af7f36c5893ba3c5ef47d94af2b689f1_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

af7f36c5893ba3c5ef47d94af2b689f1_JaffaCakes118
Size

646KB
MD5

af7f36c5893ba3c5ef47d94af2b689f1
SHA1

21ba7b138779c4a92780658c50ef081f55b1abcc
SHA256

9de0e53e340a77ceebda4e1f3a4121f1905b9263392e481c2841c650bee3836f
SHA512

33fc7a1ec143700f8d99572b05c30aaa97b35672247b0a7e2f8c831e2ad4c5385ba7ef33ec3965b9c7de5990376a0f5fcfe50725b683d52ce425e850fe4fd22d
SSDEEP

12288:1fSlLE1I4EbKPXcCYvcDZsP4YySen8XQ0Yy/XI81jZ/vnDSN2MLY64deU3hhiw:1fSpyIdb11vqZs/XB/XnZWN2uOe0x

Score

3^/10

Malware Config

Signatures

Unsigned PE 6 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/AccessControl.dll
unpack001/$PLUGINSDIR/SimpleFC.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

af7f36c5893ba3c5ef47d94af2b689f1_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cc:a3:5c:8e:98:56:41:42:bb:28:73:4f:d3:48:be:bc:ff:76:13:f6
Signer

Actual PE Digest

cc:a3:5c:8e:98:56:41:42:bb:28:73:4f:d3:48:be:bc:ff:76:13:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 116KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/AccessControl.dll
.dll windows:4 windows x86 arch:x86

ed83f419402bc3b83a08e3aaf8b5b5b7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

ConvertStringSidToSidA
LookupAccountNameA
AdjustTokenPrivileges
LookupPrivilegeValueA
GetUserNameA
SetNamedSecurityInfoA
SetEntriesInAclA
BuildExplicitAccessWithNameA
GetNamedSecurityInfoA
OpenProcessToken
LookupAccountSidA
ConvertSidToStringSidA
GetSidSubAuthority
GetSidSubAuthorityCount

kernel32

lstrcmpiA
lstrcpyA
LocalAlloc
lstrlenA
LocalFree
GetLastError
GlobalFree
lstrcpynA
GlobalAlloc
GetFileAttributesA
CloseHandle
GetCurrentProcess
lstrcatA

user32

wsprintfA

Exports

Exports

ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
IsUserTheAdministrator
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 780B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SimpleFC.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

AddApplication
AddPort
AdvAddRule
AdvExistsRule
AdvRemoveRule
AllowDisallowExceptionsNotAllowed
AllowDisallowIcmpInboundEchoRequest
AllowDisallowIcmpInboundMaskRequest
AllowDisallowIcmpInboundRouterRequest
AllowDisallowIcmpInboundTimestampRequest
AllowDisallowIcmpOutboundDestinationUnreachable
AllowDisallowIcmpOutboundPacketTooBig
AllowDisallowIcmpOutboundParameterProblem
AllowDisallowIcmpOutboundSourceQuench
AllowDisallowIcmpOutboundTimeExceeded
AllowDisallowIcmpRedirect
AreExceptionsNotAllowed
AreNotificationsEnabled
EnableDisableApplication
EnableDisableFirewall
EnableDisableNotifications
EnableDisablePort
IsApplicationAdded
IsApplicationEnabled
IsFirewallEnabled
IsFirewallServiceRunning
IsIcmpTypeAllowed
IsPortAdded
IsPortEnabled
RemoveApplication
RemovePort
RestoreDefaults
StartStopFirewallService

Sections

CODE
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 2KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/StartMenu.dll
.dll windows:4 windows x86 arch:x86

a648aeaa164b592c1e8892a10400b5ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrcatA
FindClose
FindNextFileA
MulDiv
GlobalFree
lstrcpynA
GlobalAlloc
lstrcmpiA
FindFirstFileA
lstrcpyA

user32

TranslateMessage
GetMessageA
IsDialogMessageA
PostMessageA
DispatchMessageA
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
CallWindowProcA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 518B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

afa8e526425f3585465337467d0b5909

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetVersion
GetCurrentThread
lstrcpynA
GetCurrentProcess
GetModuleHandleA
GetProcAddress
GetLastError
GlobalFree
CloseHandle
GlobalAlloc

advapi32

OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameA
OpenThreadToken

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 741B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 673B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 190B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/tvnserver.exe
.exe windows:5 windows x86 arch:x86

077350571d96bade5e87cdd310f6eed4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52
Signer

Actual PE Digest

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\const\Documents\svn\tightvnc\branches\2.0-stabilize\scripts\build\output\tvnserver-2.0.4\Release\tvnserver.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

ws2_32

WSAGetLastError
htonl
inet_ntoa
inet_addr
WSACleanup
WSAStartup
gethostbyname
ntohs
htons
ntohl
gethostname
accept
listen
send
closesocket
__WSAFDIsSet
socket
bind
recv
setsockopt
shutdown
getsockname
select
connect

kernel32

ProcessIdToSessionId
Sleep
FindFirstFileW
SetErrorMode
DisconnectNamedPipe
SetNamedPipeHandleState
CreatePipe
SetHandleInformation
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
CreateFileMappingW
CreateEventW
MapViewOfFile
DuplicateHandle
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
ReleaseMutex
GetLogicalDriveStringsW
CreateThread
ResumeThread
SetEndOfFile
SystemTimeToFileTime
GetLocalTime
SetEnvironmentVariableA
RemoveDirectoryW
CompareStringA
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateDirectoryW
SetFileTime
MoveFileW
GlobalUnlock
GlobalAlloc
GlobalLock
GetModuleHandleW
DeleteFileW
CreateMutexW
FindNextFileW
SetEvent
WaitForSingleObject
OpenThread
GetModuleFileNameW
GetVersionExW
GetComputerNameW
GetProcAddress
LoadLibraryW
FreeLibrary
LocalFree
LocalAlloc
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateFileW
SetUnhandledExceptionFilter
GetLastError
FormatMessageW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
FindClose
GetFileSizeEx
UnmapViewOfFile
GetEnvironmentStringsW
GetConsoleMode
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetModuleHandleA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP

user32

SetForegroundWindow
LoadMenuW
RemoveMenu
SetMenuDefaultItem
CloseClipboard
GetMessageW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
ChangeClipboardChain
OpenClipboard
SendMessageW
SetClipboardData
SetClipboardViewer
EnumWindows
IsWindowVisible
RegisterWindowMessageW
DrawIconEx
GetIconInfo
GetCursorInfo
GetWindowRect
GetForegroundWindow
GetClassNameW
GetCursorPos
GetDC
CallNextHookEx
WaitMessage
PeekMessageW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
DispatchMessageW
SendInput
GetWindowInfo
MoveWindow
MapWindowPoints
CreateDialogParamW
EndDialog
SetWindowLongW
GetWindowLongW
DialogBoxParamW
GetSubMenu
SetWindowTextW
ShowWindow
GetWindowTextW
InvalidateRect
SetFocus
EnumChildWindows
DefWindowProcW
RegisterClassW
CreateWindowExW
UnregisterClassW
DestroyIcon
GetClientRect
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
GetThreadDesktop
IsDialogMessageW
TranslateMessage
PostQuitMessage
OpenWindowStationW
CloseWindowStation
SetProcessWindowStation
ExitWindowsEx
LockWorkStation
ToUnicodeEx
GetWindowThreadProcessId
GetKeyboardLayout
GetKeyState
MapVirtualKeyW
VkKeyScanExW
GetSystemMetrics
SetTimer
KillTimer
GetDlgItem
PostMessageW
FindWindowW
SystemParametersInfoW
LoadIconW
LoadStringW
MessageBoxW
TrackPopupMenu
DestroyWindow

gdi32

GetObjectW
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GetCurrentObject
DeleteObject
SelectObject
CreateCompatibleDC
GetBitmapBits

advapi32

ImpersonateNamedPipeClient
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
ControlService
DuplicateToken
DuplicateTokenEx
OpenThreadToken
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegCreateKeyW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSidToSidW
CopySid
GetTokenInformation
OpenProcessToken
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
SetSecurityInfo
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatusEx

shell32

ord680
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
LICENSE.txt
TightVNC Web Site.url
sas.dll.new
.dll windows:6 windows x86 arch:x86

638be5dbbe48f1d5c208636a279a8ed3

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:27:81:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/10/2008, 21:24

Not After

22/01/2010, 21:34

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:7a:c7:69:c7:48:30:08:3b:ed:ba:b3:c8:42:67:41:29:aa:69:44
Signer

Actual PE Digest

b5:7a:c7:69:c7:48:30:08:3b:ed:ba:b3:c8:42:67:41:29:aa:69:44

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

SAS.pdb

Imports

msvcrt

malloc
free
_initterm
_amsg_exit
_except_handler4_common
_XcptFilter
_vsnwprintf

kernel32

UnhandledExceptionFilter
SetLastError
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
GetProcAddress
FreeLibrary
SetUnhandledExceptionFilter
GetCurrentProcess
DisableThreadLibraryCalls
InterlockedExchange
Sleep
InterlockedCompareExchange
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess

rpcrt4

RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
I_RpcExceptionFilter
NdrClientCall2

Exports

Exports

SendSAS

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 864B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 482B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
screenhooks.dll.new
.dll windows:5 windows x86 arch:x86

89170f52f6b39070641ae9add8e3d44d

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:98:b2:86:90:48:35:97:89:a7:58:a2:4d:54:bd:79:8f:35:34:a9
Signer

Actual PE Digest

1e:98:b2:86:90:48:35:97:89:a7:58:a2:4d:54:bd:79:8f:35:34:a9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\const\Documents\svn\tightvnc\branches\2.0-stabilize\scripts\build\output\tvnserver-2.0.4\Release\screenhooks.pdb

Imports

user32

ClientToScreen
GetWindowRect
RegisterWindowMessageW
PostMessageW
CallNextHookEx
GetClientRect
SetWindowsHookExW
UnhookWindowsHookEx
GetSystemMetrics

kernel32

GetEnvironmentStrings
LCMapStringW
LCMapStringA
GetStringTypeW
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
HeapReAlloc
RaiseException
RtlUnwind
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
WriteFile
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeA

Exports

Exports

setHook
unsetHook

Sections

.text
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tvnserver.exe
.exe windows:5 windows x86 arch:x86

077350571d96bade5e87cdd310f6eed4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52
Signer

Actual PE Digest

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\const\Documents\svn\tightvnc\branches\2.0-stabilize\scripts\build\output\tvnserver-2.0.4\Release\tvnserver.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

ws2_32

WSAGetLastError
htonl
inet_ntoa
inet_addr
WSACleanup
WSAStartup
gethostbyname
ntohs
htons
ntohl
gethostname
accept
listen
send
closesocket
__WSAFDIsSet
socket
bind
recv
setsockopt
shutdown
getsockname
select
connect

kernel32

ProcessIdToSessionId
Sleep
FindFirstFileW
SetErrorMode
DisconnectNamedPipe
SetNamedPipeHandleState
CreatePipe
SetHandleInformation
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
CreateFileMappingW
CreateEventW
MapViewOfFile
DuplicateHandle
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
ReleaseMutex
GetLogicalDriveStringsW
CreateThread
ResumeThread
SetEndOfFile
SystemTimeToFileTime
GetLocalTime
SetEnvironmentVariableA
RemoveDirectoryW
CompareStringA
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateDirectoryW
SetFileTime
MoveFileW
GlobalUnlock
GlobalAlloc
GlobalLock
GetModuleHandleW
DeleteFileW
CreateMutexW
FindNextFileW
SetEvent
WaitForSingleObject
OpenThread
GetModuleFileNameW
GetVersionExW
GetComputerNameW
GetProcAddress
LoadLibraryW
FreeLibrary
LocalFree
LocalAlloc
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateFileW
SetUnhandledExceptionFilter
GetLastError
FormatMessageW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
FindClose
GetFileSizeEx
UnmapViewOfFile
GetEnvironmentStringsW
GetConsoleMode
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetModuleHandleA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP

user32

SetForegroundWindow
LoadMenuW
RemoveMenu
SetMenuDefaultItem
CloseClipboard
GetMessageW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
ChangeClipboardChain
OpenClipboard
SendMessageW
SetClipboardData
SetClipboardViewer
EnumWindows
IsWindowVisible
RegisterWindowMessageW
DrawIconEx
GetIconInfo
GetCursorInfo
GetWindowRect
GetForegroundWindow
GetClassNameW
GetCursorPos
GetDC
CallNextHookEx
WaitMessage
PeekMessageW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
DispatchMessageW
SendInput
GetWindowInfo
MoveWindow
MapWindowPoints
CreateDialogParamW
EndDialog
SetWindowLongW
GetWindowLongW
DialogBoxParamW
GetSubMenu
SetWindowTextW
ShowWindow
GetWindowTextW
InvalidateRect
SetFocus
EnumChildWindows
DefWindowProcW
RegisterClassW
CreateWindowExW
UnregisterClassW
DestroyIcon
GetClientRect
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
GetThreadDesktop
IsDialogMessageW
TranslateMessage
PostQuitMessage
OpenWindowStationW
CloseWindowStation
SetProcessWindowStation
ExitWindowsEx
LockWorkStation
ToUnicodeEx
GetWindowThreadProcessId
GetKeyboardLayout
GetKeyState
MapVirtualKeyW
VkKeyScanExW
GetSystemMetrics
SetTimer
KillTimer
GetDlgItem
PostMessageW
FindWindowW
SystemParametersInfoW
LoadIconW
LoadStringW
MessageBoxW
TrackPopupMenu
DestroyWindow

gdi32

GetObjectW
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GetCurrentObject
DeleteObject
SelectObject
CreateCompatibleDC
GetBitmapBits

advapi32

ImpersonateNamedPipeClient
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
ControlService
DuplicateToken
DuplicateTokenEx
OpenThreadToken
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegCreateKeyW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSidToSidW
CopySid
GetTokenInformation
OpenProcessToken
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
SetSecurityInfo
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatusEx

shell32

ord680
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tvnserver.exe.new
.exe windows:5 windows x86 arch:x86

077350571d96bade5e87cdd310f6eed4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52
Signer

Actual PE Digest

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\const\Documents\svn\tightvnc\branches\2.0-stabilize\scripts\build\output\tvnserver-2.0.4\Release\tvnserver.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

ws2_32

WSAGetLastError
htonl
inet_ntoa
inet_addr
WSACleanup
WSAStartup
gethostbyname
ntohs
htons
ntohl
gethostname
accept
listen
send
closesocket
__WSAFDIsSet
socket
bind
recv
setsockopt
shutdown
getsockname
select
connect

kernel32

ProcessIdToSessionId
Sleep
FindFirstFileW
SetErrorMode
DisconnectNamedPipe
SetNamedPipeHandleState
CreatePipe
SetHandleInformation
GetOverlappedResult
CreateNamedPipeW
ConnectNamedPipe
CreateFileMappingW
CreateEventW
MapViewOfFile
DuplicateHandle
WaitForMultipleObjects
GetExitCodeProcess
CreateProcessW
ReleaseMutex
GetLogicalDriveStringsW
CreateThread
ResumeThread
SetEndOfFile
SystemTimeToFileTime
GetLocalTime
SetEnvironmentVariableA
RemoveDirectoryW
CompareStringA
ReadFile
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateDirectoryW
SetFileTime
MoveFileW
GlobalUnlock
GlobalAlloc
GlobalLock
GetModuleHandleW
DeleteFileW
CreateMutexW
FindNextFileW
SetEvent
WaitForSingleObject
OpenThread
GetModuleFileNameW
GetVersionExW
GetComputerNameW
GetProcAddress
LoadLibraryW
FreeLibrary
LocalFree
LocalAlloc
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateFileW
SetUnhandledExceptionFilter
GetLastError
FormatMessageW
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetCurrentProcess
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
FindClose
GetFileSizeEx
UnmapViewOfFile
GetEnvironmentStringsW
GetConsoleMode
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetModuleHandleA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
HeapAlloc
RaiseException
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
VirtualAlloc
HeapReAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP

user32

SetForegroundWindow
LoadMenuW
RemoveMenu
SetMenuDefaultItem
CloseClipboard
GetMessageW
IsClipboardFormatAvailable
GetClipboardData
EmptyClipboard
ChangeClipboardChain
OpenClipboard
SendMessageW
SetClipboardData
SetClipboardViewer
EnumWindows
IsWindowVisible
RegisterWindowMessageW
DrawIconEx
GetIconInfo
GetCursorInfo
GetWindowRect
GetForegroundWindow
GetClassNameW
GetCursorPos
GetDC
CallNextHookEx
WaitMessage
PeekMessageW
PostThreadMessageW
SetWindowsHookExW
UnhookWindowsHookEx
DispatchMessageW
SendInput
GetWindowInfo
MoveWindow
MapWindowPoints
CreateDialogParamW
EndDialog
SetWindowLongW
GetWindowLongW
DialogBoxParamW
GetSubMenu
SetWindowTextW
ShowWindow
GetWindowTextW
InvalidateRect
SetFocus
EnumChildWindows
DefWindowProcW
RegisterClassW
CreateWindowExW
UnregisterClassW
DestroyIcon
GetClientRect
GetUserObjectInformationW
SetThreadDesktop
CloseDesktop
OpenDesktopW
OpenInputDesktop
GetThreadDesktop
IsDialogMessageW
TranslateMessage
PostQuitMessage
OpenWindowStationW
CloseWindowStation
SetProcessWindowStation
ExitWindowsEx
LockWorkStation
ToUnicodeEx
GetWindowThreadProcessId
GetKeyboardLayout
GetKeyState
MapVirtualKeyW
VkKeyScanExW
GetSystemMetrics
SetTimer
KillTimer
GetDlgItem
PostMessageW
FindWindowW
SystemParametersInfoW
LoadIconW
LoadStringW
MessageBoxW
TrackPopupMenu
DestroyWindow

gdi32

GetObjectW
BitBlt
DeleteDC
CreateDIBSection
GetDIBits
GetCurrentObject
DeleteObject
SelectObject
CreateCompatibleDC
GetBitmapBits

advapi32

ImpersonateNamedPipeClient
RevertToSelf
ImpersonateLoggedOnUser
SetTokenInformation
CreateProcessAsUserW
ControlService
DuplicateToken
DuplicateTokenEx
OpenThreadToken
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyW
RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegCreateKeyW
SetEntriesInAclW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSidToSidW
CopySid
GetTokenInformation
OpenProcessToken
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
SetSecurityInfo
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
OpenServiceW
ChangeServiceConfig2W
StartServiceW
QueryServiceStatusEx

shell32

ord680
SHGetSpecialFolderPathW
ShellExecuteExW
ShellExecuteW
Shell_NotifyIconW

comctl32

InitCommonControlsEx

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 510KB - Virtual size: 510KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 193KB - Virtual size: 192KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninstall.exe.nsis
vncviewer.exe.new
.exe windows:5 windows x86 arch:x86

3f5157c5f29a627c6ea7c6660c7843d3

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

30/03/2011, 00:00

Not After

29/03/2012, 23:59

Subject

CN=GlavSoft LLC.,O=GlavSoft LLC.,L=Tomsk,ST=Tomsk,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

03:d3:34:51:3d:36:38:20:d0:4a:8d:76:3e:36:96:91:0c:5c:58:b4
Signer

Actual PE Digest

03:d3:34:51:3d:36:38:20:d0:4a:8d:76:3e:36:96:91:0c:5c:58:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

PlaySoundA

wsock32

send
WSAStartup
WSACleanup
inet_ntoa
bind
WSAAsyncSelect
listen
accept
getpeername
connect
ioctlsocket
WSAGetLastError
htons
shutdown
setsockopt
recv
socket
closesocket
gethostbyname

comctl32

ImageList_Create
ImageList_Destroy
CreateToolbarEx
ImageList_ReplaceIcon

kernel32

GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
SetEndOfFile
MoveFileA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateDirectoryA
RemoveDirectoryA
GetModuleHandleA
FreeLibrary
TlsGetValue
GetCurrentProcess
WaitForSingleObject
GetCurrentThread
TlsSetValue
CreateSemaphoreA
SetThreadPriority
DuplicateHandle
TlsAlloc
ResumeThread
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
GetCurrentDirectoryA
GetDateFormatA
GetTimeFormatA
GetLocalTime
GetStringTypeA
GetLocaleInfoA
GetConsoleMode
GetConsoleCP
SetFilePointer
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSectionAndSpinCount
GetDriveTypeA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
HeapReAlloc
VirtualAlloc
VirtualFree
HeapCreate
HeapSize
InterlockedDecrement
SetLastError
InterlockedIncrement
TlsFree
RtlUnwind
RaiseException
CreateThread
ExitThread
GetStartupInfoA
GetCommandLineA
ExitProcess
GetModuleHandleW
GetFullPathNameA
GetFileAttributesA
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LoadLibraryA
GetProcAddress
GetModuleFileNameA
DeleteFileA
CloseHandle
FindNextFileA
FindClose
GetLogicalDriveStringsA
FindFirstFileA
ReadFile
WriteFile
SetFileTime
SetErrorMode
CreateFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GlobalFree
GlobalUnlock
GlobalAlloc
GetUserDefaultLCID
GlobalLock
LocalFree
GetLastError
Beep
Sleep
FormatMessageA
FileTimeToSystemTime
FileTimeToLocalFileTime
GetStringTypeW
GetFileSizeEx

user32

CallWindowProcA
GetKeyboardLayout
ToUnicodeEx
IsDialogMessageA
LoadKeyboardLayoutA
GetMessageW
GetWindowTextLengthA
FindWindowA
GetDlgItemTextA
GetKeyState
GetKeyboardState
DestroyAcceleratorTable
CreateAcceleratorTableA
TranslateAcceleratorA
CreateDialogParamA
TranslateMessage
GetWindowTextA
PeekMessageA
DispatchMessageA
LoadImageA
DestroyIcon
RegisterClassExA
TrackPopupMenu
GetSubMenu
LoadMenuA
SetMenuDefaultItem
DestroyMenu
GetDlgItem
EnableWindow
SetCursorPos
GetCursorPos
GetSystemMetrics
CloseClipboard
GetClipboardData
EmptyClipboard
OpenClipboard
SetClipboardData
GetClipboardOwner
EndPaint
DestroyWindow
SetWindowPlacement
SetCursor
GetSystemMenu
SetTimer
ScreenToClient
GetWindowRect
PostQuitMessage
IsIconic
KillTimer
DrawTextA
SetForegroundWindow
GetFocus
LoadIconA
WindowFromPoint
GetClientRect
SetFocus
SendMessageA
BeginPaint
GetDC
GetForegroundWindow
GetWindowPlacement
SetRect
SetWindowLongA
MessageBoxA
InvalidateRect
GetWindowLongA
CreateWindowExA
ReleaseDC
EnableMenuItem
SetClassLongA
GetMenuState
ChangeClipboardChain
DefWindowProcA
SetWindowPos
ShowWindow
GetSysColorBrush
DrawMenuBar
AppendMenuA
ShowScrollBar
PostMessageA
AdjustWindowRectEx
SystemParametersInfoA
ScrollWindowEx
UpdateWindow
LoadCursorA
SetClipboardViewer
SetScrollInfo
CheckMenuItem
RegisterClassA
GetWindow
GetKeyboardLayoutNameA
LoadStringA
EndDialog
SetWindowTextA
DialogBoxParamA
SetDlgItemTextA
CopyRect
DrawFrameControl
FrameRect
GetSysColor
OffsetRect
DrawStateA
InflateRect
DrawFocusRect
TrackMouseEvent
FillRect
GetMenuItemID
SetThreadDesktop
CloseDesktop
OpenInputDesktop

gdi32

SetPixelV
SetTextColor
DeleteDC
GetDeviceCaps
UpdateColors
ExtTextOutA
GetStockObject
SetStretchBltMode
SelectPalette
RealizePalette
CreateCompatibleBitmap
CreateCompatibleDC
CreateSolidBrush
GetTextMetricsA
DeleteObject
CreatePalette
SetBkColor
SetBrushOrgEx
SetBkMode
BitBlt
StretchBlt
SelectObject

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

advapi32

RegEnumKeyA
RegCreateKeyA
RegSetValueA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegCloseKey

shell32

SHGetSpecialFolderPathA
Shell_NotifyIconA
ShellExecuteA

Sections

.text
Size: 339KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03Certificate

Extended Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

cc:a3:5c:8e:98:56:41:42:bb:28:73:4f:d3:48:be:bc:ff:76:13:f6Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 116KB

.rsrc Size: 7KB - Virtual size: 7KB

ed83f419402bc3b83a08e3aaf8b5b5b7

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 348B

.reloc Size: 1024B - Virtual size: 780B

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 148KB - Virtual size: 148KB

DATA Size: 3KB - Virtual size: 2KB

BSS Size: - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.edata Size: 1KB - Virtual size: 1KB

.reloc Size: 10KB - Virtual size: 10KB

.rsrc Size: 7KB - Virtual size: 7KB

a648aeaa164b592c1e8892a10400b5ae

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

ole32

Exports

Exports

Sections

.text Size: 3KB - Virtual size: 2KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 512B - Virtual size: 296B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

cc:a3:5c:8e:98:56:41:42:bb:28:73:4f:d3:48:be:bc:ff:76:13:f6
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 116KB

.rsrc
Size: 7KB - Virtual size: 7KB

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 348B

.reloc
Size: 1024B - Virtual size: 780B

CODE
Size: 148KB - Virtual size: 148KB

DATA
Size: 3KB - Virtual size: 2KB

BSS
Size: - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.edata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 10KB - Virtual size: 10KB

.rsrc
Size: 7KB - Virtual size: 7KB

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 512B - Virtual size: 296B

.reloc
Size: 1024B - Virtual size: 518B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1024B - Virtual size: 741B

.rdata
Size: 1024B - Virtual size: 673B

.data
Size: 512B - Virtual size: 88B

.reloc
Size: 512B - Virtual size: 190B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 572B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

38:7f:dd:e4:84:88:5e:72:90:82:1d:87:4f:86:07:03
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

ab:fd:93:21:1e:f3:5b:61:8d:b6:3e:a1:d8:a9:16:f5:bb:c2:94:52
Signer