4d6d2db68a687e5ee633847c96cb2fa2_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4d6d2db68a687e5ee633847c96cb2fa2_JaffaCakes118
Size

1.9MB
MD5

4d6d2db68a687e5ee633847c96cb2fa2
SHA1

67a854f0cff2bc48e5f911557a0498720268f5b8
SHA256

8b5f91719139554efc5c6697a0167b01fa36243b991fda5a4b74df7f323f3758
SHA512

35314896b1db17c75ff92653ad44b7d1d0d668b56ceb65bc5374c2fd85c32f00e99179be5ba76f906418a3ef7305a7de4131edd575d5ebe856a1d24d4459f626
SSDEEP

24576:LT1jt9z+JDuJAHNwHxnot9XD8F3I3c5lW2eW3zrj9mlTn2nS9SRdea/17JtgvFR:X/9qJcAOim+MO2eWDNmFjglJSvFR

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/md5dll.dll	upx

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/ZipDLL.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/$PLUGINSDIR/md5dll.dll
unpack004/out.upx
unpack001/$PLUGINSDIR/nsislog.dll
unpack001/$PLUGINSDIR/nsisos.dll
unpack001/$PLUGINSDIR/text.txt
unpack001/$_81_

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_2

Files

4d6d2db68a687e5ee633847c96cb2fa2_JaffaCakes118
.exe windows:4 windows x86 arch:x86

28a099a911237a28521d8b7ea250f089

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:09:1d:d2:fe:79:03:46:bc:d3:ee:3e:7c:ba:84:a8:e6:2f:1e:1a
Signer

Actual PE Digest

72:09:1d:d2:fe:79:03:46:bc:d3:ee:3e:7c:ba:84:a8:e6:2f:1e:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$LOCALAPPDATA/Vid-Saver/Chrome/Vid-Saver.crx
.zip
background.html
.html
crossriderManifest.json
icons/actions/1.png
.png
icons/icon128.png
.png
icons/icon16.png
.png
icons/icon48.png
.png
js/api/chrome.js
.js
js/api/cookie.js
.js
js/api/message.js
.js
js/background.js
.js
js/lib/app_api.js
.js
js/lib/async_api.js
.js
js/lib/bg_app_api.js
.js
js/lib/cookie_store.js
.js
js/lib/data_store.js
.js
js/lib/delegate.js
.js
js/lib/events.js
.js
js/lib/onBGDocumentLoad.js
.js
js/lib/reports.js
.js
js/lib/util.js
.js
manifest.json
$PLUGINSDIR/CleanChromePrefs.vbs
.vbs
$PLUGINSDIR/Dialer.dll
.dll windows:4 windows x86 arch:x86

6504337db30ea93d33d7a714fefff047

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetProcAddress
LoadLibraryA
FreeLibrary
lstrcpynA
GlobalAlloc

Exports

Exports

AttemptConnect
AutodialHangup
AutodialOnline
AutodialUnattended
GetConnectedState

Sections

.text
Size: 1024B - Virtual size: 570B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 375B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 156B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 166B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ExecDos.dll
.dll windows:5 windows x86 arch:x86

b997a221e444f5e6463b28778735cf2b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
Sleep
lstrcatA
lstrcmpiA
TerminateProcess
ReadFile
GetExitCodeProcess
PeekNamedPipe
CreateFileA
FlushFileBuffers
WriteFile
lstrlenA
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
GetProcAddress
GetModuleHandleA
GlobalAlloc
GetExitCodeThread
WaitForSingleObject
CreateThread
lstrcpyA
lstrcpynA

user32

wsprintfA
GetClassNameA
GetDlgItem
FindWindowExA
SendMessageA

Exports

Exports

exec
isdone
wait

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Processes.dll
.dll windows:4 windows x86 arch:x86

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
WriteFile
SetFilePointer
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo

user32

FindWindowA
GetDesktopWindow
wsprintfA
UpdateWindow

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/RemoveFromList.vbs
.vbs
$PLUGINSDIR/StdUtils.dll
.dll windows:5 windows x86 arch:x86

6aa1fb50f909cdf4bea3d3523348e900

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

srand
sscanf
_snprintf
rand
time
memset
??2@YAPAXI@Z
strncpy
_stricmp
strchr
??3@YAXPAX@Z

shlwapi

ord176

kernel32

GlobalFree
MultiByteToWideChar
GetVersionExA
CreateThread
WaitForSingleObject
CloseHandle
TerminateThread
GetCommandLineA
GlobalAlloc
lstrcpynA

user32

wsprintfA
MessageBoxA
MessageBoxW

shell32

ShellExecuteExA
ShellExecuteA
SHFileOperationA

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

VariantClear
VariantInit
SysAllocString

Exports

Exports

DisableVerboseMode
Dummy
EnableVerboseMode
ExecShellAsUser
ExecShellWait
FormatStr
FormatStr2
FormatStr3
GetAllParameters
GetParameter
Rand
RandList
RandMax
RandMinMax
RevStr
SHFileCopy
SHFileMove
ScanStr
ScanStr2
ScanStr3
Time
TrimStr
TrimStrLeft
TrimStrRight
WaitForProc

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Vid-Saver.xpi
.zip
chrome.manifest
chrome/content/background.html
.html .js polyglot
chrome/content/browser.xul
.xml
chrome/content/crossrider.js
.js
chrome/content/crossriderapi.js
.js
chrome/content/dialog.js
.js
chrome/content/lib/reports.js
.js
chrome/content/options.js
.js
chrome/content/options.xul
.xml
chrome/content/search_dialog.xul
.xml
chrome/content/update.html
.html .js polyglot
defaults/preferences/prefs.js
install.rdf
.xml
locale/en-US/translations.dtd
skin/button1.png
.png
skin/button2.png
.png
skin/button3.png
.png
skin/button4.png
.png
skin/button5.png
.png
skin/crossrider_statusbar.png
.png
skin/icon128.png
.png
skin/icon16.png
.png
skin/icon24.png
.png
skin/icon48.png
.png
skin/panelarrow-up.png
.png
skin/popup.css
skin/popup.html
.html
skin/popup_binding.xml
.xml
skin/skin.css
skin/update.css
$PLUGINSDIR/ZipDLL.dll
.dll windows:4 windows x86 arch:x86

f10b94e3705eae25c7617ba56a648b77

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
GetLocaleInfoW
LoadLibraryA
IsBadCodePtr
LocalFree
FormatMessageA
GetLastError
MapViewOfFile
CreateFileMappingA
CloseHandle
UnmapViewOfFile
GetDiskFreeSpaceA
CreateFileA
GetCurrentDirectoryA
SetFileAttributesA
GetFileAttributesA
GetDriveTypeA
SetVolumeLabelA
DeleteFileA
MoveFileA
CreateDirectoryA
EnterCriticalSection
Sleep
InitializeCriticalSection
InterlockedExchange
DeleteCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
RtlUnwind
GetCommandLineA
GetVersion
HeapFree
HeapReAlloc
HeapAlloc
RaiseException
GetTimeZoneInformation
GetSystemTime
GetLocalTime
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetEnvironmentVariableA
SetCurrentDirectoryA
GetFileType
FlushFileBuffers
SetStdHandle
ExitProcess
LCMapStringA
LCMapStringW
GetCPInfo
CompareStringA
CompareStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
TerminateProcess
GetCurrentProcess
HeapSize
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetModuleHandleA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
SetUnhandledExceptionFilter
SetEndOfFile
ReadFile
SetFilePointer
GetACP
GetOEMCP
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
GetProcAddress
GetStringTypeA
GetStringTypeW
IsBadReadPtr

user32

SendMessageA
GetDlgItem
SetWindowTextA
FindWindowExA
OemToCharBuffA
CharToOemBuffA

Exports

Exports

extractall
extractfile

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bringtofront.exe
.exe windows:5 windows x86 arch:x86

275d854cb701f5772522e8c50b111119

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa
Signer

Actual PE Digest

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetGetCookieA
InternetSetCookieA
InternetSetOptionA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle

kernel32

CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
Sleep
SetEvent
CreateEventA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalFlags
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetExitCodeProcess
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
WaitForSingleObject
OpenProcess
Process32Next
CreateToolhelp32Snapshot
WideCharToMultiByte
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
LoadLibraryW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapSize
GetStringTypeW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
CloseHandle
OutputDebugStringA
DebugBreak
InterlockedIncrement
VirtualAllocEx
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InterlockedExchange
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LCMapStringA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualProtect
HeapAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
EncodePointer
DecodePointer
HeapFree
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
TerminateProcess

user32

CharLowerA
MessageBoxA
PostMessageA
CharNextA
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
UnregisterClassA
GetDesktopWindow
GetWindowThreadProcessId
DestroyIcon
InvalidateRect
SendMessageA
GetWindowRect
ReleaseDC
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
EnumWindows
GetForegroundWindow
SetFocus
BringWindowToTop
SetForegroundWindow
AttachThreadInput
IsWindowVisible
GetDC
wvsprintfA
DestroyWindow

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32A
DeleteObject
GetObjectA

advapi32

RegQueryValueExA
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantInit
SysFreeString

shlwapi

ord176

comctl32

ImageList_GetImageCount
ImageList_Remove
ImageList_ReplaceIcon

gdiplus

GdipDrawPath
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGraphicsClear
GdipDeleteGraphics
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdipFillPath
GdipCreateFontFromLogfontA
GdipCloneBitmapAreaI
GdipCloneBrush
GdipDrawString
GdipMeasureString
GdipCloneImage
GdipDeleteFont
GdipDrawImageRectI
GdiplusShutdown
GdipGetImagePixelFormat
GdiplusStartup

Sections

.text
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/checkmachine.exe
.exe windows:5 windows x86 arch:x86

275d854cb701f5772522e8c50b111119

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa
Signer

Actual PE Digest

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetGetCookieA
InternetSetCookieA
InternetSetOptionA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle

kernel32

CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
Sleep
SetEvent
CreateEventA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalFlags
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetExitCodeProcess
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
WaitForSingleObject
OpenProcess
Process32Next
CreateToolhelp32Snapshot
WideCharToMultiByte
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
LoadLibraryW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapSize
GetStringTypeW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
CloseHandle
OutputDebugStringA
DebugBreak
InterlockedIncrement
VirtualAllocEx
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InterlockedExchange
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LCMapStringA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualProtect
HeapAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
EncodePointer
DecodePointer
HeapFree
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
TerminateProcess

user32

CharLowerA
MessageBoxA
PostMessageA
CharNextA
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
UnregisterClassA
GetDesktopWindow
GetWindowThreadProcessId
DestroyIcon
InvalidateRect
SendMessageA
GetWindowRect
ReleaseDC
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
EnumWindows
GetForegroundWindow
SetFocus
BringWindowToTop
SetForegroundWindow
AttachThreadInput
IsWindowVisible
GetDC
wvsprintfA
DestroyWindow

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32A
DeleteObject
GetObjectA

advapi32

RegQueryValueExA
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantInit
SysFreeString

shlwapi

ord176

comctl32

ImageList_GetImageCount
ImageList_Remove
ImageList_ReplaceIcon

gdiplus

GdipDrawPath
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGraphicsClear
GdipDeleteGraphics
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdipFillPath
GdipCreateFontFromLogfontA
GdipCloneBitmapAreaI
GdipCloneBrush
GdipDrawString
GdipMeasureString
GdipCloneImage
GdipDeleteFont
GdipDrawImageRectI
GdiplusShutdown
GdipGetImagePixelFormat
GdiplusStartup

Sections

.text
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/md5dll.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

GetFileMD5
GetMD5
GetMD5File
GetMD5Random
GetMD5String

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsislog.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

Log

Sections

CODE
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 66B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisos.dll
.dll windows:1 windows x86 arch:x86

a70233c77fd258ec47709388c2338273

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExitProcess
GetEnvironmentStringsA
GetVersionExA
RtlUnwind
RtlZeroMemory
lstrcpyA

crtdll

_fdopen
_open_osfhandle
_ultoa
fclose
_cexit
malloc
printf
raise
setbuf
strcpy

Exports

Exports

osplatform
osversion

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 16B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 80B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 588B - Virtual size: 588B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 156B - Virtual size: 156B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE

.edata
Size: 96B - Virtual size: 96B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/text.txt
.exe windows:4 windows x86 arch:x86

0047888f327cf14ecbaf4755bc6d52a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\source\notepad++\trunk\PowerEditor\bin\npp.pdb

Imports

comctl32

InitCommonControlsEx
ImageList_SetIconSize
ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
ImageList_ReplaceIcon
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_Draw

shlwapi

PathStripPathW
PathIsRelativeW
PathAddExtensionW
PathFindExtensionW
PathRemoveExtensionW
PathMatchSpecW
PathIsDirectoryW
PathCompactPathExW
PathFindFileNameW
PathAppendW
PathFileExistsW
PathRemoveFileSpecW

shell32

SHGetMalloc
Shell_NotifyIconW
SHGetSpecialFolderLocation
ShellExecuteW
DragQueryPoint
SHGetPathFromIDListW
SHBrowseForFolderW
DragFinish
DragQueryFileW

kernel32

GlobalAlloc
CreateDirectoryW
GlobalSize
FindClose
FindNextFileW
FindFirstFileW
TerminateThread
CreateThread
CopyFileW
lstrcpynW
GetSystemInfo
GetModuleHandleW
GetVersionExW
ExpandEnvironmentStringsW
GetTimeFormatW
GetDateFormatW
GetLocalTime
MulDiv
WaitForMultipleObjects
WaitForSingleObject
OpenEventW
SetEvent
GetExitCodeProcess
ReadFile
PeekNamedPipe
Sleep
ResumeThread
CreateEventW
CreateProcessW
CreatePipe
GetACP
SizeofResource
LockResource
LoadResource
FindResourceW
LocalLock
LocalAlloc
GetTempPathW
CreateMutexW
SetLastError
GetCommandLineW
HeapReAlloc
VirtualAlloc
VirtualFree
GlobalLock
HeapDestroy
SetFilePointer
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
ExitProcess
HeapSize
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
GetStdHandle
WriteFile
GetCurrentDirectoryA
IsValidCodePage
GetOEMCP
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
GetStartupInfoA
GetProcessHeap
HeapAlloc
GetVersionExA
GetCommandLineA
HeapFree
GetSystemTimeAsFileTime
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RaiseException
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedExchange
InterlockedCompareExchange
InterlockedDecrement
InterlockedIncrement
GlobalUnlock
LocalUnlock
LoadLibraryW
GetProcAddress
CreateFileW
GetCurrentProcessId
GetCurrentProcess
CloseHandle
GlobalFree
FreeLibrary
SetCurrentDirectoryW
GetCurrentThreadId
GetCurrentDirectoryW
WideCharToMultiByte
MultiByteToWideChar
GetLastError
FormatMessageW
LocalFree
GetFileAttributesW
SetFileAttributesW
MoveFileW
GetFullPathNameW
GetLongPathNameW
lstrcmpiW
DeleteFileW
lstrcpyW
lstrlenW
GetModuleFileNameW
lstrcatW
lstrcmpW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetLocaleInfoA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA
SetStdHandle
LoadLibraryA
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
HeapCreate

user32

FindWindowW
ReleaseCapture
RegisterClassExW
CreateDialogIndirectParamW
GetCapture
DragDetect
AppendMenuW
RegisterWindowMessageW
IsWindow
DestroyCursor
CreateCursor
ScrollWindow
SetScrollInfo
SetMenuItemInfoW
InsertMenuItemW
LoadStringW
TranslateAcceleratorW
GetMessageA
GetMessageW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetMenuItemCount
IsClipboardFormatAvailable
GetClipboardData
GetMenuStringW
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
MonitorFromWindow
GetMonitorInfoW
SetForegroundWindow
SetWindowPlacement
GetMenuState
EnableMenuItem
CheckMenuRadioItem
DestroyAcceleratorTable
GetSubMenu
GetMenuItemID
ModifyMenuW
EndDialog
DialogBoxIndirectParamW
DialogBoxParamW
RemoveMenu
LoadIconW
DestroyIcon
mouse_event
WindowFromPoint
PtInRect
SetDlgItemInt
MapWindowPoints
GetKeyState
CreatePopupMenu
InsertMenuW
DestroyMenu
TrackPopupMenu
GetWindowTextW
MessageBoxA
SetCapture
GetActiveWindow
IsChild
GetDlgCtrlID
RedrawWindow
GetCursorPos
CreateAcceleratorTableW
IsWindowUnicode
SetWindowLongA
CallWindowProcA
CharUpperW
SetWindowsHookExW
UnhookWindowsHookEx
SetParent
SetWindowTextW
LoadBitmapW
CallNextHookEx
ScreenToClient
GetDlgItemTextW
SetDlgItemTextW
MessageBoxW
GetDlgItemInt
CharLowerW
DrawIcon
TranslateMessage
CreateDialogParamW
DrawFocusRect
FillRect
FrameRect
SendDlgItemMessageW
SetWindowLongW
GetWindowLongW
GetSysColor
InflateRect
ClientToScreen
CallWindowProcW
IsWindowVisible
GetWindowRect
ShowWindow
SetWindowPos
RegisterClassW
BeginPaint
EndPaint
GetFocus
PostMessageW
LoadCursorW
SetCursor
DestroyWindow
CreateCaret
DestroyCaret
GetSystemMetrics
GetWindowPlacement
MoveWindow
CreateWindowExW
SetFocus
GetScrollPos
GetScrollRange
UpdateWindow
DefWindowProcW
DrawFrameControl
GetMenu
ShowCaret
MessageBeep
DrawTextW
SetCaretPos
HideCaret
GetParent
ShowScrollBar
SetScrollRange
InvalidateRect
SetScrollPos
GetKeyboardState
ToAscii
wsprintfW
GetDC
DrawEdge
DrawTextExW
ReleaseDC
GetClientRect
LoadImageW
DrawIconEx
GetDlgItem
SendMessageW
EnableWindow
DispatchMessageW
CreateMenu
GetClassNameW
PostQuitMessage
LoadMenuW
SystemParametersInfoW
SetMenu
IsDialogMessageW
IsDialogMessageA
PeekMessageW
IsZoomed
DeleteMenu
RealChildWindowFromPoint
IsIconic
DrawMenuBar
CheckMenuItem

gdi32

GetTextMetricsW
CreateHatchBrush
LineTo
MoveToEx
RestoreDC
SaveDC
DeleteDC
BitBlt
CreateCompatibleBitmap
GetObjectW
CreateFontW
SetBkColor
SetWindowOrgEx
OffsetWindowOrgEx
PatBlt
SetBrushOrgEx
CreatePatternBrush
CreateBitmap
EnumFontFamiliesExW
EndDoc
EndPage
ExtTextOutW
SetTextAlign
StartPage
StartDocW
DPtoLP
GetDeviceCaps
GetTextExtentPointW
CreateFontIndirectW
GetPixel
SetTextColor
CreateSolidBrush
GetTextExtentPoint32W
GetROP2
SetROP2
GetStockObject
CreatePen
Rectangle
DeleteObject
SetBkMode
CreateCompatibleDC
SelectObject

comdlg32

ChooseColorW
GetOpenFileNameW
PrintDlgW
GetSaveFileNameW

advapi32

RegCloseKey
RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
IsTextUnicode
RegQueryInfoKeyW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 792KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 324KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$_80_
$_81_
.exe windows:4 windows x86 arch:x86

a4f7472959bb80652b46ef53fc672202

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
ExitProcess
FlushFileBuffers
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
Sleep
TlsGetValue
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__getmainargs
__mb_cur_max
__p__environ
__p__fmode
__set_app_type
_access
_assert
_cexit
_flsbuf
_iob
_isatty
_isctype
_onexit
_pctype
_setmode
_winmajor
abort
atexit
atoi
calloc
exit
fclose
fflush
fgets
fopen
fprintf
fputc
fputs
free
fwrite
getenv
localtime
malloc
memcmp
memmove
memset
printf
putchar
puts
qsort
realloc
signal
strcmp
strncmp
strncpy
strtol
tolower
vfprintf

Sections

.text
Size: 387KB - Virtual size: 387KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$_83_/$_84_
ButtonUtil.dll
.dll windows:5 windows x86 arch:x86

30c72e9b672c7802ac4d896661aea380

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

14:3f:e9:d2:29:83:8e:be:69:e0:e8:32:74:39:58:d0:33:3e:69:8f
Signer

Actual PE Digest

14:3f:e9:d2:29:83:8e:be:69:e0:e8:32:74:39:58:d0:33:3e:69:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Shai\Crossrider\cr-ie-plugin\output\ButtonUtil.pdb

Imports

wininet

HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetCrackUrlA
InternetSetOptionA
InternetOpenA

kernel32

GetVersion
GetLastError
GetModuleFileNameA
ExpandEnvironmentStringsA
CreateFileA
ReadFile
SetLastError
LocalFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GlobalFlags
MultiByteToWideChar
EnterCriticalSection
LeaveCriticalSection
SetEvent
lstrcpyA
CreateEventA
CreateFileMappingA
OpenFileMappingA
MapViewOfFile
UnmapViewOfFile
GetCurrentProcess
LocalAlloc
WriteFile
SetFilePointer
FindResourceA
FreeLibrary
LoadResource
SizeofResource
IsDBCSLeadByte
lstrlenW
RaiseException
lstrcmpiA
LoadLibraryExA
GetCommandLineA
CreateThread
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
Sleep
HeapSize
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
GetConsoleCP
ReleaseMutex
WaitForSingleObject
VirtualQuery
CloseHandle
OpenMutexA
CreateMutexA
WideCharToMultiByte
GetModuleHandleA
GetProcAddress
GetCurrentThreadId
GetCurrentProcessId
OutputDebugStringA
DebugBreak
InterlockedIncrement
InterlockedDecrement
lstrlenA
EncodePointer
DecodePointer
GetLocalTime
GetSystemTimeAsFileTime
HeapFree
GetConsoleMode
FlushFileBuffers
CreateFileW
GetProcessHeap
SetEndOfFile
SetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
LoadLibraryW
LCMapStringW
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
RtlUnwind
WriteConsoleW

user32

UnhookWindowsHookEx
SetWindowsHookExA
SetWindowPos
GetWindowRect
ReleaseDC
GetDC
DestroyIcon
PostMessageA
GetParent
CallNextHookEx
GetWindowThreadProcessId
GetDesktopWindow
SendMessageA
GetWindowTextA
FindWindowExA
CharNextA
wvsprintfA
LoadStringA
InvalidateRect
DestroyWindow

gdi32

GetTextExtentPoint32A
SelectObject
DeleteObject
GetObjectA
CreateFontA

advapi32

RegSetValueExA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA
RegQueryValueExA
OpenProcessToken
GetTokenInformation
RegDeleteValueA
RegQueryInfoKeyW
RegCloseKey
RegCreateKeyExA
GetSidSubAuthority
GetSidSubAuthorityCount

shell32

SHGetFolderPathA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

VariantClear
VarUI4FromStr

comctl32

ImageList_GetImageCount
ImageList_ReplaceIcon
ImageList_Remove

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCloneBitmapAreaI
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipDrawImageRectI
GdipMeasureString
GdipDrawString
GdipFillPath
GdipGraphicsClear
GdipDrawPath
GdipSetInterpolationMode
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipDeletePath
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDisposeImage
GdipCreateSolidFill
GdipCloneBrush
GdipDeleteBrush
GdipAlloc
GdipFree

Sections

.text
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninstall.exe.nsis
Vid-Saver-bg.exe
.exe windows:5 windows x86 arch:x86

275d854cb701f5772522e8c50b111119

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa
Signer

Actual PE Digest

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetGetCookieA
InternetSetCookieA
InternetSetOptionA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle

kernel32

CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
Sleep
SetEvent
CreateEventA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalFlags
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetExitCodeProcess
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
WaitForSingleObject
OpenProcess
Process32Next
CreateToolhelp32Snapshot
WideCharToMultiByte
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
LoadLibraryW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapSize
GetStringTypeW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
CloseHandle
OutputDebugStringA
DebugBreak
InterlockedIncrement
VirtualAllocEx
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InterlockedExchange
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LCMapStringA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualProtect
HeapAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
EncodePointer
DecodePointer
HeapFree
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
TerminateProcess

user32

CharLowerA
MessageBoxA
PostMessageA
CharNextA
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
UnregisterClassA
GetDesktopWindow
GetWindowThreadProcessId
DestroyIcon
InvalidateRect
SendMessageA
GetWindowRect
ReleaseDC
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
EnumWindows
GetForegroundWindow
SetFocus
BringWindowToTop
SetForegroundWindow
AttachThreadInput
IsWindowVisible
GetDC
wvsprintfA
DestroyWindow

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32A
DeleteObject
GetObjectA

advapi32

RegQueryValueExA
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantInit
SysFreeString

shlwapi

ord176

comctl32

ImageList_GetImageCount
ImageList_Remove
ImageList_ReplaceIcon

gdiplus

GdipDrawPath
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGraphicsClear
GdipDeleteGraphics
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdipFillPath
GdipCreateFontFromLogfontA
GdipCloneBitmapAreaI
GdipCloneBrush
GdipDrawString
GdipMeasureString
GdipCloneImage
GdipDeleteFont
GdipDrawImageRectI
GdiplusShutdown
GdipGetImagePixelFormat
GdiplusStartup

Sections

.text
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Vid-Saver.dll
.dll regsvr32 windows:5 windows x86 arch:x86

2cc191315f529f836af28b2e96d3105f

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:6a:29:45:68:bb:b8:40:9f:90:0c:75:75:c6:cb:01:a5:08:aa:41
Signer

Actual PE Digest

7c:6a:29:45:68:bb:b8:40:9f:90:0c:75:75:c6:cb:01:a5:08:aa:41

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleacc

AccessibleObjectFromWindow

urlmon

URLDownloadToCacheFileA
CoInternetGetSession

wininet

InternetSetOptionA
InternetReadFile
HttpQueryInfoA
InternetGetCookieA
InternetSetCookieA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetCrackUrlA
InternetOpenA

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

kernel32

FreeLibrary
LoadLibraryA
CloseHandle
GetLastError
GetCurrentProcess
OpenProcess
Sleep
TerminateProcess
WaitForSingleObject
CreateThread
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
SetLastError
WideCharToMultiByte
LocalFree
FormatMessageA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MultiByteToWideChar
UnmapViewOfFile
SetEvent
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
CreateEventA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrlenW
ReleaseMutex
lstrcmpiA
DisableThreadLibraryCalls
GetModuleFileNameA
GetModuleHandleW
IsDBCSLeadByte
SizeofResource
LoadResource
GetCurrentProcessId
LoadLibraryExA
OpenMutexA
lstrlenA
GetVersion
ExpandEnvironmentStringsA
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapDestroy
HeapCreate
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
ExitProcess
HeapSize
GetStringTypeW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LCMapStringW
GetCommandLineA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapReAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
DecodePointer
EncodePointer
InterlockedExchange
GetCurrentThreadId
OutputDebugStringA
DebugBreak
InterlockedIncrement
FindResourceA
InterlockedDecrement
GetModuleHandleA
GetProcAddress
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
CompareStringW
SetEnvironmentVariableA
GetStringTypeExA
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
LCMapStringA
CreateMutexA

user32

LoadStringA
CharNextA
PostMessageA
GetWindowThreadProcessId
EnumWindows
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
DestroyWindow
GetDesktopWindow
DestroyIcon
SendMessageA
GetWindowRect
wvsprintfA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
SetTimer
KillTimer
CharNextW
MessageBoxA
CharLowerA
GetWindowTextA
IsWindowVisible
UnregisterClassA

advapi32

GetSidSubAuthorityCount
RegCreateKeyExA
RegDeleteValueA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegQueryInfoKeyA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteKeyA
GetTokenInformation
RegOpenKeyExA
GetSidSubAuthority
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumValueA

shell32

ShellExecuteA
SHGetFolderPathA
ShellExecuteExA

ole32

CoGetClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoCreateGuid
CLSIDFromProgID

oleaut32

SysAllocString
SysFreeString
SysStringLen
VariantInit
VariantClear
DispCallFunc
LoadTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysAllocStringLen
VariantChangeType
VariantCopy
UnRegisterTypeLi

gdiplus

GdiplusShutdown

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 417KB - Virtual size: 416KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Vid-Saver.exe
.exe windows:5 windows x86 arch:x86

275d854cb701f5772522e8c50b111119

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/08/2012, 00:00

Not After

29/08/2013, 23:59

Subject

CN=Awesome Apps,O=Awesome Apps,L=Philadelphia,ST=Pennsylvania,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

17/11/2006, 00:00

Not After

16/07/2036, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa
Signer

Actual PE Digest

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

oleacc

AccessibleObjectFromWindow

ws2_32

WSACleanup
gethostbyname
WSAStartup
inet_ntoa

urlmon

URLDownloadToCacheFileA

wininet

HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetGetCookieA
InternetSetCookieA
InternetSetOptionA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle

kernel32

CreateThread
GetCurrentThreadId
GetCurrentProcessId
lstrlenW
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetProcAddress
LoadLibraryA
GetLastError
ReleaseMutex
OpenMutexA
CreateMutexA
Sleep
SetEvent
CreateEventA
RaiseException
FlushInstructionCache
GetCurrentProcess
SetLastError
LocalFree
FormatMessageA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GlobalFlags
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
UnmapViewOfFile
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
lstrcpyA
LocalAlloc
InitializeCriticalSection
WriteFile
ReadFile
SetFilePointer
GetFileSize
CreateFileA
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
GetExitCodeProcess
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
WaitForSingleObject
OpenProcess
Process32Next
CreateToolhelp32Snapshot
WideCharToMultiByte
GetVersion
MoveFileExA
GetTempPathA
CopyFileExA
ExpandEnvironmentStringsA
LoadLibraryW
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetTimeZoneInformation
LCMapStringW
GetFileType
SetHandleCount
FlushFileBuffers
GetConsoleMode
GetConsoleCP
ExitProcess
HeapSize
GetStringTypeW
GetLocaleInfoW
GetModuleFileNameW
GetStdHandle
IsProcessorFeaturePresent
HeapCreate
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoW
HeapSetInformation
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
GetModuleHandleW
VirtualAlloc
CloseHandle
OutputDebugStringA
DebugBreak
InterlockedIncrement
VirtualAllocEx
MultiByteToWideChar
lstrlenA
InterlockedDecrement
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
InterlockedExchange
SetStdHandle
WriteConsoleW
CreateFileW
SetEndOfFile
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
LCMapStringA
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualProtect
HeapAlloc
GetLocalTime
GetSystemTimeAsFileTime
RtlUnwind
EncodePointer
DecodePointer
HeapFree
VirtualFree
InterlockedPopEntrySList
GetStringTypeExA
TerminateProcess

user32

CharLowerA
MessageBoxA
PostMessageA
CharNextA
SetWindowLongA
GetClassInfoExA
LoadCursorA
DefWindowProcA
RegisterClassExA
CreateWindowExA
GetWindowLongA
CallWindowProcA
UnregisterClassA
GetDesktopWindow
GetWindowThreadProcessId
DestroyIcon
InvalidateRect
SendMessageA
GetWindowRect
ReleaseDC
LoadStringA
SetWindowPos
GetParent
FindWindowExA
UnhookWindowsHookEx
CallNextHookEx
SetWindowsHookExA
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
GetWindowTextA
EnumWindows
GetForegroundWindow
SetFocus
BringWindowToTop
SetForegroundWindow
AttachThreadInput
IsWindowVisible
GetDC
wvsprintfA
DestroyWindow

gdi32

CreateFontA
SelectObject
GetTextExtentPoint32A
DeleteObject
GetObjectA

advapi32

RegQueryValueExA
GetSidSubAuthorityCount
GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegCloseKey
RegSetValueExA
RegEnumValueA
RegEnumKeyExA
RegQueryInfoKeyW
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetSidSubAuthority

shell32

SHGetFolderPathA
ShellExecuteExA

ole32

CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CLSIDFromProgID
CoTaskMemAlloc
CreateStreamOnHGlobal

oleaut32

VariantClear
SysAllocString
VariantChangeType
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantInit
SysFreeString

shlwapi

ord176

comctl32

ImageList_GetImageCount
ImageList_Remove
ImageList_ReplaceIcon

gdiplus

GdipDrawPath
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipCreatePathGradientFromPath
GdipWindingModeOutline
GdipAddPathEllipseI
GdipAddPathRectangleI
GdipSetStringFormatTrimming
GdipSetStringFormatAlign
GdipCreateSolidFill
GdipCreateHICONFromBitmap
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateFontFromDC
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipGraphicsClear
GdipDeleteGraphics
GdipSetPathGradientFocusScales
GdipSetPathGradientSurroundColorsWithCount
GdipGetPathGradientPointCount
GdipSetPathGradientCenterColor
GdipDeletePath
GdipCreatePath
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeletePen
GdipCreatePen1
GdipDeleteBrush
GdipAlloc
GdipFree
GdipFillPath
GdipCreateFontFromLogfontA
GdipCloneBitmapAreaI
GdipCloneBrush
GdipDrawString
GdipMeasureString
GdipCloneImage
GdipDeleteFont
GdipDrawImageRectI
GdiplusShutdown
GdipGetImagePixelFormat
GdiplusStartup

Sections

.text
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Vid-Saver.ico

Sharing

General

Malware Config

Signatures

Files

28a099a911237a28521d8b7ea250f089

Code Sign

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:baCertificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6dCertificate

Key Usages

72:09:1d:d2:fe:79:03:46:bc:d3:ee:3e:7c:ba:84:a8:e6:2f:1e:1aSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

Sections

.text Size: 33KB - Virtual size: 32KB

.data Size: 512B - Virtual size: 140B

.rdata Size: 3KB - Virtual size: 3KB

.bss Size: - Virtual size: 107KB

.idata Size: 5KB - Virtual size: 4KB

.ndata Size: 1024B - Virtual size: 128KB

.rsrc Size: 13KB - Virtual size: 12KB

6504337db30ea93d33d7a714fefff047

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 1024B - Virtual size: 570B

.rdata Size: 512B - Virtual size: 375B

.data Size: 512B - Virtual size: 156B

.reloc Size: 512B - Virtual size: 166B

b997a221e444f5e6463b28778735cf2b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 20B

.reloc Size: 512B - Virtual size: 290B

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

6aa1fb50f909cdf4bea3d3523348e900

Headers

DLL Characteristics

File Characteristics

Imports

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

72:09:1d:d2:fe:79:03:46:bc:d3:ee:3e:7c:ba:84:a8:e6:2f:1e:1a
Signer

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 140B

.rdata
Size: 3KB - Virtual size: 3KB

.bss
Size: - Virtual size: 107KB

.idata
Size: 5KB - Virtual size: 4KB

.ndata
Size: 1024B - Virtual size: 128KB

.rsrc
Size: 13KB - Virtual size: 12KB

.text
Size: 1024B - Virtual size: 570B

.rdata
Size: 512B - Virtual size: 375B

.data
Size: 512B - Virtual size: 156B

.reloc
Size: 512B - Virtual size: 166B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 20B

.reloc
Size: 512B - Virtual size: 290B

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 28B

.rsrc
Size: 1024B - Virtual size: 864B

.reloc
Size: 1024B - Virtual size: 832B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1024B - Virtual size: 741B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 88B

.reloc
Size: 512B - Virtual size: 190B

.text
Size: 110KB - Virtual size: 110KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 21KB - Virtual size: 27KB

.reloc
Size: 12KB - Virtual size: 12KB

3d:0c:9c:cf:6a:7d:44:b9:fd:a1:96:3a:42:43:19:ba
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

34:4e:d5:57:20:d5:ed:ec:49:f4:2f:ce:37:db:2b:6d
Certificate

18:2b:2e:fb:1e:6d:e7:28:b1:d3:bd:5f:44:dc:8b:53:2f:fc:3e:aa
Signer