0aab9316f970f19c9aa26bb025c2f8d0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

0aab9316f970f19c9aa26bb025c2f8d0_JaffaCakes118
Size

1.1MB
MD5

0aab9316f970f19c9aa26bb025c2f8d0
SHA1

3eb97c2c53a94b16e207e9f5e5ebb7d8f287cca5
SHA256

bb3dbcde0e1dd7c65adf9eda6e6ccca7163fb70b7fe1b43385166b4a1a4c5ef6
SHA512

c01e09828e282264f5eb556c877dc5f07bd509e31f5ba02472d0fef5f235b03d97664324732ceb83ddf070ede06708952f3f2491bf01562959624429566bb95b
SSDEEP

24576:WVAw26oJ3D8jz2/AD4cfEdbl5VgDu9miLHGHpAkI:2+J3Dhf6OzaDu9miLH+pD

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

0aab9316f970f19c9aa26bb025c2f8d0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:05:d1:ca:1e:cd:09:04:76:ae:b9:5a:ff:7e:e0:ee
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/04/2011, 00:00

Not After

21/04/2012, 23:59

Subject

CN=广东雨林木风计算机科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=广东雨林木风计算机科技有限公司,L=Dongguan,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e9:df:02:13:f5:6e:43:9f:31:d2:5b:1f:b3:69:e2:14:e4:4d:07:c0
Signer

Actual PE Digest

e9:df:02:13:f5:6e:43:9f:31:d2:5b:1f:b3:69:e2:14:e4:4d:07:c0

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 48KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

'2
Size: 97KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 836B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsProcess.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProcess
_KillProcess
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 646B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 146B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/partner.ini
115br.exe
.exe windows:5 windows x86 arch:x86

9dd3ab399fab762d8cd40ac89dd52d3c

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:05:d1:ca:1e:cd:09:04:76:ae:b9:5a:ff:7e:e0:ee
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

22/04/2011, 00:00

Not After

21/04/2012, 23:59

Subject

CN=广东雨林木风计算机科技有限公司,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=广东雨林木风计算机科技有限公司,L=Dongguan,ST=Guangdong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

84:a0:e9:36:4d:60:a8:db:f4:41:08:f1:7b:ed:e7:5d:b2:6f:64:1a
Signer

Actual PE Digest

84:a0:e9:36:4d:60:a8:db:f4:41:08:f1:7b:ed:e7:5d:b2:6f:64:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WaitForMultipleObjects
OpenThread
GetPrivateProfileIntW
GetPrivateProfileStringA
SystemTimeToFileTime
GetSystemTime
OpenFileMappingW
OutputDebugStringA
LocalFree
OutputDebugStringW
FormatMessageW
CompareStringW
FreeLibrary
LoadLibraryW
GetLocalTime
GetTickCount
FileTimeToSystemTime
DeviceIoControl
CreateFileA
LoadLibraryA
ResumeThread
FreeResource
ResetEvent
OpenEventW
CreateMutexW
IsBadReadPtr
lstrlenA
WriteProcessMemory
VirtualAllocEx
ExpandEnvironmentStringsW
ReadFile
GetProcessTimes
GetSystemTimeAsFileTime
GetSystemInfo
GetProcessIoCounters
VirtualProtect
VirtualFreeEx
GetCurrentThread
GetSystemDefaultLCID
GlobalHandle
WinExec
lstrcpynA
LoadLibraryExW
SuspendThread
GetThreadContext
SetThreadContext
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
GetExitCodeThread
QueryPerformanceCounter
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetModuleFileNameA
GetModuleHandleA
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetStdHandle
GetStartupInfoA
GetStdHandle
SetHandleCount
GetStartupInfoW
VirtualQuery
CreateThread
ExitThread
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
CreateFileMappingA
GetFileType
SetEndOfFile
GetFileInformationByHandle
GetStringTypeA
GetCPInfo
LCMapStringA
LCMapStringW
GetStringTypeW
GetLocaleInfoA
InterlockedExchangeAdd
GetModuleHandleW
GetProcAddress
ExitProcess
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
MulDiv
WritePrivateProfileSectionW
GetPrivateProfileSectionW
GetPrivateProfileStringW
SetProcessWorkingSetSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GlobalSize
CopyFileW
SetEvent
DeleteCriticalSection
TlsAlloc
TlsFree
GetLastError
HeapAlloc
GetFileSize
FindFirstFileW
GetFileAttributesW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
FindClose
GetWindowsDirectoryW
GetProcessHeap
HeapFree
GetTempPathW
TerminateThread
DeleteFileW
CreateDirectoryW
lstrcpyW
lstrcatW
CreateFileW
SetFilePointer
WriteFile
CreateProcessW
TerminateProcess
OpenProcess
DuplicateHandle
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameW
lstrcpynW
GetCurrentProcessId
WritePrivateProfileStringW
GetVersionExW
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcess
FlushInstructionCache
SetLastError
MultiByteToWideChar
RaiseException
lstrcmpiW
WideCharToMultiByte
WaitForSingleObject
CreateEventW
CloseHandle
Sleep
TlsSetValue
TlsGetValue
GetCurrentThreadId
lstrlenW
lstrcmpW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
FlushFileBuffers

user32

EnumChildWindows
WindowFromPoint
IsChild
GetActiveWindow
RemovePropW
PostQuitMessage
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
EnableWindow
EqualRect
GetPropW
OffsetRect
CopyRect
SetRectEmpty
PtInRect
IsRectEmpty
GetWindowDC
ReleaseDC
GetDC
FindWindowExW
EnableMenuItem
SendNotifyMessageW
GetSysColor
RedrawWindow
CharNextW
CreateAcceleratorTableW
InvalidateRgn
DestroyAcceleratorTable
TranslateAcceleratorW
LoadAcceleratorsW
SystemParametersInfoW
FindWindowW
SetRect
LoadStringW
IsDlgButtonChecked
TrackPopupMenuEx
SetMenuInfo
UnregisterClassA
wsprintfW
EndDialog
GetWindowTextW
GetWindowTextLengthW
SetFocus
MessageBeep
SetDlgItemTextW
GetParent
GetDlgItem
SetWindowPos
MapWindowPoints
GetClientRect
GetMonitorInfoW
MonitorFromWindow
GetWindowLongW
GetWindowRect
GetWindow
PostMessageW
GetClassNameW
CharUpperW
CallNextHookEx
PostThreadMessageW
SetWindowsHookExW
SetScrollPos
DeleteMenu
RegisterHotKey
UnregisterHotKey
GetSystemMetrics
IsZoomed
SetWindowRgn
CreateDialogParamW
RegisterClipboardFormatW
PrintWindow
LoadStringA
wvsprintfW
RemoveMenu
GetClipboardData
SetWindowContextHelpId
MapDialogRect
DialogBoxIndirectParamW
CheckMenuItem
CopyIcon
OpenClipboard
EmptyClipboard
UpdateWindow
GetCapture
GetDlgCtrlID
IsWindowEnabled
DrawTextW
DrawFocusRect
FrameRect
SetScrollInfo
IsIconic
InflateRect
GetMenuItemCount
ModifyMenuW
AppendMenuW
CreatePopupMenu
mouse_event
DrawStateW
LockWindowUpdate
SetCursor
ReleaseCapture
SetCapture
FillRect
UpdateLayeredWindow
IsWindow
SendMessageTimeoutW
DestroyWindow
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
UnhookWindowsHookEx
AttachThreadInput
GetWindowThreadProcessId
SetClipboardData
CloseClipboard
GetMessageExtraInfo
SetForegroundWindow
SetPropW
BringWindowToTop
GetForegroundWindow
RegisterWindowMessageW
ShowWindow
LoadIconW
GetFocus
MoveWindow
GetDlgItemTextW
LoadImageW
ScreenToClient
InsertMenuW
MessageBoxW
SendMessageW
DialogBoxParamW
SetWindowLongW
CreateWindowExW
GetClassInfoExW
LoadCursorW
RegisterClassExW
DrawIconEx
GetCursorPos
GetKeyState
GetSubMenu
DefWindowProcW
LoadMenuW
InvalidateRect
IsWindowVisible
SetTimer
KillTimer
DestroyMenu
CallWindowProcW
BeginPaint
EndPaint
TrackPopupMenu
MonitorFromPoint
DestroyIcon
SetLayeredWindowAttributes
GetDesktopWindow
SetWindowTextW
ClientToScreen
GetMenuItemID
IsMenu
ShowScrollBar
ScrollWindow

gdi32

EnumFontsW
SelectPalette
RealizePalette
SetStretchBltMode
CreateDCW
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
Rectangle
CreatePen
GetTextExtentPoint32W
DPtoLP
LineTo
MoveToEx
CreateFontIndirectW
GetObjectW
GetDeviceCaps
CreateSolidBrush
SetBkColor
ExtTextOutW
CreateDIBSection
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
DeleteDC
BitBlt
CreatePatternBrush
SetTextColor
SetBkMode
GetStockObject
CreateFontW
StretchBlt
DeleteObject

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

GetLengthSid
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetTokenInformation
CopySid
GetUserNameW
RegCloseKey
RegGetKeySecurity
RegOpenKeyExW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegOpenKeyW
RegSetValueExW
RegCreateKeyExW
RegSetKeySecurity
RegQueryInfoKeyW
RegEnumKeyW
AllocateAndInitializeSid
InitializeAcl
AddAce
GetSidIdentifierAuthority

shell32

DragQueryFileW
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
ord155
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderLocation
SHGetFileInfoW
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetMalloc
Shell_NotifyIconW
SHFileOperationW
SHCreateDirectoryExW

ole32

CoCreateInstance
CreateStreamOnHGlobal
CoTaskMemRealloc
PropVariantClear
StringFromCLSID
CoTaskMemFree
ReleaseStgMedium
CoGetMalloc
DoDragDrop
OleRun
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleInitialize
OleUninitialize
CoGetInterfaceAndReleaseStream
CoUnmarshalInterface
CoGetMarshalSizeMax
CoMarshalInterface
CoMarshalInterThreadInterfaceInStream
CoInitialize
CoUninitialize

oleaut32

GetErrorInfo
SysStringLen
SysFreeString
SysAllocStringLen
VarUI4FromStr
VariantCopy
VariantChangeType
VarBstrCat
DispCallFunc
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantInit
VarBstrCmp
SysAllocString

shlwapi

SHGetValueW
PathFindFileNameA
PathFileExistsW
SHDeleteKeyW
PathFindFileNameW
SHSetValueW
SHDeleteValueW
StrRetToStrW
PathRemoveFileSpecW
PathFindExtensionW
PathIsDirectoryW
PathUnquoteSpacesW
PathRemoveArgsW
StrStrIW
SHStrDupW
PathMatchSpecW

comctl32

ImageList_AddMasked
_TrackMouseEvent
InitCommonControlsEx
ImageList_Draw
ImageList_GetImageInfo
CreateStatusWindowW
ImageList_Create
ImageList_GetIcon
ImageList_Destroy
ImageList_ReplaceIcon

urlmon

UrlMkSetSessionOption
ObtainUserAgentString

psapi

GetModuleInformation
GetProcessMemoryInfo

gdiplus

GdipImageRotateFlip
GdipGraphicsClear
GdipDrawLinesI
GdipSetSmoothingMode
GdipSetPenMode
GdipSetPenStartCap
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipLoadImageFromStreamICM
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipGetImagePixelFormat
GdipSetInterpolationMode
GdipGetImageGraphicsContext
GdipSetStringFormatHotkeyPrefix
GdipSetStringFormatFlags
GdipDrawLineI
GdipSetPageUnit
GdipSaveImageToStream
GdipSaveImageToFile
GdipDeletePen
GdipCreatePen1
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipDrawString
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipCreateBitmapFromHICON
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipDeleteFont
GdipDeleteFontFamily
GdipGetGenericFontFamilySansSerif
GdipCreateFontFamilyFromName
GdipCreateFont
GdipMeasureString
GdipReleaseDC
GdipGetDC
GdipCreateFromHDC
GdipAlloc
GdipFree
GdipCreateHBITMAPFromBitmap
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDrawImageRectI
GdipDeleteGraphics
GdipCreateFromHDC2
GdipSetTextRenderingHint

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpOpenRequestA
InternetOpenA
HttpAddRequestHeadersA
InternetSetStatusCallbackA
InternetSetCookieExW
InternetSetCookieW
InternetSetCookieExA
InternetSetCookieA
InternetSetOptionW
InternetQueryOptionA
HttpSendRequestA
InternetSetStatusCallbackW
HttpAddRequestHeadersW
GetUrlCacheEntryInfoW
InternetOpenUrlW
HttpQueryInfoA
InternetReadFile
InternetOpenW
HttpOpenRequestW
InternetGetCookieExA
HttpQueryInfoW
FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetCrackUrlW
InternetTimeToSystemTimeA
InternetCloseHandle
HttpSendRequestW
InternetConnectW

setupapi

SetupIterateCabinetW

netapi32

Netbios

dsound

ord1

winmm

waveOutWrite

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 315KB - Virtual size: 314KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

STLPORT_
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IcoCache/116.com_favicon.ico
IcoCache/search8.taobao.com_favicon.ico
IcoCache/www.baidu.com_favicon.ico
IcoCache/www.google.com.hk_favicon.ico
Recent.ini
ThumbnailCache/u.115.com.jpeg
.jpg
ThumbnailCache/www.114la.com.jpeg
.jpg
ThumbnailCache/www.915.com.jpeg
.jpg
ThumbnailCache/www.xiazaiba.com.jpeg
.jpg
cfg.ini
html/404error.html
.html .js polyglot
html/config.html
.js
html/error.html
.html .js polyglot
html/last.html
.html .js polyglot
html/start.html
.html .js polyglot
html/static/css/config.css
html/static/css/last.css
html/static/css/reset.css
html/static/css/start.css
html/static/images/115.gif
.gif
html/static/images/194x136.jpg
.jpg
html/static/images/baidu.gif
.gif
html/static/images/c_btn.png
.png
html/static/images/c_left.png
.png
html/static/images/c_left_bg.png
.png
html/static/images/c_line.png
.png
html/static/images/c_plug.png
.png
html/static/images/c_top.png
.png
html/static/images/google.gif
.gif
html/static/images/mouse/MouseGesture_0.png
.png
html/static/images/mouse/MouseGesture_1.png
.png
html/static/images/mouse/MouseGesture_10.png
.png
html/static/images/mouse/MouseGesture_11.png
.png
html/static/images/mouse/MouseGesture_12.png
.png
html/static/images/mouse/MouseGesture_13.png
.png
html/static/images/mouse/MouseGesture_14.png
.png
html/static/images/mouse/MouseGesture_15.png
.png
html/static/images/mouse/MouseGesture_16.png
.png
html/static/images/mouse/MouseGesture_17.png
.png
html/static/images/mouse/MouseGesture_18.png
.png
html/static/images/mouse/MouseGesture_19.png
.png
html/static/images/mouse/MouseGesture_2.png
.png
html/static/images/mouse/MouseGesture_3.png
.png
html/static/images/mouse/MouseGesture_4.png
.png
html/static/images/mouse/MouseGesture_5.png
.png
html/static/images/mouse/MouseGesture_6.png
.png
html/static/images/mouse/MouseGesture_7.png
.png
html/static/images/mouse/MouseGesture_8.png
.png
html/static/images/mouse/MouseGesture_9.png
.png
html/static/images/mp3.gif
.gif
html/static/images/pic.gif
.gif
html/static/images/s_add.png
.png
html/static/images/s_bg.png
.png
html/static/images/s_btn.png
.png
html/static/images/s_con.png
.png
html/static/images/s_form.png
.png
html/static/images/s_ico.png
.png
html/static/images/s_ico_bg.png
.png
html/static/images/s_last.png
.png
html/static/images/s_load.gif
.gif
html/static/images/s_test_204_127.png
.png
html/static/images/s_top.png
.png
html/static/images/taobao.gif
.gif
html/static/images/video.gif
.gif
html/static/images/zhidao.gif
.gif
html/static/js/suggest.js
.js
setting.ini
skin/default/Stretch_dlg_close.png
.png
skin/default/Stretch_dlg_max.png
.png
skin/default/Stretch_dlg_min.png
.png
skin/default/Stretch_dlg_res.png
.png
skin/default/add.png
.png
skin/default/addr_go.png
.png
skin/default/addr_goframe.png
.png
skin/default/addr_history.png
.png
skin/default/addr_hover_left.png
.png
skin/default/addr_hover_mid.png
.png
skin/default/addr_hover_right.png
.png
skin/default/addr_left.png
.png
skin/default/addr_normal_left.png
.png
skin/default/addr_normal_mid.png
.png
skin/default/addr_normal_right.png
.png
skin/default/addr_progress.png
.png
skin/default/addr_right.png
.png
skin/default/addr_safe.png
.png
skin/default/addr_stop.png
.png
skin/default/ani_download.gif
.gif
skin/default/ani_webfav.gif
.gif
skin/default/arrow_down.png
.png
skin/default/arrow_up.png
.png
skin/default/bg.png
.png
skin/default/bg_nofav.png
.png
skin/default/bitmap_fav.bmp
skin/default/bitmap_nodes.bmp
skin/default/bitmap_page.bmp
skin/default/bottom_left.PNG
.png
skin/default/bottom_middle.PNG
.png
skin/default/bottom_right.PNG
.png
skin/default/button.png
.png
skin/default/button_bg.png
.png
skin/default/button_close.png
.png
skin/default/button_maxi.png
.png
skin/default/button_menu_bg.png
.png
skin/default/button_mini.png
.png
skin/default/button_restore.png
.png
skin/default/button_sug.png
.png
skin/default/change_skin.png
.png
skin/default/chevron.png
.png
skin/default/close-tab.png
.png
skin/default/common_dlg_close.png
.png
skin/default/common_dlg_lostfoucs.png
.png
skin/default/common_dlg_setfoucs.png
.png
skin/default/date.png
.png
skin/default/del.png
.png
skin/default/dlg_button_bg.png
.png
skin/default/download_close.png
.png
skin/default/edit.png
.png
skin/default/edit_left.png
.png
skin/default/edit_right.png
.png
skin/default/filtrate.png
.png
skin/default/fold_menu.png
.png
skin/default/frame_left.png
.png
skin/default/frame_right.PNG
.png
skin/default/frame_under.png
.png
skin/default/frame_up.png
.png
skin/default/loading.png
.png
skin/default/move_tab.png
.png
skin/default/no_trace.png
.png
skin/default/page.png
.png
skin/default/pluginbar_bg.png
.png
skin/default/progress_bg.png
.png
skin/default/progress_fw.png
.png
skin/default/scrollbar_bg.png
.png
skin/default/scrollbar_thumb.png
.png
skin/default/search.png
.png
skin/default/search_botton.png
.png
skin/default/search_choose.png
.png
skin/default/side_band_top_bg.png
.png
skin/default/side_favorite.png
.png
skin/default/side_grip.png
.png
skin/default/side_history.png
.png
skin/default/side_leftband.png
.png
skin/default/side_top_bg.png
.png
skin/default/side_top_close.png
.png
skin/default/side_top_fixed.png
.png
skin/default/side_top_moved.png
.png
skin/default/site.png
.png
skin/default/skin-icon2.png
.png
skin/default/skin.ini
skin/default/status_bg.png
.png
skin/default/status_curpage.png
.png
skin/default/status_download.png
.png
skin/default/status_loading.png
.png
skin/default/status_netuser.png
.png
skin/default/status_newpage.png
.png
skin/default/status_nonetuser.png
.png
skin/default/status_nosound.png
.png
skin/default/status_ok.png
.png
skin/default/status_sound.png
.png
skin/default/tab_add.png
.png
skin/default/tab_all.png
.png
skin/default/tab_background.png
.png
skin/default/tab_background_nofav.png
.png
skin/default/tab_item.png
.png
skin/default/tab_left.png
.png
skin/default/tab_right.png
.png
skin/default/tab_sidebarbutton.png
.png
skin/default/title_left.PNG
.png
skin/default/title_middle.png
.png
skin/default/title_right.PNG
.png
skin/default/tool_back.PNG
.png
skin/default/tool_browsermode.png
.png
skin/default/tool_forward.PNG
.png
skin/default/tool_home.PNG
.png
skin/default/tool_refresh.png
.png
skin/default/tool_restore.png
.png
skin/default/tool_showmenu.png
.png
skin/default/total_menu.png
.png
skin/default/unfold_menu.png
.png
skin/default/webzoom.png
.png
skin/default/.png
.png
skin/default/.png
.png
skin/default/.png
.png
skin/default/.png
.png
uninst.exe.nsis

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78Certificate

Key Usages

79:05:d1:ca:1e:cd:09:04:76:ae:b9:5a:ff:7e:e0:eeCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e9:df:02:13:f5:6e:43:9f:31:d2:5b:1f:b3:69:e2:14:e4:4d:07:c0Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 48KB

.rsrc Size: 18KB - Virtual size: 18KB

'2 Size: 97KB - Virtual size: 100KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ws2_32

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: 1KB - Virtual size: 25KB

.reloc Size: 1024B - Virtual size: 836B

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

79:05:d1:ca:1e:cd:09:04:76:ae:b9:5a:ff:7e:e0:ee
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e9:df:02:13:f5:6e:43:9f:31:d2:5b:1f:b3:69:e2:14:e4:4d:07:c0
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 48KB

.rsrc
Size: 18KB - Virtual size: 18KB

'2
Size: 97KB - Virtual size: 100KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 1KB - Virtual size: 25KB

.reloc
Size: 1024B - Virtual size: 836B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 646B

.data
Size: - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 146B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Certificate

79:05:d1:ca:1e:cd:09:04:76:ae:b9:5a:ff:7e:e0:ee
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

84:a0:e9:36:4d:60:a8:db:f4:41:08:f1:7b:ed:e7:5d:b2:6f:64:1a
Signer

.text
Size: 1.5MB - Virtual size: 1.5MB

.rdata
Size: 315KB - Virtual size: 314KB

.data
Size: 33KB - Virtual size: 48KB

STLPORT_
Size: 512B - Virtual size: 32B

.rsrc
Size: 102KB - Virtual size: 102KB