be5c0e70465ebda10b784a1bf7ed105b_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

be5c0e70465ebda10b784a1bf7ed105b_JaffaCakes118
Size

4.1MB
MD5

be5c0e70465ebda10b784a1bf7ed105b
SHA1

1c1bf36386c8feb57982ad3bbb3701002a9a95cf
SHA256

454957b679b051b8659c8a2a660728426d22f73e9514e5611475ec08cddb10f8
SHA512

86f01ed9d37852f25fbf05928f31e776ca309fde47c78557bf43d90f5bb2cd952d3dfb30ccb7fd4840118abc07022eeec1f0b0d52196cee318bfab2b946a4b30
SSDEEP

98304:1JbM6YwBO7XSTxobPKo0AfEsE7q3Ed2ut8bmZO1c:11YwFibPt0Afz6p01c

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/usbhdd.exe	upx

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/inetc.dll
unpack002/OpenHardwareMonitor/Aga.Controls.dll
unpack002/OpenHardwareMonitor/OpenHardwareMonitor.exe
unpack002/OpenHardwareMonitor/OpenHardwareMonitorLib.dll
unpack002/OpenHardwareMonitor/OxyPlot.WindowsForms.dll
unpack002/OpenHardwareMonitor/OxyPlot.dll
unpack002/VirusTotalUpload.exe
unpack003/out.upx

Files

be5c0e70465ebda10b784a1bf7ed105b_JaffaCakes118
.zip
taskpro.exe
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f0:7c:26:f0:ca:c4:58:2e:00:20:1a:e6:4e:a1:f9:a1:51:95:13:e1:14:2e:02:ad:5e:34:a5:14:23:6d:54:43
Signer

Actual PE Digest

f0:7c:26:f0:ca:c4:58:2e:00:20:1a:e6:4e:a1:f9:a1:51:95:13:e1:14:2e:02:ad:5e:34:a5:14:23:6d:54:43

Digest Algorithm

sha256

PE Digest Matches

true

d0:89:4e:64:11:ac:42:bf:5d:62:d4:be:d0:5e:08:db:fd:2c:7a:77
Signer

Actual PE Digest

d0:89:4e:64:11:ac:42:bf:5d:62:d4:be:d0:5e:08:db:fd:2c:7a:77

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

86cdacc6fa5e3ff4938d358350751516

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcstol
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
wcsrchr
wcstoul
wcsstr
wcschr
memset
_chkesp

kernel32

DeleteFileW
WideCharToMultiByte
CreateFileA
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleW
MulDiv
lstrcpyW
GlobalAlloc
LoadLibraryW
GetProcAddress
lstrcmpiW
CreateFileW
lstrlenW
WriteFile
ReadFile
lstrcmpW
lstrcpynW
GetLastError
GetFileSize
GlobalFree
CloseHandle
SleepEx
SetFilePointer
GetTickCount
lstrcatW

user32

MessageBoxW
GetParent
ShowWindow
SetWindowLongW
IsWindow
SetWindowTextW
SendDlgItemMessageW
GetDlgItem
PostMessageW
GetWindowTextW
SendMessageW
SetDlgItemTextW
SetWindowPos
SystemParametersInfoW
GetClientRect
GetWindowRect
SetTimer
LoadIconW
DestroyWindow
KillTimer
UpdateWindow
RedrawWindow
DispatchMessageW
TranslateMessage
IsDialogMessageW
GetMessageW
IsWindowVisible
EnableWindow
CreateDialogParamW
FindWindowExW
wsprintfA
wsprintfW
GetWindowLongW

wininet

HttpSendRequestW
HttpSendRequestExW
HttpQueryInfoW
FtpCreateDirectoryW
FtpOpenFileW
InternetGetLastResponseInfoW
InternetSetFilePointer
InternetSetOptionW
InternetQueryOptionW
HttpAddRequestHeadersA
InternetCloseHandle
InternetErrorDlg
HttpAddRequestHeadersW
HttpOpenRequestW
HttpEndRequestW
InternetConnectW
InternetCrackUrlW
InternetOpenW
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/AnVir.exe
.exe windows:5 windows x86 arch:x86

782b5663b25cdd98990e54032a1cb476

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3
Signer

Actual PE Digest

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3

Digest Algorithm

sha256

PE Digest Matches

true

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb
Signer

Actual PE Digest

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ord155
ord18
Shell_NotifyIconA
ord680
SHOpenFolderAndSelectItems
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoA

shlwapi

ord10
ord9
ord8
StrFormatByteSizeW
PathFindOnPathA
PathCanonicalizeA

msi

ord216
ord172

kernel32

FileTimeToSystemTime
LoadLibraryA
GlobalAlloc
GlobalLock
GlobalUnlock
GetVolumeInformationA
LocalFree
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcess
GetFileSize
OpenProcess
SetFilePointer
MulDiv
LockResource
GetCurrentProcessId
GlobalMemoryStatusEx
SetProcessAffinityMask
GetProcessAffinityMask
GlobalFree
lstrlenW
GlobalReAlloc
FindFirstFileA
FindNextFileA
FindClose
CopyFileA
MoveFileA
SetFileTime
GetSystemPowerStatus
GetProcessHeap
HeapFree
GetProcessTimes
GetPriorityClass
SetPriorityClass
SuspendThread
SetProcessWorkingSetSize
QueryDosDeviceA
VirtualAlloc
VirtualFree
DuplicateHandle
GetFileType
VirtualAllocEx
FileTimeToLocalFileTime
RemoveDirectoryA
CreateFileMappingA
MapViewOfFile
GetLogicalDrives
GetDiskFreeSpaceExA
DeviceIoControl
GetExitCodeProcess
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
GetACP
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualProtect
GetSystemInfo
GetModuleFileNameW
LoadLibraryExW
TlsFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
HeapAlloc
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetDateFormatA
GetLocaleInfoA
GetDriveTypeA
GetLogicalDriveStringsA
SetErrorMode
DeleteFileA
GetSystemTime
GetSystemWow64DirectoryA
GetWindowsDirectoryA
SetFileAttributesA
GetFileAttributesA
FormatMessageA
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateDirectoryA
SystemTimeToFileTime
IsBadWritePtr
VirtualQuery
ReadFile
WriteFile
SetEndOfFile
GetFileTime
CreateFileA
GetLongPathNameA
ExpandEnvironmentStringsA
GetEnvironmentVariableA
GetLocalTime
ResumeThread
SetThreadPriority
TerminateThread
CreateProcessA
SetEvent
lstrcatA
GetSystemDirectoryA
CompareStringA
GetVersionExA
SetLastError
DecodePointer
GetCurrentThreadId
SetUnhandledExceptionFilter
Sleep
OpenMutexA
CreateMutexA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
GetLastError
SizeofResource
RaiseException
WideCharToMultiByte
IsDBCSLeadByte
MultiByteToWideChar
lstrcmpiA
GetModuleHandleA
GetProcAddress
FreeLibrary
WaitForSingleObject
PulseEvent
CloseHandle
OpenEventA
CreateEventA
lstrcpyA
lstrcmpA
lstrcpynA
IsBadStringPtrA
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
FindFirstFileExA
SetStdHandle
CreateFileW
SetFilePointerEx
WriteConsoleW
ReadConsoleW
VirtualFreeEx

user32

CreateIconIndirect
GetGuiResources
FindWindowExA
EnumThreadWindows
SetScrollPos
SetScrollInfo
SetClassLongA
GetScrollRange
ScrollWindowEx
GetKeyboardLayoutList
FlashWindow
WaitForInputIdle
GetMenuStringA
GetNextDlgTabItem
wvsprintfA
SetLayeredWindowAttributes
GetTopWindow
GetWindowPlacement
GetMenuState
GetDlgItemTextA
IntersectRect
GetAsyncKeyState
DragDetect
AdjustWindowRectEx
EqualRect
GetDesktopWindow
LockWindowUpdate
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetParent
IsChild
SetRect
IsRectEmpty
LoadBitmapA
DrawStateA
AppendMenuA
GetWindowThreadProcessId
FrameRect
WindowFromPoint
GetMessagePos
DestroyIcon
DrawFrameControl
TranslateAcceleratorA
PostQuitMessage
LoadStringW
DrawEdge
LockWorkStation
SendDlgItemMessageA
GetForegroundWindow
RegisterHotKey
UnregisterHotKey
IsZoomed
IsIconic
GetMenuItemID
SetWindowsHookExA
CallNextHookEx
MonitorFromPoint
UnhookWindowsHookEx
ModifyMenuA
ClientToScreen
MonitorFromRect
CopyRect
SetMenu
GetMenu
SetMenuDefaultItem
CheckMenuRadioItem
RegisterWindowMessageA
DrawIconEx
GetWindowDC
GetDCEx
GetSysColorBrush
GetMenuItemInfoA
IsMenu
LoadIconA
MoveWindow
CharLowerBuffA
GetKeyState
DeleteMenu
InsertMenuA
RemoveMenu
InsertMenuItemA
GetSubMenu
CreateDialogParamA
GetMenuItemCount
BringWindowToTop
RedrawWindow
IsDialogMessageA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DestroyMenu
TrackPopupMenu
TrackPopupMenuEx
CreatePopupMenu
ChildWindowFromPoint
GetDialogBaseUnits
DialogBoxIndirectParamA
DrawAnimatedRects
SetMenuItemInfoA
GetScrollPos
ExitWindowsEx
GetClassLongA
SendMessageTimeoutA
CharUpperA
SetDlgItemInt
GetDlgItemInt
MessageBeep
CheckDlgButton
IsDlgButtonChecked
EndDialog
EnableWindow
MessageBoxA
SetDlgItemTextA
KillTimer
GetShellWindow
SetTimer
ShowWindowAsync
IsWindowVisible
EnumWindows
wsprintfA
CharLowerA
SystemParametersInfoA
IsWindowEnabled
GetFocus
DrawFocusRect
SetCapture
GetCapture
GetLayeredWindowAttributes
InflateRect
FillRect
ReleaseCapture
GetDlgCtrlID
GetCursorPos
ScreenToClient
OffsetRect
GetDlgItem
CallWindowProcA
PtInRect
GetWindowTextLengthA
ReleaseDC
GetDC
GetClassNameA
UpdateWindow
InvalidateRect
EndPaint
BeginPaint
IsWindow
GetWindow
MonitorFromWindow
GetMonitorInfoA
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
EnumChildWindows
CreateWindowExA
SetWindowTextA
GetWindowTextA
GetClassInfoExA
LoadImageA
GetSystemMetrics
RegisterClassExA
SetRectEmpty
DefWindowProcA
SetWindowLongA
DialogBoxParamA
UnregisterClassA
LoadAcceleratorsA
LoadMenuA
SendMessageA
SetFocus
GetWindowLongA
DestroyWindow
SetForegroundWindow
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
FindWindowA
GetActiveWindow
ShowWindow
LoadCursorA
SetCursor
PostMessageA
LoadStringA
GetSysColor
IsCharAlphaNumericA
CharUpperBuffA
CharNextA
DrawTextA

gdi32

CreateDIBSection
CreateDCA
SetViewportOrgEx
GetClipBox
SetWindowOrgEx
SetBrushOrgEx
PatBlt
TextOutW
CreatePatternBrush
CreateBitmap
GetDeviceCaps
Polygon
DPtoLP
LPtoDP
RectVisible
GetCurrentObject
RoundRect
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
GetStockObject
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
GetObjectA
SetTextColor
SetBkColor
SetBkMode
CreateSolidBrush
RestoreDC
SaveDC
Rectangle
LineTo
SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
MoveToEx
CreatePen
ExtTextOutA

comdlg32

GetOpenFileNameA
FindTextA
GetSaveFileNameA
CommDlgExtendedError

advapi32

LookupAccountSidA
QueryServiceStatusEx
ControlService
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
DuplicateTokenEx
GetSecurityInfo
GetTokenInformation
OpenProcessToken
SetSecurityInfo
SystemFunction036
GetSecurityDescriptorSacl
ChangeServiceConfigA
RegEnumValueA
RegQueryInfoKeyA
RegQueryValueExA
RegDeleteValueA
QueryServiceConfig2A
QueryServiceConfigA
GetServiceDisplayNameA
UnlockServiceDatabase
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
LockServiceDatabase
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VarUI4FromStr
VariantInit
VariantClear
SysAllocString
SysFreeString
VariantChangeType

comctl32

ImageList_Draw
ImageList_AddMasked
ord17
CreatePropertySheetPageA
InitCommonControlsEx
_TrackMouseEvent
ImageList_Remove
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_LoadImageA
ImageList_GetIconSize
ImageList_DrawEx
DestroyPropertySheetPage
PropertySheetA
ImageList_GetImageCount
ImageList_GetIcon
ImageList_DrawIndirect

uxtheme

SetWindowTheme
IsAppThemed

psapi

GetModuleFileNameExA

crypt32

CertFindRDNAttr
CertFreeCertificateContext
CryptDecodeObjectEx

rpcrt4

UuidFromStringA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AnVir.exe
.exe windows:5 windows x86 arch:x86

782b5663b25cdd98990e54032a1cb476

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3
Signer

Actual PE Digest

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3

Digest Algorithm

sha256

PE Digest Matches

true

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb
Signer

Actual PE Digest

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ord155
ord18
Shell_NotifyIconA
ord680
SHOpenFolderAndSelectItems
SHGetDesktopFolder
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHFileOperationA
SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteExA
ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoA

shlwapi

ord10
ord9
ord8
StrFormatByteSizeW
PathFindOnPathA
PathCanonicalizeA

msi

ord216
ord172

kernel32

FileTimeToSystemTime
LoadLibraryA
GlobalAlloc
GlobalLock
GlobalUnlock
GetVolumeInformationA
LocalFree
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcess
GetFileSize
OpenProcess
SetFilePointer
MulDiv
LockResource
GetCurrentProcessId
GlobalMemoryStatusEx
SetProcessAffinityMask
GetProcessAffinityMask
GlobalFree
lstrlenW
GlobalReAlloc
FindFirstFileA
FindNextFileA
FindClose
CopyFileA
MoveFileA
SetFileTime
GetSystemPowerStatus
GetProcessHeap
HeapFree
GetProcessTimes
GetPriorityClass
SetPriorityClass
SuspendThread
SetProcessWorkingSetSize
QueryDosDeviceA
VirtualAlloc
VirtualFree
DuplicateHandle
GetFileType
VirtualAllocEx
FileTimeToLocalFileTime
RemoveDirectoryA
CreateFileMappingA
MapViewOfFile
GetLogicalDrives
GetDiskFreeSpaceExA
DeviceIoControl
GetExitCodeProcess
GetCommandLineW
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
LCMapStringW
GetStringTypeW
GetACP
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
VirtualProtect
GetSystemInfo
GetModuleFileNameW
LoadLibraryExW
TlsFree
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
HeapAlloc
EncodePointer
OutputDebugStringW
IsDebuggerPresent
GetDateFormatA
GetLocaleInfoA
GetDriveTypeA
GetLogicalDriveStringsA
SetErrorMode
DeleteFileA
GetSystemTime
GetSystemWow64DirectoryA
GetWindowsDirectoryA
SetFileAttributesA
GetFileAttributesA
FormatMessageA
GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStructA
GetPrivateProfileIntA
WritePrivateProfileStringA
CreateDirectoryA
SystemTimeToFileTime
IsBadWritePtr
VirtualQuery
ReadFile
WriteFile
SetEndOfFile
GetFileTime
CreateFileA
GetLongPathNameA
ExpandEnvironmentStringsA
GetEnvironmentVariableA
GetLocalTime
ResumeThread
SetThreadPriority
TerminateThread
CreateProcessA
SetEvent
lstrcatA
GetSystemDirectoryA
CompareStringA
GetVersionExA
SetLastError
DecodePointer
GetCurrentThreadId
SetUnhandledExceptionFilter
Sleep
OpenMutexA
CreateMutexA
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
LoadLibraryExA
FindResourceA
LoadResource
GetLastError
SizeofResource
RaiseException
WideCharToMultiByte
IsDBCSLeadByte
MultiByteToWideChar
lstrcmpiA
GetModuleHandleA
GetProcAddress
FreeLibrary
WaitForSingleObject
PulseEvent
CloseHandle
OpenEventA
CreateEventA
lstrcpyA
lstrcmpA
lstrcpynA
IsBadStringPtrA
LeaveCriticalSection
EnterCriticalSection
GetTickCount
InterlockedIncrement
InterlockedDecrement
lstrlenA
FindFirstFileExA
SetStdHandle
CreateFileW
SetFilePointerEx
WriteConsoleW
ReadConsoleW
VirtualFreeEx

user32

CreateIconIndirect
GetGuiResources
FindWindowExA
EnumThreadWindows
SetScrollPos
SetScrollInfo
SetClassLongA
GetScrollRange
ScrollWindowEx
GetKeyboardLayoutList
FlashWindow
WaitForInputIdle
GetMenuStringA
GetNextDlgTabItem
wvsprintfA
SetLayeredWindowAttributes
GetTopWindow
GetWindowPlacement
GetMenuState
GetDlgItemTextA
IntersectRect
GetAsyncKeyState
DragDetect
AdjustWindowRectEx
EqualRect
GetDesktopWindow
LockWindowUpdate
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetParent
IsChild
SetRect
IsRectEmpty
LoadBitmapA
DrawStateA
AppendMenuA
GetWindowThreadProcessId
FrameRect
WindowFromPoint
GetMessagePos
DestroyIcon
DrawFrameControl
TranslateAcceleratorA
PostQuitMessage
LoadStringW
DrawEdge
LockWorkStation
SendDlgItemMessageA
GetForegroundWindow
RegisterHotKey
UnregisterHotKey
IsZoomed
IsIconic
GetMenuItemID
SetWindowsHookExA
CallNextHookEx
MonitorFromPoint
UnhookWindowsHookEx
ModifyMenuA
ClientToScreen
MonitorFromRect
CopyRect
SetMenu
GetMenu
SetMenuDefaultItem
CheckMenuRadioItem
RegisterWindowMessageA
DrawIconEx
GetWindowDC
GetDCEx
GetSysColorBrush
GetMenuItemInfoA
IsMenu
LoadIconA
MoveWindow
CharLowerBuffA
GetKeyState
DeleteMenu
InsertMenuA
RemoveMenu
InsertMenuItemA
GetSubMenu
CreateDialogParamA
GetMenuItemCount
BringWindowToTop
RedrawWindow
IsDialogMessageA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
DestroyMenu
TrackPopupMenu
TrackPopupMenuEx
CreatePopupMenu
ChildWindowFromPoint
GetDialogBaseUnits
DialogBoxIndirectParamA
DrawAnimatedRects
SetMenuItemInfoA
GetScrollPos
ExitWindowsEx
GetClassLongA
SendMessageTimeoutA
CharUpperA
SetDlgItemInt
GetDlgItemInt
MessageBeep
CheckDlgButton
IsDlgButtonChecked
EndDialog
EnableWindow
MessageBoxA
SetDlgItemTextA
KillTimer
GetShellWindow
SetTimer
ShowWindowAsync
IsWindowVisible
EnumWindows
wsprintfA
CharLowerA
SystemParametersInfoA
IsWindowEnabled
GetFocus
DrawFocusRect
SetCapture
GetCapture
GetLayeredWindowAttributes
InflateRect
FillRect
ReleaseCapture
GetDlgCtrlID
GetCursorPos
ScreenToClient
OffsetRect
GetDlgItem
CallWindowProcA
PtInRect
GetWindowTextLengthA
ReleaseDC
GetDC
GetClassNameA
UpdateWindow
InvalidateRect
EndPaint
BeginPaint
IsWindow
GetWindow
MonitorFromWindow
GetMonitorInfoA
GetWindowRect
GetParent
GetClientRect
MapWindowPoints
SetWindowPos
EnumChildWindows
CreateWindowExA
SetWindowTextA
GetWindowTextA
GetClassInfoExA
LoadImageA
GetSystemMetrics
RegisterClassExA
SetRectEmpty
DefWindowProcA
SetWindowLongA
DialogBoxParamA
UnregisterClassA
LoadAcceleratorsA
LoadMenuA
SendMessageA
SetFocus
GetWindowLongA
DestroyWindow
SetForegroundWindow
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
FindWindowA
GetActiveWindow
ShowWindow
LoadCursorA
SetCursor
PostMessageA
LoadStringA
GetSysColor
IsCharAlphaNumericA
CharUpperBuffA
CharNextA
DrawTextA

gdi32

CreateDIBSection
CreateDCA
SetViewportOrgEx
GetClipBox
SetWindowOrgEx
SetBrushOrgEx
PatBlt
TextOutW
CreatePatternBrush
CreateBitmap
GetDeviceCaps
Polygon
DPtoLP
LPtoDP
RectVisible
GetCurrentObject
RoundRect
ExcludeClipRect
BitBlt
CreateCompatibleBitmap
GetStockObject
GetTextExtentPoint32A
GetTextMetricsA
CreateFontIndirectA
GetObjectA
SetTextColor
SetBkColor
SetBkMode
CreateSolidBrush
RestoreDC
SaveDC
Rectangle
LineTo
SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
MoveToEx
CreatePen
ExtTextOutA

comdlg32

GetOpenFileNameA
FindTextA
GetSaveFileNameA
CommDlgExtendedError

advapi32

LookupAccountSidA
QueryServiceStatusEx
ControlService
StartServiceA
DeleteService
ChangeServiceConfig2A
CreateServiceA
CloseServiceHandle
OpenServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
DuplicateTokenEx
GetSecurityInfo
GetTokenInformation
OpenProcessToken
SetSecurityInfo
SystemFunction036
GetSecurityDescriptorSacl
ChangeServiceConfigA
RegEnumValueA
RegQueryInfoKeyA
RegQueryValueExA
RegDeleteValueA
QueryServiceConfig2A
QueryServiceConfigA
GetServiceDisplayNameA
UnlockServiceDatabase
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
LockServiceDatabase
RegEnumKeyExA
RegDeleteKeyA
RegCloseKey
RegQueryInfoKeyW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VarUI4FromStr
VariantInit
VariantClear
SysAllocString
SysFreeString
VariantChangeType

comctl32

ImageList_Draw
ImageList_AddMasked
ord17
CreatePropertySheetPageA
InitCommonControlsEx
_TrackMouseEvent
ImageList_Remove
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_LoadImageA
ImageList_GetIconSize
ImageList_DrawEx
DestroyPropertySheetPage
PropertySheetA
ImageList_GetImageCount
ImageList_GetIcon
ImageList_DrawIndirect

uxtheme

SetWindowTheme
IsAppThemed

psapi

GetModuleFileNameExA

crypt32

CertFindRDNAttr
CertFreeCertificateContext
CryptDecodeObjectEx

rpcrt4

UuidFromStringA

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 332B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
AnvirHook8.dll
.dll windows:5 windows x86 arch:x86

4d3d5cda99c0f7e0bc7e72dc64b6e178

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b5:aa:12:5a:32:7c:78:04:4a:62:e8:6f:20:28:db:5e:b6:ec:a2:5b:cc:f4:88:5f:61:c0:de:d1:61:20:08:bf
Signer

Actual PE Digest

b5:aa:12:5a:32:7c:78:04:4a:62:e8:6f:20:28:db:5e:b6:ec:a2:5b:cc:f4:88:5f:61:c0:de:d1:61:20:08:bf

Digest Algorithm

sha256

PE Digest Matches

true

32:63:28:d0:68:41:9a:3a:26:79:66:ea:aa:77:93:a4:fb:2b:4c:a2
Signer

Actual PE Digest

32:63:28:d0:68:41:9a:3a:26:79:66:ea:aa:77:93:a4:fb:2b:4c:a2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

comctl32

ImageList_ReplaceIcon

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetDesktopFolder

msimg32

TransparentBlt

kernel32

GetVersionExA
RaiseException
lstrcmpA
GetCurrentDirectoryA
MultiByteToWideChar
GetProcAddress
lstrlenW
WideCharToMultiByte
OpenProcess
SetPriorityClass
GetPriorityClass
GetFileAttributesA
LoadLibraryW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
SetLastError
TlsFree
TlsSetValue
GetTickCount
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
HeapSize
IsProcessorFeaturePresent
HeapDestroy
HeapCreate
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCommandLineA
GetCurrentThreadId
HeapReAlloc
DecodePointer
EncodePointer
HeapFree
HeapAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
lstrcatA
Sleep
GetCurrentProcessId
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
CloseHandle
MapViewOfFile
lstrlenA
lstrcpyA
OpenFileMappingA
RtlUnwind
LCMapStringW
GetStringTypeW
TlsGetValue

user32

GetMenuItemInfoA
SetMenuItemInfoA
RemoveMenu
GetMenuState
IsMenu
DeleteMenu
GetMenuItemID
CheckMenuItem
GetKeyState
SendInput
GetSystemMetrics
InsertMenuA
InsertMenuItemA
CheckMenuRadioItem
AppendMenuA
TrackPopupMenuEx
SetActiveWindow
RedrawWindow
GetWindowTextA
GetWindowPlacement
GetLayeredWindowAttributes
InflateRect
DrawFrameControl
DrawIconEx
GetSystemMenu
LoadBitmapA
PostMessageA
SendMessageTimeoutA
IsWindow
RegisterClassA
GetWindowDC
ReleaseDC
ClientToScreen
SetWindowTextA
LoadImageA
LoadIconA
wsprintfA
GetWindowTextLengthA
GetDlgCtrlID
FindWindowExA
GetClassNameA
GetDlgItem
SendMessageA
EnumWindows
SetTimer
KillTimer
DefWindowProcA
FillRect
GetClientRect
EndPaint
BeginPaint
ShowWindowAsync
SetWindowPos
SetCapture
IsWindowVisible
SetLayeredWindowAttributes
ShowWindow
CreateWindowExA
GetCursorPos
UpdateWindow
InvalidateRect
CallWindowProcA
CallWindowProcW
SetWindowLongA
SetWindowLongW
IsWindowUnicode
DestroyMenu
TrackPopupMenu
CreatePopupMenu
DestroyWindow
GetParent
ScreenToClient
OffsetRect
ReleaseCapture
PtInRect
GetWindowLongA
GetWindowRect
GetDC

gdi32

SetWindowOrgEx
DPtoLP
SelectObject
DeleteObject
CreateCompatibleBitmap
LPtoDP
CreateCompatibleDC
GetClipBox
BitBlt
CreateSolidBrush
GetStockObject
GetObjectA
StretchBlt
GetPixel
Polyline
CreatePen
DeleteDC

ole32

CoTaskMemFree

uxtheme

IsAppThemed
GetThemeEnumValue
GetThemeInt
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeFilename
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeMargins

Exports

Exports

AddTitleIcons
ExtendSaveDialogs
ExtendSystemMenu

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AnvirHook8_64.dll
.dll windows:5 windows x64 arch:x64

3c77569552017b41c37267fe86b374b6

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

ac:af:c8:07:f0:35:19:21:ad:22:11:27:99:e3:76:0d:35:d2:ed:0c:16:20:59:2a:6b:4b:c8:23:ce:13:5a:12
Signer

Actual PE Digest

ac:af:c8:07:f0:35:19:21:ad:22:11:27:99:e3:76:0d:35:d2:ed:0c:16:20:59:2a:6b:4b:c8:23:ce:13:5a:12

Digest Algorithm

sha256

PE Digest Matches

true

48:00:fc:f7:aa:21:40:8b:fa:c6:43:e1:2d:c1:ff:16:a9:48:5f:ce
Signer

Actual PE Digest

48:00:fc:f7:aa:21:40:8b:fa:c6:43:e1:2d:c1:ff:16:a9:48:5f:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

comctl32

ImageList_ReplaceIcon

shell32

SHGetMalloc
SHGetPathFromIDListA
SHGetDesktopFolder

msimg32

TransparentBlt

kernel32

GetVersionExA
RaiseException
lstrcmpA
GetCurrentDirectoryA
MultiByteToWideChar
GetProcAddress
lstrlenW
WideCharToMultiByte
OpenProcess
SetPriorityClass
GetPriorityClass
GetFileAttributesA
LoadLibraryW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
FlsAlloc
SetLastError
FlsFree
FlsGetValue
IsValidCodePage
GetTickCount
GetACP
GetCPInfo
RtlUnwindEx
HeapSize
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetModuleFileNameW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCommandLineA
FlsSetValue
GetCurrentThreadId
HeapReAlloc
DecodePointer
EncodePointer
HeapFree
HeapAlloc
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
lstrcatA
Sleep
GetCurrentProcessId
LoadLibraryA
GetModuleFileNameA
UnmapViewOfFile
CloseHandle
MapViewOfFile
lstrlenA
lstrcpyA
OpenFileMappingA
LCMapStringW
GetStringTypeW
GetOEMCP
RtlPcToFileHeader

user32

GetMenuItemInfoA
SetMenuItemInfoA
GetDC
RemoveMenu
GetMenuState
IsMenu
DeleteMenu
GetMenuItemID
GetSystemMenu
GetKeyState
SendInput
GetSystemMetrics
InsertMenuA
InsertMenuItemA
CheckMenuRadioItem
AppendMenuA
TrackPopupMenuEx
SetActiveWindow
RedrawWindow
GetWindowPlacement
GetLayeredWindowAttributes
SetWindowLongA
InflateRect
DrawFrameControl
CheckMenuItem
DrawIconEx
PostMessageA
SendMessageTimeoutA
IsWindow
RegisterClassA
GetWindowDC
ReleaseDC
ClientToScreen
GetWindowTextA
SetWindowTextA
LoadImageA
LoadIconA
wsprintfA
GetWindowTextLengthA
GetDlgCtrlID
FindWindowExA
GetClassNameA
GetDlgItem
SendMessageA
EnumWindows
SetTimer
KillTimer
DefWindowProcA
FillRect
GetClientRect
EndPaint
BeginPaint
GetWindowLongPtrA
ShowWindowAsync
SetWindowPos
SetCapture
IsWindowVisible
SetLayeredWindowAttributes
ShowWindow
CreateWindowExA
GetCursorPos
UpdateWindow
InvalidateRect
CallWindowProcA
CallWindowProcW
SetWindowLongPtrA
SetWindowLongPtrW
IsWindowUnicode
DestroyMenu
TrackPopupMenu
CreatePopupMenu
DestroyWindow
GetParent
ScreenToClient
OffsetRect
ReleaseCapture
PtInRect
GetWindowLongA
GetWindowRect
LoadBitmapA

gdi32

SetWindowOrgEx
DPtoLP
SelectObject
DeleteObject
CreateCompatibleBitmap
LPtoDP
CreateCompatibleDC
GetClipBox
BitBlt
CreateSolidBrush
GetStockObject
GetObjectA
StretchBlt
GetPixel
Polyline
CreatePen
DeleteDC

ole32

CoTaskMemFree

uxtheme

IsAppThemed
GetThemeEnumValue
GetThemeInt
IsThemeBackgroundPartiallyTransparent
GetCurrentThemeName
GetThemeFilename
OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemeMargins

Exports

Exports

AddTitleIcons
ExtendSaveDialogs
ExtendSystemMenu

Sections

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AnvirRunServ.exe
.exe windows:4 windows x86 arch:x86

b02ec238d323162eb8e5d7854e0638a2

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:36:ff:0b:f0:cc:47:16:4f:70:62:26:c3:6e:8a:7b:19:e2:af:df:41:8e:0c:ca:0d:bb:f6:f4:86:c4:37:53
Signer

Actual PE Digest

61:36:ff:0b:f0:cc:47:16:4f:70:62:26:c3:6e:8a:7b:19:e2:af:df:41:8e:0c:ca:0d:bb:f6:f4:86:c4:37:53

Digest Algorithm

sha256

PE Digest Matches

true

48:12:af:e8:d4:5d:0f:99:1c:1a:38:b4:1f:a7:ec:89:fd:90:c2:e4
Signer

Actual PE Digest

48:12:af:e8:d4:5d:0f:99:1c:1a:38:b4:1f:a7:ec:89:fd:90:c2:e4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetCurrentThreadId
lstrlenA
CreateProcessA
CloseHandle
LoadLibraryA
GetProcAddress
lstrcpyA
GetLastError
FormatMessageA
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadWritePtr
IsBadCodePtr
EnterCriticalSection
LeaveCriticalSection
SetFilePointer
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
SetStdHandle
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers

user32

PostThreadMessageA
LoadStringA

advapi32

RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumKeyA
RegQueryValueExA
RegCloseKey
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
SetServiceStatus

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Languages/anvir_Croatian.txt
Languages/anvir_Czech.txt
Languages/anvir_Danish.txt
Languages/anvir_Dutch.txt
Languages/anvir_Finnish.txt
Languages/anvir_French.txt
Languages/anvir_German.txt
Languages/anvir_Greek.txt
Languages/anvir_Italian.txt
Languages/anvir_Japanese.txt
Languages/anvir_Korean.txt
Languages/anvir_Norwegian.txt
Languages/anvir_Polish.txt
Languages/anvir_Portuguese.txt
Languages/anvir_Spanish.txt
Languages/anvir_Vietnamese.txt
Languages/anvir_swedish.txt
OpenHardwareMonitor/Aga.Controls.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\DEV\OpenHardwareMonitor\External\Aga.Controls\obj\Release\Aga.Controls.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenHardwareMonitor/License.html
OpenHardwareMonitor/OpenHardwareMonitor.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 463KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenHardwareMonitor/OpenHardwareMonitor.exe.config
OpenHardwareMonitor/OpenHardwareMonitorLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 257KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenHardwareMonitor/OxyPlot.WindowsForms.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\DEV\OpenHardwareMonitor\External\OxyPlot\OxyPlot.WindowsForms\obj\Release\NET40\OxyPlot.WindowsForms.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenHardwareMonitor/OxyPlot.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\DEV\OpenHardwareMonitor\External\OxyPlot\OxyPlot\obj\Release\OxyPlot.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VirusTotalUpload.exe
.exe windows:5 windows x86 arch:x86

1c06186a7f0367e14a6db68fa3b0c6b3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetReadFile
InternetCrackUrlW
InternetConnectW
InternetOpenW
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
InternetCloseHandle
HttpOpenRequestW
HttpQueryInfoW
HttpSendRequestW

comctl32

InitCommonControlsEx

psapi

GetProcessImageFileNameW

kernel32

LocalAlloc
QueryDosDeviceW
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
CreateThread
GetFullPathNameW
GetTickCount
Sleep
GetFileAttributesW
ReadFile
GetFileSizeEx
GetCurrentProcess
GetModuleFileNameW
GetSystemDirectoryW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetCurrentProcessId
QueryPerformanceCounter
DeleteCriticalSection
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
HeapCreate
WideCharToMultiByte
ExitProcess
GetCurrentThread
LocalFree
GetProcAddress
CloseHandle
GetLastError
GetTempPathW
CreateFileW
WriteFile
GetTempFileNameW
HeapReAlloc
GetStringTypeW
GetModuleHandleW
LoadLibraryW
SetStdHandle
SetEndOfFile
GetProcessHeap
GetTimeZoneInformation
FlushFileBuffers
SetEnvironmentVariableA
WriteConsoleW
CompareStringW
GetCurrentDirectoryW
GetFileType
PeekNamedPipe
GetFileInformationByHandle
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
HeapSize
LCMapStringW
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
FindClose
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
MultiByteToWideChar
HeapFree
HeapAlloc
RtlUnwind
GetCommandLineW
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage

user32

SendMessageW
MessageBoxW
SendDlgItemMessageW
SetWindowTextW
CheckDlgButton
IsDlgButtonChecked
EnableWindow
SetTimer
SetForegroundWindow
DialogBoxParamW
GetDlgItem
EndDialog
wsprintfW
ShowWindow
GetDlgItemTextW
SetDlgItemTextW
LoadImageW
GetSysColor

gdi32

SetBkMode
CreateSolidBrush
SetTextColor

comdlg32

GetOpenFileNameW
CommDlgExtendedError

advapi32

CryptReleaseContext
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptAcquireContextW
CryptGetHashParam
AdjustTokenPrivileges
GetLengthSid
IsValidSecurityDescriptor
FreeSid
AddAccessAllowedAce
SetSecurityDescriptorOwner
AllocateAndInitializeSid
InitializeAcl
LookupPrivilegeValueW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DuplicateToken
AccessCheck
SetSecurityDescriptorGroup
OpenThreadToken
OpenProcessToken

shell32

ShellExecuteW
DragQueryFileW
SHGetPathFromIDListW
SHBrowseForFolderW
DragFinish
CommandLineToArgvW

ole32

CoInitialize
CoTaskMemFree
CoUninitialize

Sections

.text
Size: 105KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
anvir64.exe
.exe windows:5 windows x64 arch:x64

c1c3f5e814438baff1f29630330e232d

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cc:02:90:2f:53:74:ea:8a:47:2f:e4:c7:c1:80:8a:70:05:9c:e5:12:4d:45:b8:a4:4e:4f:85:a1:45:3c:91:9b
Signer

Actual PE Digest

cc:02:90:2f:53:74:ea:8a:47:2f:e4:c7:c1:80:8a:70:05:9c:e5:12:4d:45:b8:a4:4e:4f:85:a1:45:3c:91:9b

Digest Algorithm

sha256

PE Digest Matches

true

44:5c:f5:a5:d7:ee:8d:3c:87:a6:b4:83:a1:be:bf:91:72:18:f8:3b
Signer

Actual PE Digest

44:5c:f5:a5:d7:ee:8d:3c:87:a6:b4:83:a1:be:bf:91:72:18:f8:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

CloseHandle
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
GetVersionExA
GetModuleHandleA
GetStdHandle
TlsAlloc
TlsGetValue
GetCurrentProcess
WriteFile
EnterCriticalSection
LeaveCriticalSection
lstrcmpiA
IsDBCSLeadByte
RaiseException
SizeofResource
LoadResource
FindResourceA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
CreateMutexA
FlushInstructionCache
SetLastError
OpenFileMappingA
MapViewOfFile
OpenMutexA
FlushFileBuffers
CreateFileW
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
LCMapStringW
HeapSize
RtlUnwindEx
GetStringTypeW
HeapCreate
GetVersion
HeapSetInformation
GetModuleFileNameW
Sleep
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
GetLastError
GetProcAddress
lstrcpyA
lstrcatA
ExitProcess
GetModuleHandleW
FlsAlloc
FlsFree
FlsSetValue
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlPcToFileHeader
GetStartupInfoW
GetCommandLineA
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
lstrlenA
InterlockedPushEntrySList
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
EncodePointer
DecodePointer
VirtualProtect

user32

CharNextA
PostQuitMessage
SetTimer
SetWindowTextA
IsDialogMessageA
SetWindowLongPtrA
CreateDialogParamA
DestroyWindow
DefWindowProcA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
UnregisterClassA

advapi32

RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyW
RegCloseKey

ole32

CoTaskMemAlloc
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoTaskMemFree

oleaut32

VarUI4FromStr

comctl32

InitCommonControlsEx

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
anvirlauncher.exe
.exe windows:6 windows x86 arch:x86

27cef9d26747652e0d11e3c14bb6154f

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

8e:34:88:b8:69:22:76:3c:8a:b9:f9:0a:67:c2:8a:86:74:5c:9a:0b:16:2e:24:9c:b4:03:df:dc:1b:40:d1:1d
Signer

Actual PE Digest

8e:34:88:b8:69:22:76:3c:8a:b9:f9:0a:67:c2:8a:86:74:5c:9a:0b:16:2e:24:9c:b4:03:df:dc:1b:40:d1:1d

Digest Algorithm

sha256

PE Digest Matches

true

dc:05:83:f2:a4:df:4a:d0:3b:17:ec:eb:b7:ff:3a:c1:5a:5c:96:74
Signer

Actual PE Digest

dc:05:83:f2:a4:df:4a:d0:3b:17:ec:eb:b7:ff:3a:c1:5a:5c:96:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
ReadFile
WriteFile
CloseHandle
SetHandleInformation
CreatePipe
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
CreateProcessA
GetVersionExA
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
CreateMutexA
CreateEventA
OpenEventA
PulseEvent
WaitForMultipleObjects
DecodePointer
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
CreateFileW
WriteConsoleW
FlushFileBuffers
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetStdHandle
FindNextFileA
FindFirstFileExA
FindClose
GetCommandLineW
GetCommandLineA
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetStdHandle
lstrlenA
lstrcpyA
IsValidCodePage
GetLastError
LCMapStringW
HeapReAlloc
HeapSize
GetFileType
GetStringTypeW
HeapAlloc
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
GetModuleFileNameW
SetLastError
EncodePointer
ExitProcess
GetModuleHandleExW
GetACP
HeapFree

user32

CharToOemA
wsprintfA
LoadStringA

advapi32

SystemFunction036

shell32

ord680
ShellExecuteA

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
portable.txt
uninstall.exe.nsis
usbhdd.exe
.exe windows:4 windows x86 arch:x86

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

08/09/2014, 00:00

Not After

08/09/2019, 23:59

Subject

CN=AnVir Software,O=AnVir Software,POSTALCODE=107589,STREET=Altayskaya 29,L=Moscow,ST=Moscow,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

b1:fa:52:79:67:4d:89:4f:4f:91:6d:67:84:4e:cc:7a:71:ed:51:eb:7d:e6:de:b4:33:e2:27:27:2e:76:0e:e3
Signer

Actual PE Digest

b1:fa:52:79:67:4d:89:4f:4f:91:6d:67:84:4e:cc:7a:71:ed:51:eb:7d:e6:de:b4:33:e2:27:27:2e:76:0e:e3

Digest Algorithm

sha256

PE Digest Matches

true

03:a6:e7:20:de:97:3d:d6:84:a2:93:e7:b4:bb:20:30:41:d2:c7:ed
Signer

Actual PE Digest

03:a6:e7:20:de:97:3d:d6:84:a2:93:e7:b4:bb:20:30:41:d2:c7:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 80KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 19KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 120KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bcCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bcCertificate

Extended Key Usages

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77Certificate

Extended Key Usages

Key Usages

f0:7c:26:f0:ca:c4:58:2e:00:20:1a:e6:4e:a1:f9:a1:51:95:13:e1:14:2e:02:ad:5e:34:a5:14:23:6d:54:43Signer

d0:89:4e:64:11:ac:42:bf:5d:62:d4:be:d0:5e:08:db:fd:2c:7a:77Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.0MB

.rsrc Size: 26KB - Virtual size: 26KB

.reloc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

86cdacc6fa5e3ff4938d358350751516

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 3KB - Virtual size: 5KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 2KB

782b5663b25cdd98990e54032a1cb476

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

f0:7c:26:f0:ca:c4:58:2e:00:20:1a:e6:4e:a1:f9:a1:51:95:13:e1:14:2e:02:ad:5e:34:a5:14:23:6d:54:43
Signer

d0:89:4e:64:11:ac:42:bf:5d:62:d4:be:d0:5e:08:db:fd:2c:7a:77
Signer

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.0MB

.rsrc
Size: 26KB - Virtual size: 26KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 2KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3
Signer

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb
Signer

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 5.2MB - Virtual size: 5.2MB

.data
Size: 2.5MB - Virtual size: 2.5MB

.gfids
Size: 512B - Virtual size: 332B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 1.5MB - Virtual size: 1.5MB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

6f:85:c8:a0:36:46:b0:43:6c:69:f0:b5:e0:18:ef:bc
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Certificate

35:17:94:22:17:1a:bd:d2:23:35:15:1c:6e:fd:74:2d:e3:55:25:44:9a:19:0b:05:e4:45:3a:93:e2:15:e8:e3
Signer

9b:8d:87:c7:c2:3d:4d:ee:21:1c:29:5b:f0:58:e9:b3:66:94:2b:cb
Signer