c73e3b98b5f631669fb3d4b114e98ad55d2b015e2c55003c265e0b75e0c31d9e

Summary

Architecture IMAGE_FILE_MACHINE_I386
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2020-May-18 05:28:11
Detected languages English - United States
Debug artifacts h:\syzygy_wpsoptimize\result\wpspdf.pdb
CompanyName Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription WPS PDF
FileVersion 11,2,0,9363
InternalName wpspdf
LegalCopyright Copyright©1988-2020 Kingsoft Corporation. All rights reserved.
OriginalFilename wpspdf.exe
ProductName WPS Office
ProductVersion 11,2,0,9363

Plugin Output

Info Matching compiler(s): Microsoft Visual C++ 6.0 - 8.0
Suspicious Strings found in the binary may indicate undesirable behavior: May have dropper capabilities:
  • CurrentControlSet\Services
 Accesses the WMI:
  • ROOT\CIMV2
Info Cryptographic algorithms detected in the binary: Uses constants related to MD5
Uses constants related to SHA1
Uses constants related to SHA256
Uses constants related to SHA512
Uses constants related to AES
Suspicious The PE is possibly packed. Unusual section name found: .syzygy
Suspicious The PE contains functions most legitimate programs don't use. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryW
  • LoadLibraryA
  • LoadLibraryExW
 Functions which can be used for anti-debugging purposes:
  • CreateToolhelp32Snapshot
 Possibly launches other programs:
  • CreateProcessW
 Can create temporary files:
  • GetTempPathW
  • CreateFileW
 Manipulates other processes:
  • OpenProcess
  • Process32NextW
  • Process32FirstW
Info The PE is digitally signed. Signer: Zhuhai Kingsoft Office Software Co.
Issuer: DigiCert Assured ID Code Signing CA-1
Suspicious VirusTotal score: 1/71 (Scanned on 2026-11-02 09:41:29) ClamAV: Win.Virus.Expiro-10015928-0

Hashes

MD5 122e2a7b947eb6185b12ff52966ab4bf 🔍
SHA1 930983c4375824b80db95ba8e64083d1564ca601 🔍
SHA256 c73e3b98b5f631669fb3d4b114e98ad55d2b015e2c55003c265e0b75e0c31d9e 🔍
SHA3 b0d56907f87dc53948365c5072eafad3c2713d3b3396e8a94823398a104fc5a0 🔍
SSDeep 24576:aGU5ml5W5zCwKmcr26ncIk2hZ2Nyf61b0wxnz+xKHu89uJ:S5GMKh26nbo1b0wl6xKry 🔍
Imports Hash 45cbffa0cd3c915dd55714f5a6a537f0 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x1
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x90

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_I386
NumberofSections 6
TimeDateStamp 2020-May-18 05:28:11
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xe0
Characteristics IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32
LinkerVersion 10.0
SizeOfCode 0x95e00
SizeOfInitializedData 0xa9400
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00001000 (Section: .text)
BaseOfCode 0x1000
BaseOfData 0x97000
ImageBase 0x400000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 5.1
ImageVersion 0.0
SubsystemVersion 5.1
Win32VersionValue 0
SizeOfImage 0x146000
SizeOfHeaders 0x400
Checksum 0x143ecf
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 5804e7fe417f73e64f324b2adb245c4a 🔍
SHA1 75ecbcfcf9fe1816a65e9018a92802db61145a04 🔍
SHA256 d068f1fc3225b1e3d0723a1a96078bc10b805fe3687d0b8a9d3cbd552374cd03 🔍
SHA3 f2ba3c0d8db0149c14c03827e54901f0ab96d182abe9049f9fe167b299e89d82 🔍
VirtualSize 0x95ded
VirtualAddress 0x1000
SizeOfRawData 0x95e00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.65347

.rdata

MD5 9069f6c57a46492c56d5df0bbdc00a00 🔍
SHA1 a50121cdba9781d534af2412f5a519d148b8287a 🔍
SHA256 7523605248f804ab9255afddf70910d0a86e9bffb9ab37ae5fd16bb1307e3103 🔍
SHA3 036da85c0e1df9e49f1b87ecbda002855ae511fe9a98e06ae5684c609bd4e4dc 🔍
VirtualSize 0x2efa2
VirtualAddress 0x97000
SizeOfRawData 0x2f000
PointerToRawData 0x96200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.03369

.data

MD5 72e009b379fa8dfd7b4cec61da2aef98 🔍
SHA1 2405f78a830458fd730e90821217af3f9a9277c6 🔍
SHA256 c9e8f9f8c5d2abf45b562f2099a7ea954093a5086fb872c63460591fc67dafaf 🔍
SHA3 52b8007db0f09609cd14c15fd8475ae0914f355be02d46e465293a6537fc2535 🔍
VirtualSize 0xe9f4
VirtualAddress 0xc6000
SizeOfRawData 0xa800
PointerToRawData 0xc5200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 3.34416

.syzygy

MD5 75145d9cb36d33217b378ae7e5bdccc7 🔍
SHA1 f9d161b87fab741bfac25a4304d1015615b24062 🔍
SHA256 acff62cfdec2272cc288ca1b2c97be78d915069a71ba9ab3e8e85c0fd35be936 🔍
SHA3 3177311ff59f19e7a723d0294a933afc1d4c294d06561e67b8efc21a89048daf 🔍
VirtualSize 0x393
VirtualAddress 0xd5000
SizeOfRawData 0x400
PointerToRawData 0xcfa00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.87961

.rsrc

MD5 ab5fc053d905427631d00c39649cc2af 🔍
SHA1 a1530805c0fab9a8ef371398e481492d9ebc0a32 🔍
SHA256 0f118e0f8ec876677e24affcd98e9317ba83f3c302da1e689c615f0184521c56 🔍
SHA3 725a755f34a1c16f151fe9bc7890dd02e163353776a1a14c0f87e7ec2bf950f3 🔍
VirtualSize 0x66a98
VirtualAddress 0xd6000
SizeOfRawData 0x66c00
PointerToRawData 0xcfe00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 5.10372

.reloc

MD5 e6a4b2725e017de720f775a098709e5b 🔍
SHA1 c6c55ec60c095cd1219207a06a776a94202faff6 🔍
SHA256 0187a21468e8dee319913a83b7f25009cbe8292877ee94b244062e0053913967 🔍
SHA3 bd61e6e3c5be59f386658c5baca1803ceddd99d9c6a79878400490c439486d28 🔍
VirtualSize 0x8ac4
VirtualAddress 0x13d000
SizeOfRawData 0x8c00
PointerToRawData 0x136a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 6.58985

Imports

KERNEL32.dll InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryW
GetModuleFileNameW
CloseHandle
TerminateProcess
OpenProcess
Process32NextW
Process32FirstW
GetCurrentProcessId
CreateToolhelp32Snapshot
GetLastError
Sleep
GetCurrentThreadId
LoadLibraryA
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
UnregisterWaitEx
WaitForMultipleObjects
DeleteFileW
InitializeCriticalSection
QueueUserWorkItem
WaitForSingleObject
DeleteCriticalSection
CreateThread
LocalFree
GetStartupInfoW
GetModuleHandleW
GetTickCount
GetTempPathW
CopyFileW
MultiByteToWideChar
SetDllDirectoryW
GetDllDirectoryW
DisconnectNamedPipe
ConnectNamedPipe
FlushFileBuffers
ReadFile
CreateIoCompletionPort
CreateNamedPipeW
WriteFile
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetOverlappedResult
CancelIo
InterlockedExchange
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
GetExitCodeProcess
GetVersionExW
LocalAlloc
GetCurrentProcess
GetSystemDirectoryW
GetSystemWow64DirectoryW
WideCharToMultiByte
GetPrivateProfileStringW
CreateProcessW
GetProcessId
SetUnhandledExceptionFilter
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetFileAttributesExW
OpenFileMappingW
ReleaseMutex
UnmapViewOfFile
CreateMutexW
VirtualQuery
MapViewOfFile
CreateFileMappingW
VerifyVersionInfoW
VerSetConditionMask
GetSystemDirectoryA
SetEvent
OpenMutexW
CreateEventW
HeapAlloc
HeapFree
GetSystemInfo
LoadLibraryExW
GetModuleHandleExW
SetErrorMode
RaiseException
GetPrivateProfileIntW
GetUserDefaultUILanguage
SetFilePointerEx
GetFileSizeEx
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
CompareFileTime
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
FindClose
FindFirstFileW
CreateDirectoryW
FindNextFileW
ExpandEnvironmentStringsW
GetCurrentThread
ProcessIdToSessionId
GetStringTypeW
InterlockedCompareExchange
EncodePointer
DecodePointer
HeapSetInformation
RtlUnwind
HeapReAlloc
SetConsoleCtrlHandler
UnhandledExceptionFilter
IsDebuggerPresent
ExitThread
ExitProcess
GetSystemTimeAsFileTime
HeapCreate
HeapDestroy
LCMapStringW
GetCPInfo
GetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
QueryPerformanceCounter
GetLocaleInfoW
IsProcessorFeaturePresent
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
GetProcessHeap
krpt.dll ?_force_link_krpt@@YGXXZ
USER32.dll (delay-loaded) wsprintfW
LoadStringW
PostMessageW
DestroyWindow
ShowWindow
RegisterClassExW
LoadCursorW
GetSystemMetrics
ReleaseDC
DispatchMessageW
GetMessageW
PostThreadMessageW
GetDC
UpdateWindow
UpdateLayeredWindow
MessageBoxW
DefWindowProcW
CreateWindowExW
RegisterClassW
TranslateMessage

Delayed Imports

Attributes 0x1
Name USER32.dll
ModuleHandle 0xc89e0
DelayImportAddressTable 0xc89e4
DelayImportNameTable 0x99e70
BoundDelayImportTable 0x99ec8
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

GetHostInterface

Ordinal 1
Address 0x187a6

ksGetHWND

Ordinal 2
Address 0x3a075

1

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x519b
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93591
Detected Filetype PNG graphic file
MD5 7a347f42b710655987fc3d2434bcf524 🔍
SHA1 049088ea4727f765d71ed816f46acfb6df8914d6 🔍
SHA256 f66896dedb2216b389c9f4be248cdd9f0df01d8145763eb7b3d79629b0011040 🔍
SHA3 9e2a155c89cf72f114b93586dac19b53f9beaac9dfced4c4918bc93e04f4e765 🔍

2

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.70123
MD5 3600e4cebc838c76852e016a89d8af6d 🔍
SHA1 58d1c818f88bd2d90e9706e94ac1d20201bc337f 🔍
SHA256 e3ef45e61e2b7c281cbbd0035b8301e46df67ee8444329034c737ae263402a65 🔍
SHA3 cb4f08efc8227e34421cdcaa249ebce444eff2fa1f2595654c4d466ffb560d06 🔍

3

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.69892
MD5 0180a543c12b4299de652d64d5851b4a 🔍
SHA1 76532530e51371280b97dc6a391316b679f561ce 🔍
SHA256 df5f3a77938bca035f6170e0b24f708f7a6a0c80c595eadb1f84688ba6bc7ee7 🔍
SHA3 2c891af6522a674a2e50815d060e86fc975b2b2a0b6277751b448118917b8741 🔍

4

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.73359
MD5 d414177c2fa9591dcc980c6e2d107a08 🔍
SHA1 5824d38f632a15874ec027c4affbf4466958148e 🔍
SHA256 03c291327fe3086fe3972119a6e8f63ef35fa72b0394fc21f380599da0297213 🔍
SHA3 1c52cc2a48d4fd5a2ab82675f81e2d1d9b6ac05218398af61801037c3cf30b28 🔍

5

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.67535
MD5 3bbfe97e20ea05aafaff8bb37215b042 🔍
SHA1 9c7e69990e193472efa1cce96535261c440b89b4 🔍
SHA256 8f18b4a154a8e6b16bd9009524489b0b370e5eb322db6f98e4fc212fdcd17818 🔍
SHA3 cc2487a52416961de2b812926b634742990209ada10138fef6c71eb3cb7e9bd8 🔍

6

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.73406
MD5 5fa71b89bdf2f79abd4f480cbe9eb815 🔍
SHA1 5ce8467a362cd1ce98ac4e19c56e5960981d4c0c 🔍
SHA256 6d075e018c37d1f5ae09f67ee00842f3a93d66e306781e7ab5ff7f84274845d1 🔍
SHA3 8e825e431a5ea32be93044afeac6129653669ef7ade2dbccf05201e165201d55 🔍

7

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.95093
MD5 bcddc0ba6ca331f4f3028ff4183cf1cb 🔍
SHA1 ed8cb3567386ac6f83f7af73a404d61c6c24242c 🔍
SHA256 82596c5f1f6c041368357a1eb07d1e0dd90cc61784ccf97209a8c842e065e9e8 🔍
SHA3 027cda70b435a24ae04af7f06316b93ecbb3865f3fefc5f5ed6929db7d43ca62 🔍

8

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.05334
MD5 95fa41c71703185df093e619937fb1ca 🔍
SHA1 748e726984d202a76fe727de3f59d5903685a08c 🔍
SHA256 72fbad2a37f43ed86830f117dd556b1ebb82ffcfd3ea6fcf0591c49af9541ffa 🔍
SHA3 377c94789bc4c344148b71a3d5920b44c203dfd62290a6dc969287681773dae0 🔍

9

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x11d4
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.59116
Detected Filetype PNG graphic file
MD5 8753bffa1235dfacc5d597bbfc95a6d3 🔍
SHA1 7633f671920ed651f87099e42fb1d9d57648e1a5 🔍
SHA256 451c75ae80db975af07beab284dff06d60c340e7aed96ea4cf8519ee260729b8 🔍
SHA3 7b130052d4e157930e1c8c8c3a5338afa8376aa3d3c264c7b3d0caed513ee8df 🔍

10

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 1.78399
MD5 a9e865f4db4e1d828a97b89ddadc5146 🔍
SHA1 78ab78b34a5039defc8b785ad3038fe8ebb85996 🔍
SHA256 5b8be097fc703c51c70a6c8895f6281c50c0cef75be1e046e206e6bbd2f5c926 🔍
SHA3 afb8bc765af6705cc2898f352d557d6ebc6b4d31a7125dbb09aa1abdabed4bce 🔍

11

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.1237
MD5 0cc080516ef6977ffa2966aac2ba4233 🔍
SHA1 091c7b91cd8a9d5c268eb00b875a2fa80c6e4b0a 🔍
SHA256 76fc83b67e91c2055f5a8e22a9106db7b3ee94b2fd47fa7f38968f62641ea74d 🔍
SHA3 a274544c8a1d3e366f535b9940effe54c742b62cc9c8fa2132498b74c38d4ba2 🔍

12

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.39132
MD5 3eea6f38ddaefb1a5abed40c4e7b1d12 🔍
SHA1 fa865d5013f3943174567f2caa97e322dd379292 🔍
SHA256 6d03b8e38867648914f5a766f9a47c8f77418428dc2cdd5b386033e5451a4a04 🔍
SHA3 7f1a78be130eb4d114ef08b818639a957c01d48bde53f1679a507111ae790d12 🔍

13

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.45439
MD5 056163a9cf2836dd6fd3727ad87bc26c 🔍
SHA1 0e25f3489c42d8ae8a8c4ad5a36bc5275f3cf260 🔍
SHA256 e1fd5f8ef6353db031aa17a2fd501e3534e013668455e5cfd7272f24a5bb2e34 🔍
SHA3 5e6f41efa6256a209a691113f6edb28eea9b402eebb6e3ec7cb23986b9ebd80d 🔍

14

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.68896
MD5 a137b4dfbb647b7566e3dc47829a0579 🔍
SHA1 c36ef38641d9918a3a228f87a6f15ec8a96e3fc1 🔍
SHA256 b94983990042ab2c97f4bbb7d6b4af29e0054f87703d68c684b95ffec30acba8 🔍
SHA3 02e277694b9c24accd6d62b78a944d1f1f8d03f807390e2ed0684f08312d172e 🔍

15

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.63641
MD5 97b3bb1e7f94381c760b4a3f921aa65f 🔍
SHA1 49921fa7801917b42043dc12e392594398112ae3 🔍
SHA256 cf67cdefd6ebcefbd88cbde579df89b5f930adb1e884d479cf210925da9a7cf2 🔍
SHA3 a55b39f89614ebcee617e76580e924cc2911d8090d71c3ff808926da5adee285 🔍

16

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x22ac
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.86265
Detected Filetype PNG graphic file
MD5 536120ad3905e4ed5fbaaaa5229d082e 🔍
SHA1 7675320d954055e2e4e58bdd1d53c39e39ccd348 🔍
SHA256 126adc2f49be025be41cc2621296a7e839af063861fd9a557a53524b9405a327 🔍
SHA3 e4aea4404ab1329f5e560a70fe01e75c71415aa8a2de129a40b19ddc1c4b42ba 🔍

17

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.90581
MD5 66e9ee961791a033aad289db5d5cc382 🔍
SHA1 c818ef8141b742515e7d5eef21be62df7b120428 🔍
SHA256 3863462073960a41feb4425978d02b4107052b3ad17f8f27dcc7bccb8a46c6ac 🔍
SHA3 099830cb2d7c499d5b4e52e46c6072c988223a5c184aa05e863c74c3bf0f5280 🔍

18

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.00603
MD5 551d2ad3f63ae6b3df41ef217fab5e85 🔍
SHA1 5ba62dd5313372d7753ac950e15e5be9d925ed18 🔍
SHA256 5a5f42589bd1879f33588fff31b424bb5d597c0bfe157a226d4a3e72ead322b9 🔍
SHA3 1c39b1001c330af8a11f00ba95eadac0504d9483acbbfb8504c8fa6ad23b7d94 🔍

19

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.09427
MD5 e946efbdbca99f2831856c5d71d1cdca 🔍
SHA1 831f2173da5c920774d0c97af29370a69f72f019 🔍
SHA256 cae3999df9d747b1b0ffbc083ffd522de8af51efed918a31a7b563212093ccc7 🔍
SHA3 b0597573683124a1e29c3db572878aaba2b2015fa846492dea96420d013c17a5 🔍

20

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.15764
MD5 ab33eda94b7fbff27aaf20642eee9f05 🔍
SHA1 e5cf21cab6df6c47caca3e573db790db008df949 🔍
SHA256 651e7ab853e50ddd90d3c7a33114d2e8e6b6c1fd936da7a3b3f1053f438fb7bb 🔍
SHA3 3e9c96eb1692856f525e59bc050c42c6c3c8343bbd3aa6b33a1202f1da31f91f 🔍

21

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.23527
MD5 cc816e0a0188ea7610348bfc8fea2296 🔍
SHA1 0e2dc1ff661220a925256da2045adfe5dbab2347 🔍
SHA256 8c6a456b6b98344f7a118d3c23fd35ced08e16b71e73d0f4108232657fee334c 🔍
SHA3 9418c6999a64141cabd9afe8b66b24eab34baf37d73e0d288a414d1093cd929f 🔍

22

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.44738
MD5 efbc5da1749008a657e25f5e5976ad0f 🔍
SHA1 9ae9659117a0729f999e3c4d1b7e2396fb1f7711 🔍
SHA256 74696e958c06bd97da490c4d5a7a5f3eb48af67d816718e48391b0a4ce4a9285 🔍
SHA3 cda1eeb3ebafd33d8016008f97570f73b426fc13ce6a03edf99493ca8b57bba0 🔍

23

Type RT_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.25673
MD5 857819bb2301d4b5cfd353c8837eb62d 🔍
SHA1 4c7522fa821d2936b073fb1744fcf98ac25f6fd2 🔍
SHA256 eecc2c9a8c1e8ba4a135ff4c6bf8bf019887be5c66d0ea64c7d93bb4d5af2deb 🔍
SHA3 a9172e30b59887649f9457f011027c00abe26d9ddfe570c848b383baf8f26fac 🔍

IDI_ICON1

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.97321
Detected Filetype Icon file
MD5 0824d098d4a6ac569a0ea27d79318d12 🔍
SHA1 655931637e190fda9e578b7414477b3c65e40c59 🔍
SHA256 d507a732fdba788d30c90849e5cef3064a97225c4219b2ce9f556b185dc7aed6 🔍
SHA3 77516ddfd4ac60ab055c69747a64b2f545cf3a1561fa147b6526a6825563ff21 🔍

IDI_P1WPSPDF

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x68
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 2.98335
Detected Filetype Icon file
MD5 8da394a7ba7ce91967946618229446ab 🔍
SHA1 5db1b7e9a22191d09e821e6b4391f5026ab62c50 🔍
SHA256 05658b9eae9327b8ca807d446bd290b0e78a891a957870a4138c6abf40615c22 🔍
SHA3 ddb3f48930d0a1168be5625a922582937794fa98a0dd157f0d8ca52de3320508 🔍

IDI_STANDALONE_MAIN

Type RT_GROUP_ICON
Language English - United States
Codepage Latin 1 / Western European
Size 0x76
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.02698
Detected Filetype Icon file
MD5 99fea95d46008b0af3026860896cf1fb 🔍
SHA1 752c7caa1ecb05eb2a56927c795cb910d295de0b 🔍
SHA256 ce5e338e4033d65ec7f664e1c013342d4f63a5c4618ad76184480865a648efb6 🔍
SHA3 3fc175d32ffd495f33d5eef30995f82bb18e5d3f8200831bc45f9f327e9f9d14 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage Latin 1 / Western European
Size 0x35c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.51606
MD5 8bf39537125c29556022f70881b7842c 🔍
SHA1 1191cf2fb0fb80a58d8b7cb86f8e98f675efab7f 🔍
SHA256 79cf50092102111697749486e879f54eb837fa34a1c3afe7f0cfde1ab66bc290 🔍
SHA3 ce372be1315141138ef2a2e407461428abb51a2d561ab9bd7e873634ecccde13 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage Latin 1 / Western European
Size 0x4bf
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.16348
MD5 5de52de56a7242ea025bb0c43a6aff93 🔍
SHA1 5222005c7d1d706e2b4b01d805cf39a751889eeb 🔍
SHA256 fc4e3ad579b227b13f012485a24fb5924c67ece3476cfb4b1c85607ab09dd869 🔍
SHA3 2f3fd5f438dfa7ef0e645f52fc8939efd7d269f8f672807782bedd0e4e276bb0 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 11.2.0.9363
ProductVersion 11.2.0.9363
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language UNKNOWN
CompanyName Zhuhai Kingsoft Office Software Co.,Ltd
FileDescription WPS PDF
FileVersion (#2) 11,2,0,9363
InternalName wpspdf
LegalCopyright Copyright©1988-2020 Kingsoft Corporation. All rights reserved.
OriginalFilename wpspdf.exe
ProductName WPS Office
ProductVersion (#2) 11,2,0,9363
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2020-May-18 05:28:11
Version 0.0
SizeofData 67
AddressOfRawData 0xb6ed0
PointerToRawData 0xb60d0
Referenced File h:\syzygy_wpsoptimize\result\wpspdf.pdb

TLS Callbacks

Load Configuration

Size 0x48
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x4c6000
SEHandlerTable 0x4ba770
SEHandlerCount 506

RICH Header

Errors

Leave a comment

No comments yet.