36d53aaacf14af7cff0a31130124d096_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

36d53aaacf14af7cff0a31130124d096_JaffaCakes118
Size

1.7MB
MD5

36d53aaacf14af7cff0a31130124d096
SHA1

323207013b75c17e36bda24f5abf1a2446f046db
SHA256

80f75933eeb010187ab6f62dca979b711fd63197d049452fab427ed14dae7a80
SHA512

66ff8f78dd4e574653d9dcf92ee12eef7c6e1af4cbf595b025e341a01bcd50863cb063b6d7261be077d1d85864462bb342fa4c73496cc0273706ddef7a8d9636
SSDEEP

24576:2Mhg8GtDc2nYEsVzOZ5slyr2XYVqJwwhtsFEI7h4KJ0+d9rptE1p5dVWfZ2/:7h4w2nFZS0SXswsEmhT9fAndVWY/

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/ExLicenseVirusSafePage.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMP/nsisos.dll
unpack001/AccountCheck.exe
unpack001/AddScheduler.exe
unpack001/VSUtill.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

36d53aaacf14af7cff0a31130124d096_JaffaCakes118
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate

Issuer

CN=eBiz Networks Certificate Services,O=eBiz Networks Ltd,C=KR

Not Before

02/11/2010, 00:00

Not After

02/11/2011, 23:59

Subject

CN=J2networks,OU=solution,O=J2networks,POSTALCODE=135-090,STREET=143-15 changae B/D 5F+STREET=Samseong-dong\, Gangnam-gu\, Seoul\, Korea,L=Seoul,ST=Gangnam-gu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

09:d8:51:6f:b5:52:55:77:78:1d:d5:72:65:f7:ba:20:47:fb:74:f9
Signer

Actual PE Digest

09:d8:51:6f:b5:52:55:77:78:1d:d5:72:65:f7:ba:20:47:fb:74:f9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ExLicenseVirusSafePage.dll
.dll windows:4 windows x86 arch:x86

e2c6f316b5682e27932edc971f2cf5f4

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

InternetGetConnectedState

mfc42

ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord3953
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord5265
ord4998
ord2514
ord6052
ord1775
ord5280
ord4425
ord3597
ord3610
ord6055
ord4078
ord1776
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5290
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord3402
ord4627
ord3721
ord5199
ord4274
ord795
ord800
ord641
ord567
ord540
ord324
ord3626
ord3663
ord2414
ord2302
ord4234
ord858
ord924
ord1116
ord2864
ord2818
ord3092
ord1641
ord4710
ord755
ord4133
ord4297
ord5788
ord472
ord2754
ord470
ord2379
ord5953
ord860
ord1168
ord690
ord2614
ord2764
ord1988
ord939
ord941
ord6112
ord5207
ord389
ord5875
ord4476
ord6453
ord4047
ord2086
ord537
ord2867
ord6242
ord6467
ord3742
ord818
ord4275
ord6215
ord6320
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord600
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord3619
ord6375
ord826
ord269
ord1176
ord656
ord6199

msvcrt

__CxxFrameHandler
??2@YAPAXI@Z
__dllonexit
_onexit
??1type_info@@UAE@XZ
free
_initterm
malloc
_adjust_fdiv
_EH_prolog

kernel32

LocalFree
lstrcpyA
GlobalFree
FindResourceA
LoadResource
LockResource
LocalAlloc

user32

InvalidateRect
GetClientRect
SendMessageA
GetParent
PostMessageA
FindWindowExA
ShowWindow
IsWindowVisible
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
CopyRect
EnableWindow

gdi32

CreateFontA
GetStockObject

Exports

Exports

showPage

Sections

.text
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$TEMP/nsisos.dll
.dll windows:1 windows x86 arch:x86

a70233c77fd258ec47709388c2338273

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetEnvironmentStringsA
GetVersionExA
RtlUnwind
RtlZeroMemory
lstrcpyA

crtdll

_fdopen
_open_osfhandle
_ultoa
fclose
_cexit
malloc
printf
raise
setbuf
strcpy

Exports

Exports

osplatform
osversion

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 588B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 156B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE

.edata
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
AccountCheck.exe
.exe windows:4 windows x86 arch:x86

8863ea9be61f4f509aa068a1f0d03c3a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord5289
ord5714
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4622
ord4424
ord3738
ord561
ord825
ord815
ord3571
ord3619
ord3626
ord3663
ord641
ord800
ord2414
ord656
ord2514
ord1200
ord2621
ord1134
ord6055
ord1776
ord5290
ord3402
ord3610
ord5265
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord5307
ord2124
ord5277
ord4627
ord4425
ord3597
ord1146
ord1168
ord567
ord540
ord324
ord2302
ord4234
ord1768
ord4299
ord6199
ord6197
ord1641
ord4287
ord4284
ord4710
ord755
ord640
ord2379
ord2405
ord5785
ord2754
ord1640
ord323
ord470
ord4224
ord2764
ord2818
ord4204
ord926
ord939
ord3874
ord2614
ord690
ord1988
ord6112
ord5207
ord389
ord5280
ord5981
ord6453
ord2575
ord4396
ord3574
ord609
ord556
ord809
ord4275
ord5875
ord2859
ord823
ord2864
ord4698
ord4079
ord2725
ord5302
ord5300
ord3346
ord2396
ord5199
ord1089
ord3922
ord5731
ord2512
ord2554
ord4486
ord6375
ord4274
ord2446
ord4673
ord1576

msvcrt

_except_handler3
_setmbcp
__CxxFrameHandler
exit
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

kernel32

GetModuleHandleA
GetStartupInfoA

user32

ClientToScreen
InvalidateRect
SetWindowRgn
GetNextDlgGroupItem
GetParent
GetDC
ReleaseDC
GetCapture
GetCursorPos
WindowFromPoint
DrawEdge
OffsetRect
DrawFocusRect
GetWindowLongA
GetSysColor
EnableWindow
PostMessageA
GetClientRect
SendMessageA
LoadBitmapA
LoadIconA
ReleaseCapture

gdi32

CreateFontA
GetObjectA
BitBlt
CreateCompatibleDC
DeleteObject
StretchBlt
CreateCompatibleBitmap
SelectObject
SelectClipRgn
CombineRgn
CreateRectRgn
GetPixel

comctl32

_TrackMouseEvent

wininet

InternetGetConnectedState

Sections

.text
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AddScheduler.exe
.exe windows:5 windows x86 arch:x86

2987c746837caa31b56b8628b299de0c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Project\VirusSafe\AddScheduler\Release\AddScheduler.pdb

Imports

kernel32

HeapAlloc
HeapFree
RtlUnwind
Sleep
ExitProcess
HeapReAlloc
RaiseException
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetCommandLineA
GetTickCount
GetOEMCP
GetCPInfo
GetFileTime
GetFileSizeEx
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
GetModuleHandleW
FileTimeToSystemTime
InterlockedIncrement
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
GlobalFlags
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
DuplicateHandle
GetFileSize
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
ReadFile
GetThreadLocale
InterlockedDecrement
GetModuleFileNameW
GetCurrentProcessId
GlobalAddAtomA
WritePrivateProfileStringA
FreeResource
GetLastError
SetLastError
GlobalFree
GlobalUnlock
FormatMessageA
LocalFree
MulDiv
lstrlenA
MultiByteToWideChar
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
FreeLibrary
GetModuleHandleA
GetProcAddress
ResumeThread
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
CloseHandle
WriteFile
CreateFileA
DeleteFileA
WaitForSingleObject
CreateProcessA
GetComputerNameA
GetModuleFileNameA
FindResourceA
LoadResource
LockResource
SizeofResource
HeapCreate
WideCharToMultiByte

user32

RegisterClipboardFormatA
PostThreadMessageA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
InvalidateRect
SetRect
IsRectEmpty
CopyAcceleratorTableA
CharNextA
GetSysColorBrush
ReleaseCapture
LoadCursorA
SetCapture
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
LoadIconA
SendMessageA
IsIconic
GetSystemMetrics
CharUpperA
UnhookWindowsHookEx
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
DestroyMenu
UnregisterClassA
GetClientRect
DrawIcon
wsprintfA
EnableWindow
PostMessageA
PostQuitMessage
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
SetWindowPos
MapDialogRect
GetParent
SetWindowContextHelpId
GetWindow
EndDialog
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
GetWindowLongA
IsWindow
DestroyWindow
CreateDialogIndirectParamA
SetActiveWindow
GetActiveWindow
GetDesktopWindow
CheckMenuItem
EnableMenuItem
ModifyMenuA
GetFocus
LoadBitmapA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
ValidateRect
GetWindowTextA

gdi32

GetStockObject
GetBkColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
ExtSelectClipRgn
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetTextColor
GetDeviceCaps
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
GetObjectA
DeleteObject
GetClipBox
SetMapMode
SetTextColor
SetBkColor
RestoreDC
SaveDC
CreateBitmap
Escape

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
GetUserNameA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

SHGetPathFromIDListA
SHGetSpecialFolderLocation

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleIsCurrentClipboard
CLSIDFromString
CLSIDFromProgID
CoTaskMemAlloc
CoTaskMemFree
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

SysFreeString
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysAllocString
SysStringLen

Sections

.text
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Lang/kr.xml
.xml
SoVSUpdateServer.dat
VSAutoUpdate.exe
.exe windows:5 windows x86 arch:x86

46d2c6ab29a045cf11ac3b1db09ef983

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate

Issuer

CN=eBiz Networks Certificate Services,O=eBiz Networks Ltd,C=KR

Not Before

02/11/2010, 00:00

Not After

02/11/2011, 23:59

Subject

CN=J2networks,OU=solution,O=J2networks,POSTALCODE=135-090,STREET=143-15 changae B/D 5F+STREET=Samseong-dong\, Gangnam-gu\, Seoul\, Korea,L=Seoul,ST=Gangnam-gu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

a1:98:88:ca:98:f3:c0:de:8d:fa:d3:a8:56:b0:3a:6d:e0:1f:56:56
Signer

Actual PE Digest

a1:98:88:ca:98:f3:c0:de:8d:fa:d3:a8:56:b0:3a:6d:e0:1f:56:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleHandleW
InterlockedIncrement
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetTickCount
RtlUnwind
GetSystemTimeAsFileTime
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetStartupInfoA
ExitProcess
HeapReAlloc
ExitThread
CreateThread
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
LCMapStringA
TlsFree
GetStringTypeA
GetStringTypeW
SetHandleCount
GetStdHandle
HeapCreate
VirtualFree
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
GetFileTime
GetFileSizeEx
GetFileAttributesA
GetFullPathNameA
GetVolumeInformationA
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetThreadLocale
MoveFileA
LocalAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedDecrement
GetModuleFileNameW
WritePrivateProfileStringA
GetCurrentProcessId
GlobalAddAtomA
CreateEventA
SuspendThread
SetEvent
FreeResource
GlobalDeleteAtom
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
LoadLibraryA
CompareStringA
InterlockedExchange
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
MulDiv
SetLastError
MultiByteToWideChar
GetSystemDirectoryA
CopyFileA
GetWindowsDirectoryA
WinExec
CreateDirectoryA
FormatMessageA
LocalFree
GetLocaleInfoA
GetFileSize
ReadFile
DeleteFileA
Sleep
SetFileAttributesA
FindFirstFileA
FindNextFileA
FindClose
CreateToolhelp32Snapshot
Process32First
lstrcmpiA
Process32Next
GetExitCodeProcess
WaitForSingleObject
OpenProcess
TerminateProcess
CreateFileA
GetModuleFileNameA
lstrcpyA
lstrlenA
WriteFile
CloseHandle
CreateProcessA
SetThreadPriority
GetCurrentThread
GetCurrentProcess
SetPriorityClass
ResumeThread
CreateMutexA
GetLastError
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
LCMapStringW
SizeofResource
CreateFileW

user32

SetForegroundWindow
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
EqualRect
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
UnhookWindowsHookEx
SetWindowContextHelpId
MapDialogRect
GetWindowTextLengthA
GetWindowTextA
SetWindowPos
SetFocus
ShowWindow
MoveWindow
SetWindowLongA
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
SendDlgItemMessageA
ReleaseCapture
GetWindowThreadProcessId
MessageBoxA
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
ReleaseDC
GetDC
CopyRect
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetWindowLongA
GetDlgItem
IsWindowEnabled
GetParent
GetNextDlgTabItem
EndDialog
PostMessageA
PostQuitMessage
GetMenuState
SetCapture
InvalidateRgn
InvalidateRect
SetRect
GetMenuItemID
GetMenuItemCount
GetSubMenu
FindWindowA
wsprintfA
GetSystemMetrics
LoadIconA
EnableWindow
KillTimer
SetTimer
GetClientRect
IsIconic
SendMessageA
DrawIcon
PostThreadMessageA
RegisterClipboardFormatA
DestroyMenu
UnregisterClassA
MessageBeep
GetLastActivePopup
GetNextDlgGroupItem
IsRectEmpty
CopyAcceleratorTableA
CharNextA
LoadCursorA
GetSysColorBrush
CharUpperA
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
SetMenu
RegisterWindowMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
GetWindow

gdi32

DeleteObject
GetViewportExtEx
GetWindowExtEx
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
SetMapMode
ExtSelectClipRgn
DeleteDC
GetStockObject
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
CreateRectRgnIndirect
ScaleWindowExtEx
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegEnumKeyA
RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
AdjustTokenPrivileges
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken
LookupPrivilegeValueA

shell32

ShellExecuteA

comctl32

InitCommonControlsEx

shlwapi

StrFormatByteSizeA
PathFindFileNameA
UrlUnescapeA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

CoRegisterMessageFilter
OleFlushClipboard
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
CoFreeUnusedLibraries
OleInitialize
CoRevokeClassObject
OleIsCurrentClipboard

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
VariantInit
SysStringLen
SysAllocStringByteLen
VariantChangeType
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
VariantClear

urlmon

URLDownloadToFileA

wininet

InternetOpenUrlA
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallback
InternetGetLastResponseInfoA
InternetQueryDataAvailable
InternetQueryOptionA
InternetCanonicalizeUrlA
InternetCrackUrlA
InternetGetConnectedState
DeleteUrlCacheEntry
InternetOpenA
InternetReadFile
InternetCloseHandle

Sections

.text
Size: 354KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VSUpdateServer.dat
VSUtill.dll
.dll windows:5 windows x86 arch:x86

2c19cb5aee7b8bac83d63421a6fc9594

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileSize
WriteFile
CreateFileA
CreateDirectoryA
GetLocalTime
ReadFile
GetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
GetProcAddress
GetModuleHandleA
HeapFree
HeapAlloc
SetFilePointer
GetLastError
GetCurrentProcess
SystemTimeToFileTime
GetCurrentDirectoryA
FileTimeToSystemTime
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetTickCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
WinExec
Process32First
Process32Next
GetModuleFileNameA
TerminateProcess
WaitForSingleObject
Sleep
OpenProcess
SetFileAttributesA
RemoveDirectoryA
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
GetTempPathA
GetWindowsDirectoryA
GetSystemDirectoryA
CreateToolhelp32Snapshot
Module32First
GetLongPathNameA
Module32Next
CloseHandle
WideCharToMultiByte
GetVersionExA
lstrcmpiA
MultiByteToWideChar
GetProcessHeap
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
GetModuleHandleW
ExitProcess
MoveFileA
GetCurrentThreadId
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
LCMapStringA
LCMapStringW
HeapCreate
HeapDestroy
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
GetStdHandle
GetStringTypeA
GetStringTypeW
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapSize
SetHandleCount
GetFileType

user32

MessageBoxA
wsprintfA
GetDesktopWindow

advapi32

RegQueryInfoKeyA
GetUserNameA
RegEnumKeyExA
RegSetKeySecurity
RegGetKeySecurity
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
CopySid
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
FreeSid
RegDeleteKeyA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegEnumKeyA
OpenProcessToken
GetTokenInformation
LookupAccountSidA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

ole32

CoCreateInstance

shell32

SHFileOperationA
SHEmptyRecycleBinA
SHGetSpecialFolderPathA

shlwapi

SHDeleteKeyA

wininet

FindNextUrlCacheEntryA
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA

Exports

Exports

AdFailedRepair
ClearAutoForm
ClearCookie
ClearHistory
ClearIECache
ClearMediaPlayLog
ClearRecent
ClearRecycleBin
ClearRunList
ClearSearchComputerAndPeople
ClearSearchFileFolder
ClearSearchInternet
ClearSearchPictureAndMusicAndVideo
ClearSiteVisitedLog
ClearTemp
ClearWinTemp
GetRestoreCount
QuarantinePow
QuarantineView
Quarantine_Close
Quarantine_Create
Quarantine_Restore
Quarantine_RestoreInit
Release
Repair

Sections

.text
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VirusSafe.exe
.exe windows:5 windows x86 arch:x86

82580ddeea82ec8ef9a78930302ff7d2

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate

Issuer

CN=eBiz Networks Certificate Services,O=eBiz Networks Ltd,C=KR

Not Before

02/11/2010, 00:00

Not After

02/11/2011, 23:59

Subject

CN=J2networks,OU=solution,O=J2networks,POSTALCODE=135-090,STREET=143-15 changae B/D 5F+STREET=Samseong-dong\, Gangnam-gu\, Seoul\, Korea,L=Seoul,ST=Gangnam-gu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6c:72:b5:b1:99:1f:82:cf:48:f1:f9:c9:19:d1:37:cc:06:d0:a8:1a
Signer

Actual PE Digest

6c:72:b5:b1:99:1f:82:cf:48:f1:f9:c9:19:d1:37:cc:06:d0:a8:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

vsutill

Quarantine_Create
QuarantinePow
Repair
AdFailedRepair
Quarantine_Close
Quarantine_RestoreInit
GetRestoreCount
Quarantine_Restore
QuarantineView
Release
ClearIECache
ClearSiteVisitedLog
ClearAutoForm
ClearHistory
ClearRecycleBin
ClearWinTemp
ClearTemp
ClearRecent
ClearMediaPlayLog
ClearRunList
ClearSearchInternet
ClearSearchPictureAndMusicAndVideo
ClearSearchComputerAndPeople
ClearSearchFileFolder
ClearCookie

kernel32

FreeResource
GetModuleFileNameW
InterlockedDecrement
lstrcmpW
GlobalFindAtomA
GlobalGetAtomNameA
GetThreadLocale
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
DuplicateHandle
GetFullPathNameA
GetFileSizeEx
GetFileTime
GetModuleHandleW
InterlockedIncrement
LocalAlloc
TlsGetValue
GlobalHandle
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
SetErrorMode
GetCurrentProcessId
RtlUnwind
SetEnvironmentVariableA
GetDriveTypeA
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
HeapReAlloc
SetStdHandle
GetFileType
HeapSize
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
InitializeCriticalSectionAndSpinCount
VirtualFree
HeapCreate
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
GlobalAddAtomA
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
CompareStringA
InterlockedExchange
lstrcmpA
FreeLibrary
FormatMessageA
LocalFree
GetVersion
CreateEventA
SetEvent
ResetEvent
ExitProcess
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
UnmapViewOfFile
WriteFile
SetFileTime
GetCurrentDirectoryA
GetFileAttributesA
LocalFileTimeToFileTime
SystemTimeToFileTime
ReadFile
SetFilePointer
MulDiv
SetLastError
LoadLibraryA
lstrlenA
lstrcatA
LeaveCriticalSection
GetTempPathA
GetLocaleInfoA
SetFileAttributesA
RemoveDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalReAlloc
GlobalFree
lstrcpyA
EnterCriticalSection
DeleteCriticalSection
GetWindowsDirectoryA
WritePrivateProfileStringA
GetLocalTime
GetCurrentProcess
MultiByteToWideChar
CreateDirectoryA
DeleteFileA
FindNextFileA
GetModuleFileNameA
GetCommandLineA
GetVolumeInformationA
FileTimeToLocalFileTime
FileTimeToSystemTime
InitializeCriticalSection
SuspendThread
ResumeThread
Sleep
GetModuleHandleA
GetProcAddress
CreateFileA
GetFileSize
FindFirstFileA
FindClose
WinExec
GetVersionExA
CreateToolhelp32Snapshot
Process32First
Process32Next
TerminateProcess
WaitForSingleObject
CloseHandle
lstrcmpiA
CreateMutexA
GetLastError
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
SizeofResource

user32

WindowFromPoint
GetSysColorBrush
CharNextA
CopyAcceleratorTableA
InvalidateRgn
GetNextDlgGroupItem
MessageBeep
UnregisterClassA
RegisterClipboardFormatA
PostThreadMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextLengthA
GetWindowTextA
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
GetScrollRange
GetScrollPos
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
GetDlgCtrlID
CallWindowProcA
GetMenu
IntersectRect
GetWindowPlacement
GetMenuItemInfoA
UnhookWindowsHookEx
GetWindow
SetWindowContextHelpId
MapDialogRect
SetWindowPos
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetLastActivePopup
IsWindowEnabled
ShowOwnedPopups
SetWindowsHookExA
UnpackDDElParam
GetMessageA
GetActiveWindow
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
EnableMenuItem
PostQuitMessage
GetMenuState
GetMenuStringA
RegisterWindowMessageA
SystemParametersInfoA
GetClassNameA
SetMenuDefaultItem
SetActiveWindow
ModifyMenuA
GetMenuItemID
GetMenuItemCount
GetDesktopWindow
LoadBitmapA
ReleaseCapture
SetCapture
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetFocus
DrawFocusRect
DrawFrameControl
PtInRect
CopyRect
GetKeyState
IsWindow
GetSysColor
RedrawWindow
UpdateWindow
OffsetRect
SetRect
SetParent
ReleaseDC
GetDC
FillRect
GetParent
ClientToScreen
CreatePopupMenu
TrackPopupMenu
wsprintfA
DestroyMenu
MessageBoxA
ExitWindowsEx
PeekMessageA
TranslateMessage
DispatchMessageA
FrameRect
InflateRect
IsRectEmpty
GetWindowLongA
SetWindowLongA
GetForegroundWindow
LoadImageA
FindWindowA
SetCursor
GetCursorPos
GetSystemMetrics
ReuseDDElParam
LoadAcceleratorsA
InsertMenuItemA
SetRectEmpty
BringWindowToTop
TranslateAcceleratorA
CharUpperA
EndPaint
BeginPaint
EnableWindow
LoadIconA
LoadCursorA
SetForegroundWindow
KillTimer
SetTimer
IsWindowVisible
GetWindowDC
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
CallNextHookEx
InvalidateRect
ScreenToClient
GetClientRect
GetWindowRect
IsIconic
PostMessageA
SendMessageA
LoadMenuA
RemoveMenu
InsertMenuA
GetSubMenu
CheckMenuItem
DrawIcon
DefWindowProcA

gdi32

MoveToEx
GetViewportExtEx
GetWindowExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
LineTo
ExcludeClipRect
Escape
ExtSelectClipRgn
CreatePatternBrush
DPtoLP
CreateRectRgnIndirect
GetMapMode
GetBkColor
GetTextColor
GetRgnBox
SetMapMode
TextOutA
RectVisible
PtVisible
ExtTextOutA
Rectangle
GetTextExtentPoint32A
GetStockObject
RoundRect
CreateFontIndirectA
CreatePen
CreateBitmap
CreateFontA
CreateDIBSection
DeleteDC
StretchBlt
CreateSolidBrush
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
GetObjectA
BitBlt
DeleteObject
SetBkMode
RestoreDC
SaveDC
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
IntersectClipRect

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
OpenPrinterA
DocumentPropertiesA

advapi32

RegEnumKeyA
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegOpenKeyA
RegCreateKeyExA
RegQueryValueA
AdjustTokenPrivileges
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegQueryValueExA

shell32

SHGetFileInfoA
SHGetPathFromIDListA
SHGetMalloc
SHGetDesktopFolder
Shell_NotifyIconA
DragFinish
DragQueryFileA
ShellExecuteA

comctl32

_TrackMouseEvent
ImageList_GetIconSize
FlatSB_EnableScrollBar
InitializeFlatSB
InitCommonControlsEx
ImageList_DrawEx

shlwapi

PathFindExtensionA
PathFindFileNameA
PathStripToRootA
PathIsUNCA

oledlg

ord8

ole32

OleInitialize
CoFreeUnusedLibraries
OleUninitialize
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CoTaskMemAlloc
CoRevokeClassObject
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CreateStreamOnHGlobal
CoInitializeEx
CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter

oleaut32

OleCreateFontIndirect
SafeArrayDestroy
VariantCopy
VariantChangeType
SysAllocStringByteLen
SysStringLen
VariantInit
SysAllocString
OleLoadPicture
VariantTimeToSystemTime
SystemTimeToVariantTime
SysFreeString
VariantClear
SysAllocStringLen

Sections

.text
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
conf.ini
skin/default.avs
.zip
1.bmp
2.bmp
3.bmp
4.bmp
5.bmp
AV-SCAN.ico
Pop_Tray_bg.bmp
Pop_Tray_bg2.bmp
Thumbs.db
about_blank.bmp
all_select.bmp
all_select2.bmp
bg.bmp
btn_account.bmp
btn_autoupdate.bmp
btn_cure.bmp
btn_exit.bmp
btn_logout.bmp
btn_menu1.bmp
btn_qurantine.bmp
btn_realtime.bmp
btn_realtime_start.bmp
btn_realtime_stop.bmp
btn_scan.bmp
btn_scanlog.bmp
btn_service.bmp
btn_skin.bmp
btn_updateinfo.bmp
btn_x.bmp
close.bmp
common_close.bmp
common_dlg_backpattern.bmp
common_exit.bmp
del.bmp
engine_ver.bmp
help.bmp
home.bmp
last_scan_date.bmp
license_date.bmp
list_control/ColumnHeaderEnd.bmp
list_control/ColumnHeaderSpan.bmp
list_control/ColumnHeaderStart.bmp
list_control/HorizontalScrollBarLeftArrow.bmp
list_control/HorizontalScrollBarRightArrow.bmp
list_control/HorizontalScrollBarSpan.bmp
list_control/HorizontalScrollBarThumb.bmp
list_control/Thumbs.db
list_control/VerticleScrollBarDownArrow.bmp
list_control/VerticleScrollBarSpan.bmp
list_control/VerticleScrollBarThumb.bmp
list_control/VerticleScrollBarUpArrow.bmp
list_control/VerticleScrollbarBottom.bmp
list_control/VerticleScrollbarTop.bmp
list_control/height_blank.bmp
list_control/left_pattern.bmp
list_control/pattern.bmp
list_control/right_pattern.bmp
loading.bmp
logo.bmp
main_btn_scan.bmp
main_btn_startpage.bmp
main_chk_general_scan2.bmp
main_chk_vs_scan2.bmp
mark.bmp
maxmize.bmp
minmize.bmp
msg_no.bmp
msg_yes.bmp
normal.bmp
pop_end_bg.bmp
pop_end_cancel.bmp
pop_end_yes.bmp
pop_result1_bg.bmp
pop_result1_cancel.bmp
pop_result1_title.gif
.gif
pop_result2_bg.bmp
pop_result2_title.gif
.gif
pop_resutl1_ok.bmp
qurantine_title.bmp
realtime_start.bmp
realtime_stop.bmp
realtime_title.bmp
release_all.bmp
release_all2.bmp
report.bmp
restore.bmp
scaing_repair.bmp
scaing_repair_can.bmp
scan_db_update_info.bmp
scan_engine_update_info.bmp
scan_info.bmp
scan_list_bg.bmp
scan_start.bmp
scan_start2.bmp
scan_title.bmp
scan_update_info.bmp
scaning_cancel.bmp
scaning_counting.bmp
scaning_objects_count.bmp
scaning_pattern_count.bmp
scaning_progresbar.bmp
scaning_scan.bmp
scaning_target.bmp
scanlog_title.bmp
service_internet_temp_title.bmp
service_title.bmp
service_win_searchlist_title.bmp
service_win_temp_title.bmp
setup.bmp
skin.xml
.xml
top_title.bmp
tray_btn_close.bmp
tray_btn_cure.bmp
tray_btn_x.bmp
tray_copy.gif
.gif
updateinfo_title.bmp
view.bmp
uninst.exe.nsis
vsReg.exe
.exe windows:5 windows x86 arch:x86

9fc7c2159689ae9f036e1d8f2b14906a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate

Issuer

CN=eBiz Networks Certificate Services,O=eBiz Networks Ltd,C=KR

Not Before

02/11/2010, 00:00

Not After

02/11/2011, 23:59

Subject

CN=J2networks,OU=solution,O=J2networks,POSTALCODE=135-090,STREET=143-15 changae B/D 5F+STREET=Samseong-dong\, Gangnam-gu\, Seoul\, Korea,L=Seoul,ST=Gangnam-gu,C=KR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:5a:29:2b:7b:38:2b:31:fe:08:6d:64:c9:f0:57:79:2e:9b:6a:87
Signer

Actual PE Digest

7b:5a:29:2b:7b:38:2b:31:fe:08:6d:64:c9:f0:57:79:2e:9b:6a:87

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
Sleep
HeapReAlloc
HeapSize
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapAlloc
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetStringTypeA
GetStringTypeW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
GetStartupInfoA
GetCommandLineA
RaiseException
RtlUnwind
GetTickCount
GetFileSizeEx
FileTimeToLocalFileTime
SetErrorMode
GetFileTime
GetFileAttributesA
GetOEMCP
GetCPInfo
FileTimeToSystemTime
GetFullPathNameA
GetVolumeInformationA
FindFirstFileA
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
GetThreadLocale
GlobalFlags
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
InterlockedIncrement
GetModuleHandleW
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
GetVersionExA
InterlockedDecrement
GetModuleFileNameW
FreeResource
GetCurrentProcessId
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryA
CompareStringA
InterlockedExchange
lstrcmpA
FreeLibrary
GetModuleHandleA
GetProcAddress
SetLastError
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
MultiByteToWideChar
MulDiv
lstrlenA
WritePrivateProfileStringA
GetFileSize
ReadFile
CreateFileA
WriteFile
CloseHandle
GetModuleFileNameA
CreateMutexA
GetLastError
ExitProcess
WideCharToMultiByte
FindResourceA
LoadResource
LockResource
HeapCreate
SizeofResource

user32

RegisterClipboardFormatA
PostThreadMessageA
GetWindowTextA
GetForegroundWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
UpdateWindow
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
AdjustWindowRectEx
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
PtInRect
GetMenu
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ReleaseDC
GetDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
UnhookWindowsHookEx
SetWindowContextHelpId
SetWindowPos
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
MessageBoxA
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostMessageA
PostQuitMessage
GetMenuState
GetMenuItemID
GetMenuItemCount
FillRect
GetSubMenu
SetForegroundWindow
GetParent
SetWindowRgn
FindWindowA
EnableWindow
GetSystemMetrics
LoadIconA
KillTimer
SetTimer
GetClientRect
GetWindowRect
IsIconic
SendMessageA
DrawIcon
GetMenuItemInfoA
InflateRect
UnregisterClassA
MessageBeep
GetNextDlgGroupItem
InvalidateRgn
SetRect
CopyAcceleratorTableA
CharNextA
MapDialogRect
CharUpperA
GetSysColorBrush
LoadCursorA
SetCapture
IsRectEmpty
UnpackDDElParam
ReuseDDElParam
LoadMenuA
DestroyMenu
ReleaseCapture
LoadAcceleratorsA
InvalidateRect
InsertMenuItemA
CreatePopupMenu
SetRectEmpty
BringWindowToTop
TranslateAcceleratorA
ShowWindow
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
GetWindowTextLengthA
GetPropA
RemovePropA
GetWindow
SetFocus
SetPropA

gdi32

DeleteObject
GetObjectA
GetViewportExtEx
GetWindowExtEx
BitBlt
GetPixel
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
SelectObject
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
DeleteDC
CreatePatternBrush
CreateCompatibleDC
GetStockObject
CreateCompatibleBitmap
CreateEllipticRgn
LPtoDP
Ellipse
GetTextExtentPoint32A
CreateFontIndirectA
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
GetMapMode
SetMapMode
GetClipBox
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateBitmap
CreateSolidBrush
CreateRoundRectRgn
GetDeviceCaps

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegCreateKeyExA
RegQueryValueA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyA
RegSetValueExA
RegOpenKeyA
RegQueryValueExA
RegCloseKey

shell32

DragFinish
DragQueryFileA
ShellExecuteA

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA

oledlg

ord8

ole32

CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString
CLSIDFromProgID
OleInitialize
CoTaskMemFree
CoUninitialize
OleUninitialize
CoFreeUnusedLibraries
CoRevokeClassObject
OleIsCurrentClipboard
OleFlushClipboard
CoRegisterMessageFilter
CoTaskMemAlloc

oleaut32

SysAllocStringByteLen
SysStringLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantInit
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
OleCreateFontIndirect
SysFreeString

wininet

InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetGetConnectedState
InternetOpenA

netapi32

Netbios

Sections

.text
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7fa974366048f9c551ef45714595665e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fcCertificate

Extended Key Usages

Key Usages

09:d8:51:6f:b5:52:55:77:78:1d:d5:72:65:f7:ba:20:47:fb:74:f9Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 23KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 151KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 17KB - Virtual size: 16KB

e2c6f316b5682e27932edc971f2cf5f4

Headers

File Characteristics

Imports

wininet

mfc42

msvcrt

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 6KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 1KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate

09:d8:51:6f:b5:52:55:77:78:1d:d5:72:65:f7:ba:20:47:fb:74:f9
Signer

.text
Size: 23KB - Virtual size: 23KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 151KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 8KB - Virtual size: 6KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 16B

.data
Size: 80B - Virtual size: 80B

.idata
Size: 588B - Virtual size: 588B

.reloc
Size: 156B - Virtual size: 156B

.edata
Size: 96B - Virtual size: 96B

.text
Size: 16KB - Virtual size: 13KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 928B

.rsrc
Size: 268KB - Virtual size: 267KB

.text
Size: 202KB - Virtual size: 202KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 10KB - Virtual size: 25KB

.rsrc
Size: 82KB - Virtual size: 81KB

.reloc
Size: 33KB - Virtual size: 32KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1e:41:fe:86:b2:1a:05:46:85:c3:99:66:a2:76:09:fc
Certificate