75a976b7b357bbf0cfccba3547438c12_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

75a976b7b357bbf0cfccba3547438c12_JaffaCakes118
Size

3.5MB
MD5

75a976b7b357bbf0cfccba3547438c12
SHA1

87adb82a60345589d3988b4b8abd0bd774716f8a
SHA256

55a3e6cfc829ad37f95d81abce379eb350785f7847ede3aa769983595796c779
SHA512

b7ae58be3f4a4c6d956cd853b501e6cf88c9268e5e9ba027545d7dd3400598e3a97f6e254894082b58bfdee6013f91b97c9c1d2e01f16202f7688e3e850402a7
SSDEEP

98304:BK0nVy6/CQ1+5ciDp4C270aofzy+Q3wj6FMi90TdHDjfCvK:BKCyiCcidmofzWweui9cDey

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/FlashStorm.exe	upx
static1/unpack001/Tools/Flash资源提取工具.exe	upx
static1/unpack001/Tools/从EXE到SWF转换工具.exe	upx
static1/unpack001/Tools/从SWF到EXE转换工具.exe	upx

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Data/FlashIcon.icon
unpack001/FlashStorm.dll
unpack001/FlashStorm.exe
unpack001/ScrollBarPlus.ocx
unpack001/SmartMenuXP.dll
unpack001/SmartMenuXP.ocx
unpack001/Tools/Flash资源提取工具.exe
unpack001/Tools/从EXE到SWF转换工具.exe
unpack004/out.upx
unpack001/Tools/从SWF到EXE转换工具.exe
unpack001/XList.ocx

Files

75a976b7b357bbf0cfccba3547438c12_JaffaCakes118
.rar
!)卸载.bat
!)绿化.bat
Data/BKSETS.FSDATE
Data/Clock.swf
Data/Color.dat
Data/ENDNUM.FSDATE
Data/FLashStorm.ico
Data/FlashIcon.icon
.exe windows:4 windows x86 arch:x86

b4cc12215e4d35757e9ddadd18919d89

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord593
ord594
ord595
ord598
EVENT_SINK_AddRef
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord100

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Data/FlashStorm.dat
.xml
Data/HISTORY.FSDATE
Data/SAVE.FSDATE
Data/SETS.FSDATE
Data/Textures/0.jpg
.jpg
Data/Textures/1.jpg
.jpg
Data/Textures/2.jpg
.jpg
Data/Textures/3.jpg
.jpg
Data/Textures/4.jpg
.jpg
Data/Textures/5.jpg
.jpg
Data/Textures/6.jpg
.jpg
Data/Textures/7.jpg
.jpg
Data/Textures/8.jpg
.jpg
Data/Textures/9.jpg
.jpg
Data/WEB.FSDATE
Data/icon/Icon0.ico
Data/icon/Icon1.ico
Data/icon/Icon2.ico
Data/icon/Icon3.ico
Data/icon/Icon4.ico
Data/icon/Icon5.ico
FlashStorm.dll
.dll windows:4 windows x86 arch:x86

a2cc5f3d2ba9aad81b1accde68265573

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

PtInRect
DrawIconEx
GetCursor
SetRect
GetCursorPos
GetDC
GetDesktopWindow

gdi32

CreateDIBSection
SetTextAlign
GetDeviceCaps
SetTextColor
TextOutA
SelectObject
CreateCompatibleDC
DeleteObject
BitBlt
DeleteDC
StretchBlt
SetStretchBltMode

kernel32

WideCharToMultiByte
WriteFile
HeapFree
GetCommandLineA
GetVersion
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
VirtualAlloc
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
LoadLibraryA
InterlockedDecrement
InterlockedIncrement
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
HeapReAlloc
RaiseException
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LCMapStringW
RtlUnwind

Exports

Exports

fxAlphaBlend
fxAmbientLight
fxAntiAlias
fxBitBlt
fxBlur
fxBrightness
fxCMYK
fxDrawText
fxEmboss
fxEngrave
fxGamma
fxGetBlue
fxGetGreen
fxGetRed
fxGreyscale
fxGridelines
fxHSLtoRGB
fxHue
fxInversion
fxInvert
fxLight
fxMirror
fxMosaic
fxPaletteIndex
fxPaletteRGB
fxRGB
fxRGBtoHSL
fxReduceColors
fxRelief
fxRender
fxReplaceColor
fxReplaceColors
fxResample
fxRotate
fxSaturation
fxScanlines
fxScreenShot
fxScroll
fxSemitransparentBlt
fxShadeColors
fxShift
fxStretchBlt
fxText
fxTone
fxTransparentBlt
fxZoom

Sections

.text
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FlashStorm.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 659KB - Virtual size: 660KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Mscomctl.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

50ccb1d881ea89a41a10cced45c79649

Code Sign

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Certificate

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Not Before

09/04/1996, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

16/11/1999, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service CA SW1,OU=VeriSign Trust Network+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5c
Certificate

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Not Before

04/04/2000, 00:00

Not After

17/04/2001, 23:59

Subject

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CreateThread
LocalReAlloc
GetProfileIntA
RtlMoveMemory
LocalSize
FreeResource
GetCurrentProcessId
MulDiv
GetTickCount
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalReAlloc
IsBadReadPtr
Sleep
WaitForSingleObject
GlobalHandle
GetThreadLocale
LocalFree
LocalAlloc
GlobalAddAtomA
SetFilePointer
SetStdHandle
FlushFileBuffers
VirtualAlloc
WriteFile
VirtualFree
HeapCreate
HeapDestroy
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetOEMCP
GetACP
GetCPInfo
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
TlsGetValue
SetLastError
TlsFree
TlsAlloc
TlsSetValue
GetCurrentProcess
TerminateProcess
ExitProcess
RtlUnwind
GetCommandLineA
CompareStringW
GlobalSize
CreateFileA
GetFileSize
GlobalUnlock
GlobalLock
ReadFile
CloseHandle
GlobalFree
IsDBCSLeadByte
GetModuleHandleA
FindResourceA
LoadResource
LockResource
GetLastError
GetFileAttributesA
GetVersion
DisableThreadLibraryCalls
GetProcAddress
GetLocaleInfoA
LoadLibraryA
GetWindowsDirectoryA
lstrcatA
GetModuleFileNameA
IsBadWritePtr
lstrcmpiA
GetLocalTime
GetTimeFormatA
GetDateFormatA
lstrcmpA
GlobalAlloc
GetVersionExA
GetCurrentThreadId
MultiByteToWideChar
CompareStringA
lstrcpyA
InterlockedExchange
lstrlenA
GetSystemDefaultLCID
lstrcpynA
HeapAlloc
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
HeapReAlloc

user32

DrawFocusRect
AdjustWindowRect
DrawFrameControl
TrackPopupMenu
GetMessageA
AdjustWindowRectEx
CopyRect
GetKeyNameTextA
ShowCaret
SetCaretPos
GrayStringA
HideCaret
DestroyCaret
CreateCaret
SetWindowTextA
SetScrollInfo
DrawTextExA
InvertRect
SetRectEmpty
GetShellWindow
SetKeyboardState
GetKeyboardState
GetScrollInfo
GetKeyboardLayout
DestroyCursor
GetUpdateRgn
GetUpdateRect
GetWindowRgn
ValidateRect
CallMsgFilterA
LockWindowUpdate
IsZoomed
GetDesktopWindow
GetIconInfo
GetCursor
GetForegroundWindow
InvalidateRgn
EndDeferWindowPos
EnumChildWindows
GetDoubleClickTime
FindWindowA
GetMessageTime
GetWindowThreadProcessId
RemovePropA
SendNotifyMessageA
SetScrollPos
SetScrollRange
GetWindowTextLengthA
EnableScrollBar
ChildWindowFromPoint
GetDlgItemInt
EndDialog
GetActiveWindow
GetWindow
GetPropA
GetCursorPos
WindowFromPoint
GetClassNameA
GetDlgCtrlID
IsWindow
SetPropA
IsWindowEnabled
IsWindowVisible
UnregisterClassA
CharNextA
MessageBoxA
SetActiveWindow
CheckRadioButton
SetFocus
IsDlgButtonChecked
SetDlgItemTextA
SetDlgItemInt
CheckDlgButton
GetDlgItem
GetDCEx
DrawIconEx
CreateIconIndirect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetClipboardFormatNameA
SetCursorPos
RegisterClipboardFormatA
MessageBeep
RegisterWindowMessageA
PeekMessageA
PostMessageW
PeekMessageW
VkKeyScanA
SetParent
CharUpperA
GetDlgItemTextA
SetCursor
CreateDialogIndirectParamA
GetNextDlgTabItem
IsDialogMessageA
ScrollWindowEx
SendDlgItemMessageA
SetWindowRgn
IntersectRect
EqualRect
MoveWindow
BeginPaint
EndPaint
DeferWindowPos
BeginDeferWindowPos
CharNextExA
SetTimer
KillTimer
DrawIcon
DestroyIcon
MapWindowPoints
CreatePopupMenu
AppendMenuA
TrackPopupMenuEx
DestroyMenu
WinHelpA
PtInRect
DefWindowProcA
GetWindowDC
SetRect
LoadCursorA
IsRectEmpty
ClientToScreen
GetWindowRect
MapVirtualKeyA
DestroyWindow
CreateWindowExA
GetSysColorBrush
GetAsyncKeyState
EnableWindow
PostMessageA
TranslateMessage
DispatchMessageA
wsprintfA
DialogBoxParamA
UpdateWindow
GetWindowLongA
SetWindowLongA
GetDC
ReleaseDC
GetParent
OffsetRect
UnionRect
GetFocus
IsChild
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetMessagePos
ScreenToClient
SetWindowPos
SetCapture
GetWindowTextA
WindowFromDC
GetClientRect
CallWindowProcA
DrawEdge
GetSysColor
FrameRect
InflateRect
FillRect
DrawTextA
GetKeyState
GetCapture
ReleaseCapture
GetClassInfoA
RegisterClassA
InvalidateRect
LoadIconA
GetSystemMetrics
CopyImage
SendMessageA
LoadStringA
RedrawWindow
ShowWindow
CreateAcceleratorTableA

ole32

ReleaseStgMedium
DoDragDrop
RegisterDragDrop
RevokeDragDrop
CreateStreamOnHGlobal
OleLoadFromStream
OleSaveToStream
CreateOleAdviseHolder
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance

advapi32

RegDeleteKeyA
RegOpenKeyA
RegQueryValueA
RegQueryValueExA
RegEnumKeyExA
RegCreateKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegDeleteValueA

oleaut32

SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
GetErrorInfo
OleCreateFontIndirect
OleCreatePropertyFrame
LoadTypeLibEx
UnRegisterTypeLi
RegisterTypeLi
CreateErrorInfo
SetErrorInfo
LoadRegTypeLi
LoadTypeLi
VariantChangeTypeEx
SysStringByteLen
SysAllocStringByteLen
OleLoadPicture
SysAllocStringLen
VariantCopy
OleTranslateColor
VariantChangeType
OleCreatePictureIndirect
VariantCopyInd
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocString
SafeArrayCopy

comdlg32

GetOpenFileNameA

gdi32

Arc
GetTextExtentPointA
GetCharWidthA
OffsetWindowOrgEx
ExtTextOutW
GetTextExtentPointW
Polyline
GetTextAlign
SetTextAlign
OffsetRgn
GetTextColor
CombineRgn
GetTextMetricsA
MoveToEx
LineTo
Ellipse
DeleteObject
SelectObject
CreateSolidBrush
SetViewportOrgEx
SetWindowOrgEx
SetViewportExtEx
SetWindowExtEx
SetMapMode
GetDeviceCaps
CreateFontIndirectA
GetObjectA
SelectClipRgn
ExcludeClipRect
RectVisible
GetClipBox
IntersectClipRect
GetClipRgn
CreateRectRgnIndirect
RealizePalette
SelectPalette
PatBlt
CreateCompatibleBitmap
CreateBitmap
CreateCompatibleDC
GetTextExtentPoint32A
TextOutA
SetBkColor
SetTextColor
SetBkMode
Rectangle
CreatePen
GetStockObject
GetViewportExtEx
GetWindowExtEx
LPtoDP
DeleteDC
CreateDCA
CreateRectRgn
StretchBlt
CreateICA
CopyMetaFileA
CopyEnhMetaFileA
GetPaletteEntries
GetDIBits
CreateDIBitmap
GetBitmapBits
CreatePalette
GetNearestColor
CreatePatternBrush
CreateDIBSection
CreateHalftonePalette
BitBlt
SetDIBColorTable
GetDIBColorTable
GetPixel
StretchDIBits
SetBrushOrgEx
GetBkColor
ExtTextOutA
RestoreDC
SaveDC
CreateFontA

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 687KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ScrollBarPlus.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

addfe11c6a728c0e87946ff9647c1e38

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
ord588
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
__vbaRaiseEvent
__vbaFreeObjList
_adj_fprem1
ord660
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaLateMemSt
ord595
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
__vbaFpR4
__vbaBoolVar
__vbaFpR8
_CIsin
__vbaVarCmpGt
ord632
__vbaChkstk
EVENT_SINK_AddRef
__vbaI2I4
_adj_fpatan
__vbaR4Var
EVENT_SINK_Release
_CIsqrt
__vbaVarAnd
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaVarDiv
__vbaFPException
__vbaStrVarVal
__vbaVarCat
__vbaI2Var
_CIlog
__vbaErrorOverflow
__vbaVarInt
_adj_fdiv_m32i
_adj_fdivr_m32i
ord681
_adj_fdivr_m32
_adj_fdiv_r
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaVarAdd
__vbaVarDup
__vbaFpI2
__vbaFpI4
__vbaLateMemCallLd
__vbaR8IntI2
ord617
_CIatan
__vbaStrMove
ord619
_allmul
_CItan
__vbaFPInt
_CIexp
__vbaFreeObj
__vbaFreeStr

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 168KB - Virtual size: 165KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Skins/Aqua.skin
Skins/Aqua.skins/!END.jpg
.jpg
Skins/Aqua.skins/!MAX.jpg
.jpg
Skins/Aqua.skins/!MIN.jpg
.jpg
Skins/Aqua.skins/!TOP.JPG
.jpg
Skins/Aqua.skins/BK.jpg
.jpg
Skins/Aqua.skins/Bar.jpg
.jpg
Skins/Aqua.skins/FD.jpg
.jpg
Skins/Aqua.skins/KEY-00.jpg
.jpg
Skins/Aqua.skins/KEY-01.jpg
.jpg
Skins/Aqua.skins/Left.jpg
.jpg
Skins/Aqua.skins/Main.jpg
.jpg
Skins/Aqua.skins/MainBar.jpg
.jpg
Skins/Aqua.skins/Menu0.jpg
.jpg
Skins/Aqua.skins/Menu1.jpg
.jpg
Skins/Aqua.skins/Menu2.jpg
.jpg
Skins/Aqua.skins/Menu3.jpg
.jpg
Skins/Aqua.skins/Menu4.jpg
.jpg
Skins/Aqua.skins/PLAY.jpg
.jpg
Skins/Aqua.skins/PT.jpg
.jpg
Skins/Aqua.skins/STOP.jpg
.jpg
Skins/Aqua.skins/Slider.jpg
.jpg
Skins/Aqua.skins/Title.jpg
.jpg
Skins/Aqua.skins/Top.jpg
.jpg
Skins/Aqua.skins/logo.jpg
.jpg
Skins/TheSchool.skin
Skins/TheSchool.skins/!END.jpg
.jpg
Skins/TheSchool.skins/!MAX.jpg
.jpg
Skins/TheSchool.skins/!MIN.jpg
.jpg
Skins/TheSchool.skins/!TOP.JPG
.jpg
Skins/TheSchool.skins/BK.jpg
.jpg
Skins/TheSchool.skins/Bar.jpg
.jpg
Skins/TheSchool.skins/FD.jpg
.jpg
Skins/TheSchool.skins/KEY-00.jpg
.jpg
Skins/TheSchool.skins/KEY-01.jpg
.jpg
Skins/TheSchool.skins/Left.jpg
.jpg
Skins/TheSchool.skins/Main.jpg
.jpg
Skins/TheSchool.skins/MainBar.jpg
.jpg
Skins/TheSchool.skins/Menu0.jpg
.jpg
Skins/TheSchool.skins/Menu1.jpg
.jpg
Skins/TheSchool.skins/Menu2.jpg
.jpg
Skins/TheSchool.skins/Menu3.jpg
.jpg
Skins/TheSchool.skins/Menu4.jpg
.jpg
Skins/TheSchool.skins/PLAY.jpg
.jpg
Skins/TheSchool.skins/PT.jpg
.jpg
Skins/TheSchool.skins/STOP.jpg
.jpg
Skins/TheSchool.skins/Slider.jpg
.jpg
Skins/TheSchool.skins/Title.jpg
.jpg
Skins/TheSchool.skins/Top.jpg
.jpg
Skins/TheSchool.skins/logo.jpg
.jpg
Skins/§Frame§/Frame1.gif
.gif
Skins/§Frame§/Frame2.gif
.gif
Skins/§Frame§/Frame3.gif
.gif
Skins/§Frame§/Frame4.gif
.gif
Skins/§Frame§/Frame5.gif
.gif
Skins/暗潮.skin
Skins/暗潮.skins/!END.jpg
.jpg
Skins/暗潮.skins/!MAX.jpg
.jpg
Skins/暗潮.skins/!MIN.jpg
.jpg
Skins/暗潮.skins/!TOP.JPG
.jpg
Skins/暗潮.skins/BK.jpg
.jpg
Skins/暗潮.skins/Bar.jpg
.jpg
Skins/暗潮.skins/FD.jpg
.jpg
Skins/暗潮.skins/KEY-00.jpg
.jpg
Skins/暗潮.skins/KEY-01.jpg
.jpg
Skins/暗潮.skins/Left.jpg
.jpg
Skins/暗潮.skins/MAIN.jpg
.jpg
Skins/暗潮.skins/MainBar.jpg
.jpg
Skins/暗潮.skins/Menu0.jpg
.jpg
Skins/暗潮.skins/Menu1.jpg
.jpg
Skins/暗潮.skins/Menu2.jpg
.jpg
Skins/暗潮.skins/Menu3.jpg
.jpg
Skins/暗潮.skins/Menu4.jpg
.jpg
Skins/暗潮.skins/PLAY.jpg
.jpg
Skins/暗潮.skins/Pt.jpg
.jpg
Skins/暗潮.skins/STOP.jpg
.jpg
Skins/暗潮.skins/Slider.jpg
.jpg
Skins/暗潮.skins/Title.jpg
.jpg
Skins/暗潮.skins/Top.jpg
.jpg
Skins/暗潮.skins/logo.jpg
.jpg
Skins/沙漠.skin
Skins/沙漠.skins/!END.jpg
.jpg
Skins/沙漠.skins/!MAX.jpg
.jpg
Skins/沙漠.skins/!MIN.jpg
.jpg
Skins/沙漠.skins/!TOP.JPG
.jpg
Skins/沙漠.skins/BK.jpg
.jpg
Skins/沙漠.skins/Bar.jpg
.jpg
Skins/沙漠.skins/FD.jpg
.jpg
Skins/沙漠.skins/KEY-00.jpg
.jpg
Skins/沙漠.skins/KEY-01.jpg
.jpg
Skins/沙漠.skins/Left.jpg
.jpg
Skins/沙漠.skins/Main.jpg
.jpg
Skins/沙漠.skins/MainBar.jpg
.jpg
Skins/沙漠.skins/Menu0.jpg
.jpg
Skins/沙漠.skins/Menu1.jpg
.jpg
Skins/沙漠.skins/Menu2.jpg
.jpg
Skins/沙漠.skins/Menu3.jpg
.jpg
Skins/沙漠.skins/Menu4.jpg
.jpg
Skins/沙漠.skins/PLAY.jpg
.jpg
Skins/沙漠.skins/PT.jpg
.jpg
Skins/沙漠.skins/STOP.jpg
.jpg
Skins/沙漠.skins/Slider.jpg
.jpg
Skins/沙漠.skins/Title.jpg
.jpg
Skins/沙漠.skins/Top.jpg
.jpg
Skins/沙漠.skins/logo.jpg
.jpg
Skins/精灵.skin
Skins/精灵.skins/!END.jpg
.jpg
Skins/精灵.skins/!MAX.jpg
.jpg
Skins/精灵.skins/!MIN.jpg
.jpg
Skins/精灵.skins/!TOP.JPG
.jpg
Skins/精灵.skins/BK.jpg
.jpg
Skins/精灵.skins/Bar.jpg
.jpg
Skins/精灵.skins/FD.jpg
.jpg
Skins/精灵.skins/KEY-00.jpg
.jpg
Skins/精灵.skins/KEY-01.jpg
.jpg
Skins/精灵.skins/Left.jpg
.jpg
Skins/精灵.skins/Main.jpg
.jpg
Skins/精灵.skins/MainBar.jpg
.jpg
Skins/精灵.skins/Menu0.jpg
.jpg
Skins/精灵.skins/Menu1.jpg
.jpg
Skins/精灵.skins/Menu2.jpg
.jpg
Skins/精灵.skins/Menu3.jpg
.jpg
Skins/精灵.skins/Menu4.jpg
.jpg
Skins/精灵.skins/PLAY.jpg
.jpg
Skins/精灵.skins/PT.jpg
.jpg
Skins/精灵.skins/STOP.jpg
.jpg
Skins/精灵.skins/Slider.jpg
.jpg
Skins/精灵.skins/Title.jpg
.jpg
Skins/精灵.skins/Top.jpg
.jpg
Skins/精灵.skins/logo.jpg
.jpg
Skins/黑洞.skin
Skins/黑洞.skins/!END.jpg
.jpg
Skins/黑洞.skins/!MAX.jpg
.jpg
Skins/黑洞.skins/!MIN.jpg
.jpg
Skins/黑洞.skins/!TOP.JPG
.jpg
Skins/黑洞.skins/BK.jpg
.jpg
Skins/黑洞.skins/Bar.jpg
.jpg
Skins/黑洞.skins/FD.jpg
.jpg
Skins/黑洞.skins/KEY-00.jpg
.jpg
Skins/黑洞.skins/KEY-01.jpg
.jpg
Skins/黑洞.skins/Left.jpg
.jpg
Skins/黑洞.skins/Main.jpg
.jpg
Skins/黑洞.skins/MainBar.jpg
.jpg
Skins/黑洞.skins/Menu0.jpg
.jpg
Skins/黑洞.skins/Menu1.jpg
.jpg
Skins/黑洞.skins/Menu2.jpg
.jpg
Skins/黑洞.skins/Menu3.jpg
.jpg
Skins/黑洞.skins/Menu4.jpg
.jpg
Skins/黑洞.skins/PLAY.jpg
.jpg
Skins/黑洞.skins/PT.jpg
.jpg
Skins/黑洞.skins/STOP.jpg
.jpg
Skins/黑洞.skins/Slider.jpg
.jpg
Skins/黑洞.skins/Title.jpg
.jpg
Skins/黑洞.skins/Top.jpg
.jpg
Skins/黑洞.skins/logo.jpg
.jpg
SmartMenuXP.dll
.dll regsvr32 windows:4 windows x86 arch:x86

807636e1308035bc0b7080dd0872e240

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

_CIcos
_adj_fptan
_adj_fdiv_m64
__vbaRaiseEvent
_adj_fprem1
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaOnError
__vbaObjSet
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaGenerateBoundsError
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFailedFriend
__vbaFPException
__vbaUbound
ord644
_CIlog
__vbaErrorOverflow
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord685
ord101
ord102
ord103
ord104
ord105
__vbaStrToAnsi
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1004B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 772B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SmartMenuXP.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

2dd0580535bddac3d38d4fa8d76463c2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaVarTstGt
__vbaStrI2
_CIcos
_adj_fptan
__vbaVarMove
__vbaStrI4
__vbaVarVargNofree
__vbaFreeVar
ord588
__vbaAptOffset
__vbaLenBstr
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaRecAnsiToUni
__vbaCopyBytes
__vbaStrCat
__vbaLsetFixstr
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
_adj_fdiv_m32
Zombie_GetTypeInfo
ord591
__vbaObjSet
__vbaStrLike
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
ord520
__vbaBoolVar
__vbaBoolVarNull
__vbaFpR8
_CIsin
ord632
__vbaVarCmpGt
__vbaChkstk
__vbaCyVar
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaVarTstEq
__vbaI2I4
DllFunctionCall
__vbaVarOr
__vbaCastObjVar
__vbaRedimPreserve
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRecUniToAnsi
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
ord606
_adj_fprem
_adj_fdivr_m64
__vbaFPException
ord319
__vbaStrVarVal
__vbaUbound
__vbaI2Var
ord537
_CIlog
__vbaErrorOverflow
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord681
__vbaVarNot
__vbaFreeStrList
__vbaVarCmpLt
_adj_fdivr_m32
__vbaPowerR8
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
__vbaVarCmpEq
ord104
ord105
__vbaVarAdd
__vbaAryLock
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
ord616
__vbaFpI4
__vbaLateMemCallLd
__vbaRecDestructAnsi
_CIatan
__vbaStrMove
__vbaCastObj
__vbaR8IntI4
__vbaI4Cy
_allmul
_CItan
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeStr
__vbaFreeObj

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 188KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Tools/Flash资源提取工具.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 364KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Tools/从EXE到SWF转换工具.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 64KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Tools/从SWF到EXE转换工具.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

UPX0
Size: - Virtual size: 400KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 613KB - Virtual size: 616KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XList.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

2d0d32bd26ba1dfccc96bdb420365352

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvbvm60

EVENT_SINK_GetIDsOfNames
__vbaVarSub
__vbaVarTstGt
_CIcos
_adj_fptan
__vbaVarVargNofree
__vbaFreeVar
__vbaStrVarMove
__vbaFreeVarList
_adj_fdiv_m64
EVENT_SINK_Invoke
__vbaRaiseEvent
__vbaFreeObjList
__vbaStrErrVarCopy
_adj_fprem1
__vbaCopyBytes
__vbaSetSystemError
__vbaRecDestruct
__vbaHresultCheckObj
__vbaLenVar
_adj_fdiv_m32
Zombie_GetTypeInfo
__vbaAryDestruct
ord300
__vbaObjSet
__vbaOnError
_adj_fdiv_m16i
ord303
__vbaObjSetAddref
_adj_fdivr_m16i
ord598
__vbaFpR4
ord306
__vbaBoolVar
ord309
__vbaBoolVarNull
__vbaFpR8
_CIsin
__vbaErase
ord632
__vbaChkstk
__vbaCyVar
EVENT_SINK_AddRef
__vbaGenerateBoundsError
ord528
__vbaStrCmp
__vbaAryConstruct2
__vbaVarTstEq
__vbaR4Str
__vbaI2I4
__vbaPrintObj
__vbaObjVar
DllFunctionCall
__vbaCastObjVar
__vbaRedimPreserve
__vbaLbound
_adj_fpatan
__vbaR4Var
__vbaLateIdCallLd
Zombie_GetTypeInfoCount
__vbaRedim
EVENT_SINK_Release
__vbaNew
_CIsqrt
__vbaObjIs
EVENT_SINK_QueryInterface
__vbaVarMul
__vbaExceptHandler
__vbaStrToUnicode
_adj_fprem
_adj_fdivr_m64
__vbaI2Str
ord607
__vbaFPException
__vbaInStrVar
ord717
ord319
__vbaUbound
__vbaVarCat
__vbaI2Var
_CIlog
__vbaErrorOverflow
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaStrCopy
ord573
ord681
__vbaVarNot
_adj_fdivr_m32
_adj_fdiv_r
ord685
__vbaVarTstNe
ord101
ord102
__vbaI4Var
ord103
ord104
ord105
__vbaAryLock
__vbaLateMemCall
__vbaVarAdd
ord320
__vbaVarDup
__vbaStrToAnsi
ord321
__vbaFpI2
__vbaFpI4
__vbaVarLateMemCallLd
__vbaLateMemCallLd
_CIatan
__vbaCastObj
__vbaStrMove
_allmul
__vbaLenVarB
__vbaLateIdSt
_CItan
__vbaFPInt
__vbaAryUnlock
_CIexp
__vbaFreeObj
__vbaFreeStr
__vbaRecAssign

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
comdlg32.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

988f29c1eb8054253091352741683c76

Code Sign

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Certificate

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Not Before

09/04/1996, 00:00

Not After

07/01/2004, 23:59

Subject

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Certificate

Issuer

OU=VeriSign\, Inc.+OU=VeriSign Time Stamping Service Root+OU=NO LIABILITY ACCEPTED\, (c)97 VeriSign\, Inc.,O=VeriSign Trust Network

Not Before

16/11/1999, 00:00

Not After

06/01/2004, 23:59

Subject

CN=VeriSign Time Stamping Service CA SW1,OU=VeriSign Trust Network+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98,O=VeriSign\, Inc.

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5c
Certificate

Issuer

OU=VeriSign Commercial Software Publishers CA,O=VeriSign\, Inc.,L=Internet

Not Before

04/04/2000, 00:00

Not After

17/04/2001, 23:59

Subject

CN=Microsoft Corporation,OU=VeriSign Commercial Software Publishers CA+OU=www.verisign.com/repository/RPA Incorp. by Ref.\,LIAB.LTD(c)98+OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Microsoft Corporation,O=VeriSign\, Inc.,L=Internet+L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageKeyEncipherment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

HeapReAlloc
GetLastError
LockResource
GetWindowsDirectoryA
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
CompareStringA
CompareStringW
lstrcmpA
GetLocaleInfoA
GetVersion
GetModuleFileNameA
GetFileAttributesA
IsBadWritePtr
DisableThreadLibraryCalls
GlobalAlloc
lstrcmpiA
LoadLibraryA
GetProcAddress
lstrcatA
lstrlenA
lstrcpyA
WriteProfileStringA
GlobalLock
GlobalUnlock
LoadResource
FindResourceA
lstrcpynA
LeaveCriticalSection
DeleteCriticalSection
FreeLibrary
HeapFree
WideCharToMultiByte
lstrlenW
HeapAlloc
GetProfileStringA
EnterCriticalSection
GetProcessHeap
GetCurrentThreadId
MultiByteToWideChar
InitializeCriticalSection
GlobalFree

user32

SetWindowRgn
IntersectRect
EqualRect
PtInRect
IsDialogMessageA
IsChild
GetKeyState
CreateDialogIndirectParamA
MessageBeep
PostMessageA
ClientToScreen
wsprintfA
SendMessageTimeoutA
CharNextA
GetActiveWindow
GetWindowThreadProcessId
LoadCursorA
MessageBoxA
GetWindowLongA
GetWindowRect
CreateWindowExA
SetWindowLongA
ShowWindow
DialogBoxParamA
EnableWindow
GetDesktopWindow
GetWindow
IsWindowEnabled
OffsetRect
GetParent
GetDlgItem
SendMessageA
SetFocus
SetParent
SetDlgItemInt
EndPaint
SetActiveWindow
IsWindowVisible
WinHelpA
GetDlgItemInt
EndDialog
GetDlgItemTextA
DestroyWindow
SetDlgItemTextA
GetWindowTextA
GetNextDlgTabItem
SendDlgItemMessageA
RegisterClassA
GetDC
ReleaseDC
LoadIconA
DrawIcon
DestroyIcon
GetSystemMetrics
RegisterWindowMessageA
LoadStringA
DefWindowProcA
UnregisterClassA
GetClientRect
BeginPaint
RegisterClipboardFormatA
SetWindowPos
MoveWindow

ole32

CreateOleAdviseHolder
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
ReleaseStgMedium

advapi32

RegEnumKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

oleaut32

LoadRegTypeLi
OleCreatePropertyFrame
SetErrorInfo
UnRegisterTypeLi
LoadTypeLi
LoadTypeLibEx
OleLoadPicture
VariantChangeType
RegisterTypeLi
VariantInit
GetErrorInfo
VariantClear
SysStringLen
SysAllocStringLen
OleTranslateColor
SysFreeString
SysAllocString
CreateErrorInfo

comdlg32

CommDlgExtendedError
PrintDlgA
ChooseFontA
ChooseColorA
GetOpenFileNameA
GetSaveFileNameA

gdi32

GetDIBits
CreateCompatibleDC
CreateBitmap
GetSystemPaletteEntries
StretchDIBits
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
LPtoDP
SetViewportExtEx
GetViewportExtEx
CreateRectRgnIndirect
GetWindowExtEx
CreateDCA
GetObjectA
EnumFontFamiliesA
DeleteDC
DeleteObject
GetDeviceCaps
SelectObject

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
安装说明.url
.url
幕后.doc
.rtf .doc
更新文档.doc
.rtf .doc

Sharing

General

Malware Config

Signatures

Files

b4cc12215e4d35757e9ddadd18919d89

Headers

File Characteristics

Imports

msvbvm60

Sections

.text Size: 28KB - Virtual size: 27KB

.data Size: - Virtual size: 2KB

.rsrc Size: 68KB - Virtual size: 66KB

a2cc5f3d2ba9aad81b1accde68265573

Headers

File Characteristics

Imports

user32

gdi32

kernel32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 48KB

.rdata Size: 8KB - Virtual size: 4KB

.data Size: 8KB - Virtual size: 5KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 4KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.2MB

UPX1 Size: 659KB - Virtual size: 660KB

.rsrc Size: 27KB - Virtual size: 28KB

50ccb1d881ea89a41a10cced45c79649

Code Sign

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10Certificate

fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1dCertificate

Extended Key Usages

Key Usages

75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5cCertificate

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

ole32

advapi32

oleaut32

comdlg32

gdi32

Exports

Exports

Sections

.text Size: 687KB - Virtual size: 687KB

.data Size: 28KB - Virtual size: 28KB

.rsrc Size: 279KB - Virtual size: 279KB

.reloc Size: 38KB - Virtual size: 38KB

addfe11c6a728c0e87946ff9647c1e38

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

Sections

.text Size: 168KB - Virtual size: 165KB

.data Size: 4KB - Virtual size: 6KB

.rsrc Size: 8KB - Virtual size: 6KB

.reloc Size: 12KB - Virtual size: 11KB

807636e1308035bc0b7080dd0872e240

Headers

File Characteristics

Imports

msvbvm60

Exports

Exports

.text
Size: 28KB - Virtual size: 27KB

.data
Size: - Virtual size: 2KB

.rsrc
Size: 68KB - Virtual size: 66KB

.text
Size: 52KB - Virtual size: 48KB

.rdata
Size: 8KB - Virtual size: 4KB

.data
Size: 8KB - Virtual size: 5KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 4KB

UPX0
Size: - Virtual size: 2.2MB

UPX1
Size: 659KB - Virtual size: 660KB

.rsrc
Size: 27KB - Virtual size: 28KB

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Certificate

fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Certificate

75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5c
Certificate

.text
Size: 687KB - Virtual size: 687KB

.data
Size: 28KB - Virtual size: 28KB

.rsrc
Size: 279KB - Virtual size: 279KB

.reloc
Size: 38KB - Virtual size: 38KB

.text
Size: 168KB - Virtual size: 165KB

.data
Size: 4KB - Virtual size: 6KB

.rsrc
Size: 8KB - Virtual size: 6KB

.reloc
Size: 12KB - Virtual size: 11KB

.text
Size: 12KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 1004B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 772B

.text
Size: 188KB - Virtual size: 185KB

.data
Size: 4KB - Virtual size: 8KB

.rsrc
Size: 16KB - Virtual size: 15KB

.reloc
Size: 16KB - Virtual size: 12KB

UPX0
Size: - Virtual size: 364KB

UPX1
Size: 212KB - Virtual size: 212KB

.rsrc
Size: 29KB - Virtual size: 32KB

UPX0
Size: - Virtual size: 64KB

UPX1
Size: 15KB - Virtual size: 16KB

.rsrc
Size: 27KB - Virtual size: 28KB

.text
Size: 40KB - Virtual size: 37KB

.data
Size: - Virtual size: 2KB

.rsrc
Size: 28KB - Virtual size: 26KB

UPX0
Size: - Virtual size: 400KB

UPX1
Size: 613KB - Virtual size: 616KB

.rsrc
Size: 30KB - Virtual size: 32KB

.text
Size: 84KB - Virtual size: 83KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 16KB - Virtual size: 12KB

.reloc
Size: 8KB - Virtual size: 7KB

03:c7:8f:37:db:92:28:df:3c:bb:1a:ad:82:fa:67:10
Certificate

fc:a4:a5:9f:2c:0f:c0:b9:03:98:33:1b:7b:54:54:1d
Certificate

75:f2:8e:f8:a8:fb:ea:6d:11:52:97:14:95:4b:65:5c
Certificate