6ce4ae6bed9f4b669963cf4783f0f42f[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

6ce4ae6bed9f4b669963cf4783f0f42f.bin
Size

4.5MB
MD5

6ce4ae6bed9f4b669963cf4783f0f42f
SHA1

e72746cb5787e989717d2f245781897c49a52fab
SHA256

e684ef5dccb25e5c0b52d228d564ce8ebb7f994d76a4e25fac7ffeb30af5bce9
SHA512

39eb69606de52a620a467313365a0f4016796673bf0ee596b7d1c44024aa9f76d3e92395d53703c695d8e3b3a01f65a754967bcbe96862237038a5d7d27f612b
SSDEEP

98304:IX0EA+nrQU4l7Q+V/TFjiMiN9Sauvcbli1LiVRGdaMo9Rm:IzzrQJlUGT9xPjeRglo9Rm

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/Maxthon.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
6ce4ae6bed9f4b669963cf4783f0f42f.bin
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/MaxUpdate.exe
unpack001/Maxthon.exe
unpack001/Plugin/FloatBar/FloatBar.dll
unpack001/Plugin/ViewSource/ViewSrc.dll
unpack001/Services/realtime/real_time.dll
unpack001/maxzlib.dll

NSIS installer 1 IoCs

installer

resource	yara_rule
sample	nsis_installer_1

Files

6ce4ae6bed9f4b669963cf4783f0f42f.bin
.exe windows:4 windows x86 arch:x86

381e79edf6f32b225643e232be0965fa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GetCommandLineA
SetFileTime
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
CreateWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
EmptyClipboard
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
GetDlgItem

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 930B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

8fc31e88f4e2f35a7d6873d897a2680d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpynA
GetModuleHandleA
lstrlenA
lstrcmpA
MulDiv
lstrcpyA
GlobalAlloc

user32

LoadIconA
SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
DialogBoxParamA
GetDC
ShowWindow
EndDialog
SendMessageA

gdi32

CreateFontIndirectA
GetDeviceCaps
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 242B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/bundles.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/rf.ini
AiRoboForm/AiRoboForm.exe
.exe windows:4 windows x86 arch:x86

f40e5203d41e6ead8137d9ffaf8656ea

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:f6:8e
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

02/02/2005, 16:09

Not After

17/02/2006, 18:40

Subject

CN=Siber Systems,OU=Secure Application Development,O=Siber Systems,L=Herndon,ST=Virginia,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetWindowsDirectoryA
GetTempFileNameA
CreateDirectoryA
GetFileAttributesA
FreeLibrary
LocalFree
GetProcAddress
LoadLibraryA
LocalAlloc
CreateFileA
lstrcmpiA
Sleep
lstrlenA
lstrcmpA
GetModuleFileNameA
WriteFile
RemoveDirectoryA
GetTickCount
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
FormatMessageA
SetFilePointer
GetLocalTime
GetFileSize
GetModuleHandleA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
FindClose
lstrcpyA
FindFirstFileA
CopyFileA
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
SetLastError
SetFileTime
GetSystemTimeAsFileTime
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsBadCodePtr
IsBadReadPtr
IsBadWritePtr
HeapReAlloc
SetUnhandledExceptionFilter
GetEnvironmentVariableA
GetFileType
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
TerminateProcess
GetOEMCP
GetACP
GetCPInfo
HeapFree
RaiseException
ExitProcess
DeleteFileA
lstrcatA
GetTempPathA
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
HeapCreate
GetVersionExA
GetSystemInfo
HeapAlloc
CreateEventA
GetLastError
FindNextFileA
CloseHandle
VirtualAlloc
VirtualFree
GetStdHandle
MultiByteToWideChar
WideCharToMultiByte
RtlUnwind
GetStartupInfoA
GetCommandLineA
GetVersion

user32

ExitWindowsEx
CharNextA
GetWindowLongA
GetParent
GetWindow
GetWindowRect
SystemParametersInfoA
GetClientRect
MapWindowPoints
SetWindowPos
SetWindowLongA
CreateDialogParamA
PeekMessageA
TranslateMessage
PostQuitMessage
SetWindowTextA
IsWindow
GetDlgItem
SendMessageA
ShowWindow
wsprintfA
DestroyWindow
MessageBoxA
DispatchMessageA

comctl32

InitCommonControlsEx

advapi32

OpenProcessToken
GetTokenInformation
EqualSid
FreeSid
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegCloseKey
AllocateAndInitializeSid

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
C:/Program Files/AWS/WeatherBug/WeatherBug.exe
.exe windows:4 windows x86 arch:x86

965694e3b55a803f561510c0fb5c9240

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

40:48:fc:a6:21:55:4c:af:18:94:2a:dd:55:97:5f:b3
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24/05/2005, 00:00

Not After

01/07/2006, 23:59

Subject

CN=WeatherBug,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Consumer,O=WeatherBug,L=Gaithersburg,ST=Maryland,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\aws_soft\WxBugLite\Release\WeatherLight.pdb

Imports

winmm

PlaySoundA

wininet

InternetConnectA
InternetReadFile
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetOpenA
InternetCloseHandle
HttpQueryInfoA

rpcrt4

UuidToStringA
RpcStringFreeA

kernel32

TlsGetValue
TlsAlloc
TlsSetValue
LocalReAlloc
TlsFree
InterlockedIncrement
GetCPInfo
GetOEMCP
SetErrorMode
HeapFree
HeapAlloc
VirtualAlloc
GetSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
CreateDirectoryA
GetTimeFormatA
GetDateFormatA
GetStartupInfoA
GlobalHandle
RtlUnwind
HeapReAlloc
ExitThread
CreateThread
TerminateProcess
HeapSize
HeapDestroy
HeapCreate
VirtualFree
IsBadWritePtr
GetTimeZoneInformation
LCMapStringA
LCMapStringW
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
SetUnhandledExceptionFilter
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
SetEnvironmentVariableA
GlobalReAlloc
LocalAlloc
GlobalFlags
FindResourceExA
GetCurrentThread
lstrcmpA
ConvertDefaultLocale
EnumResourceLanguagesA
CreateEventA
SuspendThread
SetEvent
SetThreadPriority
GetFullPathNameA
GetVolumeInformationA
lstrcpyA
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
GetFileTime
GetFileSize
CreateFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
LoadLibraryA
FreeLibrary
lstrcatA
lstrcmpW
GlobalAlloc
FormatMessageA
LocalFree
MulDiv
GetModuleHandleA
GetProcAddress
GlobalLock
GlobalUnlock
FreeResource
SetLastError
lstrcpynA
GlobalFree
VirtualProtect
EnterCriticalSection
LeaveCriticalSection
GetTickCount
GetUserDefaultLCID
FindClose
FindFirstFileA
GetFileAttributesA
DeleteFileA
ResumeThread
WriteProcessMemory
CloseHandle
DuplicateHandle
VirtualProtectEx
RemoveDirectoryA
FlushInstructionCache
CreateProcessA
Sleep
GetCurrentProcess
SetThreadContext
GetThreadContext
ExitProcess
LockResource
SizeofResource
WaitForSingleObject
LoadResource
FindResourceA
GetModuleFileNameA
GetVersion
GetVersionExA
DeleteCriticalSection
CompareStringA
GetThreadLocale
lstrcmpiA
GetLastError
InterlockedExchange
RaiseException
MultiByteToWideChar
GetACP
CompareStringW
WideCharToMultiByte
InitializeCriticalSection
GetLocaleInfoA
lstrlenA
GetCommandLineA

user32

MessageBeep
PostThreadMessageA
LoadCursorA
GetSysColorBrush
SetCursor
PostQuitMessage
GetMessageA
TranslateMessage
ValidateRect
MoveWindow
SetWindowTextA
IsDialogMessageA
RegisterWindowMessageA
WinHelpA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
GetClassInfoExA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SendDlgItemMessageA
IsChild
GetForegroundWindow
GetLastActivePopup
DispatchMessageA
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageA
MapWindowPoints
MessageBoxA
TrackPopupMenu
GetKeyState
UpdateWindow
GetMenu
AdjustWindowRectEx
EqualRect
RegisterClassA
GetNextDlgGroupItem
GetDlgCtrlID
DefWindowProcA
SetWindowLongA
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
ReleaseCapture
PtInRect
GetMenuItemID
GetMenuItemCount
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
ScreenToClient
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
GetDesktopWindow
CreateDialogIndirectParamA
DestroyWindow
GetNextDlgTabItem
EndDialog
wsprintfA
GetWindowTextA
GetWindow
SetMenuItemBitmaps
GetMenuState
CheckMenuItem
GetMenuCheckMarkDimensions
LoadBitmapA
MapDialogRect
SetWindowPos
ShowWindow
GetCapture
GetActiveWindow
SetActiveWindow
GetAsyncKeyState
GetFocus
SetFocus
GetWindowLongA
GetParent
GetDlgItem
IsWindowEnabled
GetSystemMenu
GetWindowRect
EnableMenuItem
IsIconic
GetSubMenu
RegisterClipboardFormatA
SetWindowContextHelpId
CharNextA
SetForegroundWindow
LoadMenuA
DrawIcon
GetClientRect
GetDC
BringWindowToTop
ReleaseDC
GetCursorPos
SetMenuDefaultItem
GetSystemMetrics
IsWindowVisible
DestroyMenu
ModifyMenuA
GetClassInfoA
FindWindowA
InvalidateRgn
InvalidateRect
CopyAcceleratorTableA
IsRectEmpty
LoadIconA
CreateIconIndirect
SetRect
DestroyIcon
SetTimer
KillTimer
IsWindow
PostMessageA
CharUpperA
SendMessageA
UnregisterClassA
EnableWindow
CopyRect
SetCapture
CallWindowProcA

gdi32

SetViewportOrgEx
GetDeviceCaps
EnumFontFamiliesExA
CreateRectRgnIndirect
GetMapMode
GetRgnBox
GetStockObject
GetTextColor
SelectObject
Escape
TextOutA
RectVisible
PtVisible
GetWindowExtEx
GetViewportExtEx
DeleteObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetBkMode
SetBkColor
RestoreDC
SaveDC
SetBitmapBits
CreateBitmap
CreateCompatibleDC
CreateCompatibleBitmap
GetPixel
ExtTextOutA
CreateFontIndirectA
GetBkColor
GetObjectA
GetClipBox
SetMapMode
SetTextColor
OffsetViewportOrgEx

comdlg32

GetFileTitleA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegCreateKeyExA
RegOpenKeyExA
RegDeleteValueA
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegDeleteKeyA
RegEnumKeyA
RegQueryValueA
RegSetValueExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHGetPathFromIDListA
Shell_NotifyIconA
ShellExecuteExA
SHFileOperationA

comctl32

PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ord17

shlwapi

PathStripToRootA
PathIsUNCA
PathFindExtensionA
SHDeleteKeyA
PathFindFileNameA

oledlg

ord8

ole32

CoFreeUnusedLibraries
CoTaskMemFree
CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance
OleUninitialize
CoTaskMemAlloc
CoRegisterMessageFilter
OleFlushClipboard
OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
CLSIDFromString

oleaut32

SysFreeString
SafeArrayDestroy
SafeArrayCreate
SafeArrayGetElemsize
SafeArrayAccessData
SafeArrayUnaccessData
LoadRegTypeLi
SysAllocString
DispCallFunc
VariantCopy
SysAllocStringByteLen
SysStringLen
VariantChangeType
SysAllocStringLen
VariantInit
VariantClear
SystemTimeToVariantTime
OleCreateFontIndirect

Sections

.text
Size: 228KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 56KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Config/Plugins.ini
Config/blacklist.htm
.html .js polyglot
Config/blocked.wav
Config/default.ini
Config/downloadmgr.ini
.js
Config/empty.swf
Config/rss.ini
Groups/maxthon.cgp
Language/English/DefaultSetup.ini
Language/English/SearchBar.ini
.js
Language/English/gohelp.htm
.html
Language/English/language.ini
Language/English/resource.htm
.html
Language/English/search.htm
.html
Language/English/start.tem
.html .js polyglot
Language/English/tips.txt
Language/English/urllist.htm
.html .js polyglot
License.txt
MaxUpdate.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 12KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1024B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Maxthon.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 756KB - Virtual size: 760KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 99KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Plugin/EnableRightClick/EnableRightClick.htm
.html .js polyglot
Plugin/EnableRightClick/plugin.ini
Plugin/EnableRightClick/rightclick.ico
Plugin/EnableRightClick/rightclick2.ico
Plugin/FlashSave/FlashSave.html
.html .js polyglot
Plugin/FlashSave/cold.ico
Plugin/FlashSave/hot.ico
Plugin/FlashSave/plugin.ini
Plugin/FloatBar/FloatBar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2d1db46406901b96596e971843804268

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalLock
lstrcmpA
GetVersionExA
GetModuleFileNameA
DisableThreadLibraryCalls
GetShortPathNameA
GetModuleHandleA
FreeLibrary
SizeofResource
LoadLibraryExA
lstrcmpiA
IsDBCSLeadByte
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
GetProcAddress
LoadLibraryA
lstrcpyA
lstrcatA
WritePrivateProfileStringA
GetPrivateProfileStringA
CreateFileA
InterlockedExchange
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
GetTimeZoneInformation
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoA
IsValidCodePage
IsValidLocale
ReadFile
SetStdHandle
Sleep
IsBadCodePtr
GlobalUnlock
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetEnvironmentVariableA
HeapSize
TerminateProcess
SetUnhandledExceptionFilter
CloseHandle
FlushFileBuffers
SetFilePointer
WriteFile
LCMapStringW
LCMapStringA
ExitProcess
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetVersion
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
RaiseException
RtlUnwind
GetCurrentProcess
FlushInstructionCache
GlobalAlloc
FindResourceA
LoadResource
LockResource
GlobalHandle
GlobalFree
FreeResource
lstrcpynA
CopyFileA
GetLastError
SetEndOfFile
FormatMessageA
LocalFree
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
lstrlenA
OutputDebugStringA
DebugBreak
IsBadReadPtr
InterlockedDecrement

user32

CreatePopupMenu
AppendMenuA
OpenClipboard
SetDlgItemTextA
EndDialog
MessageBoxA
SendMessageA
DestroyMenu
GetWindow
SetWindowLongA
MessageBeep
SetDlgItemInt
GetDlgItemInt
wvsprintfA
CharNextA
TrackPopupMenu
MapWindowPoints
ClientToScreen
PtInRect
SetMenuItemInfoA
LoadMenuA
GetSubMenu
GetDlgItem
SetFocus
SetWindowTextA
GetWindowLongA
ShowWindow
SetTimer
KillTimer
MoveWindow
EmptyClipboard
SetClipboardData
CloseClipboard
LoadImageA
DialogBoxParamA
EnumChildWindows
LoadStringA
CreateWindowExA
wsprintfA
DestroyWindow
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
CreateAcceleratorTableA
GetDesktopWindow
GetParent
GetClassNameA
RedrawWindow
IsWindow
SetWindowPos
BeginPaint
GetClientRect
FillRect
EndPaint
CallWindowProcA
GetDC
ReleaseDC
GetFocus
IsChild
GetSysColor
GetWindowTextLengthA
GetWindowTextA
DefWindowProcA
RegisterWindowMessageA
GetClassInfoExA
LoadCursorA
RegisterClassExA
DialogBoxIndirectParamA
CreateDialogParamA
GetCursorPos
GetActiveWindow
CharLowerA
ScreenToClient
WindowFromPoint
GetWindowRect
IsWindowVisible

gdi32

GetDeviceCaps
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
DeleteObject
CreateSolidBrush
GetStockObject
GetObjectA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegOpenKeyExA
RegDeleteKeyA
RegQueryValueExA
RegCloseKey
RegEnumValueA
RegQueryInfoKeyA
RegSetValueExA
RegEnumKeyExA
RegDeleteValueA
RegCreateKeyExA

ole32

OleLockRunning
CoTaskMemAlloc
StringFromCLSID
CoTaskMemRealloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree

oleaut32

LoadTypeLi
VarUI4FromStr
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
VariantCopy
SysAllocStringLen
SysAllocString
VariantClear
SysFreeString
RegisterTypeLi

wininet

GetUrlCacheEntryInfoExA

urlmon

URLDownloadToCacheFileA

comctl32

ImageList_Destroy
ImageList_Create
ImageList_AddMasked

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugin/FloatBar/ReadMe.txt
Plugin/FloatBar/plugin.ini
Plugin/FloatBar/tempfile.html
.html
Plugin/M2bookmark/compact_menu.html
.html .js polyglot
Plugin/M2bookmark/compact_options.html
.html .js polyglot
Plugin/M2bookmark/defaultlocal.css
Plugin/M2bookmark/images/dot.gif
.gif
Plugin/M2bookmark/images/help1.gif
.gif
Plugin/M2bookmark/images/ico_addfavorite.gif
.gif
Plugin/M2bookmark/images/ico_addfavorite_t.gif
.gif
Plugin/M2bookmark/images/ico_addfolder.gif
.gif
Plugin/M2bookmark/images/logout.gif
.gif
Plugin/M2bookmark/images/options.gif
.gif
Plugin/M2bookmark/images/refresh.gif
.gif
Plugin/M2bookmark/languages/Chinese.ini
Plugin/M2bookmark/languages/English.ini
Plugin/M2bookmark/m2bk.ico
Plugin/M2bookmark/max.src
Plugin/M2bookmark/plugin.ini
Plugin/M2bookmark/settings.ini
Plugin/M2bookmark/userbk.html
.html
Plugin/NetSnippets/1.html
.html
Plugin/NetSnippets/ns.ico
Plugin/NetSnippets/plugin.ini
Plugin/Plugins-HowTo.htm
.html .js polyglot
Plugin/ViewSource/ViewSrc.dll
.dll regsvr32 windows:4 windows x86 arch:x86

2a289fa876ad70dfdca4d679a37d3a3d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetPrivateProfileIntA
GetPrivateProfileStringA
GetSystemInfo
HeapCreate
InterlockedDecrement
GetVersionExA
DisableThreadLibraryCalls
lstrlenA
lstrcpyA
WideCharToMultiByte
lstrlenW
GetTempFileNameA
GetTempPathA
WritePrivateProfileStringA
CloseHandle
WriteFile
FlushInstructionCache
DebugBreak
HeapFree
lstrcpynA
HeapAlloc
lstrcatA
CreateFileA
GetCurrentProcess

user32

GetWindowLongA
GetParent
MapWindowPoints
GetWindowRect
GetActiveWindow
SetWindowPos
GetWindow
DialogBoxParamA
SystemParametersInfoA
IsDlgButtonChecked
GetSystemMetrics
GetClientRect
SetWindowLongA
GetDlgItemTextA
LoadImageA
CheckDlgButton
GetDlgItem
EnableWindow
SetDlgItemTextA
SendMessageA
EndDialog

comdlg32

GetOpenFileNameA
GetSaveFileNameA

shell32

ShellExecuteA

ole32

CoUninitialize

oleaut32

SysStringLen
LoadRegTypeLi
SysFreeString

atl

ord18
ord15
ord57
ord30
ord58
ord32
ord23
ord21
ord44
ord43
ord16

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 557B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 902B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugin/ViewSource/plugin.ini
Plugin/ViewSource/plugin.ini.bak
Plugin/Weather/config.htm
.html .js polyglot
Plugin/Weather/images/collapse.gif
.gif
Plugin/Weather/images/config.gif
.gif
Plugin/Weather/images/expand.gif
.gif
Plugin/Weather/images/sun.gif
.gif
Plugin/Weather/images/sync.gif
.gif
Plugin/Weather/images/weather.gif
.gif
Plugin/Weather/images/weather_title.jpg
.jpg
Plugin/Weather/language/lan_cn.xml
.xml
Plugin/Weather/language/lan_en.xml
.xml
Plugin/Weather/plugin.ini
Plugin/Weather/readme.txt
Plugin/Weather/script/config.js
.js
Plugin/Weather/script/weather.css
Plugin/Weather/script/weather.js
.js
Plugin/Weather/script/weather2.js
.js
Plugin/Weather/weather.htm
.html .js polyglot
Plugin/Weather/weather.ico
Plugin/Weather/weather2.htm
.html .js polyglot
Services/realtime/Settings.ini
Services/realtime/real_time.dll
.dll regsvr32 windows:4 windows x86 arch:x86

835a4abc25b026afe354051dbed60008

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mfc42

ord4424
ord3639
ord5265
ord4376
ord3402
ord5290
ord4998
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord2514
ord6374
ord5163
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord4353
ord2982
ord3147
ord5277
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord616
ord641
ord567
ord324
ord825
ord692
ord2302
ord4234
ord2379
ord6197
ord6199
ord5951
ord1779
ord4710
ord3259
ord5683
ord860
ord823
ord6055
ord4401
ord5810
ord5481
ord2031
ord4335
ord4863
ord4975
ord5796
ord5478
ord966
ord3570
ord2029
ord926
ord2077
ord278
ord2642
ord3092
ord605
ord5953
ord1264
ord1567
ord268
ord540
ord3095
ord3097
ord4055
ord6453
ord4274
ord815
ord6375
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord3953
ord2725
ord1131
ord6467
ord2086
ord2864
ord6379
ord1768
ord3337
ord924
ord858
ord3811
ord2820
ord2822
ord922
ord535
ord537
ord800
ord1776
ord2024
ord2581
ord4219
ord1771
ord2413
ord6366
ord2578
ord3582
ord4398
ord2411
ord4218
ord2023
ord1168
ord1971
ord3874
ord4129
ord4853
ord1116
ord1176
ord1575
ord1577
ord1182
ord342
ord1243
ord1197
ord1570
ord1253
ord1255
ord1578
ord826
ord600
ord269

msvcrt

_snprintf
_ftime
modf
_mbscmp
__CxxFrameHandler
_ftol
_purecall
memcmp
__dllonexit
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
free
_initterm
malloc
_adjust_fdiv
_except_handler3
memcpy
_CxxThrowException

kernel32

WritePrivateProfileStringA
GetModuleFileNameA
GetPrivateProfileIntA
SetEvent
SetLocalTime
FormatMessageA
GetPrivateProfileStringA
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSection
EnterCriticalSection
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
lstrlenW
ResetEvent

user32

EnableWindow
GetDesktopWindow
SetForegroundWindow
KillTimer
SendMessageA
SetTimer
GetWindowRect
MessageBoxA

oleaut32

SysFreeString
SysStringLen
LoadRegTypeLi

atl

ord18
ord23
ord16
ord21
ord15
ord57
ord32
ord58
ord30

wsock32

ntohl
htonl
WSAGetLastError

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skin/ChaNinja Style - SubZero/bg.bmp
Skin/ChaNinja Style - SubZero/button_a.bmp
Skin/ChaNinja Style - SubZero/button_i.bmp
Skin/ChaNinja Style - SubZero/checked.ico
Skin/ChaNinja Style - SubZero/coldtool.bmp
Skin/ChaNinja Style - SubZero/coldtool_s.bmp
Skin/ChaNinja Style - SubZero/fav_folders.bmp
Skin/ChaNinja Style - SubZero/go.bmp
Skin/ChaNinja Style - SubZero/hottool.bmp
Skin/ChaNinja Style - SubZero/hottool1.bmp
Skin/ChaNinja Style - SubZero/hottool_s.bmp
Skin/ChaNinja Style - SubZero/iconani.bmp
Skin/ChaNinja Style - SubZero/preview.gif
.gif
Skin/ChaNinja Style - SubZero/progress.bmp
Skin/ChaNinja Style - SubZero/skin.ini
Skin/ChaNinja Style - SubZero/status.bmp
Skin/ChaNinja Style - SubZero/sysmenu.bmp
Skin/ChaNinja Style - SubZero/tab.bmp
Skin/ChaNinja Style - SubZero/unchecked.ico
Skin/Default/bg.bmp
Skin/Default/icons.bmp
Skin/Default/skin.ini
Skin/Default/skin1.ini
Skin/MSN_EXP/bg.bmp
Skin/MSN_EXP/coldtool.bmp
Skin/MSN_EXP/coldtool_s.bmp
Skin/MSN_EXP/go.bmp
Skin/MSN_EXP/hottool.bmp
Skin/MSN_EXP/hottool1.bmp
Skin/MSN_EXP/hottool_s.bmp
Skin/MSN_EXP/iconani.bmp
Skin/MSN_EXP/link.bmp
Skin/MSN_EXP/preview.gif
.gif
Skin/MSN_EXP/progress.bmp
Skin/MSN_EXP/sb_bg.BMP
Skin/MSN_EXP/sidebar_s.bmp
Skin/MSN_EXP/sidebar_u.bmp
Skin/MSN_EXP/skin.ini
Skin/MSN_EXP/status.bmp
Skin/MSN_EXP/sysmenu.bmp
Skin/MSN_EXP/tab.bmp
Skin/Noia/bg.bmp
Skin/Noia/button_a.bmp
Skin/Noia/button_i.bmp
Skin/Noia/checked.ico
Skin/Noia/coldtool.bmp
Skin/Noia/coldtool_s.bmp
Skin/Noia/fav_folders.bmp
Skin/Noia/go.bmp
Skin/Noia/hottool.bmp
Skin/Noia/hottool1.bmp
Skin/Noia/hottool1_s.bmp
Skin/Noia/hottool_s.bmp
Skin/Noia/iconani.bmp
Skin/Noia/preview.gif
.gif
Skin/Noia/progress.bmp
Skin/Noia/skin.ini
Skin/Noia/status.bmp
Skin/Noia/status_bg.bmp
Skin/Noia/sysmenu.bmp
Skin/Noia/tab.bmp
Skin/Noia/tab_bg.bmp
Skin/Noia/unchecked.ico
Skin/Safari/Bg.BMP
Skin/Safari/Bg_sp.BMP
Skin/Safari/Bg_st.BMP
Skin/Safari/coldtool.bmp
Skin/Safari/coldtool_s.bmp
Skin/Safari/fav_folder.bmp
Skin/Safari/go.bmp
Skin/Safari/hottool.bmp
Skin/Safari/hottool_s.bmp
Skin/Safari/icon.bmp
Skin/Safari/preview.gif
.gif
Skin/Safari/s_i.ico
Skin/Safari/sidebar_s.bmp
Skin/Safari/sidebar_u.bmp
Skin/Safari/skin.ini
Skin/Safari/status.bmp
Skin/Safari/sysmenu.bmp
Skin/Safari/tab.bmp
Skin/Safari/u_i.ico
maxthon.exe.manifest
.xml
maxzlib.dll
.dll windows:4 windows x86 arch:x86

bce90da5cd731751eca82d6e48766455

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

memcpy
fprintf
_fdopen
fopen
_errno
strcpy
strlen
malloc
sprintf
fwrite
fread
memset
ftell
_vsnprintf
fflush
fseek
fputc
strcat
clearerr
_initterm
_adjust_fdiv
__dllonexit
_onexit
fclose
free

kernel32

DisableThreadLibraryCalls

Exports

Exports

adler32
compress
compress2
compressBound
crc32
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePrime
deflateReset
deflateSetDictionary
get_crc_table
gzclearerr
gzclose
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgets
gzopen
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzsetparams
gztell
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateInit2_
inflateInit_
inflateReset
inflateSetDictionary
inflateSync
inflateSyncPoint
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mstyle.css
sp2enable.reg
sp2removal.reg
what's new.txt

Sharing

General

Malware Config

Signatures

Files

381e79edf6f32b225643e232be0965fa

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 152KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 27KB - Virtual size: 28KB

9d433976e02d79532f0d635ee81d0b20

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 930B

8fc31e88f4e2f35a7d6873d897a2680d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 681B

.data Size: 512B - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 242B

f40e5203d41e6ead8137d9ffaf8656ea

Code Sign

01Certificate

0aCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

3e:f6:8eCertificate

Extended Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

comctl32

advapi32

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 6KB - Virtual size: 5KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 152KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 27KB - Virtual size: 28KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 930B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 681B

.data
Size: 512B - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 242B

01
Certificate

0a
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

3e:f6:8e
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 6KB - Virtual size: 5KB

.data
Size: 14KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 1KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

40:48:fc:a6:21:55:4c:af:18:94:2a:dd:55:97:5f:b3
Certificate

.text
Size: 228KB - Virtual size: 224KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 56KB - Virtual size: 53KB

.text
Size: 12KB - Virtual size: 20KB

.rdata
Size: 2KB - Virtual size: 8KB

.data
Size: 1024B - Virtual size: 8KB

.rsrc
Size: 3KB - Virtual size: 32KB

.aspack
Size: 28KB - Virtual size: 28KB

.adata
Size: - Virtual size: 4KB

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 756KB - Virtual size: 760KB

.rsrc
Size: 99KB - Virtual size: 100KB