37f52a115abf789d53a2c92bf8644e45_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

37f52a115abf789d53a2c92bf8644e45_JaffaCakes118
Size

1.8MB
MD5

37f52a115abf789d53a2c92bf8644e45
SHA1

59185aad8b8eeec6b049558ec656360af724c4b3
SHA256

2074d0d7ea276cccb316d9fe5fdbb94f07899f9780fa1a493af42723103ba9b6
SHA512

3732a7add36626ac57b2f1f02aacae14add77f8e14a08a26e1bef29b9aa212d6e9a15048ef59a903a503533b2821f54360fb25940332c21ea075d1ffd2c922da
SSDEEP

49152:QFjnB69dkL6lw3C0Tzs154SuMoNgoISRfQ+/H:Qdj+5bMSuMoJzlH

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
37f52a115abf789d53a2c92bf8644e45_JaffaCakes118
unpack001/$PLUGINSDIR/ExecCmd.dll
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$SYSDIR/$SYSDIR/Funshion.scr
unpack001/$TEMP/$SYSDIR/Funshion.scr
unpack001/InnerWeb.exe
unpack001/funshionplugin2.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

37f52a115abf789d53a2c92bf8644e45_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 320KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ExecCmd.dll
.dll windows:4 windows x86 arch:x86

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
OpenProcess
CloseHandle
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
Sleep
CreateProcessA
GlobalAlloc
GetExitCodeThread
lstrcpyA
lstrcpynA
CreateThread
lstrcatA
GetEnvironmentVariableA
lstrcmpiA

user32

SendMessageA
EnumWindows
WaitForInputIdle
wsprintfA
GetWindowThreadProcessId

Exports

Exports

exec
wait

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstPath.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/WelcomePage.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/$SYSDIR/Funshion.scr
.exe windows:4 windows x86 arch:x86

4bc47b1b60a84bd791e872571ef947cb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\Fun Player\Rel2.6.4\src\plugin\FunScr\FunScr\Release\FunScr.pdb

Imports

wininet

InternetGetConnectedState
InternetOpenA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA
InternetSetOptionA
HttpQueryInfoW
InternetCloseHandle

kernel32

GlobalAlloc
DeleteFileW
GetCurrentThreadId
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GlobalUnlock
GlobalLock
SetLastError
GlobalFree
GlobalHandle
lstrcmpW
MulDiv
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
FreeResource
CloseHandle
WriteFile
CreateFileW
WaitForSingleObject
GetPrivateProfileStringW
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
GetCurrentProcess
WideCharToMultiByte
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetCPInfo
SetConsoleCtrlHandler
EnterCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
Sleep
ExitProcess
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
FlushInstructionCache
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
LeaveCriticalSection
RaiseException
CreateFileA
FlushFileBuffers
CompareStringA
InterlockedExchange
CompareStringW
SetEnvironmentVariableA
GetACP
GetLocaleInfoA
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetSystemTimeAsFileTime

user32

DefWindowProcW
UnregisterClassA
SetWindowTextW
GetWindowTextW
CharNextW
DestroyWindow
RegisterClassExW
SetWindowLongW
GetWindowLongW
ShowWindow
DispatchMessageW
TranslateMessage
PeekMessageW
GetWindowTextLengthW
ReleaseCapture
GetSystemMetrics
LoadImageW
GetCursorPos
CreateAcceleratorTableW
PostQuitMessage
GetWindowRect
SystemParametersInfoW
MapWindowPoints
IsDialogMessageW
SetWindowContextHelpId
PostMessageW
CreateWindowExW
MapDialogRect
IsWindow
SendMessageW
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
LoadCursorW
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
MoveWindow
GetSysColor
CreateDialogIndirectParamW
RegisterWindowMessageW
GetClassInfoExW
GetMessageW

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

advapi32

RegOpenKeyExW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
DispCallFunc
LoadTypeLi
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 248KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/$SYSDIR/Funshion.scr
.exe windows:4 windows x86 arch:x86

4bc47b1b60a84bd791e872571ef947cb

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\workspace\Fun Player\Rel2.6.4\src\plugin\FunScr\FunScr\Release\FunScr.pdb

Imports

wininet

InternetGetConnectedState
InternetOpenA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA
InternetSetOptionA
HttpQueryInfoW
InternetCloseHandle

kernel32

GlobalAlloc
DeleteFileW
GetCurrentThreadId
lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GlobalUnlock
GlobalLock
SetLastError
GlobalFree
GlobalHandle
lstrcmpW
MulDiv
GetModuleFileNameW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
FreeResource
CloseHandle
WriteFile
CreateFileW
WaitForSingleObject
GetPrivateProfileStringW
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetConsoleMode
GetConsoleCP
GetCurrentProcess
WideCharToMultiByte
GetLocaleInfoW
IsValidCodePage
GetOEMCP
GetCPInfo
SetConsoleCtrlHandler
EnterCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
Sleep
ExitProcess
GetCurrentThread
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
FatalAppExitA
HeapCreate
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
CreateThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
FlushInstructionCache
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
SetFilePointer
LeaveCriticalSection
RaiseException
CreateFileA
FlushFileBuffers
CompareStringA
InterlockedExchange
CompareStringW
SetEnvironmentVariableA
GetACP
GetLocaleInfoA
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetProcAddress
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetSystemTimeAsFileTime

user32

DefWindowProcW
UnregisterClassA
SetWindowTextW
GetWindowTextW
CharNextW
DestroyWindow
RegisterClassExW
SetWindowLongW
GetWindowLongW
ShowWindow
DispatchMessageW
TranslateMessage
PeekMessageW
GetWindowTextLengthW
ReleaseCapture
GetSystemMetrics
LoadImageW
GetCursorPos
CreateAcceleratorTableW
PostQuitMessage
GetWindowRect
SystemParametersInfoW
MapWindowPoints
IsDialogMessageW
SetWindowContextHelpId
PostMessageW
CreateWindowExW
MapDialogRect
IsWindow
SendMessageW
GetFocus
GetWindow
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
LoadCursorW
GetClassNameW
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
MoveWindow
GetSysColor
CreateDialogIndirectParamW
RegisterWindowMessageW
GetClassInfoExW
GetMessageW

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
GetStockObject

advapi32

RegOpenKeyExW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoUninitialize
CoInitialize

oleaut32

CreateErrorInfo
SetErrorInfo
GetErrorInfo
VariantChangeType
DispCallFunc
LoadTypeLi
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysStringByteLen
VariantInit
VariantClear
OleCreateFontIndirect
LoadRegTypeLi

shlwapi

PathFileExistsW

comctl32

InitCommonControlsEx

Sections

.text
Size: 212KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 248KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMP/dump.dll
.dll windows:5 windows x86 arch:x86

9764535f474bf35664a25871bd87e292

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2012, 00:00

Not After

02/08/2014, 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:85:88:94:ca:40:ef:b2:b8:94:11:46:30:56:73:95:d4:03:d4:6f
Signer

Actual PE Digest

13:85:88:94:ca:40:ef:b2:b8:94:11:46:30:56:73:95:d4:03:d4:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\dump.pdb

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetTickCount
TerminateThread
Sleep
GetPrivateProfileIntW
GetLastError
ResetEvent
GetPrivateProfileSectionW
CreateEventW
OutputDebugStringW
GetPrivateProfileStringW
WritePrivateProfileStringW
lstrcpyW
GetModuleFileNameW
CreateFileW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
FindResourceExW
FindResourceW
LoadResource
WriteFile
SizeofResource
LockResource
DeleteFileW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetSystemTimeAsFileTime
GetFileAttributesW
ExitThread
CreateThread
GetCommandLineA
GetLocalTime
GetCPInfo
RaiseException
GetFileAttributesExW
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapSize
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapReAlloc
LoadLibraryW
SetStdHandle
CreateFileA
WriteConsoleW
SetEndOfFile
GetProcessHeap
OpenEventA
SetEvent
WaitForSingleObject
RtlUnwind
CreateEventA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteW

urlmon

UrlMkGetSessionOption

shlwapi

PathRemoveFileSpecW
PathFileExistsW

wininet

InternetCloseHandle
InternetOpenA
InternetGetConnectedState
HttpQueryInfoW
InternetSetOptionA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA

Exports

Exports

?dump_info@dump@@YAHABV?$basic_format@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@boost@@@Z
?dump_info@dump@@YAHJABV?$basic_format@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@boost@@@Z
destroy_config_center
disable_output_log_to_file
dump
dump_initialize
dump_log
enable_output_log_to_file
erase_log_record
get_records_duration_by_ms
if_dump
init_config_center
log_output
lvalue
lvalue_of
output_overhead_duration
record_begin_time
record_log_interface
remove_log
set_live_log
svalue
svalue_of
ulvalue_of
upload_live_log
upload_log

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/gma.dll
.dll windows:5 windows x86 arch:x86

8596d45da9d4f8d0913c58f9221801ef

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2012, 00:00

Not After

02/08/2014, 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:46:9c:32:6c:55:eb:37:fc:ec:26:5e:ba:07:f3:fd:75:fc:66:71
Signer

Actual PE Digest

2d:46:9c:32:6c:55:eb:37:fc:ec:26:5e:ba:07:f3:fd:75:fc:66:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\gma.pdb

Imports

iphlpapi

GetIpAddrTable
GetBestInterface
GetBestRoute
SendARP

ws2_32

gethostname
getservbyname
getservbyport
htons
WSAGetLastError
htonl
ntohs
inet_ntoa
WSASetLastError
gethostbyaddr
gethostbyname
inet_addr

advapi32

RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW

wininet

HttpQueryInfoW
InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA
InternetGetConnectedState

kernel32

SystemTimeToFileTime
WaitForMultipleObjects
ResumeThread
ResetEvent
OpenEventA
GetSystemInfo
FlushFileBuffers
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
InterlockedDecrement
GetPrivateProfileStringW
WritePrivateProfileStringW
GetLastError
ExpandEnvironmentStringsW
CreateEventA
WaitForSingleObject
SetEvent
GetModuleFileNameW
CreateFileW
DeviceIoControl
GetCurrentThreadId
CloseHandle
GetSystemTime
GetTickCount
GetVersionExW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
LocalFree
lstrlenW
FreeLibrary
CreateProcessW
GetSystemDirectoryW
GetSystemDirectoryA
GetCurrentDirectoryW
GetProcAddress
LoadLibraryA
lstrcmpiW
SetWaitableTimer
FindResourceW
LoadResource
WriteFile
SizeofResource
LockResource
DeleteFileW
GetModuleFileNameA
GetConsoleCP
SetFilePointer
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
ExitProcess
HeapCreate
GetLocaleInfoW
GetStdHandle
GetCurrentThread
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
CreateWaitableTimerA
GetACP
IsProcessorFeaturePresent
LCMapStringW
GetCPInfo
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocalTime
GetFileAttributesW
CreateThread
FindResourceExW
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineA
RtlUnwind
ExitThread

shell32

SHGetSpecialFolderPathW
ord51
SHGetFolderPathW
SHGetSpecialFolderPathA
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance

oleaut32

VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysFreeString

urlmon

UrlMkGetSessionOption

shlwapi

PathFileExistsW
PathIsRelativeW
PathRemoveFileSpecA
PathAppendW
PathRemoveBackslashW
PathRemoveFileSpecW

Exports

Exports

GetCurrUsedIPUL
GetCurrUsedIPUL2
GetMACAddress
GetMACAddress2
getGatewayIP
get_and_update_mac
get_mac_info
get_nic_description
get_time_cost_mac
get_time_cost_mac_main

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/instpath.ini
$TEMP/nicdescr.dat
$TEMP/partner.ini
$TEMP/welcomepage.ini
Funshion.exe
.exe windows:5 windows x86 arch:x86

d678953629114a9b521804e030d8da94

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2012, 00:00

Not After

02/08/2014, 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b9:a6:0f:75:4e:81:83:3e:6f:e6:38:eb:fc:2c:79:01:26:09:14:d1
Signer

Actual PE Digest

b9:a6:0f:75:4e:81:83:3e:6f:e6:38:eb:fc:2c:79:01:26:09:14:d1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\Funshion.pdb

Imports

dbghelp

MiniDumpWriteDump
MakeSureDirectoryPathExists

shlwapi

PathRemoveArgsW
StrCatW
PathRemoveExtensionW
PathAddExtensionW
PathRenameExtensionW
PathAppendW
PathRemoveFileSpecW
PathRemoveFileSpecA
PathFileExistsA
PathFileExistsW
PathRemoveBackslashW
PathIsRelativeW

ws2_32

getservbyname
getservbyport
htons
WSAGetLastError
htonl
ntohl
gethostbyaddr
WSASetLastError
inet_addr
WSACleanup
WSAStartup
ntohs
gethostname
gethostbyname
inet_ntoa

wininet

HttpSendRequestExW
HttpEndRequestW
HttpAddRequestHeadersA
HttpOpenRequestA
InternetReadFile
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestW
InternetQueryDataAvailable
InternetGetConnectedState
InternetConnectA
InternetSetOptionW
InternetQueryOptionW
InternetOpenA
InternetCloseHandle
InternetSetCookieW
InternetGetCookieExW
InternetGetCookieW
DeleteUrlCacheEntryA
FindNextUrlCacheEntryA
FindCloseUrlCache
FindFirstUrlCacheEntryA
HttpOpenRequestW
InternetSetOptionA
InternetOpenUrlW

iphlpapi

GetAdaptersInfo
GetBestInterface
GetIfEntry

winmm

timeGetTime
waveOutGetVolume
waveOutSetVolume
mixerGetLineInfoW
mixerGetLineControlsW
mixerGetControlDetailsW
mixerOpen
mixerClose

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

kernel32

lstrcmpW
GlobalHandle
GlobalFree
MultiByteToWideChar
lstrlenA
FindFirstFileW
FindNextFileW
SetFileAttributesW
RemoveDirectoryW
DeleteFileW
FindClose
GetFileAttributesW
WideCharToMultiByte
InitializeCriticalSection
GetTickCount
LocalFree
GetCurrentDirectoryW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetPrivateProfileStringW
GetPrivateProfileStringA
CreateFileA
DeviceIoControl
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
InterlockedExchange
lstrcpyW
lstrcatW
Sleep
WaitForSingleObject
TerminateThread
lstrcpynW
GetVersionExW
CompareStringW
GetSystemDirectoryW
GetDriveTypeW
CreateDirectoryW
GetFileAttributesExW
GetDiskFreeSpaceExW
GetProcAddress
GetModuleHandleW
LoadLibraryW
FreeLibrary
OpenProcess
GetExitCodeProcess
GetLocalTime
CopyFileW
GetExitCodeThread
CreateFileW
GetFileSize
ReadFile
GetModuleFileNameA
GetWindowsDirectoryW
SetFilePointer
WriteFile
lstrcmpiW
LoadLibraryExW
MoveFileExW
FlushInstructionCache
CreateDirectoryA
FindNextFileA
CopyFileA
MoveFileA
CreateEventW
lstrcpynA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetThreadPriority
DeleteFileA
ExitProcess
GetSystemInfo
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
TerminateProcess
GetTempPathA
GetTempFileNameA
IsWow64Process
GlobalMemoryStatusEx
GlobalMemoryStatus
FreeResource
LockFile
UnlockFile
MulDiv
SetThreadExecutionState
GetLogicalDriveStringsW
CompareFileTime
OutputDebugStringW
QueryPerformanceFrequency
QueryPerformanceCounter
CreatePipe
CreateProcessW
GetThreadLocale
SetThreadLocale
SetEvent
CreateThread
GetSystemDirectoryA
LoadLibraryA
ExpandEnvironmentStringsW
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetCurrentProcessId
HeapValidate
DebugBreak
CreateEventA
HeapDestroy
HeapCreate
ResetEvent
CreateMutexW
MapViewOfFile
UnmapViewOfFile
GetSystemTimeAsFileTime
CreateFileMappingW
ReleaseMutex
GlobalAlloc
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
GetCurrentProcess
SetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrlenW
GetModuleFileNameW
GetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
EnterCriticalSection
RaiseException
LeaveCriticalSection
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
VirtualQuery
GetTimeFormatW
GetDateFormatW
GetFileAttributesA
RtlUnwind
GetCommandLineW
HeapSetInformation
GetStartupInfoW
FindFirstFileExW
UnhandledExceptionFilter
IsDebuggerPresent
LCMapStringW
GetCPInfo
HeapReAlloc
HeapSize
GetStringTypeW
EncodePointer
DecodePointer
TlsAlloc
TlsFree
TlsGetValue
OpenEventA
TlsSetValue
ResumeThread
SystemTimeToFileTime
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerA
ExitThread
GlobalLock
GetFullPathNameW
VirtualProtect
MoveFileW
GlobalUnlock
GetStdHandle
GetLocaleInfoW
GetCurrentThread
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
FatalAppExitA
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetTimeZoneInformation
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileInformationByHandle
PeekNamedPipe
SetCurrentDirectoryW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetConsoleCtrlHandler
GetFullPathNameA
WriteConsoleW
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
FindFirstFileA

user32

MessageBoxW
EqualRect
UpdateWindow
SendMessageA
EnumChildWindows
SetRect
IsWindowEnabled
SetLayeredWindowAttributes
MessageBeep
EnumDisplayMonitors
MonitorFromRect
GetDlgItemInt
SetDlgItemInt
WindowFromPoint
DrawFocusRect
DestroyCursor
GetMenuItemID
ExitWindowsEx
LoadBitmapW
ScrollWindow
DestroyIcon
GetWindowDC
GetScrollPos
GetScrollRange
PostThreadMessageW
SetParent
IsRectEmpty
CheckMenuRadioItem
GetMenuStringW
GetMenuState
CheckMenuItem
LoadMenuW
TrackPopupMenu
DeleteMenu
InsertMenuW
GetSubMenu
EnableMenuItem
IntersectRect
DrawIcon
LoadIconW
GetMenuItemInfoW
PostQuitMessage
LoadStringA
LoadStringW
EndMenu
GetWindowPlacement
GetDoubleClickTime
CreateDialogParamW
FrameRect
SetDlgItemTextW
LoadImageW
MessageBoxA
ShowCursor
wsprintfW
GetSysColorBrush
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
AttachThreadInput
IsZoomed
GetWindowThreadProcessId
SetCursor
DdeNameService
DdeConnect
DdeCreateStringHandleW
DdeInitializeW
DdeDisconnect
DdeGetData
SetScrollPos
SetRectEmpty
EnableWindow
DestroyMenu
RemoveMenu
ModifyMenuW
GetMenuItemCount
AppendMenuW
SetMenuInfo
TrackPopupMenuEx
CreatePopupMenu
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
SystemParametersInfoW
SetWindowRgn
SetForegroundWindow
IsIconic
GetForegroundWindow
UnhookWindowsHookEx
SetWindowsHookExW
CallNextHookEx
IsDialogMessageW
GetActiveWindow
FindWindowW
GetSystemMetrics
BringWindowToTop
GetKeyState
GetCursorPos
CopyRect
GetCapture
InflateRect
DialogBoxParamW
OffsetRect
SetScrollInfo
GetScrollInfo
DrawTextW
MonitorFromWindow
GetMonitorInfoW
GetWindowRect
MapWindowPoints
SendDlgItemMessageW
MapDialogRect
SetWindowContextHelpId
CreateDialogIndirectParamW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetFocus
SetFocus
GetWindow
GetDlgItem
GetClassNameW
GetSysColor
CharNextW
SetWindowPos
RedrawWindow
GetClassInfoExW
CreateWindowExW
DestroyWindow
CreateAcceleratorTableW
ClientToScreen
SetCapture
ReleaseCapture
FillRect
InvalidateRgn
CallWindowProcW
GetDesktopWindow
DestroyAcceleratorTable
GetWindowLongW
SetWindowLongW
LoadCursorW
RegisterClassExW
ReleaseDC
GetDC
InvalidateRect
SetTimer
GetDlgCtrlID
PtInRect
IsWindowVisible
PostMessageW
KillTimer
EndPaint
BeginPaint
IsChild
DefWindowProcW
GetClientRect
MoveWindow
ScreenToClient
IsWindow
ShowWindow
SendMessageW
GetParent
UnregisterClassA
EndDialog

gdi32

Rectangle
SetBkMode
SetTextColor
SetBkColor
ExcludeClipRect
CreateBitmap
GetTextMetricsW
SetStretchBltMode
GetPixel
PtInRegion
DPtoLP
OffsetRgn
GetCurrentObject
SetPixel
Arc
SetTextAlign
SetBrushOrgEx
GetDIBColorTable
StretchBlt
RestoreDC
SaveDC
CreateDIBSection
SetDIBColorTable
CreateFontIndirectW
CreatePatternBrush
CombineRgn
CreateRoundRectRgn
CreateRectRgn
RoundRect
LineTo
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetStockObject
GetObjectW
GetDeviceCaps
SelectObject
CreatePen
CreateSolidBrush
DeleteObject
MoveToEx
GetTextExtentPoint32W
TextOutW
ExtTextOutW
DeleteDC

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

RegEnumKeyW
RegSetValueExA
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueW
RegCreateKeyExA
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyW
RegOpenKeyExW
RegQueryValueExW

shell32

SHBrowseForFolderW
ord51
SHGetFolderPathW
SHGetSpecialFolderPathA
SHCreateDirectoryExW
ShellExecuteExW
SHAppBarMessage
DragQueryFileW
Shell_NotifyIconW
SHChangeNotify
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteW
SHGetSpecialFolderPathW
ord165

ole32

OleUninitialize
CoTaskMemAlloc
StringFromGUID2
OleLockRunning
CreateStreamOnHGlobal
CoCreateInstance
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
OleInitialize
OleRun
CoInitialize
CoUninitialize
CoTaskMemRealloc
CoCreateGuid
StgOpenStorageEx
CoTaskMemFree

oleaut32

GetErrorInfo
VariantChangeType
SetErrorInfo
DispCallFunc
OleLoadPicture
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
CreateErrorInfo
SysAllocStringLen
VariantInit
SysFreeString
SysAllocString
OleCreateFontIndirect
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantClear

comctl32

_TrackMouseEvent
ImageList_Create
ImageList_AddMasked
ImageList_GetImageInfo
ImageList_Draw
ImageList_Add
InitCommonControlsEx
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Destroy

msimg32

TransparentBlt
GradientFill
AlphaBlend

urlmon

URLDownloadToFileA
CoInternetSetFeatureEnabled
UrlMkGetSessionOption

gdiplus

GdipCloneBrush
GdipDisposeImage
GdipFillRectangleI
GdipDeleteBrush
GdipCreateTextureIAI
GdipDrawImageRectRectI
GdipBitmapGetPixel
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDrawImageRectRect
GdipDrawImageI
GdipTranslateWorldTransform
GdipCreateFromHDC
GdiplusStartup
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCreateSolidFill
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdiplusShutdown
GdipDrawImagePointRectI
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipRotateWorldTransform
GdipGetImageHeight
GdipGetImageWidth
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCreateBitmapFromScan0
GdipCloneImage
GdipAlloc
GdipFree
GdipSetSolidFillColor

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 55KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
InnerWeb.exe
.exe windows:5 windows x86 arch:x86

8fbd83c2608d90f0e3b14fb54b2b847d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\InnerWeb.pdb

Imports

kernel32

GetCurrentProcess
lstrlenW
GetModuleFileNameW
lstrcmpW
MulDiv
InterlockedIncrement
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
GlobalFree
GlobalHandle
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
FreeLibrary
SizeofResource
LoadLibraryExW
lstrcmpiW
GetProcAddress
FindResourceExW
FlushFileBuffers
CreateFileW
ReadFile
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
LoadLibraryW
InterlockedExchange
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
GetStringTypeW
WideCharToMultiByte
FlushInstructionCache
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
HeapCreate
GetLocaleInfoW
GetStdHandle
WriteFile
ExitProcess
Sleep
GetCurrentThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
HeapSetInformation
GetCommandLineW
DecodePointer
EncodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
DeleteCriticalSection
GetCurrentThreadId
lstrlenA
MultiByteToWideChar
GetLastError
FindResourceW
LoadResource
LockResource
GlobalAlloc
GetCurrentProcessId
GlobalLock
GlobalUnlock
SetLastError
OpenProcess
GetExitCodeProcess
CloseHandle
RaiseException
GetPrivateProfileIntW
GetPrivateProfileStringW
GetSystemTimeAsFileTime
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy

user32

TranslateMessage
DispatchMessageW
EndDialog
DestroyWindow
MapDialogRect
GetWindow
IsWindow
GetWindowThreadProcessId
DefWindowProcW
SetTimer
PostMessageW
GetMessageW
PeekMessageW
CreateWindowExW
MoveWindow
PostQuitMessage
GetDesktopWindow
IsDialogMessageW
CreateDialogIndirectParamW
CallWindowProcW
InvalidateRgn
InvalidateRect
SetCapture
ReleaseCapture
ScreenToClient
ClientToScreen
CreateAcceleratorTableW
GetDC
ReleaseDC
UnregisterClassA
CharNextW
GetParent
GetClassNameW
RedrawWindow
GetClientRect
BeginPaint
FillRect
EndPaint
IsChild
SetFocus
GetFocus
GetSysColor
DestroyAcceleratorTable
SendMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetWindowLongW
SetWindowLongW
RegisterWindowMessageW
GetClassInfoExW
LoadCursorW
RegisterClassExW
SetWindowContextHelpId
GetDlgItem
SetParent
SendDlgItemMessageW
ShowWindow
SetWindowPos

gdi32

GetObjectW
GetDeviceCaps
CreateSolidBrush
DeleteObject
CreateCompatibleBitmap
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
GetStockObject

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitialize
OleUninitialize
OleInitialize
CoTaskMemRealloc
CoTaskMemFree
OleLockRunning
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
CreateStreamOnHGlobal

oleaut32

VariantClear
SysFreeString
VarBstrCat
SysStringByteLen
VarUI4FromStr
OleCreateFontIndirect
SysAllocString
LoadTypeLi
LoadRegTypeLi
SysStringLen
SysAllocStringLen
DispCallFunc
VariantInit

urlmon

CoInternetSetFeatureEnabled

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dump.dll
.dll windows:5 windows x86 arch:x86

9764535f474bf35664a25871bd87e292

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2012, 00:00

Not After

02/08/2014, 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

13:85:88:94:ca:40:ef:b2:b8:94:11:46:30:56:73:95:d4:03:d4:6f
Signer

Actual PE Digest

13:85:88:94:ca:40:ef:b2:b8:94:11:46:30:56:73:95:d4:03:d4:6f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\dump.pdb

Imports

kernel32

GetCurrentThreadId
CloseHandle
GetTickCount
TerminateThread
Sleep
GetPrivateProfileIntW
GetLastError
ResetEvent
GetPrivateProfileSectionW
CreateEventW
OutputDebugStringW
GetPrivateProfileStringW
WritePrivateProfileStringW
lstrcpyW
GetModuleFileNameW
CreateFileW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
FindResourceExW
FindResourceW
LoadResource
WriteFile
SizeofResource
LockResource
DeleteFileW
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapFree
GetSystemTimeAsFileTime
GetFileAttributesW
ExitThread
CreateThread
GetCommandLineA
GetLocalTime
GetCPInfo
RaiseException
GetFileAttributesExW
HeapAlloc
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
GetModuleHandleW
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
HeapSize
GetLocaleInfoW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetConsoleCP
GetConsoleMode
FlushFileBuffers
ReadFile
SetFilePointer
HeapReAlloc
LoadLibraryW
SetStdHandle
CreateFileA
WriteConsoleW
SetEndOfFile
GetProcessHeap
OpenEventA
SetEvent
WaitForSingleObject
RtlUnwind
CreateEventA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteW

urlmon

UrlMkGetSessionOption

shlwapi

PathRemoveFileSpecW
PathFileExistsW

wininet

InternetCloseHandle
InternetOpenA
InternetGetConnectedState
HttpQueryInfoW
InternetSetOptionA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA

Exports

Exports

?dump_info@dump@@YAHABV?$basic_format@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@boost@@@Z
?dump_info@dump@@YAHJABV?$basic_format@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@boost@@@Z
destroy_config_center
disable_output_log_to_file
dump
dump_initialize
dump_log
enable_output_log_to_file
erase_log_record
get_records_duration_by_ms
if_dump
init_config_center
log_output
lvalue
lvalue_of
output_overhead_duration
record_begin_time
record_log_interface
remove_log
set_live_log
svalue
svalue_of
ulvalue_of
upload_live_log
upload_log

Sections

.text
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
funshionplugin2.dll
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_TEXT64
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text.un
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 656KB - Virtual size: 656KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.debug_a
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_i
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_l
Size: 1024B - Virtual size: 987B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_f
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_l
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_p
Size: 512B - Virtual size: 126B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_a
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug_r
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 264KB - Virtual size: 263KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
gma.dll
.dll windows:5 windows x86 arch:x86

8596d45da9d4f8d0913c58f9221801ef

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

23/07/2012, 00:00

Not After

02/08/2014, 23:59

Subject

CN=Beijing Funshion Online Technologies Ltd.,OU=SECURE APPLICATION DEVELOPMENT,O=Beijing Funshion Online Technologies Ltd.,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:46:9c:32:6c:55:eb:37:fc:ec:26:5e:ba:07:f3:fd:75:fc:66:71
Signer

Actual PE Digest

2d:46:9c:32:6c:55:eb:37:fc:ec:26:5e:ba:07:f3:fd:75:fc:66:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\build2.8.2\Funshion\Rel\symbols\gma.pdb

Imports

iphlpapi

GetIpAddrTable
GetBestInterface
GetBestRoute
SendARP

ws2_32

gethostname
getservbyname
getservbyport
htons
WSAGetLastError
htonl
ntohs
inet_ntoa
WSASetLastError
gethostbyaddr
gethostbyname
inet_addr

advapi32

RegOpenKeyExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW

wininet

HttpQueryInfoW
InternetOpenA
InternetCloseHandle
InternetSetOptionA
InternetReadFile
InternetOpenUrlW
HttpQueryInfoA
InternetGetConnectedState

kernel32

SystemTimeToFileTime
WaitForMultipleObjects
ResumeThread
ResetEvent
OpenEventA
GetSystemInfo
FlushFileBuffers
WriteConsoleW
SetStdHandle
LoadLibraryW
GetConsoleMode
InterlockedDecrement
GetPrivateProfileStringW
WritePrivateProfileStringW
GetLastError
ExpandEnvironmentStringsW
CreateEventA
WaitForSingleObject
SetEvent
GetModuleFileNameW
CreateFileW
DeviceIoControl
GetCurrentThreadId
CloseHandle
GetSystemTime
GetTickCount
GetVersionExW
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
LocalFree
lstrlenW
FreeLibrary
CreateProcessW
GetSystemDirectoryW
GetSystemDirectoryA
GetCurrentDirectoryW
GetProcAddress
LoadLibraryA
lstrcmpiW
SetWaitableTimer
FindResourceW
LoadResource
WriteFile
SizeofResource
LockResource
DeleteFileW
GetModuleFileNameA
GetConsoleCP
SetFilePointer
SetConsoleCtrlHandler
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
FatalAppExitA
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
GetFileType
SetHandleCount
ExitProcess
HeapCreate
GetLocaleInfoW
GetStdHandle
GetCurrentThread
SetLastError
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
CreateWaitableTimerA
GetACP
IsProcessorFeaturePresent
LCMapStringW
GetCPInfo
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLocalTime
GetFileAttributesW
CreateThread
FindResourceExW
InterlockedIncrement
InterlockedCompareExchange
InterlockedExchange
GetStringTypeW
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
InitializeCriticalSectionAndSpinCount
GetCommandLineA
RtlUnwind
ExitThread

shell32

SHGetSpecialFolderPathW
ord51
SHGetFolderPathW
SHGetSpecialFolderPathA
SHCreateDirectoryExW

ole32

CoSetProxyBlanket
CoUninitialize
CoInitializeSecurity
CoInitialize
CoCreateInstance

oleaut32

VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
SafeArrayUnaccessData
VariantInit
SafeArrayAccessData
SysAllocString
SysFreeString

urlmon

UrlMkGetSessionOption

shlwapi

PathFileExistsW
PathIsRelativeW
PathRemoveFileSpecA
PathAppendW
PathRemoveBackslashW
PathRemoveFileSpecW

Exports

Exports

GetCurrUsedIPUL
GetCurrUsedIPUL2
GetMACAddress
GetMACAddress2
getGatewayIP
get_and_update_mac
get_mac_info
get_nic_description
get_time_cost_mac
get_time_cost_mac_main

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nicdescr.dat

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 320KB

.rsrc Size: 32KB - Virtual size: 31KB

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 802B

.data Size: 512B - Virtual size: 142B

.reloc Size: 512B - Virtual size: 200B

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 16KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 9KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 16KB - Virtual size: 15KB

.rdata Size: 4KB - Virtual size: 2KB

.data Size: 4KB - Virtual size: 4KB

.reloc Size: 4KB - Virtual size: 2KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 320KB

.rsrc
Size: 32KB - Virtual size: 31KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 802B

.data
Size: 512B - Virtual size: 142B

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 16KB - Virtual size: 16KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 9KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 16KB - Virtual size: 15KB

.rdata
Size: 4KB - Virtual size: 2KB

.data
Size: 4KB - Virtual size: 4KB

.reloc
Size: 4KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 212KB - Virtual size: 211KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 248KB - Virtual size: 245KB

.text
Size: 212KB - Virtual size: 211KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 248KB - Virtual size: 245KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

72:69:eb:e2:99:6a:28:0c:c4:0d:e7:d2:a7:1b:08:8d
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

13:85:88:94:ca:40:ef:b2:b8:94:11:46:30:56:73:95:d4:03:d4:6f
Signer