
SHGetFolderPathW
ShellExecuteA
DragFinish
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW
SHEmptyRecycleBinW
ord680
SHParseDisplayName
ShellExecuteW
Shell_NotifyIconW
SHGetDesktopFolder
SHGetPathFromIDListW
DragAcceptFiles
ord155
SHBrowseForFolderW

shlwapi

SHDeleteEmptyKeyW
StrCmpLogicalW
PathCompactPathExW
SHDeleteKeyW

user32

EnableMenuItem
MoveWindow
DestroyIcon
SendDlgItemMessageW
GetCapture
SetFocus
CopyImage
SetCursor
IsWindow
SetCapture
RegisterClipboardFormatW
FrameRect
GetCursor
GetClientRect
GetCursorInfo
CheckDlgButton
CreatePopupMenu
GetMenu
SetPropW
DefWindowProcW
IsWindowVisible
ReleaseDC
GetAsyncKeyState
GetSystemMetrics
GetDesktopWindow
IsWindowEnabled
TrackPopupMenu
SetClassLongW
InvalidateRect
DeleteMenu
KillTimer
CountClipboardFormats
InsertMenuW
GetMenuItemCount
DrawIconEx
GetMenuItemInfoW
FindWindowW
MonitorFromRect
PeekMessageW
GetKeyboardState
WindowFromPoint
LoadIconW
MonitorFromPoint
CallWindowProcW
SetMenuItemInfoW
MsgWaitForMultipleObjects
GetClipboardData
GetMonitorInfoW
GetUpdateRect
EndMenu
GetMenuInfo
LoadStringW
GetWindow
GetDlgCtrlID
GetClassNameA
EnumDisplayMonitors
DestroyCursor
NotifyWinEvent
AllowSetForegroundWindow
InsertMenuItemW
GetParent
CharUpperW
GetScrollBarInfo
SetMenuInfo
GetClassInfoW
GetMessageW
keybd_event
GetWindowThreadProcessId
IsDialogMessageW
GetClipboardFormatNameW
AdjustWindowRectEx
RemoveMenu
SetDlgItemTextW
SetWindowPlacement
GetClassNameW
GetWindowDC
IsClipboardFormatAvailable
DialogBoxIndirectParamW
RegisterClassW
MapVirtualKeyW
TranslateMessage
SetMenuDefaultItem
GetWindowTextW
SetClipboardData
WindowFromDC
PtInRect
FlashWindowEx
IsCharAlphaW
RemovePropW
MonitorFromWindow
FindWindowExW
EndDialog
GetAncestor
wsprintfW
MapWindowPoints
GetSysColorBrush
EnumThreadWindows
ChildWindowFromPoint
GetMenuBarInfo
DispatchMessageW
GetComboBoxInfo
MessageBoxW
CreateIconIndirect
GetPropW
GetDlgItemTextW
EnumChildWindows
CallNextHookEx
PostQuitMessage
GetPriorityClipboardFormat
GetKeyNameTextW
GetFocus
SendInput
SetWindowLongW
LoadCursorW
BeginPaint
UpdateWindow
FillRect
UnhookWindowsHookEx
EnableWindow
GetWindowPlacement
GetScrollInfo
GetSysColor
CreateWindowExW
ShowWindow
DialogBoxParamW
EmptyClipboard
DestroyMenu
IsZoomed
GetWindowLongW
ReleaseCapture
AppendMenuW
GetActiveWindow
LoadImageW
CheckRadioButton
ScreenToClient
SetScrollInfo
GetWindowTextLengthW
GetWindowRect
GetDC
DestroyWindow
WaitForInputIdle
CreateDialogIndirectParamW
IsDlgButtonChecked
MapDialogRect
SetWindowsHookExW
SetActiveWindow
OpenClipboard
CloseClipboard
PostMessageW
IsIconic
SetForegroundWindow
CheckMenuItem
GetForegroundWindow
ClientToScreen
SetWindowTextW
SetTimer
RedrawWindow
SetMenu
EndPaint
GetDlgItem
SendMessageW
SetWindowPos
ScrollWindowEx
GetKeyState
DrawTextW
GetSubMenu
SystemParametersInfoW

ws2_32

recv
setsockopt
connect
socket
send
select
inet_addr
closesocket
ioctlsocket
gethostbyname
WSAGetLastError
htons
WSAStartup
gethostname
__WSAFDIsSet
gethostbyaddr
ntohs

winspool.drv

OpenPrinterW

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidCreate
UuidToStringW

netapi32

NetUserGetInfo
NetApiBufferFree

msimg32

AlphaBlend
GradientFill

iphlpapi

GetIpAddrTable
GetAdaptersAddresses

wininet

InternetGetConnectedState
InternetAutodialHangup
InternetAutodial
InternetQueryOptionA

dnsapi

DnsQuery_W
DnsRecordListFree

gdiplus

GdipFillRectangle
GdipStartPathFigure
GdipDeletePathIter
GdipCreatePathIter
GdipDeletePath
GdipTransformPath
GdipCreateBitmapFromStream
GdipSetPathFillMode
GdipGetPropertyItem
GdipCloneImage
GdipAddPathLine2
GdipDeleteRegion
GdipCreateFontFamilyFromName
GdipCreateRegionRect
GdipClonePath
GdipDeleteBrush
GdipSetPathMarker
GdipGetImageVerticalResolution
GdipSaveImageToStream
GdipGetGenericFontFamilySansSerif
GdipGetPointCount
GdipIsVisiblePathPoint
GdipSetClipRegion
GdipGetImageHeight
GdipDeletePen
GdipDrawLine
GdipMultiplyWorldTransform
GdipFillEllipse
GdipAddPathStringI
GdipEmfToWmfBits
GdipSetImageAttributesWrapMode
GdipAddPathString
GdipSetLineBlend
GdipCreateLineBrush
GdipSetPenEndCap
GdipWidenPath
GdipSetStringFormatFlags
GdipGetFontSize
GdipCreateFontFromDC
GdipGetFontCollectionFamilyCount
GdipGetPathTypes
GdipFlattenPath
GdipNewInstalledFontCollection
GdipGetStringFormatFlags
GdipSetStringFormatAlign
GdipSetPenMiterLimit
GdipResetClip
GdipSetImageAttributesColorMatrix
GdipCreateRegion
GdipSetPenDashCap197819
GdipGetBrushType
GdipDrawImageRectRect
GdipCreateFromHDC
GdipGetEmHeight
GdipSetPageUnit
GdipCombineRegionPath
GdipCreateBitmapFromHBITMAP
GdipGetFontCollectionFamilyList
GdipSetSolidFillColor
GdipSetPathGradientCenterColor
GdipCloneFontFamily
GdipSetPathGradientPresetBlend
GdipImageSelectActiveFrame
GdipGetRegionBounds
GdipGetTextRenderingHint
GdiplusStartup
GdipSetStringFormatHotkeyPrefix
GdipSetPathGradientBlend
GdipSaveAdd
GdipSaveAddImage
GdipCreateStringFormat
GdipDrawPath
GdipGetClip
GdipSetPathGradientWrapMode
GdipFillPath
GdipSetStringFormatTrimming
GdipGetCellAscent
GdipReleaseDC
GdipGetPathWorldBounds
GdipDisposeImageAttributes
GdipSetInterpolationMode
GdipSaveGraphics
GdipSetPathGradientCenterPoint
GdipCreateBitmapFromScan0
GdipCreatePen1
GdipCreateFontFromLogfontA
GdipSetPathGradientTransform
GdipCreateImageAttributes
GdipGetImageEncodersSize
GdipSetPenStartCap
GdipMeasureString
GdipDeleteStringFormat
GdipCreateMetafileFromStream
GdipGetCellDescent
GdipGetPathGradientPointCount
GdipStringFormatGetGenericTypographic
GdipGetMetafileHeaderFromMetafile
GdipSetPenDashArray
GdipSetLineWrapMode
GdipIsOutlineVisiblePathPoint
GdipGetFamilyName
GdipSetStringFormatLineAlign
GdipMeasureCharacterRanges
GdipSetPenLineJoin
GdipSetLinePresetBlend
GdipSetStringFormatMeasurableCharacterRanges
GdipSetPenDashOffset
GdipGetSolidFillColor
GdipGetFontStyle
GdipGetImageEncoders
GdipGetFamily
GdipCloneStringFormat
GdipCreatePathGradientFromPath
GdipRestoreGraphics
GdiplusShutdown
GdipGetImageGraphicsContext
GdipGetMetafileHeaderFromEmf
GdipRecordMetafileStreamI
GdipGetDC
GdipSetPathGradientSurroundColorsWithCount
GdipGetHemfFromMetafile
GdipSetLineTransform
GdipBitmapSetResolution
GdipAddPathRectangle
GdipGetPathPoints
GdipResetWorldTransform
GdipPathIterNextMarkerPath
GdipClosePathFigure
GdipDeleteGraphics
GdipTranslateWorldTransform
GdipCreateSolidFill
GdipSetSmoothingMode
GdipBitmapUnlockBits
GdipGetWorldTransform
GdipGetPropertyIdList
GdipDeleteFont
GdipBitmapLockBits
GdipAddPathArc
GdipDeleteFontFamily
GdipCreatePen2
GdipDrawString
GdipGraphicsClear
GdipGetPropertyItemSize
GdipCreateFont
GdipCreateMatrix
GdipGetImageHorizontalResolution
GdipSetWorldTransform
GdipAddPathBezier
GdipAddPathLine
GdipGetImagePixelFormat
GdipCloneBrush
GdipSetPixelOffsetMode
GdipAddPathEllipse
GdipDrawEllipse
GdipResetPath
GdipGetImageWidth
GdipCreatePath
GdipDisposeImage
GdipDeleteMatrix
GdipDrawRectangle
GdipGetPathLastPoint
GdipSetTextRenderingHint
GdipCreateMatrix2
GdipAddPathPath
GdipGetPropertyCount
GdipSetPenDashStyle
GdipGetMatrixElements

secur32

InitializeSecurityContextW
DecryptMessage
EncryptMessage
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleW
QueryContextAttributesW
FreeContextBuffer
ApplyControlToken

crypt32

CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptQueryObject

wintrust

WinVerifyTrust

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 653KB - Virtual size: 653KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 3B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NCH Software/ClickCharts/clickchartssetup_v9.29.exe
.exe windows:5 windows x86 arch:x86

dfc6dbbcea4beda15dcbddfb77d26fc5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/03/2022, 00:00

Not After

02/04/2025, 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

18/03/2022, 00:00

Not After

02/04/2025, 23:59

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

19/01/2024, 16:46

Not After

01/06/2029, 00:00

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e4:64:f8:56:45:b9:ce:bf:b4:01:d9:72:8b:fe:ed:82:82:bf:1c:b1:4f:f8:3e:d2:e4:74:7c:c3:2d:88:5d:06
Signer

Actual PE Digest

e4:64:f8:56:45:b9:ce:bf:b4:01:d9:72:8b:fe:ed:82:82:bf:1c:b1:4f:f8:3e:d2:e4:74:7c:c3:2d:88:5d:06

Digest Algorithm

sha256

PE Digest Matches

true

c1:eb:c1:ec:ab:df:a2:a8:b4:50:2b:bc:b2:d2:17:0a:4e:6f:64:f4
Signer

Actual PE Digest

c1:eb:c1:ec:ab:df:a2:a8:b4:50:2b:bc:b2:d2:17:0a:4e:6f:64:f4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

setupapi

SetupIterateCabinetW

ole32

CoUninitialize
CoInitializeEx

shell32

ShellExecuteExW
ShellExecuteW

user32

wsprintfW
MessageBoxW

kernel32

CreateDirectoryW
lstrcpyW
DeleteFileW
CloseHandle
RemoveDirectoryW
LockResource
LoadLibraryA
GetProcAddress
GetLastError
GetTempPathW
GetStartupInfoW
ExitProcess
GetCommandLineW
FindResourceW
FreeLibrary
LoadResource
VerSetConditionMask
SetEnvironmentVariableW
WaitForSingleObject
GetModuleHandleW
WriteFile
SizeofResource
GetExitCodeProcess
GetModuleFileNameW
CreateFileW

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NCH Software/ClickCharts/shellmenu.dll
.dll windows:6 windows x64 arch:x64

a8855f899e3960ffc2c02739894b8226

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsIsStringEmpty
WindowsGetStringRawBuffer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW

shell32

ShellExecuteExW
SHGetStockIconInfo

advapi32

RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

shlwapi

SHStrDupW

ole32

CoTaskMemFree
CoTaskMemAlloc

kernel32

GetConsoleMode
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
FreeLibrary
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
HeapReAlloc
InitOnceExecuteOnce
EncodePointer
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
DecodePointer
AcquireSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
HeapSize
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetCurrentProcess
TerminateProcess
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NCH Software/ClickCharts/shellmenua.msix
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxSignature.p7x
[Content_Types].xml
.xml
NCH Software/ClickCharts/shellmenub.msix
.appx
AppxBlockMap.xml
.xml
AppxManifest.xml
AppxSignature.p7x
[Content_Types].xml
.xml
NCH Software/ClickCharts/zlib1v3.exe
.exe windows:4 windows x86 arch:x86

a6395c68dfe647509ad9d94b8cd4ef96

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:01:c3:ff:88:55:f0:08:c8:e4:fa:63:97:32:52:e6
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2019, 00:00

Not After

30/03/2022, 12:00

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:b9:14:f4:75:ba:6f:ac:ea:57:5d:b5:25:12:5c:7a
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2019, 00:00

Not After

30/03/2022, 12:00

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

38:63:de:f8
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

24/12/1999, 17:50

Not After

24/07/2029, 14:15

Subject

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

Issuer

CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

Not Before

22/07/2015, 19:02

Not After

22/06/2029, 19:32

Subject

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8d:ce:15:f3:a7:94:c5:87:00:00:00:00:55:92:33:f4
Certificate

Issuer

CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

22/07/2020, 15:33

Not After

29/12/2030, 16:29

Subject

CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a2:fa:37:c7:bc:3f:28:fc:0c:bd:d4:31:6b:2e:4d:a2:a4:68:cf:6f:0e:63:a1:08:28:08:2d:8e:72:66:0c:e9
Signer

Actual PE Digest

a2:fa:37:c7:bc:3f:28:fc:0c:bd:d4:31:6b:2e:4d:a2:a4:68:cf:6f:0e:63:a1:08:28:08:2d:8e:72:66:0c:e9

Digest Algorithm

sha256

PE Digest Matches

true

f5:bc:e4:13:18:15:1e:8c:57:fd:61:4a:7d:6c:3c:e7:71:81:9c:44
Signer

Actual PE Digest

f5:bc:e4:13:18:15:1e:8c:57:fd:61:4a:7d:6c:3c:e7:71:81:9c:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SizeofResource
LoadResource
GetTempFileNameA
WriteFile
LoadLibraryA
GetModuleHandleA
GetVersionExA
GetEnvironmentVariableA
ExitProcess
CloseHandle
CreateProcessA
WaitForSingleObject
GetTempPathA
LockResource
FindResourceA
lstrcpyA
DeleteFileA
CreateFileA
CreateDirectoryA
GetProcAddress

user32

wsprintfA
MessageBoxA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
RegSetValueExA

setupapi

SetupIterateCabinetA

Sections

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
NCH Software/Components/zlib1v3/zlib1.dll
.dll windows:4 windows x86 arch:x86

d75f2ddca22f4f82f142e2a52e7c0e71

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:01:c3:ff:88:55:f0:08:c8:e4:fa:63:97:32:52:e6
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2019, 00:00

Not After

30/03/2022, 12:00

Subject

SERIALNUMBER=4489370,CN=NCH Software\, Inc.,O=NCH Software\, Inc.,L=Greenwood Village,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:0d:ef:9d:1b:51:a5:24:8e:2c:03:50:af:1f:ed:f4:6b:9f:2c:fb
Signer

Actual PE Digest

17:0d:ef:9d:1b:51:a5:24:8e:2c:03:50:af:1f:ed:f4:6b:9f:2c:fb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\sourcecode\components\thecomponents\zlib1x64\vcproject\release\zlib.pdb

Imports

kernel32

GetLastError
SetFilePointer
CloseHandle
GetFileType
CreateFileW
HeapFree
HeapAlloc
WideCharToMultiByte
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
SetStdHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
GetConsoleCP
GetConsoleMode
SetEndOfFile
MultiByteToWideChar
ReadFile
GetProcAddress
GetModuleHandleA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetModuleFileNameA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSection
RtlUnwind
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LoadLibraryA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CreateFileA
HeapSize
FlushFileBuffers

Exports

Exports

adler32
adler32_combine
compress
compress2
compressBound
crc32
crc32_combine
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c1362edd5817c09bfef382fe761977e

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1Certificate

Extended Key Usages

Key Usages

38:63:de:f8Certificate

Key Usages

58:da:13:ff:00:00:00:00:51:ce:0d:f7Certificate

Extended Key Usages

Key Usages

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04Certificate

Extended Key Usages

Key Usages

c5:1a:38:12:aa:9d:09:8e:96:59:73:a9:49:ed:74:d6:2e:c4:e4:da:80:d8:ca:a0:fa:24:77:ba:64:af:bf:47Signer

26:48:a0:6d:cc:34:0f:58:ea:79:74:9f:6e:f3:fa:06:d5:9c:d0:32Signer

Headers

File Characteristics

PDB Paths

Imports

imm32

kernel32

advapi32

comctl32

comdlg32

gdi32

ole32

oleaut32

shell32

shlwapi

user32

ws2_32

winspool.drv

rpcrt4

netapi32

msimg32

iphlpapi

wininet

dnsapi

gdiplus

secur32

crypt32

wintrust

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 653KB - Virtual size: 653KB

.data Size: 18KB - Virtual size: 34KB

.tls Size: 512B - Virtual size: 3B

.rsrc Size: 1.1MB - Virtual size: 1.1MB

dfc6dbbcea4beda15dcbddfb77d26fc5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

c5:1a:38:12:aa:9d:09:8e:96:59:73:a9:49:ed:74:d6:2e:c4:e4:da:80:d8:ca:a0:fa:24:77:ba:64:af:bf:47
Signer

26:48:a0:6d:cc:34:0f:58:ea:79:74:9f:6e:f3:fa:06:d5:9c:d0:32
Signer

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 653KB - Virtual size: 653KB

.data
Size: 18KB - Virtual size: 34KB

.tls
Size: 512B - Virtual size: 3B

.rsrc
Size: 1.1MB - Virtual size: 1.1MB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

07:ef:f6:93:7e:47:22:71:e7:22:f7:e0:62:48:a3:f1
Certificate

38:63:de:f8
Certificate

58:da:13:ff:00:00:00:00:51:ce:0d:f7
Certificate

07:d7:13:53:da:25:61:b4:61:e9:90:47:8a:4c:ce:04
Certificate

e4:64:f8:56:45:b9:ce:bf:b4:01:d9:72:8b:fe:ed:82:82:bf:1c:b1:4f:f8:3e:d2:e4:74:7c:c3:2d:88:5d:06
Signer

c1:eb:c1:ec:ab:df:a2:a8:b4:50:2b:bc:b2:d2:17:0a:4e:6f:64:f4
Signer

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 4B

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

.reloc
Size: 512B - Virtual size: 168B

.text
Size: 81KB - Virtual size: 80KB

.rdata
Size: 43KB - Virtual size: 43KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 5KB - Virtual size: 4KB

.gxfg
Size: 4KB - Virtual size: 4KB

.gehcont
Size: 512B - Virtual size: 12B

.rsrc
Size: 512B - Virtual size: 248B

.reloc
Size: 2KB - Virtual size: 1KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

0a:01:c3:ff:88:55:f0:08:c8:e4:fa:63:97:32:52:e6
Certificate