a25c053102dcdb575d022d3ca1188ae0a69789bc29beffb045909618dcb49940

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2017-May-23 06:35:37
Detected languages Chinese - PRC
English - United States
TLS Callbacks 1 callback(s) detected.
Debug artifacts D:\SVN\install.v3\src\iku_git_hotfix_v700\build_module_vs2013\bin\Publish\YoukuMediaCenter.pdb
CompanyName youku.com
FileDescription 优酷媒体中心
FileVersion 7.1.9.5231
InternalName YoukuMediaCenter.exe
LegalCopyright Copyright(c)2017 youku.com. All rights reserved.
OriginalFilename YoukuMediaCenter.exe
ProductName 优酷媒体中心
ProductVersion 7.1.9.5231

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig1(h)
Suspicious Strings found in the binary may indicate undesirable behavior: Accesses the WMI:
  • ROOT\CIMV2
Info Cryptographic algorithms detected in the binary: Uses constants related to CRC32
Uses constants related to MD5
Malicious The PE contains functions mostly used by malware. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryA
  • LoadLibraryW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
  • FindWindowW
 Can access the registry:
  • RegDeleteValueW
  • RegSetValueExW
  • RegQueryValueExW
  • RegQueryInfoKeyW
  • RegOpenKeyExW
  • RegEnumKeyExW
  • RegDeleteKeyW
  • RegCreateKeyExW
  • RegCloseKey
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Has Internet access capabilities:
  • InternetSetCookieA
  • InternetReadFile
  • InternetConnectW
  • InternetCloseHandle
  • InternetOpenW
  • InternetTimeToSystemTimeA
  • InternetSetFilePointer
  • InternetSetOptionW
  • InternetTimeFromSystemTimeA
 Leverages the raw socket API to access the Internet:
  • #116
  • #115
 Functions related to the privilege level:
  • OpenProcessToken
  • AdjustTokenPrivileges
 Enumerates local disk drives:
  • GetDriveTypeW
 Manipulates other processes:
  • Process32FirstW
  • Process32NextW
  • ReadProcessMemory
  • OpenProcess
Info The PE is digitally signed. Signer: \xE5\x90\x88\xE4\xB8\x80\xE7\xBD\x91\xE7\xBB\x9C\xE6\x8A\x80\xE6\x9C\xAF\xEF\xBC\x88\xE5\x8C\x97\xE4\xBA\xAC\xEF\xBC\x89\xE6\x9C\x89\xE9\x99\x90\xE5\x85\xAC\xE5\x8F\xB8
Issuer: WoSign Class 3 Code Signing CA
Suspicious VirusTotal score: 1/61 (Scanned on 2017-06-03 08:57:29) Zillya: Adware.YoukuCRTD.Win32.5338

Hashes

MD5 1bf9277cc045362472d1ba55e4d31dd5 🔍
SHA1 90cc96d56f0564077143a1c37f806d987bbe70ac 🔍
SHA256 a25c053102dcdb575d022d3ca1188ae0a69789bc29beffb045909618dcb49940 🔍
SHA3 7a4cf6a54a4db8c6f8536b802142d9acf9e5e0e396046b4749b135cadd6f51a2 🔍
SSDeep 12288:KVm+YtFZmmyHTkY5ldlwgDrfitoHhy7DVJbHW/TjFflI3MWHRohhh0fI:Y+tFZNY3bdVrfitocRNoThlI3bHRMhsI 🔍
Imports Hash 155d3fb1567c21144f039d488013bec3 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x120

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2017-May-23 06:35:37
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE

Image Optional Header

Magic PE32
LinkerVersion 12.0
SizeOfCode 0x9c800
SizeOfInitializedData 0x4c600
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00058859 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x9e000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0xed000
SizeOfHeaders 0x400
Checksum 0xf216c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 829fcafb69718ab80364aa9808720832 🔍
SHA1 2450c4aee0579c6abc58d008a194f995bf3c220c 🔍
SHA256 c9c71dfc476742d5bbb04b2a673b0b20251f0d2b8923360a8d10b8ca6a890364 🔍
SHA3 dcf9d15c4dad91ddc5d068a2b4d672d0df77c896f6a0ead747f6b394dee9736b 🔍
VirtualSize 0x9c69c
VirtualAddress 0x1000
SizeOfRawData 0x9c800
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.16023

.rdata

MD5 8d79a2b9d402d4dffcc67337b22b7480 🔍
SHA1 f4cfa14d67b1259cc196b8afcbd0683f6c3a6a22 🔍
SHA256 2f55b920864484f2e4b44c626150ee76780727d61af6b657c51d99039028ffe7 🔍
SHA3 825a47266d5b42301c2afa8d32247c1e22f36053ef427655eed3b89e5aecd3da 🔍
VirtualSize 0x195c2
VirtualAddress 0x9e000
SizeOfRawData 0x19600
PointerToRawData 0x9cc00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.38003

.data

MD5 3b06ad6ffae023964bcf36ab6260f290 🔍
SHA1 debf92e70b143fabb1b635f121bf49d6924e616d 🔍
SHA256 c22c21cf6590ed1dd38e0a602b2c1b3943a6c598203aebef283c6eaf516a943b 🔍
SHA3 959ceb87aa0d787b0a8ddff8af26835e21cb0069843a08aa97e4122d0679eb47 🔍
VirtualSize 0x3984
VirtualAddress 0xb8000
SizeOfRawData 0x2c00
PointerToRawData 0xb6200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 4.73896

.tls

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x2
VirtualAddress 0xbc000
SizeOfRawData 0x200
PointerToRawData 0xb8e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 19d4b429b879600ac9c30339a4337a0e 🔍
SHA1 d271529777da217d9c763eef7fd1dd4a3e18fc64 🔍
SHA256 feca279144691bc5a0b7fec046e04899d3962584025f8e3500c6318335443afa 🔍
SHA3 256ba5f234037bd36263a2e3a85180077941634b371a84d385ac2a7d32a44b4c 🔍
VirtualSize 0x28ad0
VirtualAddress 0xbd000
SizeOfRawData 0x28c00
PointerToRawData 0xb9000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.37466

.reloc

MD5 f878f890cd86fef1596d77d341a3e53a 🔍
SHA1 84460a5bb814f3b6c09b48a39d56f8b46c47dcc5 🔍
SHA256 49f32176a38085dc849d9fa053ad20487410ef38380eadbf4338ed307c70dc27 🔍
SHA3 dbc2c35156e0bac99a7ebbfd95e61d1cd4e432ff1df32738889874fba7fcf261 🔍
VirtualSize 0x6684
VirtualAddress 0xe6000
SizeOfRawData 0x6800
PointerToRawData 0xe1c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.55511

Imports

PSAPI.DLL GetModuleFileNameExW
KERNEL32.dll GetSystemTimeAsFileTime
LeaveCriticalSection
TerminateProcess
InterlockedExchange
GetLastError
GetProcAddress
EnterCriticalSection
Process32FirstW
InterlockedExchangeAdd
CreateEventW
PostQueuedCompletionStatus
Module32FirstW
Process32NextW
CreateWaitableTimerW
CreateToolhelp32Snapshot
GetCurrentThreadId
OutputDebugStringA
TlsAlloc
CloseHandle
TlsFree
MultiByteToWideChar
WideCharToMultiByte
FreeResource
LockResource
Sleep
LoadResource
SizeofResource
GetLogicalDrives
DeviceIoControl
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
GetTickCount
GetModuleFileNameW
GetModuleHandleW
CreateProcessW
OutputDebugStringW
FindResourceW
GetDriveTypeW
GetSystemDirectoryW
GetTempPathW
GetDiskFreeSpaceExW
RemoveDirectoryW
CreateFileW
SetFileAttributesW
DeleteFileW
FindFirstFileA
SetEvent
FindNextFileW
CopyFileW
MoveFileExW
CreateJobObjectW
AssignProcessToJobObject
SetInformationJobObject
GetACP
SetConsoleCtrlHandler
AllocConsole
FreeConsole
SetConsoleTitleW
SetConsoleOutputCP
HeapAlloc
HeapFree
GetProcessHeap
GetCurrentProcessId
ReadProcessMemory
CreateMutexW
OpenMutexW
LoadLibraryA
VerSetConditionMask
InterlockedCompareExchange
TerminateThread
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
QueueUserAPC
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForMultipleObjects
TlsSetValue
VerifyVersionInfoW
GlobalAlloc
GlobalFree
GetFileSize
WriteFile
SetFilePointer
GetSystemTime
SystemTimeToFileTime
ResetEvent
ReleaseSemaphore
OpenEventA
FormatMessageA
LocalFree
WaitForSingleObject
GetCurrentProcess
CreateEventA
LoadLibraryW
OpenProcess
SleepEx
QueryPerformanceCounter
InterlockedDecrement
InterlockedIncrement
SetWaitableTimer
FreeLibrary
TlsGetValue
GetModuleHandleA
CreateWaitableTimerA
FindFirstFileW
IsDebuggerPresent
DecodePointer
EncodePointer
AreFileApisANSI
SetFilePointerEx
SetEndOfFile
ResumeThread
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
IsProcessorFeaturePresent
lstrlenA
USER32.dll SendMessageTimeoutW
FindWindowW
wsprintfW
PostMessageW
ADVAPI32.dll RegDeleteValueW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
OpenProcessToken
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW
SHELL32.dll SHGetFolderPathW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32.dll CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
OLEAUT32.dll #2
#6
#9
MSVCP120.dll ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?classic@locale@std@@SAABV12@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?tolower@?$ctype@_W@std@@QBE_W_W@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??0id@locale@std@@QAE@I@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?uncaught_exception@std@@YA_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
?exceptions@ios_base@std@@QAEXH@Z
?flags@ios_base@std@@QBEHXZ
?unsetf@ios_base@std@@QAEXH@Z
?precision@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?_Xlength_error@std@@YAXPBD@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
_Inf
_Nan
?_BADOFF@std@@3_JB
?id@?$codecvt@DDH@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?flags@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xout_of_range@std@@YAXPBD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?id@?$numpunct@D@std@@2V0locale@2@A
?_Winerror_map@std@@YAPBDH@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
WS2_32.dll #116
#115
MSVCR120.dll wcslen
vsprintf_s
_beginthreadex
??_V@YAXPAX@Z
strcpy_s
strcmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
vsprintf
memset
isalnum
_CxxThrowException
__CxxFrameHandler3
__iob_func
fclose
fflush
fgetc
fgetpos
fputc
fread
freopen
fsetpos
fseek
_fseeki64
fwrite
printf
setvbuf
sscanf
ungetc
swprintf_s
_vswprintf_c_l
_wfopen_s
_wremove
_lock_file
_unlock_file
memcpy_s
strncpy
strrchr
wcscmp
wcscpy_s
_wcsicmp
abs
atof
atoi
_strtoui64
rand
srand
free
malloc
_wchdir
_wmkdir
_wrmdir
_waccess
_wrename
_wfindfirst64i32
_wfindnext64i32
toupper
tolower
_localtime64
_time64
_findclose
sprintf_s
__RTDynamicCast
wcscat_s
_itow_s
_wtoi
_wtoi64
ftell
_localtime64_s
strerror
_stricmp
?terminate@@YAXXZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except1
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
memchr
strstr
strlen
memcmp
memmove
??8type_info@@QBE_NABV0@@Z
_gmtime64
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
memcpy
fopen
_strdup
_wcsnicmp
fprintf
sprintf
strncmp
feof
realloc
ferror
_exit
IPHLPAPI.DLL GetAdaptersInfo
WININET.dll HttpQueryInfoA
HttpQueryInfoW
InternetSetCookieA
HttpSendRequestW
HttpOpenRequestW
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetTimeToSystemTimeA
InternetSetFilePointer
InternetSetOptionW
InternetTimeFromSystemTimeA
VERSION.dll GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Delayed Imports

1

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x368
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.38802
MD5 8b1afbfdba5521d92ff145e0c3735932 🔍
SHA1 1bd517f244004f2a4e79b6b64da6a68ff5630c38 🔍
SHA256 96e14d13e93dc0c6a13f1893b578a0c2507832bd40dddb774a191ad125e1eb5e 🔍
SHA3 5051ea68502175845c1ec5c2910da7e3a34b115acc5180484396480ff7b48e62 🔍

2

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.45952
MD5 cae93b2a495176c1c65bcbb5ac95929a 🔍
SHA1 a9bb8215007aea65a8f05016bcea1c567f4ed587 🔍
SHA256 4cb3657cf68ea4b680456e3e9bbea15203de3dda7707f0d5d5e6a8526fd0c0a1 🔍
SHA3 16f76d447f8d0e520977b7ed804ad86d87b391d976e57b3274655e44f1ee0e1e 🔍

3

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0xca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.15718
MD5 76de08c7dd9a048d98eaf2d338945497 🔍
SHA1 2a68a9cf59aadbf3982fd52b0d0842b714e2dfde 🔍
SHA256 90e3a10df5c7c9c83bee801245b0a2d3397b11447c9a4a2fbf2a2edd2b5333b7 🔍
SHA3 e020e95b4535a8924c2c323e909c69bc93780f5e0c3dc69c2dfbf6c9f7971c77 🔍

4

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.57863
MD5 237853f1430b72b3fad9381af86aeac9 🔍
SHA1 35a7a7a6388703795fd591e9f7d900f30d5d31b5 🔍
SHA256 638c03b756762db5827e3aac74c0b4c13d277aee34504e14872053616ac96c43 🔍
SHA3 0dcc9dc287439a727d6c69bdba1de50905822d7a3c329f5b2bff4ed3bf3f8a46 🔍

5

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x1ca8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.01862
MD5 75814d98e1ebc10755502ba783583828 🔍
SHA1 72a84e33f6fb3aede47bfcce51dd11ae2f8a258b 🔍
SHA256 329aa7c1b5cf4832df1b432337561b2ded08ebebeb2649b14e7846c465305bd6 🔍
SHA3 f05fbb7762d1349ad0641c9456170d6bd7e2dda69f6d686606bfcda32864edcc 🔍

6

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.35201
MD5 1e6bad60cb7cf5ca4094fd89edf367cb 🔍
SHA1 5f63b0c4988bed8ccbe92beb8aec0c9ad7638a85 🔍
SHA256 9bbd7b42b1769064dfbc82560c9671acc9f2087b0ca7f554208ae552ca42fcd9 🔍
SHA3 5834b1880f5ace42cac62a9c570d8667ffa23fbd994ad8164e86f87278c36a49 🔍

7

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.45952
MD5 cae93b2a495176c1c65bcbb5ac95929a 🔍
SHA1 a9bb8215007aea65a8f05016bcea1c567f4ed587 🔍
SHA256 4cb3657cf68ea4b680456e3e9bbea15203de3dda7707f0d5d5e6a8526fd0c0a1 🔍
SHA3 16f76d447f8d0e520977b7ed804ad86d87b391d976e57b3274655e44f1ee0e1e 🔍

8

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.45952
MD5 cae93b2a495176c1c65bcbb5ac95929a 🔍
SHA1 a9bb8215007aea65a8f05016bcea1c567f4ed587 🔍
SHA256 4cb3657cf68ea4b680456e3e9bbea15203de3dda7707f0d5d5e6a8526fd0c0a1 🔍
SHA3 16f76d447f8d0e520977b7ed804ad86d87b391d976e57b3274655e44f1ee0e1e 🔍

9

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x2f89
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92493
Detected Filetype PNG graphic file
MD5 2da9d359dd6c7f47408162c1ab30d397 🔍
SHA1 7a4c16eeeb7ca6c40e2f6ccac7d7aaa419e28608 🔍
SHA256 006c3e5cdf0ec477c8f9ce952488c272011d300c8ef652f9919039bc034b67c5 🔍
SHA3 279d197ff53448752eba297b7d777301b81180b3b990fb164f033cd1b234e2da 🔍

10

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.57922
MD5 b28525da0c700330c643b60df0502795 🔍
SHA1 6b281ac318d6be8bc1a1ff5970e74c319b7dd44b 🔍
SHA256 617fc6ffcf3af848c4d03a860f7659e8b67790819370c73b3992d8d1a8620051 🔍
SHA3 ba2e66a9916857ad2d9801ece7aeae06fa062a4bb5cff5d83a5e15cc7ab91f26 🔍

11

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.88223
MD5 4cbacc2491c7436a95a6dd05e732fff7 🔍
SHA1 8d7f7fa97894ab56906a5dc25fdd948c242b7b69 🔍
SHA256 10618cc5fb9aa723fb4a79f452a54ed017f1d43961eb134ef6113d76da7d425a 🔍
SHA3 d330428aed89efcec31f58a0a62fc06b82728c00c5b8060a618b6ae1bc434591 🔍

12

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.44608
MD5 039c6d41f0cb3cc7abd8095442968976 🔍
SHA1 1622243a9d9a99b4c8aed376a3e76c0904f6f84a 🔍
SHA256 f5a30e40660575cbd735074d93d8439f754735ca8684280e5296d19f478b30f2 🔍
SHA3 73db1bd73c41fd625841090eb1eee2e8250f1b41c22c91bf1c170941db5d8e5b 🔍

13

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.14659
MD5 8b2e40ac71ed0769bb249ffb740c70d3 🔍
SHA1 4d0eeea9f4a86236b2f78b644cde5285e496f767 🔍
SHA256 ea9ba80a0485a9061a7ad3322213449f7ecf5cb9919a3f8d819a099e53d7e58c 🔍
SHA3 16c84a21e63eecfa5815f51339bdb6584e89131d22cb714f7732af2b8aa1a2b9 🔍

14

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.56296
MD5 dee9a9f87260f8ad32838423da43ffaa 🔍
SHA1 8391d49b0cd48e2d18d474d60fc63d9df66c504a 🔍
SHA256 943f6cb60187bb2edcbcb854abb530f77ad75fd3abe0f46d9fd19eb3f93c9d08 🔍
SHA3 e0b8cdc67364ce3656a0ede5eced30c276dfba562a1bd9f9284d48c70a236234 🔍

15

Type RT_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.58878
MD5 54ea21f6d1a5744e86828fe7929890c1 🔍
SHA1 4b24053c2bbfdae38edb11f3822aaf65f776154b 🔍
SHA256 2fe7a6ef50cb87cce24b108e88cf4f159238cbd8813e36847a6a2f3a923317a4 🔍
SHA3 86babe99c3fd61d89df1c0815874ae817eb850186b70be0a00635897c8f6f7fb 🔍

107

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x5a
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.73519
Detected Filetype Icon file
MD5 00a998d03f40261c08db15725c8b49fc 🔍
SHA1 b6230f17e14b870eadbe8bc82a09a60506c411b7 🔍
SHA256 5004a8939c2ec1be9068ca450196e986aa0aa058431a79f453e026555f6b06d9 🔍
SHA3 5267b8f01f207d52d9658b062e644c19ca7047e54da7c81fa71ccd4155bc299e 🔍

128

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.0815
Detected Filetype Icon file
MD5 9a2ecd931607a3e63110250c64f874ab 🔍
SHA1 c0beabb14c98fe6050b0ac4eba46fe7f70b54fd8 🔍
SHA256 ffc9a0fcfbfc61893fe969e4a73e6c1efd043cc724ad517dbad9b6244f653687 🔍
SHA3 47aa903a8e24ea84c4cdb70035df400db871e9eb126bb11fa8af894a19c5dee6 🔍

140

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x14
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.0815
Detected Filetype Icon file
MD5 dd7714fdc92e60eb14afbe736c879ece 🔍
SHA1 1c93863334cb0ca1121434c897865c52bf67f54e 🔍
SHA256 770e691e35b6bdcb2534ad145bd2f470db38663f32a0f5bcb76fb5eff9fb2126 🔍
SHA3 d4af180c6c1e24df57680eb6a9f1e72db2bf903e8628cdeabfa76dc6ed4eddec 🔍

218

Type RT_GROUP_ICON
Language Chinese - PRC
Codepage UNKNOWN
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97609
Detected Filetype Icon file
MD5 6a8e1aa1bbe9ee92ede3f9f8ab88ba0c 🔍
SHA1 8b0f64aeb734534bd2aa2e4ab14973b0790e70cd 🔍
SHA256 ea3e133c78c64c6e5ab8d452825b5511ace3e2bb0235940002d0ff0e48c16d22 🔍
SHA3 998017edf24d6e73555f49171cad8086c89ad792c8e5813d637d86489792bdc0 🔍

1 (#2)

Type RT_VERSION
Language Chinese - PRC
Codepage UNKNOWN
Size 0x314
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.59509
MD5 a1a8159ca0c1114c91a4c35f958da6f1 🔍
SHA1 ad5be1b02407d16ea01415f6e686d4e99485f025 🔍
SHA256 90c36c7cc8cf877471155f161a6c68b354fd98fc293b3d1a9e3ea250326e3b23 🔍
SHA3 70570e9f1e1197c516f58d5693e4aef4c3e53e6193d319207e586821a2fd7a76 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 7.1.9.5231
ProductVersion 7.1.9.5231
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language English - United States
CompanyName youku.com
FileDescription 优酷媒体中心
FileVersion (#2) 7.1.9.5231
InternalName YoukuMediaCenter.exe
LegalCopyright Copyright(c)2017 youku.com. All rights reserved.
OriginalFilename YoukuMediaCenter.exe
ProductName 优酷媒体中心
ProductVersion (#2) 7.1.9.5231
Resource LangID Chinese - PRC

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2017-May-23 06:35:37
Version 0.0
SizeofData 119
AddressOfRawData 0xa85c8
PointerToRawData 0xa71c8
Referenced File D:\SVN\install.v3\src\iku_git_hotfix_v700\build_module_vs2013\bin\Publish\YoukuMediaCenter.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2017-May-23 06:35:37
Version 0.0
SizeofData 20
AddressOfRawData 0xa8640
PointerToRawData 0xa7240

TLS Callbacks

StartAddressOfRawData 0x4bc000
EndAddressOfRawData 0x4bc001
AddressOfIndex 0x4bb0f0
AddressOfCallbacks 0x49ec2c
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_1BYTES
Callbacks 0x004536B0

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4b80d0
SEHandlerTable 0x4aaf70
SEHandlerCount 504

RICH Header

XOR Key 0x89d63f11
Unmarked objects 0
C objects (VS2008 SP1 build 30729) 1
C++ objects (20806) 5
199 (41118) 4
ASM objects (VS2013 build 21005) 12
C objects (VS2013 build 21005) 20
C++ objects (VS2013 UPD4 build 31101) 8
221 (VS2013 build 21005) 4
C++ objects (VS2013 build 21005) 6
C objects (VS2013 UPD5 build 40629) 14
C++ objects (VS2013 UPD5 build 40629) 14
Imports (VS2008 SP1 build 30729) 23
Total imports 433
229 (VS2013 UPD5 build 40629) 1
Resource objects (VS2013 build 21005) 1
151 1
Linker (VS2013 UPD5 build 40629) 1

Errors

Leave a comment

No comments yet.