2d319baeea99e36edeb07c59bd39ab49
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2024-Jan-31 04:16:58 |
| Detected languages |
Chinese - PRC
English - United States |
| Debug artifacts |
D:\code\pc\deskcalcode\deskcal3\output\bin32\pdb\desktopcal.pdb
|
| Comments | If you have any questions or suggestions, please feel free to contact www.desktopcal.com. |
| CompanyName | Beijing Xiaowei Cloud Inc. |
| FileDescription | CalendarTask |
| FileVersion | 3.10.174.6418 |
| InternalName | destkopcalx.exe |
| LegalCopyright | Copyright (C) 2024 Beijing Xiaowei Cloud Inc. All rights reserved. |
| LegalTrademarks | CalendarTask |
| OriginalFilename | destkopcalx.exe |
| PrivateBuild | 3.0 |
| ProductName | desktopcalx Module |
| ProductVersion | 3.10.174.6418 |
| SpecialBuild | 3.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 8
MASM/TASM - sig1(h) MSVC++ v.8 (procedure 1 recognized - h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Info | Cryptographic algorithms detected in the binary: | Uses constants related to MD5 |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Malicious | The PE is possibly a dropper. | Resource 203 detected as a PE Executable. |
| Info | The PE is digitally signed. |
Signer: Beijing Xiaowei Cloud Inc.
Issuer: Sectigo Public Code Signing CA R36 |
| Safe | VirusTotal score: 0/71 (Scanned on 2024-04-23 03:46:12) | All the AVs think this file is safe. |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 4 |
| TimeDateStamp | 2024-Jan-31 04:16:58 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_RELOCS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 8.0 |
| SizeOfCode | 0x22000 |
| SizeOfInitializedData | 0x89000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001EF96 (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x23000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x1000 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0xac000 |
| SizeOfHeaders | 0x1000 |
| Checksum | 0xb37e3 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
Imports
| KERNEL32.dll |
GetFileAttributesW
GetVersionExW LocalFree FormatMessageW ExpandEnvironmentStringsW TerminateProcess GetCurrentThread InterlockedCompareExchange HeapFree GetProcessHeap HeapAlloc IsProcessorFeaturePresent VirtualFree VirtualAlloc HeapDestroy HeapReAlloc HeapSize GetVersionExA InterlockedExchange GetACP GetLocaleInfoA GetTickCount FreeLibrary TerminateThread GetExitCodeThread GetCurrentProcessId GetThreadLocale GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime CreateProcessW GetPrivateProfileIntW Sleep lstrcmpiW RaiseException GetPrivateProfileStringW GetModuleFileNameW MultiByteToWideChar lstrlenW GetCurrentProcess FlushInstructionCache FindResourceExW FindResourceW LoadResource LockResource SizeofResource LoadLibraryW GetProcAddress GetCommandLineW SetEvent InterlockedDecrement InterlockedIncrement GetLastError GetCurrentThreadId GetModuleHandleW WritePrivateProfileStringW OpenProcess DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ResumeThread WaitForSingleObject CloseHandle CreateMutexW LoadLibraryA |
|---|---|
| USER32.dll |
PostQuitMessage
PostThreadMessageW PostMessageW GetWindowThreadProcessId UnregisterHotKey SendMessageW CharLowerBuffW CopyRect IsWindow SetTimer RegisterHotKey DestroyWindow GetWindowRect IsRectEmpty GetSystemMetrics UnregisterClassA DefWindowProcW GetWindowLongW CallWindowProcW SetWindowTextW KillTimer SetRect SetRectEmpty FindWindowW SubtractRect CharNextW DispatchMessageW TranslateMessage GetMessageW PeekMessageW IsWindowVisible GetClassLongW GetWindow GetAncestor RedrawWindow SetCapture GetParent IntersectRect GetDC TrackMouseEvent GetMessagePos GetSysColor GetCursor ReleaseDC InvalidateRect OffsetRect PtInRect UnionRect GetCursorPos LoadImageW ShowWindow GetClientRect MapWindowPoints SetWindowPos DestroyIcon UpdateWindow GetDesktopWindow MessageBoxW SetWindowLongW SystemParametersInfoW |
| GDI32.dll |
LPtoDP
DPtoLP SetWindowOrgEx GetStockObject GetObjectW Rectangle SetROP2 CreateCompatibleBitmap GetClipBox CreateCompatibleDC SelectObject CreateDIBSection BitBlt DeleteObject SetBkColor ExtTextOutW CreateDCW GetDeviceCaps CreatePen DeleteDC |
| ADVAPI32.dll |
RegCloseKey
RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegEnumKeyExW RegNotifyChangeKeyValue OpenThreadToken ImpersonateSelf LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW RegDeleteKeyW |
| SHELL32.dll |
SHGetSpecialFolderPathW
SHGetFileInfoW ShellExecuteExW CommandLineToArgvW SHAppBarMessage |
| ole32.dll |
CreateStreamOnHGlobal
OleInitialize StringFromCLSID CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree |
| OLEAUT32.dll |
VarBstrCmp
LoadRegTypeLib SysStringByteLen SysAllocStringByteLen VarUI4FromStr SysFreeString SysAllocString SysStringLen LoadTypeLib SysAllocStringLen |
| ATL80.DLL |
#32
#31 #30 #58 #64 |
| SHLWAPI.dll |
SHSetValueW
SHGetValueW SHDeleteValueW |
| MSIMG32.dll |
AlphaBlend
|
| gdiplus.dll |
GdipGetImageEncodersSize
GdipGetImageEncoders GdiplusStartup GdiplusShutdown GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipSetClipRectI GdipCloneImage GdipGraphicsClear GdipSetSmoothingMode GdipReleaseDC GdipCreateFromHDC GdipCreateBitmapFromScan0 GdipDisposeImage GdipDeleteGraphics GdipAlloc GdipFree |
| MSVCP80.dll |
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ |
| dkcore.dll |
?RemoveIdleHandler@Message@Util@@YAXPAUIxIdleHandler@@@Z
?AddIdleHandler@Message@Util@@YAHPAUIxIdleHandler@@@Z ?StringToGuid@Com@Util@@YAJPB_WPAU_GUID@@@Z ?TryDeleteFile@File@Util@@YAHPB_W@Z ?RegisterCreateFunc@@YAJABU_GUID@@P6AJPAPAXPAUIUnknown@@@ZPAUHINSTANCE__@@HPBD@Z ?NIntLogSet@Log@Util@@YAHXZ ?SetOneTimer@Timer@Util@@YAJIPAUITimerCallback@@I@Z ?GetCurrentWindowType@System@Util@@YA?AW4tagUtilWindowsType@@XZ ?IsFileExist@File@Util@@YAHPA_W@Z ?GetMD5@File@Util@@YAJPA_WPAPA_W@Z ?RegisterService@@YAJABU_GUID@@P6AJPAPAXPAUIUnknown@@@ZPAUHINSTANCE__@@HPBD@Z ?IsXp@System@Util@@YAHXZ ?EraseTimerCallback@Timer@Util@@YAJPAUITimerCallback@@I@Z ?GetMessageLoop@Message@Util@@YAXPAPAUIxMessageLoop@@@Z ?GetWindowsVersionString@System@Util@@YAJPAPA_W@Z ?GetFileVersion@File@Util@@YAHPA_WPAPA_WH@Z ?SetMulTimer@Timer@Util@@YAJIPAUITimerCallback@@I@Z ?Is64Bit_OS@System@Util@@YAHXZ ?LaunchDefaultBrowser@System@Util@@YAXPA_W@Z ?RegisterTypelib@@YAJABU_GUID@@PAUHINSTANCE__@@@Z ?CreateInstanceFromClassFactory@@YAJABU_GUID@@PAPAXPAUIUnknown@@@Z ?GetService@Service@Util@@YAJABU_GUID@@PAPAX@Z ?__NTrace@@YAXPB_W0H0ZZ |
| MSVCR80.dll |
wcsrchr
_invalid_parameter_noinfo _wcsicmp wcsncpy_s wcscpy_s malloc _localtime64_s wcsftime ??2@YAPAXI@Z memset _time64 _purecall free _endthreadex _beginthreadex _recalloc ??_V@YAXPAX@Z __CxxFrameHandler3 memcpy_s vswprintf_s _vscwprintf _wcslwr_s wcschr memmove_s wcsstr ??3@YAXPAX@Z _wfopen _snwprintf_s _wcsnicmp _except_handler4_common ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ _resetstkoflw _CxxThrowException ??0exception@std@@QAE@ABV01@@Z __set_app_type ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _invoke_watson _controlfp_s fclose fwrite |
| dkui.dll |
?GetElementById@UI@Util@@YAHPAUIxNode2@@PB_WPAPAU3@@Z
?LayoutParent@UI@Util@@YAJPAUIxElement@@HH@Z ?SetVisible@Style@Util@@YAJPAUIxElement@@H@Z ?GetDocument@UI@Util@@YAJPAUIxElement@@PAPAUIxDocument@@@Z ?GetRexBoxElement@UIEngine@Util@@YAJPA_WPAPAUIxNode@@@Z ?Layout@UI@Util@@YAJPAUIxElement@@H@Z ?ForceShowWindow@UI@Util@@YAJPAUHWND__@@H@Z |
Delayed Imports
203
101
1
1 (#2)
2
3
4
5
7
100
1 (#3)
1 (#4)
String Table contents
| dkmain |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 3.10.174.6418 |
| ProductVersion | 3.10.174.6418 |
| FileFlags |
VS_FF_PRIVATEBUILD
VS_FF_SPECIALBUILD
|
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| Comments | If you have any questions or suggestions, please feel free to contact www.desktopcal.com. |
| CompanyName | Beijing Xiaowei Cloud Inc. |
| FileDescription | CalendarTask |
| FileVersion (#2) | 3.10.174.6418 |
| InternalName | destkopcalx.exe |
| LegalCopyright | Copyright (C) 2024 Beijing Xiaowei Cloud Inc. All rights reserved. |
| LegalTrademarks | CalendarTask |
| OriginalFilename | destkopcalx.exe |
| PrivateBuild | 3.0 |
| ProductName | desktopcalx Module |
| ProductVersion (#2) | 3.10.174.6418 |
| SpecialBuild | 3.0 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2024-Jan-31 04:16:58 |
| Version | 0.0 |
| SizeofData | 88 |
| AddressOfRawData | 0x27730 |
| PointerToRawData | 0x27730 |
| Referenced File | D:\code\pc\deskcalcode\deskcal3\output\bin32\pdb\desktopcal.pdb |
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x43627c |
| SEHandlerTable | 0x42b950 |
| SEHandlerCount | 180 |
RICH Header
| XOR Key | 0x54e06111 |
|---|---|
| Unmarked objects | 0 |
| 126 (50327) | 1 |
| ASM objects (VS2012 build 50727 / VS2005 build 50727) | 3 |
| C objects (VS2012 build 50727 / VS2005 build 50727) | 21 |
| C++ objects (VS2003 (.NET) build 4035) | 1 |
| Imports (VS2012 build 50727 / VS2005 build 50727) | 10 |
| C objects (VS2003 (.NET) build 4035) | 6 |
| Imports (VS2003 (.NET) build 4035) | 21 |
| Total imports | 347 |
| C++ objects (VS2012 build 50727 / VS2005 build 50727) | 33 |
| Resource objects (VS2012 build 50727 / VS2005 build 50727) | 1 |
| Linker (VS2012 build 50727 / VS2005 build 50727) | 1 |
Errors
[*] Warning: [plugin_authenticode] Hashing algorithm 1.2.840.1015.13.2.5 is not supported.