67cd15250159a68ed4f714dffe2319669a4841bb3b5e784b76a32e0779459f46

Sharing

Copy URL Twitter E-mail

General

Target

67cd15250159a68ed4f714dffe2319669a4841bb3b5e784b76a32e0779459f46
Size

2.3MB
MD5

113ee52935e497de5afc7882bda3d069
SHA1

8fa33d7e05c87aac2e61b0cba80a4fa5854ed33e
SHA256

67cd15250159a68ed4f714dffe2319669a4841bb3b5e784b76a32e0779459f46
SHA512

3d57d78722ad675d9fb79b9878b8eef432545701f2fbc153a8dd0974a36b31cd667f06d02b652e78493269d3999ddde0cc3620fdc6f3e52dda4b7e7d75ce3838
SSDEEP

49152:jn8LsJ+zzjgDB2vOkZELhfH/0FKZ1oLGts9IDyiWGQRwA8:j9+zzjWYvDKL5fIQoGts9Q4wA8

Score

1^/10

Malware Config

Signatures

Files

67cd15250159a68ed4f714dffe2319669a4841bb3b5e784b76a32e0779459f46
.zip
7z.dll
.dll windows:5 windows x86 arch:x86

cd489efe557cd42acdc90e4d9ec4c09c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

11/03/2013, 00:00

Not After

10/03/2016, 23:59

Subject

CN=Qihoo 360 Software (Beijing) Company Limited,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Tech. Dev. Dept.,O=Qihoo 360 Software (Beijing) Company Limited,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b0:ba:a0:63:d2:08:8e:84:74:f9:6c:6e:74:ca:0e:94:f9:d3:45:85
Signer

Actual PE Digest

b0:ba:a0:63:d2:08:8e:84:74:f9:6c:6e:74:ca:0e:94:f9:d3:45:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\vmagent_new\bin\joblist\29113\out\Release\7z.pdb

Imports

kernel32

GetVersionExA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
WaitForMultipleObjects
VirtualAlloc
VirtualFree
GetProcAddress
GetModuleHandleA
CloseHandle
WaitForSingleObject
CreateEventA
SetEvent
ResetEvent
CreateSemaphoreA
ReleaseSemaphore
InitializeCriticalSection
LocalFileTimeToFileTime
FileTimeToLocalFileTime
CompareFileTime
SetCurrentDirectoryA
AreFileApisANSI
SetFileTime
CreateFileW
SetLastError
SetFileAttributesA
RemoveDirectoryA
MoveFileA
CreateDirectoryA
DeleteFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetWindowsDirectoryW
GetSystemDirectoryW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
CreateDirectoryW
DeleteFileW
GetShortPathNameA
lstrlenA
GetFullPathNameA
GetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
SearchPathA
GetTempPathA
GetTempPathW
GetTempFileNameA
GetTempFileNameW
GetFullPathNameW
SearchPathW
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationA
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FindFirstChangeNotificationW
GetLogicalDriveStringsA
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
GetFileInformationByHandle
ReadFile
WriteFile
SetEndOfFile
CreateFileA
GetSystemInfo
GlobalMemoryStatus
DosDateTimeToFileTime
FileTimeToDosDateTime
SystemTimeToFileTime
GetSystemTime
CompareStringW
CompareStringA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
RtlUnwind
RaiseException
HeapAlloc
HeapFree
HeapReAlloc
ExitThread
CreateThread
GetCommandLineA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FatalAppExitA
HeapCreate
HeapDestroy
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSize
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
SetEnvironmentVariableA

user32

CharPrevA
CharToOemA
CharNextA
CharLowerW
CharUpperW
CharLowerA
CharUpperA
CharPrevExA

oleaut32

VariantCopy
SysFreeString
VariantClear
SysAllocString
SysAllocStringByteLen

Exports

Exports

CreateObject
GetHandlerProperty
GetHandlerProperty2
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetLargePageMode

Sections

.text
Size: 753KB - Virtual size: 752KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
CefHelper.dll
.dll windows:5 windows x86 arch:x86

19f3b7f4c1b3f623a26a597d95a7b7da

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8e:93:53:94:56:bf:4e:f3:0e:ac:bc:89:04:07:6a:e4:97:3d:52:ad:1b:c6:fe:87:d8:e9:2b:e4:47:c2:f0:cf
Signer

Actual PE Digest

8e:93:53:94:56:bf:4e:f3:0e:ac:bc:89:04:07:6a:e4:97:3d:52:ad:1b:c6:fe:87:d8:e9:2b:e4:47:c2:f0:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\cefhelper\cef_helper\Release\CefHelper.pdb

Imports

kernel32

GetProcessHeap
LoadResource
SizeofResource
GetModuleFileNameW
FindResourceW
FindResourceExW
CopyFileW
MultiByteToWideChar
GetProcAddress
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
CloseHandle
CreateEventW
LoadLibraryW
GetTempPathW
DeleteFileW
FreeLibrary
HeapSize
WaitForMultipleObjects
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
GetModuleHandleW
FlushFileBuffers
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
WaitForSingleObject
LockResource
WriteConsoleW
ReadConsoleW
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
WideCharToMultiByte
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
LocalFree
GetCurrentProcessId
GetCurrentThreadId
ReleaseMutex
CreateMutexW
LoadLibraryExW
GetVersionExW
ReadFile
SetFilePointer
CreateFileW
SetFileTime
CreateDirectoryW
SetFileAttributesW
FindClose
FindFirstFileW
GetFileSize
WriteFile
SetEndOfFile
GetStdHandle
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
InterlockedFlushSList
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW

user32

wsprintfW

ole32

CoCreateGuid

shlwapi

PathAppendW
SHGetValueW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
StrStrIW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

crypt32

CertGetNameStringW

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

shell32

ord165

oleaut32

VariantClear
SysAllocString

Exports

Exports

ScriptStart
SetProductInfo
Start
StartEx
StartFlashEx
StartFlashWithProcessEx
StartWithProgress
StartWithProgressEx
Stop

Sections

.text
Size: 300KB - Virtual size: 300KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ12.dll
.dll regsvr32 windows:5 windows x86 arch:x86

b1660ba9d1af87c46e71a5caff0a7150

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f3:f3:75:9b:55:5d:8b:da:7d:e7:80:28:e7:f3:f4:9c:5c:17:04:d5:4e:6d:ae:35:65:e8:50:12:f4:ae:e8:19
Signer

Actual PE Digest

f3:f3:75:9b:55:5d:8b:da:7d:e7:80:28:e7:f3:f4:9c:5c:17:04:d5:4e:6d:ae:35:65:e8:50:12:f4:ae:e8:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\ComputerZ12_Grab_Version\hookhomepage_1145\Release\ComputerZ12.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
lstrlenW
GlobalDeleteAtom
GlobalFindAtomW
OpenEventW
SetLastError
GetPrivateProfileStringW
OpenProcess
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
ResetEvent
DeviceIoControl
CreateFileW
lstrcmpiW
WriteFile
ReadFile
GetLocalTime
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ResumeThread
LocalFileTimeToFileTime
WaitForSingleObjectEx
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
GetFileSize
GetCurrentThread
GetProcAddress
FreeLibrary
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetTickCount
CloseHandle
WaitForMultipleObjects
TerminateProcess
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
SetStdHandle
ReadConsoleW
GetStdHandle
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetFileType
GetModuleHandleExW
InitializeCriticalSection
RtlUnwind
CreateSemaphoreW
InitializeCriticalSectionEx
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
GetCurrentProcessId
InterlockedCompareExchange
LoadLibraryW
LocalFree
GetVersionExW
GetModuleHandleW
GetCurrentProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
SetEvent
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
DuplicateHandle
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetSystemWindowsDirectoryW
FreeResource
Sleep
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
SuspendThread
SetThreadContext
GetThreadContext
GetCurrentThreadId
RaiseException
GetProcessHeap
VirtualQuery
VirtualProtect
FlushFileBuffers
DosDateTimeToFileTime
SetFileTime
SetEndOfFile
GetStartupInfoW
DecodePointer
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetFilePointer
OpenFileMappingW
LoadLibraryExW
ReleaseSemaphore
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
FindNextFileA
GetFileSizeEx
CopyFileW
CreateMutexW
ReleaseMutex
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
ExitThread
EncodePointer
OutputDebugStringW
IsDebuggerPresent

user32

SetWindowsHookExW
UnhookWindowsHookEx
SendMessageTimeoutW
PostMessageW
IsWindow
SetRect
OffsetRect
PtInRect
SetCursor
LoadCursorW
BeginPaint
wsprintfW
EndPaint
IsRectEmpty
GetMessageW
FindWindowExW
GetWindowThreadProcessId
FindWindowW
ReleaseDC
EnumWindows
GetMonitorInfoW
GetDC
MonitorFromPoint
EnumDisplaySettingsW
GetWindow
GetShellWindow
GetDesktopWindow
WindowFromPoint
GetWindowRect
GetForegroundWindow
TranslateMessage
DispatchMessageW
PeekMessageW
DefWindowProcW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
SetWindowLongW
UnregisterClassW
GetWindowLongW
SetTimer
CallNextHookEx
GetWindowInfo
GetClassNameW
GetAncestor
MonitorFromWindow
GetParent
MapWindowPoints
InvalidateRect
SetForegroundWindow
GetDlgItem
DestroyWindow
PostQuitMessage
SendMessageW
SystemParametersInfoW
CopyRect
GetClientRect
SetWindowRgn
KillTimer
IsWindowVisible
UpdateLayeredWindow
ShowWindow
SetWindowPos

gdi32

EnumFontFamiliesW
CreateRectRgn
CreateCompatibleBitmap
CombineRgn
SetViewportOrgEx
SelectObject
DeleteDC
CreateCompatibleDC
BitBlt
DeleteObject
CreateFontW

advapi32

OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
GetTokenInformation

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHCreateDirectoryExW

ole32

CLSIDFromString
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx

shlwapi

StrCmpIW
SHGetValueW
StrStrNIW
SHDeleteKeyW
PathCombineW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIA
PathIsRootW
PathIsRelativeW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
SHSetValueW
StrStrIW
PathIsDirectoryW
PathFindFileNameW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreateImageAttributes
GdipDrawImagePointRectI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipSetTextRenderingHint
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont

ws2_32

ntohs

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
HookTaskBar
InstallHook
UnHookTaskBar
Uninst

Sections

.text
Size: 878KB - Virtual size: 878KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ12_helper_x64.exe
.exe windows:6 windows x64 arch:x64

d35e20d79d00a868ccda74f589bfc50d

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41
Signer

Actual PE Digest

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\ComputerZ12\hookhomepage_normal\Release\ComputerZ12_helper_x64.pdb

Imports

kernel32

LoadLibraryW
GetProcAddress
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
MultiByteToWideChar
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
LockResource
FreeLibrary
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
LoadResource
SizeofResource
LoadLibraryExW
FindResourceW
FindResourceExW
WideCharToMultiByte
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
OpenFileMappingW
DeleteFileW
GetFileSizeEx
ReadFile
CloseHandle
CreateFileW
GetStringTypeW
FormatMessageW
EncodePointer
SetLastError
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
CompareStringW
HeapDestroy
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
LocalFree
GetCurrentProcessId
GetCurrentThreadId
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCurrentProcess
WriteFile
FindClose
FindNextFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
QueryPerformanceCounter
InitializeSListHead
FlushFileBuffers
RtlPcToFileHeader
RtlUnwindEx
GetFileType
SetFilePointerEx
GetConsoleCP
GetConsoleMode
GetTimeZoneInformation
ExitProcess
GetModuleHandleExW
GetStdHandle
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetStdHandle
SetEndOfFile
ReadConsoleW
WriteConsoleW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetLastError
RaiseException
LCMapStringW
DecodePointer

user32

wsprintfW

shlwapi

PathAppendW
PathFileExistsW
StrStrIW
PathRemoveFileSpecW
PathIsDirectoryW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

urlmon

URLDownloadToCacheFileW

advapi32

RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW

Sections

.text
Size: 336KB - Virtual size: 336KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ12_x64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

ac0be52c54588ee2e3b1fe6eb8b75a6c

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

28/05/2024, 23:59

Subject

CN=Chengdu Qilu Technology Co. Ltd.,O=Chengdu Qilu Technology Co. Ltd.,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3b:01:f4:ee:d3:ea:4c:f8:64:3e:3e:f7:8a:1b:a2:41:77:ff:9c:33:c6:58:f6:8a:94:61:36:3e:81:d7:65:26
Signer

Actual PE Digest

3b:01:f4:ee:d3:ea:4c:f8:64:3e:3e:f7:8a:1b:a2:41:77:ff:9c:33:c6:58:f6:8a:94:61:36:3e:81:d7:65:26

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Jenkins\.jenkins\workspace\lib_common\ComputerZ12_Grab_Version\hookhomepage_1145\Release\ComputerZ12_x64_x64.pdb

Imports

kernel32

SetLastError
GetPrivateProfileStringW
OpenProcess
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
ResetEvent
DeviceIoControl
CreateFileW
GetFileSize
WriteFile
ReadFile
OpenEventW
RemoveDirectoryW
SetFileAttributesW
GetFileAttributesW
ResumeThread
LocalFileTimeToFileTime
WaitForSingleObjectEx
CreateWaitableTimerW
SetWaitableTimer
CancelWaitableTimer
RtlUnwind
GetLocalTime
GlobalFindAtomW
Process32FirstW
CreateToolhelp32Snapshot
LoadLibraryW
GetProcAddress
FreeLibrary
DeleteFileW
CreateDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetModuleFileNameW
CreateEventW
GetTickCount
CloseHandle
WaitForMultipleObjects
GlobalDeleteAtom
LeaveCriticalSection
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExA
WriteConsoleW
SetStdHandle
ReadConsoleW
GetACP
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetModuleFileNameA
ExitProcess
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetFilePointerEx
GetModuleHandleExW
ExitThread
InitializeCriticalSection
RtlUnwindEx
CreateSemaphoreW
InitializeCriticalSectionEx
WaitNamedPipeW
WaitForMultipleObjectsEx
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
lstrlenW
lstrcmpiW
GetCurrentThread
TerminateProcess
Process32NextW
GetCurrentProcessId
LocalFree
GetVersionExW
GetModuleHandleW
GetCurrentProcess
SetEvent
WideCharToMultiByte
MultiByteToWideChar
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
InterlockedFlushSList
DuplicateHandle
GetModuleHandleA
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
CreateThread
SignalObjectAndWait
GetFileType
GetStdHandle
GetSystemWindowsDirectoryW
FreeResource
Sleep
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
GetCurrentThreadId
RaiseException
GetProcessHeap
SuspendThread
SetThreadContext
GetThreadContext
VirtualQuery
VirtualProtect
FlushFileBuffers
DosDateTimeToFileTime
SetFileTime
SetEndOfFile
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DecodePointer
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetFilePointer
OpenFileMappingW
LoadLibraryExW
ReleaseSemaphore
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
FindNextFileA
GetFileSizeEx
CopyFileW
CreateMutexW
ReleaseMutex
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
QueryPerformanceCounter
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
LoadLibraryExA
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
RtlPcToFileHeader
VirtualFree
VirtualAlloc
FlushInstructionCache
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList

user32

SetWindowsHookExW
UnhookWindowsHookEx
SendMessageTimeoutW
PostMessageW
IsWindow
SetRect
OffsetRect
PtInRect
SetCursor
LoadCursorW
BeginPaint
EndPaint
IsRectEmpty
GetMessageW
TranslateMessage
FindWindowExW
GetWindowThreadProcessId
FindWindowW
GetDesktopWindow
ReleaseDC
GetDC
GetParent
WindowFromPoint
GetWindowRect
GetForegroundWindow
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
SetTimer
wsprintfW
DispatchMessageW
PeekMessageW
DefWindowProcW
CallWindowProcW
SetWindowPos
UnregisterClassW
CreateWindowExW
GetClassInfoExW
CallNextHookEx
GetShellWindow
GetClassNameW
EnumWindows
MonitorFromWindow
GetWindow
MapWindowPoints
InvalidateRect
SetForegroundWindow
GetDlgItem
DestroyWindow
PostQuitMessage
SendMessageW
SystemParametersInfoW
CopyRect
GetClientRect
SetWindowRgn
KillTimer
IsWindowVisible
UpdateLayeredWindow
ShowWindow
GetAncestor
GetWindowInfo
GetMonitorInfoW
MonitorFromPoint
EnumDisplaySettingsW
RegisterClassExW

gdi32

CreateCompatibleDC
CreateRectRgn
CreateCompatibleBitmap
CombineRgn
SetViewportOrgEx
SelectObject
DeleteDC
BitBlt
EnumFontFamiliesW
DeleteObject
CreateFontW

advapi32

GetTokenInformation
OpenProcessToken
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegGetValueW
RegQueryValueExW
RegNotifyChangeKeyValue
RegSetValueExW
RegDeleteKeyW
RegCreateKeyExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey

shell32

CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ord165
SHCreateDirectoryExW

ole32

CLSIDFromString
CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance
CoInitializeEx

shlwapi

StrCmpIW
SHGetValueW
PathFindFileNameW
SHDeleteKeyW
PathCombineW
PathIsDirectoryW
StrTrimA
StrCmpNIW
SHSetValueA
SHGetValueA
StrStrIA
PathIsRootW
PathIsRelativeW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
SHSetValueW
StrStrNIW
StrStrIW

comctl32

_TrackMouseEvent
InitCommonControlsEx

gdiplus

GdipCreateImageAttributes
GdipDrawImagePointRectI
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdiplusStartup
GdipAlloc
GdipFree
GdipCloneImage
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdipCreateFromHDC
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipDeleteBrush
GdipCreateSolidFill
GdipDisposeImageAttributes
GdipCreateStringFormat
GdipMeasureString
GdipDrawString
GdipSetImageAttributesColorMatrix
GdipSetTextRenderingHint
GdipCreateFontFamilyFromName
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont

ws2_32

ntohs

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetGetConnectedState
InternetOpenW
InternetCloseHandle
InternetOpenUrlW
InternetReadFile

urlmon

URLDownloadToCacheFileW
URLDownloadToFileW

psapi

GetProcessImageFileNameW
EnumProcessModules
GetModuleFileNameExW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

iphlpapi

GetAdaptersInfo

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer
HookTaskBar
InstallHook
UnHookTaskBar
Uninst

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ComputerZ14.exe
.exe windows:5 windows x86 arch:x86

032389bb37a444d0f480b6c2e4dd9897

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:fd:3e:81:a2:3e:67:96:8b:af:99:9b:7a:1b:3b:bc
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/09/2020, 00:00

Not After

03/11/2021, 12:00

Subject

CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11/02/2011, 12:00

Not After

10/02/2026, 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:40:d3:8f:ff:0f:6e:d2:9e:05:c9:9c:d2:ef:6d:4f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/09/2020, 00:00

Not After

03/11/2021, 12:00

Subject

CN=成都奇鲁科技有限公司,O=成都奇鲁科技有限公司,L=成都市,ST=四川省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:e8:7d:75:03:55:7a:1a:c5:06:89:42:f2:46:8b:34:7e:02:bd:c5:bc:ae:c3:25:70:c0:ff:af:f9:df:9c:c7
Signer

Actual PE Digest

74:e8:7d:75:03:55:7a:1a:c5:06:89:42:f2:46:8b:34:7e:02:bd:c5:bc:ae:c3:25:70:c0:ff:af:f9:df:9c:c7

Digest Algorithm

sha256

PE Digest Matches

true

80:42:90:73:2a:19:e0:dd:71:08:f5:5b:d6:ae:26:c5:45:43:3d:53
Signer

Actual PE Digest

80:42:90:73:2a:19:e0:dd:71:08:f5:5b:d6:ae:26:c5:45:43:3d:53

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build\lib_common\ComputerZ14\Release\ComputerZ14.pdb

Imports

gdiplus

GdiplusShutdown
GdipDeleteBrush
GdipCreateSolidFill
GdipFillRectangleI
GdiplusStartup
GdipDrawImageRectRect
GdipDeleteGraphics
GdipCreateFromHDC
GdipGetImageHeight
GdipGetImageWidth

kernel32

LoadLibraryW
FreeLibrary
GetModuleFileNameW
lstrcmpiW
RaiseException
LoadLibraryExW
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
DecodePointer
GetCommandLineW
InitializeCriticalSection
SetLastError
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetLocalTime
GetTickCount
CreateMutexW
ReleaseMutex
WaitForSingleObjectEx
CreateToolhelp32Snapshot
Process32FirstW
GetCurrentProcessId
Process32NextW
GetLongPathNameW
OpenProcess
GetShortPathNameW
Sleep
MoveFileExW
ReadFile
WriteFile
SizeofResource
GetFileSize
GetCurrentProcess
InterlockedPopEntrySList
SetStdHandle
EnterCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetFileType
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
RtlUnwind
CreateFileA
GetSystemDirectoryW
lstrcmpiA
lstrcmpA
DeviceIoControl
QueryPerformanceCounter
GetStartupInfoW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CloseHandle
CreateFileW
GetVersionExW
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
LeaveCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetLastError
MultiByteToWideChar
WideCharToMultiByte
ReadConsoleW
SetFilePointerEx
WriteConsoleW
SetEndOfFile
LoadResource
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
InterlockedPushEntrySList
LockResource
FlushFileBuffers
FlushInstructionCache
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateEventW
LoadLibraryExA

user32

SetCursor
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
OffsetRect
DefWindowProcW
DestroyWindow
UnregisterClassW
RegisterClassExW
SendMessageW
PostMessageW
SetWindowPos
PostQuitMessage
GetParent
CopyRect
UnionRect
EqualRect
PtInRect
ShowWindow
InvalidateRect
DrawFocusRect
SendMessageTimeoutW
GetWindowThreadProcessId
FindWindowExW
PeekMessageW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetWindowLongW
KillTimer
SetTimer
IsWindow
GetWindowLongW
ReleaseCapture
UpdateLayeredWindow
GetWindowRect
ReleaseDC
GetDC
GetClientRect
GetAsyncKeyState
ScreenToClient
EndPaint
BeginPaint
SetCapture
CallWindowProcW

gdi32

RectVisible
SaveDC
RestoreDC
CreateRectRgnIndirect
SelectClipRgn
GetObjectW
BitBlt
SetViewportOrgEx
SelectObject
CreateCompatibleBitmap
CreateDIBSection
CreateCompatibleDC
DeleteObject
DeleteDC
OffsetViewportOrgEx

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueW
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW

shell32

SHCreateDirectoryExW
ord165
SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree

oleaut32

VarUI4FromStr

shlwapi

PathAppendW
PathFileExistsW
SHSetValueW
StrStrIW
SHSetValueA
SHGetValueA
StrCmpIW
SHDeleteValueW
PathFindFileNameW
PathCombineW
SHGetValueW
PathIsRelativeW
PathIsRootW
PathRemoveFileSpecW

comctl32

_TrackMouseEvent
InitCommonControlsEx

ws2_32

WSACleanup
WSAStartup

psapi

GetModuleFileNameExW

crypt32

CertGetNameStringW

wintrust

WTHelperProvDataFromStateData
WinVerifyTrust

Sections

.text
Size: 357KB - Virtual size: 357KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd489efe557cd42acdc90e4d9ec4c09c

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:beCertificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

b0:ba:a0:63:d2:08:8e:84:74:f9:6c:6e:74:ca:0e:94:f9:d3:45:85Signer

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

oleaut32

Exports

Exports

Sections

.text Size: 753KB - Virtual size: 752KB

.rdata Size: 150KB - Virtual size: 150KB

.data Size: 29KB - Virtual size: 54KB

.rsrc Size: 95KB - Virtual size: 95KB

.reloc Size: 42KB - Virtual size: 41KB

19f3b7f4c1b3f623a26a597d95a7b7da

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

8e:93:53:94:56:bf:4e:f3:0e:ac:bc:89:04:07:6a:e4:97:3d:52:ad:1b:c6:fe:87:d8:e9:2b:e4:47:c2:f0:cfSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ole32

shlwapi

version

crypt32

wintrust

shell32

oleaut32

Exports

Exports

Sections

.text Size: 300KB - Virtual size: 300KB

.rdata Size: 89KB - Virtual size: 89KB

.data Size: 6KB - Virtual size: 9KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 16KB - Virtual size: 15KB

b1660ba9d1af87c46e71a5caff0a7150

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25Certificate

Extended Key Usages

Key Usages

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

51:bd:5d:8e:45:b8:2a:02:10:f1:7f:e4:c5:23:34:68
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

b0:ba:a0:63:d2:08:8e:84:74:f9:6c:6e:74:ca:0e:94:f9:d3:45:85
Signer

.text
Size: 753KB - Virtual size: 752KB

.rdata
Size: 150KB - Virtual size: 150KB

.data
Size: 29KB - Virtual size: 54KB

.rsrc
Size: 95KB - Virtual size: 95KB

.reloc
Size: 42KB - Virtual size: 41KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

8e:93:53:94:56:bf:4e:f3:0e:ac:bc:89:04:07:6a:e4:97:3d:52:ad:1b:c6:fe:87:d8:e9:2b:e4:47:c2:f0:cf
Signer

.text
Size: 300KB - Virtual size: 300KB

.rdata
Size: 89KB - Virtual size: 89KB

.data
Size: 6KB - Virtual size: 9KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 16KB - Virtual size: 15KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

f3:f3:75:9b:55:5d:8b:da:7d:e7:80:28:e7:f3:f4:9c:5c:17:04:d5:4e:6d:ae:35:65:e8:50:12:f4:ae:e8:19
Signer

.text
Size: 878KB - Virtual size: 878KB

.rdata
Size: 203KB - Virtual size: 203KB

.data
Size: 23KB - Virtual size: 40KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 44KB - Virtual size: 44KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

05:de:6c:1e:6d:cb:34:df:98:69:ae:dc:15:7f:07:25
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

b2:2f:cd:67:5b:69:6b:2a:13:fe:d2:67:b2:44:bf:e2:75:c5:89:ba:f5:82:73:07:df:d9:3a:a5:5c:7b:0b:41
Signer

.text
Size: 336KB - Virtual size: 336KB

.rdata
Size: 138KB - Virtual size: 137KB

.data
Size: 10KB - Virtual size: 17KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB