[*] MalFamily: "" [*] MalScore: 6.6 [*] File Name: "jkcgjj.exe" [*] File Size: 403456 [*] File Type: "PE32 executable (GUI) Intel 80386, for MS Windows" [*] SHA256: "9c1b99aadbfb33fdd546f147a84e6ef956d3e301de914b18ce56b7705b5a9412" [*] MD5: "8b49d2c49c43b1f71e73ccc34f9b3da2" [*] SHA1: "bd8c83684f42197eb4bf2f025dc1d52147a60f4d" [*] SHA512: "61b6ab038f898384a71aa4a6d136eca390cdaa2bbca11cbf8743972ad1dc5167fb4c979591dd67000f0c50838be260a6d8f5c2c0f1d59dc146ad608fcbf1fe61" [*] CRC32: "84898B07" [*] SSDEEP: "6144:XHVqO3BBFzWZ/47RwCtOZxsmK+ZufisjevPYxjJRDyfEDf1sl4hGQAVyPl9l:XUO3BBFCZwtiiN5fieDKI1sWhGxVElL" [*] Process Execution: [ "jkcgjj.exe" ] [*] Signatures Detected: [ { "Description": "Creates RWX memory", "Details": [] }, { "Description": "File has been identified by 10 Antiviruses on VirusTotal as malicious", "Details": [ { "Cylance": "Unsafe" }, { "Avast": "FileRepMalware" }, { "Tencent": "Win32.Backdoor.Fareit.Auto" }, { "FireEye": "Generic.mg.8b49d2c49c43b1f7" }, { "SentinelOne": "DFI - Malicious PE" }, { "Acronis": "suspicious" }, { "MaxSecure": "Trojan.Malware.300983.susgen" }, { "AVG": "FileRepMalware" }, { "Cybereason": "malicious.84f421" }, { "CrowdStrike": "win/malicious_confidence_80% (W)" } ] }, { "Description": "Anomalous binary characteristics", "Details": [ { "anomaly": "Timestamp on binary predates the release date of the OS version it requires by at least a year" } ] } ] [*] Started Service: [] [*] Executed Commands: [] [*] Mutexes: [] [*] Modified Files: [] [*] Deleted Files: [] [*] Modified Registry Keys: [] [*] Deleted Registry Keys: [] [*] DNS Communications: [] [*] Domains: [] [*] Network Communication - ICMP: [] [*] Network Communication - HTTP: [] [*] Network Communication - SMTP: [] [*] Network Communication - Hosts: [] [*] Network Communication - IRC: [] [*] Static Analysis: { "pe": { "peid_signatures": null, "imports": [ { "imports": [ { "name": "DeleteCriticalSection", "address": "0x45612c" }, { "name": "LeaveCriticalSection", "address": "0x456130" }, { "name": "EnterCriticalSection", "address": "0x456134" }, { "name": "InitializeCriticalSection", "address": "0x456138" }, { "name": "VirtualFree", "address": "0x45613c" }, { "name": "VirtualAlloc", "address": "0x456140" }, { "name": "LocalFree", "address": "0x456144" }, { "name": "LocalAlloc", "address": "0x456148" }, { "name": "GetVersion", "address": "0x45614c" }, { "name": "GetCurrentThreadId", "address": "0x456150" }, { "name": "InterlockedDecrement", "address": "0x456154" }, { "name": "InterlockedIncrement", "address": "0x456158" }, { "name": "VirtualQuery", "address": "0x45615c" }, { "name": "WideCharToMultiByte", "address": "0x456160" }, { "name": "MultiByteToWideChar", "address": "0x456164" }, { "name": "lstrlenA", "address": "0x456168" }, { "name": "lstrcpynA", "address": "0x45616c" }, { "name": "LoadLibraryExA", "address": "0x456170" }, { "name": "GetThreadLocale", "address": "0x456174" }, { "name": "GetStartupInfoA", "address": "0x456178" }, { "name": "GetProcAddress", "address": "0x45617c" }, { "name": "GetModuleHandleA", "address": "0x456180" }, { "name": "GetModuleFileNameA", "address": "0x456184" }, { "name": "GetLocaleInfoA", "address": "0x456188" }, { "name": "GetCommandLineA", "address": "0x45618c" }, { "name": "FreeLibrary", "address": "0x456190" }, { "name": "FindFirstFileA", "address": "0x456194" }, { "name": "FindClose", "address": "0x456198" }, { "name": "ExitProcess", "address": "0x45619c" }, { "name": "WriteFile", "address": "0x4561a0" }, { "name": "UnhandledExceptionFilter", "address": "0x4561a4" }, { "name": "RtlUnwind", "address": "0x4561a8" }, { "name": "RaiseException", "address": "0x4561ac" }, { "name": "GetStdHandle", "address": "0x4561b0" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "GetKeyboardType", "address": "0x4561b8" }, { "name": "LoadStringA", "address": "0x4561bc" }, { "name": "MessageBoxA", "address": "0x4561c0" }, { "name": "CharNextA", "address": "0x4561c4" } ], "dll": "user32.dll" }, { "imports": [ { "name": "RegQueryValueExA", "address": "0x4561cc" }, { "name": "RegOpenKeyExA", "address": "0x4561d0" }, { "name": "RegCloseKey", "address": "0x4561d4" } ], "dll": "advapi32.dll" }, { "imports": [ { "name": "SysFreeString", "address": "0x4561dc" }, { "name": "SysReAllocStringLen", "address": "0x4561e0" }, { "name": "SysAllocStringLen", "address": "0x4561e4" } ], "dll": "oleaut32.dll" }, { "imports": [ { "name": "TlsSetValue", "address": "0x4561ec" }, { "name": "TlsGetValue", "address": "0x4561f0" }, { "name": "LocalAlloc", "address": "0x4561f4" }, { "name": "GetModuleHandleA", "address": "0x4561f8" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "RegQueryValueExA", "address": "0x456200" }, { "name": "RegOpenKeyExA", "address": "0x456204" }, { "name": "RegCloseKey", "address": "0x456208" } ], "dll": "advapi32.dll" }, { "imports": [ { "name": "lstrcpyA", "address": "0x456210" }, { "name": "lstrcmpiA", "address": "0x456214" }, { "name": "WriteProcessMemory", "address": "0x456218" }, { "name": "WriteFile", "address": "0x45621c" }, { "name": "WaitForSingleObject", "address": "0x456220" }, { "name": "VirtualQuery", "address": "0x456224" }, { "name": "VirtualProtect", "address": "0x456228" }, { "name": "VirtualFree", "address": "0x45622c" }, { "name": "VirtualAllocEx", "address": "0x456230" }, { "name": "VirtualAlloc", "address": "0x456234" }, { "name": "Sleep", "address": "0x456238" }, { "name": "SizeofResource", "address": "0x45623c" }, { "name": "SetThreadLocale", "address": "0x456240" }, { "name": "SetFilePointer", "address": "0x456244" }, { "name": "SetEvent", "address": "0x456248" }, { "name": "SetErrorMode", "address": "0x45624c" }, { "name": "SetEndOfFile", "address": "0x456250" }, { "name": "ResetEvent", "address": "0x456254" }, { "name": "ReadProcessMemory", "address": "0x456258" }, { "name": "ReadFile", "address": "0x45625c" }, { "name": "MulDiv", "address": "0x456260" }, { "name": "LockResource", "address": "0x456264" }, { "name": "LoadResource", "address": "0x456268" }, { "name": "LoadLibraryA", "address": "0x45626c" }, { "name": "LeaveCriticalSection", "address": "0x456270" }, { "name": "InitializeCriticalSection", "address": "0x456274" }, { "name": "GlobalUnlock", "address": "0x456278" }, { "name": "GlobalReAlloc", "address": "0x45627c" }, { "name": "GlobalHandle", "address": "0x456280" }, { "name": "GlobalLock", "address": "0x456284" }, { "name": "GlobalFree", "address": "0x456288" }, { "name": "GlobalFindAtomA", "address": "0x45628c" }, { "name": "GlobalDeleteAtom", "address": "0x456290" }, { "name": "GlobalAlloc", "address": "0x456294" }, { "name": "GlobalAddAtomA", "address": "0x456298" }, { "name": "GetVersionExA", "address": "0x45629c" }, { "name": "GetVersion", "address": "0x4562a0" }, { "name": "GetTickCount", "address": "0x4562a4" }, { "name": "GetThreadLocale", "address": "0x4562a8" }, { "name": "GetTempPathA", "address": "0x4562ac" }, { "name": "GetSystemInfo", "address": "0x4562b0" }, { "name": "GetStringTypeExA", "address": "0x4562b4" }, { "name": "GetStdHandle", "address": "0x4562b8" }, { "name": "GetProcAddress", "address": "0x4562bc" }, { "name": "GetModuleHandleA", "address": "0x4562c0" }, { "name": "GetModuleFileNameA", "address": "0x4562c4" }, { "name": "GetLocaleInfoA", "address": "0x4562c8" }, { "name": "GetLocalTime", "address": "0x4562cc" }, { "name": "GetLastError", "address": "0x4562d0" }, { "name": "GetFullPathNameA", "address": "0x4562d4" }, { "name": "GetExitCodeThread", "address": "0x4562d8" }, { "name": "GetDiskFreeSpaceA", "address": "0x4562dc" }, { "name": "GetDateFormatA", "address": "0x4562e0" }, { "name": "GetCurrentThreadId", "address": "0x4562e4" }, { "name": "GetCurrentProcessId", "address": "0x4562e8" }, { "name": "GetCPInfo", "address": "0x4562ec" }, { "name": "GetACP", "address": "0x4562f0" }, { "name": "FreeResource", "address": "0x4562f4" }, { "name": "InterlockedExchange", "address": "0x4562f8" }, { "name": "FreeLibrary", "address": "0x4562fc" }, { "name": "FormatMessageA", "address": "0x456300" }, { "name": "FindResourceA", "address": "0x456304" }, { "name": "FindFirstFileA", "address": "0x456308" }, { "name": "FindClose", "address": "0x45630c" }, { "name": "FileTimeToLocalFileTime", "address": "0x456310" }, { "name": "FileTimeToDosDateTime", "address": "0x456314" }, { "name": "ExitProcess", "address": "0x456318" }, { "name": "EnumCalendarInfoA", "address": "0x45631c" }, { "name": "EnterCriticalSection", "address": "0x456320" }, { "name": "DeleteCriticalSection", "address": "0x456324" }, { "name": "CreateThread", "address": "0x456328" }, { "name": "CreateRemoteThread", "address": "0x45632c" }, { "name": "CreateProcessA", "address": "0x456330" }, { "name": "CreateFileA", "address": "0x456334" }, { "name": "CreateEventA", "address": "0x456338" }, { "name": "CompareStringA", "address": "0x45633c" }, { "name": "CloseHandle", "address": "0x456340" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "VerQueryValueA", "address": "0x456348" }, { "name": "GetFileVersionInfoSizeA", "address": "0x45634c" }, { "name": "GetFileVersionInfoA", "address": "0x456350" } ], "dll": "version.dll" }, { "imports": [ { "name": "UnrealizeObject", "address": "0x456358" }, { "name": "StretchBlt", "address": "0x45635c" }, { "name": "SetWindowOrgEx", "address": "0x456360" }, { "name": "SetViewportOrgEx", "address": "0x456364" }, { "name": "SetTextColor", "address": "0x456368" }, { "name": "SetStretchBltMode", "address": "0x45636c" }, { "name": "SetROP2", "address": "0x456370" }, { "name": "SetPixel", "address": "0x456374" }, { "name": "SetDIBColorTable", "address": "0x456378" }, { "name": "SetBrushOrgEx", "address": "0x45637c" }, { "name": "SetBkMode", "address": "0x456380" }, { "name": "SetBkColor", "address": "0x456384" }, { "name": "SelectPalette", "address": "0x456388" }, { "name": "SelectObject", "address": "0x45638c" }, { "name": "SaveDC", "address": "0x456390" }, { "name": "RestoreDC", "address": "0x456394" }, { "name": "Rectangle", "address": "0x456398" }, { "name": "RectVisible", "address": "0x45639c" }, { "name": "RealizePalette", "address": "0x4563a0" }, { "name": "PatBlt", "address": "0x4563a4" }, { "name": "MoveToEx", "address": "0x4563a8" }, { "name": "MaskBlt", "address": "0x4563ac" }, { "name": "LineTo", "address": "0x4563b0" }, { "name": "IntersectClipRect", "address": "0x4563b4" }, { "name": "GetWindowOrgEx", "address": "0x4563b8" }, { "name": "GetTextMetricsA", "address": "0x4563bc" }, { "name": "GetTextExtentPoint32A", "address": "0x4563c0" }, { "name": "GetSystemPaletteEntries", "address": "0x4563c4" }, { "name": "GetStockObject", "address": "0x4563c8" }, { "name": "GetPixel", "address": "0x4563cc" }, { "name": "GetPaletteEntries", "address": "0x4563d0" }, { "name": "GetObjectA", "address": "0x4563d4" }, { "name": "GetGraphicsMode", "address": "0x4563d8" }, { "name": "GetDeviceCaps", "address": "0x4563dc" }, { "name": "GetDIBits", "address": "0x4563e0" }, { "name": "GetDIBColorTable", "address": "0x4563e4" }, { "name": "GetDCOrgEx", "address": "0x4563e8" }, { "name": "GetCurrentPositionEx", "address": "0x4563ec" }, { "name": "GetClipBox", "address": "0x4563f0" }, { "name": "GetBrushOrgEx", "address": "0x4563f4" }, { "name": "GetBkColor", "address": "0x4563f8" }, { "name": "GetBitmapBits", "address": "0x4563fc" }, { "name": "ExcludeClipRect", "address": "0x456400" }, { "name": "DeleteObject", "address": "0x456404" }, { "name": "DeleteDC", "address": "0x456408" }, { "name": "CreateSolidBrush", "address": "0x45640c" }, { "name": "CreatePenIndirect", "address": "0x456410" }, { "name": "CreatePalette", "address": "0x456414" }, { "name": "CreateHalftonePalette", "address": "0x456418" }, { "name": "CreateFontIndirectA", "address": "0x45641c" }, { "name": "CreateDIBitmap", "address": "0x456420" }, { "name": "CreateDIBSection", "address": "0x456424" }, { "name": "CreateCompatibleDC", "address": "0x456428" }, { "name": "CreateCompatibleBitmap", "address": "0x45642c" }, { "name": "CreateBrushIndirect", "address": "0x456430" }, { "name": "CreateBitmap", "address": "0x456434" }, { "name": "BitBlt", "address": "0x456438" } ], "dll": "gdi32.dll" }, { "imports": [ { "name": "CreateWindowExA", "address": "0x456440" }, { "name": "WindowFromPoint", "address": "0x456444" }, { "name": "WinHelpA", "address": "0x456448" }, { "name": "WaitMessage", "address": "0x45644c" }, { "name": "UpdateWindow", "address": "0x456450" }, { "name": "UnregisterClassA", "address": "0x456454" }, { "name": "UnhookWindowsHookEx", "address": "0x456458" }, { "name": "TranslateMessage", "address": "0x45645c" }, { "name": "TranslateMDISysAccel", "address": "0x456460" }, { "name": "TrackPopupMenu", "address": "0x456464" }, { "name": "SystemParametersInfoA", "address": "0x456468" }, { "name": "ShowWindow", "address": "0x45646c" }, { "name": "ShowScrollBar", "address": "0x456470" }, { "name": "ShowOwnedPopups", "address": "0x456474" }, { "name": "ShowCursor", "address": "0x456478" }, { "name": "SetWindowsHookExA", "address": "0x45647c" }, { "name": "SetWindowPos", "address": "0x456480" }, { "name": "SetWindowPlacement", "address": "0x456484" }, { "name": "SetWindowLongA", "address": "0x456488" }, { "name": "SetTimer", "address": "0x45648c" }, { "name": "SetScrollRange", "address": "0x456490" }, { "name": "SetScrollPos", "address": "0x456494" }, { "name": "SetScrollInfo", "address": "0x456498" }, { "name": "SetRect", "address": "0x45649c" }, { "name": "SetPropA", "address": "0x4564a0" }, { "name": "SetParent", "address": "0x4564a4" }, { "name": "SetMenuItemInfoA", "address": "0x4564a8" }, { "name": "SetMenu", "address": "0x4564ac" }, { "name": "SetForegroundWindow", "address": "0x4564b0" }, { "name": "SetFocus", "address": "0x4564b4" }, { "name": "SetCursor", "address": "0x4564b8" }, { "name": "SetClassLongA", "address": "0x4564bc" }, { "name": "SetCapture", "address": "0x4564c0" }, { "name": "SetActiveWindow", "address": "0x4564c4" }, { "name": "SendMessageA", "address": "0x4564c8" }, { "name": "ScrollWindow", "address": "0x4564cc" }, { "name": "ScreenToClient", "address": "0x4564d0" }, { "name": "RemovePropA", "address": "0x4564d4" }, { "name": "RemoveMenu", "address": "0x4564d8" }, { "name": "ReleaseDC", "address": "0x4564dc" }, { "name": "ReleaseCapture", "address": "0x4564e0" }, { "name": "RegisterWindowMessageA", "address": "0x4564e4" }, { "name": "RegisterClipboardFormatA", "address": "0x4564e8" }, { "name": "RegisterClassA", "address": "0x4564ec" }, { "name": "RedrawWindow", "address": "0x4564f0" }, { "name": "PtInRect", "address": "0x4564f4" }, { "name": "PostQuitMessage", "address": "0x4564f8" }, { "name": "PostMessageA", "address": "0x4564fc" }, { "name": "PeekMessageA", "address": "0x456500" }, { "name": "OffsetRect", "address": "0x456504" }, { "name": "OemToCharA", "address": "0x456508" }, { "name": "MessageBoxA", "address": "0x45650c" }, { "name": "MapWindowPoints", "address": "0x456510" }, { "name": "MapVirtualKeyA", "address": "0x456514" }, { "name": "LoadStringA", "address": "0x456518" }, { "name": "LoadKeyboardLayoutA", "address": "0x45651c" }, { "name": "LoadIconA", "address": "0x456520" }, { "name": "LoadCursorA", "address": "0x456524" }, { "name": "LoadBitmapA", "address": "0x456528" }, { "name": "KillTimer", "address": "0x45652c" }, { "name": "IsZoomed", "address": "0x456530" }, { "name": "IsWindowVisible", "address": "0x456534" }, { "name": "IsWindowEnabled", "address": "0x456538" }, { "name": "IsWindow", "address": "0x45653c" }, { "name": "IsRectEmpty", "address": "0x456540" }, { "name": "IsIconic", "address": "0x456544" }, { "name": "IsDialogMessageA", "address": "0x456548" }, { "name": "IsChild", "address": "0x45654c" }, { "name": "InvalidateRect", "address": "0x456550" }, { "name": "IntersectRect", "address": "0x456554" }, { "name": "InsertMenuItemA", "address": "0x456558" }, { "name": "InsertMenuA", "address": "0x45655c" }, { "name": "InflateRect", "address": "0x456560" }, { "name": "GetWindowThreadProcessId", "address": "0x456564" }, { "name": "GetWindowTextA", "address": "0x456568" }, { "name": "GetWindowRect", "address": "0x45656c" }, { "name": "GetWindowPlacement", "address": "0x456570" }, { "name": "GetWindowLongA", "address": "0x456574" }, { "name": "GetWindowDC", "address": "0x456578" }, { "name": "GetTopWindow", "address": "0x45657c" }, { "name": "GetSystemMetrics", "address": "0x456580" }, { "name": "GetSystemMenu", "address": "0x456584" }, { "name": "GetSysColorBrush", "address": "0x456588" }, { "name": "GetSysColor", "address": "0x45658c" }, { "name": "GetSubMenu", "address": "0x456590" }, { "name": "GetScrollRange", "address": "0x456594" }, { "name": "GetScrollPos", "address": "0x456598" }, { "name": "GetScrollInfo", "address": "0x45659c" }, { "name": "GetPropA", "address": "0x4565a0" }, { "name": "GetParent", "address": "0x4565a4" }, { "name": "GetWindow", "address": "0x4565a8" }, { "name": "GetMenuStringA", "address": "0x4565ac" }, { "name": "GetMenuState", "address": "0x4565b0" }, { "name": "GetMenuItemInfoA", "address": "0x4565b4" }, { "name": "GetMenuItemID", "address": "0x4565b8" }, { "name": "GetMenuItemCount", "address": "0x4565bc" }, { "name": "GetMenu", "address": "0x4565c0" }, { "name": "GetLastActivePopup", "address": "0x4565c4" }, { "name": "GetKeyboardState", "address": "0x4565c8" }, { "name": "GetKeyboardLayoutList", "address": "0x4565cc" }, { "name": "GetKeyboardLayout", "address": "0x4565d0" }, { "name": "GetKeyState", "address": "0x4565d4" }, { "name": "GetKeyNameTextA", "address": "0x4565d8" }, { "name": "GetIconInfo", "address": "0x4565dc" }, { "name": "GetForegroundWindow", "address": "0x4565e0" }, { "name": "GetFocus", "address": "0x4565e4" }, { "name": "GetDesktopWindow", "address": "0x4565e8" }, { "name": "GetDCEx", "address": "0x4565ec" }, { "name": "GetDC", "address": "0x4565f0" }, { "name": "GetCursorPos", "address": "0x4565f4" }, { "name": "GetCursor", "address": "0x4565f8" }, { "name": "GetClientRect", "address": "0x4565fc" }, { "name": "GetClassNameA", "address": "0x456600" }, { "name": "GetClassInfoA", "address": "0x456604" }, { "name": "GetCapture", "address": "0x456608" }, { "name": "GetActiveWindow", "address": "0x45660c" }, { "name": "FrameRect", "address": "0x456610" }, { "name": "FindWindowA", "address": "0x456614" }, { "name": "FillRect", "address": "0x456618" }, { "name": "EqualRect", "address": "0x45661c" }, { "name": "EnumWindows", "address": "0x456620" }, { "name": "EnumThreadWindows", "address": "0x456624" }, { "name": "EndPaint", "address": "0x456628" }, { "name": "EnableWindow", "address": "0x45662c" }, { "name": "EnableScrollBar", "address": "0x456630" }, { "name": "EnableMenuItem", "address": "0x456634" }, { "name": "DrawTextA", "address": "0x456638" }, { "name": "DrawMenuBar", "address": "0x45663c" }, { "name": "DrawIconEx", "address": "0x456640" }, { "name": "DrawIcon", "address": "0x456644" }, { "name": "DrawFrameControl", "address": "0x456648" }, { "name": "DrawFocusRect", "address": "0x45664c" }, { "name": "DrawEdge", "address": "0x456650" }, { "name": "DispatchMessageA", "address": "0x456654" }, { "name": "DestroyWindow", "address": "0x456658" }, { "name": "DestroyMenu", "address": "0x45665c" }, { "name": "DestroyIcon", "address": "0x456660" }, { "name": "DestroyCursor", "address": "0x456664" }, { "name": "DeleteMenu", "address": "0x456668" }, { "name": "DefWindowProcA", "address": "0x45666c" }, { "name": "DefMDIChildProcA", "address": "0x456670" }, { "name": "DefFrameProcA", "address": "0x456674" }, { "name": "CreatePopupMenu", "address": "0x456678" }, { "name": "CreateMenu", "address": "0x45667c" }, { "name": "CreateIcon", "address": "0x456680" }, { "name": "ClientToScreen", "address": "0x456684" }, { "name": "CheckMenuItem", "address": "0x456688" }, { "name": "CallWindowProcA", "address": "0x45668c" }, { "name": "CallNextHookEx", "address": "0x456690" }, { "name": "BeginPaint", "address": "0x456694" }, { "name": "CharNextA", "address": "0x456698" }, { "name": "CharLowerA", "address": "0x45669c" }, { "name": "CharToOemA", "address": "0x4566a0" }, { "name": "AdjustWindowRectEx", "address": "0x4566a4" }, { "name": "ActivateKeyboardLayout", "address": "0x4566a8" } ], "dll": "user32.dll" }, { "imports": [ { "name": "Sleep", "address": "0x4566b0" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "SafeArrayPtrOfIndex", "address": "0x4566b8" }, { "name": "SafeArrayGetUBound", "address": "0x4566bc" }, { "name": "SafeArrayGetLBound", "address": "0x4566c0" }, { "name": "SafeArrayCreate", "address": "0x4566c4" }, { "name": "VariantChangeType", "address": "0x4566c8" }, { "name": "VariantCopy", "address": "0x4566cc" }, { "name": "VariantClear", "address": "0x4566d0" }, { "name": "VariantInit", "address": "0x4566d4" } ], "dll": "oleaut32.dll" }, { "imports": [ { "name": "ImageList_SetIconSize", "address": "0x4566dc" }, { "name": "ImageList_GetIconSize", "address": "0x4566e0" }, { "name": "ImageList_Write", "address": "0x4566e4" }, { "name": "ImageList_Read", "address": "0x4566e8" }, { "name": "ImageList_GetDragImage", "address": "0x4566ec" }, { "name": "ImageList_DragShowNolock", "address": "0x4566f0" }, { "name": "ImageList_SetDragCursorImage", "address": "0x4566f4" }, { "name": "ImageList_DragMove", "address": "0x4566f8" }, { "name": "ImageList_DragLeave", "address": "0x4566fc" }, { "name": "ImageList_DragEnter", "address": "0x456700" }, { "name": "ImageList_EndDrag", "address": "0x456704" }, { "name": "ImageList_BeginDrag", "address": "0x456708" }, { "name": "ImageList_Remove", "address": "0x45670c" }, { "name": "ImageList_DrawEx", "address": "0x456710" }, { "name": "ImageList_Draw", "address": "0x456714" }, { "name": "ImageList_GetBkColor", "address": "0x456718" }, { "name": "ImageList_SetBkColor", "address": "0x45671c" }, { "name": "ImageList_ReplaceIcon", "address": "0x456720" }, { "name": "ImageList_Add", "address": "0x456724" }, { "name": "ImageList_SetImageCount", "address": "0x456728" }, { "name": "ImageList_GetImageCount", "address": "0x45672c" }, { "name": "ImageList_Destroy", "address": "0x456730" }, { "name": "ImageList_Create", "address": "0x456734" } ], "dll": "comctl32.dll" }, { "imports": [ { "name": "mciSendCommandA", "address": "0x45673c" }, { "name": "mciGetErrorStringA", "address": "0x456740" } ], "dll": "winmm.dll" } ], "digital_signers": null, "exported_dll_name": null, "actual_checksum": "0x000717ec", "overlay": null, "imagebase": "0x00400000", "reported_checksum": "0x00000000", "icon_hash": null, "entrypoint": "0x004523e4", "timestamp": "1992-06-19 22:22:17", "osversion": "4.0", "sections": [ { "name": "CODE", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "virtual_address": "0x00001000", "size_of_data": "0x00051600", "entropy": "6.51", "raw_address": "0x00000400", "virtual_size": "0x00051434", "characteristics_raw": "0x60000020" }, { "name": "DATA", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00053000", "size_of_data": "0x00001800", "entropy": "4.38", "raw_address": "0x00051a00", "virtual_size": "0x000016d8", "characteristics_raw": "0xc0000040" }, { "name": "BSS", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00055000", "size_of_data": "0x00000000", "entropy": "0.00", "raw_address": "0x00053200", "virtual_size": "0x00000bf9", "characteristics_raw": "0xc0000000" }, { "name": ".idata", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00056000", "size_of_data": "0x00002200", "entropy": "4.84", "raw_address": "0x00053200", "virtual_size": "0x00002134", "characteristics_raw": "0xc0000040" }, { "name": ".tls", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00059000", "size_of_data": "0x00000000", "entropy": "0.00", "raw_address": "0x00055400", "virtual_size": "0x00000010", "characteristics_raw": "0xc0000000" }, { "name": ".rdata", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x0005a000", "size_of_data": "0x00000200", "entropy": "0.20", "raw_address": "0x00055400", "virtual_size": "0x00000018", "characteristics_raw": "0x50000040" }, { "name": ".reloc", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x0005b000", "size_of_data": "0x00005a00", "entropy": "6.67", "raw_address": "0x00055600", "virtual_size": "0x00005964", "characteristics_raw": "0x50000040" }, { "name": ".rsrc", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x00061000", "size_of_data": "0x00007800", "entropy": "4.17", "raw_address": "0x0005b000", "virtual_size": "0x00007800", "characteristics_raw": "0x50000040" } ], "resources": [], "dirents": [ { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "size": "0x00000000" }, { "virtual_address": "0x00056000", "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "size": "0x00002134" }, { "virtual_address": "0x00061000", "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "size": "0x00007800" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "size": "0x00000000" }, { "virtual_address": "0x0005b000", "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "size": "0x00005964" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "size": "0x00000000" }, { "virtual_address": "0x0005a000", "name": "IMAGE_DIRECTORY_ENTRY_TLS", "size": "0x00000018" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_IAT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "size": "0x00000000" } ], "exports": [], "guest_signers": {}, "imphash": "0f15c679d20b1af2274142b9e8e5dd14", "icon_fuzzy": null, "icon": null, "pdbpath": null, "imported_dll_count": 14, "versioninfo": [] } } [*] Resolved APIs: [ "kernel32.dll.GetDiskFreeSpaceExA", "oleaut32.dll.VariantChangeTypeEx", "oleaut32.dll.VarNeg", "oleaut32.dll.VarNot", "oleaut32.dll.VarAdd", "oleaut32.dll.VarSub", "oleaut32.dll.VarMul", "oleaut32.dll.VarDiv", "oleaut32.dll.VarIdiv", "oleaut32.dll.VarMod", "oleaut32.dll.VarAnd", "oleaut32.dll.VarOr", "oleaut32.dll.VarXor", "oleaut32.dll.VarCmp", "oleaut32.dll.VarI4FromStr", "oleaut32.dll.VarR4FromStr", "oleaut32.dll.VarR8FromStr", "oleaut32.dll.VarDateFromStr", "oleaut32.dll.VarCyFromStr", "oleaut32.dll.VarBoolFromStr", "oleaut32.dll.VarBstrFromCy", "oleaut32.dll.VarBstrFromDate", "oleaut32.dll.VarBstrFromBool", "user32.dll.GetMonitorInfoA", "user32.dll.GetSystemMetrics", "user32.dll.EnumDisplayMonitors", "dwmapi.dll.DwmIsCompositionEnabled", "gdi32.dll.GetLayout", "gdi32.dll.GdiRealizationInfo", "gdi32.dll.FontIsLinked", "advapi32.dll.RegOpenKeyExW", "advapi32.dll.RegQueryInfoKeyW", "gdi32.dll.GetTextFaceAliasW", "advapi32.dll.RegEnumValueW", "advapi32.dll.RegCloseKey", "advapi32.dll.RegQueryValueExW", "gdi32.dll.GetFontAssocStatus", "advapi32.dll.RegQueryValueExA", "advapi32.dll.RegEnumKeyExW", "gdi32.dll.GdiIsMetaPrintDC", "user32.dll.AnimateWindow", "comctl32.dll.InitializeFlatSB", "comctl32.dll.UninitializeFlatSB", "comctl32.dll.FlatSB_GetScrollProp", "comctl32.dll.FlatSB_SetScrollProp", "comctl32.dll.FlatSB_EnableScrollBar", "comctl32.dll.FlatSB_ShowScrollBar", "comctl32.dll.FlatSB_GetScrollRange", "comctl32.dll.FlatSB_GetScrollInfo", "comctl32.dll.FlatSB_GetScrollPos", "comctl32.dll.FlatSB_SetScrollPos", "comctl32.dll.FlatSB_SetScrollInfo", "comctl32.dll.FlatSB_SetScrollRange", "user32.dll.SetLayeredWindowAttributes", "lpk.dll.LpkEditControl", "comctl32.dll.HIMAGELIST_QueryInterface", "comctl32.dll.DrawShadowText", "comctl32.dll.DrawSizeBox", "comctl32.dll.DrawScrollBar", "comctl32.dll.SizeBoxHwnd", "comctl32.dll.ScrollBar_MouseMove", "comctl32.dll.ScrollBar_Menu", "comctl32.dll.HandleScrollCmd", "comctl32.dll.DetachScrollBars", "comctl32.dll.AttachScrollBars", "comctl32.dll.CCSetScrollInfo", "comctl32.dll.CCGetScrollInfo", "comctl32.dll.CCEnableScrollBar", "comctl32.dll.QuerySystemGestureStatus", "uxtheme.dll.#49", "uxtheme.dll.CloseThemeData", "kernel32.dll.SortGetHandle", "kernel32.dll.SortCloseHandle", "uxtheme.dll.OpenThemeData", "uxtheme.dll.DrawThemeBackground", "uxtheme.dll.DrawThemeText", "uxtheme.dll.GetThemeBackgroundContentRect", "uxtheme.dll.GetThemePartSize", "uxtheme.dll.GetThemeTextExtent", "uxtheme.dll.GetThemeTextMetrics", "uxtheme.dll.GetThemeBackgroundRegion", "uxtheme.dll.HitTestThemeBackground", "uxtheme.dll.DrawThemeEdge", "uxtheme.dll.DrawThemeIcon", "uxtheme.dll.IsThemePartDefined", "uxtheme.dll.IsThemeBackgroundPartiallyTransparent", "uxtheme.dll.GetThemeColor", "uxtheme.dll.GetThemeMetric", "uxtheme.dll.GetThemeString", "uxtheme.dll.GetThemeBool", "uxtheme.dll.GetThemeInt", "uxtheme.dll.GetThemeEnumValue", "uxtheme.dll.GetThemePosition", "uxtheme.dll.GetThemeFont", "uxtheme.dll.GetThemeRect", "uxtheme.dll.GetThemeMargins", "uxtheme.dll.GetThemeIntList", "uxtheme.dll.GetThemePropertyOrigin", "uxtheme.dll.SetWindowTheme", "uxtheme.dll.GetThemeFilename", "uxtheme.dll.GetThemeSysColor", "uxtheme.dll.GetThemeSysColorBrush", "uxtheme.dll.GetThemeSysBool", "uxtheme.dll.GetThemeSysSize", "uxtheme.dll.GetThemeSysFont", "uxtheme.dll.GetThemeSysString", "uxtheme.dll.GetThemeSysInt", "uxtheme.dll.IsThemeActive", "uxtheme.dll.IsAppThemed", "uxtheme.dll.GetWindowTheme", "uxtheme.dll.EnableThemeDialogTexture", "uxtheme.dll.IsThemeDialogTextureEnabled", "uxtheme.dll.GetThemeAppProperties", "uxtheme.dll.SetThemeAppProperties", "uxtheme.dll.GetCurrentThemeName", "uxtheme.dll.GetThemeDocumentationProperty", "uxtheme.dll.DrawThemeParentBackground", "uxtheme.dll.EnableTheming" ] [*] Static Analysis: { "pe": { "peid_signatures": null, "imports": [ { "imports": [ { "name": "DeleteCriticalSection", "address": "0x45612c" }, { "name": "LeaveCriticalSection", "address": "0x456130" }, { "name": "EnterCriticalSection", "address": "0x456134" }, { "name": "InitializeCriticalSection", "address": "0x456138" }, { "name": "VirtualFree", "address": "0x45613c" }, { "name": "VirtualAlloc", "address": "0x456140" }, { "name": "LocalFree", "address": "0x456144" }, { "name": "LocalAlloc", "address": "0x456148" }, { "name": "GetVersion", "address": "0x45614c" }, { "name": "GetCurrentThreadId", "address": "0x456150" }, { "name": "InterlockedDecrement", "address": "0x456154" }, { "name": "InterlockedIncrement", "address": "0x456158" }, { "name": "VirtualQuery", "address": "0x45615c" }, { "name": "WideCharToMultiByte", "address": "0x456160" }, { "name": "MultiByteToWideChar", "address": "0x456164" }, { "name": "lstrlenA", "address": "0x456168" }, { "name": "lstrcpynA", "address": "0x45616c" }, { "name": "LoadLibraryExA", "address": "0x456170" }, { "name": "GetThreadLocale", "address": "0x456174" }, { "name": "GetStartupInfoA", "address": "0x456178" }, { "name": "GetProcAddress", "address": "0x45617c" }, { "name": "GetModuleHandleA", "address": "0x456180" }, { "name": "GetModuleFileNameA", "address": "0x456184" }, { "name": "GetLocaleInfoA", "address": "0x456188" }, { "name": "GetCommandLineA", "address": "0x45618c" }, { "name": "FreeLibrary", "address": "0x456190" }, { "name": "FindFirstFileA", "address": "0x456194" }, { "name": "FindClose", "address": "0x456198" }, { "name": "ExitProcess", "address": "0x45619c" }, { "name": "WriteFile", "address": "0x4561a0" }, { "name": "UnhandledExceptionFilter", "address": "0x4561a4" }, { "name": "RtlUnwind", "address": "0x4561a8" }, { "name": "RaiseException", "address": "0x4561ac" }, { "name": "GetStdHandle", "address": "0x4561b0" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "GetKeyboardType", "address": "0x4561b8" }, { "name": "LoadStringA", "address": "0x4561bc" }, { "name": "MessageBoxA", "address": "0x4561c0" }, { "name": "CharNextA", "address": "0x4561c4" } ], "dll": "user32.dll" }, { "imports": [ { "name": "RegQueryValueExA", "address": "0x4561cc" }, { "name": "RegOpenKeyExA", "address": "0x4561d0" }, { "name": "RegCloseKey", "address": "0x4561d4" } ], "dll": "advapi32.dll" }, { "imports": [ { "name": "SysFreeString", "address": "0x4561dc" }, { "name": "SysReAllocStringLen", "address": "0x4561e0" }, { "name": "SysAllocStringLen", "address": "0x4561e4" } ], "dll": "oleaut32.dll" }, { "imports": [ { "name": "TlsSetValue", "address": "0x4561ec" }, { "name": "TlsGetValue", "address": "0x4561f0" }, { "name": "LocalAlloc", "address": "0x4561f4" }, { "name": "GetModuleHandleA", "address": "0x4561f8" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "RegQueryValueExA", "address": "0x456200" }, { "name": "RegOpenKeyExA", "address": "0x456204" }, { "name": "RegCloseKey", "address": "0x456208" } ], "dll": "advapi32.dll" }, { "imports": [ { "name": "lstrcpyA", "address": "0x456210" }, { "name": "lstrcmpiA", "address": "0x456214" }, { "name": "WriteProcessMemory", "address": "0x456218" }, { "name": "WriteFile", "address": "0x45621c" }, { "name": "WaitForSingleObject", "address": "0x456220" }, { "name": "VirtualQuery", "address": "0x456224" }, { "name": "VirtualProtect", "address": "0x456228" }, { "name": "VirtualFree", "address": "0x45622c" }, { "name": "VirtualAllocEx", "address": "0x456230" }, { "name": "VirtualAlloc", "address": "0x456234" }, { "name": "Sleep", "address": "0x456238" }, { "name": "SizeofResource", "address": "0x45623c" }, { "name": "SetThreadLocale", "address": "0x456240" }, { "name": "SetFilePointer", "address": "0x456244" }, { "name": "SetEvent", "address": "0x456248" }, { "name": "SetErrorMode", "address": "0x45624c" }, { "name": "SetEndOfFile", "address": "0x456250" }, { "name": "ResetEvent", "address": "0x456254" }, { "name": "ReadProcessMemory", "address": "0x456258" }, { "name": "ReadFile", "address": "0x45625c" }, { "name": "MulDiv", "address": "0x456260" }, { "name": "LockResource", "address": "0x456264" }, { "name": "LoadResource", "address": "0x456268" }, { "name": "LoadLibraryA", "address": "0x45626c" }, { "name": "LeaveCriticalSection", "address": "0x456270" }, { "name": "InitializeCriticalSection", "address": "0x456274" }, { "name": "GlobalUnlock", "address": "0x456278" }, { "name": "GlobalReAlloc", "address": "0x45627c" }, { "name": "GlobalHandle", "address": "0x456280" }, { "name": "GlobalLock", "address": "0x456284" }, { "name": "GlobalFree", "address": "0x456288" }, { "name": "GlobalFindAtomA", "address": "0x45628c" }, { "name": "GlobalDeleteAtom", "address": "0x456290" }, { "name": "GlobalAlloc", "address": "0x456294" }, { "name": "GlobalAddAtomA", "address": "0x456298" }, { "name": "GetVersionExA", "address": "0x45629c" }, { "name": "GetVersion", "address": "0x4562a0" }, { "name": "GetTickCount", "address": "0x4562a4" }, { "name": "GetThreadLocale", "address": "0x4562a8" }, { "name": "GetTempPathA", "address": "0x4562ac" }, { "name": "GetSystemInfo", "address": "0x4562b0" }, { "name": "GetStringTypeExA", "address": "0x4562b4" }, { "name": "GetStdHandle", "address": "0x4562b8" }, { "name": "GetProcAddress", "address": "0x4562bc" }, { "name": "GetModuleHandleA", "address": "0x4562c0" }, { "name": "GetModuleFileNameA", "address": "0x4562c4" }, { "name": "GetLocaleInfoA", "address": "0x4562c8" }, { "name": "GetLocalTime", "address": "0x4562cc" }, { "name": "GetLastError", "address": "0x4562d0" }, { "name": "GetFullPathNameA", "address": "0x4562d4" }, { "name": "GetExitCodeThread", "address": "0x4562d8" }, { "name": "GetDiskFreeSpaceA", "address": "0x4562dc" }, { "name": "GetDateFormatA", "address": "0x4562e0" }, { "name": "GetCurrentThreadId", "address": "0x4562e4" }, { "name": "GetCurrentProcessId", "address": "0x4562e8" }, { "name": "GetCPInfo", "address": "0x4562ec" }, { "name": "GetACP", "address": "0x4562f0" }, { "name": "FreeResource", "address": "0x4562f4" }, { "name": "InterlockedExchange", "address": "0x4562f8" }, { "name": "FreeLibrary", "address": "0x4562fc" }, { "name": "FormatMessageA", "address": "0x456300" }, { "name": "FindResourceA", "address": "0x456304" }, { "name": "FindFirstFileA", "address": "0x456308" }, { "name": "FindClose", "address": "0x45630c" }, { "name": "FileTimeToLocalFileTime", "address": "0x456310" }, { "name": "FileTimeToDosDateTime", "address": "0x456314" }, { "name": "ExitProcess", "address": "0x456318" }, { "name": "EnumCalendarInfoA", "address": "0x45631c" }, { "name": "EnterCriticalSection", "address": "0x456320" }, { "name": "DeleteCriticalSection", "address": "0x456324" }, { "name": "CreateThread", "address": "0x456328" }, { "name": "CreateRemoteThread", "address": "0x45632c" }, { "name": "CreateProcessA", "address": "0x456330" }, { "name": "CreateFileA", "address": "0x456334" }, { "name": "CreateEventA", "address": "0x456338" }, { "name": "CompareStringA", "address": "0x45633c" }, { "name": "CloseHandle", "address": "0x456340" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "VerQueryValueA", "address": "0x456348" }, { "name": "GetFileVersionInfoSizeA", "address": "0x45634c" }, { "name": "GetFileVersionInfoA", "address": "0x456350" } ], "dll": "version.dll" }, { "imports": [ { "name": "UnrealizeObject", "address": "0x456358" }, { "name": "StretchBlt", "address": "0x45635c" }, { "name": "SetWindowOrgEx", "address": "0x456360" }, { "name": "SetViewportOrgEx", "address": "0x456364" }, { "name": "SetTextColor", "address": "0x456368" }, { "name": "SetStretchBltMode", "address": "0x45636c" }, { "name": "SetROP2", "address": "0x456370" }, { "name": "SetPixel", "address": "0x456374" }, { "name": "SetDIBColorTable", "address": "0x456378" }, { "name": "SetBrushOrgEx", "address": "0x45637c" }, { "name": "SetBkMode", "address": "0x456380" }, { "name": "SetBkColor", "address": "0x456384" }, { "name": "SelectPalette", "address": "0x456388" }, { "name": "SelectObject", "address": "0x45638c" }, { "name": "SaveDC", "address": "0x456390" }, { "name": "RestoreDC", "address": "0x456394" }, { "name": "Rectangle", "address": "0x456398" }, { "name": "RectVisible", "address": "0x45639c" }, { "name": "RealizePalette", "address": "0x4563a0" }, { "name": "PatBlt", "address": "0x4563a4" }, { "name": "MoveToEx", "address": "0x4563a8" }, { "name": "MaskBlt", "address": "0x4563ac" }, { "name": "LineTo", "address": "0x4563b0" }, { "name": "IntersectClipRect", "address": "0x4563b4" }, { "name": "GetWindowOrgEx", "address": "0x4563b8" }, { "name": "GetTextMetricsA", "address": "0x4563bc" }, { "name": "GetTextExtentPoint32A", "address": "0x4563c0" }, { "name": "GetSystemPaletteEntries", "address": "0x4563c4" }, { "name": "GetStockObject", "address": "0x4563c8" }, { "name": "GetPixel", "address": "0x4563cc" }, { "name": "GetPaletteEntries", "address": "0x4563d0" }, { "name": "GetObjectA", "address": "0x4563d4" }, { "name": "GetGraphicsMode", "address": "0x4563d8" }, { "name": "GetDeviceCaps", "address": "0x4563dc" }, { "name": "GetDIBits", "address": "0x4563e0" }, { "name": "GetDIBColorTable", "address": "0x4563e4" }, { "name": "GetDCOrgEx", "address": "0x4563e8" }, { "name": "GetCurrentPositionEx", "address": "0x4563ec" }, { "name": "GetClipBox", "address": "0x4563f0" }, { "name": "GetBrushOrgEx", "address": "0x4563f4" }, { "name": "GetBkColor", "address": "0x4563f8" }, { "name": "GetBitmapBits", "address": "0x4563fc" }, { "name": "ExcludeClipRect", "address": "0x456400" }, { "name": "DeleteObject", "address": "0x456404" }, { "name": "DeleteDC", "address": "0x456408" }, { "name": "CreateSolidBrush", "address": "0x45640c" }, { "name": "CreatePenIndirect", "address": "0x456410" }, { "name": "CreatePalette", "address": "0x456414" }, { "name": "CreateHalftonePalette", "address": "0x456418" }, { "name": "CreateFontIndirectA", "address": "0x45641c" }, { "name": "CreateDIBitmap", "address": "0x456420" }, { "name": "CreateDIBSection", "address": "0x456424" }, { "name": "CreateCompatibleDC", "address": "0x456428" }, { "name": "CreateCompatibleBitmap", "address": "0x45642c" }, { "name": "CreateBrushIndirect", "address": "0x456430" }, { "name": "CreateBitmap", "address": "0x456434" }, { "name": "BitBlt", "address": "0x456438" } ], "dll": "gdi32.dll" }, { "imports": [ { "name": "CreateWindowExA", "address": "0x456440" }, { "name": "WindowFromPoint", "address": "0x456444" }, { "name": "WinHelpA", "address": "0x456448" }, { "name": "WaitMessage", "address": "0x45644c" }, { "name": "UpdateWindow", "address": "0x456450" }, { "name": "UnregisterClassA", "address": "0x456454" }, { "name": "UnhookWindowsHookEx", "address": "0x456458" }, { "name": "TranslateMessage", "address": "0x45645c" }, { "name": "TranslateMDISysAccel", "address": "0x456460" }, { "name": "TrackPopupMenu", "address": "0x456464" }, { "name": "SystemParametersInfoA", "address": "0x456468" }, { "name": "ShowWindow", "address": "0x45646c" }, { "name": "ShowScrollBar", "address": "0x456470" }, { "name": "ShowOwnedPopups", "address": "0x456474" }, { "name": "ShowCursor", "address": "0x456478" }, { "name": "SetWindowsHookExA", "address": "0x45647c" }, { "name": "SetWindowPos", "address": "0x456480" }, { "name": "SetWindowPlacement", "address": "0x456484" }, { "name": "SetWindowLongA", "address": "0x456488" }, { "name": "SetTimer", "address": "0x45648c" }, { "name": "SetScrollRange", "address": "0x456490" }, { "name": "SetScrollPos", "address": "0x456494" }, { "name": "SetScrollInfo", "address": "0x456498" }, { "name": "SetRect", "address": "0x45649c" }, { "name": "SetPropA", "address": "0x4564a0" }, { "name": "SetParent", "address": "0x4564a4" }, { "name": "SetMenuItemInfoA", "address": "0x4564a8" }, { "name": "SetMenu", "address": "0x4564ac" }, { "name": "SetForegroundWindow", "address": "0x4564b0" }, { "name": "SetFocus", "address": "0x4564b4" }, { "name": "SetCursor", "address": "0x4564b8" }, { "name": "SetClassLongA", "address": "0x4564bc" }, { "name": "SetCapture", "address": "0x4564c0" }, { "name": "SetActiveWindow", "address": "0x4564c4" }, { "name": "SendMessageA", "address": "0x4564c8" }, { "name": "ScrollWindow", "address": "0x4564cc" }, { "name": "ScreenToClient", "address": "0x4564d0" }, { "name": "RemovePropA", "address": "0x4564d4" }, { "name": "RemoveMenu", "address": "0x4564d8" }, { "name": "ReleaseDC", "address": "0x4564dc" }, { "name": "ReleaseCapture", "address": "0x4564e0" }, { "name": "RegisterWindowMessageA", "address": "0x4564e4" }, { "name": "RegisterClipboardFormatA", "address": "0x4564e8" }, { "name": "RegisterClassA", "address": "0x4564ec" }, { "name": "RedrawWindow", "address": "0x4564f0" }, { "name": "PtInRect", "address": "0x4564f4" }, { "name": "PostQuitMessage", "address": "0x4564f8" }, { "name": "PostMessageA", "address": "0x4564fc" }, { "name": "PeekMessageA", "address": "0x456500" }, { "name": "OffsetRect", "address": "0x456504" }, { "name": "OemToCharA", "address": "0x456508" }, { "name": "MessageBoxA", "address": "0x45650c" }, { "name": "MapWindowPoints", "address": "0x456510" }, { "name": "MapVirtualKeyA", "address": "0x456514" }, { "name": "LoadStringA", "address": "0x456518" }, { "name": "LoadKeyboardLayoutA", "address": "0x45651c" }, { "name": "LoadIconA", "address": "0x456520" }, { "name": "LoadCursorA", "address": "0x456524" }, { "name": "LoadBitmapA", "address": "0x456528" }, { "name": "KillTimer", "address": "0x45652c" }, { "name": "IsZoomed", "address": "0x456530" }, { "name": "IsWindowVisible", "address": "0x456534" }, { "name": "IsWindowEnabled", "address": "0x456538" }, { "name": "IsWindow", "address": "0x45653c" }, { "name": "IsRectEmpty", "address": "0x456540" }, { "name": "IsIconic", "address": "0x456544" }, { "name": "IsDialogMessageA", "address": "0x456548" }, { "name": "IsChild", "address": "0x45654c" }, { "name": "InvalidateRect", "address": "0x456550" }, { "name": "IntersectRect", "address": "0x456554" }, { "name": "InsertMenuItemA", "address": "0x456558" }, { "name": "InsertMenuA", "address": "0x45655c" }, { "name": "InflateRect", "address": "0x456560" }, { "name": "GetWindowThreadProcessId", "address": "0x456564" }, { "name": "GetWindowTextA", "address": "0x456568" }, { "name": "GetWindowRect", "address": "0x45656c" }, { "name": "GetWindowPlacement", "address": "0x456570" }, { "name": "GetWindowLongA", "address": "0x456574" }, { "name": "GetWindowDC", "address": "0x456578" }, { "name": "GetTopWindow", "address": "0x45657c" }, { "name": "GetSystemMetrics", "address": "0x456580" }, { "name": "GetSystemMenu", "address": "0x456584" }, { "name": "GetSysColorBrush", "address": "0x456588" }, { "name": "GetSysColor", "address": "0x45658c" }, { "name": "GetSubMenu", "address": "0x456590" }, { "name": "GetScrollRange", "address": "0x456594" }, { "name": "GetScrollPos", "address": "0x456598" }, { "name": "GetScrollInfo", "address": "0x45659c" }, { "name": "GetPropA", "address": "0x4565a0" }, { "name": "GetParent", "address": "0x4565a4" }, { "name": "GetWindow", "address": "0x4565a8" }, { "name": "GetMenuStringA", "address": "0x4565ac" }, { "name": "GetMenuState", "address": "0x4565b0" }, { "name": "GetMenuItemInfoA", "address": "0x4565b4" }, { "name": "GetMenuItemID", "address": "0x4565b8" }, { "name": "GetMenuItemCount", "address": "0x4565bc" }, { "name": "GetMenu", "address": "0x4565c0" }, { "name": "GetLastActivePopup", "address": "0x4565c4" }, { "name": "GetKeyboardState", "address": "0x4565c8" }, { "name": "GetKeyboardLayoutList", "address": "0x4565cc" }, { "name": "GetKeyboardLayout", "address": "0x4565d0" }, { "name": "GetKeyState", "address": "0x4565d4" }, { "name": "GetKeyNameTextA", "address": "0x4565d8" }, { "name": "GetIconInfo", "address": "0x4565dc" }, { "name": "GetForegroundWindow", "address": "0x4565e0" }, { "name": "GetFocus", "address": "0x4565e4" }, { "name": "GetDesktopWindow", "address": "0x4565e8" }, { "name": "GetDCEx", "address": "0x4565ec" }, { "name": "GetDC", "address": "0x4565f0" }, { "name": "GetCursorPos", "address": "0x4565f4" }, { "name": "GetCursor", "address": "0x4565f8" }, { "name": "GetClientRect", "address": "0x4565fc" }, { "name": "GetClassNameA", "address": "0x456600" }, { "name": "GetClassInfoA", "address": "0x456604" }, { "name": "GetCapture", "address": "0x456608" }, { "name": "GetActiveWindow", "address": "0x45660c" }, { "name": "FrameRect", "address": "0x456610" }, { "name": "FindWindowA", "address": "0x456614" }, { "name": "FillRect", "address": "0x456618" }, { "name": "EqualRect", "address": "0x45661c" }, { "name": "EnumWindows", "address": "0x456620" }, { "name": "EnumThreadWindows", "address": "0x456624" }, { "name": "EndPaint", "address": "0x456628" }, { "name": "EnableWindow", "address": "0x45662c" }, { "name": "EnableScrollBar", "address": "0x456630" }, { "name": "EnableMenuItem", "address": "0x456634" }, { "name": "DrawTextA", "address": "0x456638" }, { "name": "DrawMenuBar", "address": "0x45663c" }, { "name": "DrawIconEx", "address": "0x456640" }, { "name": "DrawIcon", "address": "0x456644" }, { "name": "DrawFrameControl", "address": "0x456648" }, { "name": "DrawFocusRect", "address": "0x45664c" }, { "name": "DrawEdge", "address": "0x456650" }, { "name": "DispatchMessageA", "address": "0x456654" }, { "name": "DestroyWindow", "address": "0x456658" }, { "name": "DestroyMenu", "address": "0x45665c" }, { "name": "DestroyIcon", "address": "0x456660" }, { "name": "DestroyCursor", "address": "0x456664" }, { "name": "DeleteMenu", "address": "0x456668" }, { "name": "DefWindowProcA", "address": "0x45666c" }, { "name": "DefMDIChildProcA", "address": "0x456670" }, { "name": "DefFrameProcA", "address": "0x456674" }, { "name": "CreatePopupMenu", "address": "0x456678" }, { "name": "CreateMenu", "address": "0x45667c" }, { "name": "CreateIcon", "address": "0x456680" }, { "name": "ClientToScreen", "address": "0x456684" }, { "name": "CheckMenuItem", "address": "0x456688" }, { "name": "CallWindowProcA", "address": "0x45668c" }, { "name": "CallNextHookEx", "address": "0x456690" }, { "name": "BeginPaint", "address": "0x456694" }, { "name": "CharNextA", "address": "0x456698" }, { "name": "CharLowerA", "address": "0x45669c" }, { "name": "CharToOemA", "address": "0x4566a0" }, { "name": "AdjustWindowRectEx", "address": "0x4566a4" }, { "name": "ActivateKeyboardLayout", "address": "0x4566a8" } ], "dll": "user32.dll" }, { "imports": [ { "name": "Sleep", "address": "0x4566b0" } ], "dll": "kernel32.dll" }, { "imports": [ { "name": "SafeArrayPtrOfIndex", "address": "0x4566b8" }, { "name": "SafeArrayGetUBound", "address": "0x4566bc" }, { "name": "SafeArrayGetLBound", "address": "0x4566c0" }, { "name": "SafeArrayCreate", "address": "0x4566c4" }, { "name": "VariantChangeType", "address": "0x4566c8" }, { "name": "VariantCopy", "address": "0x4566cc" }, { "name": "VariantClear", "address": "0x4566d0" }, { "name": "VariantInit", "address": "0x4566d4" } ], "dll": "oleaut32.dll" }, { "imports": [ { "name": "ImageList_SetIconSize", "address": "0x4566dc" }, { "name": "ImageList_GetIconSize", "address": "0x4566e0" }, { "name": "ImageList_Write", "address": "0x4566e4" }, { "name": "ImageList_Read", "address": "0x4566e8" }, { "name": "ImageList_GetDragImage", "address": "0x4566ec" }, { "name": "ImageList_DragShowNolock", "address": "0x4566f0" }, { "name": "ImageList_SetDragCursorImage", "address": "0x4566f4" }, { "name": "ImageList_DragMove", "address": "0x4566f8" }, { "name": "ImageList_DragLeave", "address": "0x4566fc" }, { "name": "ImageList_DragEnter", "address": "0x456700" }, { "name": "ImageList_EndDrag", "address": "0x456704" }, { "name": "ImageList_BeginDrag", "address": "0x456708" }, { "name": "ImageList_Remove", "address": "0x45670c" }, { "name": "ImageList_DrawEx", "address": "0x456710" }, { "name": "ImageList_Draw", "address": "0x456714" }, { "name": "ImageList_GetBkColor", "address": "0x456718" }, { "name": "ImageList_SetBkColor", "address": "0x45671c" }, { "name": "ImageList_ReplaceIcon", "address": "0x456720" }, { "name": "ImageList_Add", "address": "0x456724" }, { "name": "ImageList_SetImageCount", "address": "0x456728" }, { "name": "ImageList_GetImageCount", "address": "0x45672c" }, { "name": "ImageList_Destroy", "address": "0x456730" }, { "name": "ImageList_Create", "address": "0x456734" } ], "dll": "comctl32.dll" }, { "imports": [ { "name": "mciSendCommandA", "address": "0x45673c" }, { "name": "mciGetErrorStringA", "address": "0x456740" } ], "dll": "winmm.dll" } ], "digital_signers": null, "exported_dll_name": null, "actual_checksum": "0x000717ec", "overlay": null, "imagebase": "0x00400000", "reported_checksum": "0x00000000", "icon_hash": null, "entrypoint": "0x004523e4", "timestamp": "1992-06-19 22:22:17", "osversion": "4.0", "sections": [ { "name": "CODE", "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ", "virtual_address": "0x00001000", "size_of_data": "0x00051600", "entropy": "6.51", "raw_address": "0x00000400", "virtual_size": "0x00051434", "characteristics_raw": "0x60000020" }, { "name": "DATA", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00053000", "size_of_data": "0x00001800", "entropy": "4.38", "raw_address": "0x00051a00", "virtual_size": "0x000016d8", "characteristics_raw": "0xc0000040" }, { "name": "BSS", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00055000", "size_of_data": "0x00000000", "entropy": "0.00", "raw_address": "0x00053200", "virtual_size": "0x00000bf9", "characteristics_raw": "0xc0000000" }, { "name": ".idata", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00056000", "size_of_data": "0x00002200", "entropy": "4.84", "raw_address": "0x00053200", "virtual_size": "0x00002134", "characteristics_raw": "0xc0000040" }, { "name": ".tls", "characteristics": "IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE", "virtual_address": "0x00059000", "size_of_data": "0x00000000", "entropy": "0.00", "raw_address": "0x00055400", "virtual_size": "0x00000010", "characteristics_raw": "0xc0000000" }, { "name": ".rdata", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x0005a000", "size_of_data": "0x00000200", "entropy": "0.20", "raw_address": "0x00055400", "virtual_size": "0x00000018", "characteristics_raw": "0x50000040" }, { "name": ".reloc", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x0005b000", "size_of_data": "0x00005a00", "entropy": "6.67", "raw_address": "0x00055600", "virtual_size": "0x00005964", "characteristics_raw": "0x50000040" }, { "name": ".rsrc", "characteristics": "IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ", "virtual_address": "0x00061000", "size_of_data": "0x00007800", "entropy": "4.17", "raw_address": "0x0005b000", "virtual_size": "0x00007800", "characteristics_raw": "0x50000040" } ], "resources": [], "dirents": [ { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_EXPORT", "size": "0x00000000" }, { "virtual_address": "0x00056000", "name": "IMAGE_DIRECTORY_ENTRY_IMPORT", "size": "0x00002134" }, { "virtual_address": "0x00061000", "name": "IMAGE_DIRECTORY_ENTRY_RESOURCE", "size": "0x00007800" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_EXCEPTION", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_SECURITY", "size": "0x00000000" }, { "virtual_address": "0x0005b000", "name": "IMAGE_DIRECTORY_ENTRY_BASERELOC", "size": "0x00005964" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_DEBUG", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_COPYRIGHT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_GLOBALPTR", "size": "0x00000000" }, { "virtual_address": "0x0005a000", "name": "IMAGE_DIRECTORY_ENTRY_TLS", "size": "0x00000018" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_IAT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR", "size": "0x00000000" }, { "virtual_address": "0x00000000", "name": "IMAGE_DIRECTORY_ENTRY_RESERVED", "size": "0x00000000" } ], "exports": [], "guest_signers": {}, "imphash": "0f15c679d20b1af2274142b9e8e5dd14", "icon_fuzzy": null, "icon": null, "pdbpath": null, "imported_dll_count": 14, "versioninfo": [] } }