d1b63fa94d3a02febae8d91285ca2b17_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d1b63fa94d3a02febae8d91285ca2b17_JaffaCakes118
Size

3.6MB
MD5

d1b63fa94d3a02febae8d91285ca2b17
SHA1

2da41afa5435c418f3b74050f57b542fb6f5d5b7
SHA256

d01e45b6c6271d24585b1f478952599a8b7703075a60c83ba58a05ca7059681b
SHA512

dd467d9b9c1c3e8b940e012bae7c8cd4c03309b49655900317a5ce4896bdd2560c45b2de0ccf1b571f4ab6fdad5abf35c9068b7004138c27909892f6a3237008
SSDEEP

98304:w2imotPEoIp0E8WWpO+unSnmqe5hBOatlC3voZXWwFQ:wRmoPYQOrem7GwCJ

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/tianyin/reg.exe	aspack_v212_v242
static1/unpack001/tianyin/tianyin.exe	aspack_v212_v242
static1/unpack001/tianyin/update.exe	aspack_v212_v242

Unsigned PE 9 IoCs

Checks for missing Authenticode signature.

resource
unpack001/tianyin/Unrar.dll
unpack001/tianyin/VB6chs.dll
unpack001/tianyin/bass.dll
unpack001/tianyin/bassenc.dll
unpack001/tianyin/basswma.dll
unpack001/tianyin/lame.exe
unpack001/tianyin/reg.exe
unpack001/tianyin/tianyin.exe
unpack001/tianyin/update.exe

Files

d1b63fa94d3a02febae8d91285ca2b17_JaffaCakes118
.rar
tianyin/Unrar.dll
.dll windows:4 windows x86 arch:x86

b4d076238051fcc22607f17c728e83bc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
SetFileSecurityW

kernel32

CloseHandle
CompareStringA
CompareStringW
CreateDirectoryA
CreateDirectoryW
CreateFileA
CreateFileW
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FindNextFileW
FreeEnvironmentStringsA
FreeLibrary
GetACP
GetCPInfo
GetCurrentProcess
GetCurrentThreadId
GetEnvironmentStrings
GetFileAttributesA
GetFileAttributesW
GetFileType
GetFullPathNameA
GetLastError
GetLocalTime
GetModuleFileNameA
GetModuleHandleA
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoA
GetStdHandle
GetStringTypeW
GetSystemTime
GetVersion
GetVersionExA
GlobalMemoryStatus
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByte
LCMapStringA
LeaveCriticalSection
LoadLibraryA
LocalFileTimeToFileTime
MoveFileA
MultiByteToWideChar
RaiseException
ReadFile
RtlUnwind
SetConsoleCtrlHandler
SetEndOfFile
SetFileAttributesA
SetFileAttributesW
SetFilePointer
SetFileTime
SetHandleCount
SetLastError
Sleep
SystemTimeToFileTime
UnhandledExceptionFilter
VirtualAlloc
VirtualFree
VirtualQuery
WideCharToMultiByte
WriteFile

user32

CharLowerA
CharLowerW
CharToOemA
CharToOemBuffA
CharUpperA
CharUpperW
EnumThreadWindows
MessageBoxA
OemToCharA
OemToCharBuffA
wsprintfA

Exports

Exports

RARCloseArchive
RARGetDllVersion
RAROpenArchive
RAROpenArchiveEx
RARProcessFile
RARProcessFileW
RARReadHeader
RARReadHeaderEx
RARSetCallback
RARSetChangeVolProc
RARSetPassword
RARSetProcessDataProc
___CPPdebugHook

Sections

.text
Size: 138KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tianyin/VB6chs.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 98KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tianyin/author.dat
tianyin/bass.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_Apply3D
BASS_ChannelBytes2Seconds
BASS_ChannelFlags
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttribute
BASS_ChannelGetData
BASS_ChannelGetDevice
BASS_ChannelGetInfo
BASS_ChannelGetLength
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelGetTags
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelLock
BASS_ChannelPause
BASS_ChannelPlay
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttribute
BASS_ChannelSetDSP
BASS_ChannelSetDevice
BASS_ChannelSetFX
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttribute
BASS_ChannelStop
BASS_ChannelUpdate
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXReset
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetConfig
BASS_GetConfigPtr
BASS_GetDSoundObject
BASS_GetDevice
BASS_GetDeviceInfo
BASS_GetEAXParameters
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicLoad
BASS_Pause
BASS_PluginFree
BASS_PluginGetInfo
BASS_PluginLoad
BASS_RecordFree
BASS_RecordGetDevice
BASS_RecordGetDeviceInfo
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetDevice
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleFree
BASS_SampleGetChannel
BASS_SampleGetChannels
BASS_SampleGetData
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SampleSetData
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetConfig
BASS_SetConfigPtr
BASS_SetDevice
BASS_SetEAXParameters
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateFileUser
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_StreamPutData
BASS_StreamPutFileData
BASS_Update
_

Sections

Size: 91KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 568B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/bassenc.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_Encode_AddChunk
BASS_Encode_CastGetStats
BASS_Encode_CastInit
BASS_Encode_CastSetTitle
BASS_Encode_GetACMFormat
BASS_Encode_GetChannel
BASS_Encode_GetCount
BASS_Encode_GetVersion
BASS_Encode_IsActive
BASS_Encode_SetChannel
BASS_Encode_SetNotify
BASS_Encode_SetPaused
BASS_Encode_Start
BASS_Encode_StartACM
BASS_Encode_StartACMFile
BASS_Encode_Stop
BASS_Encode_Write

Sections

Size: 8KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 576B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/basswma.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_WMA_EncodeClose
BASS_WMA_EncodeGetClients
BASS_WMA_EncodeGetPort
BASS_WMA_EncodeGetRates
BASS_WMA_EncodeOpen
BASS_WMA_EncodeOpenFile
BASS_WMA_EncodeOpenNetwork
BASS_WMA_EncodeOpenNetworkMulti
BASS_WMA_EncodeOpenPublish
BASS_WMA_EncodeOpenPublishMulti
BASS_WMA_EncodeSetNotify
BASS_WMA_EncodeSetTag
BASS_WMA_EncodeWrite
BASS_WMA_GetWMObject
BASS_WMA_StreamCreateFile
BASS_WMA_StreamCreateFileAuth
BASS_WMA_StreamCreateFileUser
BASSplugin

Sections

Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 576B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/ico.dat
tianyin/lame.exe
.exe windows:5 windows x86 arch:x86

8fee74aad97ca6d4da74fb5bd0aa4dce

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetConsoleCursorPosition
GetConsoleScreenBufferInfo
GetFileType
GetStdHandle
SetPriorityClass
OpenProcess
GetCurrentProcessId
FindClose
FindFirstFileA
FormatMessageA
LoadLibraryA
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetLastError
GetDriveTypeA
GetTimeZoneInformation
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
GetCommandLineA
HeapReAlloc
GetModuleHandleA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStartupInfoA
DeleteCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CloseHandle
MultiByteToWideChar
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
GetFullPathNameA
GetCurrentDirectoryA
VirtualFree
VirtualAlloc
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
GetLocaleInfoA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetStringTypeA
GetStringTypeW
SetEndOfFile
GetProcessHeap

Sections

.text
Size: 360KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tianyin/mswinsck.ocx
.dll regsvr32 windows:4 windows x86 arch:x86

fcc40667ac22e0c598518006de958259

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/12/2000, 08:00

Not After

12/11/2005, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:0e:7d:a7:00:00:00:00:00:48
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/10/2003, 05:59

Not After

25/01/2005, 06:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc
Signer

Actual PE Digest

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

wsock32

accept
listen
inet_ntoa
recv
WSAGetLastError
WSASetLastError
select
__WSAFDIsSet
shutdown
ntohs
sendto
recvfrom
connect
getsockopt
setsockopt
getsockname
getpeername
closesocket
WSACancelAsyncRequest
gethostbyaddr
bind
WSAAsyncSelect
socket
WSAStartup
WSACleanup
inet_addr
WSAAsyncGetHostByName
WSAAsyncGetHostByAddr
gethostbyname
htons
gethostname
ioctlsocket
send

kernel32

WideCharToMultiByte
GetVersion
GetProcAddress
GetModuleFileNameA
InitializeCriticalSection
HeapFree
HeapAlloc
GetProcessHeap
lstrcpynA
lstrcpyA
lstrlenA
lstrcatA
IsBadWritePtr
DisableThreadLibraryCalls
lstrlenW
LeaveCriticalSection
GetCurrentThreadId
EnterCriticalSection
LocalFree
FormatMessageA
GetTickCount
MultiByteToWideChar
SetLastError
GetLocaleInfoA
DeleteCriticalSection
FreeLibrary
lstrcmpA
InterlockedDecrement
GetFileAttributesA
GetWindowsDirectoryA
LoadLibraryA
GetLastError
InterlockedIncrement
lstrcmpiA
FindResourceA
LockResource
LoadResource
HeapReAlloc

user32

EndDialog
DrawEdge
DialogBoxParamA
LoadCursorA
MessageBoxA
GetActiveWindow
GetDC
CharNextA
ReleaseDC
SetParent
GetWindowRect
ShowWindow
WinHelpA
IsDialogMessageA
GetWindow
GetNextDlgTabItem
IsWindowEnabled
GetDlgItem
IsChild
GetKeyState
SetWindowPos
LoadBitmapA
IsWindowVisible
EndPaint
GetClientRect
BeginPaint
GetSystemMetrics
GetDlgItemTextA
ClientToScreen
OffsetRect
EqualRect
IntersectRect
SetWindowRgn
PtInRect
MessageBeep
LoadStringA
IsWindow
CreateDialogIndirectParamA
GetParent
SetDlgItemTextA
SendMessageA
DefWindowProcA
GetWindowLongA
DestroyWindow
SetWindowLongA
KillTimer
SetTimer
UnregisterClassA
RegisterClassA
PeekMessageA
PostMessageA
SendDlgItemMessageA
GetDlgItemInt
SetDlgItemInt
SetFocus
MoveWindow
CreateWindowExA
wsprintfA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CreateOleAdviseHolder

advapi32

RegDeleteValueA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegEnumKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

oleaut32

VariantChangeType
SysAllocStringLen
SysAllocString
SafeArrayRedim
SysStringLen
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi
LoadTypeLibEx
OleCreatePropertyFrame
LoadRegTypeLi
SetErrorInfo
SysFreeString
CreateErrorInfo
GetErrorInfo
SafeArrayUnaccessData
SafeArrayDestroy
VariantClear
SysAllocStringByteLen
SafeArrayCreate
SysStringByteLen
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
VariantInit
SafeArrayAccessData
SafeArrayGetDim

gdi32

GetDeviceCaps
CreateCompatibleDC
CreateRectRgnIndirect
GetWindowExtEx
GetViewportExtEx
DeleteDC
DeleteObject
GetObjectA
LPtoDP
SetMapMode
SetViewportExtEx
SetWindowExtEx
SetViewportOrgEx
SetWindowOrgEx
CreateDCA
BitBlt
SelectObject

Exports

Exports

DLLGetDocumentation
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 68KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tianyin/playlist/0.lst
tianyin/playlist/1.lst
tianyin/playlist/10.lst
tianyin/playlist/13.lst
tianyin/playlist/18.lst
tianyin/playlist/19.lst
tianyin/playlist/2.lst
tianyin/playlist/3.lst
tianyin/playlist/4.lst
tianyin/playlist/5.lst
tianyin/playlist/6.lst
tianyin/playlist/7.lst
tianyin/playlist/8.lst
tianyin/playlist/9.lst
tianyin/playlist/ertong.lst
tianyin/playlist/hot.lst
tianyin/playlist/hotmusic.lst
tianyin/playlist/junlu.lst
tianyin/playlist/kala.lst
tianyin/playlist/laoge.lst
tianyin/playlist/mcount.dat
tianyin/playlist/minyue.lst
tianyin/playlist/mv.lst
tianyin/playlist/new.lst
tianyin/playlist/tiaijiao.lst
tianyin/playlist/vip.lst
tianyin/radio.dat
tianyin/readme.txt
tianyin/reg.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 21KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 26KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/skin/BlueFire.Wayhome(蓝火)/Skin.xml
tianyin/skin/BlueFire.Wayhome(蓝火)/back.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/close.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/equalizer.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/exit.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/icon.ico
tianyin/skin/BlueFire.Wayhome(蓝火)/lyric.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/lyric_skin.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_exit.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_lyric.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_minimize.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_minimode.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_next.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_open.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_pause.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_play.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_prev.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_skin.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mini_stop.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/minimize.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/minimode.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/mute.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/next.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/number.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/ontop.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/open.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/pause.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/play.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/player_skin.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/playlist.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/playlist_skin.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/playlist_toolbar.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/playlist_toolbar_hot.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/prev.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/progress_fill.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/progress_thumb.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/scrollbar_bar.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/scrollbar_button.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/scrollbar_thumb.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/search.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/splitter_arrow.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/splitter_bar.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/stop.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/volume_fill.bmp
tianyin/skin/BlueFire.Wayhome(蓝火)/volume_thumb.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/Readme.txt
tianyin/skin/MediaPlayer11(炫黑皮肤)/Skin.xml
tianyin/skin/MediaPlayer11(炫黑皮肤)/back.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/close.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/equalizer.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/exit.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/lyric.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/lyric_skin.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_exit.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_lyric.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_minimize.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_minimode.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_next.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_open.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_pause.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_play.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_prev.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_skin.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mini_stop.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/minimize.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/minimode.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/mute.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/next.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/number.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/numbers.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/ontop.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/open.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/pause.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/play.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/player_skin.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/playlist.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/playlist_skin.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/playlist_toolbar.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/playlist_toolbar_hot.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/prev.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/progress_fill.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/progress_thumb.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/scrollbar_bar.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/scrollbar_button.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/scrollbar_thumb.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/search.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/stop.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/volume_fill.bmp
tianyin/skin/MediaPlayer11(炫黑皮肤)/volume_thumb.bmp
tianyin/skin/Winamp(精典皮肤)/Skin.xml
tianyin/skin/Winamp(精典皮肤)/back.bmp
tianyin/skin/Winamp(精典皮肤)/close.bmp
tianyin/skin/Winamp(精典皮肤)/equalizer.bmp
tianyin/skin/Winamp(精典皮肤)/hot_playlist_toolbar.bmp
tianyin/skin/Winamp(精典皮肤)/lyric.bmp
tianyin/skin/Winamp(精典皮肤)/lyric_skin.bmp
tianyin/skin/Winamp(精典皮肤)/lyric_title.bmp
tianyin/skin/Winamp(精典皮肤)/mini_mute.bmp
tianyin/skin/Winamp(精典皮肤)/mini_next.bmp
tianyin/skin/Winamp(精典皮肤)/mini_normal.bmp
tianyin/skin/Winamp(精典皮肤)/mini_pause.bmp
tianyin/skin/Winamp(精典皮肤)/mini_play.bmp
tianyin/skin/Winamp(精典皮肤)/mini_prev.bmp
tianyin/skin/Winamp(精典皮肤)/mini_skin.bmp
tianyin/skin/Winamp(精典皮肤)/mini_stop.bmp
tianyin/skin/Winamp(精典皮肤)/mini_thumb.bmp
tianyin/skin/Winamp(精典皮肤)/mini_volume_fill.bmp
tianyin/skin/Winamp(精典皮肤)/minimize.bmp
tianyin/skin/Winamp(精典皮肤)/minimode.bmp
tianyin/skin/Winamp(精典皮肤)/mute.bmp
tianyin/skin/Winamp(精典皮肤)/next.bmp
tianyin/skin/Winamp(精典皮肤)/number.bmp
tianyin/skin/Winamp(精典皮肤)/ontop.bmp
tianyin/skin/Winamp(精典皮肤)/open.bmp
tianyin/skin/Winamp(精典皮肤)/pause.bmp
tianyin/skin/Winamp(精典皮肤)/play.bmp
tianyin/skin/Winamp(精典皮肤)/player_skin.bmp
tianyin/skin/Winamp(精典皮肤)/playlist.bmp
tianyin/skin/Winamp(精典皮肤)/playlist_skin.bmp
tianyin/skin/Winamp(精典皮肤)/playlist_title.bmp
tianyin/skin/Winamp(精典皮肤)/playlist_toolbar.bmp
tianyin/skin/Winamp(精典皮肤)/prev.bmp
tianyin/skin/Winamp(精典皮肤)/progress_fill.bmp
tianyin/skin/Winamp(精典皮肤)/progress_thumb.bmp
tianyin/skin/Winamp(精典皮肤)/scrollbar_bar.bmp
tianyin/skin/Winamp(精典皮肤)/scrollbar_button.bmp
tianyin/skin/Winamp(精典皮肤)/scrollbar_thumb.bmp
tianyin/skin/Winamp(精典皮肤)/search.bmp
tianyin/skin/Winamp(精典皮肤)/stop.bmp
tianyin/skin/Winamp(精典皮肤)/thumb.bmp
tianyin/skin/Winamp(精典皮肤)/volume_fill.bmp
tianyin/skin/default/Skin.xml
tianyin/skin/default/back.bmp
tianyin/skin/default/close.bmp
tianyin/skin/default/close2.bmp
tianyin/skin/default/hot_menu.bmp
tianyin/skin/default/loop.bmp
tianyin/skin/default/lyric.bmp
tianyin/skin/default/lyric_skin.bmp
tianyin/skin/default/menu.bmp
tianyin/skin/default/mini_close.bmp
tianyin/skin/default/mini_lyric.bmp
tianyin/skin/default/mini_minimize.bmp
tianyin/skin/default/mini_normal.bmp
tianyin/skin/default/mini_playlist.bmp
tianyin/skin/default/mini_skin.bmp
tianyin/skin/default/minimize.bmp
tianyin/skin/default/minimode.bmp
tianyin/skin/default/mute.bmp
tianyin/skin/default/next.bmp
tianyin/skin/default/noloop.bmp
tianyin/skin/default/novideo.bmp
tianyin/skin/default/number.bmp
tianyin/skin/default/ontop.bmp
tianyin/skin/default/open.bmp
tianyin/skin/default/pause.bmp
tianyin/skin/default/play.bmp
tianyin/skin/default/player_skin.bmp
tianyin/skin/default/playlist.bmp
tianyin/skin/default/playlist_skin.bmp
tianyin/skin/default/playlist_toolbar.bmp
tianyin/skin/default/playlist_toolbar_hot.bmp
tianyin/skin/default/prev.bmp
tianyin/skin/default/progress_fill.bmp
tianyin/skin/default/progress_thumb.bmp
tianyin/skin/default/rnd.bmp
tianyin/skin/default/search.bmp
tianyin/skin/default/shunxu.bmp
tianyin/skin/default/stop.bmp
tianyin/skin/default/video.bmp
tianyin/skin/default/volume_fill.bmp
tianyin/skin/default/volume_thumb.bmp
tianyin/skin/绿色魅影/Skin.xml
tianyin/skin/绿色魅影/back.bmp
tianyin/skin/绿色魅影/close.bmp
tianyin/skin/绿色魅影/close2.bmp
tianyin/skin/绿色魅影/hot_menu.bmp
tianyin/skin/绿色魅影/loop.bmp
tianyin/skin/绿色魅影/lyric.bmp
tianyin/skin/绿色魅影/lyric_skin.bmp
tianyin/skin/绿色魅影/menu.bmp
tianyin/skin/绿色魅影/mini_close.bmp
tianyin/skin/绿色魅影/mini_lyric.bmp
tianyin/skin/绿色魅影/mini_minimize.bmp
tianyin/skin/绿色魅影/mini_next.bmp
tianyin/skin/绿色魅影/mini_normal.bmp
tianyin/skin/绿色魅影/mini_pause.bmp
tianyin/skin/绿色魅影/mini_play.bmp
tianyin/skin/绿色魅影/mini_playlist.bmp
tianyin/skin/绿色魅影/mini_prev.bmp
tianyin/skin/绿色魅影/mini_skin.bmp
tianyin/skin/绿色魅影/mini_stop.bmp
tianyin/skin/绿色魅影/minimize.bmp
tianyin/skin/绿色魅影/minimode.bmp
tianyin/skin/绿色魅影/mute.bmp
tianyin/skin/绿色魅影/next.bmp
tianyin/skin/绿色魅影/noloop.bmp
tianyin/skin/绿色魅影/novideo.bmp
tianyin/skin/绿色魅影/number.bmp
tianyin/skin/绿色魅影/ontop.bmp
tianyin/skin/绿色魅影/open.bmp
tianyin/skin/绿色魅影/pause.bmp
tianyin/skin/绿色魅影/play.bmp
tianyin/skin/绿色魅影/player_skin.bmp
tianyin/skin/绿色魅影/playlist.bmp
tianyin/skin/绿色魅影/playlist_skin.bmp
tianyin/skin/绿色魅影/playlist_toolbar.bmp
tianyin/skin/绿色魅影/playlist_toolbar_hot.bmp
tianyin/skin/绿色魅影/prev.bmp
tianyin/skin/绿色魅影/progress_fill.bmp
tianyin/skin/绿色魅影/progress_thumb.bmp
tianyin/skin/绿色魅影/rnd.bmp
tianyin/skin/绿色魅影/search.bmp
tianyin/skin/绿色魅影/shunxu.bmp
tianyin/skin/绿色魅影/stop.bmp
tianyin/skin/绿色魅影/video.bmp
tianyin/skin/绿色魅影/volume_fill.bmp
tianyin/tianyin.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 638KB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 47KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/tvlist.dat
tianyin/update.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 107KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 27KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tianyin/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

b4d076238051fcc22607f17c728e83bc

Headers

File Characteristics

Imports

advapi32

kernel32

user32

Exports

Exports

Sections

.text Size: 138KB - Virtual size: 140KB

.data Size: 16KB - Virtual size: 56KB

.tls Size: 512B - Virtual size: 4KB

.idata Size: 2KB - Virtual size: 4KB

.edata Size: 512B - Virtual size: 4KB

.rsrc Size: 1024B - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.rdata Size: 512B - Virtual size: 112B

.rsrc Size: 98KB - Virtual size: 97KB

.reloc Size: 512B - Virtual size: 12B

Headers

File Characteristics

Exports

Exports

Sections

Size: 91KB - Virtual size: 372KB

.rsrc Size: 568B - Virtual size: 4KB

Size: - Virtual size: 8KB

Size: 4KB - Virtual size: 3KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 8KB - Virtual size: 20KB

.rsrc Size: 576B - Virtual size: 4KB

Size: - Virtual size: 4KB

Size: 1KB - Virtual size: 1KB

Headers

File Characteristics

Exports

Exports

Sections

Size: 12KB - Virtual size: 24KB

.rsrc Size: 576B - Virtual size: 4KB

Size: - Virtual size: 4KB

Size: 2KB - Virtual size: 1KB

8fee74aad97ca6d4da74fb5bd0aa4dce

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 360KB - Virtual size: 360KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 11KB - Virtual size: 220KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 20KB - Virtual size: 19KB

fcc40667ac22e0c598518006de958259

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6Certificate

Extended Key Usages

Key Usages

61:0e:7d:a7:00:00:00:00:00:48Certificate

.text
Size: 138KB - Virtual size: 140KB

.data
Size: 16KB - Virtual size: 56KB

.tls
Size: 512B - Virtual size: 4KB

.idata
Size: 2KB - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 8KB

.rdata
Size: 512B - Virtual size: 112B

.rsrc
Size: 98KB - Virtual size: 97KB

.reloc
Size: 512B - Virtual size: 12B

.rsrc
Size: 568B - Virtual size: 4KB

.rsrc
Size: 576B - Virtual size: 4KB

.rsrc
Size: 576B - Virtual size: 4KB

.text
Size: 360KB - Virtual size: 360KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 11KB - Virtual size: 220KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 20KB - Virtual size: 19KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:de:aa:11:d4:d8:40:9a:a8:be:e6
Certificate

61:0e:7d:a7:00:00:00:00:00:48
Certificate

5b:3d:e6:b4:56:d1:a3:cc:c3:77:ec:dd:05:31:a7:25:62:28:b5:bc
Signer

.text
Size: 68KB - Virtual size: 66KB

.data
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 28KB - Virtual size: 25KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 21KB - Virtual size: 44KB

.data
Size: 512B - Virtual size: 4KB

.rsrc
Size: 1024B - Virtual size: 24KB

.aspack
Size: 26KB - Virtual size: 28KB

.adata
Size: - Virtual size: 4KB

.text
Size: 638KB - Virtual size: 2.5MB

.data
Size: 512B - Virtual size: 68KB

.rsrc
Size: 1024B - Virtual size: 48KB

.aspack
Size: 47KB - Virtual size: 48KB

.adata
Size: - Virtual size: 4KB

.text
Size: 107KB - Virtual size: 328KB

.data
Size: 512B - Virtual size: 12KB

.rsrc
Size: 1024B - Virtual size: 24KB

.aspack
Size: 27KB - Virtual size: 28KB

.adata
Size: - Virtual size: 4KB