619b81bc9f08865eaaab5f54616823a00dce9fd115924cf185cc6d6c3255c170
- SHA256 619b81bc9f08865eaaab5f54616823a00dce9fd115924cf185cc6d6c3255c170
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
kvpins64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
kvpins64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
kvpvbsext64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral4
Sample
kvpvbsext64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral5
Sample
kvpvbsext64_orig.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
kvpvbsext64_orig.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 619b81bc9f08865eaaab5f54616823a00dce9fd115924cf185cc6d6c3255c170
- Size 13.1MB
- Sample261102-jrncxaee39
- SHA256 619b81bc9f08865eaaab5f54616823a00dce9fd115924cf185cc6d6c3255c170
- MD5 17ed0ba7381915fe0cf24fc2fe4c55ae
- SHA1 21e8ef1311e16a8fdc7e3ca9026c76a2bc0ae14d
- SHA512 7dc26fbe71f0a5435d0ab2d382043f86f18ff296547a34eb626ca4739afaf0290ebe7204242d87a0795101dee571454825d512b63b31bfcfce750dba5b2d10ab
- SSDEEP 393216:bWIaG78Hj7DgwpXcCly1vFgowInFqkeAI9exwmCJGuq:bWttHj7DgEcUy1DwIUki9SwmCu
- TLSH T1B5D633D24557B4C7C8FBB08F5EC3ADE023AE97D44578826EEE1586C670881C2D8E8767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/kvpvbsext64.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/kvpvbsext64.dll
File Explorer
-
619b81bc9f08865eaaab5f54616823a00dce9fd115924cf185cc6d6c3255c170.zip 13.1MB
-
kvpins64.exe.exe 353KB
-
kvpvbsext64.dll.dll 12.8MB
-
kvpvbsext64_orig.dll.dll 172KB
kvpins64.exe
- IMPHASH 414fa1b73bd09571e84d9fcc476f07e6
- SHA256 5b4c1dc1d629341286cefa03133aaf2a041ee24aa022f7cd845924f210f1ce6d
- MD5 16118227770402f79938d1f9ded3ce49
- SHA1 1db92873f396a4a944e223c90778098129a01f80
- SHA512 533e17c4d0b6bf2332d533c4beda98882efe3cf986a36e1dcfe6664c3be5d22605bd2f6f3b378ccf22f8a211b052c884e802660a4bca7dd7af13c6f1a855b6ec
- SSDEEP 6144:FXdnf1VDU2mMQTyydY3xlTD+qAM4mF5sAOj/dxCwfiUzgQ:Ftnf1W298gPeW4OSdxmOgQ
- TLSH T1F0749D56B3A81CE9E837C1388D529A16EBB27C610710C7DF1364876A9F736E0AD3DB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
9b:84:a2:94:9b:4c:de:44:b1:fb:9e:82:76:06:3b:84:74:f2:ae:23:02:37:cd:c2:13:06:ac:fb:1b:ce:15:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Chains
Aug 20, 2026
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
34:55:d7:6b:0e:57:40:18:c1:6e:55:fd:90:c4:45:a8:21:16:4c:8e
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Chains
Aug 20, 2026
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Serial Number
0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2024 - Oct 17, 2027
Minor OS version
2
Major OS version
5
Entry point
87628
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
H:\pub_1lgl3\rc_bugfix_master_\Build\Release_x64\WPSOffice\office6\kvprinter\kvpins64.pdb
kvpvbsext64
?RunScript@ScriptInterpreter@@YAJPEB_WPEBD0PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z
kernel32
WriteConsoleW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
GetTempFileNameW
RemoveDirectoryW
SetFileAttributesW
GetTempPathW
IsDebuggerPresent
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
FatalAppExitW
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
WaitForSingleObject
CreateEventW
SetWaitableTimer
Sleep
CreateWaitableTimerW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
TerminateThread
GetExitCodeThread
ResumeThread
CreateProcessW
OpenProcess
GetTickCount
GetSystemDirectoryW
GetNativeSystemInfo
VirtualQuery
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageW
GetPrivateProfileIntW
GetPrivateProfileStringW
CopyFileW
MoveFileExW
WideCharToMultiByte
GetLocaleInfoW
GetThreadLocale
GetSystemDefaultLCID
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
OutputDebugStringA
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsValidCodePage
CreateFileW
LoadLibraryW
GetCurrentThreadId
GetWindowsDirectoryW
IsWow64Process
HeapReAlloc
HeapSize
DebugBreak
GetSystemInfo
lstrlenA
SwitchToThread
CreateThread
VirtualProtect
LoadLibraryExA
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlPcToFileHeader
RtlUnwindEx
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
WriteFile
ExitProcess
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
UninstallRoutine
Name
.text
Size
164KB
Virtual Size
164KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
78KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.kvpver
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=26715,
count=139, id=261, version=26715,
count=17, id=260, version=30034,
count=9, id=259, version=30034,
count=55, id=261, version=30034,
count=13, id=260, version=26715,
count=2, id=257, version=26715,
count=3, id=257, version=30154,
count=1, id=263, version=26715,
count=2, id=262, version=26715,
count=371, id=1, productName=Unmarked objects,
count=13, id=261, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=2, id=151,
count=1, id=258, version=30154,
kvpvbsext64.dll
- IMPHASH c39111d8f672fe380230328b5a92123b
- SHA256 e28a6f4d8a08c79cb8d198263e819dc339634da08faf8b97d162d95d34cb3f42
- MD5 8506ace59fd90a0845ff76018ac076b2
- SHA1 fa693dcb2d8cc682e8da6417e5f47ec82ea9007f
- SHA512 385cd41fe779a99e8f7ca23e59c6c20a11e9f35f420252a812f4792687012ec33e9820e9f229158fceeee8edd71017686e9447c85197f82e9a9a8a597fec25aa
- SSDEEP 393216:O8+QhOxrvXOKjZuArEdXnMAc03NmwswqBMVGsIX0q:O/DxrvXOauMEd/c0MwqBsGsI
- TLSH T1A1D633D28517B4C7C8BBE07F8EC3AEF1239E67D44578822FEE0586C530851D29DA8766
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4896
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
ChangeServiceConfig2W
ChangeServiceConfigW
CloseServiceHandle
CreateServiceW
GetTokenInformation
OpenProcessToken
OpenSCManagerW
OpenServiceW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
CreateProcessW
DisableThreadLibraryCalls
FindResourceW
GetCurrentProcess
GetEnvironmentVariableW
GetExitCodeProcess
GetFileSize
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcessHeap
HeapAlloc
HeapFree
LoadResource
LockResource
MultiByteToWideChar
ReadFile
SetFilePointer
SizeofResource
Sleep
VirtualProtect
VirtualQuery
WaitForSingleObject
WriteFile
msvcrt
__iob_func
_initterm
_lock
_snwprintf
_unlock
_vsnprintf
_wcsicmp
abort
calloc
fprintf
free
malloc
memcpy
memset
realloc
vfprintf
wcscpy
wcslen
wcsncpy
wcsrchr
?RunScript@ScriptInterpreter@@YAJPEB_W00PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z
?RunScript@ScriptInterpreter@@YAJPEB_WPEBD0PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z
RunDll32Entry
_X86ScriptHostEntry
Name
.text
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
96B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
320B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
1024B
Virtual Size
558B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12.8MB
Virtual Size
12.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
kvpvbsext64_orig.dll
- IMPHASH 3bcb24a52c7aee5df21c5aa013a893b2
- SHA256 77e95ee19a449079ea45db6d93ac8395835affff906334f0344210f695d77bdc
- MD5 6fc5a288190eed2942ee329b9920bc40
- SHA1 8b532ffb8325cedba63d6e0cee70e148b3a09653
- SHA512 c9f7aaa31764003660985a09dd70ed0cdd31682ffd258d54632a835bd91ef61d778a00579bcbe558ab432522a73138374ed74c2ca4416d894b3e8aa3b6f52323
- SSDEEP 3072:L+QSohtIDshvGzH5lOVVshHRHClFROl613LBCWxWde:L+QTWDjbOrsXHCNnbAs
- TLSH T11E047C57B2A454BBE437C634C9935A12EB7674510B6097DF0364827E2F633E0AE3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
de:23:35:a4:8f:71:b4:d5:be:d8:a4:7d:20:f2:7e:2a:fc:1a:93:00:eb:10:a4:a8:e8:17:26:da:14:68:0a:0e
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Chains
Aug 20, 2026
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Digest
9a:cb:fb:79:f9:15:ac:69:36:32:40:1a:7e:16:17:d1:5d:b6:c7:b6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Chains
Aug 20, 2026
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=Zhuhai Kingsoft Office Software Co.\, Ltd.,O=Zhuhai Kingsoft Office Software Co.\, Ltd.,L=珠海市,ST=广东省,C=CN
Serial Number
0f:52:f2:95:33:ee:ba:d4:11:50:36:79:4e:e1:07:4f
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 18, 2024 - Oct 17, 2027
Minor OS version
2
Major OS version
5
Entry point
24132
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
H:\pub_1lgl3\rc_bugfix_master_\Build\Release_x64\WPSOffice\office6\kvprinter\kvpvbsext64.pdb
kernel32
GetCommandLineW
CreateFileW
GetTempPathW
CloseHandle
RaiseException
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
GetCurrentProcess
ExitProcess
GetExitCodeProcess
ResumeThread
CreateProcessW
VirtualQuery
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
LocalFree
FatalExit
MultiByteToWideChar
DisableThreadLibraryCalls
WriteConsoleW
GetSystemInfo
VirtualProtect
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RtlUnwindEx
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetModuleHandleExW
GetStdHandle
GetFileType
HeapSize
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
?RunScript@ScriptInterpreter@@YAJPEB_W00PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z
?RunScript@ScriptInterpreter@@YAJPEB_WPEBD0PEAPEAUtagSAFEARRAY@@PEAUtagVARIANT@@@Z
RunDll32Entry
_X86ScriptHostEntry
Name
.text
Size
91KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
46KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=26715,
count=132, id=261, version=26715,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=36, id=261, version=30034,
count=12, id=260, version=26715,
count=3, id=257, version=26715,
count=146, id=1, productName=Unmarked objects,
count=3, id=261, version=30154,
count=1, id=256, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,