eae9cae98036a95e006d578e6959062f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

eae9cae98036a95e006d578e6959062f_JaffaCakes118
Size

4.3MB
MD5

eae9cae98036a95e006d578e6959062f
SHA1

74e6bc1238aa962a290e9d8a4ee5b279fa89a12b
SHA256

6e0ae8c9cfbc9f64cb972fb2b6f371c6b01803ce120f15e9de901765ce49f703
SHA512

c30dac6615abdc16e3e72a6b450c8dab86ecab524940061e971bf4ea41cd9b430e34fa6b8be5a56871dbf897708a81624fa466eae5ba907db5a4e97b7e5bda15
SSDEEP

98304:WCvYjZdxCfKElXB0gA/WC3gUZ3mKpkyEdrrSVXPX5jjqrSIU5rgVMG:ga/VWgA/WZUZFpud6VXPXgenuVMG

Score

7^/10

aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack001/XP美化大师/BeautificationMaster.exe	aspack_v212_v242
static1/unpack001/XP美化大师/update.dll	aspack_v212_v242

Files

eae9cae98036a95e006d578e6959062f_JaffaCakes118
.rar
XP美化大师/BeautificationMaster.exe
.exe windows:4 windows x86 arch:x86

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

13:83:e8:79:ea:d7:70:69:75:31:16:10:b6:db:bd:2b
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

09/07/2009, 00:00

Not After

08/07/2012, 23:59

Subject

CN=365 Network Information Consulting Co.\,Ltd,OU=Class 3 - for Microsoft Authenticode Signing,O=365 Network Information Consulting Co.\,Ltd,L=chenzhou,ST=hunan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

59:83:66:6d:28:40:53:49:82:c1:60:0a:24:9c:97:1a:70:ef:35:8a
Signer

Actual PE Digest

59:83:66:6d:28:40:53:49:82:c1:60:0a:24:9c:97:1a:70:ef:35:8a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

.text
Size: 380KB - Virtual size: 960KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.itext
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 20KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 520KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.aspack
Size: 40KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XP美化大师/ThemePatcher-x64.exe
.exe windows:5 windows x64 arch:x64

f631ae8ca1c7afaeec16b2938253cd05

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

Issuer

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

Not Before

18/01/2008, 16:00

Not After

31/12/2011, 16:00

Subject

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

90:79:83:6f:36:cc:71:14:ac:50:87:4e:aa:5e:24:0e:5b:46:07:ef
Signer

Actual PE Digest

90:79:83:6f:36:cc:71:14:ac:50:87:4e:aa:5e:24:0e:5b:46:07:ef

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

b:\universalthemepatcher\universalthemepatcher\x64\objfre_wnet_AMD64\amd64\UniversalThemePatcher-x64.pdb

Imports

mfc42u

ord3783
ord2903
ord2393
ord1441
ord1126
ord6660
ord5687
ord4721
ord5245
ord5406
ord6437
ord1777
ord5663
ord5702
ord4771
ord3761
ord337
ord4557
ord984
ord525
ord3177
ord6328
ord1499
ord4548
ord1287
ord1284
ord2846
ord626
ord6614
ord4214
ord5077
ord3742
ord1647
ord1812
ord1771
ord6243
ord4014
ord4826
ord620
ord2459
ord2049
ord6886
ord1122
ord6147
ord6184
ord5815
ord6832
ord6050
ord4436
ord6021
ord2900
ord665
ord624
ord1930
ord4599
ord4131
ord2517
ord852
ord1063
ord659
ord3916
ord4983
ord6053
ord5711
ord5730
ord1584
ord5065
ord4368
ord2752
ord5724
ord5722
ord3468
ord2412
ord5615
ord1388
ord4191
ord6071
ord2515
ord2559
ord4836
ord6813
ord4598
ord1035
ord4770
ord4988
ord4371
ord3164
ord4077
ord4083
ord4082
ord3046
ord3166
ord3052
ord3366
ord3231
ord4815
ord3362
ord3243
ord3049
ord5699
ord2140
ord2457
ord5683
ord1736
ord5484
ord3933
ord6814
ord2060
ord2670
ord4789
ord5229
ord4017
ord5712
ord4694
ord6812
ord5586
ord2399
ord4752
ord1778
ord4365
ord6440
ord1040
ord2427
ord3790
ord1463
ord6887
ord3830
ord4473
ord5039

msvcrt

_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_commode
_c_exit
exit
??1type_info@@UEAA@XZ
__dllonexit
_XcptFilter
__C_specific_handler
_wcsicmp
_cexit
__set_app_type
_exit
memset
__CxxFrameHandler
malloc
wcsrchr
wcstoul
__argc
__wargv
_wcslwr
wcsstr
_fmode
_onexit
?terminate@@YAXXZ
memcpy
free

advapi32

GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

MoveFileExW
DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
GetEnvironmentVariableW
FindFirstFileW
GetPrivateProfileStringW
IsValidLocale
GetLocaleInfoW
FindNextFileW
lstrcmpiW
GetModuleFileNameW
GetVersionExW
GetModuleHandleW
GetProcAddress
GetSystemInfo
CopyFileW
lstrcpyW
lstrcmpW
lstrcatW
GetCurrentProcess
GetLastError
GetTempFileNameW
LoadLibraryW
UnmapViewOfFile
IsBadReadPtr
MapViewOfFile
CreateFileW
WriteFile
SetFilePointer
Sleep
ReadFile
lstrcpynW
LockResource
LoadResource
FindResourceExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStartupInfoW
CloseHandle
GetExitCodeProcess
WaitForSingleObject
FreeLibrary
GetWindowsDirectoryW
CreateMutexW
GetFileSize
CreateFileMappingW

gdi32

GetObjectW
CreateSolidBrush
GetStockObject
CreateFontIndirectW

user32

CharNextW
MessageBeep
LoadCursorW
SetCursor
InvalidateRect
ExitWindowsEx
SetWindowPos
GetClassNameW
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
GetSystemMenu
PostMessageW
SendMessageW
AppendMenuW
EnableWindow
MessageBoxW
DrawIcon
wsprintfW

shell32

DragQueryFileW
ShellExecuteExW
ShellExecuteW
DragFinish

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

CheckSumMappedFile
MapFileAndCheckSumW

comctl32

CreateStatusWindowW

wintrust

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext

netapi32

NetUserGetInfo
NetApiBufferFree

Sections

.text
Size: 59KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
XP美化大师/ThemePatcher-x86.exe
.exe windows:5 windows x86 arch:x86

315a1b02d7617389cdbdf1e1faba5302

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

Issuer

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

Not Before

18/01/2008, 16:00

Not After

31/12/2011, 16:00

Subject

CN=deepxw Software,O=deepxw Software,1.2.840.113549.1.9.1=#1306646565707877

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

63:21:92:f9:d0:34:fb:ef:08:ff:6e:e2:8b:fb:26:de:9b:0e:4f:b4
Signer

Actual PE Digest

63:21:92:f9:d0:34:fb:ef:08:ff:6e:e2:8b:fb:26:de:9b:0e:4f:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

b:\universalthemepatcher\universalthemepatcher\x86\objfre_wnet_x86\i386\UniversalThemePatcher-x86.pdb

Imports

mfc42u

ord815
ord641
ord2506
ord3948
ord2858
ord2371
ord1143
ord861
ord6237
ord5261
ord4370
ord4847
ord4992
ord6048
ord1767
ord5237
ord5276
ord4419
ord3592
ord324
ord4229
ord755
ord470
ord3087
ord5949
ord1197
ord4219
ord942
ord940
ord2810
ord540
ord561
ord4155
ord4704
ord3568
ord1634
ord1808
ord1761
ord5871
ord3792
ord4470
ord535
ord823
ord858
ord5798
ord5446
ord6390
ord5706
ord4124
ord5679
ord2855
ord3397
ord3716
ord567
ord538
ord1921
ord4270
ord3871
ord2036
ord2440
ord1569
ord3733
ord4616
ord5710
ord5285
ord5303
ord4692
ord4074
ord2717
ord5830
ord5298
ord5296
ord3341
ord2388
ord5193
ord1089
ord3917
ord5727
ord2504
ord2546
ord4480
ord6371
ord4269
ord825
ord795
ord4418
ord4621
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord5273
ord2116
ord2438
ord5257
ord1720
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord4401
ord1768
ord4073
ord6051
ord800
ord3614
ord2406
ord3621
ord1165
ord3658
ord6195
ord4667

msvcrt

__p__commode
__p__fmode
__set_app_type
_except_handler3
__wgetmainargs
_adjust_fdiv
_onexit
_wcmdln
exit
_cexit
__setusermatherr
__dllonexit
_initterm
__argc
__wargv
_XcptFilter
_exit
_wcsicmp
malloc
free
wcsrchr
wcstoul
??1type_info@@UAE@XZ
_controlfp
?terminate@@YAXXZ
wcslen
_wcslwr
wcsstr
__CxxFrameHandler
_c_exit

advapi32

GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

DeleteFileW
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetVersion
GetEnvironmentVariableW
FindFirstFileW
GetLocaleInfoW
GetPrivateProfileStringW
IsValidLocale
FindNextFileW
lstrcmpiW
GetModuleFileNameW
GetVersionExW
GetModuleHandleW
GetProcAddress
GetSystemInfo
CopyFileW
lstrcpyW
lstrcmpW
GetWindowsDirectoryW
CreateMutexW
GetLastError
MoveFileExW
FreeLibrary
LoadLibraryW
UnmapViewOfFile
IsBadReadPtr
GetFileSize
CreateFileW
WriteFile
SetFilePointer
Sleep
ReadFile
lstrcpynW
LockResource
LoadResource
FindResourceExW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetTempFileNameW
CloseHandle
GetExitCodeProcess
GetCurrentProcess
WaitForSingleObject
lstrcatW
CreateFileMappingW
MapViewOfFile

gdi32

GetObjectW
CreateSolidBrush
GetStockObject
CreateFontIndirectW

user32

CharNextW
MessageBeep
LoadCursorW
SetCursor
InvalidateRect
ExitWindowsEx
GetClassNameW
wsprintfW
GetSystemMetrics
LoadIconW
GetClientRect
IsIconic
GetSystemMenu
PostMessageW
EnableWindow
MessageBoxW
DrawIcon
AppendMenuW
SendMessageW
SetWindowPos

shell32

DragQueryFileW
ShellExecuteExW
ShellExecuteW
DragFinish

shlwapi

PathFileExistsW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

imagehlp

CheckSumMappedFile
MapFileAndCheckSumW

comctl32

CreateStatusWindowW

wintrust

CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
WinVerifyTrust
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext

netapi32

NetUserGetInfo
NetApiBufferFree

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
XP美化大师/cache/cursor/77_Black_Arrow.jpg
.jpg
XP美化大师/cache/cursor/Abiss.jpg
.jpg .ps1 polyglot
XP美化大师/cache/cursor/Aliel.jpg
.jpg
XP美化大师/cache/cursor/Blue hand.jpg
.jpg
XP美化大师/cache/cursor/BlueCrystal.jpg
.jpg
XP美化大师/cache/cursor/Bubbasmall.jpg
.jpg
XP美化大师/cache/cursor/Chrome Glass.jpg
.jpg
XP美化大师/cache/cursor/Cranberry.jpg
.jpg
XP美化大师/cache/cursor/Cristal.jpg
.jpg
XP美化大师/cache/cursor/Floral.jpg
.jpg
XP美化大师/cache/cursor/Fresh.jpg
.jpg
XP美化大师/cache/cursor/Gleam XP.jpg
.jpg
XP美化大师/cache/cursor/Grey.jpg
.jpg
XP美化大师/cache/cursor/KLES.jpg
.jpg
XP美化大师/cache/cursor/Lindein Green.jpg
.jpg
XP美化大师/cache/cursor/MacCursorX_s.jpg
.jpg
XP美化大师/cache/cursor/NuclearGreen.jpg
.jpg
XP美化大师/cache/cursor/OldSys.jpg
.jpg
XP美化大师/cache/cursor/Pal3A.jpg
.jpg
XP美化大师/cache/cursor/PurpleKeKe_Blue.jpg
.jpg
XP美化大师/cache/cursor/PurpleKeKe_Green.jpg
.jpg
XP美化大师/cache/cursor/PurpleKeKe_LightRed.jpg
.jpg
XP美化大师/cache/cursor/Red Glass.jpg
.jpg
XP美化大师/cache/cursor/SeffyXmas.jpg
.jpg
XP美化大师/cache/cursor/Semi_transparent.jpg
.jpg
XP美化大师/cache/cursor/Soft_Blue.jpg
.jpg
XP美化大师/cache/cursor/Sour Apple.jpg
.jpg
XP美化大师/cache/cursor/Valentine's Day.jpg
.jpg
XP美化大师/cache/cursor/VistaPlastic.jpg
.jpg
XP美化大师/cache/cursor/White hand.jpg
.jpg
XP美化大师/cache/cursor/redfish.jpg
.jpg
XP美化大师/cache/logon/Addy Blue logon.jpg
.jpg
XP美化大师/cache/logon/Animated Longhorn.jpg
.jpg
XP美化大师/cache/logon/Arise Logon.jpg
.jpg
XP美化大师/cache/logon/Aston Marten Amv.jpg
.jpg
XP美化大师/cache/logon/Fergie.jpg
.jpg
XP美化大师/cache/logon/Future Kid.jpg
.jpg
XP美化大师/cache/logon/Longhorn Plex.jpg
.jpg
XP美化大师/cache/logon/Longhorn XP Slate.jpg
.jpg
XP美化大师/cache/logon/MAC OS Leopard.jpg
.jpg
XP美化大师/cache/logon/MacOS X-1.jpg
.jpg
XP美化大师/cache/logon/MacOS X-2.jpg
.jpg
XP美化大师/cache/logon/Moonrise 2.jpg
.jpg
XP美化大师/cache/logon/Novum OS.jpg
.jpg
XP美化大师/cache/logon/OS X2.jpg
.jpg
XP美化大师/cache/logon/Perfect.jpg
.jpg
XP美化大师/cache/logon/Planet.jpg
.jpg
XP美化大师/cache/logon/Spring Fairy Tale.jpg
.jpg
XP美化大师/cache/logon/Ubuntu.jpg
.jpg
XP美化大师/cache/logon/Vista MCE.jpg
.jpg
XP美化大师/cache/logon/Win7-绿色.jpg
.jpg
XP美化大师/cache/logon/Win7-蓝色.jpg
.jpg
XP美化大师/cache/logon/Windows Seven深蓝.jpg
.jpg
XP美化大师/cache/logon/夏日冰冰凉.jpg
.jpg
XP美化大师/cache/logon/月夜蝴蝶.jpg
.jpg
XP美化大师/cache/logon/韩庚.jpg
.jpg
XP美化大师/cache/theme/3D搞笑动物.jpg
.jpg
XP美化大师/cache/theme/4月可爱卡通.jpg
.jpg
XP美化大师/cache/theme/Azul 2.1.jpg
.jpg
XP美化大师/cache/theme/Hello KittyⅧ.jpg
.jpg
XP美化大师/cache/theme/Kiss Me.jpg
.jpg
XP美化大师/cache/theme/Leopard 2.0.jpg
.jpg
XP美化大师/cache/theme/Leopard X.jpg
.jpg
XP美化大师/cache/theme/Mac OS X iLimited.jpg
.jpg
XP美化大师/cache/theme/OSX Tiger.jpg
.jpg
XP美化大师/cache/theme/Tiger.jpg
.jpg
XP美化大师/cache/theme/X Aqua 2.jpg
.jpg
XP美化大师/cache/theme/三叶草.jpg
.jpg
XP美化大师/cache/theme/仰望天空.jpg
.jpg
XP美化大师/cache/theme/伊丽莎白乐.jpg
.jpg
XP美化大师/cache/theme/做梦也想你.jpg
.jpg
XP美化大师/cache/theme/兔斯基.jpg
.jpg
XP美化大师/cache/theme/兔斯基Ⅱ.jpg
.jpg
XP美化大师/cache/theme/刘亦菲Ⅱ.jpg
.jpg
XP美化大师/cache/theme/勾勾手.jpg
.jpg
XP美化大师/cache/theme/北京2008.jpg
.jpg
XP美化大师/cache/theme/可爱CG美女.jpg
.jpg
XP美化大师/cache/theme/可爱七仔.jpg
.jpg
XP美化大师/cache/theme/可爱女孩.jpg
.jpg
XP美化大师/cache/theme/可爱小盒子.jpg
.jpg
XP美化大师/cache/theme/可爱小驴子.jpg
.jpg
XP美化大师/cache/theme/可爱的懒睡猫猫.jpg
.jpg
XP美化大师/cache/theme/周杰伦Ⅱ.jpg
.jpg
XP美化大师/cache/theme/周迅.jpg
.jpg
XP美化大师/cache/theme/夜幕.jpg
.jpg
XP美化大师/cache/theme/宇智波鼬.jpg
.jpg
XP美化大师/cache/theme/宋慧乔.jpg
.jpg
XP美化大师/cache/theme/小老鼠.jpg
.jpg
XP美化大师/cache/theme/小资女生.jpg
.jpg
XP美化大师/cache/theme/幸福指环.jpg
.jpg
XP美化大师/cache/theme/幸福的约定.jpg
.jpg
XP美化大师/cache/theme/彩色苹果.jpg
.jpg
XP美化大师/cache/theme/彩虹MM.jpg
.jpg
XP美化大师/cache/theme/彩虹天使.jpg
.jpg
XP美化大师/cache/theme/心形Ⅱ.jpg
.jpg
XP美化大师/cache/theme/手牵手.jpg
.jpg
XP美化大师/cache/theme/捷克之春.jpg
.jpg
XP美化大师/cache/theme/朝雾麻衣.jpg
.jpg
XP美化大师/cache/theme/林宝坚尼.jpg
.jpg
XP美化大师/cache/theme/梦幻卡通Ⅱ.jpg
.jpg
XP美化大师/cache/theme/死神（Bleach）.jpg
.jpg
XP美化大师/cache/theme/永恒的爱.jpg
.jpg
XP美化大师/cache/theme/永远的爱.jpg
.jpg
XP美化大师/cache/theme/法拉利.jpg
.jpg
XP美化大师/cache/theme/洋葱头情侣.jpg
.jpg
XP美化大师/cache/theme/浪漫小情侣.jpg
.jpg
XP美化大师/cache/theme/浪漫的童话.jpg
.jpg
XP美化大师/cache/theme/深度娱乐主题.jpg
.jpg
XP美化大师/cache/theme/深色Aquanox风格.jpg
.jpg
XP美化大师/cache/theme/清明节.jpg
.jpg
XP美化大师/cache/theme/清纯佳人.jpg
.jpg
XP美化大师/cache/theme/爱是什么Ⅱ.jpg
.jpg
XP美化大师/cache/theme/爱是什么Ⅲ.jpg
.jpg
XP美化大师/cache/theme/爱的漂流瓶.jpg
.jpg
XP美化大师/cache/theme/玫瑰人生.jpg
.jpg
XP美化大师/cache/theme/甜蜜情侣.jpg
.jpg
XP美化大师/cache/theme/甜蜜的恋爱.jpg
.jpg
XP美化大师/cache/theme/矢量情侣.jpg
.jpg
XP美化大师/cache/theme/立体矢量.jpg
.jpg
XP美化大师/cache/theme/粉红女孩Ⅱ.jpg
.jpg
XP美化大师/cache/theme/粉红洋葱头.jpg
.jpg
XP美化大师/cache/theme/精美简约苹果.jpg
.jpg
XP美化大师/cache/theme/精美花纹Ⅱ.jpg
.jpg
XP美化大师/cache/theme/红楼梦Ⅱ.jpg
.jpg
XP美化大师/cache/theme/绿色动物卡通.jpg
.jpg
XP美化大师/cache/theme/罗志祥.jpg
.jpg
XP美化大师/cache/theme/苹果标志.jpg
.jpg
XP美化大师/cache/theme/蓝色Royale风格.jpg
.jpg
XP美化大师/cache/theme/蓝色TANGO平板风格.jpg
.jpg
XP美化大师/cache/theme/蓝色仙剑.jpg
.jpg
XP美化大师/cache/theme/蓝色洋葱头.jpg
.jpg
XP美化大师/cache/theme/蝴蝶效应.jpg
.jpg
XP美化大师/cache/theme/远山翠.jpg
.jpg
XP美化大师/cache/theme/非主流Ⅴ.jpg
.jpg
XP美化大师/cache/theme/非主流美女Ⅳ.jpg
.jpg
XP美化大师/cache/theme/韩国风格.jpg
.jpg
XP美化大师/cache/theme/韩庚帅哥.jpg
.jpg
XP美化大师/cache/theme/骄傲的公主.jpg
.jpg
XP美化大师/cache/theme/鱼骨简约.jpg
.jpg
XP美化大师/cache/theme/黑猫.jpg
.jpg
XP美化大师/cache/theme/黑色Vista主题.jpg
.jpg
XP美化大师/cache/theme/黑色变形金刚电影.jpg
.jpg
XP美化大师/update.dll
.dll windows:4 windows x86 arch:x86

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

25/04/2007, 00:00

Not After

09/07/2019, 18:40

Subject

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning
ExtKeyUsageClientAuth

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

09/07/1999, 18:31

Not After

09/07/2019, 18:40

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

30/04/2007, 00:00

Not After

29/04/2012, 23:59

Subject

CN=WoSign Time Stamping Signer,O=WoSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

13:83:e8:79:ea:d7:70:69:75:31:16:10:b6:db:bd:2b
Certificate

Issuer

CN=WoSign Code Signing Authority,O=WoSign\, Inc.,C=US

Not Before

09/07/2009, 00:00

Not After

08/07/2012, 23:59

Subject

CN=365 Network Information Consulting Co.\,Ltd,OU=Class 3 - for Microsoft Authenticode Signing,O=365 Network Information Consulting Co.\,Ltd,L=chenzhou,ST=hunan,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

5d:b5:ec:93:1d:2f:27:35:a0:81:05:a4:f5:8e:34:75:bc:e7:a5:90
Signer

Actual PE Digest

5d:b5:ec:93:1d:2f:27:35:a0:81:05:a4:f5:8e:34:75:bc:e7:a5:90

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

BeginUpdate
DoUpdate

Sections

CODE
Size: 196KB - Virtual size: 492KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 21KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CHINA
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
XP美化大师/新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

Code Sign

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04Certificate

Extended Key Usages

Key Usages

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1bCertificate

Extended Key Usages

Key Usages

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0dCertificate

Extended Key Usages

Key Usages

13:83:e8:79:ea:d7:70:69:75:31:16:10:b6:db:bd:2bCertificate

Extended Key Usages

Key Usages

59:83:66:6d:28:40:53:49:82:c1:60:0a:24:9c:97:1a:70:ef:35:8aSigner

Headers

File Characteristics

Sections

.text Size: 380KB - Virtual size: 960KB

.itext Size: 2KB - Virtual size: 4KB

.data Size: 20KB - Virtual size: 40KB

.bss Size: - Virtual size: 20KB

.idata Size: 4KB - Virtual size: 16KB

.tls Size: - Virtual size: 4KB

.rdata Size: 512B - Virtual size: 4KB

.reloc Size: - Virtual size: 56KB

.rsrc Size: 34KB - Virtual size: 520KB

.aspack Size: 40KB - Virtual size: 44KB

.adata Size: - Virtual size: 4KB

f631ae8ca1c7afaeec16b2938253cd05

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4cCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

90:79:83:6f:36:cc:71:14:ac:50:87:4e:aa:5e:24:0e:5b:46:07:efSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mfc42u

msvcrt

advapi32

kernel32

gdi32

user32

shell32

shlwapi

version

imagehlp

comctl32

wintrust

netapi32

Sections

.text Size: 59KB - Virtual size: 59KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 25KB - Virtual size: 25KB

315a1b02d7617389cdbdf1e1faba5302

Code Sign

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4cCertificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

63:21:92:f9:d0:34:fb:ef:08:ff:6e:e2:8b:fb:26:de:9b:0e:4f:b4Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

13:83:e8:79:ea:d7:70:69:75:31:16:10:b6:db:bd:2b
Certificate

59:83:66:6d:28:40:53:49:82:c1:60:0a:24:9c:97:1a:70:ef:35:8a
Signer

.text
Size: 380KB - Virtual size: 960KB

.itext
Size: 2KB - Virtual size: 4KB

.data
Size: 20KB - Virtual size: 40KB

.bss
Size: - Virtual size: 20KB

.idata
Size: 4KB - Virtual size: 16KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 56KB

.rsrc
Size: 34KB - Virtual size: 520KB

.aspack
Size: 40KB - Virtual size: 44KB

.adata
Size: - Virtual size: 4KB

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

90:79:83:6f:36:cc:71:14:ac:50:87:4e:aa:5e:24:0e:5b:46:07:ef
Signer

.text
Size: 59KB - Virtual size: 59KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 25KB - Virtual size: 25KB

18:23:2a:ce:52:10:a6:b0:4d:86:17:a5:00:40:af:4c
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

63:21:92:f9:d0:34:fb:ef:08:ff:6e:e2:8b:fb:26:de:9b:0e:4f:b4
Signer

.text
Size: 41KB - Virtual size: 41KB

.data
Size: 1024B - Virtual size: 2KB

.rsrc
Size: 25KB - Virtual size: 25KB

42:ce:8a:30:d3:56:02:f8:41:18:6c:6e:20:53:19:04
Certificate

44:be:0c:8b:50:00:24:b4:11:d3:36:2d:e0:b3:5f:1b
Certificate

43:73:c5:9c:4f:32:a9:e5:b5:d3:de:f1:26:9a:12:0d
Certificate

13:83:e8:79:ea:d7:70:69:75:31:16:10:b6:db:bd:2b
Certificate

5d:b5:ec:93:1d:2f:27:35:a0:81:05:a4:f5:8e:34:75:bc:e7:a5:90
Signer

CODE
Size: 196KB - Virtual size: 492KB

DATA
Size: 3KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 12KB

.edata
Size: 512B - Virtual size: 4KB

.reloc
Size: 21KB - Virtual size: 40KB

.rsrc
Size: 11KB - Virtual size: 32KB

.CHINA
Size: 6KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB