242724ac146699e70a27e040b1ceca55
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2009-Mar-20 02:42:25 |
| Detected languages |
English - United States
|
| Debug artifacts |
c:\home\luntbuild\work\app-winrd\products\winrd\bin\release\npTVUAx.pdb
|
| CompanyName | TVU networks |
| FileDescription | 2,4,5,1 |
| FileExtents | tvu |
| FileOpenName | TVU Web Player for FireFox |
| FileVersion | 2.4.5.1 |
| InternalName | TVUAx.dll |
| LegalCopyright | Copyright (C) 2006-2008 TVU networks. All rights reserved. |
| MIMEType | application/x-tvuplayer-plugin |
| OriginalFilename | TVUAx.dll |
| ProductName | TVU Web Player for FireFox |
| ProductVersion | 2.4.5.1 |
| Comments | TVU IPTV Player |
| LegalTrademarks | TVU networks |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ v6.0 DLL
Microsoft Visual C++ 6.0 - 8.0 |
| Suspicious | PEiD Signature: | Crunch 4 |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Miscellaneous malware strings:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The program tries to mislead users about its origins. | The PE pretends to be from FireFox but is not signed! |
| Safe | VirusTotal score: 0/54 (Scanned on 2014-10-30 05:42:41) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x118 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2009-Mar-20 02:42:25 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 9.0 |
| SizeOfCode | 0x178200 |
| SizeOfInitializedData | 0x82600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0008EFC4 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x17a000 |
| ImageBase | 0x10000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x392000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x2055d4 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| KERNEL32.dll |
CreateSemaphoreA
CreateMutexA ReleaseSemaphore GetDriveTypeA GetCurrentDirectoryA PeekNamedPipe CreateEventA CreateDirectoryW MoveFileW GetDriveTypeW FileTimeToLocalFileTime FileTimeToSystemTime CreatePipe FindNextFileW VirtualQuery GetFileInformationByHandle ResumeThread MultiByteToWideChar LeaveCriticalSection EnterCriticalSection CreateSemaphoreW GetLocalTime FindFirstFileW FindClose MoveFileExW SetThreadPriority GetSystemTime FormatMessageA LoadLibraryW GetFullPathNameW GetFullPathNameA GetTempPathW GetTickCount GetFileAttributesW GetFileAttributesA UnlockFile LockFileEx LockFile AreFileApisANSI GetVersionExA CreateNamedPipeA ConnectNamedPipe DisconnectNamedPipe OutputDebugStringA GetProcessTimes DuplicateHandle CreateRemoteThread GetExitCodeThread GetSystemDirectoryA OpenProcess GetFileSize CreateFileMappingA CreateProcessA SetEnvironmentVariableA CompareStringW GetCurrentProcess SetEndOfFile CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA CreateFileW SetStdHandle InitializeCriticalSectionAndSpinCount GetLocaleInfoW IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetDateFormatA GetTimeFormatA GetCurrentDirectoryW Sleep WideCharToMultiByte TerminateThread ReleaseMutex OpenMutexW CreateMutexW WaitForMultipleObjects PulseEvent ResetEvent SetLastError FindResourceExW LockResource GlobalAlloc GlobalLock GlobalUnlock MulDiv RaiseException lstrcmpiW LoadLibraryExW FindResourceW LoadResource SizeofResource FreeLibrary DeleteCriticalSection InitializeCriticalSection GetLastError GetModuleFileNameW GetProcAddress GetThreadLocale GetTempPathA SetThreadLocale FlushInstructionCache GetCurrentThreadId GetModuleHandleW SetEvent lstrlenA OutputDebugStringW DebugBreak InterlockedIncrement WaitForSingleObject LocalFree OpenFileMappingW CreateFileMappingW MapViewOfFile GetStringTypeW GetStringTypeA GetLocaleInfoA FlushFileBuffers SetFilePointer ReadFile GetConsoleMode GetConsoleCP GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapCreate ExitProcess GetModuleHandleA IsValidCodePage GetOEMCP GetACP GetModuleFileNameA GetStdHandle WriteFile TlsFree GetCPInfo LCMapStringW LCMapStringA DeleteFileA DeleteFileW GetTimeZoneInformation CreateThread ExitThread GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetSystemTimeAsFileTime RtlUnwind TlsGetValue TlsAlloc InterlockedDecrement lstrlenW CreateEventW UnmapViewOfFile CloseHandle CompareStringA TlsSetValue InterlockedExchange HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetExitCodeProcess |
|---|---|
| USER32.dll |
CopyRect
GetClientRect LoadBitmapW BeginPaint EndPaint GetDlgCtrlID SystemParametersInfoW SetTimer GetParent SendMessageW KillTimer InvalidateRect SetWindowPos UnregisterClassA wvsprintfW CharNextW DrawTextW ReleaseDC GetWindowDC PostMessageW MessageBoxW LoadStringW RegisterWindowMessageW IsZoomed EnableWindow RegisterClassW MonitorFromWindow GetMonitorInfoW MapWindowPoints GetDlgItem GetScrollPos GetSysColor EndDialog DialogBoxParamW BringWindowToTop ScreenToClient GetWindowRect GetSystemMetrics IsIconic GetWindow PeekMessageW IsWindowVisible SetFocus GetFocus IsChild IntersectRect EqualRect OffsetRect SetWindowRgn UnionRect PtInRect GetKeyState IsWindow GetDC UpdateWindow CallWindowProcW GetWindowLongW SetWindowLongW CreateWindowExW GetClassInfoExW LoadCursorW RegisterClassExW DestroyWindow DefWindowProcW ShowWindow MoveWindow FillRect InflateRect |
| GDI32.dll |
SetWindowExtEx
CloseMetaFile DeleteMetaFile CreateRectRgnIndirect CreateDCW GetDeviceCaps LPtoDP SaveDC SetMapMode SetWindowOrgEx SetViewportOrgEx RestoreDC StretchBlt CreateFontW GetClipRgn CreateRectRgn SelectClipRgn SetBkMode CreatePen CreateSolidBrush Rectangle SetTextColor GetObjectW CreateFontIndirectW CreateCompatibleDC SelectObject BitBlt DeleteDC DeleteObject GetStockObject CreateMetaFileW |
| ADVAPI32.dll |
RegOpenKeyExW
LookupPrivilegeValueA AdjustTokenPrivileges SetNamedSecurityInfoW GetSecurityDescriptorSacl RegQueryValueExW RegSetValueExW RegEnumKeyExW RegCreateKeyExW RegDeleteValueW OpenProcessToken RegCloseKey RegDeleteKeyW RegQueryInfoKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW |
| SHELL32.dll |
SHGetSpecialFolderLocation
SHCreateDirectoryExW SHGetPathFromIDListW SHGetFileInfoW |
| ole32.dll |
CoUninitialize
CoInitialize CoCreateInstance OleSaveToStream StringFromGUID2 WriteClassStm OleLoadFromStream CreateDataAdviseHolder OleRegGetMiscStatus CreateOleAdviseHolder OleRegGetUserType OleRegEnumVerbs StringFromCLSID CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc |
| OLEAUT32.dll |
SysAllocString
SysFreeString VariantChangeType GetErrorInfo UnRegisterTypeLib LoadTypeLib SysStringLen RegisterTypeLib SysStringByteLen OleCreatePropertyFrame VarUI4FromStr VariantInit VariantClear SysAllocStringLen SafeArrayCreateVector SafeArrayAccessData SafeArrayUnaccessData SafeArrayDestroy SysAllocStringByteLen LoadRegTypeLib VariantCopy |
| SHLWAPI.dll |
PathFileExistsA
PathFileExistsW SHSetValueW |
| COMCTL32.dll |
ImageList_Destroy
ImageList_DrawEx ImageList_Duplicate ImageList_LoadImageW ImageList_GetImageInfo |
| WS2_32.dll |
htonl
ioctlsocket __WSAFDIsSet bind recv send getsockname accept WSARecvFrom WSASendTo setsockopt WSACleanup ntohs select gethostname inet_ntoa ntohl WSAStartup gethostbyname inet_addr getpeername WSAGetLastError shutdown closesocket connect htons socket listen |
| WININET.dll |
InternetGetConnectedStateExW
|
| LIBEXPATW.dll |
#31
#53 #18 #25 #52 #10 #11 #2 #12 #16 #21 |
| LIBEAY32.dll |
#3171
#3024 #3106 #510 #3109 #2630 #316 #269 #2821 #2936 #259 #2602 #256 #315 #961 #2915 #2399 #509 |
| dbghelp.dll |
MakeSureDirectoryPathExists
|
| IPHLPAPI.DLL |
GetAdaptersInfo
|
| NETAPI32.dll |
NetApiBufferFree
NetWkstaTransportEnum Netbios |
| snmpapi.dll |
SnmpUtilOidCpy
SnmpUtilOidNCmp SnmpUtilVarBindFree |
| PSAPI.DLL |
GetModuleBaseNameW
EnumProcessModules EnumProcesses |
| libcurl.dll |
curl_easy_getinfo
curl_easy_perform curl_easy_init curl_easy_cleanup curl_easy_setopt |
Delayed Imports
NP_GetEntryPoints
| Ordinal | 1 |
|---|---|
| Address | 0xb480 |
NP_Initialize
| Ordinal | 2 |
|---|---|
| Address | 0xb2c0 |
NP_Shutdown
| Ordinal | 3 |
|---|---|
| Address | 0xb2b0 |
DllCanUnloadNow
| Ordinal | 4 |
|---|---|
| Address | 0xe750 |
DllGetClassObject
| Ordinal | 5 |
|---|---|
| Address | 0xe6f0 |
DllMain
| Ordinal | 6 |
|---|---|
| Address | 0xe760 |
DllRegisterServer
| Ordinal | 7 |
|---|---|
| Address | 0xe710 |
DllUnregisterServer
| Ordinal | 8 |
|---|---|
| Address | 0xe730 |
101
1001
1
103
147
206
207
209
210
3000
7
9
1 (#2)
2
String Table contents
| TVUAx |
| Error |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 2.4.5.1 |
| ProductVersion | 2.4.5.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | TVU networks |
| FileDescription | 2,4,5,1 |
| FileExtents | tvu |
| FileOpenName | TVU Web Player for FireFox |
| FileVersion (#2) | 2.4.5.1 |
| InternalName | TVUAx.dll |
| LegalCopyright | Copyright (C) 2006-2008 TVU networks. All rights reserved. |
| MIMEType | application/x-tvuplayer-plugin |
| OriginalFilename | TVUAx.dll |
| ProductName | TVU Web Player for FireFox |
| ProductVersion (#2) | 2.4.5.1 |
| Comments | TVU IPTV Player |
| LegalTrademarks | TVU networks |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2009-Mar-20 02:42:25 |
| Version | 0.0 |
| SizeofData | 96 |
| AddressOfRawData | 0x197480 |
| PointerToRawData | 0x195a80 |
| Referenced File | c:\home\luntbuild\work\app-winrd\products\winrd\bin\release\npTVUAx.pdb |
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x101afc78 |
| SEHandlerTable | 0x1019c7b0 |
| SEHandlerCount | 704 |
RICH Header
| XOR Key | 0x2455162d |
|---|---|
| Unmarked objects | 0 |
| 150 (20413) | 12 |
| ASM objects (VS2008 build 21022) | 32 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 12 |
| C objects (VS2008 build 21022) | 244 |
| C objects (VS2003 (.NET) build 3077) | 58 |
| C++ objects (VS2008 SP1 build 30729) | 3 |
| Imports (VS2003 (.NET) build 3077) | 6 |
| Total imports | 422 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 33 |
| C++ objects (VS2008 build 21022) | 195 |
| Exports (VS2008 build 21022) | 1 |
| Linker (VS2008 build 21022) | 1 |
| Resource objects (VS2008 build 21022) | 1 |