3f52d3dabeef100bdb1343fb0d8c480e_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

3f52d3dabeef100bdb1343fb0d8c480e_JaffaCakes118
Size

1.3MB
MD5

3f52d3dabeef100bdb1343fb0d8c480e
SHA1

85345c3e6cbb4d4dfdfa8b32a70cf9b35ba190aa
SHA256

790b000a5565554a328cfcc6889c2c151a15614616cf155dc8afb4217037b183
SHA512

f99969292f2ec3e9281dee6388a2ff6717b97ced1da9f22e70dbc134bd22f805214ddaf2d095a23c24cbbdff5b58a45fb5f5d1429528710f13730a73d1d24a53
SSDEEP

24576:o1d6o55GEbX8fWKMbF47PlCqJjc5RqKfQ1DvuAb+lSSDjMYYWsi8ftYEut:4rHbX8fWKxoqJA5RqKY1zuAb8uNiclut

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
3f52d3dabeef100bdb1343fb0d8c480e_JaffaCakes118
unpack001/$COMMONFILES/Angels/IEMenuExt.dll.tmp
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

NSIS installer 1 IoCs

installer

resource	yara_rule
static1/unpack001/out.upx	nsis_installer_2

Files

3f52d3dabeef100bdb1343fb0d8c480e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 288KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$COMMONFILES/Angels/AgLog.dll.tmp
.dll windows:5 windows x86 arch:x86

8b94593f8aa2176ca294ef29c489bf88

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0
Signer

Actual PE Digest

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Source\AgLog\Release\AgLog.pdb

Imports

kernel32

HeapFree
GetCommandLineA
HeapAlloc
RtlUnwind
Sleep
ExitProcess
RaiseException
VirtualAlloc
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
VirtualFree
SetHandleCount
GetStdHandle
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
CreateFileA
SetEnvironmentVariableA
GetFileTime
GetFileSizeEx
GetFileAttributesW
GetFullPathNameW
FindFirstFileW
FindClose
GetCurrentProcess
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
InterlockedIncrement
GetModuleHandleA
GlobalFlags
GlobalFindAtomW
CompareStringW
LoadLibraryA
GetVersionExA
SetErrorMode
TlsFree
LocalReAlloc
TlsSetValue
TlsAlloc
GlobalHandle
GlobalReAlloc
TlsGetValue
InterlockedDecrement
LocalAlloc
FileTimeToLocalFileTime
FileTimeToSystemTime
GlobalFree
GlobalUnlock
FormatMessageW
LocalFree
lstrlenW
WaitForSingleObject
GlobalAddAtomW
SetLastError
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesW
GetModuleFileNameW
lstrcmpA
GetLocaleInfoW
LoadLibraryW
CompareStringA
InterlockedExchange
GlobalLock
lstrcmpW
GlobalAlloc
FreeLibrary
GetSystemInfo
GetProcAddress
GetVersionExW
GetModuleHandleW
GetSystemDefaultLangID
GetVolumeInformationW
GetCurrentProcessId
DeleteFileW
DeleteCriticalSection
EnterCriticalSection
WritePrivateProfileStringW
GetTimeZoneInformation
LeaveCriticalSection
GetPrivateProfileIntA
InitializeCriticalSection
GetPrivateProfileStringW
ExpandEnvironmentStringsA
GetTickCount
lstrlenA
MultiByteToWideChar
CloseHandle
LockResource
GetLocalTime
GetLastError
CreateFileW
ReadFile
SizeofResource
WideCharToMultiByte
WriteFile
LoadResource
FindResourceW
SetFilePointer
FreeEnvironmentStringsW
GetFileSize

user32

DestroyMenu
CharUpperW
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
LoadCursorW
GetDC
ReleaseDC
GetSysColorBrush
ClientToScreen
ShowWindow
SetWindowTextW
RegisterWindowMessageW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetWindowTextW
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
UnregisterClassW
UnhookWindowsHookEx
GetMenuItemID
GetMenuItemCount
GetSubMenu
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageW
GetCursorPos
ValidateRect
GetWindowThreadProcessId
GetWindowLongW
GetLastActivePopup
IsWindowEnabled
EnableWindow
SetCursor
PostMessageW
PostQuitMessage
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
GetParent
SendMessageW
ModifyMenuW
GetMenuState
EnableMenuItem
CheckMenuItem
GetSystemMetrics
MessageBoxA
MessageBoxW

gdi32

GetStockObject
TextOutW
RectVisible
PtVisible
DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
Escape
CreateBitmap
SetMapMode
RestoreDC
SaveDC
DeleteObject
SetBkColor
SetTextColor
GetClipBox
GetDeviceCaps
ExtTextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegSetValueExW
RegCreateKeyExW
RegQueryValueW
RegOpenKeyW
RegEnumKeyW
RegDeleteKeyW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW

shell32

ord165
SHGetFolderPathW

shlwapi

PathFindFileNameW
UrlUnescapeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW

oleaut32

VariantClear
VariantInit
VariantChangeType

ws2_32

WSAStartup
WSACleanup
WSASetLastError

iphlpapi

GetAdaptersInfo

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetConnectW
HttpSendRequestW
InternetReadFile
InternetWriteFile
InternetSetFilePointer
InternetSetStatusCallbackW
InternetOpenW
InternetGetLastResponseInfoW
HttpQueryInfoW
HttpAddRequestHeadersW
InternetQueryDataAvailable
InternetSetOptionExW
InternetCanonicalizeUrlW
InternetCrackUrlW
HttpOpenRequestW
InternetCloseHandle

Exports

Exports

AddLog
AddLogA
AddLogW
GetOemId

Sections

.text
Size: 196KB - Virtual size: 195KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/Angels/IE360.htm.tmp
.html .js polyglot
$COMMONFILES/Angels/IEMenuExt.dll.tmp
.dll windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/Angels/IEScan.dll.tmp
.dll windows:5 windows x86 arch:x86

d4d7acf2490f50cad61341abdc13b81b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bc
Signer

Actual PE Digest

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

w:\src\IE360\bin\IEScan.pdb

Imports

kernel32

GetVersion
DisableThreadLibraryCalls
GetProcAddress
GetModuleFileNameW
Sleep
LoadLibraryW
CreateProcessW
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetLastError
HeapFree
HeapAlloc
LCMapStringW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoA
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
HeapSize

user32

SendMessageW
wsprintfW

advapi32

RegOpenKeyExW
RegEnumValueW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey

Exports

Exports

RepairEntry
ScanEntry
StartRepairProcess

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/Angels/IEsafe.dll.tmp
.dll regsvr32 windows:5 windows x86 arch:x86

a4ec15836730568f4c99c114eb04d808

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3f:97:be:3c:fe:99:31:ba:49:7f:e4:b1:74:ca:bb:c4:26:26:ea:25
Signer

Actual PE Digest

3f:97:be:3c:fe:99:31:ba:49:7f:e4:b1:74:ca:bb:c4:26:26:ea:25

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

wininet

GetUrlCacheEntryInfoW
DeleteUrlCacheEntryW

winmm

PlaySoundW

gdiplus

GdiplusShutdown
GdipLoadImageFromFile
GdipFree
GdipAlloc
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipCloneImage
GdiplusStartup

kernel32

GetSystemWindowsDirectoryW
ExpandEnvironmentStringsW
GetCurrentThreadId
GetTickCount
GetCurrentProcessId
SetFileAttributesA
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
LoadLibraryA
MultiByteToWideChar
lstrlenA
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
RaiseException
FlushInstructionCache
lstrcmpiW
LoadLibraryExW
TerminateThread
WaitForSingleObject
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceW
GlobalAlloc
WideCharToMultiByte
CreateThread
GlobalFree
WriteFile
DebugBreak
OutputDebugStringW
GlobalUnlock
GlobalLock
MulDiv
GlobalHandle
LockResource
CreateProcessW
MoveFileExW
ResumeThread
GetPrivateProfileStringW
VirtualProtectEx
IsBadReadPtr
GetTempPathW
InterlockedCompareExchange
CreateFileMappingA
CreateEventA
GetSystemInfo
lstrcmpiA
GetVersionExA
CompareStringW
CompareFileTime
SystemTimeToFileTime
GetWindowsDirectoryW
GetLongPathNameW
FileTimeToDosDateTime
FileTimeToLocalFileTime
FindClose
FindFirstFileW
VirtualQuery
VirtualProtect
VirtualAlloc
GetThreadContext
SetThreadContext
SuspendThread
SetFilePointer
TlsAlloc
TlsGetValue
HeapReAlloc
HeapDestroy
HeapCreate
GetCommandLineA
GetSystemTimeAsFileTime
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
VirtualFree
IsProcessorFeaturePresent
InterlockedExchange
GetLocalTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
lstrcmpW
lstrcpyW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
OutputDebugStringA
GetModuleFileNameW
SetLastError
LoadLibraryW
GetCurrentThread
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
Sleep
DeleteFileW
InterlockedIncrement
CopyFileW
CreateFileW
ExitProcess
GetStdHandle
GetModuleFileNameA
LCMapStringW
HeapSize
GetFileType
SetHandleCount
GetStartupInfoA
SetStdHandle
GetFileSize
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringA
GetStringTypeA
GetLastError
ReadFile
CloseHandle
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryW
lstrlenW
InterlockedDecrement
GetStringTypeW
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEndOfFile
GetLocaleInfoW
FlushFileBuffers
TlsSetValue
FileTimeToSystemTime
TlsFree

user32

OffsetRect
GetCursorPos
RegisterWindowMessageW
LoadBitmapW
MessageBeep
SetDlgItemInt
GetDlgItemInt
CreateAcceleratorTableW
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
IsChild
RedrawWindow
InvalidateRgn
InvalidateRect
MoveWindow
SetWindowTextA
SetFocus
GetDlgItemTextW
EnableWindow
GetDlgItem
MapDialogRect
EndDialog
SetWindowContextHelpId
DestroyIcon
LoadImageW
GetCursor
DrawEdge
DialogBoxIndirectParamW
GetActiveWindow
SetForegroundWindow
BringWindowToTop
UpdateWindow
ReleaseCapture
PtInRect
SetCursor
IsWindowVisible
wsprintfW
SetMenuItemInfoW
DrawFocusRect
InflateRect
DrawTextW
DeleteMenu
ScreenToClient
wvsprintfW
AdjustWindowRectEx
SetCapture
ReleaseDC
GetDC
GetMenu
GetWindowTextW
CharNextW
GetClassInfoExW
RegisterClassExW
CharUpperBuffW
GetSystemMetrics
DestroyWindow
GetSysColor
LoadCursorW
GetDesktopWindow
SetWindowLongW
CreateWindowExW
DestroyMenu
ClientToScreen
LoadMenuW
GetSubMenu
TrackPopupMenu
DefWindowProcW
MessageBoxW
ShowWindow
wsprintfA
UnhookWindowsHookEx
GetFocus
SetTimer
DispatchMessageW
TranslateMessage
PostMessageW
CopyRect
FindWindowExW
GetClassNameW
GetAsyncKeyState
GetKeyState
CallWindowProcW
KillTimer
CharLowerBuffW
IsWindow
LoadStringW
LoadIconW
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SendMessageW
SetDlgItemTextW
SetWindowTextW
GetWindowLongW
UnregisterClassA
GetWindowTextLengthW

gdi32

MoveToEx
LineTo
GetTextMetricsW
SetMapMode
SetTextAlign
CreateFontIndirectW
GetDeviceCaps
SetBkMode
GetStockObject
GetDIBits
GetObjectW
CreateCompatibleDC
CreateBitmap
CreateCompatibleBitmap
SetBkColor
BitBlt
DeleteDC
CreatePen
SelectObject
GetTextExtentPoint32W
DeleteObject
CreateSolidBrush

advapi32

RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetSidIdentifierAuthority
RegGetKeySecurity
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAce
InitializeAcl
AllocateAndInitializeSid
RegEnumKeyW
RegSetKeySecurity
GetUserNameW
RegDeleteKeyW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey

shell32

SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoGetMalloc
CoTaskMemAlloc
CLSIDFromProgID
StringFromIID
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal
ReleaseStgMedium
OleLockRunning
CoGetClassObject
CLSIDFromString
RegisterDragDrop
OleInitialize
CoTaskMemRealloc
OleUninitialize
CoTaskMemFree

oleaut32

VarBstrCmp
VariantInit
VariantClear
SysAllocString
SysAllocStringLen
DispCallFunc
LoadRegTypeLi
LoadTypeLi
VariantChangeType
SysStringLen
RegisterTypeLi
VarUI4FromStr
SysAllocStringByteLen
SysStringByteLen
OleCreateFontIndirect
SafeArrayDestroyData
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysFreeString
UnRegisterTypeLi

shlwapi

PathFileExistsW
StrToIntW
StrCpyW

urlmon

IsValidURL
URLDownloadToCacheFileA
URLDownloadToFileW

oleacc

AccessibleObjectFromWindow

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 504KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 149KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/Angels/Scan.dll.tmp
.dll windows:5 windows x86 arch:x86

cebe3e34ceb35941b3c83de27fd8e026

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

21:6e:c6:b7:86:cb:f6:79:f5:da:b0:4d:45:1d:84:e4:85:63:cd:80
Signer

Actual PE Digest

21:6e:c6:b7:86:cb:f6:79:f5:da:b0:4d:45:1d:84:e4:85:63:cd:80

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\haokanbar4\browser\ie\Scan\Release\Scan.pdb

Imports

winmm

timeGetTime
timeBeginPeriod
timeEndPeriod

kernel32

GetFileAttributesExW
DeleteFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
CreateMutexW
SetFilePointer
WaitForSingleObject
GetTickCount
GetModuleFileNameW
GetCurrentThreadId
OutputDebugStringA
ReleaseMutex
GetCurrentProcessId
Sleep
RaiseException
InterlockedExchangeAdd
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentProcess
GetFullPathNameA
CreateFileA
GetFileSize
FreeLibrary
UnlockFile
LockFile
FormatMessageA
LoadLibraryW
FlushFileBuffers
GetProcAddress
LockFileEx
LoadLibraryA
GetVersionExA
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
InterlockedIncrement
InitializeCriticalSection
InterlockedDecrement
GetThreadLocale
GetACP
GetLocaleInfoA
GetLocaleInfoW
GetTimeZoneInformation
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
GetConsoleOutputCP
WriteConsoleW
WriteConsoleA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetLastError
GetTempPathW
CreateFileW
ReadFile
GetFileAttributesW
WriteFile
GetFullPathNameW
CloseHandle
IsDebuggerPresent
InterlockedExchange
InterlockedCompareExchange
MultiByteToWideChar
GetFileAttributesA
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetEndOfFile
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SetStdHandle
GetConsoleMode
GetConsoleCP
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
HeapAlloc
GetCommandLineA
HeapReAlloc
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetStdHandle
GetModuleFileNameA
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
ExitProcess
HeapSize
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

SHFileOperationW

Exports

Exports

InitEngine
ScanLink

Sections

.text
Size: 757KB - Virtual size: 756KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 370KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$COMMONFILES/Angels/blockimg.xml.tmp
$PLUGINSDIR/FindProcDLL.dll
.dll windows:4 windows x86 arch:x86

c480ee4d2a64d4a16edee43fdfe35079

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
OpenProcess
LoadLibraryA
CloseHandle
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
HeapCreate
VirtualFree
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
HeapReAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
HeapSize
FreeLibrary
GetModuleFileNameA
GetEnvironmentVariableA
HeapDestroy
DisableThreadLibraryCalls
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetACP
GetOEMCP
WriteFile
VirtualAlloc
RtlUnwind
GetStringTypeA
GetStringTypeW
GetCPInfo

user32

wsprintfA

Exports

Exports

FindProc

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/KillProcDLL.dll
.dll windows:4 windows x86 arch:x86

815c88741b87a0210c457b00b57bf9c6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateProcess
CloseHandle
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
GlobalFree
lstrcpyA
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
RtlUnwind
GetCPInfo
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP

Exports

Exports

KillProc

Sections

.text
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsWebEx.dll
.dll windows:5 windows x86 arch:x86

ae32207b6031c02aed9dfbea809c29f1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

f4:28:41:bc:3e:9c:9f:f0:e4:6e:6f:48:8e:a3:ea:59:b8:a9:ea:70
Signer

Actual PE Digest

f4:28:41:bc:3e:9c:9f:f0:e4:6e:6f:48:8e:a3:ea:59:b8:a9:ea:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
CreateFileA
GetCurrentProcessId
GetTickCount
GetPrivateProfileStringA
GetPrivateProfileIntA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
HeapSize
GetConsoleMode
GetConsoleCP
WriteFile
SetFilePointer
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
CloseHandle
GetProcessHeap
HeapAlloc
ExpandEnvironmentStringsA
WritePrivateProfileStringA
HeapFree
GetPrivateProfileSectionA
lstrcpyA
LoadLibraryA
GlobalFree
MultiByteToWideChar
LCMapStringA
HeapReAlloc
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
VirtualFree
GetSystemTimeAsFileTime
RtlUnwind
GetCurrentThreadId
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
RaiseException
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy

user32

ReleaseDC
ShowWindow
GetWindowTextA
MoveWindow
GetDlgItem
GetClientRect
GetDC
PostMessageA
LoadCursorA
SetCursor
SetDlgItemTextA
InvalidateRect
CreateDialogParamA
SetWindowLongA
SendMessageA
GetWindowRect
MapWindowPoints
UpdateWindow
GetMessageA
IsDialogMessageA
TranslateMessage
DispatchMessageA
IsDlgButtonChecked
DestroyWindow
CheckDlgButton
LoadBitmapA
CallWindowProcA

gdi32

CreateCompatibleDC
SelectObject
BitBlt
DeleteObject
DeleteDC
GetObjectA
GetTextExtentPointA
GetTextExtentPoint32A

advapi32

CryptReleaseContext
CryptGenRandom
CryptAcquireContextW

ole32

OleUninitialize
OleInitialize

urlmon

URLDownloadToCacheFileA

wininet

DeleteUrlCacheEntry
InternetAttemptConnect
GetUrlCacheEntryInfoA

Exports

Exports

GetChannelId
IsInet
PutChannelId
ShowBarPage
ShowWebPage

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IEProt/IEProt2.exe.tmp
.exe windows:5 windows x86 arch:x86

a0e5751a95312c77b206db6dc5fe651b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16-07-2004 00:00

Not After

15-07-2014 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

24-12-2008 00:00

Not After

24-12-2011 23:59

Subject

CN=Beijing Gigabit Times Technology Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Beijing Gigabit Times Technology Co.\, Ltd,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:68:a0:36:8c:57:de:06:39:54:e0:e7:0a:95:18:b4:d6:37:96:69
Signer

Actual PE Digest

c5:68:a0:36:8c:57:de:06:39:54:e0:e7:0a:95:18:b4:d6:37:96:69

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

w:\src\IE360\bin\IEProt2.pdb

Imports

kernel32

SetErrorMode
GetStartupInfoW
HeapReAlloc
RtlUnwind
RaiseException
Sleep
ExitProcess
ExitThread
HeapSize
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetFileTime
IsDebuggerPresent
GetCPInfo
GetOEMCP
IsValidCodePage
LCMapStringW
LCMapStringA
InitializeCriticalSectionAndSpinCount
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetEnvironmentVariableA
GetFileSizeEx
FileTimeToLocalFileTime
GetFullPathNameW
GetVolumeInformationW
DuplicateHandle
SetEndOfFile
UnlockFile
LockFile
FlushFileBuffers
GetTickCount
FileTimeToSystemTime
GlobalFlags
GetThreadLocale
CreateEventW
SuspendThread
SetEvent
WaitForSingleObject
SetThreadPriority
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
WritePrivateProfileStringW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
InterlockedExchange
lstrlenA
lstrcmpA
InterlockedIncrement
GetCurrentThreadId
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersionExW
LoadLibraryA
lstrcmpW
GetModuleHandleW
GlobalAlloc
FormatMessageW
LocalFree
MulDiv
GetModuleHandleA
GlobalLock
GlobalUnlock
FreeResource
GetCurrentProcessId
SetLastError
MultiByteToWideChar
GetTempPathW
CreateDirectoryW
ResumeThread
GetPrivateProfileStringW
InterlockedDecrement
GetProcessHeap
HeapFree
HeapAlloc
GetVersionExA
lstrcmpiA
CompareStringW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetACP
CreateThread
GetWindowsDirectoryW
GetModuleFileNameW
TerminateThread
GetSystemWindowsDirectoryW
GetCurrentProcess
FreeLibrary
GetVersion
GlobalFree
GetProcAddress
GetLastError
LoadLibraryW
CreateMutexW
GetCommandLineW
ExpandEnvironmentStringsW
FindClose
CreateFileW
ReadFile
WideCharToMultiByte
WriteFile
SetFilePointer
FindFirstFileW
GetFileSize
CompareStringA
LockResource
lstrlenW
SizeofResource
LoadResource
FindResourceW
CloseHandle
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
TerminateProcess
OpenProcess
OutputDebugStringW
SetFileAttributesW
DeleteFileW
WriteProfileStringW
GetFileAttributesW
GetLogicalDrives
GetProfileStringW
UnhandledExceptionFilter
GetDriveTypeW

user32

PostThreadMessageW
CharUpperW
RegisterClipboardFormatW
UnregisterClassW
DestroyMenu
LoadCursorW
GetSysColorBrush
CharNextW
DrawFocusRect
GetMessageW
TranslateMessage
GetCursorPos
ValidateRect
MessageBeep
GetNextDlgGroupItem
SetCursor
PostQuitMessage
SetWindowContextHelpId
MapDialogRect
ReleaseCapture
SetCapture
InvalidateRgn
SetRect
IsRectEmpty
CopyAcceleratorTableW
ShowWindow
MoveWindow
SetWindowTextW
IsDialogMessageW
SendDlgItemMessageW
SendDlgItemMessageA
WinHelpW
GetCapture
SetWindowsHookExW
CallNextHookEx
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
GetForegroundWindow
DispatchMessageW
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
PeekMessageW
MapWindowPoints
GetKeyState
SetMenu
SetForegroundWindow
UpdateWindow
PostMessageW
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
EqualRect
CopyRect
PtInRect
EnableWindow
IsWindowVisible
GetClientRect
FillRect
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
GetMenu
SetWindowLongW
OffsetRect
IntersectRect
SystemParametersInfoA
GetWindowPlacement
GetMenuItemID
GetMenuItemCount
GetSubMenu
GetSysColor
EndPaint
BeginPaint
GetWindowDC
ClientToScreen
GrayStringW
DrawTextExW
TabbedTextOutW
GetDesktopWindow
GetActiveWindow
SetActiveWindow
CreateDialogIndirectParamW
DestroyWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowThreadProcessId
GetLastActivePopup
GetMessagePos
GetWindowRect
LoadBitmapW
InvalidateRect
TrackMouseEvent
SendMessageW
GetParent
RegisterWindowMessageW
LoadStringW
SetWindowPos
wsprintfW
FindWindowW
GetSystemMetrics
IsWindow
SystemParametersInfoW
LoadIconW
DrawIcon
IsZoomed
LoadImageW
IsIconic
ScreenToClient
SetWindowRgn
DrawTextW
ReleaseDC
GetDC
KillTimer
CheckMenuItem
EnableMenuItem
GetMenuState
ModifyMenuW
GetFocus
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
SetFocus
GetWindowLongW
GetWindow
GetWindowTextW
IsWindowEnabled
MessageBoxW
IsChild

gdi32

GetMapMode
GetTextColor
GetRgnBox
GetBkColor
CreateRectRgnIndirect
GetDeviceCaps
GetStockObject
DeleteDC
ExtSelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
RectVisible
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
Escape
ExtTextOutW
CreateSolidBrush
PtVisible
GetWindowExtEx
GetViewportExtEx
MoveToEx
LineTo
GetClipBox
SetMapMode
SetTextColor
SetBkMode
SetBkColor
RestoreDC
SaveDC
CreateFontIndirectW
GetTextMetricsW
DeleteObject
CombineRgn
CreateRoundRectRgn
CreateRectRgn
GetPixel
BitBlt
StretchBlt
CreateBitmap
SelectObject
CreateCompatibleDC
GetObjectW
CreatePenIndirect
TextOutW

comdlg32

GetFileTitleW

winspool.drv

DocumentPropertiesW
ClosePrinter
OpenPrinterW

advapi32

RegEnumKeyW
RegQueryValueW
RegOpenKeyW
GetLengthSid
AddAce
RegSetKeySecurity
FreeSid
AllocateAndInitializeSid
InitializeAcl
RegGetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CopySid
RegCreateKeyExW
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
GetSidIdentifierAuthority
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyW
RegEnumKeyExW
RegEnumValueW
RegDeleteValueW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegOpenKeyExW

shell32

CommandLineToArgvW
ShellExecuteW

comctl32

InitCommonControlsEx

shlwapi

StrCpyW
PathFindExtensionW
PathFindFileNameW
PathStripToRootW
PathIsUNCW
StrToIntW
PathFileExistsW

oledlg

OleUIBusyW

ole32

OleIsCurrentClipboard
CoRevokeClassObject
OleInitialize
CoFreeUnusedLibraries
OleUninitialize
CLSIDFromProgID
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
StgOpenStorageOnILockBytes
CoGetClassObject
OleFlushClipboard
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
CoCreateInstance
CoInitialize
CoUninitialize
CoRegisterMessageFilter

oleaut32

SysFreeString
SysAllocString
VariantInit
SysStringLen
SysAllocStringByteLen
SysAllocStringLen
VariantClear
VariantChangeType
VariantTimeToSystemTime
SystemTimeToVariantTime
SafeArrayDestroy
OleCreateFontIndirect
VariantCopy

urlmon

URLDownloadToFileW

Sections

.text
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 288KB

UPX1 Size: 18KB - Virtual size: 20KB

.rsrc Size: 77KB - Virtual size: 80KB

8b94593f8aa2176ca294ef29c489bf88

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9Certificate

Extended Key Usages

Key Usages

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

shlwapi

oleaut32

ws2_32

iphlpapi

version

wininet

Exports

Exports

Sections

.text Size: 196KB - Virtual size: 195KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 9KB - Virtual size: 23KB

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 31KB - Virtual size: 31KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 138KB - Virtual size: 137KB

.rdata Size: 27KB - Virtual size: 27KB

.data Size: 7KB - Virtual size: 14KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 11KB - Virtual size: 11KB

d4d7acf2490f50cad61341abdc13b81b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9Certificate

Extended Key Usages

Key Usages

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bcSigner

Headers

DLL Characteristics

File Characteristics

UPX0
Size: - Virtual size: 288KB

UPX1
Size: 18KB - Virtual size: 20KB

.rsrc
Size: 77KB - Virtual size: 80KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

cf:2c:46:b3:c0:17:45:b0:62:74:ed:3f:0a:78:74:e0:d3:55:ce:f0
Signer

.text
Size: 196KB - Virtual size: 195KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 9KB - Virtual size: 23KB

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 31KB - Virtual size: 31KB

.text
Size: 138KB - Virtual size: 137KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 7KB - Virtual size: 14KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 11KB - Virtual size: 11KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

41:07:3e:21:13:33:a0:5f:6c:5c:61:13:a3:e9:d6:b2:2d:c0:29:bc
Signer

.text
Size: 35KB - Virtual size: 35KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 3KB - Virtual size: 5KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

3f:97:be:3c:fe:99:31:ba:49:7f:e4:b1:74:ca:bb:c4:26:26:ea:25
Signer

.text
Size: 504KB - Virtual size: 504KB

.rdata
Size: 127KB - Virtual size: 127KB

.data
Size: 149KB - Virtual size: 188KB

.SHARED
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 199KB - Virtual size: 199KB

.reloc
Size: 44KB - Virtual size: 44KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

77:a6:47:59:f1:27:66:e3:63:d7:79:99:8c:71:bd:c9
Certificate

21:6e:c6:b7:86:cb:f6:79:f5:da:b0:4d:45:1d:84:e4:85:63:cd:80
Signer