pandastealer | JaffaCakes118_79dcc2f78c807dfeecfd3960a31afb6f

resource	yara_rule
static1/unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/rvcomlib.dll	family_pandastealer

resource	yara_rule
static1/unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/accbiz.dll	acprotect
static1/unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/alidcp.dll	acprotect

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

resource	yara_rule
static1/unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/accbiz.dll	upx
static1/unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/alidcp.dll	upx

resource
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/7z.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/ATL80.dll
unpack002/out.upx
unpack003/out.upx
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/dbghelp.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/flash.exe
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/libeay32.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/msvcp80.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/msvcr80.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/ssleay32.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/ATL80.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/GdiPlus.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/msvcp80.dll
unpack001/AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/msvcr80.dll

JaffaCakes118_79dcc2f78c807dfeecfd3960a31afb6f

.rar

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/7z.dll

.dll windows:4 windows x86 arch:x86

71fc45db7a81ce236f432a828a4e8fcd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LINE_NUMS_STRIPPED

IMAGE_FILE_LOCAL_SYMS_STRIPPED

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

Imports

oleaut32

SysAllocString

VariantClear

VariantCopy

SysFreeString

SysAllocStringByteLen

user32

CharLowerW

CharUpperA

CharNextA

CharPrevExA

CharUpperW

CharLowerA

msvcrt

_adjust_fdiv

_initterm

?terminate@@YAXXZ

_onexit

__dllonexit

??1type_info@@UAE@XZ

_except_handler3

_beginthreadex

memset

strcmp

realloc

memcmp

_purecall

strlen

free

malloc

memmove

_CxxThrowException

memcpy

__CxxFrameHandler

kernel32

InitializeCriticalSection

ReleaseSemaphore

CreateSemaphoreA

ResetEvent

SetEvent

CreateEventA

WaitForSingleObject

VirtualFree

VirtualAlloc

GetCurrentProcessId

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

FileTimeToLocalFileTime

DeleteCriticalSection

LocalFileTimeToFileTime

GetVersionExA

WaitForMultipleObjects

EnterCriticalSection

LeaveCriticalSection

GetSystemTime

SystemTimeToFileTime

FileTimeToDosDateTime

DosDateTimeToFileTime

GetModuleHandleA

GetProcAddress

GetSystemInfo

CompareFileTime

WriteFile

ReadFile

MultiByteToWideChar

WideCharToMultiByte

GetLastError

CloseHandle

SetFileAttributesA

DeleteFileA

GetTempPathA

GetTempFileNameA

CreateFileA

Exports

CreateObject

GetHandlerProperty

GetHandlerProperty2

GetMethodProperty

GetNumberOfFormats

GetNumberOfMethods

SetLargePageMode

Sections

.text
Size: 654KB - Virtual size: 654KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/ATL80.dll

.dll windows:4 windows x86 arch:x86

00c6e566e88c3d07ddc376fe4ce83c5f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

atl80.i386.pdb

Imports

kernel32

RaiseException

EnterCriticalSection

LeaveCriticalSection

GetCurrentThreadId

FindClose

FindFirstFileW

CompareStringW

GetSystemDirectoryW

GetLongPathNameW

GetModuleFileNameW

GetProcAddress

GetModuleHandleW

lstrlenW

InitializeCriticalSection

DeleteCriticalSection

GetLastError

DisableThreadLibraryCalls

DebugBreak

OutputDebugStringA

GetVersionExA

InterlockedIncrement

InterlockedDecrement

lstrcmpiW

FreeLibrary

MultiByteToWideChar

SizeofResource

LoadResource

FindResourceW

LoadLibraryExW

CloseHandle

ReadFile

GetFileSize

CreateFileW

WideCharToMultiByte

WaitForSingleObject

GlobalAlloc

FindResourceA

MulDiv

FlushInstructionCache

GetCurrentProcess

lstrcmpW

GlobalUnlock

GlobalLock

SetLastError

GlobalFree

GlobalHandle

LockResource

lstrcmpA

GetModuleHandleA

GetTickCount

InterlockedExchange

GetACP

GetLocaleInfoA

GetThreadLocale

InterlockedCompareExchange

HeapFree

GetProcessHeap

HeapAlloc

LoadLibraryA

IsProcessorFeaturePresent

VirtualFree

VirtualAlloc

HeapSize

HeapReAlloc

QueryPerformanceCounter

GetCurrentProcessId

GetSystemTimeAsFileTime

TerminateProcess

UnhandledExceptionFilter

SetUnhandledExceptionFilter

IsDebuggerPresent

RtlUnwind

LocalAlloc

Exports

AtlAdvise

AtlAxAttachControl

AtlAxCreateControl

AtlAxCreateControlEx

AtlAxCreateControlLic

AtlAxCreateControlLicEx

AtlAxCreateDialogA

AtlAxCreateDialogW

AtlAxDialogBoxA

AtlAxDialogBoxW

AtlAxGetControl

AtlAxGetHost

AtlAxWinInit

AtlCallTermFunc

AtlComModuleGetClassObject

AtlComModuleRegisterClassObjects

AtlComModuleRegisterServer

AtlComModuleRevokeClassObjects

AtlComModuleUnregisterServer

AtlComPtrAssign

AtlComQIPtrAssign

AtlCreateRegistrar

AtlCreateTargetDC

AtlDevModeW2A

AtlFreeMarshalStream

AtlGetObjectSourceInterface

AtlGetVersion

AtlHiMetricToPixel

AtlIPersistPropertyBag_Load

AtlIPersistPropertyBag_Save

AtlIPersistStreamInit_Load

AtlIPersistStreamInit_Save

AtlInternalQueryInterface

AtlLoadTypeLib

AtlMarshalPtrInProc

AtlModuleAddTermFunc

AtlPixelToHiMetric

AtlRegisterClassCategoriesHelper

AtlRegisterTypeLib

AtlSetErrorInfo

AtlUnRegisterTypeLib

AtlUnadvise

AtlUnmarshalPtr

AtlUpdateRegistryFromResourceD

AtlWaitWithMessageLoop

AtlWinModuleAddCreateWndData

AtlWinModuleExtractCreateWndData

AtlWinModuleInit

AtlWinModuleRegisterClassExA

AtlWinModuleRegisterClassExW

AtlWinModuleRegisterWndClassInfoA

AtlWinModuleRegisterWndClassInfoW

AtlWinModuleTerm

Sections

.text
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AVTransBiz.dll

.dll windows:4 windows x86 arch:x86

1f0da76e616d82aaee986eac8ec2cd7a

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

d3:8e:77:cf:7e:dc:15:1e:5d:44:e8:33:bc:07:de:1e:d0:56:6e:48
Signer

Actual PE Digest

d3:8e:77:cf:7e:dc:15:1e:5d:44:e8:33:bc:07:de:1e:d0:56:6e:48

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

F:\AliWWAutoPackage\Trunk\SourceCode\IMClient-RV\symbol\Release\AVTransBiz.pdb

Imports

ws2_32

ntohl

inet_addr

htonl

ntohs

htons

ww_network

?WW_GetNatAddr@@YA_NAAUtag_AddrParam@@@Z

?WW_GetMapPort@@YAHXZ

?WW_GetLocalUPort@@YAHXZ

?WW_RefreshNatAddress@@YA_NXZ

?WW_FreeClient@@YAXPAPAVCBaseClient@@@Z

?WW_GetLocalPort@@YAHXZ

?WW_Unbind@@YAXPB_W@Z

?WW_Bind@@YAXPB_WW4P2P_DLL_VERSION@@@Z

?WW_GetStrategyMaxCount@@YAHXZ

?WW_ReserveStrategy@@YAXPAUtag_Strategy@@H@Z

?WW_FilterStrategy@@YA_NPB_WPAUtag_Strategy@@AAH@Z

?WW_GetClient@@YAPAVCBaseClient@@PB_WW4P2P_DLL_VERSION@@@Z

?WW_GetStrategy@@YA_NPB_WPAUtag_Strategy@@AAH@Z

?WW_GetLocalAddr@@YAKXZ

kernel32

GetCurrentProcessId

GetCurrentThreadId

QueryPerformanceCounter

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

GetProcessHeap

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

HeapDestroy

GetTickCount

InitializeCriticalSection

DeleteCriticalSection

InterlockedIncrement

InterlockedDecrement

lstrlenW

EnterCriticalSection

LeaveCriticalSection

GetModuleFileNameW

GetLastError

SizeofResource

LockResource

LoadResource

GetSystemTimeAsFileTime

FindResourceExW

Sleep

InterlockedCompareExchange

FreeLibrary

WideCharToMultiByte

MultiByteToWideChar

lstrlenA

GetProcAddress

LoadLibraryExW

GetPrivateProfileStringW

RaiseException

GetVersionExA

GetThreadLocale

GetLocaleInfoA

GetACP

InterlockedExchange

FindResourceW

user32

UnregisterClassA

ole32

CoCreateInstance

oleaut32

SysAllocString

LoadTypeLi

LoadRegTypeLi

SysStringLen

SysFreeString

p2pbiz

?GetP2PUserMgr@@YAPAVIP2PUserMgr@@XZ

atl80

ord58

ord31

ord32

ord30

ord64

ord15

msvcr80

??_V@YAXPAX@Z

??2@YAPAXI@Z

_CxxThrowException

free

??_U@YAPAXI@Z

??1exception@std@@UAE@XZ

??0exception@std@@QAE@XZ

_invalid_parameter_noinfo

??3@YAXPAX@Z

memcpy_s

wcsrchr

_vscwprintf

vswprintf_s

memmove_s

calloc

_recalloc

??8type_info@@QBE_NABV0@@Z

memset

strncpy

memcpy

_except_handler4_common

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_decode_pointer

?terminate@@YAXXZ

_malloc_crt

_encoded_null

_initterm

_initterm_e

_amsg_exit

_adjust_fdiv

__CppXcptFilter

_crt_debugger_hook

?_type_info_dtor_internal_method@type_info@@QAEXXZ

__clean_type_info_names_internal

_purecall

__CxxFrameHandler3

??0exception@std@@QAE@ABV01@@Z

msvcp80

?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@@Z

?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z

??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z

??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

rvcore

queue_timer_task

GetRvCore

rpcrt4

UuidCreate

Exports

DllCanUnloadNow

DllGetClassObject

Sections

.text
Size: 76KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AccVideoEgn.dll

.dll windows:5 windows x86 arch:x86

b06c6d935aaffb13d72659fa98aea093

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

72:3c:b5:73:83:5f:5d:25:ec:9e:53:e1:9b:e7:9e:56:ee:3c:1d:01
Signer

Actual PE Digest

72:3c:b5:73:83:5f:5d:25:ec:9e:53:e1:9b:e7:9e:56:ee:3c:1d:01

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\AVSDK\bin\release\AccVideoEgn.pdb

Imports

msimg32

AlphaBlend

winmm

timeGetTime

accbiz

ord70

ord37

ord438

ord73

ord538

ord537

ord536

ord539

ord3

ord52

ord49

ord31

ord521

ord522

ord420

ord429

ord430

ord431

ord432

ord433

ord28

ord532

ord533

ord504

ord530

ord204

ord205

ord208

ord212

ord540

ord541

ord2

ord535

ord529

ord520

ord523

ord524

ord437

ord409

ord413

ord32

ord215

ord439

ord440

ord435

ord436

ord12

ord50

ord48

ord29

ord46

ord47

ord14

ord36

ord191

ord192

ord143

ord149

ord4

ord16

ord13

ord11

ord370

ord371

ord372

ord375

ord1

ord56

ord6

ord87

ord113

ord127

ord139

ord79

ord78

ord77

ord76

ord84

ord85

ord38

ord497

ord498

ord500

ord502

kernel32

SetFilePointer

GetLocaleInfoA

LCMapStringW

MultiByteToWideChar

LCMapStringA

GetConsoleMode

GetConsoleCP

SetStdHandle

IsValidCodePage

GetOEMCP

GetACP

GetCPInfo

GetEnvironmentStringsW

WideCharToMultiByte

FreeEnvironmentStringsW

GetEnvironmentStrings

FreeEnvironmentStringsA

GetStartupInfoA

GetFileType

SetHandleCount

VirtualAlloc

VirtualFree

HeapDestroy

HeapCreate

ExitProcess

HeapSize

InterlockedDecrement

SetLastError

InterlockedIncrement

TlsFree

TlsSetValue

TlsAlloc

TlsGetValue

GetStdHandle

WriteFile

RtlUnwind

RaiseException

InitializeCriticalSectionAndSpinCount

GetCommandLineA

HeapAlloc

HeapFree

GetLastError

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

TerminateProcess

CreateThread

GetThreadPriority

ResetEvent

SetThreadPriority

TerminateThread

SetEvent

CreateEventA

WaitForSingleObject

DeleteCriticalSection

EnterCriticalSection

LeaveCriticalSection

QueryPerformanceCounter

lstrlenW

QueryPerformanceFrequency

lstrcpyW

FreeLibrary

GetCurrentProcess

GetModuleHandleW

GetCurrentThread

GetPrivateProfileIntA

LoadLibraryW

GetProcAddress

WritePrivateProfileStringA

GetModuleFileNameA

DuplicateHandle

CloseHandle

GetCurrentProcessId

Sleep

DisableThreadLibraryCalls

GetTickCount

LoadLibraryA

GetModuleHandleA

GetCurrentThreadId

InitializeCriticalSection

GetSystemTimeAsFileTime

FlushFileBuffers

GetStringTypeA

GetStringTypeW

WriteConsoleA

GetConsoleOutputCP

WriteConsoleW

ReadFile

CreateFileA

SetEndOfFile

GetProcessHeap

HeapReAlloc

user32

GetClientRect

GetWindowRect

ScreenToClient

SetTimer

GetWindowLongW

SetWindowLongW

GetSysColor

SetWindowPos

GetSystemMetrics

SendMessageW

UpdateWindow

GetWindowThreadProcessId

MoveWindow

KillTimer

EndPaint

ClientToScreen

MonitorFromPoint

BeginPaint

InvalidateRect

ValidateRect

DestroyWindow

IsWindow

SetForegroundWindow

IsWindowEnabled

EnableWindow

FillRect

PostMessageW

FrameRect

DrawTextExW

GetParent

DefWindowProcW

SetParent

gdi32

GetTextExtentExPointW

CreateSolidBrush

SelectObject

DeleteObject

SetBkColor

CreateFontIndirectW

SetTextColor

BitBlt

ExtTextOutW

SelectClipRgn

GetObjectW

CreateCompatibleDC

CreateDIBSection

DeleteDC

SetStretchBltMode

CombineRgn

CreateRectRgnIndirect

SetBkMode

SetBrushOrgEx

StretchBlt

GetTextExtentPointW

ole32

GetRunningObjectTable

CoCreateInstance

CoUninitialize

CoInitialize

CreateItemMoniker

CoTaskMemAlloc

CoTaskMemFree

oleaut32

OleCreatePropertyFrame

SysFreeString

ws2_32

ntohl

ntohs

htons

htonl

Sections

.text
Size: 866KB - Virtual size: 866KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 581KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AccVoiceEgn.dll

.dll windows:5 windows x86 arch:x86

f414033a91f29e0bd1d681f1680216b6

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

46:5b:41:f6:09:a2:19:0a:95:e1:c0:71:4a:25:2e:ae:ec:6c:f4:0e
Signer

Actual PE Digest

46:5b:41:f6:09:a2:19:0a:95:e1:c0:71:4a:25:2e:ae:ec:6c:f4:0e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

d:\AVSDK\bin\release\AccVoiceEgn.pdb

Imports

accbiz

ord140

ord85

ord189

ord33

ord29

ord419

ord405

ord403

ord314

ord236

ord438

ord437

ord14

ord524

ord523

ord520

ord12

ord13

ord441

ord279

ord278

ord66

ord30

ord36

ord540

ord539

ord541

ord6

ord535

ord151

ord143

ord141

ord356

ord439

ord440

ord11

ord435

ord436

ord429

ord430

ord431

ord432

ord433

ord434

ord370

ord371

ord31

ord2

ord275

ord273

ord276

ord98

ord125

ord81

ord532

ord533

ord38

ord215

ord529

ord530

ord204

ord205

ord208

ord212

ord235

ord87

ord94

ord103

ord113

ord82

ord78

ord70

ord192

ord149

ord406

ord409

ord413

ord415

ord416

ord417

ord418

ord426

ord423

ord16

ord231

ord232

ord233

ord234

ord37

ord15

ord372

ord375

ord1

ord3

ord73

ord71

ord139

ord77

ord76

ord84

ord35

kernel32

GetModuleHandleA

FlushFileBuffers

SetStdHandle

WriteConsoleW

GetConsoleOutputCP

WriteConsoleA

SetFilePointer

GetLocaleInfoA

GetStringTypeW

GetStringTypeA

LCMapStringW

MultiByteToWideChar

LCMapStringA

RtlUnwind

HeapReAlloc

VirtualAlloc

GetSystemTimeAsFileTime

GetCurrentProcessId

GetTickCount

QueryPerformanceCounter

VirtualFree

HeapDestroy

HeapCreate

GetEnvironmentStringsW

FreeEnvironmentStringsW

GetEnvironmentStrings

FreeEnvironmentStringsA

InitializeCriticalSectionAndSpinCount

LoadLibraryA

GetConsoleMode

GetConsoleCP

WideCharToMultiByte

DeleteCriticalSection

GetStartupInfoA

GetFileType

SetHandleCount

LeaveCriticalSection

EnterCriticalSection

GetModuleFileNameA

GetStdHandle

WriteFile

RaiseException

HeapAlloc

HeapSize

SetLastError

TlsFree

TlsSetValue

TlsAlloc

TlsGetValue

IsValidCodePage

GetOEMCP

GetACP

InterlockedDecrement

InterlockedIncrement

GetCPInfo

HeapFree

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

GetCommandLineA

GetCurrentThreadId

ExitProcess

CreateFileA

LockResource

SizeofResource

LoadResource

FindResourceW

CreateDirectoryW

DeviceIoControl

CreateFileW

DisableThreadLibraryCalls

GetProcAddress

GetModuleHandleW

CloseHandle

WaitForMultipleObjects

CreateEventW

GetLastError

Sleep

SetEvent

WaitForSingleObject

user32

IsWindow

MessageBoxW

DefWindowProcW

PostMessageW

DestroyWindow

ole32

PropVariantClear

CoCreateInstance

winmm

mmioAdvance

mmioClose

mmioCreateChunk

mmioOpenW

mmioWrite

mmioRead

mixerSetControlDetails

mixerGetDevCapsW

mmioAscend

mixerGetControlDetailsW

mixerGetLineControlsW

timeGetTime

waveOutWrite

waveOutPause

waveOutRestart

waveOutReset

waveOutUnprepareHeader

mmioSetInfo

mmioDescend

mmioSeek

mmioGetInfo

mixerGetLineInfoW

waveOutGetID

waveOutPrepareHeader

waveOutClose

waveOutGetDevCapsW

waveInStart

waveInStop

waveInUnprepareHeader

waveInReset

waveInAddBuffer

waveInOpen

waveInGetID

waveInPrepareHeader

waveInClose

waveInMessage

mixerOpen

waveOutGetNumDevs

mixerGetID

waveOutOpen

waveInGetNumDevs

mixerClose

waveInGetDevCapsW

waveOutMessage

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rodata
Size: 512B - Virtual size: 340B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AddNewEmotion.htm

.html .js polyglot

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliApkInstaller.exe

.exe windows:4 windows x86 arch:x86

913b05e09affe23b020a1a4ba940dff3

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

07:0f:49:67:da:d9:b0:ea:3d:00:62:00:dd:29:0e:a2:61:13:12:70
Signer

Actual PE Digest

07:0f:49:67:da:d9:b0:ea:3d:00:62:00:dd:29:0e:a2:61:13:12:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\AliWWAutoPackage\Trunk\SourceCode\IMClient-RV\symbol\Release\AliApkInstaller.pdb

Imports

netapi32

Netbios

kernel32

LockResource

LoadResource

FindResourceExW

Sleep

GetProcessHeap

MultiByteToWideChar

HeapFree

CreateMutexW

lstrlenA

GetVersionExW

GetModuleHandleW

GetProcAddress

InterlockedDecrement

GetCurrentProcess

GetCurrentThreadId

OpenMutexW

GetTickCount

GetModuleFileNameW

FindFirstFileW

FindClose

GetCurrentProcessId

CreateEventW

CreateProcessW

WaitForMultipleObjects

SizeofResource

CloseHandle

SetUnhandledExceptionFilter

ExitProcess

GetPrivateProfileStringW

RaiseException

InterlockedCompareExchange

DeleteCriticalSection

LoadLibraryExW

FreeLibrary

GetSystemTimeAsFileTime

QueryPerformanceCounter

IsDebuggerPresent

UnhandledExceptionFilter

TerminateProcess

GetStartupInfoW

GetThreadLocale

GetLocaleInfoA

GetACP

InterlockedExchange

HeapSize

HeapReAlloc

HeapAlloc

HeapDestroy

FindResourceW

InitializeCriticalSection

GetLastError

LeaveCriticalSection

EnterCriticalSection

GetExitCodeProcess

GetVersionExA

user32

CreateWindowExW

GetWindowTextW

GetWindowThreadProcessId

IsWindow

GetActiveWindow

GetWindowLongW

FindWindowExW

DispatchMessageW

TranslateMessage

GetMessageW

MessageBoxW

SetWindowLongW

DefWindowProcW

SendMessageTimeoutW

RegisterClassExW

UnregisterClassA

advapi32

RegFlushKey

RegQueryValueExW

RegCreateKeyExW

RegCloseKey

RegSetValueExW

RegOpenKeyExW

shell32

SHChangeNotify

CommandLineToArgvW

ShellExecuteW

ole32

CoUninitialize

OleInitialize

CoInitialize

oleaut32

SysFreeString

SysStringLen

SysAllocString

shlwapi

SHDeleteKeyW

StrCatW

PathFileExistsW

SHDeleteValueW

msvcp80

?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z

?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z

??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z

??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z

??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

_amsg_exit

__wgetmainargs

_cexit

_exit

_XcptFilter

exit

_wcmdln

_initterm

_initterm_e

_configthreadlocale

__setusermatherr

_adjust_fdiv

__p__commode

__CxxFrameHandler3

__p__fmode

__set_app_type

_except_handler4_common

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_crt_debugger_hook

_invoke_watson

_controlfp_s

_CxxThrowException

?terminate@@YAXXZ

??3@YAXPAX@Z

_wcsicmp

wcsstr

wcschr

free

memcpy_s

_recalloc

malloc

memmove_s

wcslen

??0exception@std@@QAE@ABV01@@Z

??0exception@std@@QAE@XZ

??1exception@std@@UAE@XZ

strlen

_vscwprintf

vswprintf_s

??2@YAPAXI@Z

calloc

wcsrchr

_wputenv_s

??_V@YAXPAX@Z

_invalid_parameter_noinfo

memset

memcpy

??0exception@std@@QAE@ABQBD@Z

sprintf_s

?what@exception@std@@UBEPBDXZ

memcmp

wcscpy

_wgetenv

_wcslwr

_ultow

wcsncmp

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_decode_pointer

rvcore

create_main_thread_window

EnableMsgBus

GetRvCore

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliIMBrowserHostmod.dll

.dll regsvr32 windows:4 windows x86 arch:x86

4fe86b4be504e09d3a1c568b9b970802

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

fa:34:47:29:77:41:02:59:fc:a4:47:b0:08:df:12:0d:a6:ac:24:ec
Signer

Actual PE Digest

fa:34:47:29:77:41:02:59:fc:a4:47:b0:08:df:12:0d:a6:ac:24:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

F:\AliWWAutoPackage\Trunk\SourceCode\IMClient-RV\symbol\Release\AliIMBrowserHostmod.pdb

Imports

psapi

GetProcessMemoryInfo

kernel32

SetPriorityClass

OpenProcess

GetCurrentProcessId

IsDebuggerPresent

InterlockedExchange

Sleep

CloseHandle

GetCurrentProcess

GetModuleFileNameW

GetTickCount

RaiseException

InterlockedCompareExchange

FreeLibrary

GetProcAddress

LoadLibraryExW

GetPrivateProfileStringW

FlushInstructionCache

SetLastError

GetCurrentThreadId

CreateFileW

ReadFile

WriteFile

SetFilePointer

GetFileSize

GetTempFileNameW

GetTempPathW

TerminateProcess

EnterCriticalSection

lstrlenW

QueryPerformanceCounter

SetUnhandledExceptionFilter

UnhandledExceptionFilter

VirtualAlloc

VirtualFree

IsProcessorFeaturePresent

LoadLibraryA

GetProcessHeap

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

HeapDestroy

GetLocaleInfoA

GetACP

GetVersionExA

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

InterlockedIncrement

InterlockedDecrement

SetThreadLocale

GetThreadLocale

GetLastError

lstrlenA

LoadLibraryExA

MultiByteToWideChar

SizeofResource

LockResource

WideCharToMultiByte

FindResourceExW

FindResourceW

LoadResource

GetSystemTimeAsFileTime

user32

GetClassInfoExW

UnregisterClassA

LoadCursorW

MoveWindow

GetClientRect

UpdateWindow

InvalidateRect

GetWindowDC

ReleaseDC

CreateWindowExW

CallNextHookEx

GetKeyState

IsChild

SetWindowsHookExW

UnhookWindowsHookEx

GetWindowLongW

CallWindowProcW

RegisterClassExW

ShowWindow

IsWindow

SendMessageW

DestroyWindow

DefWindowProcW

PostThreadMessageW

SetTimer

SetWindowLongW

KillTimer

PeekMessageW

TranslateMessage

DispatchMessageW

GetParent

gdi32

DeleteDC

GetDeviceCaps

ole32

CoCreateInstance

CoTaskMemAlloc

oleaut32

SysAllocStringLen

DispCallFunc

VariantClear

VariantChangeType

VariantInit

BSTR_UserSize

BSTR_UserMarshal

BSTR_UserUnmarshal

BSTR_UserFree

VARIANT_UserSize

VARIANT_UserMarshal

VARIANT_UserUnmarshal

VARIANT_UserFree

LoadTypeLi

LoadRegTypeLi

SysStringLen

SysAllocString

SysFreeString

atl80

ord22

ord64

ord15

ord23

ord61

ord32

ord58

ord31

ord30

ord43

ord44

ord10

ord11

ord42

ord48

ord47

ord18

shlwapi

UrlUnescapeA

UrlUnescapeW

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ

?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ

?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD0@Z

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z

??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z

?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z

??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

vswprintf_s

_vscwprintf

wcsrchr

_wtoi64

_beginthreadex

exit

??0exception@std@@QAE@ABV01@@Z

_time64

calloc

free

memmove_s

??_V@YAXPAX@Z

??2@YAPAXI@Z

??0exception@std@@QAE@XZ

memset

malloc

wcsncpy_s

_wsplitpath_s

wcsnlen

_wcsicmp

_wtoi

strstr

wcsncmp

wcstol

iswdigit

_except_handler4_common

_unlock

__dllonexit

_encode_pointer

_lock

_onexit

_mbsicoll

_mbsicmp

wcscpy_s

_decode_pointer

?terminate@@YAXXZ

_malloc_crt

_encoded_null

_initterm_e

_amsg_exit

_adjust_fdiv

__CppXcptFilter

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_crt_debugger_hook

__clean_type_info_names_internal

_wcslwr_s

_wcsnicmp

_initterm

??3@YAXPAX@Z

_CxxThrowException

swprintf_s

__CxxFrameHandler3

_recalloc

memcpy_s

_invalid_parameter_noinfo

wcsstr

wcschr

??1exception@std@@UAE@XZ

memcpy

urlmon

CoInternetGetSession

wininet

InternetGetCookieW

rpcrt4

NdrDllUnregisterProxy

NdrDllRegisterProxy

NdrCStdStubBuffer2_Release

NdrCStdStubBuffer_Release

NdrDllCanUnloadNow

NdrDllGetClassObject

NdrOleAllocate

NdrOleFree

IUnknown_QueryInterface_Proxy

IUnknown_AddRef_Proxy

IUnknown_Release_Proxy

CStdStubBuffer_QueryInterface

CStdStubBuffer_AddRef

CStdStubBuffer_Connect

CStdStubBuffer_Disconnect

CStdStubBuffer_Invoke

CStdStubBuffer_IsIIDSupported

CStdStubBuffer_CountRefs

CStdStubBuffer_DebugServerQueryInterface

CStdStubBuffer_DebugServerRelease

NdrStubForwardingFunction

NdrStubCall2

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.orpc
Size: 4KB - Virtual size: 844B

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliIMEmotion.ico

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliIMSSOLogin.dll

.dll regsvr32 windows:4 windows x86 arch:x86

05d7a49324b1ff3899ab2242f7f42987

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

3b:b8:25:07:cb:24:b9:d8:6e:d8:13:d3:21:fa:08:4f:12:c2:7e:ea
Signer

Actual PE Digest

3b:b8:25:07:cb:24:b9:d8:6e:d8:13:d3:21:fa:08:4f:12:c2:7e:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

IMAGE_FILE_DLL

PDB Paths

F:\AliWWAutoPackage\Trunk\SourceCode\IMClient-RV\symbol\Release\AliIMSSOLogin.pdb

Imports

kernel32

FindResourceW

LoadLibraryExW

InterlockedDecrement

EnterCriticalSection

lstrlenW

GetLastError

lstrcmpiW

GetModuleFileNameW

FreeLibrary

InitializeCriticalSection

MultiByteToWideChar

WideCharToMultiByte

LockResource

FindResourceExW

WaitForSingleObject

InterlockedIncrement

CreateFileMappingW

MapViewOfFileEx

CloseHandle

OpenFileMappingW

UnmapViewOfFile

GetProcAddress

GetSystemDirectoryW

CreateEventW

InterlockedExchange

GetSystemTimeAsFileTime

GetCurrentProcessId

GetCurrentThreadId

GetTickCount

QueryPerformanceCounter

LoadResource

RaiseException

SizeofResource

GetModuleHandleW

DeleteCriticalSection

LeaveCriticalSection

SetThreadLocale

lstrlenA

GetThreadLocale

IsDebuggerPresent

SetUnhandledExceptionFilter

UnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

InterlockedCompareExchange

Sleep

GetProcessHeap

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

HeapDestroy

GetLocaleInfoA

GetACP

GetVersionExA

user32

GetWindowTextW

SendMessageTimeoutW

FindWindowExW

IsWindow

UnregisterClassA

CharNextW

advapi32

RegOpenKeyExW

RegQueryInfoKeyW

RegCloseKey

RegDeleteKeyW

RegDeleteValueW

RegSetValueExW

RegCreateKeyExW

RegEnumKeyExW

ole32

CoCreateInstance

CoTaskMemAlloc

CoCreateGuid

StringFromGUID2

CoTaskMemRealloc

CoTaskMemFree

oleaut32

VariantClear

LoadRegTypeLi

SysAllocStringLen

SysAllocString

SysFreeString

UnRegisterTypeLi

VarUI4FromStr

SysStringLen

RegisterTypeLi

LoadTypeLi

shlwapi

UrlGetPartW

msvcr80

__clean_type_info_names_internal

?_type_info_dtor_internal_method@type_info@@QAEXXZ

_crt_debugger_hook

_except_handler4_common

__CppXcptFilter

_adjust_fdiv

_amsg_exit

_initterm_e

_initterm

_encoded_null

_malloc_crt

?terminate@@YAXXZ

_decode_pointer

_onexit

_lock

_encode_pointer

__dllonexit

_unlock

??1bad_cast@std@@UAE@XZ

iswprint

??0bad_cast@std@@QAE@ABV01@@Z

wcsstr

memcpy

wcsrchr

_wcsicmp

_resetstkoflw

??0exception@std@@QAE@ABV01@@Z

??2@YAPAXI@Z

??1exception@std@@UAE@XZ

??0exception@std@@QAE@ABQBD@Z

?what@exception@std@@UBEPBDXZ

_purecall

_invalid_parameter_noinfo

wcscmp

??0exception@std@@QAE@XZ

strlen

wcslen

memmove_s

calloc

vswprintf_s

_vscwprintf

_time64

rand

srand

??_U@YAPAXI@Z

wcscat_s

_recalloc

memset

??_V@YAXPAX@Z

free

wcsncpy_s

memcmp

memcpy_s

wcscpy_s

malloc

??3@YAXPAX@Z

__CxxFrameHandler3

??0bad_cast@std@@QAE@PBD@Z

_CxxThrowException

msvcp80

?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ

?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z

?id@?$ctype@_W@std@@2V0locale@2@A

?getloc@ios_base@std@@QBE?AVlocale@2@XZ

?uncaught_exception@std@@YA_NXZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z

??Bid@locale@std@@QAEIXZ

?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ

?_Incref@facet@locale@std@@QAEXXZ

?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

?widen@?$ctype@_W@std@@QBE_WD@Z

?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

?_Register@facet@locale@std@@QAEXXZ

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z

?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ

??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z

??_D?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z

?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ

??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_K@Z

??0?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z

?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z

?str@?$basic_ostringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ

?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z

??1locale@std@@QAE@XZ

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z

?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z

??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z

??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z

??1_Lockit@std@@QAE@XZ

?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ

??0_Lockit@std@@QAE@H@Z

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ

??$?6_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@0@AAV10@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z

?setprecision@std@@YA?AU?$_Smanip@H@1@H@Z

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 80KB - Virtual size: 78KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

AliIM2013_7.21.04C去广告绿色优化版V2/AliWangWang/7.21.04C/AliIMSrv.exe

.exe windows:4 windows x86 arch:x86

b7bc3de0ff1026db8a6ba83e39ef1fed

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

KeyUsageContentCommitment

47:6a:b7:0c:91:3f:23:09:1f:0b:21:b7:41:6c:52:42
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

23/04/2012, 00:00

Not After

22/06/2014, 23:59

Subject

CN=TaoBao(china) Software Co.\, Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=TaoBao(china) Software Co.\, Ltd,L=HangZhou,ST=ZheJiang,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign

KeyUsageCRLSign

18:6b:e2:48:70:8f:29:c6:a8:0b:cb:c3:fd:9d:18:d1:ec:df:d0:c8
Signer

Actual PE Digest

18:6b:e2:48:70:8f:29:c6:a8:0b:cb:c3:fd:9d:18:d1:ec:df:d0:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\AliWWAutoPackage\Trunk\SourceCode\IMClient-RV\symbol\Release\AliIMSrv.pdb

Imports

netapi32

Netbios

kernel32

GetProcessHeap

GetACP

LeaveCriticalSection

GetModuleHandleW

GetProcAddress

WaitForSingleObject

GetCurrentProcess

MultiByteToWideChar

GetLastError

GetCurrentThreadId

lstrlenA

EnterCriticalSection

SizeofResource

LockResource

LoadResource

FindResourceExW

FindFirstFileW

GetPrivateProfileStringW

FindClose

GetCurrentProcessId

CreateEventW

CreateProcessW

GetModuleFileNameW

WaitForMultipleObjects

GetExitCodeProcess

CloseHandle

SetUnhandledExceptionFilter

Sleep

FindResourceW

ExitProcess

OpenFileMappingW

MapViewOfFile

UnmapViewOfFile

GetCurrentDirectoryW

SetEvent

LoadLibraryExW

DeleteCriticalSection

FreeLibrary

InterlockedCompareExchange

RaiseException

GetSystemTimeAsFileTime

GetTickCount

QueryPerformanceCounter

IsDebuggerPresent

UnhandledExceptionFilter

TerminateProcess

GetStartupInfoW

InitializeCriticalSection

GetLocaleInfoA

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

HeapDestroy

GetVersionExA

GetThreadLocale

InterlockedExchange

user32

GetMessageW

MessageBoxW

UnregisterClassA

GetWindowThreadProcessId

PostThreadMessageW

GetParent

GetWindowTextW

SendMessageW

IsWindow

FindWindowExW

GetActiveWindow

DispatchMessageW

TranslateMessage

shell32

ShellExecuteW

ole32

CoInitialize

CoUninitialize

CreateStreamOnHGlobal

CoMarshalInterface

CoCreateInstance

msvcp80

?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ

?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z

?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z