faf77835071ab6253515f21c95cf61a4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

faf77835071ab6253515f21c95cf61a4_JaffaCakes118
Size

4.5MB
MD5

faf77835071ab6253515f21c95cf61a4
SHA1

db5e20d607de32811e2831215c7caa54eeaed05e
SHA256

df4aab91aefc47d2422dc700ada8ebea52b20cf12391a7f774bea7632996a897
SHA512

f4b8fec55199200870c312ac36eaef96c4d7c82768ad53c567947092a53e08d508e90588867fef564681fed491fac5056d3012abef8442903665a1c134f167d3
SSDEEP

98304:3KnmowGNAlVnmEzwDo9egCkcLnqOKfFjmsA8ahfIUrDUmNaHZbYxeSBqGZBwGtqo:3YmoLN6VcDJkon8fFSn7rhzx5BqsW1Bi

Score

7^/10

upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	acprotect
static1/unpack003/$PLUGINSDIR/AccessControl.dll	acprotect

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/$PLUGINSDIR/AccessControl.dll	upx
static1/unpack003/$PLUGINSDIR/AccessControl.dll	upx

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/AccessControl.dll
unpack002/out.upx
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack003/$PLUGINSDIR/AccessControl.dll
unpack004/out.upx
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsExec.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninst.exe	nsis_installer_1
static1/unpack001/Uninst.exe	nsis_installer_2

Files

faf77835071ab6253515f21c95cf61a4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c8:51:a7:8b:fe:16:98:c5:b9:1a:e0:cd:b4:3c:c4:7f:67:6e:23:ff:93:10:4d:6f:83:e4:f4:83:b3:3d:05:dc
Signer

Actual PE Digest

c8:51:a7:8b:fe:16:98:c5:b9:1a:e0:cd:b4:3c:c4:7f:67:6e:23:ff:93:10:4d:6f:83:e4:f4:83:b3:3d:05:dc

Digest Algorithm

sha256

PE Digest Matches

true

f1:94:88:0c:b9:6b:6f:4e:e2:c9:63:3e:aa:be:03:c8:0e:40:40:f5
Signer

Actual PE Digest

f1:94:88:0c:b9:6b:6f:4e:e2:c9:63:3e:aa:be:03:c8:0e:40:40:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/AccessControl.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstHlp.dll
.dll windows:5 windows x86 arch:x86

c8d28c8ec3ed633365eedf3ec168225b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

91:05:55:33:88:f2:7c:dc:c5:2d:1e:c3:62:57:57:21:e9:e8:14:8c:da:75:3f:f1:03:c0:c4:04:ef:79:82:2f
Signer

Actual PE Digest

91:05:55:33:88:f2:7c:dc:c5:2d:1e:c3:62:57:57:21:e9:e8:14:8c:da:75:3f:f1:03:c0:c4:04:ef:79:82:2f

Digest Algorithm

sha256

PE Digest Matches

true

c3:90:85:b2:d3:81:15:8f:83:9f:90:4a:f4:2d:56:1d:9b:ab:c4:6b
Signer

Actual PE Digest

c3:90:85:b2:d3:81:15:8f:83:9f:90:4a:f4:2d:56:1d:9b:ab:c4:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\InstHlp.pdb

Imports

kernel32

DeviceIoControl
GetSystemDirectoryA
CreateFileA
GlobalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetOverlappedResult
ResetEvent
CancelIo
WaitForSingleObjectEx
OutputDebugStringA
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
HeapReAlloc
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetCurrentThread
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCommandLineA
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
GetStringTypeW
GlobalAlloc
lstrcpynA
lstrcpyA
DeleteFileW
LoadLibraryA
GetVersionExW
GetNativeSystemInfo
GetProcessId
GetLocalTime
CreateDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
SetFileTime
SetFilePointer
WriteFile
GetFileType
FreeLibrary
MulDiv
GetACP
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryW
ReadFile
GetFileSize
SwitchToThread
GetModuleFileNameA
TerminateProcess
GetCurrentProcessId
DecodePointer
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
WaitForSingleObject
CreateThread
GetDriveTypeW
FindResourceExW
SetEvent
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
GetCurrentThreadId
GetProcessHeap
RaiseException
HeapSize
GetOEMCP
HeapFree
HeapAlloc
HeapDestroy
FindResourceW
CreateEventW
SizeofResource
LoadResource
LockResource
InterlockedIncrement
FreeResource
IsBadReadPtr
SearchPathA
CreateFileW
VirtualProtect
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryW
GetTickCount
CloseHandle
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcess
OpenProcess
GetLongPathNameW
LocalFree
InterlockedExchange
InterlockedDecrement
IsValidCodePage

user32

OpenWindowStationA
OpenDesktopA
RegisterClassW
GetMenu
SetPropW
GetPropW
CloseDesktop
EnumDesktopWindows
EnumDesktopsA
wsprintfW
GetIconInfo
DrawIconEx
LoadImageW
DestroyIcon
PrivateExtractIconsW
GetSystemMetrics
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
AdjustWindowRectEx
CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
MonitorFromPoint
InflateRect
SetCursor
wvsprintfW
PtInRect
IsRectEmpty
UnionRect
IntersectRect
GetCursorPos
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
EnumWindowStationsA
CloseWindowStation
IsWindowVisible
GetWindowRect
GetParent
GetWindowThreadProcessId
ActivateKeyboardLayout
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyWindow
IsWindow
IsChild
GetCaretBlinkTime
wsprintfA
ShowWindow
MoveWindow
SetWindowPos
IsIconic
IsZoomed
SetFocus
GetActiveWindow
SetTimer
KillTimer
EnableWindow
SetWindowRgn
GetClientRect
ScreenToClient
MapWindowPoints
CopyRect
OffsetRect
GetWindowLongW
GetKeyState
GetFocus
SetWindowLongW
GetWindow
LoadCursorW
MonitorFromWindow
GetMonitorInfoW
CharNextW

advapi32

RegCloseKey
LookupAccountNameW
RevertToSelf
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegSetValueExW
RegSetValueExA
RegSetKeySecurity
RegSaveKeyA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegLoadKeyA
RegGetKeySecurity
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidW
RegOpenKeyW
GetTokenInformation
OpenProcessToken
ImpersonateLoggedOnUser
RegCreateKeyExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
OleLockRunning

shell32

SHGetPathFromIDListW
SHFileOperationW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetFileInfoW

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

PathIsDirectoryW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17

gdi32

DeleteObject
BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
GetObjectType
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
GetDeviceCaps
CombineRgn
CreateCompatibleBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GdiFlush
GetObjectA
CreateRoundRectRgn

gdiplus

GdiplusStartup
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipSetStringFormatAlign

psapi

GetProcessImageFileNameW

winhttp

WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen

iphlpapi

GetAdaptersInfo

ws2_32

inet_ntoa
recvfrom
sendto
gethostbyname
WSAStartup
inet_addr
WSACreateEvent
WSAWaitForMultipleEvents
WSASocketW
WSAEventSelect
WSAEnumNetworkEvents
WSACleanup

Exports

Exports

DLL_fcanonical
DLL_mkconfig1
DLL_read_conf_timestamp
DLL_set_fnid
DLL_stop_processes
DestroyUI
GetAppDataDir
GetInstDir
GetInstallConfig
GetUIControlCode
InitUI
InstallPrepare
InstallSetCfg
InstalledComplete
IsPassing
RemoveAppDataDir
SetInstDir
SetNSISControlCode
ShowUI
UninstalledComplete

Sections

.text
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

46f8b6973f33717335c0f6d8087de67b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GetVersion
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GlobalLock
lstrcatA

user32

SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuExtern.dll
.dll regsvr32 windows:5 windows x86 arch:x86

62bfdfb6fa063a691f72bd14eded0a0a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

22:88:78:86:04:8d:c6:f5:d4:0c:a4:8e:80:27:1a:71:58:b6:b8:07:3d:36:71:06:0f:89:0a:e5:e7:4e:ac:16
Signer

Actual PE Digest

22:88:78:86:04:8d:c6:f5:d4:0c:a4:8e:80:27:1a:71:58:b6:b8:07:3d:36:71:06:0f:89:0a:e5:e7:4e:ac:16

Digest Algorithm

sha256

PE Digest Matches

true

8f:8e:54:9f:ca:c0:83:c6:b3:69:ad:8c:3a:42:14:f7:6d:f7:00:0c
Signer

Actual PE Digest

8f:8e:54:9f:ca:c0:83:c6:b3:69:ad:8c:3a:42:14:f7:6d:f7:00:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
FindResourceW
FindResourceExW
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalLock
GlobalUnlock
lstrcmpiA
lstrcpynA
lstrcpynW
LoadLibraryA
DecodePointer
RaiseException
ReadConsoleW
ReadFile
SetEndOfFile
WriteConsoleW
SetFilePointerEx
CreateFileW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
GetStringTypeW
GetNativeSystemInfo
GetLocalTime
CloseHandle
SizeofResource
LoadResource
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
OpenProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
VirtualQuery
LocalFree
GetProcAddress
LockResource
InterlockedDecrement
LoadLibraryW
InterlockedIncrement
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateDirectoryW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
GetTimeZoneInformation
CompareStringW
LCMapStringW

user32

LoadImageW
GetSystemMetrics
GetIconInfo
SetRect
DrawIconEx
SetMenuInfo
DestroyIcon
InsertMenuItemW
GetMenuInfo

gdi32

SelectObject
GetDIBits
DeleteDC
CreateCompatibleDC
DeleteObject
CreateDIBSection

advapi32

ConvertSidToStringSidW
RegSetValueExW
RegSetValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyA
RegCloseKey
ImpersonateLoggedOnUser
GetUserNameW
LookupAccountNameW
OpenProcessToken
RevertToSelf

shell32

ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
DragQueryFileW

ole32

IIDFromString
ReleaseStgMedium

shlwapi

SHSetValueW
StrStrIW
SHDeleteKeyA
StrCmpIW
PathFileExistsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuExtern64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

d51e5632888861ab9381c5c16ba45ea4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c4:e9:ad:47:8d:a5:8f:b0:dd:f7:df:0e:84:09:21:41:8e:45:57:5e:f1:cb:ec:be:90:32:43:62:2c:5d:45:1e
Signer

Actual PE Digest

c4:e9:ad:47:8d:a5:8f:b0:dd:f7:df:0e:84:09:21:41:8e:45:57:5e:f1:cb:ec:be:90:32:43:62:2c:5d:45:1e

Digest Algorithm

sha256

PE Digest Matches

true

bd:7f:9e:bd:ee:e1:91:20:b6:95:3b:33:c6:aa:7e:39:c2:64:13:80
Signer

Actual PE Digest

bd:7f:9e:bd:ee:e1:91:20:b6:95:3b:33:c6:aa:7e:39:c2:64:13:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
FindResourceW
FindResourceExW
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalLock
GlobalUnlock
lstrcmpiA
lstrcpynA
lstrcpynW
LoadLibraryW
GetModuleFileNameW
RaiseException
ReadConsoleW
ReadFile
SetEndOfFile
WriteConsoleW
SetFilePointerEx
CreateFileW
GetConsoleMode
GetConsoleCP
WriteFile
FlushFileBuffers
SetStdHandle
GetModuleFileNameA
LoadLibraryA
GetNativeSystemInfo
GetLocalTime
CloseHandle
LoadResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
OpenProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
VirtualQuery
LocalFree
GetProcAddress
LockResource
GetStringTypeW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
IsDebuggerPresent
OutputDebugStringW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateDirectoryW
ExitProcess
GetModuleHandleExW
GetACP
GetStdHandle
GetFileType
GetTimeZoneInformation
CompareStringW
LCMapStringW
FindClose

user32

GetSystemMetrics
SetMenuInfo
GetIconInfo
SetRect
DrawIconEx
LoadImageW
DestroyIcon
InsertMenuItemW
GetMenuInfo

gdi32

SelectObject
GetDIBits
DeleteDC
CreateCompatibleDC
DeleteObject
CreateDIBSection

advapi32

ConvertSidToStringSidW
RegSetValueExW
RegSetValueW
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
RegCreateKeyA
RegCloseKey
ImpersonateLoggedOnUser
GetUserNameW
LookupAccountNameW
OpenProcessToken
RevertToSelf

shell32

SHGetSpecialFolderPathW
ShellExecuteExW
DragQueryFileW
ShellExecuteW

ole32

ReleaseStgMedium
IIDFromString

shlwapi

StrStrIW
SHSetValueW
StrCmpIW
SHDeleteKeyA
PathFileExistsW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuMiniNews.exe
.exe windows:5 windows x86 arch:x86

571f1de0523a5772020eb4fc8c876d83

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

09:cb:3a:34:bc:a5:ff:f8:e8:cc:27:1c:56:da:fa:98:11:d9:d4:d2:44:75:dd:02:fc:8e:a1:04:05:c1:4a:d4
Signer

Actual PE Digest

09:cb:3a:34:bc:a5:ff:f8:e8:cc:27:1c:56:da:fa:98:11:d9:d4:d2:44:75:dd:02:fc:8e:a1:04:05:c1:4a:d4

Digest Algorithm

sha256

PE Digest Matches

true

d7:0c:d4:73:3e:41:4e:2d:ad:47:7b:e6:6d:5e:d6:35:93:05:01:7e
Signer

Actual PE Digest

d7:0c:d4:73:3e:41:4e:2d:ad:47:7b:e6:6d:5e:d6:35:93:05:01:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindResourceW
FindResourceExW
GetCommandLineW
GetModuleFileNameW
VirtualQuery
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ExitProcess
SetUnhandledExceptionFilter
GetLocalTime
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary
RaiseException
DecodePointer
GetNativeSystemInfo
LoadLibraryA
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
WriteFile
ReadFile
LoadResource
DeviceIoControl
GetSystemDirectoryA
CreateFileA
SystemTimeToFileTime
GetTickCount
GlobalFree
VirtualAlloc
VirtualFree
VirtualProtect
SetLastError
IsBadReadPtr
IsDebuggerPresent
OutputDebugStringW
LockResource
SizeofResource
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
CloseHandle
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetModuleHandleW
GetModuleHandleA
SwitchToThread
InterlockedIncrement
ReadConsoleW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
SetStdHandle
DeleteFileW
GetProcAddress
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetFileType
GetACP
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateDirectoryW
GetModuleHandleExW
GetStdHandle

user32

GetSystemMetrics

advapi32

GetUserNameW
RegCreateKeyExW
RegQueryValueExW
OpenProcessToken
ImpersonateLoggedOnUser
RegCloseKey
RevertToSelf
LookupAccountNameW
ConvertSidToStringSidW
RegSetValueExW
RegOpenKeyExW

ole32

CoInitialize
CoUninitialize

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

dbghelp

MiniDumpWriteDump

ws2_32

inet_addr
recvfrom
sendto
gethostbyname
WSAStartup
WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
WSASocketW
inet_ntoa

winhttp

WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCrackUrl
WinHttpSetOption
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

Sections

.text
Size: 170KB - Virtual size: 170KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuMiniTray.exe
.exe windows:5 windows x86 arch:x86

571f1de0523a5772020eb4fc8c876d83

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

60:ec:12:09:ad:4d:b6:9d:91:58:8a:03:c7:6f:ba:b3:0f:9d:6c:e9:24:60:6f:36:26:7c:32:1b:35:06:fe:38
Signer

Actual PE Digest

60:ec:12:09:ad:4d:b6:9d:91:58:8a:03:c7:6f:ba:b3:0f:9d:6c:e9:24:60:6f:36:26:7c:32:1b:35:06:fe:38

Digest Algorithm

sha256

PE Digest Matches

true

28:8f:4d:f0:c0:1a:ad:c4:66:d3:a2:62:9a:40:1c:e8:62:85:7c:15
Signer

Actual PE Digest

28:8f:4d:f0:c0:1a:ad:c4:66:d3:a2:62:9a:40:1c:e8:62:85:7c:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\MiniTray.pdb

Imports

kernel32

FindResourceW
FindResourceExW
GetCommandLineW
GetModuleFileNameW
VirtualQuery
CreateFileW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
ExitProcess
SetUnhandledExceptionFilter
GetLocalTime
GetModuleFileNameA
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetLastError
InitializeCriticalSectionAndSpinCount
LoadLibraryW
FreeLibrary
RaiseException
DecodePointer
GetNativeSystemInfo
LoadLibraryA
GetVersionExW
MultiByteToWideChar
WideCharToMultiByte
GetFileSize
WriteFile
ReadFile
LoadResource
DeviceIoControl
GetSystemDirectoryA
CreateFileA
SystemTimeToFileTime
GetTickCount
GlobalFree
VirtualAlloc
VirtualFree
VirtualProtect
SetLastError
IsBadReadPtr
IsDebuggerPresent
OutputDebugStringW
LockResource
SizeofResource
CreateToolhelp32Snapshot
Process32FirstW
OpenProcess
Process32NextW
CloseHandle
LocalFree
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetModuleHandleW
GetModuleHandleA
SwitchToThread
InterlockedIncrement
ReadConsoleW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
SetStdHandle
DeleteFileW
GetProcAddress
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetTimeZoneInformation
LCMapStringW
CompareStringW
GetFileType
GetACP
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateDirectoryW
GetModuleHandleExW
GetStdHandle

user32

GetSystemMetrics

advapi32

GetUserNameW
RegCreateKeyExW
RegQueryValueExW
OpenProcessToken
ImpersonateLoggedOnUser
RegCloseKey
RevertToSelf
LookupAccountNameW
ConvertSidToStringSidW
RegSetValueExW
RegOpenKeyExW

ole32

CoInitialize
CoUninitialize

shell32

ShellExecuteExW
SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

dbghelp

MiniDumpWriteDump

ws2_32

inet_addr
recvfrom
sendto
gethostbyname
WSAStartup
WSACleanup
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAWaitForMultipleEvents
WSASocketW
inet_ntoa

winhttp

WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpCrackUrl
WinHttpSetOption
WinHttpSetTimeouts
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuPDF.exe
.exe windows:5 windows x86 arch:x86

8341b356bf1aaccc23ef5503cb70ed52

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

74:8b:f2:a8:37:36:45:af:52:bb:ad:80:e2:ea:4d:ba:33:bf:86:88:3a:2e:47:1c:53:79:c7:b7:e6:aa:da:49
Signer

Actual PE Digest

74:8b:f2:a8:37:36:45:af:52:bb:ad:80:e2:ea:4d:ba:33:bf:86:88:3a:2e:47:1c:53:79:c7:b7:e6:aa:da:49

Digest Algorithm

sha256

PE Digest Matches

true

68:f8:cf:9b:4e:47:4d:0c:0d:79:1a:41:de:a3:fb:ce:d6:fd:21:0b
Signer

Actual PE Digest

68:f8:cf:9b:4e:47:4d:0c:0d:79:1a:41:de:a3:fb:ce:d6:fd:21:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryExA
VirtualProtect
GetSystemInfo
GetModuleHandleA
SwitchToThread
DeleteFileW
VirtualQuery
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
CreateThread
Process32FirstW
SetEndOfFile
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SetStdHandle
FlushFileBuffers
GetConsoleCP
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
SetFilePointerEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
CreateProcessA
GetStringTypeW
GetModuleHandleExW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
QueryPerformanceFrequency
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RtlUnwind
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
TryEnterCriticalSection
GetExitCodeProcess
OpenThread
GetThreadContext
GetCurrentThread
ResumeThread
SuspendThread
Thread32First
Thread32Next
ReadDirectoryChangesW
QueueUserAPC
ResetEvent
WaitForMultipleObjectsEx
CompareFileTime
CancelIo
Process32NextW
Sleep
CreateToolhelp32Snapshot
UnmapViewOfFile
SetErrorMode
LeaveCriticalSection
GetFullPathNameW
GetCommandLineW
EnterCriticalSection
GetModuleFileNameA
GetSystemTimeAsFileTime
CopyFileW
MoveFileExW
FormatMessageW
SetFileAttributesW
WaitForSingleObject
FreeLibrary
GetCurrentProcessId
OpenProcess
DosDateTimeToFileTime
GetFileType
WideCharToMultiByte
FileTimeToLocalFileTime
DuplicateHandle
SetFilePointer
WriteFile
GetCurrentProcess
CreateDirectoryW
ExitProcess
GetACP
MultiByteToWideChar
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
GetModuleFileNameW
FreeResource
InterlockedIncrement
InterlockedDecrement
GlobalUnlock
GetFileSize
GlobalLock
CloseHandle
GlobalAlloc
CreateFileW
ReadFile
GetLocalTime
GetTickCount
MulDiv
LoadLibraryW
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
FindResourceExW
RaiseException
GetNativeSystemInfo
HeapReAlloc
LockResource
LoadLibraryA
GetLastError
HeapSize
GetVersionExW
GetSystemDirectoryW
GetFileTime
GetDriveTypeW
GetTempFileNameW
GetFileAttributesExW
GetFileInformationByHandle
GetVolumePathNameW
GetTempPathW
GetPrivateProfileIntW
GetShortPathNameW
GetLongPathNameW
WritePrivateProfileStringW
GetFileSizeEx
AllocConsole
FormatMessageA
VerifyVersionInfoW
CreateProcessW
VerSetConditionMask
GetLocaleInfoW
GetEnvironmentVariableW
GetStdHandle
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
OutputDebugStringW
GetUserDefaultUILanguage
FindNextFileW
FindFirstFileW
GetSystemTime
FindClose
InitializeCriticalSection
GetLogicalDrives
GetDateFormatW
GetTimeFormatW
GlobalAddAtomW
GlobalDeleteAtom
SetUnhandledExceptionFilter
Module32NextW
GlobalMemoryStatusEx
Module32FirstW
SetEvent
CreateEventW
GetLocaleInfoA
GetCurrentThreadId
GetEnvironmentVariableA
TerminateProcess
OutputDebugStringA
HeapCreate
GlobalFree
CreateFileA
GetSystemDirectoryA
DeviceIoControl
FileTimeToDosDateTime
SystemTimeToFileTime
InitializeCriticalSectionAndSpinCount
HeapFree
SetConsoleCtrlHandler
SizeofResource

user32

GetGUIThreadInfo
ReleaseDC
InvalidateRect
ReleaseCapture
PtInRect
GetClientRect
SetCapture
SetFocus
CreateAcceleratorTableW
MoveWindow
ClientToScreen
SetTimer
InvalidateRgn
ShowWindow
ScreenToClient
FillRect
GetDC
DestroyWindow
DefWindowProcW
SetCursor
LoadCursorW
CharNextW
GetCursorPos
GetParent
IntersectRect
MapWindowPoints
GetMonitorInfoW
MonitorFromWindow
GetFocus
IsRectEmpty
SendMessageW
SetWindowPos
GetWindowTextW
EnableWindow
GetCaretBlinkTime
SetWindowTextW
GetCaretPos
GetWindowTextLengthW
ShowCaret
RemovePropW
SetLayeredWindowAttributes
DeferWindowPos
MonitorFromRect
EnumDisplayMonitors
BeginDeferWindowPos
DdeCreateStringHandleW
DdeConnect
GetWindowInfo
TrackMouseEvent
DdeInitializeW
DdeUninitialize
DdeClientTransaction
DdeFreeDataHandle
EndDeferWindowPos
SetClipboardData
CheckMenuItem
GetDesktopWindow
DdeDisconnect
DdeFreeStringHandle
IsCharAlphaNumericW
GetSystemMenu
SetMenuDefaultItem
GetWindowDC
RemoveMenu
EnableMenuItem
DrawEdge
DrawFrameControl
GetMenuItemInfoW
ModifyMenuW
CheckMenuRadioItem
GetMenuItemID
GetMenuItemCount
SetMenuItemInfoW
InsertMenuW
CreatePopupMenu
TrackPopupMenu
AppendMenuW
CreateMenu
GetMessagePos
RedrawWindow
GetCursor
GetScrollInfo
CharLowerW
CopyImage
SetClassLongW
SystemParametersInfoW
SetActiveWindow
ReuseDDElParam
ShowWindowAsync
MessageBeep
IsWindowUnicode
UnpackDDElParam
OpenClipboard
GetCapture
CloseClipboard
EmptyClipboard
CheckRadioButton
EndDialog
SetDlgItemTextW
SendDlgItemMessageW
DialogBoxIndirectParamW
IsDlgButtonChecked
GetDlgItem
CheckDlgButton
DialogBoxParamW
wsprintfA
GetSysColor
CreateCaret
SetCaretPos
HideCaret
GetKeyState
GetWindowLongW
IsIconic
GetClassInfoExW
PostQuitMessage
SetWindowLongW
TranslateMessage
SetPropW
RegisterClassW
DispatchMessageW
IsWindow
RegisterClassExW
CreateWindowExW
GetPropW
GetMenu
GetWindowRect
GetWindow
PostMessageW
CallWindowProcW
AdjustWindowRectEx
GetMessageW
IsZoomed
KillTimer
GetUpdateRect
GetActiveWindow
UnionRect
IsWindowVisible
SetRect
DrawTextW
CharPrevW
SetForegroundWindow
SetWindowRgn
wvsprintfW
OffsetRect
MessageBoxW
GetWindowRgn
MonitorFromPoint
IsCharUpperW
GetAncestor
UpdateWindow
CharLowerBuffW
TranslateAcceleratorW
DestroyMenu
SetMenu
GetForegroundWindow
MessageBoxA
LoadAcceleratorsW
GetScrollPos
MapVirtualKeyW
ShowScrollBar
SetScrollInfo
SetParent
FindWindowW
LoadIconW
LoadBitmapW
FindWindowExW
AllowSetForegroundWindow
GetWindowThreadProcessId
EndPaint
GetSystemMetrics
BeginPaint

gdi32

CreatePenIndirect
ExtSelectClipRgn
CombineRgn
RoundRect
ExtTextOutW
BitBlt
CreateCompatibleBitmap
SaveDC
SetBkColor
CreateCompatibleDC
SetWindowOrgEx
GetDIBColorTable
DeleteDC
CreatePen
Rectangle
RestoreDC
GetStockObject
GetObjectW
CreateFontIndirectW
GetObjectA
CreatePatternBrush
SetTextColor
SetBkMode
CreateSolidBrush
DeleteObject
GetDeviceCaps
SetBrushOrgEx
SetWorldTransform
EndPage
StartDocW
SetMapMode
CreateDCW
EndDoc
AbortDoc
StartPage
ExcludeClipRect
SetLayout
SetDIBits
GetDIBits
SetGraphicsMode
SetDIBColorTable
MoveToEx
GetCharABCWidthsW
SelectClipRgn
LineTo
GetTextExtentPoint32W
TextOutW
CreateRoundRectRgn
CreateRectRgnIndirect
GetClipBox
GdiFlush
StretchBlt
CreateDIBSection
PtInRegion
CreateRectRgn
PatBlt
SetStretchBltMode
CreateBitmap
SetROP2
SelectObject
GetTextMetricsW

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW
PrintDlgExW

advapi32

RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
OpenProcessToken
ConvertSidToStringSidW
LookupAccountNameW
RegCloseKey
RegDeleteKeyW
BuildExplicitAccessWithNameW
SetEntriesInAclW
RegCreateKeyExW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegEnumKeyExW
RegSetValueExW
GetUserNameW
RegEnumValueW
RegQueryValueExW
CheckTokenMembership
FreeSid
AllocateAndInitializeSid

shell32

SHGetFolderPathW
DragFinish
DragQueryFileW
SHChangeNotify
DragAcceptFiles
SHAddToRecentDocs
SHGetFileInfoW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetDesktopFolder
SHBindToParent

ole32

ReleaseStgMedium
CoTaskMemFree
CoCreateGuid
CoInitialize
CoUninitialize
CoGetMalloc
CLSIDFromProgID
CLSIDFromString
OleLockRunning
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoCreateInstance
CoTaskMemAlloc

oleaut32

SysAllocString
SysFreeString
VariantInit
SafeArrayPutElement
VariantClear
SafeArrayCreateVector

libmupdf

fz_new_context_imp
gzread
fz_throw_imp
fz_drop_pixmap
fz_load_jpeg_info
fz_malloc
fz_close
fz_var_imp
fz_free_context
fz_push_try
fz_read
fz_drop_colorspace
fz_device_gray
fz_new_pixmap_with_data
fz_open_memory
fz_open_dctd
fz_device_rgb
fz_load_jpx
fz_convert_pixmap
fz_md5_init
fz_md5_update
fz_md5_final
crc32
fz_redirect_io_to_console
gzclose
fz_free
pdf_dict_getp
fz_drop_image
pdf_insert_page
pdf_create_document
fz_transform_rect
inflateInit2_
inflate
inflateEnd
deflateInit2_
gztell
gzopen
gzseek
pdf_new_ref
pdf_dict_puts_drop
fz_rethrow
deflate
pdf_is_dict
fz_new_buffer
fz_calloc
fz_fill_image
pdf_is_indirect
ddjvu_context_release
ddjvu_document_get_pagetext
ddjvu_page_get_type
ddjvu_message_peek
ddjvu_document_get_pageinfo_imp
miniexp_cadr
ddjvu_document_get_fileinfo_imp
ddjvu_page_create_by_pageno
ddjvu_message_pop
ddjvu_document_get_outline
ddjvu_job_status
miniexp_cddr
ddjvu_context_create
miniexp_symbol
ddjvu_page_job
miniexp_stringp
ddjvu_page_set_rotation
ddjvu_document_job
ddjvu_page_render
ddjvu_document_create_by_filename_utf8
ddjvu_document_get_filenum
ddjvu_anno_get_hyperlinks
ddjvu_format_set_row_order
ddjvu_free
ddjvu_document_get_pagenum
ddjvu_miniexp_release
ddjvu_document_get_pageanno
ddjvu_stream_close
ddjvu_job_release
ddjvu_format_create
miniexp_to_str
ddjvu_format_release
ddjvu_document_create_by_data
fz_new_image
minilisp_finish
fz_free_outline
fz_matrix_expansion
fz_atof
fz_free_text_page
pdf_to_ucs2_buf
pdf_file_spec_to_str
fz_intersect_rect
fz_new_pixmap_with_bbox
pdf_bound_page
pdf_load_stream
pdf_update_object
pdf_update_stream
pdf_close_document
pdf_authenticate_password
fz_new_pixmap_from_image
fz_clear_pixmap_with_value
fz_new_link
pdf_dict_get_val
fz_new_stroke_state_with_dash_len
pdf_to_gen
fz_pre_translate
fz_transform_point
fz_strdup
pdf_array_len
fz_pre_scale
fz_new_stream
fz_round_rect
fz_drop_stroke_state
pdf_array_push_drop
fz_enable_device_hints
xps_count_pages
fz_open_buffer
pdf_is_stream
pdf_dict_len
pdf_new_bool
xps_lookup_link_target_obj
pdf_js_supported
pdf_crypt_revision
fz_new_display_list
fz_end_group
pdf_lex
pdf_keep_obj
fz_xml_tag
pdf_to_name
pdf_to_bool
pdf_get_xref_entry
pdf_is_real
pdf_obj_parent_num
pdf_to_num
xps_resolve_url
xps_read_part
fz_xml_is_tag
fz_free_text_sheet
xps_bound_page
fz_pixmap_bbox
xps_run_page
fz_parse_xml
pdf_dict_get_key
fz_new_list_device
fz_seek
pdf_is_array
pdf_open_document_with_stream
pdf_is_name
xps_load_outline
pdf_new_array
pdf_to_str_buf
pdf_cache_object
pdf_to_rect
pdf_crypt_key
pdf_array_get
fz_moveto
fz_xml_next
pdf_drop_obj
pdf_run_page_with_usage
pdf_create_object
fz_begin_page
fz_new_path
fz_rotate
fz_stroke_path
pdf_dict_getsa
pdf_new_obj_from_str
pdf_dict_put
pdf_lookup_dest
fz_begin_group
pdf_to_str_len
pdf_new_int
pdf_new_indirect
fz_invert_matrix
pdf_has_permission
fz_open_file_w
fz_new_bbox_device
pdf_needs_password
fz_rect_from_irect
pdf_to_real
fz_run_display_list
xps_close_document
fz_fill_path
fz_new_text_sheet
fz_xml_down
pdf_mark_obj
fz_new_stroke_state
fz_new_text_page
fz_drop_buffer
pdf_resolve_indirect
fz_tell
pdf_array_push
fz_warn_imp
pdf_parse_link_dest
xps_free_part
fz_xml_att
fz_free_xml
pdf_crypt_version
fz_xml_text
fz_drop_display_list
fz_free_path
fz_read_all
pdf_new_matrix
pdf_load_outline
pdf_is_int
fz_free_link_dest
pdf_count_pages
pdf_write_document
fz_free_device
fz_free_compressed_buffer
pdf_new_string
xps_open_document_with_stream
miniexp_caddr
deflateInit_
pdf_lookup_inherited_page_item
fz_new_device
pdf_load_name_tree
fz_end_page
pdf_install_load_system_font_funcs
pdf_dict_dels
pdf_dict_gets
pdf_xref_len
fz_new_draw_device
pdf_run_page
xps_load_page
fz_new_text_device
fz_clone_stream
pdf_load_page_by_obj
pdf_to_int
fz_text_char_bbox
pdf_unmark_obj
fz_lineto
fz_device_cmyk
fz_closepath
pdf_page_write
deflateEnd
pdf_new_dict
fz_device_bgr
pdf_free_page
gzerror
pdf_trailer
pdf_create_page
pdf_copy_dict

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCompositionFontW

ws2_32

WSAStartup
WSAWaitForMultipleEvents
WSASocketW
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACleanup
recvfrom
gethostbyname
sendto
inet_addr
inet_ntoa

winhttp

WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpSetOption
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts

winspool.drv

DeviceCapabilitiesW
ClosePrinter
DocumentPropertiesW
GetPrinterW
OpenPrinterW
ord203

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 594KB - Virtual size: 594KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 464KB - Virtual size: 464KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuPd.dll
.dll windows:5 windows x86 arch:x86

527729849d7d1d2eda7dd87d1f697c41

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:7c:12:2b:1c:8c:ae:55:93:11:c1:40:7f:c9:5e:e3:be:20:0f:c5:95:49:57:4c:ab:a7:f9:79:11:a6:8b:d6
Signer

Actual PE Digest

25:7c:12:2b:1c:8c:ae:55:93:11:c1:40:7f:c9:5e:e3:be:20:0f:c5:95:49:57:4c:ab:a7:f9:79:11:a6:8b:d6

Digest Algorithm

sha256

PE Digest Matches

true

c6:80:33:ec:fb:dc:2b:63:f6:7b:53:91:7f:0a:0e:5a:e5:f7:bc:80
Signer

Actual PE Digest

c6:80:33:ec:fb:dc:2b:63:f6:7b:53:91:7f:0a:0e:5a:e5:f7:bc:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryW
DeviceIoControl
GetSystemDirectoryA
CreateFileA
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
SetEndOfFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
SystemTimeToFileTime
FindClose
GetTimeZoneInformation
SetFilePointerEx
ReadConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetConsoleMode
GetConsoleCP
GetStdHandle
GetStringTypeW
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DosDateTimeToFileTime
SetFileTime
DuplicateHandle
SetFilePointer
GetFileType
MulDiv
GetACP
GetCurrentDirectoryW
SwitchToThread
GetCurrentProcessId
CreateMutexW
FreeResource
GetModuleFileNameA
GetLocalTime
DecodePointer
LoadLibraryExW
lstrcmpiW
VirtualQuery
GetModuleFileNameW
GetCommandLineW
GetComputerNameW
lstrcmpW
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
SetLastError
RaiseException
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GlobalFree
GetModuleHandleA
GetTickCount
DeleteCriticalSection
InterlockedIncrement
LocalFree
OpenProcess
Sleep
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetCurrentProcess
EnterCriticalSection
InterlockedExchange
FreeLibrary
LoadLibraryW
DeleteFileW
GetNativeSystemInfo
GetVersionExW
HeapDestroy
LoadLibraryA
GetModuleHandleW
GetProcAddress
WideCharToMultiByte
WriteFile
MultiByteToWideChar
CloseHandle
ReadFile
GetFileSize
GetLastError
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
FindFirstFileExA

user32

GetParent
GetWindowThreadProcessId
GetSystemMetrics
PrivateExtractIconsW
DrawIconEx
RegisterClassW
SetPropW
GetPropW
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
GetSysColor
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
FillRect
DrawTextW
CharPrevW
SetCursor
wvsprintfW
IsRectEmpty
UnionRect
IntersectRect
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
GetFocus
IsDialogMessageW
RealGetWindowClassW
GetForegroundWindow
DestroyWindow
CharNextW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
EnableWindow
IsWindowVisible
GetWindowRect
DefWindowProcW
IsWindow
MonitorFromWindow
GetMonitorInfoW
SetRect
OffsetRect
MoveWindow
SetWindowPos
SetTimer
ShowWindow
PostMessageW
KillTimer
SendMessageW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
SetWindowLongW
GetWindowLongW
CallWindowProcW
CopyRect
IsZoomed
GetClientRect
ScreenToClient
IsIconic
SetWindowRgn
IsChild
FindWindowW
FindWindowExW
ClientToScreen
SetFocus
MonitorFromPoint
DestroyIcon
EnumDisplaySettingsW
MapWindowPoints
GetWindow
LoadImageW
GetCursorPos
PtInRect
RegisterWindowMessageW
SetForegroundWindow

advapi32

OpenProcessToken
RegCreateKeyExW
RegQueryValueExA
RegSetValueExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
ConvertSidToStringSidW
LookupAccountNameW
RevertToSelf
GetUserNameW
ImpersonateLoggedOnUser
RegCreateKeyW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance

shell32

ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW
SHGetFileInfoW
SHGetSpecialFolderPathW

oleaut32

SysAllocString
VariantInit
VariantClear
VarUI4FromStr
VariantCopy
SysFreeString

shlwapi

PathFileExistsW
PathIsDirectoryW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdi32

CreateRoundRectRgn
BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
GetObjectType
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
GetDeviceCaps
CombineRgn
CreateCompatibleBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GetObjectA
DeleteObject

gdiplus

GdipCreateFontFromLogfontA
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdiplusStartup

winhttp

WinHttpQueryDataAvailable
WinHttpOpen
WinHttpSetTimeouts
WinHttpCrackUrl
WinHttpConnect
WinHttpOpenRequest
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpReadData
WinHttpCloseHandle

ws2_32

inet_addr
inet_ntoa
recvfrom
sendto
gethostbyname
WSAStartup
WSACleanup
WSACreateEvent
WSAEventSelect
WSAWaitForMultipleEvents
WSASocketW
WSAEnumNetworkEvents

Exports

Exports

RunMain

Sections

.text
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 129KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 171KB - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuService.exe
.exe windows:5 windows x86 arch:x86

ad6a192de257a89adba0a618514ab86b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8d:9e:c5:cc:37:f8:40:85:b0:a6:32:c7:25:43:ed:ad:66:af:d6:9b:fa:8d:0c:d6:6c:31:c9:7d:e1:90:ac:40
Signer

Actual PE Digest

8d:9e:c5:cc:37:f8:40:85:b0:a6:32:c7:25:43:ed:ad:66:af:d6:9b:fa:8d:0c:d6:6c:31:c9:7d:e1:90:ac:40

Digest Algorithm

sha256

PE Digest Matches

true

ae:ba:a1:74:56:29:05:57:2b:48:af:86:cd:65:83:97:67:24:93:bc
Signer

Actual PE Digest

ae:ba:a1:74:56:29:05:57:2b:48:af:86:cd:65:83:97:67:24:93:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
SetCurrentDirectoryW
SetUnhandledExceptionFilter
SetErrorMode
CreateMutexW
GetComputerNameW
GetModuleFileNameA
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
GetModuleHandleW
GetCommandLineW
VirtualQuery
WaitForSingleObject
LoadLibraryA
GetVersionExW
GetNativeSystemInfo
CreateEventW
GetLocalTime
CreateThread
ResetEvent
TerminateThread
SetEvent
SetProcessWorkingSetSize
SwitchToThread
CancelIo
CreateNamedPipeA
WaitForMultipleObjects
GetQueuedCompletionStatus
DisconnectNamedPipe
PostQueuedCompletionStatus
CreateIoCompletionPort
ConnectNamedPipe
LocalAlloc
GetCurrentProcessId
DeleteFileW
DeviceIoControl
GetSystemDirectoryA
CreateFileA
SystemTimeToFileTime
GlobalFree
IsDebuggerPresent
OutputDebugStringW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
ReadConsoleW
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
GetCurrentThreadId
GetModuleFileNameW
ProcessIdToSessionId
GetProcAddress
GetModuleHandleA
GetTickCount
InterlockedIncrement
DeleteCriticalSection
LocalFree
Sleep
OpenProcess
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetCurrentProcess
HeapDestroy
EnterCriticalSection
InterlockedExchange
WideCharToMultiByte
WriteFile
MultiByteToWideChar
CloseHandle
ReadFile
GetFileSize
GetLastError
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapSize
LCMapStringW
CompareStringW
GetFileType
GetStringTypeW
GetACP
GetStdHandle
GetModuleHandleExW
CreateDirectoryW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
SetLastError
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
WaitForSingleObjectEx

user32

GetSystemMetrics

advapi32

ConvertSidToStringSidW
AllocateAndInitializeSid
SetEntriesInAclW
FreeSid
ImpersonateLoggedOnUser
GetUserNameW
RevertToSelf
LookupAccountNameW
RegOpenKeyExW
RegCreateKeyExW
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
SetSecurityDescriptorDacl
RegQueryValueExA
RegSetValueExW
InitializeSecurityDescriptor
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
OpenProcessToken
GetTokenInformation

shell32

SHGetSpecialFolderPathW

shlwapi

PathFileExistsW

dbghelp

MiniDumpWriteDump

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

ws2_32

WSAStartup
WSAWaitForMultipleEvents
WSASocketW
WSAEventSelect
inet_ntoa
recvfrom
sendto
gethostbyname
inet_addr
WSACleanup
WSACreateEvent
WSAEnumNetworkEvents

winhttp

WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpen
WinHttpSendRequest
WinHttpWriteData
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpGetProxyForUrl
WinHttpAddRequestHeaders

Sections

.text
Size: 190KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FeiSuUpdate.exe
.exe windows:5 windows x86 arch:x86

d9b2786a91efc840fa3cf436c11a7493

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:9f:a7:b4:8c:60:01:8d:25:94:a8:6d:79:f1:51:99:b3:00:d4:ad:16:54:93:d9:23:f7:bc:b8:2c:07:c0:23
Signer

Actual PE Digest

01:9f:a7:b4:8c:60:01:8d:25:94:a8:6d:79:f1:51:99:b3:00:d4:ad:16:54:93:d9:23:f7:bc:b8:2c:07:c0:23

Digest Algorithm

sha256

PE Digest Matches

true

97:0b:fa:9f:c8:24:0a:21:9c:7a:98:23:cc:94:a4:1b:43:d2:4a:62
Signer

Actual PE Digest

97:0b:fa:9f:c8:24:0a:21:9c:7a:98:23:cc:94:a4:1b:43:d2:4a:62

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCurrentDirectoryW
GetACP
MulDiv
SetFileTime
DosDateTimeToFileTime
CreateDirectoryW
GetProcessId
DeviceIoControl
GetSystemDirectoryA
CreateFileA
GlobalFree
VirtualAlloc
VirtualFree
IsDebuggerPresent
OutputDebugStringW
EncodePointer
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
CancelIo
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetTimeZoneInformation
GetStdHandle
GetModuleHandleExW
GetCommandLineA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
CreateThread
SwitchToThread
TerminateThread
WaitForSingleObject
LocalAlloc
SetLastError
TerminateProcess
DeleteFileW
CreateMutexW
GetModuleFileNameA
DecodePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
RaiseException
lstrcmpiW
FreeLibrary
VirtualQuery
GetCommandLineW
GetComputerNameW
GetNativeSystemInfo
GetVersionExW
LoadLibraryA
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleW
SetUnhandledExceptionFilter
FreeResource
ExitProcess
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameW
FindClose
FindNextFileW
FindFirstFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
DuplicateHandle
FileTimeToDosDateTime
SystemTimeToFileTime
SetFilePointer
GetLocalTime
GetSystemTime
GetFileType
GetFileInformationByHandle
FileTimeToSystemTime
IsBadReadPtr
VirtualProtect
GetProcAddress
GetModuleHandleA
GetTickCount
InterlockedIncrement
HeapDestroy
DeleteCriticalSection
LocalFree
Sleep
OpenProcess
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
GetCurrentProcess
EnterCriticalSection
InterlockedExchange
WideCharToMultiByte
WriteFile
MultiByteToWideChar
CloseHandle
ReadFile
GetFileSize
GetLastError
CreateFileW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetCPInfo
GetOverlappedResult

user32

GetWindowRect
GetParent
RegisterClassW
SetPropW
GetPropW
IsWindowVisible
DrawIconEx
DestroyIcon
PrivateExtractIconsW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
GetCaretBlinkTime
CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
MonitorFromPoint
SetCursor
wvsprintfW
PtInRect
IsRectEmpty
UnionRect
IntersectRect
GetCursorPos
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
GetFocus
DestroyWindow
MoveWindow
KillTimer
DefWindowProcW
GetSystemMetrics
PostMessageW
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindow
CharNextW
FindWindowW
IsZoomed
ShowWindow
ScreenToClient
SetForegroundWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
EnableWindow
IsWindow
SetFocus
PostQuitMessage
SetTimer
SetWindowRgn
UnregisterClassW
RegisterClassExW
GetClassInfoExW
LoadCursorW
CreateWindowExW
IsChild
SetWindowLongW
CallWindowProcW
LoadImageW
SendMessageW
CopyRect
OffsetRect
IsIconic

advapi32

ImpersonateLoggedOnUser
GetUserNameW
RevertToSelf
LookupAccountNameW
RegOpenKeyExW
RegCreateKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExA
RegSetValueExW
RegOpenKeyExA
RegQueryValueExW
RegCloseKey
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
AllocateAndInitializeSid
FreeSid
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteValueW
GetSidSubAuthority
CheckTokenMembership

ole32

OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateGuid
CoInitialize
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc

shell32

ShellExecuteExW
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW

oleaut32

VarUI4FromStr
SysFreeString
VariantClear
VariantInit
SysAllocString

shlwapi

PathIsDirectoryW
PathFileExistsW

comctl32

ord17
_TrackMouseEvent
InitCommonControlsEx

gdi32

DeleteObject
BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
GetObjectType
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
GetDeviceCaps
CombineRgn
CreateCompatibleBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GetObjectA
CreateRoundRectRgn

gdiplus

GdiplusStartup
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateFontFromLogfontA
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipCreateFontFromDC

dbghelp

MiniDumpWriteDump

ws2_32

inet_addr
WSAWaitForMultipleEvents
WSASocketW
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACleanup
WSAStartup
gethostbyname
sendto
recvfrom
inet_ntoa

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCrackUrl

Sections

.text
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 167KB - Virtual size: 167KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PdfFilter.dll
.dll regsvr32 windows:5 windows x86 arch:x86

b9e781773fde70bc2db0ce9b14bb3973

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4f:eb:85:55:43:18:23:90:9a:dc:15:32:a5:0e:95:2f:bb:dd:14:2f:9a:cc:9a:16:ca:7a:66:86:3e:ce:96:e1
Signer

Actual PE Digest

4f:eb:85:55:43:18:23:90:9a:dc:15:32:a5:0e:95:2f:bb:dd:14:2f:9a:cc:9a:16:ca:7a:66:86:3e:ce:96:e1

Digest Algorithm

sha256

PE Digest Matches

true

e5:31:40:a1:87:34:c0:4b:3b:71:32:fb:ff:90:9a:b4:ec:9d:03:2d
Signer

Actual PE Digest

e5:31:40:a1:87:34:c0:4b:3b:71:32:fb:ff:90:9a:b4:ec:9d:03:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\PdfFilter.pdb

Imports

shlwapi

ord219
SHDeleteKeyW
SHSetValueW

kernel32

MultiByteToWideChar
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
CloseHandle
DeleteCriticalSection
CopyFileW
WideCharToMultiByte
GetACP
GlobalUnlock
InterlockedIncrement
GetFileSize
GlobalLock
GlobalFree
GlobalAlloc
GetLastError
CreateFileW
InterlockedDecrement
ReadFile
SystemTimeToFileTime
InitializeCriticalSection
CreateFileMappingW
DecodePointer
SetEndOfFile
WriteConsoleW
HeapSize
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetFileType
HeapFree
GetStringTypeW
HeapAlloc
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
InterlockedFlushSList
RaiseException
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetModuleHandleW
GetCurrentProcessId
GetStdHandle
GetCurrentProcess
GetProcAddress
FindClose
GetModuleFileNameW
WriteFile
GetFileSizeEx
SetFilePointerEx

gdi32

CreateDIBSection

ole32

CreateStreamOnHGlobal
CLSIDFromString
PropVariantCopy
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc

libmupdf

fz_open_buffer
pdf_is_stream
fz_md5_init
pdf_dict_len
pdf_new_bool
pdf_js_supported
pdf_crypt_revision
fz_md5_update
fz_new_display_list
fz_end_group
fz_free
pdf_lex
pdf_keep_obj
pdf_to_name
pdf_dict_getp
pdf_to_bool
pdf_get_xref_entry
pdf_is_real
pdf_obj_parent_num
pdf_to_num
fz_free_text_sheet
fz_pixmap_bbox
pdf_dict_get_key
fz_new_list_device
fz_seek
pdf_is_array
pdf_open_document_with_stream
fz_close
pdf_is_name
pdf_new_array
pdf_to_str_buf
pdf_cache_object
pdf_to_rect
pdf_crypt_key
fz_var_imp
pdf_array_get
fz_moveto
pdf_copy_dict
pdf_run_page_with_usage
pdf_create_object
fz_begin_page
pdf_drop_obj
fz_new_path
fz_rotate
fz_free_context
fz_stroke_path
pdf_dict_getsa
pdf_new_obj_from_str
fz_clear_pixmap_with_value
fz_drop_pixmap
pdf_lookup_dest
fz_begin_group
fz_push_try
pdf_to_str_len
pdf_new_int
fz_transform_rect
pdf_new_indirect
fz_invert_matrix
pdf_has_permission
fz_open_file_w
fz_new_bbox_device
fz_md5_final
pdf_needs_password
fz_rect_from_irect
fz_free_device
pdf_write_document
pdf_to_real
fz_run_display_list
pdf_close_document
fz_fill_path
fz_new_text_sheet
pdf_mark_obj
fz_new_stroke_state
fz_new_text_page
fz_drop_buffer
pdf_resolve_indirect
fz_tell
pdf_array_push
fz_warn_imp
pdf_parse_link_dest
pdf_crypt_version
fz_drop_display_list
fz_free_path
fz_read_all
pdf_new_matrix
pdf_load_outline
pdf_is_int
fz_free_link_dest
pdf_count_pages
pdf_lookup_inherited_page_item
fz_enable_device_hints
pdf_array_push_drop
fz_drop_stroke_state
pdf_new_string
fz_round_rect
fz_new_stream
pdf_is_indirect
fz_pre_scale
pdf_array_len
fz_strdup
pdf_free_page
fz_transform_point
fz_device_bgr
fz_new_pixmap_from_image
pdf_authenticate_password
pdf_update_stream
pdf_update_object
pdf_new_dict
fz_pre_translate
pdf_dict_puts_drop
fz_free_outline
fz_matrix_expansion
fz_free_text_page
fz_new_context_imp
pdf_to_ucs2_buf
fz_rethrow
pdf_file_spec_to_str
fz_intersect_rect
pdf_is_dict
fz_new_buffer
fz_new_pixmap_with_bbox
fz_calloc
pdf_bound_page
fz_new_device
pdf_load_name_tree
fz_end_page
pdf_install_load_system_font_funcs
pdf_dict_dels
pdf_dict_gets
pdf_xref_len
fz_new_draw_device
pdf_run_page
fz_device_rgb
fz_new_text_device
fz_clone_stream
pdf_load_page_by_obj
pdf_to_int
fz_text_char_bbox
pdf_trailer
pdf_unmark_obj
fz_lineto
pdf_dict_put
pdf_load_stream
fz_closepath
fz_convert_pixmap
fz_new_link
pdf_dict_get_val
fz_throw_imp
fz_new_stroke_state_with_dash_len
pdf_new_ref
pdf_to_gen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PdfPreview.dll
.dll regsvr32 windows:5 windows x86 arch:x86

7c1e85e30c884b04685c09b3d5ff158d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

c0:0a:9f:3f:b4:36:26:77:ac:39:66:7e:7f:5d:91:f6:4e:f8:b2:ee:90:ab:27:f2:24:be:6d:a9:69:a7:8d:a1
Signer

Actual PE Digest

c0:0a:9f:3f:b4:36:26:77:ac:39:66:7e:7f:5d:91:f6:4e:f8:b2:ee:90:ab:27:f2:24:be:6d:a9:69:a7:8d:a1

Digest Algorithm

sha256

PE Digest Matches

true

1c:28:55:ed:ca:18:00:28:3f:e5:b6:2c:cc:92:67:8a:a8:cb:7a:d5
Signer

Actual PE Digest

1c:28:55:ed:ca:18:00:28:3f:e5:b6:2c:cc:92:67:8a:a8:cb:7a:d5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\PdfPreview.pdb

Imports

gdiplus

GdiplusShutdown

shlwapi

SHSetValueW
SHDeleteValueW
ord219
SHDeleteKeyW

kernel32

WideCharToMultiByte
GetFileSizeEx
WriteFile
GetModuleFileNameW
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
GetFileTime
GlobalUnlock
InterlockedIncrement
GetFileSize
GlobalLock
GlobalFree
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GlobalAlloc
CreateFileW
InterlockedDecrement
ReadFile
CreateThread
GetLastError
WaitForSingleObject
CreateFileMappingW
CopyFileW
FindClose
DeleteCriticalSection
CloseHandle
MultiByteToWideChar
GetACP
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
RtlUnwind
InterlockedFlushSList
RaiseException
GetStartupInfoW
GetProcAddress
GetCurrentProcess
GetStdHandle
VerSetConditionMask
GetCurrentProcessId
GetModuleHandleW
VerifyVersionInfoW
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetModuleFileNameA
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
DecodePointer
SetEndOfFile
WriteConsoleW
HeapSize
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
HeapReAlloc
ReadConsoleW
GetConsoleMode
SetFilePointerEx
GetFileType
HeapFree
GetStringTypeW
HeapAlloc

user32

EndPaint
BeginPaint
ReleaseDC
GetFocus
DestroyWindow
SetWindowPos
GetWindowLongW
SetScrollInfo
DefWindowProcW
PostMessageW
GetDC
FillRect
CreateWindowExW
GetScrollInfo
RegisterClassExW
GetScrollPos
ShowWindow
SetFocus
LoadCursorW
SetWindowLongW
InvalidateRect
UpdateWindow
GetClientRect

gdi32

CreateCompatibleBitmap
BitBlt
SetGraphicsMode
SelectObject
CreateCompatibleDC
StretchBlt
GetStockObject
GetDIBits
DeleteDC
SetStretchBltMode
DeleteObject
CreateSolidBrush
CreateDIBSection
SetWorldTransform

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CLSIDFromString

libmupdf

pdf_dict_puts_drop
fz_free_outline
fz_matrix_expansion
fz_new_context_imp
pdf_to_ucs2_buf
fz_rethrow
pdf_file_spec_to_str
fz_intersect_rect
pdf_is_dict
fz_new_buffer
fz_new_pixmap_with_bbox
fz_calloc
pdf_bound_page
pdf_load_stream
pdf_update_object
pdf_update_stream
pdf_authenticate_password
fz_new_pixmap_from_image
fz_device_bgr
fz_clear_pixmap_with_value
fz_new_link
pdf_dict_get_val
fz_throw_imp
fz_new_stroke_state_with_dash_len
pdf_to_gen
fz_pre_translate
pdf_new_dict
fz_transform_point
pdf_free_page
fz_strdup
pdf_array_len
fz_pre_scale
pdf_is_indirect
fz_new_stream
fz_round_rect
pdf_new_string
fz_drop_stroke_state
pdf_array_push_drop
fz_enable_device_hints
fz_drop_pixmap
fz_open_buffer
pdf_is_stream
fz_md5_init
pdf_dict_len
pdf_new_bool
pdf_js_supported
pdf_crypt_revision
fz_md5_update
fz_new_display_list
fz_end_group
fz_free
pdf_lex
pdf_keep_obj
pdf_to_name
pdf_dict_getp
pdf_to_bool
pdf_get_xref_entry
pdf_is_real
pdf_obj_parent_num
pdf_to_num
fz_free_text_sheet
fz_pixmap_bbox
pdf_dict_get_key
fz_new_list_device
fz_seek
pdf_is_array
pdf_open_document_with_stream
fz_close
fz_free_text_page
pdf_new_array
pdf_to_str_buf
pdf_cache_object
pdf_to_rect
pdf_crypt_key
fz_var_imp
pdf_array_get
fz_moveto
pdf_copy_dict
pdf_run_page_with_usage
pdf_create_object
fz_begin_page
pdf_drop_obj
fz_new_path
fz_rotate
fz_free_context
fz_stroke_path
pdf_dict_getsa
pdf_new_obj_from_str
pdf_new_ref
pdf_dict_put
pdf_lookup_dest
fz_begin_group
fz_push_try
pdf_to_str_len
pdf_new_int
fz_transform_rect
pdf_new_indirect
fz_invert_matrix
pdf_has_permission
fz_open_file_w
fz_new_bbox_device
fz_md5_final
pdf_needs_password
fz_rect_from_irect
fz_free_device
pdf_write_document
pdf_to_real
fz_run_display_list
pdf_close_document
fz_fill_path
fz_new_text_sheet
pdf_mark_obj
fz_new_stroke_state
fz_new_text_page
fz_drop_buffer
pdf_resolve_indirect
fz_tell
pdf_array_push
fz_warn_imp
pdf_parse_link_dest
pdf_crypt_version
fz_drop_display_list
fz_free_path
fz_read_all
pdf_new_matrix
pdf_load_outline
pdf_is_int
fz_free_link_dest
pdf_count_pages
pdf_lookup_inherited_page_item
fz_new_device
pdf_load_name_tree
fz_end_page
pdf_install_load_system_font_funcs
pdf_dict_dels
pdf_dict_gets
pdf_xref_len
fz_new_draw_device
pdf_run_page
fz_device_rgb
fz_new_text_device
fz_clone_stream
pdf_load_page_by_obj
pdf_to_int
fz_text_char_bbox
pdf_trailer
pdf_unmark_obj
fz_lineto
fz_closepath
fz_convert_pixmap
pdf_is_name

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 145KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninst.exe
.exe windows:4 windows x86 arch:x86

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:2a:cd:54:fb:d6:a7:54:61:5e:11:53:c8:ba:dc:fd:f7:3e:e3:96:25:b0:b4:70:ae:fa:8b:69:42:eb:82:8d
Signer

Actual PE Digest

01:2a:cd:54:fb:d6:a7:54:61:5e:11:53:c8:ba:dc:fd:f7:3e:e3:96:25:b0:b4:70:ae:fa:8b:69:42:eb:82:8d

Digest Algorithm

sha256

PE Digest Matches

true

da:4f:34:5c:ca:4b:2b:96:d2:60:4e:0f:19:d9:36:90:ac:67:4c:dd
Signer

Actual PE Digest

da:4f:34:5c:ca:4b:2b:96:d2:60:4e:0f:19:d9:36:90:ac:67:4c:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetEnvironmentVariableA
CreateFileA
GetFileSize
GetModuleFileNameA
ReadFile
GetCurrentProcess
CopyFileA
Sleep
GetTickCount
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
lstrlenA
GetVersion
SetErrorMode
lstrcpynA
ExitProcess
SetCurrentDirectoryA
GlobalLock
CreateThread
GetLastError
CreateDirectoryA
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
WriteFile
lstrcpyA
MoveFileExA
lstrcatA
GetSystemDirectoryA
GetProcAddress
GetExitCodeProcess
WaitForSingleObject
CompareFileTime
SetFileAttributesA
GetFileAttributesA
GetShortPathNameA
MoveFileA
GetFullPathNameA
SetFileTime
SearchPathA
CloseHandle
lstrcmpiA
GlobalUnlock
GetDiskFreeSpaceA
lstrcmpA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
GetPrivateProfileStringA
FindClose
MultiByteToWideChar
FreeLibrary
MulDiv
WritePrivateProfileStringA
LoadLibraryExA
GetModuleHandleA
GlobalAlloc
GlobalFree
ExpandEnvironmentStringsA

user32

ScreenToClient
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
PostQuitMessage
GetWindowRect
EnableMenuItem
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndDialog
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
GetDC
CreateDialogParamA
SetTimer
GetDlgItem
SetWindowLongA
SetForegroundWindow
LoadImageA
IsWindow
SendMessageTimeoutA
FindWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
EndPaint
DestroyWindow
wsprintfA
ShowWindow
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
SHFileOperationA

advapi32

AdjustTokenPrivileges
RegCreateKeyExA
RegOpenKeyExA
SetFileSecurityA
OpenProcessToken
LookupPrivilegeValueA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoCreateInstance

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/AccessControl.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ClearOnFile
ClearOnRegKey
DenyOnFile
DenyOnRegKey
DisableFileInheritance
DisableRegKeyInheritance
EnableFileInheritance
EnableRegKeyInheritance
GetCurrentUserName
GetFileGroup
GetFileOwner
GetRegKeyGroup
GetRegKeyOwner
GrantOnFile
GrantOnRegKey
NameToSid
RevokeOnFile
RevokeOnRegKey
SetFileGroup
SetFileOwner
SetOnFile
SetOnRegKey
SetRegKeyGroup
SetRegKeyOwner
SidToName

Sections

UPX0
Size: - Virtual size: 24KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstHlp.dll
.dll windows:5 windows x86 arch:x86

c8d28c8ec3ed633365eedf3ec168225b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

91:05:55:33:88:f2:7c:dc:c5:2d:1e:c3:62:57:57:21:e9:e8:14:8c:da:75:3f:f1:03:c0:c4:04:ef:79:82:2f
Signer

Actual PE Digest

91:05:55:33:88:f2:7c:dc:c5:2d:1e:c3:62:57:57:21:e9:e8:14:8c:da:75:3f:f1:03:c0:c4:04:ef:79:82:2f

Digest Algorithm

sha256

PE Digest Matches

true

c3:90:85:b2:d3:81:15:8f:83:9f:90:4a:f4:2d:56:1d:9b:ab:c4:6b
Signer

Actual PE Digest

c3:90:85:b2:d3:81:15:8f:83:9f:90:4a:f4:2d:56:1d:9b:ab:c4:6b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\InstHlp.pdb

Imports

kernel32

DeviceIoControl
GetSystemDirectoryA
CreateFileA
GlobalFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
VirtualAlloc
VirtualFree
LoadLibraryExA
GetOverlappedResult
ResetEvent
CancelIo
WaitForSingleObjectEx
OutputDebugStringA
SetEndOfFile
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
HeapReAlloc
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetConsoleCP
SetFilePointerEx
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetStdHandle
GetCurrentThread
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetCommandLineA
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCPInfo
GetStringTypeW
GlobalAlloc
lstrcpynA
lstrcpyA
DeleteFileW
LoadLibraryA
GetVersionExW
GetNativeSystemInfo
GetProcessId
GetLocalTime
CreateDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
SetFileTime
SetFilePointer
WriteFile
GetFileType
FreeLibrary
MulDiv
GetACP
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleFileNameW
LoadLibraryW
ReadFile
GetFileSize
SwitchToThread
GetModuleFileNameA
TerminateProcess
GetCurrentProcessId
DecodePointer
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetModuleHandleW
WaitForSingleObject
CreateThread
GetDriveTypeW
FindResourceExW
SetEvent
InitializeCriticalSectionAndSpinCount
SetLastError
GetLastError
GetCurrentThreadId
GetProcessHeap
RaiseException
HeapSize
GetOEMCP
HeapFree
HeapAlloc
HeapDestroy
FindResourceW
CreateEventW
SizeofResource
LoadResource
LockResource
InterlockedIncrement
FreeResource
IsBadReadPtr
SearchPathA
CreateFileW
VirtualProtect
GetModuleHandleA
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryW
GetTickCount
CloseHandle
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcess
OpenProcess
GetLongPathNameW
LocalFree
InterlockedExchange
InterlockedDecrement
IsValidCodePage

user32

OpenWindowStationA
OpenDesktopA
RegisterClassW
GetMenu
SetPropW
GetPropW
CloseDesktop
EnumDesktopWindows
EnumDesktopsA
wsprintfW
GetIconInfo
DrawIconEx
LoadImageW
DestroyIcon
PrivateExtractIconsW
GetSystemMetrics
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
EqualRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
ClientToScreen
GetCaretPos
SetCaretPos
ShowCaret
HideCaret
AdjustWindowRectEx
CreateCaret
SetRect
FillRect
DrawTextW
CharPrevW
MonitorFromPoint
InflateRect
SetCursor
wvsprintfW
PtInRect
IsRectEmpty
UnionRect
IntersectRect
GetCursorPos
InvalidateRect
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
EnumWindowStationsA
CloseWindowStation
IsWindowVisible
GetWindowRect
GetParent
GetWindowThreadProcessId
ActivateKeyboardLayout
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageW
PostMessageW
DefWindowProcW
PostQuitMessage
CallWindowProcW
UnregisterClassW
RegisterClassExW
GetClassInfoExW
CreateWindowExW
DestroyWindow
IsWindow
IsChild
GetCaretBlinkTime
wsprintfA
ShowWindow
MoveWindow
SetWindowPos
IsIconic
IsZoomed
SetFocus
GetActiveWindow
SetTimer
KillTimer
EnableWindow
SetWindowRgn
GetClientRect
ScreenToClient
MapWindowPoints
CopyRect
OffsetRect
GetWindowLongW
GetKeyState
GetFocus
SetWindowLongW
GetWindow
LoadCursorW
MonitorFromWindow
GetMonitorInfoW
CharNextW

advapi32

RegCloseKey
LookupAccountNameW
RevertToSelf
BuildExplicitAccessWithNameA
SetEntriesInAclA
RegSetValueExW
RegSetValueExA
RegSetKeySecurity
RegSaveKeyA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExA
RegLoadKeyA
RegGetKeySecurity
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertSidToStringSidW
RegOpenKeyW
GetTokenInformation
OpenProcessToken
ImpersonateLoggedOnUser
RegCreateKeyExW
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW

ole32

CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemFree
OleLockRunning

shell32

SHGetPathFromIDListW
SHFileOperationW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetFileInfoW

oleaut32

SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

PathIsDirectoryW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17

gdi32

DeleteObject
BitBlt
CreateCompatibleDC
CreateFontIndirectW
CreatePen
DeleteDC
GetObjectType
GetStockObject
Rectangle
RestoreDC
SaveDC
SelectObject
GetTextMetricsW
GetObjectW
GetDeviceCaps
CombineRgn
CreateCompatibleBitmap
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
CreateDIBSection
MoveToEx
TextOutW
ExtTextOutW
GdiFlush
GetObjectA
CreateRoundRectRgn

gdiplus

GdiplusStartup
GdipSetStringFormatLineAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateFontFromLogfontA
GdipCreateFontFromDC
GdipSetTextRenderingHint
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateLineBrushI
GdipDeleteBrush
GdipCloneBrush
GdipFree
GdipAlloc
GdipDeleteFont
GdipCreateFont
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdiplusShutdown
GdipSetStringFormatAlign

psapi

GetProcessImageFileNameW

winhttp

WinHttpCrackUrl
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen

iphlpapi

GetAdaptersInfo

ws2_32

inet_ntoa
recvfrom
sendto
gethostbyname
WSAStartup
inet_addr
WSACreateEvent
WSAWaitForMultipleEvents
WSASocketW
WSAEventSelect
WSAEnumNetworkEvents
WSACleanup

Exports

Exports

DLL_fcanonical
DLL_mkconfig1
DLL_read_conf_timestamp
DLL_set_fnid
DLL_stop_processes
DestroyUI
GetAppDataDir
GetInstDir
GetInstallConfig
GetUIControlCode
InitUI
InstallPrepare
InstallSetCfg
InstalledComplete
IsPassing
RemoveAppDataDir
SetInstDir
SetNSISControlCode
ShowUI
UninstalledComplete

Sections

.text
Size: 787KB - Virtual size: 787KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 606B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

46f8b6973f33717335c0f6d8087de67b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GetVersion
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GlobalLock
lstrcatA

user32

SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libmupdf.dll
.dll windows:5 windows x86 arch:x86

424e0c264149843d2422fce29f4c37f7

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

24/01/2019, 00:00

Not After

28/01/2020, 12:00

Subject

CN=沧州战斧网络科技有限公司,OU=技术部,O=沧州战斧网络科技有限公司,L=沧州市,ST=河北省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

02/01/2017, 00:00

Not After

01/04/2028, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f6:14:40:e9:e8:d9:5d:ba:33:58:3a:9c:f2:3b:98:de:f4:70:a7:89:96:a9:c5:76:26:98:37:fe:75:3e:bf:83
Signer

Actual PE Digest

f6:14:40:e9:e8:d9:5d:ba:33:58:3a:9c:f2:3b:98:de:f4:70:a7:89:96:a9:c5:76:26:98:37:fe:75:3e:bf:83

Digest Algorithm

sha256

PE Digest Matches

true

85:70:04:09:6c:a2:11:50:74:b0:ab:c1:52:d9:83:16:2e:52:30:66
Signer

Actual PE Digest

85:70:04:09:6c:a2:11:50:74:b0:ab:c1:52:d9:83:16:2e:52:30:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\hudson\jobs\FeisuPDF_1.0.1.3\workspace\build\Release\libmupdf.pdb

Imports

kernel32

InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetSystemTimeAsFileTime
EnumSystemLocalesW
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
WriteFile
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CloseHandle
WaitForSingleObjectEx
WriteConsoleW
DecodePointer
CreateFileW
GetTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
GetUserDefaultLCID
QueryPerformanceCounter
FindFirstFileW
GetFullPathNameW
lstrcpynW
InterlockedCompareExchange
Sleep
GetWindowsDirectoryW
InterlockedExchange
InterlockedDecrement
InitializeCriticalSection
WaitForSingleObject
SetEvent
ResetEvent
InterlockedIncrement
CreateEventA
GetFullPathNameA
GetTickCount
CreateEventW
ReadFile
SetCurrentDirectoryA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetDriveTypeW
ReadConsoleW
SetEndOfFile

ole32

CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoInitialize

Exports

Exports

LzmaDecode
WebPDecodeBGRAInto
WebPGetInfo
aes_crypt_cbc
aes_setkey_dec
aes_setkey_enc
ar_at_eof
ar_close
ar_close_archive
ar_entry_get_filetime
ar_entry_get_name
ar_entry_get_offset
ar_entry_get_size
ar_entry_uncompress
ar_get_global_comment
ar_open
ar_open_7z_archive
ar_open_file
ar_open_file_w
ar_open_istream
ar_open_memory
ar_open_rar_archive
ar_open_tar_archive
ar_open_zip_archive
ar_parse_entry
ar_parse_entry_at
ar_parse_entry_for
ar_read
ar_seek
ar_skip
ar_tell
crc32
ddjvu_anno_get_hyperlinks
ddjvu_context_create
ddjvu_context_release
ddjvu_document_create_by_data
ddjvu_document_create_by_filename_utf8
ddjvu_document_get_fileinfo_imp
ddjvu_document_get_filenum
ddjvu_document_get_outline
ddjvu_document_get_pageanno
ddjvu_document_get_pageinfo_imp
ddjvu_document_get_pagenum
ddjvu_document_get_pagetext
ddjvu_document_job
ddjvu_format_create
ddjvu_format_release
ddjvu_format_set_row_order
ddjvu_free
ddjvu_job_release
ddjvu_job_status
ddjvu_message_peek
ddjvu_message_pop
ddjvu_message_wait
ddjvu_miniexp_release
ddjvu_page_create_by_pageno
ddjvu_page_get_type
ddjvu_page_job
ddjvu_page_render
ddjvu_page_set_rotation
ddjvu_stream_close
ddjvu_stream_write
deflate
deflateEnd
deflateInit2_
deflateInit_
ft_error_string
fz_aa_level
fz_add_text
fz_adjust_rect_for_stroke
fz_advance_glyph
fz_alpha_from_gray
fz_analyze_text
fz_apply_transfer_function
fz_arc4_encrypt
fz_arc4_init
fz_atof
fz_atoi
fz_begin_group
fz_begin_mask
fz_begin_page
fz_begin_tile
fz_begin_tile_id
fz_bitmap_details
fz_blendmode_name
fz_bound_glyph
fz_bound_path
fz_bound_shade
fz_bound_text
fz_buffer_cat
fz_buffer_printf
fz_buffer_storage
fz_buffer_vprintf
fz_calloc
fz_calloc_no_throw
fz_caught
fz_caught_message
fz_chartorune
fz_cleanname
fz_clear_bitmap
fz_clear_pixmap
fz_clear_pixmap_rect_with_value
fz_clear_pixmap_with_value
fz_clip_image_mask
fz_clip_path
fz_clip_stroke_path
fz_clip_stroke_text
fz_clip_text
fz_clone_context
fz_clone_context_internal
fz_clone_path
fz_clone_stream
fz_clone_stroke_state
fz_clone_text
fz_close
fz_close_archive
fz_close_output
fz_closepath
fz_colorspace_is_indexed
fz_compressed_buffer_size
fz_concat
fz_concat_push
fz_convert_color
fz_convert_pixmap
fz_copy_aa_context
fz_copy_pixmap_rect
fz_copy_selection
fz_count_archive_entries
fz_currentpoint
fz_curveto
fz_curvetov
fz_curvetoy
fz_debug_tree
fz_debug_xml
fz_decode_indexed_tile
fz_decode_tile
fz_decomp_image_from_stream
fz_decouple_type3_font
fz_default_halftone
fz_detach_xml
fz_device_bgr
fz_device_cmyk
fz_device_gray
fz_device_rgb
fz_dirname
fz_disable_device_hints
fz_drop_bitmap
fz_drop_buffer
fz_drop_colorspace
fz_drop_colorspace_context
fz_drop_display_list
fz_drop_font
fz_drop_font_context
fz_drop_function
fz_drop_glyph
fz_drop_glyph_cache_context
fz_drop_halftone
fz_drop_image
fz_drop_link
fz_drop_pixmap
fz_drop_shade
fz_drop_storable
fz_drop_store_context
fz_drop_stroke_state
fz_drop_transfer_function
fz_dump_glyph_cache_stats
fz_empty_hash
fz_empty_store
fz_enable_device_hints
fz_encode_character
fz_end_group
fz_end_mask
fz_end_page
fz_end_tile
fz_eval_function
fz_expand_indexed_pixmap
fz_expand_rect
fz_fill_image
fz_fill_image_mask
fz_fill_path
fz_fill_shade
fz_fill_text
fz_fin_cached_color_converter
fz_find_item
fz_flush_warnings
fz_fopen_utf8
fz_free
fz_free_aa_context
fz_free_argv
fz_free_colorspace_imp
fz_free_compressed_buffer
fz_free_context
fz_free_device
fz_free_hash
fz_free_image
fz_free_jbig2_globals_imp
fz_free_link_dest
fz_free_outline
fz_free_path
fz_free_pixmap_imp
fz_free_scale_cache
fz_free_shade_imp
fz_free_text
fz_free_text_page
fz_free_text_sheet
fz_free_tree
fz_free_xml
fz_ftoa
fz_function_size
fz_gamma_pixmap
fz_gen_id
fz_generate_transition
fz_getopt
fz_glyph_bbox
fz_glyph_bbox_no_ctx
fz_glyph_cacheable
fz_glyph_height
fz_glyph_width
fz_gridfit_matrix
fz_grow_buffer
fz_halftone_pixmap
fz_has_archive_entry
fz_hash_find
fz_hash_get_key
fz_hash_get_val
fz_hash_insert
fz_hash_insert_with_pos
fz_hash_len
fz_hash_remove
fz_hash_remove_fast
fz_highlight_selection
fz_ignore_text
fz_image_get_pixmap
fz_include_point_in_rect
fz_init_cached_color_converter
fz_install_load_system_font_funcs
fz_intersect_irect
fz_intersect_rect
fz_invert_matrix
fz_invert_pixmap
fz_invert_pixmap_rect
fz_irect_from_rect
fz_is_rectilinear
fz_keep_bitmap
fz_keep_buffer
fz_keep_colorspace
fz_keep_colorspace_context
fz_keep_display_list
fz_keep_font
fz_keep_font_context
fz_keep_function
fz_keep_glyph
fz_keep_glyph_cache
fz_keep_halftone
fz_keep_image
fz_keep_link
fz_keep_pixmap
fz_keep_shade
fz_keep_storable
fz_keep_store_context
fz_keep_stream
fz_keep_stroke_state
fz_keep_transfer_function
fz_lineto
fz_list_archive_entry
fz_load_jbig2_globals
fz_load_jpeg_info
fz_load_jpx
fz_load_jxr
fz_load_jxr_info
fz_load_png
fz_load_png_info
fz_load_system_cjk_font
fz_load_system_font
fz_load_tiff
fz_load_tiff_info
fz_load_tiff_subimage
fz_load_tiff_subimage_count
fz_lookup_blendmode
fz_lookup_color_converter
fz_lookup_device_colorspace
fz_malloc
fz_malloc_array
fz_malloc_array_no_throw
fz_malloc_no_throw
fz_matrix_expansion
fz_matrix_max_expansion
fz_md5_final
fz_md5_init
fz_md5_pixmap
fz_md5_update
fz_moveto
fz_new_aa_context
fz_new_bbox_device
fz_new_bitmap
fz_new_buffer
fz_new_buffer_from_data
fz_new_colorspace
fz_new_colorspace_context
fz_new_context_imp
fz_new_device
fz_new_display_list
fz_new_draw_device
fz_new_draw_device_type3
fz_new_draw_device_with_bbox
fz_new_font_context
fz_new_font_from_buffer
fz_new_font_from_file
fz_new_font_from_memory
fz_new_glyph_cache_context
fz_new_glyph_from_8bpp_data
fz_new_glyph_from_pixmap
fz_new_halftone
fz_new_hash_table
fz_new_image
fz_new_image_from_buffer
fz_new_image_from_data
fz_new_image_from_pixmap
fz_new_indexed_colorspace
fz_new_link
fz_new_list_device
fz_new_output_to_filename
fz_new_output_with_buffer
fz_new_output_with_file
fz_new_path
fz_new_pixmap
fz_new_pixmap_from_1bpp_data
fz_new_pixmap_from_8bpp_data
fz_new_pixmap_from_image
fz_new_pixmap_with_bbox
fz_new_pixmap_with_bbox_and_data
fz_new_pixmap_with_data
fz_new_png_from_image
fz_new_png_from_pixmap
fz_new_scale_cache
fz_new_store_context
fz_new_stream
fz_new_stroke_state
fz_new_stroke_state_with_dash_len
fz_new_text
fz_new_text_device
fz_new_text_page
fz_new_text_sheet
fz_new_trace_device
fz_new_type3_font
fz_normalize_vector
fz_open_a85d
fz_open_aesd
fz_open_ahxd
fz_open_arc4
fz_open_archive
fz_open_archive_entry
fz_open_archive_with_stream
fz_open_buffer
fz_open_compressed_buffer
fz_open_concat
fz_open_copy
fz_open_dctd
fz_open_directory
fz_open_faxd
fz_open_fd
fz_open_file
fz_open_file_w
fz_open_flated
fz_open_image_decomp_stream
fz_open_image_decomp_stream_from_buffer
fz_open_jbig2d
fz_open_leecher
fz_open_lzwd
fz_open_memory
fz_open_null
fz_open_predict
fz_open_rld
fz_outline_ft_glyph
fz_outline_glyph
fz_output_pam_band
fz_output_pam_header
fz_output_png
fz_output_png_band
fz_output_png_header
fz_output_png_trailer
fz_output_pnm_band
fz_output_pnm_header
fz_paint_shade
fz_parse_xml
fz_pixmap_bbox
fz_pixmap_bbox_no_ctx
fz_pixmap_colorspace
fz_pixmap_components
fz_pixmap_height
fz_pixmap_samples
fz_pixmap_set_resolution
fz_pixmap_size
fz_pixmap_width
fz_pop_clip
fz_pre_rotate
fz_pre_scale
fz_pre_shear
fz_pre_translate
fz_premultiply_pixmap
fz_prepare_t3_glyph
fz_print_outline
fz_print_outline_xml
fz_print_text
fz_print_text_page
fz_print_text_page_html
fz_print_text_page_xml
fz_print_text_sheet
fz_printf
fz_process_mesh
fz_purge_glyph_cache
fz_push_try
fz_putc
fz_puts
fz_read
fz_read_all
fz_read_archive_entry
fz_read_best
fz_read_file
fz_read_line
fz_rebind_archive
fz_rebind_device
fz_rebind_output
fz_rebind_stream
fz_rect_from_irect
fz_redirect_io_to_console
fz_remove_item
fz_render_ft_glyph
fz_render_ft_glyph_pixmap
fz_render_ft_stroked_glyph
fz_render_ft_stroked_glyph_pixmap
fz_render_glyph
fz_render_glyph_pixmap
fz_render_stroked_glyph
fz_render_stroked_glyph_pixmap
fz_render_t3_glyph
fz_render_t3_glyph_direct
fz_render_t3_glyph_pixmap
fz_resize_array
fz_resize_array_no_throw
fz_resize_buffer
fz_rethrow
fz_rethrow_if
fz_rethrow_message_imp
fz_rotate
fz_round_rect
fz_run_display_list
fz_run_t3_glyph
fz_runelen
fz_runetochar
fz_scale
fz_scale_pixmap
fz_scale_pixmap_cached
fz_search_text_page
fz_seek
fz_set_aa_level
fz_set_device_bgr
fz_set_device_cmyk
fz_set_device_gray
fz_set_device_rgb
fz_set_font_bbox
fz_sha256_final
fz_sha256_init
fz_sha256_update
fz_sha384_final
fz_sha384_init
fz_sha384_update
fz_sha512_final
fz_sha512_init
fz_sha512_update
fz_shear
fz_shrink_store
fz_snprintf
fz_store_item
fz_store_scavenge
fz_strdup
fz_strdup_no_throw
fz_stream_meta
fz_strlcat
fz_strlcpy
fz_stroke_path
fz_stroke_text
fz_strsep
fz_strtod
fz_subpixel_adjust
fz_subsample_pixmap
fz_tell
fz_text_char_at
fz_text_char_bbox
fz_throw_imp
fz_tint_pixmap
fz_transform_path
fz_transform_point
fz_transform_point_xy
fz_transform_rect
fz_transform_vector
fz_translate
fz_translate_irect
fz_tree_insert
fz_tree_lookup

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data:
Size: 733KB - Virtual size: 733KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 122KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

57e98d9a5a72c8d7ad8fb7a6a58b3daf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2cCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2cCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6Certificate

Extended Key Usages

Key Usages

c8:51:a7:8b:fe:16:98:c5:b9:1a:e0:cd:b4:3c:c4:7f:67:6e:23:ff:93:10:4d:6f:83:e4:f4:83:b3:3d:05:dcSigner

f1:94:88:0c:b9:6b:6f:4e:e2:c9:63:3e:aa:be:03:c8:0e:40:40:f5Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 106KB

.ndata Size: - Virtual size: 40KB

.rsrc Size: 86KB - Virtual size: 86KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 24KB

UPX1 Size: 5KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 8KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 348B

.rsrc Size: 1024B - Virtual size: 888B

.reloc Size: 1024B - Virtual size: 984B

c8d28c8ec3ed633365eedf3ec168225b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2cCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

c8:51:a7:8b:fe:16:98:c5:b9:1a:e0:cd:b4:3c:c4:7f:67:6e:23:ff:93:10:4d:6f:83:e4:f4:83:b3:3d:05:dc
Signer

f1:94:88:0c:b9:6b:6f:4e:e2:c9:63:3e:aa:be:03:c8:0e:40:40:f5
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 106KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 86KB - Virtual size: 86KB

UPX0
Size: - Virtual size: 24KB

UPX1
Size: 5KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 8KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 348B

.rsrc
Size: 1024B - Virtual size: 888B

.reloc
Size: 1024B - Virtual size: 984B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:be:b5:bc:19:d2:88:16:0d:db:5e:fe:e3:e8:f2:2c
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Certificate

91:05:55:33:88:f2:7c:dc:c5:2d:1e:c3:62:57:57:21:e9:e8:14:8c:da:75:3f:f1:03:c0:c4:04:ef:79:82:2f
Signer

c3:90:85:b2:d3:81:15:8f:83:9f:90:4a:f4:2d:56:1d:9b:ab:c4:6b
Signer

.text
Size: 787KB - Virtual size: 787KB

.rdata
Size: 183KB - Virtual size: 182KB

.data
Size: 12KB - Virtual size: 21KB

.rsrc
Size: 89KB - Virtual size: 89KB

.reloc
Size: 43KB - Virtual size: 43KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 851B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 606B

.text
Size: 3KB - Virtual size: 2KB