061959017c38725c7215be81393c30b4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

061959017c38725c7215be81393c30b4_JaffaCakes118
Size

1.2MB
MD5

061959017c38725c7215be81393c30b4
SHA1

feaf9ed80b7a279f72729e95f9b6017f50d2c136
SHA256

3ac6dc8def401c0166a017e0a2c3ffe2ec8a38676d229fd7b2956311cf2b8d78
SHA512

b847fe717dfab3fcd1ca552657effa6a7c57706a5290c4be33a1f6f9c27cfdefe241bdaccf7f5fe6a10645e6bc44b69395e42b63c4ae1dda6dfaa59402df2393
SSDEEP

24576:p72FbQk606ozJvkKKdvKHjNCFgG1EPqblRhYRkv7g4F:SYBYvKdgNCFH1x46J

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

Files

061959017c38725c7215be81393c30b4_JaffaCakes118
.exe windows:5 windows x86 arch:x86

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:82:d2:5f:ac:df:32:44:60:6c:b5:e9:68:ed:9f:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/06/2013, 00:00

Not After

16/06/2016, 23:59

Subject

CN=Inuvo Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=alot.com,O=Inuvo Inc.,L=Conway,ST=Arkansas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/$PROGRAMFILES/alotappbar/alotUninst.exe.nsis
$1/alotSettings.exe
.exe windows:5 windows x86 arch:x86

ba8e0ea689ca147fe801b09814f69ea1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

86:73:9b:77:14:c2:3e:d9:7a:4d:29:3a:61:dd:77:4a:01:37:77:c5
Signer

Actual PE Digest

86:73:9b:77:14:c2:3e:d9:7a:4d:29:3a:61:dd:77:4a:01:37:77:c5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\appbar_build\builds\alotappbar\bin\support\alotsettings\alotsettings.pdb

Imports

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules

kernel32

LCMapStringW
Sleep
RtlUnwind
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
CreateRemoteThread
OpenProcess
WideCharToMultiByte
VirtualFreeEx
TerminateProcess
lstrlenW
GetLastError
SetLastError
GetProcAddress
VirtualAllocEx
GetExitCodeThread
CloseHandle
WriteProcessMemory
GetProcessHeap
HeapAlloc
HeapSize
MultiByteToWideChar
RaiseException
HeapFree
HeapReAlloc
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleA
VirtualProtect
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
PostMessageW
RegisterWindowMessageW
SetParent
SendMessageW

advapi32

RegCreateKeyExW
RegSetValueExW

shlwapi

SHDeleteKeyW

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotappbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

b57ba77262d0341b746992651f179ad4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a5:4e:5c:02:36:b8:8b:9a:9a:6a:8c:4e:1f:67:c4:72:ec:f8:f3:b0
Signer

Actual PE Digest

a5:4e:5c:02:36:b8:8b:9a:9a:6a:8c:4e:1f:67:c4:72:ec:f8:f3:b0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\appbar_build\builds\alotappbar\bin\support\alotappbar\alotappbar.pdb

Imports

uxtheme

SetWindowTheme

kernel32

GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
FindResourceExW
LoadLibraryA
InterlockedExchange
OpenMutexW
GetTempFileNameW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
GetCurrentProcessId
CreateFileMappingW
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
Sleep
CreateFileW
SetEndOfFile
SetFileAttributesW
GetTickCount
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
ResumeThread
TerminateThread
ResetEvent
SetCurrentDirectoryW
GetSystemTimeAsFileTime
LocalFree
FormatMessageW
GetModuleFileNameA
GetFileAttributesExW
GetLongPathNameW
GetExitCodeProcess
CreateProcessW
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrlenA
GetCurrentDirectoryW
FindNextFileW
CreateDirectoryW
GetProcessHeap
HeapSize
HeapReAlloc
MulDiv
HeapFree
GetExitCodeThread
InitializeCriticalSection
SignalObjectAndWait
lstrcpynW
CreateThread
SystemTimeToFileTime
GetSystemTime
DuplicateHandle
EncodePointer
DecodePointer
ExitThread
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
HeapCreate
HeapDestroy
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
lstrcmpW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
LoadLibraryExW
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateMutexW
WaitForMultipleObjects
ReleaseMutex
CreateEventW
SetEvent
WaitForSingleObject
CloseHandle
lstrlenW
GetCurrentThreadId
FreeLibrary
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
HeapAlloc
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
LocalAlloc

user32

SendNotifyMessageW
UpdateWindow
UnhookWindowsHookEx
CallNextHookEx
WindowFromPoint
SetWindowsHookExW
wsprintfW
FrameRect
CreatePopupMenu
TrackPopupMenu
GetUpdateRect
AppendMenuW
InsertMenuW
SetMenuItemInfoW
SetDlgItemTextW
CheckDlgButton
CheckRadioButton
GetDlgItemTextW
IsDlgButtonChecked
SendDlgItemMessageW
GetWindowDC
DrawTextExW
PostThreadMessageW
UnregisterClassW
GetSystemMetrics
GetTopWindow
IntersectRect
GetActiveWindow
IsIconic
RegisterClipboardFormatW
GetMenuState
EndDialog
MonitorFromPoint
DrawTextW
SetClassLongW
GetSystemMenu
ModifyMenuW
GetSysColorBrush
GetMenuItemRect
DeleteMenu
DestroyMenu
CopyRect
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
CopyImage
KillTimer
SetTimer
CharLowerW
CharUpperW
SendMessageTimeoutW
SystemParametersInfoW
EnumChildWindows
GetAncestor
EnumWindows
OffsetRect
MsgWaitForMultipleObjects
GetWindowThreadProcessId
BroadcastSystemMessageW
LoadImageW
DestroyCursor
DestroyIcon
SetCursor
GetCursor
SetWindowRgn
PtInRect
TrackMouseEvent
GetCursorPos
IsWindowEnabled
DialogBoxIndirectParamW
DialogBoxParamW
CreateDialogIndirectParamW
IsWindowVisible
MessageBoxW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
GetFocus
SetFocus
DestroyAcceleratorTable
UnregisterClassA
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
GetDC
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
GetKeyState
IsChild
SendMessageW
GetDlgItem
CharNextW
GetWindowPlacement
SetForegroundWindow
EnableWindow
SetActiveWindow
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
ShowWindow
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
PeekMessageW
RegisterWindowMessageW
CallWindowProcW
LoadStringW
GetWindowLongW
DefWindowProcW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
LoadCursorW
IsWindow
PostMessageW
SetWindowLongW
ReleaseDC

gdi32

DeleteDC
DeleteObject
GetTextMetricsW
IntersectClipRect
SetBkMode
GetPixel
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
GetDIBColorTable
MoveToEx
LineTo
CreateFontIndirectW
SetBkColor
ExtTextOutW
GetTextExtentPoint32W
CreatePen
RoundRect
SetTextColor
CreateFontW
FrameRgn
SetDIBColorTable
CreateRoundRectRgn
CreatePolygonRgn
CreateRectRgn
CombineRgn
CreateDIBSection
SetStretchBltMode
StretchBlt
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

shell32

ord165
ShellExecuteExW
SHGetSpecialFolderPathW
ShellExecuteW
SHFileOperationW
SHFileOperationA
ord92

ole32

CoGetInterfaceAndReleaseStream
OleDuplicateData
CoInitialize
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
StringFromCLSID
OleInitialize
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SafeArrayDestroy
SafeArrayPutElement
VariantClear
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayAccessData
GetErrorInfo
SafeArrayCreateVector
SafeArrayUnaccessData
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VarBstrCmp
SysStringLen
VarUI4FromStr
SysFreeString
VariantCopyInd
VariantChangeType
DispCallFunc
VariantInit

shlwapi

SHGetValueW
UrlIsW
PathCreateFromUrlW
SHRegWriteUSValueW
SHRegCreateUSKeyW
PathIsRelativeW
UrlUnescapeW
PathAppendW
PathFileExistsW
SHDeleteValueW
UrlCanonicalizeW
PathFindFileNameW
PathIsURLW
SHCopyKeyW
UrlGetPartW
PathFindExtensionW
StrCmpIW
UrlEscapeW
SHDeleteKeyW

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 797KB - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 169KB - Virtual size: 169KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alothelper.dll
.dll regsvr32 windows:5 windows x86 arch:x86

aabfd7aec29f8b9640c3b9f085a45859

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:7a:9b:ce:27:42:ac:8f:29:1c:e8:bf:e4:aa:79:0b:bd:92:f6:e6
Signer

Actual PE Digest

48:7a:9b:ce:27:42:ac:8f:29:1c:e8:bf:e4:aa:79:0b:bd:92:f6:e6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\appbar_build\builds\alotappbar\bin\support\alothelper\alothelper.pdb

Imports

shlwapi

SHGetValueW

kernel32

EncodePointer
lstrcpyW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
lstrcatW
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
WriteFile
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
RaiseException
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter

user32

DestroyWindow
PostMessageW
GetClassInfoW
IsWindow
GetWindowLongW
SetWindowLongW
DefWindowProcW
ShowWindow
GetParent
CreateWindowExW
RegisterClassW
GetClientRect

oleaut32

VariantInit
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotservice.exe
.exe windows:5 windows x86 arch:x86

94a74fb69d6a5ba57837b07c11e5b02c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

CoInternetCompareUrl
URLDownloadToFileW
ObtainUserAgentString

wtsapi32

WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSQueryUserToken
WTSSendMessageW
WTSRegisterSessionNotification
WTSFreeMemory

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

shlwapi

SHGetValueW
PathAppendW

wininet

InternetConnectW
HttpOpenRequestW
InternetGetLastResponseInfoW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
InternetAttemptConnect
HttpAddRequestHeadersW
HttpQueryInfoW
InternetReadFile

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

CompareStringW
WriteConsoleW
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetCurrentProcessId
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
GetLastError
SetLastError
lstrcpyW
lstrlenW
WaitForSingleObject
WaitForMultipleObjects
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
GetModuleFileNameW
SetEvent
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
ExitThread
GetTickCount
CreateProcessW
WTSGetActiveConsoleSessionId
GetCurrentThreadId
CopyFileW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
TerminateThread
GetExitCodeThread
DeleteFileW
OpenEventW
UnregisterWaitEx
RegisterWaitForSingleObject
ResetEvent
CreateEventW
GetVersionExA
GetVersionExW
CreateDirectoryW
FindClose
FindFirstFileW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
OpenMutexW
CreateMutexW
ReleaseMutex
GetProcessHeap
HeapSize
HeapReAlloc
lstrcmpiW
lstrcmpW
HeapAlloc
HeapFree
lstrlenA
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
ResumeThread
CreateThread
EncodePointer
DecodePointer
GetEnvironmentStringsW
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
InitializeCriticalSectionAndSpinCount
ExitProcess
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetStdHandle
FreeEnvironmentStringsW
VirtualProtect

user32

GetWindowLongW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
RegisterClassExW
DefWindowProcW
WaitForInputIdle
DestroyWindow
GetClassInfoExW
SetWindowLongW
wsprintfW
CallWindowProcW
LoadCursorW
UnregisterClassA

advapi32

DuplicateTokenEx
RegSetValueExW
RegCloseKey
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
SetServiceStatus
StartServiceW
ControlService
OpenServiceW
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
RegCreateKeyExW

shell32

ord92
ord165

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitializeEx

oleaut32

SafeArrayDestroy
VariantChangeType
VariantClear
VarBstrCmp
SysStringLen
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SysFreeString
SysAllocString
SysAllocStringLen
SafeArrayUnaccessData

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotwidgets.exe
.exe windows:5 windows x86 arch:x86

393f5dd5e594b1fca2ea5ef64b96f33e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

35:6d:ca:41:e6:d4:e3:32:ad:b4:68:83:00:27:8e:e8:f8:f7:32:4a
Signer

Actual PE Digest

35:6d:ca:41:e6:d4:e3:32:ad:b4:68:83:00:27:8e:e8:f8:f7:32:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\appbar_build\builds\alotappbar\bin\support\alotwidgets\alotwidgets.pdb

Imports

urlmon

CoInternetCompareUrl
ObtainUserAgentString
IsValidURL
URLDownloadToFileW

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wininet

InternetOpenW
InternetCreateUrlW
InternetCrackUrlW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules

ws2_32

WSAGetLastError
gethostbyname

kernel32

TlsGetValue
TlsSetValue
TlsFree
GetCPInfo
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetLastError
WaitForSingleObject
CreateMutexW
SetLastError
lstrlenW
CloseHandle
ReleaseMutex
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
GetCurrentThreadId
ExitProcess
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
DeleteFileW
ResetEvent
CreateEventW
UnmapViewOfFile
MapViewOfFile
GetCurrentProcessId
GetACP
Sleep
WriteFile
CreateFileW
MultiByteToWideChar
TerminateThread
MoveFileW
FreeLibrary
lstrlenA
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
SetEndOfFile
SetFileAttributesW
GetExitCodeProcess
GetTickCount
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
GetLongPathNameW
TerminateProcess
OpenProcess
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEvent
lstrcmpiW
WaitForMultipleObjects
LoadLibraryA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
SizeofResource
LoadResource
FindResourceW
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapFree
GetOEMCP
IsValidCodePage
HeapCreate
GetStdHandle
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
QueryPerformanceCounter
InterlockedPopEntrySList
RtlUnwind
EncodePointer
DecodePointer
VirtualProtect
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileMappingW

user32

AttachThreadInput
AllowSetForegroundWindow
BringWindowToTop
SetForegroundWindow
SystemParametersInfoW
EnumWindows
MsgWaitForMultipleObjects
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetWindowThreadProcessId
BroadcastSystemMessageW
GetWindowPlacement
IsWindowVisible
GetWindowRect
IsIconic
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
GetFocus
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
GetForegroundWindow
GetClassNameW
GetDlgItem
FrameRect
SetWindowRgn
GetWindowDC
TrackMouseEvent
MonitorFromRect
GetSystemMetrics
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
CharNextW
GetSysColor
GetWindow
GetKeyState
ShowWindow
GetParent
IsChild
SendMessageW
RegisterWindowMessageW
PostThreadMessageW
CallWindowProcW
GetWindowLongW
DefWindowProcW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
LoadCursorW
IsWindow
PostMessageW
SetWindowLongW
FindWindowW
GetClassInfoW
GetCursorPos
SetLayeredWindowAttributes
UnregisterClassW
UnregisterClassA
RegisterClassW
CopyImage
PtInRect
KillTimer
SetTimer
DrawTextW
InSendMessage
ReplyMessage
LoadImageW
SendNotifyMessageW
MonitorFromPoint
GetMonitorInfoW
ReleaseCapture
CopyRect
SetWindowPos

gdi32

BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
SetDIBitsToDevice
CreatePatternBrush
CreateRectRgn
CreateRoundRectRgn
StretchBlt
ExtTextOutW
RoundRect
SetPixel
CreateFontW
CreateDIBSection
CreatePen
MoveToEx
LineTo
GetTextExtentPoint32W
DeleteDC
SetDIBColorTable
SetTextColor
SetBkMode
GetStockObject
GetObjectW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegDeleteKeyW

shell32

ord165
ord92
ShellExecuteExW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
StringFromGUID2

oleaut32

DispCallFunc
VariantChangeType
VariantCopyInd
SysStringLen
VarBstrCmp
SysFreeString
SysAllocStringLen
VariantInit
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SafeArrayUnaccessData
SafeArrayAccessData
VarUI4FromStr
SafeArrayCreateVector
SafeArrayDestroy
SysAllocString
VariantCopy
VariantClear
SysAllocStringByteLen

shlwapi

PathIsRelativeW
PathCreateFromUrlW
UrlIsW
SHGetValueW
PathAppendW
PathFileExistsW
UrlGetPartW

msimg32

TransparentBlt

gdiplus

GdipAlloc
GdipFree
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/resources/App_137211/images/6479f4219e1c2d4ecab91f3a375a9408.png
.png
$1/resources/App_2254/images/8cffb8b3ba4df43dea939ac6952b3f2f.png
.png
$1/resources/App_270711/images/cc087f71470539f6a11eb839135924b5.png
.png
$1/resources/App_270811/images/f5029c71caa492c399a34ab6b0846a50.png
.png
$1/resources/App_271111/images/54d126aff5b0953b576c8856f03a2c4c.png
.png
$1/resources/App_274011/images/58604cddd575f162407905b78bca711a.png
.png
$1/resources/App_274211/images/0c6182c71f9f87924dc8e0b810677e44.png
.png
$1/resources/App_5809/images/dea85611eacb320a29fe17b8907b7e05.png
.png
$1/resources/shared/domains.dat
.xml
$1/resources/shared/images/DesktopAlertClose.png
.png
$1/resources/shared/images/PageAlertBkgnd.png
.png
$1/resources/shared/images/PageAlertButton.png
.png
$1/resources/shared/images/PageAlertButtonHot.png
.png
$1/resources/shared/images/PageAlertClose.png
.png
$1/resources/shared/images/PageAlertCloseHot.png
.png
$1/resources/shared/images/add-app-hover.png
.png
$1/resources/shared/images/add-app.png
.png
$1/resources/shared/images/alot-logo-100x51.png
.png
$1/resources/shared/images/alot-logo-13x13.png
.png
$1/resources/shared/images/alot-logo-16x16.png
.png
$1/resources/shared/images/alot-logo-65x34-hover.png
.png
$1/resources/shared/images/alot-logo-65x34.png
.png
$1/resources/shared/images/alot-logo-95x55.png
.png
$1/resources/shared/images/check.png
.png
$1/resources/shared/images/cog-hover.png
.png
$1/resources/shared/images/cog.png
.png
$1/resources/shared/images/desktopAlertAttrBkgnd.png
.png
$1/resources/shared/images/desktopAlertCloseHot.png
.png
$1/resources/shared/images/desktopAlertImage.png
.png
$1/resources/shared/images/desktopAlertImageBkgnd.png
.png
$1/resources/shared/images/desktopAlertTextBkgnd.png
.png
$1/resources/shared/images/error-icon.jpg
.jpg
$1/resources/shared/images/favicon.ico
$1/resources/shared/images/loading.bmp
$1/resources/shared/images/magnifying-glass.png
.png
$1/resources/shared/images/search-button-hover.png
.png
$1/resources/shared/images/search-button.png
.png
$1/resources/shared/images/theme/blue/appbar-bg.png
.png
$1/resources/shared/images/theme/blue/divider.png
.png
$1/resources/shared/images/theme/blue/page/bg.png
.png
$1/resources/shared/images/theme/blue/page/left/hover.png
.png
$1/resources/shared/images/theme/blue/page/left/normal.png
.png
$1/resources/shared/images/theme/blue/page/left/not-available.png
.png
$1/resources/shared/images/theme/blue/page/right/hover.png
.png
$1/resources/shared/images/theme/blue/page/right/normal.png
.png
$1/resources/shared/images/theme/blue/page/right/not-available.png
.png
$1/resources/shared/images/theme/blue/slider.png
.png
$1/resources/shared/images/theme/blue/swatch.png
.png
$1/resources/shared/images/theme/green/appbar-bg.png
.png
$1/resources/shared/images/theme/green/divider.png
.png
$1/resources/shared/images/theme/green/page/bg.png
.png
$1/resources/shared/images/theme/green/page/left/hover.png
.png
$1/resources/shared/images/theme/green/page/left/normal.png
.png
$1/resources/shared/images/theme/green/page/left/not-available.png
.png
$1/resources/shared/images/theme/green/page/right/hover.png
.png
$1/resources/shared/images/theme/green/page/right/normal.png
.png
$1/resources/shared/images/theme/green/page/right/not-available.png
.png
$1/resources/shared/images/theme/green/slider.png
.png
$1/resources/shared/images/theme/green/swatch.png
.png
$1/resources/shared/images/theme/orange/appbar-bg.png
.png
$1/resources/shared/images/theme/orange/divider.png
.png
$1/resources/shared/images/theme/orange/page/bg.png
.png
$1/resources/shared/images/theme/orange/page/left/hover.png
.png
$1/resources/shared/images/theme/orange/page/left/normal.png
.png
$1/resources/shared/images/theme/orange/page/left/not-available.png
.png
$1/resources/shared/images/theme/orange/page/right/hover.png
.png
$1/resources/shared/images/theme/orange/page/right/normal.png
.png
$1/resources/shared/images/theme/orange/page/right/not-available.png
.png
$1/resources/shared/images/theme/orange/slider.png
.png
$1/resources/shared/images/theme/orange/swatch.png
.png
$1/resources/shared/images/theme/palette-hover.png
.png
$1/resources/shared/images/theme/palette.png
.png
$1/resources/shared/images/theme/pink/appbar-bg.png
.png
$1/resources/shared/images/theme/pink/divider.png
.png
$1/resources/shared/images/theme/pink/page/bg.png
.png
$1/resources/shared/images/theme/pink/page/left/hover.png
.png
$1/resources/shared/images/theme/pink/page/left/normal.png
.png
$1/resources/shared/images/theme/pink/page/left/not-available.png
.png
$1/resources/shared/images/theme/pink/page/right/hover.png
.png
$1/resources/shared/images/theme/pink/page/right/normal.png
.png
$1/resources/shared/images/theme/pink/page/right/not-available.png
.png
$1/resources/shared/images/theme/pink/slider.png
.png
$1/resources/shared/images/theme/pink/swatch.png
.png
$1/resources/shared/images/theme/standard/appbar-bg.png
.png
$1/resources/shared/images/theme/standard/divider.png
.png
$1/resources/shared/images/theme/standard/page/bg.png
.png
$1/resources/shared/images/theme/standard/page/left/hover.png
.png
$1/resources/shared/images/theme/standard/page/left/normal.png
.png
$1/resources/shared/images/theme/standard/page/left/not-available.png
.png
$1/resources/shared/images/theme/standard/page/right/hover.png
.png
$1/resources/shared/images/theme/standard/page/right/normal.png
.png
$1/resources/shared/images/theme/standard/page/right/not-available.png
.png
$1/resources/shared/images/theme/standard/slider.png
.png
$1/resources/shared/images/theme/standardClassic/appbar-bg.png
.png
$1/resources/shared/images/theme/standardClassic/divider.png
.png
$1/resources/shared/images/theme/standardClassic/page/bg.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/slider.png
.png
$1/resources/shared/images/theme/standardWin7/appbar-bg.png
.png
$1/resources/shared/images/theme/standardWin7/divider.png
.png
$1/resources/shared/images/theme/standardWin7/page/bg.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/slider.png
.png
$1/resources/shared/images/widget/caption-bg.bmp
$1/resources/shared/images/widget/close-hover.bmp
$1/resources/shared/images/widget/close.bmp
$1/resources/shared/images/widget/configure-hover.bmp
$1/resources/shared/images/widget/configure.bmp
$1/resources/shared/images/widget/refresh-hover.bmp
$1/resources/shared/images/widget/refresh.bmp
$1/service.xml
.xml
$1/toolbar.xml
.xml
$PLUGINSDIR/Acronis_offerpage.bmp
$PLUGINSDIR/Acronis_offerpage.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/about.html
$PLUGINSDIR/about.ini
$PLUGINSDIR/about.png
.png
$PLUGINSDIR/closeie.ini
$PLUGINSDIR/eula.html
.html
$PLUGINSDIR/eula.ini
$PLUGINSDIR/installagent.exe
.exe windows:5 windows x86 arch:x86

0c7938137b8e619c4beaffeb13066fc4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:82:d2:5f:ac:df:32:44:60:6c:b5:e9:68:ed:9f:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/06/2013, 00:00

Not After

16/06/2016, 23:59

Subject

CN=Inuvo Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=alot.com,O=Inuvo Inc.,L=Conway,ST=Arkansas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4c:b1:e5:5a:58:c4:24:6b:8c:e4:52:ed:12:91:36:5b:ea:58:0b:09
Signer

Actual PE Digest

4c:b1:e5:5a:58:c4:24:6b:8c:e4:52:ed:12:91:36:5b:ea:58:0b:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\installhelper\bin\support\installagent.pdb

Imports

installhelper

GetUserOptionsEx
TerminateProductProcessesEx

kernel32

GetCommandLineW
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetLastError
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
HeapFree
Sleep
LoadLibraryW
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
HeapReAlloc
HeapSize
RaiseException

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/installhelper.dll
.dll windows:5 windows x86 arch:x86

8694c689959ed0b55756b1a3d51c032c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

38:82:d2:5f:ac:df:32:44:60:6c:b5:e9:68:ed:9f:ea
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

17/06/2013, 00:00

Not After

16/06/2016, 23:59

Subject

CN=Inuvo Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=alot.com,O=Inuvo Inc.,L=Conway,ST=Arkansas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7a:7a:eb:9f:ce:34:15:92:62:aa:87:73:a4:03:b2:7f:05:86:42:68
Signer

Actual PE Digest

7a:7a:eb:9f:ce:34:15:92:62:aa:87:73:a4:03:b2:7f:05:86:42:68

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\installhelper\Release\installhelper.pdb

Imports

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW
WTSSendMessageW

shell32

SHFileOperationW
ord92
ord165
ShellExecuteW

userenv

UnloadUserProfile
DestroyEnvironmentBlock
CreateEnvironmentBlock
LoadUserProfileW

psapi

EnumProcesses
GetModuleBaseNameW
EnumProcessModules
GetProcessImageFileNameW
GetModuleFileNameExW

urlmon

URLDownloadToFileW
ObtainUserAgentString
IsValidURL

wininet

InternetOpenUrlW
InternetGetLastResponseInfoW
InternetCloseHandle
InternetGetCookieExW
InternetTimeToSystemTimeW
HttpQueryInfoW
InternetOpenW

secur32

GetUserNameExW

kernel32

lstrcmpW
LocalAlloc
GetVersionExA
GetVersionExW
GetLongPathNameW
FindClose
FindFirstFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
WaitForMultipleObjects
WaitForSingleObject
WTSGetActiveConsoleSessionId
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GetCurrentProcess
GetCurrentProcessId
FormatMessageW
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
CreateDirectoryW
SetEvent
ResetEvent
CreateEventW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
CopyFileW
GetComputerNameW
RaiseException
FlushInstructionCache
GetCurrentDirectoryW
SetCurrentDirectoryW
GetTempPathW
MoveFileW
GetCurrentThreadId
SystemTimeToFileTime
GetSystemTime
GlobalUnlock
LocalFree
GlobalAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MulDiv
WideCharToMultiByte
ProcessIdToSessionId
InitializeCriticalSection
CreateThread
OpenMutexW
CreateMutexW
FindNextFileW
HeapSize
HeapReAlloc
lstrcmpiW
lstrlenA
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapCreate
HeapDestroy
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
SetStdHandle
GetConsoleCP
GetConsoleMode
GetTickCount
WriteConsoleW
GetProcessHeap
HeapAlloc
Sleep
HeapFree
SetLastError
GetLastError
OpenProcess
CloseHandle
lstrlenW
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
GlobalLock
FlushFileBuffers

user32

MoveWindow
CharNextW
GetSysColor
RegisterWindowMessageW
CallWindowProcW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
DefWindowProcW
SendMessageW
GetWindowLongW
GetClientRect
CreateWindowExW
RegisterClassExW
ClientToScreen
GetClassInfoExW
SetWindowPos
SetWindowLongW
DestroyWindow
SendMessageTimeoutW
IsWindow
PostMessageW
EnumWindows
WaitForInputIdle
FindWindowW
GetAncestor
GetWindowThreadProcessId
GetClassNameW
GetDC
ScreenToClient
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
UnregisterClassA
MsgWaitForMultipleObjects
PostThreadMessageW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
UnregisterClassW
CreateAcceleratorTableW
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetDlgItem
LoadCursorW
GetParent

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
CreateProcessAsUserW
GetSecurityInfo
GetAclInformation
GetAce
DeleteAce
SetSecurityInfo
GetTokenInformation
ConvertSidToStringSidA
LookupAccountNameW
DuplicateTokenEx
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
CloseServiceHandle
QueryServiceStatusEx
ControlService
OpenServiceW
EnumDependentServicesW
DeleteService
OpenSCManagerW
StartServiceW
RegDeleteValueW
RegCreateKeyExA
RegOpenKeyExA
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW

ole32

CoTaskMemAlloc
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
OleUninitialize

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantCopy
SysAllocStringLen
SysStringLen
DispCallFunc
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VarBstrCmp
VariantChangeType
SafeArrayDestroy
GetErrorInfo

shlwapi

PathFileExistsW
PathRemoveFileSpecW
UrlIsW
PathIsURLW
UrlCreateFromPathW
UrlEscapeW
PathCreateFromUrlW
PathIsRelativeW
PathAppendW
SHDeleteValueW
SHDeleteKeyW
PathFindFileNameW
SHGetValueW

Exports

Exports

AppendToolbarParams
BackupProduct
DownloadAndRun
GetUserOptions
GetUserOptionsEx
HtmlCreate
HtmlDestroy
HtmlDisplay
IEAddSearchProvider
IEApprove
IEDisapprove
IEGetDefaultSearchProvider
IEGetMajorVersion
IEGetMinorVersion
IEGetOriginalDefaultSearchProvider
IELaunch
IERemoveSearchProvider
IESetDefaultSearchProvider
IEShowToolbar
IEShowToolbarExW
IEUnblockExtension
InstallProduct
InstallService
IsBundleInstallRegistered
IsInstallNotAllowed
IsInstallingInEnterprise
Notify
RegUserDeleteKey
RegUserReadDWORD
RegUserReadString
RegUserWriteDWORD
RegUserWriteString
RegisterBundleInstall
RegisterProduct
RemoveBackups
ReportUninstall
RestoreProduct
RunService
RunUninstaller
SetCampaignId
SetExtraParam1
StopService
TerminateProductProcesses
TerminateProductProcessesEx
UninstallService
UnregisterProduct
UpdateUser
WinGetKnownFolderPath

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp

Sharing

General

Malware Config

Signatures

Files

32f3282581436269b3a75b6675fe3e08

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

38:82:d2:5f:ac:df:32:44:60:6c:b5:e9:68:ed:9f:eaCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 415KB

.ndata Size: - Virtual size: 1.2MB

.rsrc Size: 28KB - Virtual size: 27KB

.reloc Size: 4KB - Virtual size: 3KB

ba8e0ea689ca147fe801b09814f69ea1

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

86:73:9b:77:14:c2:3e:d9:7a:4d:29:3a:61:dd:77:4a:01:37:77:c5Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

advapi32

shlwapi

Sections

.text Size: 30KB - Virtual size: 29KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 5KB - Virtual size: 4KB

b57ba77262d0341b746992651f179ad4

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98Certificate

Extended Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

38:82:d2:5f:ac:df:32:44:60:6c:b5:e9:68:ed:9f:ea
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 415KB

.ndata
Size: - Virtual size: 1.2MB

.rsrc
Size: 28KB - Virtual size: 27KB

.reloc
Size: 4KB - Virtual size: 3KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

86:73:9b:77:14:c2:3e:d9:7a:4d:29:3a:61:dd:77:4a:01:37:77:c5
Signer

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

a5:4e:5c:02:36:b8:8b:9a:9a:6a:8c:4e:1f:67:c4:72:ec:f8:f3:b0
Signer

.text
Size: 797KB - Virtual size: 797KB

.rdata
Size: 169KB - Virtual size: 169KB

.data
Size: 33KB - Virtual size: 64KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 65KB - Virtual size: 65KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

48:7a:9b:ce:27:42:ac:8f:29:1c:e8:bf:e4:aa:79:0b:bd:92:f6:e6
Signer

.text
Size: 31KB - Virtual size: 31KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate