896c52c742a872a99759860784dab201_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

896c52c742a872a99759860784dab201_JaffaCakes118
Size

856KB
MD5

896c52c742a872a99759860784dab201
SHA1

b11f40f0e840a1b476d6787b32c142a01dc146ce
SHA256

9d893f74e470e16642396f15c823a860094689d225a7e16dce2ecb926e05a84c
SHA512

6dbbc30fcff22ad3b6984630c4f22caf766d27cb46060d0dc3b1823251d008f5d02cd14b71a28e56565b1518d9f174612cb8adb4c657467e60619146f6b8ce4d
SSDEEP

24576:vE6K+S2tPnlEsOToKORoCvMfjN244A65fMKtB:vE65S2tvlSTdMoHpn0FNtB

Score

1^/10

Malware Config

Signatures

Files

896c52c742a872a99759860784dab201_JaffaCakes118
.rar
Recorder_2.3.0/7z.dll
.dll windows:4 windows x86 arch:x86

25bcc7010e8e7f0e059da50586853709

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e6:6b:01:37:9c:4d:1b:b1:73:f7:81:af:8e:47:42:e1:9f:b0:4b:a2
Signer

Actual PE Digest

e6:6b:01:37:9c:4d:1b:b1:73:f7:81:af:8e:47:42:e1:9f:b0:4b:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocString
VariantClear
VariantCopy
SysFreeString
SysAllocStringByteLen

user32

CharLowerW
CharUpperA
CharNextA
CharPrevExA
CharUpperW
CharLowerA

msvcrt

_adjust_fdiv
_initterm
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
memset
strcmp
memcmp
_purecall
strlen
free
malloc
memmove
_CxxThrowException
memcpy
__CxxFrameHandler

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreA
ResetEvent
SetEvent
CreateEventA
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
FileTimeToLocalFileTime
DeleteCriticalSection
LocalFileTimeToFileTime
GetVersionExA
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
FileTimeToDosDateTime
DosDateTimeToFileTime
GetModuleHandleA
GetProcAddress
GetSystemInfo
CompareFileTime
WriteFile
ReadFile
MultiByteToWideChar
WideCharToMultiByte
GetLastError
CloseHandle
SetFileAttributesA
DeleteFileA
GetTempPathA
GetTempFileNameA
CreateFileA

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 612KB - Virtual size: 611KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Cab.dll
.dll windows:4 windows x86 arch:x86

96d8760c062ed4cfe001ba66ac85ef3c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:ab:80:95:72:eb:7e:01:33:97:14:d4:b0:ce:fc:7d:8f:36:32:fc
Signer

Actual PE Digest

20:ab:80:95:72:eb:7e:01:33:97:14:d4:b0:ce:fc:7d:8f:36:32:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Xiaobai\gui\dll\release\Cab.pdb

Imports

shlwapi

PathFileExistsA
PathFileExistsW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA

user32

wsprintfW
MessageBoxW
SendMessageW

kernel32

CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
GetStringTypeW
GetStringTypeA
SetEndOfFile
GetLocaleInfoA
LoadLibraryA
HeapSize
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
WriteConsoleW
GetFileInformationByHandle
DeleteFileA
FileTimeToDosDateTime
CreateThread
WaitForSingleObject
FindFirstFileA
FindNextFileA
CreateFileA
GetFileSize
GetFileAttributesA
FindNextFileW
FindClose
FindFirstFileW
CloseHandle
GetModuleFileNameW
CreateFileW
FileTimeToLocalFileTime
DeleteFileW
GetLastError
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
SetFileAttributesA
SetThreadPriority
CreateMutexW
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
WriteFile
lstrlenW
GetPrivateProfileIntW
SetFilePointer
GetLocalTime
TerminateProcess
SetFileAttributesW
ReadFile
GetTickCount
RemoveDirectoryW
GetProcessHeap
MultiByteToWideChar
WideCharToMultiByte
GetProcAddress
HeapAlloc
MoveFileExW
GetCurrentThreadId
Sleep
GetCurrentProcess
HeapFree
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetStdHandle
GetFileType
SetHandleCount
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
ExitProcess
WriteConsoleA
GetConsoleOutputCP

Exports

Exports

??0CCab@@QAE@ABV0@@Z
??0CCab@@QAE@XZ
??1CCab@@UAE@XZ
??4CCab@@QAEAAV0@ABV0@@Z
??_7CCab@@6B@
CabGetObject

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Data/Dependence.xml
Recorder_2.3.0/Data/lang.xml
Recorder_2.3.0/Data/reginit.dat
Recorder_2.3.0/Drivers/XiaobaiFsRForVista.inf
Recorder_2.3.0/Drivers/XiaobaiFsRForVista.sys
.sys windows:6 windows x86 arch:x86

6b8fc5c5109811e6e3bab35365a128f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

da:89:be:b9:b6:f3:57:21:50:8f:c3:04:1b:d3:58:a4:07:72:91:a9
Signer

Actual PE Digest

da:89:be:b9:b6:f3:57:21:50:8f:c3:04:1b:d3:58:a4:07:72:91:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\xiaobai\sys\xiaobaifs\bin6[R]\i386\XiaobaiFsRForVista.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExAllocatePoolWithTag
RtlCopyUnicodeString
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
ZwTerminateProcess
ZwOpenProcess
IoFileObjectType
ExDeleteNPagedLookasideList
IoAllocateErrorLogEntry
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlPrefixUnicodeString
ZwQueryDirectoryFile
ProbeForRead
MmMapLockedPagesSpecifyCache
ExAllocatePool
KeTickCount
KeBugCheckEx
RtlUnwind
InterlockedPushEntrySList
InterlockedPopEntrySList
_wcsnicmp
memcpy
memset
_vsnprintf
ZwCreateKey
ZwSetValueKey
IoRaiseInformationalHardError
KeDelayExecutionThread
PsSetCreateProcessNotifyRoutine
ObReferenceObjectByHandle
PsProcessType
ObfDereferenceObject
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlInitUnicodeString
ZwClose
_vsnwprintf
ExDeleteResourceLite
ExAcquireResourceSharedLite
RtlEqualUnicodeString
DbgPrint
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
IoWriteErrorLogEntry
ExInitializeResourceLite

fltmgr.sys

FltSetInformationFile
FltCancelFileOpen
FltDoCompletionProcessingWhenSafe
FltLockUserBuffer
FltGetRequestorProcessId
FltSetCallbackDataDirty
FltIsDirectory
FltGetFileNameInformation
FltReleaseFileNameInformation
FltQueryInformationFile
FltQueryDirectoryFile
FltCreateFileEx2
FltCreateFile
FltClose
FltGetStreamContext
FltAllocateContext
FltSetStreamContext
FltDeleteContext
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltGetVolumeName
FltRegisterFilter
FltCreateCommunicationPort
FltStartFiltering
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort
FltDetachVolume
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltDeletePushLock
FltInitializePushLock

Sections

.text
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Drivers/XiaobaiFsRForXp.inf
Recorder_2.3.0/Drivers/XiaobaiFsRForXp.sys
.sys windows:6 windows x86 arch:x86

ea247a110866cf4cdbe9d449d57ef43b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:4b:72:3e:1a:ba:ef:1c:a5:37:3c:bb:8b:31:4f:10:56:40:39:4d
Signer

Actual PE Digest

61:4b:72:3e:1a:ba:ef:1c:a5:37:3c:bb:8b:31:4f:10:56:40:39:4d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

z:\xiaobai\sys\xiaobaifs\bin5[R]\i386\XiaobaiFsRForXp.pdb

Imports

ntoskrnl.exe

ExDeleteNPagedLookasideList
ExFreePoolWithTag
ExInitializeNPagedLookasideList
ExAllocatePoolWithTag
RtlCopyUnicodeString
ObOpenObjectByPointer
PsLookupProcessByProcessId
MmGetSystemRoutineAddress
ZwOpenProcess
IoFileObjectType
InterlockedPushEntrySList
IoAllocateErrorLogEntry
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlPrefixUnicodeString
ZwQueryDirectoryFile
ProbeForRead
MmMapLockedPagesSpecifyCache
ExAllocatePool
KeTickCount
KeBugCheckEx
InterlockedPopEntrySList
_wcsnicmp
memcpy
memset
_vsnprintf
ZwCreateKey
ZwSetValueKey
IoRaiseInformationalHardError
KeDelayExecutionThread
PsSetCreateProcessNotifyRoutine
KeServiceDescriptorTable
ZwTerminateProcess
PsGetCurrentProcessId
ObReferenceObjectByHandle
PsProcessType
PsGetProcessId
ObfDereferenceObject
RtlCreateAcl
RtlAddAccessAllowedAce
RtlSetDaclSecurityDescriptor
RtlValidSecurityDescriptor
RtlInitUnicodeString
ZwOpenFile
ZwCreateSection
ZwMapViewOfSection
RtlInitString
RtlCompareString
ZwUnmapViewOfSection
ZwClose
_vsnwprintf
ExDeleteResourceLite
ExAcquireResourceSharedLite
RtlEqualUnicodeString
DbgPrint
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
KeLeaveCriticalRegion
IoWriteErrorLogEntry
ExInitializeResourceLite
RtlUnwind

fltmgr.sys

FltSetInformationFile
FltCancelFileOpen
FltDoCompletionProcessingWhenSafe
FltLockUserBuffer
FltGetRequestorProcessId
FltSetCallbackDataDirty
FltIsDirectory
FltGetFileNameInformation
FltReleaseFileNameInformation
FltQueryInformationFile
FltAllocateCallbackData
FltPerformSynchronousIo
FltFreeCallbackData
FltCreateFile
FltClose
FltGetStreamContext
FltAllocateContext
FltSetStreamContext
FltDeleteContext
FltReleaseContext
FltGetStreamHandleContext
FltSetStreamHandleContext
FltGetVolumeName
FltRegisterFilter
FltCreateCommunicationPort
FltStartFiltering
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort
FltDetachVolume
FltBuildDefaultSecurityDescriptor
FltFreeSecurityDescriptor
FltDeletePushLock
FltInitializePushLock

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Drivers/XiaobaiRegR.sys
.sys windows:6 windows x86 arch:x86

53f72d2b8803ea420dd33f3a4b2cc714

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fa:85:f7:4d:90:77:25:c8:a4:54:48:ef:71:4d:62:07:7c:5d:13:ef
Signer

Actual PE Digest

fa:85:f7:4d:90:77:25:c8:a4:54:48:ef:71:4d:62:07:7c:5d:13:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

y:\unnoo.xiaobai\sys\xiaobairegr\objfre_wxp_x86\i386\XiaobaiRegR.pdb

Imports

ntoskrnl.exe

InterlockedPopEntrySList
InterlockedPushEntrySList
KeGetCurrentThread
strncmp
IoGetCurrentProcess
ObfDereferenceObject
PsLookupProcessByProcessId
ExAllocatePoolWithTag
memset
ExFreePoolWithTag
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ExGetPreviousMode
memcpy
ObReferenceObjectByHandle
KeReleaseMutex
KeWaitForSingleObject
_wcsnicmp
ObQueryNameString
swprintf
wcschr
ProbeForRead
ProbeForWrite
PsGetCurrentProcessId
IoFreeIrp
KeSetEvent
IofCallDriver
IoAllocateIrp
KeInitializeEvent
RtlVolumeDeviceToDosName
IoGetLowerDeviceObject
IoGetRelatedDeviceObject
MmIsAddressValid
wcsstr
_wcsupr
ZwClose
ZwDeleteValueKey
ZwCreateKey
ZwSetValueKey
ZwDeleteKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwQueryKey
ZwOpenKey
PsSetCreateProcessNotifyRoutine
IofCompleteRequest
ExDeletePagedLookasideList
IoDeleteDevice
IoDeleteSymbolicLink
RtlInitUnicodeString
ExInitializePagedLookasideList
KeServiceDescriptorTable
KeInitializeMutex
IoCreateSymbolicLink
IoCreateDevice
KeTickCount
KeBugCheckEx
RtlUnwind

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/DrvMgr.dll
.dll windows:4 windows x86 arch:x86

7d35555a241e4afdb350cf8ae9c3e9ed

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

57:3f:0f:ed:66:57:9c:98:c6:02:06:04:60:62:dc:90:15:1c:fd:c2
Signer

Actual PE Digest

57:3f:0f:ed:66:57:9c:98:c6:02:06:04:60:62:dc:90:15:1c:fd:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

g:\Xiaobai\gui\dll\release\DrvMgr.pdb

Imports

shell32

SHCreateDirectoryExW

setupapi

SetupCloseInfFile
SetupTermDefaultQueueCallback
SetupOpenInfFileW
SetupInstallServicesFromInfSectionW
SetupInitDefaultQueueCallback
SetupCloseFileQueue
SetupQueueDeleteSectionW
SetupCommitFileQueueW
SetupOpenFileQueue

advapi32

OpenServiceW
OpenProcessToken
LookupPrivilegeValueW
RegLoadKeyW
RegOpenKeyExW
RegCloseKey
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
StartServiceW
QueryServiceStatusEx
AdjustTokenPrivileges

user32

SendMessageW
wsprintfW
GetSystemMetrics

shlwapi

SHDeleteKeyW

kernel32

FlushFileBuffers
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetPrivateProfileIntW
SetStdHandle
CreateFileA
GetConsoleMode
GetConsoleCP
HeapSize
GetLocaleInfoA
LoadLibraryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
HeapReAlloc
VirtualAlloc
GetSystemDirectoryW
GetLastError
SetFileAttributesW
CopyFileW
CreateFileW
DeviceIoControl
CloseHandle
GetWindowsDirectoryW
DeleteFileW
GetProcAddress
LoadLibraryW
FreeLibrary
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSection
Sleep
LeaveCriticalSection
EnterCriticalSection
WriteFile
GetModuleFileNameW
lstrlenW
GetFileSize
SetFilePointer
OutputDebugStringW
WideCharToMultiByte
GetTempPathW
FindClose
FindFirstFileW
Process32NextW
SetLastError
CreateToolhelp32Snapshot
HeapAlloc
GetCurrentThreadId
GetCurrentProcess
GetCurrentProcessId
HeapFree
GetVersionExW
GetLocalTime
Process32FirstW
TerminateProcess
GetModuleHandleW
GetTickCount
GetProcessHeap
MultiByteToWideChar
GetSystemInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MoveFileW
GetCommandLineA
GetVersionExA
RaiseException
RtlUnwind
GetStdHandle
GetModuleFileNameA
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree

Exports

Exports

??0CDriverManager@@QAE@ABV0@@Z
??0CDriverManager@@QAE@XZ
??1CDriverManager@@UAE@XZ
??4CDriverManager@@QAEAAV0@ABV0@@Z
??_7CDriverManager@@6B@
DMGetObject

Sections

.text
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Recorder.exe
.exe windows:4 windows x86 arch:x86

c6e6355e73c47ba3ae5a03e63e25e974

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

13-08-2010 00:00

Not After

23-10-2011 23:59

Subject

CN=深圳市大成天下信息技术有限公司,O=深圳市大成天下信息技术有限公司,L=ShenZhen,ST=GuangDong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f1:c6:df:38:a0:bf:7a:14:a6:1c:1f:0b:9a:58:df:e0:54:c3:9d:a0
Signer

Actual PE Digest

f1:c6:df:38:a0:bf:7a:14:a6:1c:1f:0b:9a:58:df:e0:54:c3:9d:a0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

g:\Xiaobai\gui\bin\Recorder\Recorder.pdb

Imports

kernel32

GetOEMCP
IsValidCodePage
VirtualAlloc
LCMapStringA
LCMapStringW
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
GetACP
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA
TerminateThread
GetCPInfo
GetSystemTimeAsFileTime
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
VirtualQuery
VirtualProtect
GetExitCodeThread
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
HeapSize
HeapReAlloc
RaiseException
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
SetFileTime
FileTimeToLocalFileTime
SetErrorMode
GetFullPathNameW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FileTimeToSystemTime
GetThreadLocale
GlobalGetAtomNameW
InterlockedIncrement
GlobalFlags
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
LocalAlloc
GetModuleHandleA
GetCurrentThread
ConvertDefaultLocale
GetVersion
EnumResourceLanguagesW
GetLocaleInfoW
CompareStringA
InterlockedExchange
SetThreadPriority
GlobalAlloc
lstrlenA
lstrcmpA
GlobalFree
FreeResource
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
CompareStringW
LoadLibraryA
lstrcmpW
GetVersionExA
lstrcmpiW
lstrcatW
WinExec
MulDiv
LoadLibraryExW
EnumResourceNamesW
lstrcpyW
SetFilePointer
GetPrivateProfileIntW
lstrcpynW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
FlushFileBuffers
FormatMessageW
GlobalUnlock
InterlockedDecrement
GlobalLock
lstrlenW
HeapFree
GetFileAttributesW
HeapAlloc
LoadLibraryW
FreeLibrary
LocalFree
GetProcAddress
GetCurrentThreadId
SetLastError
GetFileTime
GetProcessHeap
GetTickCount
GetModuleHandleW
WritePrivateProfileStringW
GetSystemInfo
MultiByteToWideChar
MoveFileW
GetVersionExW
GetVolumeInformationW
GetCurrentProcessId
GetTempPathW
CopyFileW
WideCharToMultiByte
CreateDirectoryW
RemoveDirectoryW
GetModuleFileNameW
OutputDebugStringW
MoveFileExW
GetFileSize
WriteFile
CreateThread
GetWindowsDirectoryW
FindClose
FindFirstFileW
SetFileAttributesW
ResumeThread
FindNextFileW
CreateProcessW
ExitProcess
DeleteFileW
GetLastError
GetSystemDirectoryW
Sleep
CloseHandle
ReadFile
ReleaseMutex
WaitForSingleObject
CreateMutexW
CreateFileW
SystemTimeToFileTime
GetLocalTime
GetCurrentProcess
FindResourceW
LockResource
SizeofResource
LoadResource
CreateFileA
TerminateProcess

user32

GetSysColorBrush
DestroyMenu
GetMenuItemInfoW
InflateRect
ReleaseCapture
SetCapture
DrawIcon
EndPaint
BeginPaint
GetWindowDC
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
InvalidateRect
ShowOwnedPopups
PostQuitMessage
GetMessageW
TranslateMessage
ValidateRect
AppendMenuW
InsertMenuW
GetDesktopWindow
GetActiveWindow
CreateDialogIndirectParamW
GetNextDlgTabItem
EndDialog
MoveWindow
SetWindowTextW
IsDialogMessageW
SetDlgItemTextW
DestroyIcon
SendMessageW
MessageBoxW
EnableWindow
GetWindowRect
SetForegroundWindow
SetMenuItemBitmaps
CharUpperW
LoadBitmapW
ModifyMenuW
EnableMenuItem
CheckMenuItem
RegisterWindowMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
IsChild
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
SetPropW
GetPropW
RemovePropW
GetFocus
SetFocus
GetWindowTextLengthW
GetForegroundWindow
GetLastActivePopup
SetActiveWindow
DispatchMessageW
BeginDeferWindowPos
EndDeferWindowPos
GetDlgItem
GetTopWindow
DestroyWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
PeekMessageW
MapWindowPoints
ScrollWindow
TrackPopupMenu
HideCaret
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
IsWindowVisible
UpdateWindow
GetClientRect
GetMenu
UnregisterClassW
TranslateAcceleratorW
SetMenu
BringWindowToTop
CreatePopupMenu
InsertMenuItemW
LoadAcceleratorsW
LoadMenuW
ReuseDDElParam
UnpackDDElParam
GetSystemMenu
DrawFrameControl
FrameRect
DrawIconEx
GetSubMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
AdjustWindowRectEx
DeferWindowPos
ClipCursor
SetMenuItemInfoW
IsMenu
DrawStateW
IsClipboardFormatAvailable
GetMenuCheckMarkDimensions
CallWindowProcA
ShowWindow
SetTimer
KillTimer
LoadIconW
PostMessageW
PostThreadMessageW
GetNextDlgGroupItem
RegisterClipboardFormatW
SetWindowContextHelpId
MapDialogRect
CharNextW
InvalidateRgn
CopyAcceleratorTableW
MessageBeep
GetAsyncKeyState
RedrawWindow
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcW
DefFrameProcW
UnregisterClassA
GetWindowThreadProcessId
wsprintfW
FindWindowW
GetSystemMetrics
ReleaseDC
GetDC
FillRect
GetScrollInfo
SetScrollInfo
GetDlgCtrlID
CallWindowProcW
SetWindowLongW
SetWindowPos
IntersectRect
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindow
SetRect
EqualRect
SetWindowRgn
GetMenuState
ClientToScreen
GetMenuItemCount
GetMenuItemRect
IsWindow
DefWindowProcW
GetClassInfoW
WindowFromPoint
GetWindowLongW
PtInRect
GetCursorPos
IsRectEmpty
GetParent
IsWindowEnabled
ScreenToClient
GetClassNameW
GetMenuItemID
CopyRect
ChildWindowFromPoint
GetWindowTextW
SetRectEmpty
OffsetRect
SetCursor
LoadImageW
GetSysColor
LoadCursorW
DestroyCursor
SystemParametersInfoW
UpdateLayeredWindow
RegisterClassExW
GetKeyState
GetIconInfo
CopyIcon
CreateIconIndirect

gdi32

GetMapMode
SetRectRgn
Ellipse
LPtoDP
DPtoLP
CreateEllipticRgn
CreateFontW
GetStockObject
CreatePatternBrush
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
RectVisible
PtVisible
GetPixel
GetWindowExtEx
GetViewportExtEx
GetBitmapBits
SetPixel
GetTextColor
GetCurrentObject
Rectangle
SetROP2
RestoreDC
SaveDC
GetBkColor
DeleteObject
CreateCompatibleDC
DeleteDC
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleBitmap
CreatePen
MoveToEx
SetTextColor
CreateSolidBrush
GetObjectW
CreateBitmap
StretchBlt
LineTo
GetTextMetricsW
GetDeviceCaps
SetBkColor
SetBkMode
CreateFontIndirectW
TextOutW
GetTextExtentPoint32W
SetTextJustification
CreatePolygonRgn
CombineRgn
SelectClipRgn
FillRgn
CreateRoundRectRgn
FrameRgn
OffsetRgn
SetMapMode
GetTextExtentPointW
GetRgnBox
PatBlt
CreateRectRgn
GetClipBox
CreateRectRgnIndirect
ExcludeClipRect

msimg32

GradientFill

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumKeyW
RegOpenKeyW
RegQueryValueW
GetUserNameW
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
OpenServiceW
OpenSCManagerW
DeleteService
CloseServiceHandle
QueryServiceStatusEx

shell32

SHGetPathFromIDListW
DragQueryFileW
DragFinish
SHChangeNotify
SHBrowseForFolderW
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHFileOperationW
ShellExecuteW
DragAcceptFiles

comctl32

ImageList_GetImageCount
ImageList_GetIcon
ord17

shlwapi

StrStrIW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
SHDeleteKeyW
PathIsUNCW

ole32

OleInitialize
CLSIDFromString
CoDisconnectObject
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
GetHGlobalFromStream
OleRun
CoCreateInstance
CoCreateGuid
CoInitialize
CoUninitialize
OleUninitialize
CreateILockBytesOnHGlobal
OleIsCurrentClipboard
OleFlushClipboard
CoGetClassObject
StgOpenStorageOnILockBytes
CLSIDFromProgID
CoFreeUnusedLibraries
CoRevokeClassObject
CoRegisterMessageFilter
StgCreateDocfileOnILockBytes

oleaut32

VariantInit
SysAllocString
VariantClear
VariantCopy
SafeArrayGetUBound
LoadTypeLi
VariantChangeType
SysAllocStringLen
SysStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayCreate
SafeArrayRedim
SysFreeString
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
GetErrorInfo
OleCreateFontIndirect

drvmgr

DMGetObject

cab

CabGetObject

gdiplus

GdipCloneImage
GdipDrawImageRectI
GdipSetSmoothingMode
GdiplusShutdown
GdipSetClipRectI
GdipSaveImageToFile
GdiplusStartup
GdipGetImageEncodersSize
GdipLoadImageFromStream
GdipCreateBitmapFromScan0
GdipGetImageHeight
GdipSetInterpolationMode
GdipGetImageWidth
GdipCreateBitmapFromHICON
GdipGetImageEncoders
GdipGraphicsClear
GdipDisposeImageAttributes
GdipBitmapSetPixel
GdipCreateFromHDC
GdipDeleteGraphics
GdipDisposeImage
GdipCreateImageAttributes
GdipFree
GdipGetImageGraphicsContext
GdipBitmapGetPixel
GdipSetImageAttributesColorMatrix
GdipAlloc
GdipDrawImageRectRectI

wininet

InternetGetCookieW
InternetSetCookieW

oledlg

OleUIBusyW

Exports

Exports

??0CXB7z@_7zInterface@@QAE@ABV01@@Z
??0CXB7z@_7zInterface@@QAE@XZ
??1CXB7z@_7zInterface@@UAE@XZ
??4CXB7z@_7zInterface@@QAEAAV01@ABV01@@Z
??_7CXB7z@_7zInterface@@6B@
?_7zGetObject@_7zInterface@@YAPAVCXB7z@1@PA_W@Z

Sections

.text
Size: 688KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 80KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Recorder_2.3.0/Skins/Default/Recorder/Background.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Button.png
.png
Recorder_2.3.0/Skins/Default/Recorder/CheckBox.png
.png
Recorder_2.3.0/Skins/Default/Recorder/EditBox.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Gradient.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Main/CloseBtn.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Main/MinimizeBtn.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Main/config.xml
.xml
Recorder_2.3.0/Skins/Default/Recorder/Pgrs.png
.png
Recorder_2.3.0/Skins/Default/Recorder/Recorder.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/Add.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/Delete.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/MoveDown.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/MoveUp.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/SpeedBtn.png
.png
Recorder_2.3.0/Skins/Default/Recorder/ResInfo/config.xml
.xml
Recorder_2.3.0/Skins/Default/Recorder/SysButton.png
.png
Recorder_2.3.0/使用教程/使用说明.txt

Sharing

General

Malware Config

Signatures

Files

25bcc7010e8e7f0e059da50586853709

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

e6:6b:01:37:9c:4d:1b:b1:73:f7:81:af:8e:47:42:e1:9f:b0:4b:a2Signer

Headers

File Characteristics

Imports

oleaut32

user32

msvcrt

kernel32

Exports

Exports

Sections

.text Size: 612KB - Virtual size: 611KB

.rdata Size: 78KB - Virtual size: 78KB

.data Size: 23KB - Virtual size: 45KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 91KB - Virtual size: 91KB

.reloc Size: 31KB - Virtual size: 31KB

96d8760c062ed4cfe001ba66ac85ef3c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

20:ab:80:95:72:eb:7e:01:33:97:14:d4:b0:ce:fc:7d:8f:36:32:fcSigner

Headers

File Characteristics

PDB Paths

Imports

shlwapi

shell32

user32

kernel32

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 28KB - Virtual size: 24KB

.data Size: 8KB - Virtual size: 23KB

.rsrc Size: 4KB - Virtual size: 960B

.reloc Size: 12KB - Virtual size: 9KB

6b8fc5c5109811e6e3bab35365a128f7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

da:89:be:b9:b6:f3:57:21:50:8f:c3:04:1b:d3:58:a4:07:72:91:a9Signer

Headers

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

e6:6b:01:37:9c:4d:1b:b1:73:f7:81:af:8e:47:42:e1:9f:b0:4b:a2
Signer

.text
Size: 612KB - Virtual size: 611KB

.rdata
Size: 78KB - Virtual size: 78KB

.data
Size: 23KB - Virtual size: 45KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 91KB - Virtual size: 91KB

.reloc
Size: 31KB - Virtual size: 31KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

20:ab:80:95:72:eb:7e:01:33:97:14:d4:b0:ce:fc:7d:8f:36:32:fc
Signer

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 28KB - Virtual size: 24KB

.data
Size: 8KB - Virtual size: 23KB

.rsrc
Size: 4KB - Virtual size: 960B

.reloc
Size: 12KB - Virtual size: 9KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

da:89:be:b9:b6:f3:57:21:50:8f:c3:04:1b:d3:58:a4:07:72:91:a9
Signer

.text
Size: 64KB - Virtual size: 63KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 4KB

PAGE
Size: 7KB - Virtual size: 6KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 6KB - Virtual size: 6KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

61:4b:72:3e:1a:ba:ef:1c:a5:37:3c:bb:8b:31:4f:10:56:40:39:4d
Signer

.text
Size: 64KB - Virtual size: 64KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 4KB - Virtual size: 4KB

PAGE
Size: 7KB - Virtual size: 6KB

INIT
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 3KB

.reloc
Size: 6KB - Virtual size: 6KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

53:1d:93:1d:41:92:a0:ab:36:4c:3d:a6:96:46:0c:c5
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

fa:85:f7:4d:90:77:25:c8:a4:54:48:ef:71:4d:62:07:7c:5d:13:ef
Signer

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 640B - Virtual size: 612B

.data
Size: 4KB - Virtual size: 4KB

INIT
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 946B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate