973aaa8d5af08343c52ed4cd4617ea41
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2020-Jun-05 14:35:15 |
| Detected languages |
Chinese - PRC
English - United States |
| Debug artifacts |
E:\rc_v11_i18n_20200615_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb
|
| CompanyName | Zhuhai Kingsoft Office Software Co.,Ltd |
| FileDescription | WPS Office Setup |
| FileVersion | 11,2,0,9403 |
| InternalName | konlinesetup_xa |
| LegalCopyright | Copyright©1988-2020 Kingsoft Corporation. All rights reserved. |
| OriginalFilename | konlinesetup_xa.exe |
| ProductName | WPS Office |
| ProductVersion | 11,2,0,9403 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
MASM/TASM - sig2(h) MASM/TASM - sig1(h) |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Accesses the WMI:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to SHA512 Uses constants related to AES Uses constants related to Blowfish Uses known Diffie-Helman primes |
| Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
| Info | The PE is digitally signed. |
Signer: Zhuhai Kingsoft Office Software Co.
Issuer: DigiCert Assured ID Code Signing CA-1 |
| Suspicious | VirusTotal score: 2/71 (Scanned on 2020-09-24 02:42:50) |
VBA32:
BScope.Trojan.StartPage
ESET-NOD32: a variant of Win32/KingSoft.J potentially unwanted |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x110 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2020-Jun-05 14:35:15 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 10.0 |
| SizeOfCode | 0x305800 |
| SizeOfInitializedData | 0x124c00 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x002CD83C (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x307000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 5.1 |
| ImageVersion | 0.0 |
| SubsystemVersion | 5.1 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x435000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0x42e61d |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| KERNEL32.dll |
SizeofResource
LockResource LoadResource FindResourceW FindResourceExW WritePrivateProfileStringW GetLocaleInfoW GetUserDefaultLangID lstrcpyW GetModuleHandleW GetTempFileNameW CloseHandle GetLastError GetCommandLineW ExitProcess FreeResource EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection Sleep GetPrivateProfileIntW GetPrivateProfileStringW OpenMutexW CreateMutexW OpenProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot GetProcAddress OutputDebugStringA OutputDebugStringW GetModuleFileNameW GetModuleHandleExW CreateDirectoryW GetExitCodeProcess WaitForSingleObject CreateProcessW HeapFree HeapAlloc GetProcessHeap WideCharToMultiByte MultiByteToWideChar GetSystemTime GetSystemPowerStatus GetSystemDefaultLCID GetUserDefaultLCID GetSystemDefaultUILanguage FreeLibrary LoadLibraryW GetSystemDirectoryW GetSystemWow64DirectoryW GetTickCount CompareStringW WriteConsoleW LocalAlloc LocalFree InterlockedExchange LoadLibraryA RaiseException GetCurrentDirectoryW GetACP ReadFile GetFileSize CreateFileW SetFilePointer GetFileType DuplicateHandle GetCurrentProcess SystemTimeToFileTime DosDateTimeToFileTime SetFileTime WriteFile MulDiv InterlockedIncrement InterlockedDecrement GetLocalTime GlobalUnlock GlobalLock GlobalAlloc InterlockedCompareExchange lstrlenW DeviceIoControl CreateFileA CreateThread GetVersionExW VerifyVersionInfoA VerSetConditionMask GetSystemDirectoryA GetModuleHandleA QueryPerformanceFrequency SleepEx QueryPerformanceCounter ExpandEnvironmentStringsA PeekNamedPipe WaitForMultipleObjects GetStdHandle SetLastError FormatMessageA GetEnvironmentVariableW GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId InterlockedExchangeAdd GetSystemTimeAsFileTime GetCurrentProcessId FormatMessageW GetVersion DeleteFiber SwitchToFiber CreateFiber ConvertFiberToThread ConvertThreadToFiber FindNextFileW FindFirstFileW FindClose CreateEventW SetEvent ReleaseSemaphore SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetFileAttributesExW GetFileSizeEx CreateSemaphoreW ResetEvent ReleaseMutex GetCompressedFileSizeW GetGeoInfoW GetUserGeoID FlushViewOfFile WaitForSingleObjectEx UnmapViewOfFile UnlockFileEx UnlockFile SetEndOfFile MapViewOfFile LockFileEx LockFile HeapCompact HeapValidate HeapSize HeapReAlloc HeapDestroy HeapCreate GetVersionExA GetTempPathW GetTempPathA GetSystemInfo GetFullPathNameW GetFullPathNameA GetFileAttributesW GetFileAttributesA GetDiskFreeSpaceW GetDiskFreeSpaceA FlushFileBuffers DeleteFileW DeleteFileA CreateFileMappingW CreateFileMappingA AreFileApisANSI TryEnterCriticalSection GetStringTypeW EncodePointer DecodePointer HeapSetInformation GetStartupInfoW RtlUnwind ExitThread FileTimeToLocalFileTime GetDriveTypeW FindFirstFileExW GetDriveTypeA FindFirstFileExA GetFileInformationByHandle SetConsoleCtrlHandler GetTimeFormatA GetDateFormatA LCMapStringW GetCPInfo SetUnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount IsProcessorFeaturePresent UnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetOEMCP IsValidCodePage GetConsoleCP SetStdHandle GetTimeZoneInformation GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetEnvironmentVariableA |
|---|---|
| bcrypt.dll |
BCryptGenRandom
|
| USER32.dll (delay-loaded) |
LoadStringW
DestroyWindow UnregisterClassW LoadCursorW RegisterClassW TrackPopupMenu IsWindowVisible SetWindowRgn CreateWindowExW IsWindow GetMessageW TranslateMessage DispatchMessageW SetFocus PostMessageW KillTimer GetDC UpdateLayeredWindow ReleaseDC GetWindowRect MoveWindow DefWindowProcW RegisterWindowMessageW GetWindowLongW AppendMenuW CreatePopupMenu GetCursorPos EnableWindow SetWindowLongW GetKeyState UnionRect InvalidateRect SetCapture ReleaseCapture CharNextW GetFocus MapWindowPoints IntersectRect GetUpdateRect IsRectEmpty EndPaint BeginPaint GetParent GetWindow GetActiveWindow GetSystemMetrics CallWindowProcW GetPropW SetPropW AdjustWindowRectEx GetMenu RegisterClassExW GetClassInfoExW OffsetRect SetCursor wvsprintfW FillRect DrawTextW CharPrevW SetRect CreateCaret HideCaret ShowCaret SetCaretPos GetCaretPos ClientToScreen GetSysColor GetCaretBlinkTime InvalidateRgn GetGUIThreadInfo CreateAcceleratorTableW GetWindowTextW GetWindowTextLengthW SetWindowTextW GetUserObjectInformationW GetProcessWindowStation MsgWaitForMultipleObjects PeekMessageW wsprintfW SetWindowPos SetForegroundWindow IsZoomed MonitorFromWindow GetMonitorInfoW ScreenToClient GetClientRect IsIconic PostQuitMessage SetTimer LoadIconW PtInRect FindWindowW SendMessageW ShowWindow MessageBoxW |
Delayed Imports
| Attributes | 0x1 |
|---|---|
| Name | USER32.dll |
| ModuleHandle | 0x3bacbc |
| DelayImportAddressTable | 0x3ba2ac |
| DelayImportNameTable | 0x3ac19c |
| BoundDelayImportTable | 0x3ad7f8 |
| UnloadDelayImportTable | 0 |
| TimeStamp | 1970-Jan-01 00:00:00 |
101
1
2
3
4
5
6
7
8
1 (#2)
102
1 (#3)
1 (#4)
String Table contents
| 200.1005 |
| TRUE |
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 11.2.0.9403 |
| ProductVersion | 11.2.0.9403 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_UNKNOWN
|
| Language | UNKNOWN |
| CompanyName | Zhuhai Kingsoft Office Software Co.,Ltd |
| FileDescription | WPS Office Setup |
| FileVersion (#2) | 11,2,0,9403 |
| InternalName | konlinesetup_xa |
| LegalCopyright | Copyright©1988-2020 Kingsoft Corporation. All rights reserved. |
| OriginalFilename | konlinesetup_xa.exe |
| ProductName | WPS Office |
| ProductVersion (#2) | 11,2,0,9403 |
| Resource LangID | English - United States |
|---|
IMAGE_DEBUG_TYPE_CODEVIEW
| Characteristics |
0
|
|---|---|
| TimeDateStamp | 2020-Jun-05 14:35:15 |
| Version | 0.0 |
| SizeofData | 130 |
| AddressOfRawData | 0x397008 |
| PointerToRawData | 0x395c08 |
| Referenced File | E:\rc_v11_i18n_20200615_branch\Build\Release\WPSOffice\office6\addons\konlinesetup_xa\konlinesetup_xa.pdb |
TLS Callbacks
Load Configuration
| Size | 0x48 |
|---|---|
| TimeDateStamp | 1970-Jan-01 00:00:00 |
| Version | 0.0 |
| GlobalFlagsClear | (EMPTY) |
| GlobalFlagsSet | (EMPTY) |
| CriticalSectionDefaultTimeout | 0 |
| DeCommitFreeBlockThreshold | 0 |
| DeCommitTotalFreeThreshold | 0 |
| LockPrefixTable | 0 |
| MaximumAllocationSize | 0 |
| VirtualMemoryThreshold | 0 |
| ProcessAffinityMask | 0 |
| ProcessHeapFlags | (EMPTY) |
| CSDVersion | 0 |
| Reserved1 | 0 |
| EditList | 0 |
| SecurityCookie | 0x7b8b4c |
| SEHandlerTable | 0x79db50 |
| SEHandlerCount | 670 |
RICH Header
| XOR Key | 0x47c0e293 |
|---|---|
| Unmarked objects | 0 |
| 152 (20115) | 10 |
| ASM objects (VS2010 SP1 build 40219) | 40 |
| C++ objects (VS2008 SP1 build 30729) | 1 |
| Unmarked objects (#2) | 23 |
| C objects (VS2010 SP1 build 40219) | 884 |
| C++ objects (VS2010 build 30319) | 3 |
| C objects (VS2008 SP1 build 30729) | 15 |
| Imports (VS2008 SP1 build 30729) | 5 |
| Total imports | 564 |
| C++ objects (VS2010 SP1 build 40219) | 197 |
| Resource objects (VS2010 SP1 build 40219) | 1 |
| 151 | 1 |
| Linker (VS2010 SP1 build 40219) | 1 |