4b5569fe25d928ad0cbcd893ad22aabd_JaffaCakes118

resource
4b5569fe25d928ad0cbcd893ad22aabd_JaffaCakes118
unpack001/$PLUGINSDIR/CoreAAC.ax
unpack001/$PLUGINSDIR/CoreAVC.2.0.0.0.ax
unpack001/$PLUGINSDIR/CoreAVC.ax
unpack001/$PLUGINSDIR/HTTP_ASF_SOURCE.ax
unpack001/$PLUGINSDIR/MP4Splitter.ax
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/audioswitcher.ax
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/pnsis.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

IMPHASH ff8d8dbb96b7ab762c0ce51911e4d104
SHA256 65d3b9fa54d57a108860a8149cac840fd10ab2d6143b1f4e346f3c9fd589043e
MD5 4b5569fe25d928ad0cbcd893ad22aabd
SHA1 28bae46d8742cb957576ad350aad41aa921c5b7a
SHA512 768e8e2177c714fb3d27253cadb3d7e03dc0aa9a9d4842278178a38406c38f708d70bf10f5c299f00bbc4e1756ada421667e70a262566d9756579cb0851d3a72
SSDEEP 98304:zeOe6dLObiPg6gPHBl6Mk+89fwjzCXqFBhNAgRLn6CxxJePxCwBpva:zvOb966Bon+K6dSgBFjJANC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

13229

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA GetTempPathA SetFileTime SetErrorMode lstrcpynA GetDiskFreeSpaceA LocalFree WideCharToMultiByte OutputDebugStringA GetCommandLineW GlobalUnlock GlobalLock CreateThread LoadLibraryA CreateProcessA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion RemoveDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA MulDiv WriteFile ReadFile SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetCommandLineA

user32

GetMessagePos CallWindowProcA IsWindowVisible LoadBitmapA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuA CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos ScreenToClient GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow ShowWindow wsprintfA FindWindowExA CheckDlgButton LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA DialogBoxParamA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SendMessageTimeoutA

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

CommandLineToArgvW SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumValueA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/CoreAAC.ax

IMPHASH 603a5553c41f87f262cc1e933305d724
SHA256 04bf38bbd9cb8287582f9a2fb8b06e0ab30f06f676a93f4a56656b576f10e597
MD5 b0ffac757be8d6cc41e1131eb2b0d959
SHA1 0e41733a050bc2ed53fda6337d6501b9942317c2
SHA512 356ecf4902f767f74670e5fcd57f26fb8a43710d0a2b3a995877e6f265119b2f091c6e5e3457dfa1767c6e4043afc470cc7090f43dd997b27c0e94c7e102bee3
SSDEEP 6144:+yTbEUUmDAh189YEqbBpkJzJTba96sZTiaJfOMBfcESToVk:bxUmDAn4C9GBJba96sZTf9Oy+Wk
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

46113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_initterm _onexit qsort memmove ??2@YAPAXI@Z __dllonexit _adjust_fdiv malloc _ftol free _purecall __CxxFrameHandler ??3@YAXPAX@Z _CIpow

winmm

timeSetEvent timeGetTime

kernel32

GetCurrentProcess lstrcmpiA SetErrorMode GetTickCount GetModuleFileNameA lstrlenA MultiByteToWideChar GetLastError GetVersionExA DisableThreadLibraryCalls InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InterlockedIncrement InterlockedDecrement CloseHandle CreateEventA ResetEvent DuplicateHandle GetCurrentThread GetCurrentThreadId SetEvent WaitForMultipleObjects WaitForSingleObject CreateSemaphoreA ReleaseSemaphore GetSystemInfo VirtualAlloc VirtualFree FreeLibrary LoadLibraryA InterlockedExchange CreateThread GetProcAddress GetModuleHandleA WideCharToMultiByte GetACP SetThreadPriority GetThreadPriority

advapi32

RegDeleteKeyA RegCreateKeyA RegSetValueA RegEnumKeyExA RegCloseKey RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA

version

VerQueryValueA GetFileVersionInfoA GetFileVersionInfoSizeA

user32

ShowWindow wsprintfA SetDlgItemTextA SetTimer CheckDlgButton KillTimer IsDlgButtonChecked GetWindowLongA SetWindowLongA CreateDialogParamA MoveWindow InvalidateRect DestroyWindow DefWindowProcA PeekMessageA MsgWaitForMultipleObjects wvsprintfA PostThreadMessageA RegisterWindowMessageA GetQueueStatus DispatchMessageA LoadStringA LoadStringW GetWindowRect GetDesktopWindow

ole32

CoCreateInstance CoUninitialize StringFromGUID2 CoTaskMemAlloc CoInitialize CoFreeUnusedLibraries CoTaskMemFree

oleaut32

SysFreeString SysAllocString

$PLUGINSDIR/CoreAVC.2.0.0.0.ax

IMPHASH a51dab6f4a70c7f5108331c3fee35df0
SHA256 779768aa0bf2270422e1686547ae622238e7b7cf37ce212a1d75caf8628c1508
MD5 a45cfb1f058297ae981f8afeef056b8d
SHA1 e454ed585a0f19d3119cef725958ea19c93cd7cf
SHA512 efa87c97e4f76d5fbd73d2e0c5c580c719518d4e3e7e16efdb1355b659c9584956bc7df944f0d637f069f359a046fe65bfd178e4cbaf97fbb5921ebd29e09aa0
SSDEEP 6144:/+x+B++xX1f3uZINBKD5wlA9amB38sDFe9E23XbFDZ:Wi+A1fJ2wlhmKsg22nbNZ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

1110252

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/CoreAVC.ax

SHA256 cb8d9d80dcd48d9a9e3d87c847c47125f7201a98fb5abb4bd6c443322071b951
MD5 c264fed121afd44bda8bf0ff8f4e4269
SHA1 7480a3b26b81045a1504e68e15225682bcc6f440
SHA512 99ed4b723b2b7a90fce8e9bf9ee8d5a1440c4d569638ff6a1aa59354c8bca91618a13c440f754fad3ae22c306709da35b4c53b8a00a09753027eaed0d238052b
SSDEEP 3072:eFX0fCcmjZvyTdndzMryzKdvYQ/5c0q3ARsK/l74obxK7Dtp0XRHSOg9lX9cWR82:GEKpZY2r3VYQ/c0d7Hbw7pp0X8hlX6WB
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

995044

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/FWUpnp.dll

IMPHASH 0f59a417be517814d6255c7c7ab35c48
SHA256 e54031818e6449897e3a81f0637b0af7618f6aa9e1530c3bf4989d2fabe4a2d4
MD5 be2d4b56d5d40afca9c804d0776a25c6
SHA1 7ea48cf0e980fe999f14338f44ad4c57c9b714de
SHA512 f32b8e1d27acb7c9021dcc6cd426599374f61a78fd38a0f9d0bf5bf63c424ca816e3859387d98b3060592ea86d1743c5ff149099bcab4da9e31ff7abc81fd627
SSDEEP 3072:HE0D5eN3rsEkHJGYM+y/DV7u4hNesdd56PeAWK5:HRQ3rshhMn/DVj3dc2LK5
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

86:5b:4d:43:95:47:7d:ce:88:a1:25:24:03:5c:e1:33:65:f4:9f:f7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 27, 2009

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

5

Entry point

62733

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\SVN Control Code\app_client\NewUpnp\FWUpnp\Release\FWUpnp.pdb

kernel32

LoadResource FindResourceA FindResourceExA WideCharToMultiByte IsBadWritePtr MultiByteToWideChar CreateThread Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventA CloseHandle SetEvent ResetEvent WaitForSingleObject WaitForMultipleObjects CreateFileA WriteConsoleW GetConsoleOutputCP LockResource SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryA InitializeCriticalSectionAndSpinCount GetLocaleInfoA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW WriteConsoleA SizeofResource HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap RaiseException RtlUnwind GetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentThreadId GetCommandLineA GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetStringTypeA GetStringTypeW HeapCreate VirtualFree VirtualAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA LCMapStringA LCMapStringW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoInitialize

oleaut32

SysStringLen SysAllocString SysFreeString

ws2_32

WSACleanup WSAGetLastError socket connect ioctlsocket send WSACreateEvent WSAStartup WSAWaitForMultipleEvents WSAEnumNetworkEvents recv WSACloseEvent closesocket htons sendto inet_addr inet_ntoa gethostbyname gethostname WSAEventSelect

iphlpapi

GetAdaptersInfo

$PLUGINSDIR/HTTP_ASF_SOURCE.ax

SHA256 8986849443fd14ed19ce0e87b01fd2cba4dca42e978417344732741f2fc29c5e
MD5 d8dea47ee79837f435193fb9b6972cc1
SHA1 d8ce8e1bd0fcad2d50bc83846f7b16c52987d083
SHA512 da999774608935ca769f25e6699275033ec92a935d3081f700ea890a3cac6ac59da6f3f8be33488d07386d103eaa808734a7c8a3c5f11b38a6ec84c5ddae8b5f
SSDEEP 6144:IEBjCmsazwA6exhQWHb7Do9b2GRPKT1E9o5H4G/VmKEYTzKKAmKCetHRajaubxl:D+m3P6exhQW77TiSECrYKfTmSiajN
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

440932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

427KB

Virtual Size

426KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

171B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/Hookkernel.dll

IMPHASH 9db40d556cd2d852ea51672f0ff36a72
SHA256 9b89df0d08de3583210271f583d1ea4eb73c40d0a611dcb7512452987285bcc7
MD5 9e5ec82ae6eaf73c21b344af16fc6e37
SHA1 bfc552d9ec37858b7b197b089e05bae9733cc42f
SHA512 21ff67c6907a4d0dd4049285770d84942b19196649d384408c2404dc922141ee6a80d1f31e673f59de12d3f587c1c3e4d1c8db56eea73989f30bcb53fb3a06e0
SSDEEP 3072:6u6T0e0OOzOpNahx4X7seraCgb9GWAMRnUc6ZkdTkel1+EluZBQywr73sB68yhtW:QuUNahx4rxr3nqRnU5HevaZBQuyvceI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

6f:89:40:14:18:c4:9b:28:4e:53:e6:32:f5:d2:a2:e4:21:94:bb:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Apr 23, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

86957

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Documents and Settings\Administrator\桌面\projectout\Hookkernel.pdb

kernel32

GetCurrentProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread CreateDirectoryW GetCommandLineA HeapFree HeapAlloc GetProcessHeap RtlUnwind RaiseException ExitProcess HeapReAlloc HeapSize Sleep GetCPInfo LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime VirtualAlloc GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale WritePrivateProfileStringW InterlockedIncrement GlobalFlags GetModuleHandleA SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement FormatMessageW LocalFree MulDiv GetCurrentProcessId ResumeThread GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange GlobalAlloc lstrlenW GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom CompareStringW LoadLibraryA GetLastError SetLastError lstrcmpW GetModuleHandleW GetVersionExA GlobalLock GlobalUnlock GlobalFree FreeResource FreeLibrary GetProcAddress LoadLibraryW GetEnvironmentVariableW GetPrivateProfileStringW Module32NextW Module32FirstW Process32NextW Thread32Next Thread32First Process32FirstW CreateToolhelp32Snapshot GetModuleFileNameW MultiByteToWideChar GetACP WideCharToMultiByte CloseHandle FindResourceW LoadResource LockResource GetOEMCP SizeofResource

user32

GrayStringW DrawTextExW DrawTextW TabbedTextOutW UnregisterClassW GetWindowThreadProcessId SetCursor GetCursorPos ValidateRect PostQuitMessage ShowWindow SetWindowTextW IsDialogMessageW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW GetCapture SetWindowsHookExW CallNextHookEx GetClassLongW GetClassNameW SetPropW ClientToScreen RemovePropW GetFocus SetFocus GetWindowTextW GetForegroundWindow GetLastActivePopup GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW MapWindowPoints SetForegroundWindow IsWindowVisible GetClientRect GetMenu PostMessageW GetSubMenu GetMenuItemID GetMenuItemCount MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx CopyRect PtInRect GetDlgCtrlID DefWindowProcW GetDC ReleaseDC BeginPaint EndPaint DestroyMenu LoadCursorW GetPropW GetSysColorBrush CallWindowProcW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow GetDesktopWindow GetActiveWindow SetActiveWindow GetSystemMetrics CreateDialogIndirectParamW DestroyWindow IsWindow GetWindowLongW GetDlgItem IsWindowEnabled GetParent GetNextDlgTabItem SendMessageW EndDialog EnumThreadWindows DispatchMessageW TranslateMessage GetMessageW UpdateWindow EnableWindow SetTimer GetKeyState UnregisterClassA

gdi32

SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible DeleteObject SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap GetObjectW SetBkColor SetTextColor GetClipBox

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegCloseKey RegQueryValueExW RegOpenKeyExW

shell32

SHGetFolderPathW

shlwapi

PathAppendW PathFileExistsW PathFindExtensionW PathFindFileNameW

oleaut32

VariantClear VariantChangeType VariantInit

$PLUGINSDIR/Live.dll

IMPHASH 3ec1562ecdfd7b5d4e954855b4d24533
SHA256 769d997cb76fbfe8bd4c716286c99b0321f1cd8c1a4e419b57a842082e2a2e29
MD5 3dc6cdde8c48bfcb2baee14dde26940f
SHA1 aab6d9a5f9d75703b080e0676a6b9da91e8e19d6
SHA512 87cdc07f6c74d624ad78f16e6516abd0d979faf65c9f82b8a8ef0c058816a253b6002efd16f9a4e14380a0d6cab1f3fd1107e728be775ae7e5c7737f906c6ce8
SSDEEP 6144:9G5ieoyu2aj0Kx/EICDCEj6PWfk/K2n3/1F91k1sBJEWl7vHy69ZAquia:9G4JEWl7vz9W9ia
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

91:74:76:92:69:ab:b2:cb:83:f5:25:ad:44:59:1b:ae:2f:43:c7:2d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 27, 2009

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

142695

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord826 ord600 ord1578 ord6467 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord825 ord1182 ord1577 ord1168 ord1575 ord1176 ord1116 ord1105 ord834 ord936 ord920 ord823 ord269

msvcrt

tolower ??0exception@@QAE@ABV0@@Z strspn strstr free strtok strtol atoi memmove sscanf wcslen _strdup __CxxFrameHandler _ftol _vsnprintf rand _adjust_fdiv malloc _initterm ??1type_info@@UAE@XZ _onexit __dllonexit strchr strncmp isspace isalnum isalpha fputc fseek ftell fread fclose fprintf atof fopen ??8type_info@@QBEHABV0@@Z memchr _snprintf _CxxThrowException ??0exception@@QAE@ABQBD@Z srand _purecall ??1exception@@UAE@XZ

kernel32

DuplicateHandle CloseHandle GetLastError GetCurrentProcessId GetTickCount OutputDebugStringA GetSystemTime GetSystemDirectoryA MapViewOfFile GetCurrentProcess CreateFileMappingA VirtualQuery GetModuleFileNameA FreeLibrary GetModuleHandleA GetPrivateProfileIntA LoadLibraryA GetProcAddress InterlockedDecrement TerminateProcess GetExitCodeThread TerminateThread UnmapViewOfFile LocalAlloc LocalFree WideCharToMultiByte GetACP lstrlenA MultiByteToWideChar lstrlenW CreateProcessA WaitForSingleObject

user32

DispatchMessageA GetMessageA KillTimer WaitForInputIdle SetTimer PostThreadMessageA TranslateMessage

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

ole32

CoCreateInstance

oleaut32

GetErrorInfo SetErrorInfo VariantChangeType CreateErrorInfo SysFreeString VariantClear VariantInit SysAllocStringByteLen SysStringByteLen SysAllocString

msvcp60

?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z ??1bad_cast@std@@UAE@XZ ??0bad_cast@std@@QAE@PBD@Z ??0?$ctype@D@std@@QAE@PBF_NI@Z ?_Iscloc@locale@std@@QBE_NXZ ?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z ??Bid@locale@std@@QAEIXZ ?id@?$ctype@D@std@@2V0locale@2@A ??1?$ctype@D@std@@UAE@XZ ??1ctype_base@std@@UAE@XZ ??_7bad_cast@std@@6B@ ??1_Locinfo@std@@QAE@XZ ?_Term@?$ctype@D@std@@KAXXZ ?_Cltab@?$ctype@D@std@@0PBFB _Getctype ??0_Locinfo@std@@QAE@PBD@Z ??_7?$ctype@D@std@@6B@ ??_7ctype_base@std@@6B@ ??_7facet@locale@std@@6B@ ?_Id_cnt@id@locale@std@@0HA ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?do_tolower@?$ctype@D@std@@MBEDD@Z ?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z ?do_toupper@?$ctype@D@std@@MBEDD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??_7runtime_error@std@@6B@ ??1runtime_error@std@@UAE@XZ ??0runtime_error@std@@QAE@ABV01@@Z ?what@runtime_error@std@@UBEPBDXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??0bad_cast@std@@QAE@ABV01@@Z ?_Doraise@runtime_error@std@@MBEXXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z ??_8?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@ ??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z ??_7?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_istream@DU?$char_traits@D@std@@@1@@ ??_8?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B?$basic_ostream@DU?$char_traits@D@std@@@1@@ ??0Init@ios_base@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Xlen@std@@YAXXZ ?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??1?$basic_filebuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ifstream@DU?$char_traits@D@std@@@std@@UAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?open@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@PBDH@Z ??_7?$basic_ifstream@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??_8?$basic_ifstream@DU?$char_traits@D@std@@@std@@7B@ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ ?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ??0?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Tidy@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXXZ ?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z ?_Mode@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEHH@Z ??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??0ios_base@std@@IAE@XZ ??1?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ??1locale@std@@QAE@XZ ??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ?_Decref@facet@locale@std@@QAEPAV123@XZ ?_Incref@facet@locale@std@@QAEXXZ ?_Global@_Locimp@locale@std@@0PAV123@A ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?str@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@HH@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAV?$basic_streambuf@DU?$char_traits@D@std@@@2@D@Z ??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z ?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBDI@Z ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??_7?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

ws2_32

gethostbyname inet_addr WSAStartup WSACleanup ntohs inet_ntoa

wininet

InternetTimeToSystemTimeA InternetTimeFromSystemTime

shlwapi

PathAppendA

$PLUGINSDIR/MP4Splitter.ax

IMPHASH 6a413d2443eac83c2997189f40595191
SHA256 050649bb8dc43e68753de7567e17972cbcec1a2dacf243befeb12dc51517f7cc
MD5 bb01bfdc1bfe48cf9c18180bf6539917
SHA1 25d0a11d31857fef74e9b98dcabd96f24d89c774
SHA512 f4fa00923ee61f0fcb53c8ebfd65b27db54a7663e5d60d8a56f7d08f33e2e1c467aa0b58899fbd62ac2261b185655cc94bac9ce85e2ed3b0c32336daa5346ba5
SSDEEP 12288:TwQ9eDwtt/jTdrBGg93e19FJdQXajEEWq7uTj6T9:0Q9eDwtZTdr47QXFJ9Tjc9
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

229428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Sources\mpc-hc\Subversion\tags\release_v1_3_1249_0\bin\x86\MP4Splitter.pdb

kernel32

GlobalAddAtomW WritePrivateProfileStringW TlsGetValue GlobalReAlloc GlobalHandle TlsAlloc TlsSetValue LocalReAlloc TlsFree SetErrorMode CompareStringW GetModuleHandleA GlobalFlags GetVersionExA LoadLibraryA GlobalFindAtomW HeapFree HeapAlloc RtlUnwind GetSystemTimeAsFileTime HeapReAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LocalAlloc QueryPerformanceCounter ExitProcess SetStdHandle GetFileType VirtualQuery HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate HeapDestroy GetStdHandle SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount GetTimeZoneInformation GetConsoleCP GetConsoleMode GetStringTypeA GetStringTypeW GetLocaleInfoA WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetEnvironmentVariableA GetFullPathNameW GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile ReadFile GetFileTime GetFileSizeEx GetFileAttributesW FileTimeToLocalFileTime FileTimeToSystemTime GetCurrentProcessId GlobalDeleteAtom ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree SetLastError DeleteFileW Sleep RaiseException GetModuleFileNameW CreateFileW GetVolumeInformationW FindFirstFileW FindClose DisableThreadLibraryCalls CreateThread GetVersionExW GetTickCount GetCurrentThread SetThreadPriority GetModuleHandleW GetProcAddress InterlockedExchange VirtualAlloc GetCurrentThreadId GetCurrentProcess DuplicateHandle VirtualFree WaitForSingleObject ResetEvent SetEvent CreateEventW CloseHandle lstrcmpW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection LoadLibraryW InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA GetLastError lstrlenA lstrlenW WideCharToMultiByte MultiByteToWideChar FindResourceW LoadResource LockResource SizeofResource GetCommandLineA

user32

ShowWindow LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClientRect CreateWindowExW GetClassInfoExW GetClassInfoW AdjustWindowRectEx DefWindowProcW CallWindowProcW CopyRect GetMenu SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect GetWindowTextW SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem CharUpperW DestroyMenu RegisterClassW GetSystemMetrics GetWindowThreadProcessId SendMessageW GetParent GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW UnhookWindowsHookEx PostMessageW PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu DispatchMessageW RegisterWindowMessageW PeekMessageW OffsetRect InflateRect SetRect IsRectEmpty

gdi32

SetWindowExtEx ScaleWindowExtEx DeleteDC GetStockObject SaveDC RectVisible ScaleViewportExtEx PtVisible CreateBitmap SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW RestoreDC GetDeviceCaps TranslateCharsetInfo DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor TextOutW

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueW RegEnumKeyW RegOpenKeyW RegQueryValueExW RegCreateKeyExW RegCreateKeyW RegSetValueW RegSetValueExW RegOpenKeyExW RegEnumKeyExW RegCloseKey RegDeleteKeyW

shlwapi

PathFindExtensionW PathIsUNCW PathStripToRootW PathFindFileNameW

ole32

StringFromGUID2 CoUninitialize CoFreeUnusedLibraries CoCreateInstance CoInitialize CoTaskMemFree CoTaskMemAlloc CLSIDFromString

oleaut32

SysAllocStringLen VariantChangeType SysAllocString SysFreeString VariantInit VariantClear

$PLUGINSDIR/MngModule.dll

IMPHASH 77e580ab607c48dfa294a5b7ae2f07dd
SHA256 4514c9cd5c1b8fbafaddaf74aae25c253bffb1a1de77f1191b5873e0cbb1bb3e
MD5 52d48f039b1271fe91c4a7275603c7bf
SHA1 e488ef8a8e5cb0fa37a4f706b66e63aa30fe725d
SHA512 0daa62cb92a887f1e5266fe25d18f291f87979c715a9f4b86de705ecfcefd1c08bc1e15b1e9df43d2d5dfec2bfebfd1964d0fde7f2121280b8a5f98693c3b127
SSDEEP 12288:vMMUbyO6atIvZrW4e0W2r8cEfycBnkmfF4qjsyOgn9tu6AwhFt:VvZyV2fstrsyOI9tu6AwhFt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

53:21:a1:58:eb:7c:d7:04:35:10:18:60:01:b8:cc:ba:58:bf:b2:0b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 4, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

5

Entry point

392716

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

i:\PPLive\PPTV\trunk\mngmodule\ReleaseU\mngmodule.pdb

kernel32

LocalFileTimeToFileTime SetFileAttributesW GetFileSizeEx GetModuleHandleA GetCurrentDirectoryW GlobalFlags GetVersionExA LoadLibraryA GlobalFindAtomW FreeResource HeapAlloc HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlUnwind GetSystemTimeAsFileTime VirtualProtect VirtualAlloc GetSystemInfo GetCommandLineA HeapReAlloc ExitProcess ExitThread HeapSize SetStdHandle GetFileType FatalAppExitA VirtualFree HeapCreate HeapDestroy GetStdHandle GetCPInfo GetAtomNameW GetOEMCP IsValidCodePage LCMapStringA LCMapStringW GetTimeZoneInformation SetHandleCount GetStartupInfoA GetConsoleCP GetConsoleMode GetTimeFormatA GetDateFormatA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter SetConsoleCtrlHandler InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA SetCurrentDirectoryA GetDriveTypeA GetFullPathNameA GetProcessHeap SetEnvironmentVariableA GlobalGetAtomNameW CompareStringW SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue GlobalAddAtomW SuspendThread SetThreadPriority GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange lstrcmpW WaitForMultipleObjects ReleaseMutex ReleaseSemaphore CreateSemaphoreW FindNextFileW GetShortPathNameW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetFileSize SetEndOfFile UnlockFile LockFile SetFilePointer GetThreadLocale GetStringTypeExW MoveFileW GlobalFree GlobalSize GlobalAlloc GlobalLock GlobalUnlock FormatMessageW MulDiv SetLastError VirtualQuery ReadFile GetTempPathW GetTempFileNameW FlushFileBuffers SetFileTime ResetEvent CreateMutexW DuplicateHandle InterlockedDecrement InterlockedIncrement LocalAlloc LocalFree DeleteCriticalSection InitializeCriticalSection CreateEventW WritePrivateProfileStringW ResumeThread LoadLibraryExW SetEvent GetFileAttributesW lstrcmpiW GetExitCodeThread TerminateThread CreateThread LeaveCriticalSection EnterCriticalSection RaiseException GetCurrentProcess GetCurrentThreadId Sleep LoadLibraryW GetEnvironmentVariableW CreateProcessW WaitForSingleObject TerminateProcess GetEnvironmentVariableA LoadLibraryExA GetProcAddress FreeLibrary CreateFileW WriteFile CreateFileA CloseHandle GetModuleHandleW GetModuleFileNameA GetVersionExW DeviceIoControl GetModuleFileNameW OutputDebugStringW CopyFileW GetPrivateProfileIntW GetPrivateProfileStringW SystemTimeToFileTime GetCurrentProcessId GetTickCount GetCommandLineW DeleteFileW lstrlenW lstrlenA GetFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetSystemTime FindResourceW LoadResource LockResource SizeofResource GetLastError WideCharToMultiByte GetACP MultiByteToWideChar

user32

TranslateAcceleratorW GetDialogBaseUnits InvalidateRect SetRectEmpty CreateDialogIndirectParamW GetNextDlgTabItem EndDialog SystemParametersInfoW DestroyMenu GetMenuItemInfoW InflateRect ScrollWindowEx ShowWindow MoveWindow IsDialogMessageW IsDlgButtonChecked SetDlgItemTextW SetDlgItemInt GetDlgItemTextW GetDlgItemInt CheckRadioButton CheckDlgButton RegisterWindowMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetClassLongW SetPropW GetPropW RemovePropW SetFocus GetForegroundWindow SetActiveWindow BeginDeferWindowPos EndDeferWindowPos GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints ScrollWindow TrackPopupMenuEx TrackPopupMenu SetMenu SetScrollRange GetScrollRange SetScrollPos GetScrollPos SetForegroundWindow ShowScrollBar UpdateWindow GetClientRect CreateWindowExW BringWindowToTop GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect DeferWindowPos GetScrollInfo SetScrollInfo CopyRect SetWindowPlacement DefWindowProcW CallWindowProcW GetMenu SetWindowLongW SetWindowPos OffsetRect IntersectRect SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetDlgCtrlID GetWindowRect WaitForInputIdle GetMessageW DispatchMessageW IsWindow GetClassNameW PtInRect SetWindowTextW DeleteMenu EndPaint BeginPaint GetWindowDC ClientToScreen ScreenToClient GrayStringW DrawTextExW DrawTextW TabbedTextOutW FillRect DestroyIcon GetWindowTextLengthW GetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW GetDesktopWindow GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow CreatePopupMenu InsertMenuItemW LoadAcceleratorsW MapVirtualKeyW ReleaseCapture GetMenuBarInfo LoadMenuW ReuseDDElParam UnpackDDElParam SetRect WindowFromPoint GetKeyNameTextW SetCapture LockWindowUpdate GetDCEx UnionRect SetParent GetSystemMenu IsRectEmpty GetClassInfoExW CharNextW SendMessageTimeoutW PostThreadMessageW wsprintfW KillTimer SetTimer RemoveMenu GetSubMenu GetMenuItemCount InsertMenuW GetMenuItemID AppendMenuW GetMenuStringW GetMenuState GetSystemMetrics CharUpperW UnhookWindowsHookEx MsgWaitForMultipleObjects PostQuitMessage PostMessageW CheckMenuItem EnableMenuItem ModifyMenuW SendMessageW GetParent GetFocus MessageBoxW ShowOwnedPopups SetCursor SetWindowsHookExW CallNextHookEx TranslateMessage GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetCapture

gdi32

CombineRgn GetMapMode PatBlt DPtoLP GetTextExtentPoint32W SetRectRgn CreateFontW StretchDIBits CreateCompatibleBitmap GetTextMetricsW GetBkColor CreateFontIndirectW CreateRectRgnIndirect GetDCOrgEx CreateHatchBrush CreateSolidBrush ExtCreatePen CreatePen PlayMetaFile EnumMetaFile GetObjectType PlayMetaFileRecord SelectPalette GetStockObject CreateCompatibleDC CreatePatternBrush CreateDIBPatternBrushPt DeleteDC ExtSelectClipRgn PolyBezierTo PolylineTo PolyDraw ArcTo GetCurrentPositionEx ScaleWindowExtEx SetWindowExtEx OffsetWindowOrgEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx GetCharWidthW GetDeviceCaps SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible PtVisible StartDocW GetPixel BitBlt GetWindowExtEx GetViewportExtEx GetObjectW SelectClipPath CreateRectRgn GetClipRgn SelectClipRgn DeleteObject SetColorAdjustment SetArcDirection SetMapperFlags SetTextCharacterExtra SetTextJustification SetTextAlign MoveToEx LineTo OffsetClipRgn IntersectClipRect ExcludeClipRect GetClipBox SetMapMode ModifyWorldTransform SetWorldTransform SetGraphicsMode SetTextColor SetStretchBltMode SetROP2 SetPolyFillMode SetBkMode SetBkColor RestoreDC SaveDC CreateBitmap CreateDCW CopyMetaFileW OffsetViewportOrgEx

comdlg32

GetFileTitleW

winspool.drv

ClosePrinter OpenPrinterW DocumentPropertiesW

advapi32

RegQueryValueW RegEnumKeyW RegOpenKeyW RegSetValueW GetNamedSecurityInfoW SetNamedSecurityInfoW GetSecurityInfo BuildExplicitAccessWithNameW SetEntriesInAclW SetSecurityInfo RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges InitializeSecurityDescriptor SetSecurityDescriptorDacl OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegEnumKeyExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyW

shell32

CommandLineToArgvW SHGetFolderPathA SHGetFolderPathW SHGetFileInfoW ExtractIconW DragFinish DragQueryFileW ord165

shlwapi

PathAppendW PathFileExistsW PathFindExtensionW PathFindFileNameW PathRemoveFileSpecW PathAppendA PathStripToRootW PathIsUNCW PathRemoveExtensionW UrlUnescapeW StrStrIW

ole32

CoDisconnectObject CLSIDFromString CoInitializeEx CreateBindCtx CoTaskMemFree CoUninitialize CoInitialize CoCreateInstance CLSIDFromProgID CoRevokeClassObject CoRegisterClassObject CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoSuspendClassObjects SetConvertStg WriteFmtUserTypeStg WriteClassStg OleRegGetUserType ReadFmtUserTypeStg ReadClassStg ReleaseStgMedium StringFromCLSID CoTreatAsClass OleDuplicateData

oleaut32

SystemTimeToVariantTime SysFreeString SysAllocString VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SafeArrayGetLBound SafeArrayGetDim SysStringLen VariantClear SysAllocStringByteLen SysStringByteLen VarUI4FromStr SysAllocStringLen LoadTypeLi UnRegisterTypeLi RegisterTypeLi LoadRegTypeLi SafeArrayGetElemsize SafeArrayCreate SafeArrayRedim VariantChangeType VariantCopy SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayCopy SafeArrayGetElement SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayLock SafeArrayUnlock SafeArrayDestroy SafeArrayDestroyData SafeArrayDestroyDescriptor VarDateFromStr SysReAllocStringLen VarCyFromStr VarBstrFromCy VarBstrFromDec VarDecFromStr VarBstrFromDate VariantTimeToSystemTime

urlmon

RegisterBindStatusCallback CreateURLMoniker RevokeBindStatusCallback

wininet

InternetOpenUrlW GopherOpenFileW FtpFindFirstFileW GopherCreateLocatorW FtpCommandW FtpOpenFileW GopherGetAttributeW HttpSendRequestExW HttpEndRequestW InternetWriteFile InternetSetFilePointer InternetSetStatusCallbackW InternetGetLastResponseInfoW GopherFindFirstFileW InternetFindNextFileW HttpAddRequestHeadersW InternetErrorDlg FtpGetFileW FtpPutFileW FtpGetCurrentDirectoryW FtpSetCurrentDirectoryW FtpRemoveDirectoryW FtpCreateDirectoryW FtpRenameFileW FtpDeleteFileW InternetQueryDataAvailable InternetGetCookieW InternetSetCookieW InternetSetOptionExW InternetQueryOptionW InternetCanonicalizeUrlW InternetTimeToSystemTimeW DeleteUrlCacheEntryW InternetCloseHandle InternetReadFile HttpQueryInfoA HttpQueryInfoW HttpSendRequestW HttpOpenRequestW InternetConnectW InternetOpenW InternetCrackUrlW

psapi

GetProcessMemoryInfo

$PLUGINSDIR/OPlayer.ocx

IMPHASH 256ffd0333d26fb8086db9b1e070ff45
SHA256 ca328d40be9933e28b7f51230f5e19611ea2d4c438a152fa9190641e0c01a5f2
MD5 025a1f05dea5771611e075857598a769
SHA1 4798950c473ff8fd3ff5d546395f41b9588faca9
SHA512 be807ebd552fb3040f1328bcb47d0eed784aee13611599c9ff0e413d656297b292d44af158645fba4d5507f4bdb03e1247ccd0824cbb5e21c9e3b2487dc7e31a
SSDEEP 24576:r4cV+fZ3m5zOrPk/mn9FDIr9Ht6r6BrR/fFI+Mjc++6rZHr7o:rnTOn9xA9NamrR/fvMjyYZL7o
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d6:74:2b:2b:e8:01:f0:7b:f1:84:7d:f3:48:e4:3b:bb:f6:7d:8d:7b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 1, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

5

Entry point

325270

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\PPLive\2008\splayer\splayer\Release\oplayer.pdb

kernel32

CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetStringTypeA InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount LCMapStringA IsValidCodePage GetOEMCP GetACP GetCPInfo GetStdHandle HeapCreate QueryPerformanceCounter ExitProcess GetCommandLineA GetSystemTimeAsFileTime VirtualQuery VirtualProtect IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind GetSystemInfo GetModuleFileNameA DisableThreadLibraryCalls VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy GetLocaleInfoW GetModuleHandleA FlushFileBuffers WriteFile GlobalFlags GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom lstrcmpW GetVersionExA lstrcmpA TlsFree GlobalFree LocalReAlloc TlsSetValue TlsAlloc GlobalAlloc GlobalHandle GlobalUnlock GlobalReAlloc GlobalLock TlsGetValue LocalFree LocalAlloc GetTickCount lstrlenA GetSystemDirectoryA LoadLibraryA WideCharToMultiByte Sleep WaitForMultipleObjects InterlockedExchange ResetEvent SetThreadPriority GetVersionExW MulDiv SetLastError GetCurrentProcess FlushInstructionCache CreateThread FreeLibraryAndExitThread SetEvent CreateEventW OutputDebugStringW WaitForSingleObject GetCurrentThreadId CreateFileW CloseHandle GetFileSize SetFilePointer ReadFile FindResourceExW LockResource LoadLibraryW GetCurrentProcessId GetThreadLocale SetThreadLocale LoadLibraryExW FindResourceW LoadResource SizeofResource MultiByteToWideChar FreeLibrary InterlockedDecrement lstrlenW InterlockedIncrement GetModuleHandleW GetProcAddress GetModuleFileNameW lstrcmpiW GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException LCMapStringW

user32

GetForegroundWindow GetDlgItem GetTopWindow GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetClassInfoW AdjustWindowRectEx GetDlgCtrlID CopyRect PtInRect GetMenu SetWindowPos RemovePropW GetPropW SetPropW GetClassLongW GetCapture UnregisterClassA CharNextW wsprintfW SetWindowLongW GetWindowLongW CallWindowProcW DefWindowProcW GetClassNameW IsWindow UnregisterClassW CreateWindowExW RegisterClassW DestroyWindow GetWindowThreadProcessId RegisterWindowMessageW MsgWaitForMultipleObjects DispatchMessageW TranslateMessage PeekMessageW PostMessageW GetClassInfoExW LoadCursorW RegisterClassExW SetRectEmpty IntersectRect WinHelpW LoadIconW SetWindowTextW ClientToScreen DestroyMenu TabbedTextOutW DrawTextW DrawTextExW GrayStringW PostQuitMessage EqualRect GetClientRect IsRectEmpty InvalidateRect SetTimer KillTimer BeginPaint EndPaint UnhookWindowsHookEx MessageBoxW EnableWindow IsWindowEnabled GetLastActivePopup GetParent SendMessageW GetSubMenu GetMenuItemCount GetMenuItemID GetMenuState ValidateRect GetKeyState SystemParametersInfoA IsIconic GetWindowPlacement GetWindowRect GetWindow SetMenuItemBitmaps GetMenuCheckMarkDimensions CallNextHookEx SetWindowsHookExW GetSysColorBrush GetSysColor LoadBitmapW GetFocus ModifyMenuW EnableMenuItem CheckMenuItem GetWindowTextW GetSystemMetrics GetDC ReleaseDC

gdi32

PtVisible RectVisible TextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx SetMapMode GetStockObject RestoreDC SaveDC SetTextColor GetClipBox DeleteObject ExtTextOutW SetBkColor DeleteDC GetDeviceCaps ScaleWindowExtEx CreateBitmap

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

RegCreateKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegQueryInfoKeyW RegDeleteKeyW RegSetValueW RegQueryValueExW RegEnumKeyExW

ole32

CoInitializeEx CoUninitialize CLSIDFromString GetRunningObjectTable CreateItemMoniker CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoFreeUnusedLibraries CoInitialize

oleaut32

SysStringLen SysFreeString SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VariantInit VariantClear LoadRegTypeLi VariantChangeType SysAllocStringLen VariantCopy

shlwapi

StrStrIW PathRemoveFileSpecW PathAppendW PathFindExtensionW

wininet

InternetCrackUrlW

ws2_32

WSAStartup connect socket closesocket WSASetLastError ntohs getservbyport gethostbyaddr send getservbyname htonl inet_ntoa gethostbyname WSAGetLastError inet_addr WSACleanup recv __WSAFDIsSet htons select

uilib

inflateEnd inflateInit2_ inflate

oleacc

LresultFromObject CreateStdAccessibleObject

$PLUGINSDIR/PPAP.exe

IMPHASH 8b09590074c9596dc529d255269e0815
SHA256 631ff4824532ef5fe018eeb95303f9207c55a1c744823a79ee5904c5683ba2c2
MD5 71d558d35fccffa53e6d6414bbf91de3
SHA1 4f484219296fdb004168f8b875dc878f3ff6d392
SHA512 2cfa44c0d354d4ba311a7a9fb7fd4c866c0a8f44632f9a0ead22e286f603c89dcb5b6c389f542c18848a256378229014b7cfdcc9206c78f2cb6dda17b9de211a
SSDEEP 3072:5OByJF8UBy2zneJDQpiEIII1IIaVkbAGAdzB3Yt/nGxn8:jn8Uo2znaQgEIII1IIaVBGM3Zx8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b1:8d:92:46:7c:9b:bc:d9:ea:1d:6e:30:86:d6:f5:5d:b3:25:0c:f5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Apr 6, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

27276

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadLibraryA GetCurrentProcessId GetLocalTime GetTempPathA Module32NextW GetLongPathNameA Module32FirstW CreateToolhelp32Snapshot GetLastError lstrcatA lstrcpyA VirtualQuery FindFirstFileA GetCommandLineA GetCurrentProcess ReleaseMutex CreateMutexW OpenProcess GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW lstrlenW WaitForSingleObject GetVersionExW CreateProcessW LocalFree LocalAlloc GetModuleHandleW GetStartupInfoW CloseHandle OutputDebugStringA GetModuleFileNameA GetModuleFileNameW GetEnvironmentVariableA GetPrivateProfileStringA CreateProcessA TerminateProcess SetUnhandledExceptionFilter FreeLibrary LoadLibraryW GetProcAddress GetCommandLineW GetCurrentThread GetCurrentThreadId CreateFileA GetFileSize CreateFileMappingW MapViewOfFile IsBadReadPtr CreateEventW lstrcmpiW

user32

GetDesktopWindow wsprintfW GetWindowThreadProcessId GetShellWindow

advapi32

SetTokenInformation ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges DuplicateTokenEx OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegDeleteKeyW RegDeleteValueW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCreateKeyExW RegCloseKey InitializeSecurityDescriptor SetSecurityDescriptorDacl GetLengthSid ConvertStringSidToSidW SetThreadToken

shell32

CommandLineToArgvW SHGetFolderPathA

ole32

CoUninitialize CoCreateInstance CoInitialize CoCreateGuid StringFromCLSID

msvcp60

_Getcvt ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z ??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z ?_Id_cnt@id@locale@std@@0HA ??_7codecvt_base@std@@6B@ ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@IIABV?$allocator@G@1@@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ??0_Locinfo@std@@QAE@PBD@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Xlen@std@@YAXXZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?do_length@?$codecvt@GDH@std@@MBEHAAHPBG1I@Z ?do_out@?$codecvt@GDH@std@@MBEHAAHPBG1AAPBGPAD3AAPAD@Z ?do_in@?$codecvt@GDH@std@@MBEHAAHPBD1AAPBDPAG3AAPAG@Z ?do_encoding@?$codecvt@GDH@std@@MBEHXZ ?do_max_length@?$codecvt@GDH@std@@MBEHXZ ?do_always_noconv@?$codecvt@GDH@std@@MBE_NXZ ??0bad_cast@std@@QAE@ABV01@@Z ??1bad_cast@std@@UAE@XZ ??0locale@std@@QAE@XZ ??1locale@std@@QAE@XZ ?_Incref@facet@locale@std@@QAEXXZ ??0bad_cast@std@@QAE@PBD@Z ?out@?$codecvt@GDH@std@@QBEHAAHPBG1AAPBGPAD3AAPAD@Z ??0?$codecvt@GDH@std@@QAE@I@Z ?_Iscloc@locale@std@@QBE_NXZ ?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z ??Bid@locale@std@@QAEIXZ ?id@?$codecvt@GDH@std@@2V0locale@2@A ??1_Lockit@std@@QAE@XZ ?_Global@_Locimp@locale@std@@0PAV123@A ??0_Lockit@std@@QAE@XZ ?_Init@locale@std@@CAPAV_Locimp@12@XZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??_7facet@locale@std@@6B@ ??_7?$codecvt@GDH@std@@6B@ ?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z ??_7bad_cast@std@@6B@ ??1_Locinfo@std@@QAE@XZ ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

msvcrt

_wcsicmp _controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __wgetmainargs _wcmdln exit wcslen _snprintf ??2@YAPAXI@Z fclose fflush sprintf _except_handler3 vfprintf ??0exception@@QAE@ABV0@@Z fopen toupper _CxxThrowException strncpy __p___wargv __p___argc ??0exception@@QAE@ABQBD@Z free _wcsdup _XcptFilter wcscpy __dllonexit _onexit ??1type_info@@UAE@XZ _exit

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

shlwapi

PathRemoveFileSpecW PathAppendA PathRemoveFileSpecA PathAppendW PathFindFileNameA PathStripPathW

$PLUGINSDIR/PPHookShell.dll

IMPHASH f61b7d78068048549d605134de104dc6
SHA256 e0596457bec914a3281ad614a23c1c3c11bd9c95ddabf090d68d3bca4854c92a
MD5 f9b346bcfec4605755d4435e8eac34a1
SHA1 f694ece30381ca9dc37e18030454a56a737ce4a4
SHA512 60a17bd0b971690818b26e45ee8ca335e3b1820ac73d229f54b55b2e23acb051a45c00275a5ea1b35ac1caf2d1626fed34f0296fc8d7a41b0139b0aa0e226e7b
SSDEEP 3072:LZFvombK4A6NvgJvcYwUuSaEwTG4SJK7hqmYLzhJR7CIgNldwr73GPAG3StoIZTx:rKI5UcdUuSaEwa4S0qmATpHgNTljIBF
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

79:d9:a7:d3:c9:48:dd:eb:3d:a8:9f:20:99:3e:44:db:99:de:60:b8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Apr 27, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

76411

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Documents and Settings\Administrator\桌面\projectout\PPHookShell.pdb

kernel32

GetCurrentProcess TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread CreateDirectoryW GetCommandLineA HeapFree HeapAlloc GetProcessHeap RtlUnwind RaiseException HeapReAlloc ExitProcess HeapSize GetCPInfo GetOEMCP LCMapStringA FlushFileBuffers GetLocaleInfoA GetStringTypeA GetStringTypeW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime VirtualAlloc GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA SetFilePointer WriteFile ReadFile GlobalFindAtomW LoadLibraryA GetVersionExA GetModuleHandleA GlobalFlags WritePrivateProfileStringW GetThreadLocale InterlockedIncrement SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GlobalAddAtomW ResumeThread GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange lstrcmpW GlobalDeleteAtom GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW GetCurrentThreadId GetProcAddress Module32NextW Module32FirstW CreateToolhelp32Snapshot OpenProcess GetEnvironmentVariableW GetPrivateProfileIntW GetPrivateProfileStringW MultiByteToWideChar GetACP WideCharToMultiByte Sleep GetCurrentProcessId CloseHandle FindResourceW LoadResource LockResource SizeofResource GetModuleHandleW GetModuleFileNameW FreeLibrary LCMapStringW LoadLibraryW

user32

RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect SetWindowTextW GetWindowTextW LoadCursorW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled ShowWindow DestroyMenu EnableWindow MessageBoxW SetCursor GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW EnableMenuItem CheckMenuItem PostMessageW PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu SetWindowsHookExW CallNextHookEx UnregisterClassA

gdi32

ScaleWindowExtEx DeleteDC GetStockObject SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetDeviceCaps GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC DeleteObject CreateBitmap PtVisible

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegCloseKey RegOpenKeyExW

shell32

SHGetFolderPathW

shlwapi

PathFileExistsW PathAppendW PathFindExtensionW PathFindFileNameW

oleaut32

VariantInit VariantClear VariantChangeType

psapi

EnumProcessModules GetModuleBaseNameW

$PLUGINSDIR/Send_Log_Kernel_Module.dll

IMPHASH 43e12366080d2670a77e2262b7a2a482
SHA256 8cc9bc4f9289ef37d344c88e4b53ce5ca58b11ec1e32d60fc9fd6456a80f1233
MD5 7d1dbe3c735d2a5d4951022c45547772
SHA1 e6fbebc3c185d6b150bc7b2a9d1685e107b03b3e
SHA512 648299ee0b0c2678d9da43ca039fcf8525e9921b46327577fa6c57f0de41f5ccecda70e219a0135fb8c05725a752e7e2cdf27bad845203eb5147d3056e588086
SSDEEP 6144:kQ4Xli0q/zL8eVC0RmtrC3mVe9IMv1cWzES179Tm:kQ4igrCWVe9zaWzD9Tm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

11:e4:43:bf:8d:54:30:a5:c0:64:81:f7:ba:3a:a8:aa:9d:54:f5:4c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jan 29, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

73439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\PPVA\project\Send_Log\Send_Log_Kernel_Module\Release\Send_Log_Kernel_Module.pdb

kernel32

HeapAlloc TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree GetProcessHeap HeapReAlloc RtlUnwind RaiseException ExitProcess HeapSize VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle GetModuleFileNameA Sleep GetCPInfo IsValidCodePage LCMapStringA LCMapStringW GetLocaleInfoA GetStringTypeA GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFindAtomW LoadLibraryA GetVersionExA GlobalFlags GetModuleHandleA WritePrivateProfileStringW InterlockedIncrement GetThreadLocale SetErrorMode TlsFree DeleteCriticalSection LocalReAlloc TlsSetValue TlsAlloc InitializeCriticalSection GlobalHandle GlobalReAlloc EnterCriticalSection TlsGetValue LeaveCriticalSection LocalAlloc InterlockedDecrement GetCurrentProcessId GlobalAddAtomW GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale GetVersion EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange lstrcmpW GetLastError SetLastError GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW FindResourceW LoadResource LockResource SizeofResource MultiByteToWideChar GetACP WideCharToMultiByte LoadLibraryW FreeLibrary GetProcAddress GetModuleHandleW GetModuleFileNameW GetVersionExW CloseHandle DeviceIoControl GetOEMCP CreateFileW

user32

ShowWindow RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetWindowRect GetClassNameW PtInRect SetWindowTextW ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush GetWindowTextW UnregisterClassW UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW DestroyMenu GetClassInfoW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW EnableMenuItem CheckMenuItem PostMessageW PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetDlgCtrlID UnregisterClassA

gdi32

ScaleWindowExtEx DeleteDC GetStockObject SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetDeviceCaps DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap PtVisible

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegOpenKeyW RegCloseKey

shlwapi

PathFindExtensionW PathFindFileNameW

oleaut32

VariantInit VariantClear VariantChangeType

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/TipsClient.dll

IMPHASH 06ad09e6be2147029215bcc7830d3de7
SHA256 03f74518c3d95f51d7551cd0c39eeba2121a39ebf5ae441ba7200530f7e5b14d
MD5 cb8db32a0dd94c29baf95f5abfb5b12d
SHA1 e2e0ae5d46c8ec6a0bb82771efbdf3ec56913ae6
SHA512 34f962c40d9978c0b2ef759d0c6cf752a610379f04a8f4219bac36e4b9c7f8ad767b76ce4d17842a02b30d3026767bf1c8e65722e17aea4b5f1b551dd0a334bb
SSDEEP 3072:3uZPTECke/IWFgjpm4pzPyeTbIHX6kjPq5nR/RQQ/0yowydL/:C4xmIu6E4pzKibIHXT9Q/0yhydL/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3b:3f:ef:4b:64:5d:f2:b2:09:88:60:21:e5:5e:d7:87:ff:bc:59:54

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Dec 7, 2009

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

110261

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

winmm

PlaySoundA PlaySoundW

shlwapi

StrStrIA StrStrIW PathIsDirectoryA

mfc42

ord1233 ord6467 ord858 ord539 ord3005 ord535 ord6453 ord1949 ord4034 ord815 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord4079 ord4698 ord5307 ord5714 ord4622 ord3738 ord561 ord1134 ord2725 ord1575 ord1168 ord5289 ord5810 ord5481 ord2031 ord4863 ord5796 ord5478 ord1971 ord966 ord3570 ord278 ord605 ord2077 ord6221 ord1639 ord2152 ord826 ord600 ord1578 ord1255 ord1253 ord1570 ord1197 ord1243 ord342 ord1182 ord1577 ord1176 ord1116 ord1567 ord823 ord825 ord2393 ord268 ord1105 ord1247 ord5645 ord665 ord1979 ord3318 ord353 ord668 ord2770 ord356 ord924 ord800 ord537 ord2124 ord3742 ord6055 ord4078 ord1776 ord4407 ord5241 ord6442 ord2379 ord2688 ord4275 ord2135 ord567 ord540 ord818 ord4424 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord3402 ord2976 ord3081 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5290 ord4353 ord6374 ord5163 ord2385 ord269

msvcrt

sprintf strrchr strncpy __CxxFrameHandler _wcsicmp _wcsnicmp fflush _iob printf _vsnprintf tolower rand srand sscanf _purecall _adjust_fdiv _initterm ?terminate@@YAXXZ _onexit __dllonexit ??1type_info@@UAE@XZ wcscmp ??8type_info@@QBEHABV0@@Z _snwprintf memmove wcscpy memchr malloc _mbsicmp _snprintf free freopen ??0exception@@QAE@ABV0@@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z _CxxThrowException _except_handler3

kernel32

InterlockedCompareExchange ResumeThread VirtualQuery FlushInstructionCache GetThreadContext SetThreadContext GetLastError SuspendThread VirtualProtect CreateEventA LocalAlloc LocalFree WideCharToMultiByte lstrcatA lstrcpyA GetShortPathNameA GetCommandLineA HeapDestroy EnterCriticalSection LeaveCriticalSection lstrlenW lstrlenA DeleteCriticalSection InitializeCriticalSection GetSystemInfo CreateDirectoryA LoadLibraryA GetProcAddress FreeLibrary GetCurrentThreadId InterlockedDecrement GetEnvironmentVariableA CreateProcessA OutputDebugStringA GetExitCodeThread WaitForSingleObject TerminateThread GetCurrentProcess DuplicateHandle VirtualAlloc MultiByteToWideChar GetTickCount CreateToolhelp32Snapshot Process32First Process32Next GetTempPathA WriteFile FlushFileBuffers WinExec TlsFree GetModuleFileNameW TlsAlloc TlsSetValue InterlockedIncrement GetCurrentThread Sleep SetLastError lstrcmpA lstrcmpiA CreateFileW GetModuleHandleA GetModuleFileNameA GetVersionExA CreateFileA DeviceIoControl CloseHandle

user32

GetClassNameA GetLastInputInfo GetMessageA GetWindowTextA PostThreadMessageA TranslateMessage DispatchMessageA GetSystemMetrics EnableWindow LoadCursorA LoadIconA SetTimer KillTimer ShowWindow CharNextA

gdi32

GetStockObject

advapi32

RegQueryValueExA RegCloseKey RegOpenKeyExA RegEnumKeyExA

ole32

CoCreateInstance CoTaskMemAlloc CoUninitialize CoInitialize

oleaut32

RegisterTypeLi LoadTypeLi LoadRegTypeLi SysAllocString VariantClear SysFreeString SysStringLen SysAllocStringLen

urlmon

URLDownloadToFileA URLDownloadToCacheFileA

wsock32

listen setsockopt getsockname WSAGetLastError ioctlsocket gethostbyname ntohs accept htons inet_addr getpeername

msvcp60

??_7out_of_range@std@@6B@ ??1out_of_range@std@@UAE@XZ ??0out_of_range@std@@QAE@ABV01@@Z ??0logic_error@std@@QAE@ABV01@@Z ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z ?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB ?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z ?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z ?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??_7runtime_error@std@@6B@ ??1runtime_error@std@@UAE@XZ ?what@runtime_error@std@@UBEPBDXZ ?_Doraise@runtime_error@std@@MBEXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??_7overflow_error@std@@6B@ ??1overflow_error@std@@UAE@XZ ??0overflow_error@std@@QAE@ABV01@@Z ??0runtime_error@std@@QAE@ABV01@@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?_Xran@std@@YAXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ??_8?$basic_ofstream@DU?$char_traits@D@std@@@std@@7B@ ??0ios_base@std@@IAE@XZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ??0?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAE@PAU_iobuf@@@Z ??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@ ?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z ?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?clear@ios_base@std@@QAEXH_N@Z ??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@ ?close@?$basic_filebuf@DU?$char_traits@D@std@@@std@@QAEPAV12@XZ ??1locale@std@@QAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1ios_base@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Xlen@std@@YAXXZ ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ??0Init@ios_base@std@@QAE@XZ

wininet

DeleteUrlCacheEntry

$PLUGINSDIR/VAProxyD.dll

IMPHASH c3502aeb4d5cff18ed59ececfbd2c70f
SHA256 9815ad2348838ed36bbaf50ead9840afb00dedf923e710ee9f3ebb1b1ddbc7d6
MD5 8bc6a1a2e05d0d638e36644378fd4d5f
SHA1 a0242ae90fe80cc7e04591d98165e4498fc18e31
SHA512 2723c27b8f505e736d303b3ddd23c39dc5595c9646d06ea8deacad640112ecaf667ad071006550f7d14706f7613d5b09cd460ba91c573f0f42bb7b0c816c7f80
SSDEEP 3072:r+nWC/MLR59W5F0thOOXpNNfr8LDoe+ZUI2SzhgoyjK3EyHQRgZTpwr739VgLDBl:2kU34hxNNfrmDOmpKoRgXHHBVK5e
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

c9:69:c1:48:34:22:ec:d1:cb:9f:14:b5:5f:e2:0f:94:82:32:ad:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Apr 23, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

98423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Documents and Settings\Administrator\桌面\projectout\VAProxyD.pdb

kernel32

TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapFree HeapAlloc GetProcessHeap RtlUnwind RaiseException ExitProcess HeapReAlloc HeapSize GetCPInfo GetACP GetOEMCP LCMapStringA LCMapStringW SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetConsoleCP GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime VirtualAlloc GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFindAtomW LoadLibraryA GetVersionExA GetModuleHandleA GlobalFlags WritePrivateProfileStringW SetErrorMode LocalReAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc InterlockedDecrement GetCurrentProcessId GlobalAddAtomW SuspendThread ResumeThread GetCurrentThreadId ConvertDefaultLocale GetVersion EnumResourceLanguagesW VirtualQuery InterlockedCompareExchange VirtualProtect FlushInstructionCache GetThreadContext SetThreadContext GetLocaleInfoW WideCharToMultiByte MultiByteToWideChar InterlockedExchange lstrcmpW FreeLibrary GlobalDeleteAtom GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree lstrlenW Sleep LockResource GetSystemInfo GetVersionExW GetEnvironmentVariableW GetProcAddress GetModuleHandleW SizeofResource LoadResource FindResourceW TlsFree TlsAlloc InterlockedIncrement TlsSetValue GetCurrentThread SetLastError CloseHandle CreateThread GetThreadLocale CompareStringA GetLastError LoadLibraryExW LoadLibraryW GetModuleFileNameW LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GetConsoleMode InitializeCriticalSection

user32

ShowWindow RegisterWindowMessageW LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GrayStringW DrawTextExW DrawTextW TabbedTextOutW ClientToScreen GetWindow GetDlgCtrlID GetWindowRect GetClassNameW PtInRect GetWindowTextW SetWindowTextW LoadCursorW GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW UnhookWindowsHookEx GetWindowThreadProcessId GetWindowLongW GetLastActivePopup DestroyMenu GetClassInfoExW IsWindowEnabled EnableWindow MessageBoxW SetCursor GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState PeekMessageW GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent ModifyMenuW EnableMenuItem CheckMenuItem PostMessageW PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetSystemMetrics SetWindowsHookExW CallNextHookEx SendMessageW FindWindowW UnregisterClassA

gdi32

ScaleWindowExtEx DeleteDC GetStockObject SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW RectVisible GetDeviceCaps GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC DeleteObject CreateBitmap PtVisible

winspool.drv

DocumentPropertiesW OpenPrinterW ClosePrinter

advapi32

RegSetValueExW RegCreateKeyExW RegQueryValueW RegEnumKeyW RegDeleteKeyW RegOpenKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW PathAppendW PathFindExtensionW

oleaut32

VariantInit VariantClear VariantChangeType

ws2_32

accept __WSAFDIsSet select inet_addr WSAEventSelect WSAIoctl WSASocketW WSAAsyncSelect WSAConnect connect recv send socket setsockopt getsockname ntohs inet_ntoa getpeername htonl htons bind listen shutdown closesocket ioctlsocket

$PLUGINSDIR/admodule.dll

IMPHASH 4d55505fec9adbcb0729d379175c53d4
SHA256 ae2cd64d97249da8d96182a0f6f6611119524e995908c47d84a7277f57f48304
MD5 cc07f2797fb239fe4984f04793dec07b
SHA1 4a91fc86643d5630825f45afe9a2af09faf4faa6
SHA512 355d7de958587d483bc2ad2e8d32c4e89541a60c240190373fd0188a8ef89eab6dba6d6060423376dd4f254558c374a10bf75f473a9f9a9b302669f22f3b251b
SSDEEP 12288:v4of8exiO3+HBM2JKWseet6WtljmvJhMl0Wi7XOr8uN9/EAzmWqX2O9:vnEciZm28Ws1pm6l0f7WrNJE9GO9
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

40:00:df:fa:0c:59:1b:51:a5:5d:a7:13:79:a2:75:f9:b6:f5:fb:58

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 4, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

5

Entry point

430475

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\pplive\admodule\ReleaseUMinSize\admodule.pdb

kernel32

RtlUnwind HeapFree UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc VirtualProtect VirtualAlloc GetCommandLineA HeapReAlloc ExitProcess HeapSize GetCPInfo GetACP GetOEMCP IsValidCodePage LCMapStringW GetTimeZoneInformation HeapCreate HeapDestroy VirtualFree GetStdHandle GetModuleFileNameA LCMapStringA SetHandleCount GetFileType GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter InitializeCriticalSectionAndSpinCount GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryA GetDriveTypeA GetProcessHeap SetEnvironmentVariableA GlobalFlags IsProcessorFeaturePresent InterlockedCompareExchange GetFileSizeEx GetFileAttributesW SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle TlsGetValue LocalAlloc GlobalFindAtomW CompareStringW LoadLibraryA GetVersionExA GetModuleHandleA GlobalAddAtomW GlobalDeleteAtom GetCurrentThread ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW CompareStringA InterlockedExchange FindNextFileW CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer FormatMessageW WaitForSingleObject TerminateProcess lstrcpyW CreateProcessW VirtualQuery ReadFile LocalFree SetFileTime GlobalReAlloc GlobalFree CreateDirectoryW GetEnvironmentVariableW CreateFileA WriteFile CompareFileTime GetPrivateProfileIntA GetPrivateProfileStringA LoadLibraryW GetSystemInfo LoadLibraryExW OutputDebugStringW GetProcAddress lstrcmpiW CopyFileW GetPrivateProfileStringW SystemTimeToFileTime GetCurrentProcessId GetCommandLineW DeleteFileW lstrlenA GetFileTime FileTimeToLocalFileTime FileTimeToSystemTime WideCharToMultiByte MultiByteToWideChar FreeLibrary GetTickCount GetModuleHandleW MulDiv lstrcmpW SetLastError GetModuleFileNameW lstrlenW GetSystemTime GetCurrentThreadId GetCurrentProcess FlushInstructionCache InterlockedIncrement WritePrivateProfileStringW GetPrivateProfileIntW DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection RaiseException CreateEventW CloseHandle Sleep InterlockedDecrement GlobalAlloc GlobalLock GlobalUnlock FreeResource GetLastError FindResourceW LoadResource LockResource GetStartupInfoA SizeofResource

user32

DestroyMenu GetSysColorBrush UnregisterClassW WinHelpW GetClassLongW SetPropW GetPropW RemovePropW GetForegroundWindow GetTopWindow GetMessageTime GetMessagePos SetMenu SetForegroundWindow GetClassInfoW SystemParametersInfoA IsIconic GetWindowPlacement GetWindowThreadProcessId GetLastActivePopup MessageBoxW SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetKeyState PeekMessageW ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions ModifyMenuW EnableMenuItem CheckMenuItem PostQuitMessage CharUpperW UnhookWindowsHookEx GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu GetAncestor WaitForInputIdle LoadIconW MapWindowPoints GetDoubleClickTime BringWindowToTop SetRect DestroyWindow IsWindow UnregisterClassA KillTimer EnableWindow GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadImageW LoadBitmapW OffsetRect PostThreadMessageW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW CreateAcceleratorTableW GetSystemMetrics InflateRect DrawEdge DrawFocusRect GetCapture AdjustWindowRectEx GetDlgCtrlID IsWindowEnabled UpdateWindow GetMenu SystemParametersInfoW SetFocus GetFocus GetWindow GetActiveWindow SetTimer CopyRect IsRectEmpty SetRectEmpty GetClientRect ReleaseDC SetWindowRgn GetDC GetWindowRect UpdateLayeredWindow ClientToScreen GetWindowDC GetParent PtInRect ScreenToClient GetCursorPos EqualRect ShowWindow DefWindowProcW SendMessageW SetCursor LoadCursorW SetWindowPos EndPaint BeginPaint SetWindowLongW GetWindowLongW CreateWindowExW RegisterClassExW wsprintfW PostMessageW DestroyAcceleratorTable GetDesktopWindow FillRect ReleaseCapture GetClassNameW GetDlgItem IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect MoveWindow CharNextW GetSysColor CallWindowProcW IsWindowVisible GetClassInfoExW RegisterClassW

gdi32

ScaleWindowExtEx SetWindowExtEx SetWindowOrgEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx DeleteObject GetClipBox SetMapMode SetTextColor SetBkMode RestoreDC SaveDC CreateBitmap CreateFontW CreateDIBSection ExtCreateRegion OffsetRgn CombineRgn CreateRectRgn Escape TextOutW RectVisible PtVisible LPtoDP DPtoLP GetWindowExtEx GetViewportExtEx GetMapMode GetBkColor CreateFontIndirectW GetStockObject GetObjectW CreateSolidBrush CreateCompatibleBitmap SetViewportOrgEx SetBkColor ExtTextOutW CreateCompatibleDC SelectObject GetDeviceCaps BitBlt DeleteDC

msimg32

GradientFill

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

advapi32

BuildExplicitAccessWithNameW InitializeSecurityDescriptor RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegQueryValueW RegEnumKeyW RegOpenKeyW GetNamedSecurityInfoW SetSecurityDescriptorDacl SetEntriesInAclW SetNamedSecurityInfoW RegEnumKeyExW RegQueryInfoKeyW RegDeleteValueW RegDeleteKeyW RegSetValueExW

shell32

SHGetFolderPathW ShellExecuteW ord165

comctl32

ImageList_GetIconSize ImageList_Draw _TrackMouseEvent ImageList_Create ImageList_Destroy ImageList_AddMasked

shlwapi

PathRemoveFileSpecW PathFileExistsW PathFindExtensionW StrStrIW PathFindFileNameW PathStripPathW PathStripToRootW PathIsUNCW PathAppendW

ole32

CreateStreamOnHGlobal OleSetContainedObject OleCreate StringFromGUID2 OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc OleInitialize OleUninitialize CreateBindCtx CoTaskMemFree CoTaskMemRealloc OleDraw

oleaut32

SysFreeString SysAllocString VariantTimeToSystemTime SystemTimeToVariantTime VariantInit VariantClear VariantCopy SysAllocStringLen SysAllocStringByteLen SysStringByteLen LoadRegTypeLi LoadTypeLi OleCreateFontIndirect DispCallFunc UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VariantChangeType VarBstrCmp SafeArrayUnaccessData SafeArrayAccessData SafeArrayGetUBound SysStringLen SafeArrayAllocData SafeArrayAllocDescriptor SafeArrayDestroy SafeArrayGetLBound

urlmon

RegisterBindStatusCallback RevokeBindStatusCallback CreateURLMoniker

gdiplus

GdipBitmapGetPixel GdipCreateBitmapFromFile GdipGetPropertyItem GdipGetPropertyItemSize GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdiplusStartup GdipCloneImage GdipDrawImageRectI GdipCreateFromHDC GdipGetImageWidth GdipDeleteGraphics GdipGetImageHeight GdipDisposeImage GdipLoadImageFromStream GdipAlloc GdipFree GdiplusShutdown

wininet

InternetTimeToSystemTimeW

$PLUGINSDIR/audioswitcher.ax

IMPHASH 44d6c239fec5f9a713dd7e36b1afeee9
SHA256 bff1bf09ff63a3fd600cbf36684aa01da6a08b63498ae549b15f0964572c3ea6
MD5 9ab21c1c96fcb113ff93cd641b88112e
SHA1 d5ffe5945ebbeaf73a0e1d7470d0a2f72b08f6ff
SHA512 44cf7f6d8e51aa6c8d98f1c5456c391fe812d6df4c6b68450d0ba4ee920e86a22433f22ee3f367a8f1183c0276fbe0eaeb2de7987ac9acf51f542a0a84451293
SSDEEP 3072:9VKpjxoDyxTJwkUY6WJ12sodlHiO9OHXXg1207yOh/qEMIZX2Wwr73U048j02MQN:HKpnYsgssHZ9OHHgRhweTioIcr7
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

110003

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\mpc\src\filters\switcher\audioswitcher\Release Unicode\audioswitcher.pdb

kernel32

RaiseException HeapFree HeapAlloc RtlUnwind GetCommandLineA GetProcessHeap ExitProcess HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStdHandle HeapDestroy HeapCreate Sleep SetHandleCount GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetConsoleCP GetConsoleMode LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA FlushFileBuffers SetFilePointer WriteFile ReadFile GlobalFindAtomW LoadLibraryA GetVersionExA GetThreadLocale GlobalFlags GetModuleHandleA SetErrorMode TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc WritePrivateProfileStringW GetCurrentProcessId GlobalAddAtomW GlobalDeleteAtom ConvertDefaultLocale GetModuleFileNameW GetVersion EnumResourceLanguagesW GetLocaleInfoW WideCharToMultiByte GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW LocalFree FindResourceW LoadResource LockResource VirtualQuery SizeofResource SetLastError DisableThreadLibraryCalls GetVersionExW GetTickCount GetCurrentThread InterlockedExchange GetModuleHandleW GetProcAddress VirtualAlloc CreateSemaphoreW GetCurrentThreadId GetCurrentProcess lstrcmpW VirtualFree GetSystemInfo ReleaseSemaphore CreateEventW CloseHandle lstrcpynW LoadLibraryW InterlockedDecrement FreeLibrary InterlockedIncrement GetModuleFileNameA GetLastError lstrlenA MultiByteToWideChar lstrlenW ResetEvent WaitForSingleObject SetEvent LeaveCriticalSection EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MulDiv GetFileType

user32

ShowWindow LoadIconW WinHelpW GetCapture GetClassLongW SetPropW GetPropW RemovePropW IsWindow GetForegroundWindow GetDlgItem GetTopWindow DestroyWindow GetMessageTime GetMessagePos MapWindowPoints SetForegroundWindow GetClientRect GetMenu CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx CopyRect DefWindowProcW CallWindowProcW SetWindowLongW SetWindowPos SystemParametersInfoA IsIconic GetWindowPlacement GetWindow GetClassNameW PtInRect GetWindowTextW SetWindowTextW UnregisterClassA ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW LoadCursorW GetSystemMetrics GetDC ReleaseDC GetSysColor GetSysColorBrush UnregisterClassW GetWindowThreadProcessId DestroyMenu GetWindowLongW GetLastActivePopup IsWindowEnabled EnableWindow MessageBoxW SetCursor SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage GetActiveWindow IsWindowVisible GetKeyState GetCursorPos ValidateRect SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW GetFocus GetParent SendMessageW ModifyMenuW EnableMenuItem CheckMenuItem UnhookWindowsHookEx PostMessageW PostQuitMessage GetMenuState GetMenuItemID GetMenuItemCount GetSubMenu DispatchMessageW RegisterWindowMessageW PeekMessageW wsprintfW GetWindowRect GetDlgCtrlID

gdi32

GetStockObject DeleteDC PtVisible ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape ExtTextOutW TextOutW GetDeviceCaps DeleteObject GetClipBox SetMapMode SetTextColor SetBkColor RestoreDC SaveDC CreateBitmap RectVisible

winspool.drv

ClosePrinter DocumentPropertiesW OpenPrinterW

advapi32

RegQueryValueW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegSetValueW RegCreateKeyW RegCreateKeyExW RegDeleteKeyW RegEnumKeyW RegQueryValueExW RegOpenKeyW

shlwapi

PathFindExtensionW PathFindFileNameW

ole32

CoInitialize CoUninitialize StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoCreateInstance CoFreeUnusedLibraries

oleaut32

VariantInit VariantClear VariantChangeType

$PLUGINSDIR/crashreporter.exe

IMPHASH 4c58834f40af689f9a014f980c90715f
SHA256 bfbcc0928a3a304177ff5d8fede7056b98b4662567506b9a88376938229a0a49
MD5 89affc60f04214c7c66fd1aefc6aae0b
SHA1 0646cf5353f5f39010cee013dbc538e304418692
SHA512 6b623f7638cc921d17fe238ce907e3b42a241189c7f3c1dc92a0ef2741e1629d3cfbd7ceae94977f238d50f4fad7ab81156d59f220bc5493601865e1c6713b97
SSDEEP 1536:NWU+i88TPRz0eX9xcHkqjmFTXs+bCKetOyaEC0:0S8uJV9EzoCtObs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

bc:69:e5:a6:da:98:6d:ff:6e:d5:1e:a0:26:6f:d1:60:4b:0b:52:af

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Apr 14, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

48214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

wininet

InternetWriteFile HttpSendRequestExA InternetCloseHandle HttpAddRequestHeadersA HttpOpenRequestA InternetConnectA InternetOpenA HttpEndRequestA

mfc42

ord2976 ord3830 ord3831 ord3825 ord3079 ord4080 ord4622 ord4424 ord3738 ord815 ord2614 ord540 ord561 ord2514 ord858 ord535 ord2621 ord1134 ord1199 ord1247 ord641 ord656 ord922 ord924 ord926 ord5710 ord1997 ord939 ord941 ord5465 ord798 ord5194 ord533 ord860 ord4202 ord6392 ord2818 ord825 ord5448 ord823 ord3318 ord6877 ord5572 ord2915 ord4129 ord6663 ord5265 ord4376 ord4853 ord4998 ord6052 ord4078 ord1775 ord4407 ord5241 ord2385 ord5163 ord6374 ord4353 ord5280 ord3798 ord4837 ord4441 ord2648 ord2055 ord6376 ord3749 ord5065 ord1727 ord5261 ord2446 ord3081 ord5277 ord4627 ord4425 ord3597 ord324 ord2302 ord4234 ord6215 ord1779 ord6241 ord6199 ord3092 ord4710 ord755 ord470 ord3874 ord1168 ord2379 ord6055 ord1776 ord5290 ord3402 ord3610 ord567 ord1146 ord4396 ord3574 ord609 ord4275 ord2243 ord5875 ord2859 ord2971 ord5759 ord6192 ord5756 ord6186 ord4330 ord6189 ord6021 ord6172 ord5873 ord5789 ord5794 ord5678 ord5736 ord5579 ord5571 ord6061 ord1576 ord3596 ord640 ord323 ord2754 ord6194 ord2567 ord3089 ord2414 ord3619 ord3626 ord3663 ord3571 ord1641 ord1640 ord5785 ord2864 ord2575 ord1929 ord795 ord2244 ord4133 ord5788 ord472 ord3693 ord4297 ord3721 ord2764 ord5683 ord2763 ord2985 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord2725 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord800 ord537 ord4673 ord2124 ord5864

msvcrt

fseek fopen rewind malloc atoi _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler3 __dllonexit _controlfp ftell _setmbcp __CxxFrameHandler sprintf strtol strncpy _onexit isalnum strlen strcmp memset strcpy free fread fclose

kernel32

Sleep CreateProcessA CloseHandle GetModuleHandleA GetStartupInfoA MultiByteToWideChar WideCharToMultiByte LoadLibraryA GetProcAddress FreeLibrary GetTempPathA GetTickCount GetEnvironmentVariableA OutputDebugStringA GetCommandLineW lstrlenA DeleteFileA lstrlenW

user32

SetCapture InvalidateRect UpdateWindow GetParent GetWindowLongA DrawTextA SetWindowPos WaitForInputIdle PostMessageA TabbedTextOutA LoadBitmapA OffsetRect InflateRect GetAncestor GrayStringA PtInRect CopyRect LoadCursorA SetCursor GetSysColor ReleaseCapture LoadIconA EnableWindow GetClientRect IsIconic SendMessageA DrawIcon GetSystemMetrics GetCapture

gdi32

BitBlt Escape ExtTextOutA TextOutA PtVisible LPtoDP DPtoLP GetMapMode GetBkColor SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectA RectVisible CreateFontIndirectA

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

shell32

CommandLineToArgvW SHGetFolderPathA

msvcp60

??0Init@ios_base@std@@QAE@XZ ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??Bios_base@std@@QBEPAXXZ ??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

shlwapi

PathAppendA PathFileExistsA

$PLUGINSDIR/ikan-p.ico

SHA256 7ae7e32f31d4459ca51156528d2a820c5929c346f2b7c61169dcd9166c094b9b
MD5 d5866825ed4296ec8b4dcce265a21bc9
SHA1 833fd9a910bf2a05054b5ce8fa6e6f99a821be88
SHA512 435e757e6aa32b93b179caae12f8ea1c05b0ec124d4bf6a280a7255edb6e2ccbebea46511d62ffaefd3bdbcc652cf49d49b94e0afa88351f95630c26991cc621
SSDEEP 1536:W8MN072K17aRIzG1q4d7mWyOOK2GmjeuV3bENKHb+O021ssCdqfwe:FMuie2xZmWyOUGmjBSWaOmdqfP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/mframe.dll

IMPHASH 5791e6948e5cceb9a71dd3ba2a578784
SHA256 13d4521893045f904c9076a65703ea30fddf95e6d6f61b00d6db4a5a491eb6b7
MD5 769ee9999cae92d8a9a7e573f60a565b
SHA1 1ee8fac608a7b61e2298fd92cf2c1f8bdf672d06
SHA512 030b88d41ec169e038d57f0fb35aed24a22544a2e7d8a9a53d8665e9d036937971c80e46e5d0722f6cfc55d0f65f68a040e87560d024782aeebc08ae40664da0
SSDEEP 12288:7r6agSTN4ARR+rKYEGJQYCwm0hUxj0pzcrRuUM9NpH5euWE:cZmXj0V99LH1WE
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

53:10:55:19:91:00:fa:3c:ef:96:ab:74:f7:17:c5:69:d4:6c:55:f6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 1, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

254725

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42u

ord2810 ord956 ord3688 ord1634 ord3614 ord2371 ord861 ord2362 ord858 ord2634 ord2966 ord5755 ord6188 ord5752 ord6182 ord4324 ord6185 ord6017 ord5869 ord5790 ord5674 ord5732 ord5575 ord5567 ord6057 ord5860 ord3591 ord535 ord925 ord4124 ord6354 ord2756 ord4197 ord2859 ord6190 ord922 ord940 ord5706 ord3566 ord5781 ord6195 ord5795 ord1173 ord2862 ord4269 ord6371 ord4480 ord2546 ord2504 ord5783 ord3917 ord1089 ord5193 ord2388 ord3341 ord5296 ord5298 ord4074 ord4692 ord5303 ord5285 ord5710 ord4616 ord3733 ord561 ord815 ord3948 ord2717 ord1165 ord2606 ord6193 ord6107 ord6238 ord2105 ord2559 ord2444 ord927 ord3711 ord790 ord5977 ord3541 ord4118 ord1143 ord2822 ord1115 ord1568 ord1570 ord1179 ord342 ord1240 ord1194 ord1563 ord1248 ord1250 ord1571 ord600 ord826 ord269 ord5784 ord6871 ord6168 ord5785 ord537 ord2114 ord1088 ord860 ord2910 ord5568 ord942 ord556 ord809 ord3716 ord2078 ord4294 ord538 ord2294 ord795 ord4470 ord4704 ord6330 ord3087 ord4229 ord2356 ord2287 ord2350 ord2293 ord641 ord324 ord3592 ord4419 ord5276 ord4401 ord1767 ord6048 ord2506 ord4992 ord4847 ord4370 ord5261 ord6211 ord6466 ord567 ord3397 ord2573 ord4214 ord1633 ord3658 ord2406 ord825 ord3621 ord3568 ord470 ord755 ord2854 ord2746 ord283 ord5871 ord540 ord3798 ord323 ord2397 ord640 ord800 ord6451 ord5047 ord4270 ord692 ord3634 ord4418 ord4621 ord4075 ord3074 ord3820 ord3826 ord3825 ord2971 ord3076 ord2980 ord3257 ord3131 ord4459 ord3254 ord3142 ord2977 ord5273 ord2116 ord2438 ord5257 ord1720 ord5059 ord3744 ord6372 ord2047 ord2640 ord4435 ord4831 ord3793 ord5286 ord4347 ord6370 ord5157 ord2377 ord5237 ord4395 ord1768 ord4073 ord6051 ord2016 ord2405 ord6362 ord1764 ord823 ord5727

msvcrt

wcscmp abs swprintf _ftol atoi _purecall _wcsicmp memset malloc free _wcsnicmp fflush vfprintf fopen _snprintf strncpy fclose memcmp realloc wcslen iswdigit _wtoi _wcsdup _getdrives strlen isspace wcscpy srand rand _except_handler3 memcpy __CxxFrameHandler isalnum ?terminate@@YAXXZ __dllonexit _onexit _initterm _adjust_fdiv ??1type_info@@UAE@XZ strcpy

kernel32

OutputDebugStringW DeleteCriticalSection LoadLibraryExW InterlockedIncrement GetPrivateProfileStringW GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetLongPathNameW GetCurrentProcess FlushInstructionCache WideCharToMultiByte LoadLibraryA lstrcpynW GetWindowsDirectoryW FreeLibrary GetTickCount GetVersion GetFileAttributesW GetProcAddress GetModuleHandleW GetModuleHandleA GetModuleFileNameW LoadLibraryW OutputDebugStringA GetLastError SetLastError lstrlenW InterlockedDecrement InitializeCriticalSection lstrcmpW SetUnhandledExceptionFilter GetLocalTime lstrcatA lstrcpyA GetModuleFileNameA GetLongPathNameA Module32FirstW CreateToolhelp32Snapshot CloseHandle Module32NextW FindClose FindFirstFileA GetCurrentThread VirtualQuery DebugBreak lstrlenA GetPrivateProfileIntW WritePrivateProfileStringW GetEnvironmentVariableW MultiByteToWideChar LocalFree LocalAlloc lstrcpyW GetCurrentProcessId

user32

EnableWindow RedrawWindow DrawTextW FillRect InflateRect CopyRect GetSysColor DestroyWindow CreateWindowExW UnhookWindowsHookEx GetWindowRect GetWindowLongW SystemParametersInfoW GetClientRect MapWindowPoints SetWindowPos GetDlgItem GetParent SetDlgItemTextW SendMessageW SetWindowsHookExW CallNextHookEx GetKeyState GetMenuItemInfoW SetMenuItemInfoW SetMenuDefaultItem CreateDialogParamW GetDoubleClickTime EndDeferWindowPos DeferWindowPos ScreenToClient ShowWindow BeginDeferWindowPos IsWindow PostMessageW MessageBoxA LoadStringW SetRect wsprintfW CharNextW GetFocus GetDC IsRectEmpty MoveWindow SetWindowTextW LoadImageW IsChild SetFocus DestroyMenu TrackPopupMenu GetSubMenu LoadMenuW DialogBoxParamW SetRectEmpty GetAncestor MonitorFromWindow GetMonitorInfoW SetParent SetForegroundWindow EndDialog GetClassNameW WindowFromPoint SetActiveWindow GetCursorPos BringWindowToTop IsWindowVisible RegisterWindowMessageW GrayStringW TabbedTextOutW EndPaint BeginPaint GetMenu AdjustWindowRectEx GetDlgCtrlID SetCapture IsWindowEnabled KillTimer SetTimer UpdateWindow ClientToScreen DefWindowProcW SetWindowLongW DrawEdge DrawFocusRect CallWindowProcW ReleaseDC PtInRect GetCapture SetCursor CopyIcon LoadCursorW wvsprintfW GetSystemMetrics InvalidateRect ReleaseCapture LoadBitmapW GetWindowTextW GetWindow SetClassLongW

gdi32

SetTextColor GetBkColor GetViewportExtEx SetBkMode LPtoDP FloodFill GetStockObject Escape ExtTextOutW TextOutW RectVisible PtVisible DPtoLP CreateBitmap CreateCompatibleBitmap GetMapMode SetMapMode SetBkColor GetObjectW Rectangle CreateFontIndirectW CreatePen GetTextExtentPoint32W CreateSolidBrush CreateDIBSection CreateCompatibleDC SelectObject StretchBlt DeleteDC BitBlt DeleteObject GetWindowExtEx

advapi32

RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegDeleteValueW RegDeleteKeyW RegCloseKey

shell32

ShellExecuteW SHGetPathFromIDListW SHBrowseForFolderW SHGetFolderPathW SHGetMalloc

ole32

CoTaskMemFree CreateBindCtx

oleaut32

SysStringLen LoadRegTypeLi DispCallFunc LoadTypeLi SysAllocStringLen SysAllocString VariantClear SysFreeString

urlmon

RegisterBindStatusCallback CreateURLMoniker

atl

ord11 ord43 ord44 ord15 ord32 ord10 ord45 ord42 ord30 ord53 ord21 ord58 ord18 ord57 ord16

msimg32

GradientFill

msvcp60

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??1_Lockit@std@@QAE@XZ ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ

pplugin2

?GetCurrentVersionW@@YGHIPAGK@Z

shlwapi

PathFindFileNameA PathFileExistsW PathStripPathW PathAppendA PathRemoveFileSpecA PathAppendW PathRemoveFileSpecW

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/mir.dll

IMPHASH 1bb9ac75bcddcad19ef884bc3d73f3fc
SHA256 0314312a84b85965a87a6f83317aa11528de12e27ab678093ca3c89c8cb65f53
MD5 489d07c6f131f64bd6668923fb9a3123
SHA1 a87ffaddc430c11d1d258cc8a3643198c6265d07
SHA512 791334579da1d7ca5721c7c8a410443a696f6b68dda71216f7fdeff07bdc022b7058dd60f2c70721e136ac68f3744c1221728a03c7ff776ddbb6ffd49145b3fe
SSDEEP 24576:JguWd8sgbO34Gt7HVgnRCCeDFUifzfnn0Hjo26vRqJKJFZIcynOY1PNz6MuKsB12:2gpGFVgRqFdfzfnnN26o2FZIczY1PNeE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

b2:fc:a7:26:27:58:54:b7:39:23:bc:1e:c7:ef:12:a2:a3:34:f7:e8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 4, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

681074

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\svn\bin\Release\mir.pdb

kernel32

GetCurrentProcessId InterlockedIncrement InterlockedDecrement CreateIoCompletionPort CloseHandle TlsFree InterlockedCompareExchange MapViewOfFile CreateFileMappingA GetQueuedCompletionStatus InterlockedExchangeAdd EnterCriticalSection PostQueuedCompletionStatus TlsAlloc GetExitCodeThread VirtualQuery TlsGetValue TlsSetValue WaitForSingleObject TerminateThread GetModuleFileNameA SetLastError GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection DeleteCriticalSection GetTickCount OutputDebugStringA UnmapViewOfFile InterlockedExchange SetEnvironmentVariableA CompareStringW CompareStringA SetEndOfFile CreateFileW CreateFileA SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA ReadFile GetTimeZoneInformation GetLocaleInfoW IsValidCodePage IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetLocaleInfoA SetFilePointer FlushFileBuffers GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetCurrentDirectoryA GetFullPathNameA GetOEMCP GetACP GetProcAddress FreeLibrary GetLocalTime LoadLibraryA GetSystemDefaultLangID GetPrivateProfileStringA WritePrivateProfileStringA GetPrivateProfileIntA Sleep SetEvent CreateEventA GetModuleHandleA lstrlenA GetVersionExA WideCharToMultiByte MultiByteToWideChar LocalFree FormatMessageA HeapAlloc HeapFree RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException FindClose FileTimeToSystemTime FileTimeToLocalFileTime GetDriveTypeA FindFirstFileA ExitThread CreateThread GetCommandLineA GetProcessHeap DeleteFileA HeapReAlloc GetSystemTimeAsFileTime LCMapStringA LCMapStringW GetCPInfo ExitProcess VirtualFree VirtualAlloc HeapDestroy HeapCreate WriteFile GetStdHandle HeapSize GetLastError

shell32

SHGetFolderPathA SHCreateDirectoryExA

ole32

CoCreateGuid

ws2_32

getpeername getservbyname WSAStringToAddressA select getsockopt connect accept __WSAFDIsSet WSASendTo WSARecv shutdown WSARecvFrom inet_ntoa send socket WSASend listen closesocket WSACleanup getsockname setsockopt bind WSAGetLastError WSAStartup gethostname htonl ntohl WSASetLastError inet_addr gethostbyname recvfrom WSASocketA sendto htons ntohs ioctlsocket

mswsock

AcceptEx GetAcceptExSockaddrs

iphlpapi

GetIpAddrTable

user32

wsprintfA PostMessageA

advapi32

CryptReleaseContext CryptAcquireContextA CryptHashData CryptGetHashParam CryptCreateHash CryptDestroyHash

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/peer.dll

IMPHASH 5f401939efae749f108e5b0d37124a65
SHA256 f80f479078127044a1f9fdfb602bb6e46109d7a6352cbb01a14ed3e4d2ab80e0
MD5 1c7909fae05ec9fe026693ebf3bac510
SHA1 3212b1812f6be62f0f3e1f184f8f5ac78cf2dcbd
SHA512 cb470a9b83582c0fc9235e5d2fc09e47d10597d60fd76ac34142deb34d7326b49424eacd7871444fc6c0e734990c4e2cb6a0bcb98dc269372d1b407b99bd8ae8
SSDEEP 24576:xALJ5jdshkgWGQikqUVO8dy/kKkCLubs09h9yYtzT7U3SeSrMPDTLHyVdve7iP3p:KNxwSa8bOiBiMuTP0H6FfxEiHt1wwL4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

77:bc:78:a9:57:db:b5:a7:29:42:d4:32:45:4a:63:f8:7c:fa:34:11

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 2, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

1495777

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\SVN\p2pvideo\p\peer\trunk\lib\release\peer.pdb

shlwapi

PathFileExistsW PathAppendW

psapi

GetProcessMemoryInfo

kernel32

InterlockedExchange InterlockedExchangeAdd InterlockedCompareExchange GetSystemTimeAsFileTime PostQueuedCompletionStatus SetFilePointer ReadFile GetPrivateProfileIntW WritePrivateProfileStringW GetCurrentThreadId TlsSetValue CreateIoCompletionPort TlsGetValue InterlockedDecrement CreateThread SetLastError InterlockedIncrement GetEnvironmentVariableW GetLocalTime CreateToolhelp32Snapshot GetCurrentProcessId Process32FirstW Process32NextW SetEndOfFile WriteFile FlushFileBuffers DeleteFileW MoveFileExW GetModuleHandleW GetVersionExW OpenProcess GetSystemInfo GetProcAddress EnterCriticalSection GetFileSizeEx SetFilePointerEx GetSystemDirectoryW GetCurrentDirectoryW SetCurrentDirectoryW GetDiskFreeSpaceExW FindFirstFileW FindNextFileW FindClose SetFileAttributesW GetPrivateProfileStringW WideCharToMultiByte GetACP MultiByteToWideChar MapViewOfFile UnmapViewOfFile CreateFileMappingA GetModuleHandleA TerminateThread CreateFileW HeapFree HeapAlloc GetProcessHeap CreateDirectoryW CompareStringW CompareStringA WriteConsoleW GetConsoleOutputCP WriteConsoleA GetLocaleInfoW LoadLibraryA GetQueuedCompletionStatus DeleteCriticalSection InitializeCriticalSection GetTickCount SetEnvironmentVariableA LeaveCriticalSection TlsAlloc GetLastError TlsFree SetEvent Sleep WaitForSingleObject CreateEventW CloseHandle GetModuleFileNameW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemDefaultLangID TerminateProcess IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetStdHandle GetStartupInfoA GetFileType SetHandleCount GetConsoleMode GetConsoleCP IsValidCodePage GetOEMCP GetTimeZoneInformation VirtualAlloc VirtualFree HeapCreate HeapDestroy ExitProcess HeapSize GetModuleFileNameA GetStdHandle GetStringTypeW GetStringTypeA GetCPInfo LCMapStringW LCMapStringA ExitThread RtlUnwind RaiseException GetVersionExA GetCommandLineA LocalFree FormatMessageA GetFileAttributesW CreateFileA HeapReAlloc

user32

CloseDesktop wsprintfW GetLastInputInfo PostMessageW OpenInputDesktop SystemParametersInfoW GetSystemMetrics

advapi32

SetSecurityDescriptorDacl GetFileSecurityW GetSecurityDescriptorDacl GetAclInformation GetLengthSid EqualSid GetAce AddAce GetSecurityDescriptorControl SetFileSecurityW InitializeSecurityDescriptor InitializeAcl LookupAccountNameW AddAccessAllowedAce RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateGuid

ws2_32

getsockopt connect accept getservbyname gethostname WSASendTo WSARecvFrom WSASocketW sendto send recvfrom bind socket getsockname select gethostbyname WSACleanup WSAStringToAddressA ntohl htons ntohs WSASend setsockopt closesocket WSAStartup WSASetLastError WSAGetLastError WSAAddressToStringA htonl listen WSARecv ioctlsocket getpeername shutdown __WSAFDIsSet inet_addr

mswsock

AcceptEx GetAcceptExSockaddrs

iphlpapi

GetIpAddrTable

$PLUGINSDIR/pnsis.dll

IMPHASH 31c6ac2144003ec772b515931addb3ad
SHA256 c930819a0f64879fe3a96c606da4be49613693a43b9b1060dc870bec7b3ab47a
MD5 dde7cd3719145ecf3c89d2a1e79ca1f3
SHA1 92802c38f88c4d57f0b1153b04b4de43af4adcde
SHA512 dd67858919fea31f0d4df0c012dc9605fc68bb7512924fee04ae41528d02f8f7ddfd32949841b676735a9d3d81f7dcb455854f20467a4a40ee9f48babd5bee5a
SSDEEP 1536:b3wED/xETX1V6iCKVADJ1ON2LqbaxkO7ln:l/xm6NKqD2E/xZ7ln
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7607

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryA GetCurrentProcessId GetLongPathNameA FreeLibrary GlobalFree lstrcpyA GetVersionExA CloseHandle OpenProcess TerminateProcess DisableThreadLibraryCalls LocalFree GetCommandLineA GetVersion InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ExitProcess FatalAppExitA GetCPInfo GetACP GetOEMCP WideCharToMultiByte MultiByteToWideChar LCMapStringA LCMapStringW GetCurrentProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetLastError GetCurrentThread SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW GetModuleHandleA GetEnvironmentVariableA HeapDestroy HeapCreate VirtualFree HeapFree WriteFile HeapAlloc GetStringTypeA GetStringTypeW RtlUnwind Sleep InterlockedDecrement InterlockedIncrement UnhandledExceptionFilter VirtualAlloc HeapReAlloc IsBadWritePtr IsValidLocale IsValidCodePage GetLocaleInfoA EnumSystemLocalesA GetUserDefaultLCID GetTimeZoneInformation GetLocaleInfoW CompareStringA CompareStringW SetEnvironmentVariableA

advapi32

BuildExplicitAccessWithNameA SetEntriesInAclA SetNamedSecurityInfoA GetNamedSecurityInfoA

$PLUGINSDIR/pplugin2.dll

IMPHASH 7b2bef78f07b3ac11fa7152bddc8ed7a
SHA256 90782f4058f9a670291a9b30cbbc86fe3e773bce34f68a5a28e8ad610e5dfe8e
MD5 d6d59e6bdad28ec77d707f4b1e293a2b
SHA1 86c71c52443a3b553f5fe0040b0e59970d8290a1
SHA512 46810beee0eccb900a97f07f0f098428175d3d656d2825eea239ad20ca1e4d97fd8ee37546895bcaa34132931d218f019effa54e4220be76d8dc2bd83bc47916
SSDEEP 6144:Fx55t1UauFFeJBD70M9gIY8+at7uCjixMxnQLDPs7XvFL:D55txuFFeJBDHY8+at7uCjix86szvFL
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

e8:f6:7f:70:11:2e:fa:74:d1:f2:fe:08:ec:5c:51:60:fc:c3:26:62

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 1, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

150863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId MulDiv FlushInstructionCache CreateFileW SetEndOfFile GlobalAlloc WriteFile LocalFree GetVersionExW LoadLibraryA GlobalLock GlobalUnlock InitializeCriticalSection lstrcatW DeleteCriticalSection HeapDestroy DisableThreadLibraryCalls lstrcpynW lstrcmpiW FindResourceW LoadResource SizeofResource GetShortPathNameW MultiByteToWideChar CreateEventW FindClose FindNextFileW FindFirstFileW WaitForSingleObject SetLastError lstrcpyW WideCharToMultiByte GetPrivateProfileIntW GetPrivateProfileStringW LoadLibraryExW GetModuleFileNameW GetEnvironmentVariableW TerminateProcess LoadLibraryW FreeLibrary EnterCriticalSection LeaveCriticalSection lstrlenA OutputDebugStringW DebugBreak lstrlenW InterlockedDecrement InterlockedIncrement CreateDirectoryW GetLastError CopyFileW CreateProcessW CloseHandle GetCurrentProcess GetModuleHandleW GetProcAddress ReadFile

user32

RegisterWindowMessageW PostMessageW DrawTextW MapWindowPoints IsWindow SendMessageW CreateWindowExW DestroyWindow GetWindowLongW SetWindowTextW GetWindowRect CallWindowProcW ScreenToClient SetTimer KillTimer SetDlgItemTextW GetDlgItem SetWindowPos SetWindowLongW BeginPaint EndPaint wvsprintfW CharNextW LoadStringW MoveWindow IsChild WaitForInputIdle ShowWindow GetKeyState PtInRect UnionRect GetFocus SetWindowRgn OffsetRect EqualRect IntersectRect ReleaseDC GetDC InvalidateRect RegisterClassExW wsprintfW LoadCursorW GetClassInfoExW DefWindowProcW SetFocus GetParent CreateDialogParamW RedrawWindow GetClientRect

gdi32

CreateDCW LPtoDP SetMapMode SetViewportOrgEx GetDeviceCaps CreateMetaFileW SaveDC SetWindowOrgEx SetWindowExtEx RestoreDC CloseMetaFile DeleteMetaFile CreateRectRgnIndirect DeleteDC GetObjectW CreateFontIndirectW DeleteObject SetBkColor ExtTextOutW SetTextColor SetBkMode SelectObject GetStockObject

advapi32

InitializeSecurityDescriptor GetTokenInformation OpenProcessToken RegEnumValueW RegQueryInfoKeyW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteValueW RegDeleteKeyW SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ShellExecuteW ShellExecuteA ShellExecuteExW SHGetFolderPathW

ole32

OleLoadFromStream WriteClassStm OleSaveToStream CoTaskMemFree CreateBindCtx CreateDataAdviseHolder CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs OleRegGetMiscStatus CoTaskMemRealloc CoTaskMemAlloc CLSIDFromString CoCreateInstance

oleaut32

VariantCopy SysFreeString SysAllocString VariantClear VarUI4FromStr LoadTypeLi RegisterTypeLi SysStringLen LoadRegTypeLi OleCreatePropertyFrame SysAllocStringByteLen VariantChangeType SysStringByteLen SysAllocStringLen

urlmon

CreateURLMoniker RegisterBindStatusCallback

msvcp60

??1_Lockit@std@@QAE@XZ ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??0_Lockit@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ

msvcrt

__CxxFrameHandler wcsncpy memset realloc free wcscmp memcpy ??2@YAPAXI@Z wcslen iswdigit _wtoi malloc wcscat wcscpy _wcsicmp swprintf strlen _wfullpath wcsrchr memcmp _purecall _CxxThrowException _wcsdup _snwprintf ??1type_info@@UAE@XZ rand _except_handler3 wcstoul ?terminate@@YAXXZ __dllonexit _adjust_fdiv _initterm _onexit

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

shlwapi

PathFileExistsW PathAppendW PathRemoveFileSpecW

$PLUGINSDIR/ppp.dll

IMPHASH 46929088280429ac3354990b94720261
SHA256 6ebc3ea75e67c779afb68ff9b80bae1b499782ed006f68166f7699479746097f
MD5 a64fbce65d35ed31528cc797c2c360b2
SHA1 3cc0e3052ec73b9df72887d525f64ef5898f2142
SHA512 a7e3d150114a9eaab289599b126deacfbacf09fdb52f91cbfec9ba0d7bef4d7c5dc4d1bb951f3a937990ab01fe535c9e448486d4cdca58359e869ac181579206
SSDEEP 6144:Aa597IE6KK0Xr5bdmMG5r+b831yaI4Tn+i9xW:Aarb6KK0b5bdyB+bEpL9xW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

3d:bc:ae:28:94:36:c2:1f:47:8a:d6:62:b2:61:40:e1:6b:f0:44:75

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 2, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

195617

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42u

ord5852 ord3658 ord1115 ord1173 ord1568 ord1165 ord1570 ord1179 ord1863 ord1240 ord1194 ord1563 ord1248 ord1250 ord1571 ord600 ord826 ord269 ord1560 ord268 ord4199 ord4272 ord2756 ord2859 ord470 ord2746 ord755 ord942 ord5679 ord5706 ord4124 ord6770 ord2822 ord2910 ord5568 ord6139 ord940 ord925 ord6466 ord1128 ord2717 ord3948 ord815 ord561 ord3733 ord4418 ord4616 ord4075 ord3074 ord3820 ord3826 ord3825 ord2971 ord3076 ord2980 ord3257 ord3131 ord4459 ord3254 ord3142 ord2977 ord5710 ord5285 ord800 ord5303 ord4692 ord4074 ord5298 ord5296 ord3341 ord2388 ord5193 ord1089 ord3917 ord5727 ord2504 ord2546 ord4480 ord6371 ord4269 ord927 ord5929 ord834 ord860 ord823 ord920 ord3050 ord3420 ord6874 ord5857 ord538 ord537 ord541 ord922 ord801 ord6868 ord1594 ord535 ord858 ord2606 ord2810 ord861 ord825 ord540 ord342

msvcrt

_findfirst rand srand fclose fgetws _wfopen wcsncpy swprintf strcat _findclose tolower islower toupper isalnum isspace wcslen realloc memcpy _wcsicmp _purecall _itow memcmp wcscmp strrchr _i64tow atol strncpy sscanf memset _ftol wcscpy sprintf strcpy wcstoul _wtoi malloc free strlen atoi __CxxFrameHandler _CxxThrowException _wcsdup _snprintf strcmp fprintf fputs isalpha strncmp strchr __dllonexit _onexit _except_handler3 ?terminate@@YAXXZ ??1type_info@@UAE@XZ _initterm _adjust_fdiv _findnext

kernel32

WideCharToMultiByte MultiByteToWideChar lstrlenW GetACP lstrlenA WritePrivateProfileStringW CopyFileW LocalFree GetLastError DeviceIoControl GetPrivateProfileStringW GetVersionExA GetModuleFileNameA GetModuleHandleA CreateMutexW MapViewOfFile OpenFileMappingW ReleaseMutex FlushViewOfFile UnmapViewOfFile GetEnvironmentVariableW GetProcAddress LoadLibraryW FreeLibrary GetTickCount DeleteFileW GetTempPathW CreateDirectoryW LeaveCriticalSection EnterCriticalSection FlushInstructionCache GetCurrentProcess InterlockedDecrement TerminateProcess CloseHandle CreateProcessW WaitForSingleObject GetModuleFileNameW InitializeCriticalSection DeleteCriticalSection InterlockedIncrement OutputDebugStringW LoadLibraryExW GetSystemInfo GetModuleHandleW GetVersionExW GetPrivateProfileIntW VirtualQuery Sleep CreateFileA LocalAlloc GetSystemTime

user32

KillTimer SetWindowLongW DefWindowProcW RegisterWindowMessageW GetWindowLongW CallWindowProcW GetClientRect IsWindow DestroyWindow FindWindowW SendMessageW SetWindowTextW ShowWindow BringWindowToTop MoveWindow GetWindowRect wsprintfW GetWindowThreadProcessId CreateWindowExW SetTimer GetAncestor SetWindowPos PostMessageW WaitForInputIdle

advapi32

RegQueryValueExW RegCloseKey RegCreateKeyExW RegSetValueExW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegDeleteValueW RegDeleteKeyW RegOpenKeyExW

shell32

SHGetFolderPathW

ole32

CoCreateGuid CoCreateInstance

oleaut32

SysAllocStringLen LoadTypeLi VariantChangeType SysStringByteLen SysAllocStringByteLen VariantInit SysAllocString SysStringLen LoadRegTypeLi VariantClear DispCallFunc SysFreeString

atl

ord21 ord42 ord18 ord10 ord58 ord30 ord57 ord23 ord15 ord53 ord16 ord32 ord44 ord43 ord45 ord48 ord11 ord47

msvcp60

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z ?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z ??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z ?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z ?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ ??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ??9std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z ??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ ?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ?good@ios_base@std@@QBE_NXZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z ?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z ??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z

rpcrt4

UuidToStringW UuidFromStringA

ws2_32

gethostname gethostbyname inet_addr inet_ntoa

shlwapi

PathRemoveExtensionW PathFindExtensionW PathRemoveFileSpecW PathFileExistsW PathAppendW StrStrIW StrStrIA PathStripPathW

$PLUGINSDIR/sop.dll

IMPHASH 602b9c17818d3d0c13020d86bc7311c0
SHA256 101124840788dd1e3d415534a5214d41e4b5e0164ea5763daf8721f366f8b2b8
MD5 1681715926806173e6658c60cd723313
SHA1 e47ecc597add50e88a97a6fd8b98f0798af921fe
SHA512 9febbdc1b7ff9ca453419a063c74b18afed2528f8b55aa5e5c8528554696a86b60d2fe9f736b52112e0be8520650497384d2a9faa294630ea8bd1fd028b21dd7
SSDEEP 6144:2SKJYglIcEpruIe8eYhB4SB6mHE8GOwiFqkZYrPq4o:bKJdl+rrhB4aHEDiskz4o
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

73:36:32:7e:fe:57:85:3d:15:22:9f:c1:bd:6b:c7:db:87:3a:6e:72

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Chains

Jun 1, 2010

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Subject

CN=PPLive Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Planning Dept.,O=PPLive Corporation,L=Shanghai,ST=Shanghai,C=CN

Serial Number

6d:52:7f:4d:7d:6c:1a:2b:a7:ef:81:d5:0c:89:d7:65

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Nov 19, 2009 - Nov 18, 2012

Minor OS version

0

Major OS version

4

Entry point

144901

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\PPVA\project\PPLiveVA_atom\ShellOfPeer\Release\sop.pdb

kernel32

EnterCriticalSection GlobalReAlloc GlobalHandle InitializeCriticalSection TlsAlloc TlsSetValue LocalReAlloc DeleteCriticalSection TlsFree SetErrorMode GlobalFlags InterlockedIncrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent CreateDirectoryW HeapAlloc HeapFree HeapReAlloc GetCommandLineA GetProcessHeap RtlUnwind RaiseException ExitProcess HeapSize GetCPInfo GetOEMCP TlsGetValue LCMapStringA LCMapStringW VirtualFree VirtualAlloc HeapDestroy HeapCreate GetStdHandle GetModuleFileNameA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileA LeaveCriticalSection LocalAlloc GetCurrentProcess FlushFileBuffers SetFilePointer WriteFile ReadFile GetThreadLocale GetCurrentThread ConvertDefaultLocale GetVersion EnumResourceLanguagesW GetLocaleInfoW InterlockedExchange GetModuleHandleA GlobalFree GlobalAlloc GlobalLock GlobalUnlock FormatMessageW GetCurrentThreadId GlobalAddAtomW GlobalFindAtomW GlobalDeleteAtom SetLastError GetVersionExA InterlockedDecrement TerminateProcess CreateProcessW GetACP GetPrivateProfileStringA lstrlenA GetLastError MoveFileW WritePrivateProfileStringA WritePrivateProfileStringW GetLogicalDriveStringsW DeleteFileW GetWindowsDirectoryW GetDriveTypeW GetDiskFreeSpaceExW GetEnvironmentVariableW lstrcpyW WideCharToMultiByte GetPrivateProfileStringW lstrcpyA lstrcatW VirtualQuery SetFileAttributesW lstrlenW LocalFree Sleep MultiByteToWideChar CreateThread LoadLibraryA FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetModuleFileNameW DeviceIoControl CreateFileW LockResource GetTickCount CloseHandle GetCurrentProcessId OpenMutexW SizeofResource LoadResource FindResourceW IsValidCodePage lstrcmpW

user32

GetActiveWindow GetCursorPos ValidateRect PostQuitMessage ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW IsWindowEnabled ShowWindow SetWindowTextW SetMenuItemBitmaps GetMenuCheckMarkDimensions LoadBitmapW ModifyMenuW GetMenuState EnableMenuItem CheckMenuItem RegisterWindowMessageW LoadIconW WinHelpW SetCursor SetWindowsHookExW GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW GetFocus IsWindow GetWindowTextW GetForegroundWindow GetLastActivePopup GetDlgItem GetTopWindow DestroyWindow UnhookWindowsHookEx GetMessageTime GetMessagePos PeekMessageW EnableWindow PostMessageW FindWindowW UnregisterClassA SendMessageW SetTimer MapWindowPoints GetKeyState SetForegroundWindow IsWindowVisible GetClientRect GetMenu GetSubMenu GetMenuItemID GetWindowThreadProcessId UnregisterClassW DestroyMenu GetSysColorBrush LoadCursorW GetCapture KillTimer GetMessageW TranslateMessage DispatchMessageW WaitForInputIdle GetWindow GetSystemMetrics GetWindowRect GetWindowPlacement IsIconic SystemParametersInfoA SetWindowPos SetWindowLongW GetWindowLongW CallWindowProcW DefWindowProcW GetDlgCtrlID GetMenuItemCount MessageBoxW CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW GetSysColor AdjustWindowRectEx GetParent CopyRect PtInRect CallNextHookEx

gdi32

DeleteDC TextOutW GetStockObject ScaleWindowExtEx SetWindowExtEx ScaleViewportExtEx SetViewportExtEx OffsetViewportOrgEx SetViewportOrgEx SelectObject Escape RectVisible PtVisible DeleteObject SetMapMode RestoreDC SaveDC GetDeviceCaps CreateBitmap SetBkColor SetTextColor GetClipBox ExtTextOutW

winspool.drv

DocumentPropertiesW ClosePrinter OpenPrinterW

advapi32

RegQueryValueW RegEnumKeyW RegOpenKeyW RegSetValueExW RegDeleteKeyW BuildExplicitAccessWithNameW GetNamedSecurityInfoW SetNamedSecurityInfoW SetEntriesInAclW RegCloseKey RegQueryValueExW RegOpenKeyExW RegCreateKeyExW

shell32

SHGetFolderPathW SHCreateDirectoryExW

shlwapi

PathAppendW PathFileExistsW PathFindFileNameW PathCombineW PathFindExtensionW PathIsRelativeW

ole32

CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocStringByteLen SysStringByteLen SysFreeString VariantInit VariantClear VariantChangeType SysAllocString

wininet

InternetSetOptionW

$PLUGINSDIR/tpi.dll

IMPHASH 90547e4eb5ec31263ac362ca3152bc21
SHA256 f92a000062c3b5cb961a9773db071ab7dce19bb21a6b775fb72b89e6e12e745c
MD5 f7aebe01c20ba67e2841a0d26bb14e7a
SHA1 8571707df764256694e6a5eb9da1288127d570e8
SHA512 dea2cea63d7098c27d73c3891234b6e672d956a41acc24315de7cce42ba35aae4e6447234c42fca085f91e6749fef051c78af35dee316f348939cbc3a131ce29
SSDEEP 12288:8SUJV+dsIQUp2hiTTAct6cu6OruCPeRWcYPN2euhYqNgV:8SUT+uIQUpSA8w6cuLruPRo2e88
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8b:04:8b:b8:cd:d1:1c:ba:1e:0b:24:c7:db:5d:0a:6b:23:6a:8d:fb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical Support Dept.,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Chains

Dec 26, 2008

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical Support Dept.,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

2c:50:0e:13:db:f1:f8:41:54:b8:a7:f6:26:f5:68:cb

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 20, 2008 - Sep 26, 2009

Minor OS version

0

Major OS version

4

Entry point

12838

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/uilib.dll

IMPHASH 9b21dc5aac1fb39dced130358580e621
SHA256 ccb4bd18fdfffc3bfb78e4df766b4b7b08c637c8933535de4b0c093eeddd4057
MD5 f4df4ecb3bcca7d0e10951aba24c49ce
SHA1 0d36a9dcbdc3895772841e8b97c7c12a39ee7084
SHA512 3778af3d640a4aeec7c576ab34799f09e1e9ec605db7b75a0bd48c0b275a8f898af1371b235f7e70dc49d07b2f7edd0c03fcb82ca0335cc435ac695328159056
SSDEEP 12288:qhTJpLsmdHK3+19ZoDLYypZk/qWTnOm0xJeW:qhrLsmdHwGZopZk/dTOm0HeW
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

a4:61:7b:bd:a4:5d:6a:bb:f0:2c:3f:c0:21:0a:76:e2:9d:00:49:1d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical Support Dept.,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Chains

Nov 25, 2008

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Synacast Corp.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical Support Dept.,O=Synacast Corp.,L=Shanghai,ST=Shanghai,C=CN

Serial Number

2c:50:0e:13:db:f1:f8:41:54:b8:a7:f6:26:f5:68:cb

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Aug 20, 2008 - Sep 26, 2009

Minor OS version

0

Major OS version

4

Entry point

164465

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

mfc42

ord1575 ord1577 ord1182 ord342 ord1243 ord1197 ord1570 ord1253 ord1255 ord1578 ord600 ord826 ord1132 ord6467 ord1131 ord1168 ord2725 ord5500 ord815 ord561 ord3738 ord4424 ord1116 ord4622 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord825 ord3262 ord3136 ord4465 ord3259 ord3147 ord2982 ord5714 ord5289 ord5307 ord4698 ord4079 ord5302 ord5300 ord3346 ord2396 ord5199 ord1089 ord3922 ord5731 ord2512 ord2554 ord4486 ord6375 ord4274 ord540 ord535 ord800 ord537 ord941 ord823 ord1176 ord269

msvcrt

strtol malloc __CxxFrameHandler free strtok strstr wcslen memmove wcscmp _mbsnbcpy _strdup _snprintf _purecall atoi atof fprintf fread fclose ftell fseek fopen fputc memchr sscanf fputs isalpha isalnum isspace strncmp strchr tolower atol _mbstok _ltoa strncpy floor _ftol _CxxThrowException fwrite fflush getc printf isprint realloc _CIfmod longjmp _setjmp3 __CxxLongjmpUnwind div _wcsnicmp _strcmpi exit _iob getenv abort clearerr _CIpow strtod _fdopen _errno _vsnprintf strerror calloc _mbslen sprintf _except_handler3 ?terminate@@YAXXZ __dllonexit _onexit ??1type_info@@UAE@XZ _initterm _adjust_fdiv strspn

kernel32

GlobalSize LocalFree GlobalAlloc GlobalLock GlobalUnlock SizeofResource LoadResource lstrcatA MultiByteToWideChar lstrlenA GetACP WideCharToMultiByte lstrlenW InterlockedDecrement InterlockedIncrement GetSystemTime GetPrivateProfileStringA GetLastError GetModuleFileNameA GetPrivateProfileIntA WritePrivateProfileStringA ReleaseMutex GetLocalTime WaitForSingleObject CreateMutexA LeaveCriticalSection EnterCriticalSection CloseHandle CreateProcessA InitializeCriticalSection DeleteCriticalSection HeapDestroy FreeLibrary GetProcAddress LockResource LoadLibraryA GetShortPathNameA GetModuleHandleA LocalAlloc lstrcpyA

user32

wsprintfA CharNextA RegisterWindowMessageA PostMessageA SetTimer IsRectEmpty InvalidateRect DrawTextA GetIconInfo GetDC ReleaseDC SetRect KillTimer

gdi32

GetStockObject CreateFontIndirectA SetBkMode StretchDIBits RectVisible CreateCompatibleBitmap CreateBitmap SetBkColor StretchBlt GetClipBox CreateRectRgnIndirect ExtSelectClipRgn SetStretchBltMode SetDIBitsToDevice BitBlt GetObjectA SelectObject RealizePalette GetDIBits CreateCompatibleDC CreateDIBSection DeleteDC CreateDIBitmap ExtCreateRegion CombineRgn DeleteObject SetTextColor

advapi32

RegCloseKey RegDeleteKeyA RegDeleteValueA RegSetValueExA RegCreateKeyExA RegOpenKeyExA RegQueryValueExA

ole32

CLSIDFromString StringFromGUID2 CoCreateInstance CreateStreamOnHGlobal CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString SysAllocStringLen RegisterTypeLi LoadTypeLi SysAllocString

msvcp60

??_7?$basic_streambuf@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ ??_7?$basic_ofstream@DU?$char_traits@D@std@@@std@@6B@ ??_7?$basic_filebuf@DU?$char_traits@D@std@@@std@@6B@ ??1locale@std@@QAE@XZ ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z ?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ??_8?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@7B@ ??0ios_base@std@@IAE@XZ ??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N1@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ??_7?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ?_Mode@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEHH@Z ?_Init@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXPBDIH@Z ??_7?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@ ?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ?_Tidy@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@ ??1ios_base@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ ??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z ?_Xran@std@@YAXXZ ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ??1_Winit@std@@QAE@XZ ??0_Winit@std@@QAE@XZ ??1Init@ios_base@std@@QAE@XZ ??0Init@ios_base@std@@QAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ?__Fiopen@std@@YAPAU_iobuf@@PBDH@Z ?_Init@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXPAU_iobuf@@W4_Initfl@12@@Z ?_Initcvt@?$basic_filebuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ?setw@std@@YA?AU?$_Smanip@H@1@H@Z ?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z ?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ ??0_Lockit@std@@QAE@XZ ??1_Lockit@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z ?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xlen@std@@YAXXZ ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ??Mstd@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

shlwapi

PathRemoveFileSpecA PathAppendA

rpcrt4

UuidFromStringA

Sharing

General

Malware Config

Signatures

File Explorer