parentQvodSetup5.exe
filenameQvodSetup5.unpacked.exe
size734128 (0xb33b0)
md5c05c460134c27ea1a186b0b6ff06f54d
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Sality-40173 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0xe0

Rich Header

lib idversiontimes used
1255072728
1145072767
10950727197
1235072725
10325
1105072784
124507271
120507271

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x528594e2
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x103
Magic0x10b
LinkerVersion8.0
SizeOfCode0x69000
SizeOfInitializedData0x48600
SizeOfUninitializedData0
AddressOfEntryPoint0x2c953
BaseOfCode0x1000
BaseOfData0x6a000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xb7000
SizeOfHeaders0x1000
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

namevavsizeraw sizeflags
.text0x10000x68e100x69000R-X CODE
.rdata0x6a0000x116b00x11800R-- IDATA
.data0x7c0000x52100x2800RW- IDATA
.rsrc0x820000x344480x34600R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x79c580x104
RESOURCE0x820000x34448
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG0x718280x40
Bound_IAT00
IAT00
Delay_IAT00
CLR_Header00
typenamesizecp
PNG#231991401252
PNG#23228611252
PNG#233243531252
PNG#23437131252
PNG#23531481252
PNG#2369601252
PNG#23710691252
PNG#23810651252
PNG#23935481252
PNG#24028531252
PNG#241286441252
PNG#24253521252
ICON#113841252
ICON#2169361252
ICON#396401252
ICON#442641252
ICON#511281252
MENU#202481252
DIALOG#129441252
STRING#81121252
STRING#92041252
STRING#102221252
STRING#18361252
STRING#69361252
GROUP_ICON#128761252
VERSION#19081252
MANIFEST#18101252
idlangstring
1252052共:%s 已下载:%s|速度:%dK/S
1262052快播5在线安装程序
1272052正在获取文件信息...
1282052QvodPlayer5
1332052已下载:%.2f%%
1382052共:%s 已下载:%s|下载完成
1392052无法连接到服务器，正在重试...
1402052正在下载最新的快播增强版安装包...
1412052快播下载器
1432052正在下载 %s...
1472052安装包的数字签名无法验证。您确定需要继续安装吗？
1482052快播安装提示
1492052安装包不是快播的数字签名，此安装包不是快播发布，安装中止。请从http://www.kuaibo.com下载官方版本。
1502052快播安装中止
2772052完成
11002052取消
module_namehintordfunction_name
KERNEL32.DLLCreateProcessW
KERNEL32.DLLCopyFileW
KERNEL32.DLLlstrcpyW
KERNEL32.DLLSetEvent
KERNEL32.DLLGetFileAttributesW
KERNEL32.DLLWideCharToMultiByte
KERNEL32.DLLCloseHandle
KERNEL32.DLLOpenEventW
KERNEL32.DLLGetProcessHeap
KERNEL32.DLLInitializeCriticalSection
KERNEL32.DLLDeleteCriticalSection
KERNEL32.DLLHeapFree
KERNEL32.DLLFindResourceExW
KERNEL32.DLLHeapReAlloc
KERNEL32.DLLHeapAlloc
KERNEL32.DLLGetLastError
KERNEL32.DLLEnterCriticalSection
KERNEL32.DLLLeaveCriticalSection
KERNEL32.DLLMultiByteToWideChar
KERNEL32.DLLlstrlenA
KERNEL32.DLLGetTempPathW
KERNEL32.DLLSetLastError
KERNEL32.DLLGetCurrentThreadId
KERNEL32.DLLRaiseException
KERNEL32.DLLFlushInstructionCache
KERNEL32.DLLGetCurrentProcess
KERNEL32.DLLInterlockedIncrement
KERNEL32.DLLInterlockedDecrement
KERNEL32.DLLGetModuleHandleW
KERNEL32.DLLFreeLibrary
KERNEL32.DLLLoadLibraryExW
KERNEL32.DLLlstrcmpiW
KERNEL32.DLLWaitForSingleObject
KERNEL32.DLLHeapDestroy
KERNEL32.DLLHeapSize
KERNEL32.DLLInterlockedExchange
KERNEL32.DLLGetACP
KERNEL32.DLLTerminateThread
KERNEL32.DLLGetModuleFileNameW
KERNEL32.DLLDeleteFileW
KERNEL32.DLLCreateEventW
KERNEL32.DLLSetEnvironmentVariableA
KERNEL32.DLLCompareStringW
KERNEL32.DLLCompareStringA
KERNEL32.DLLGetTimeZoneInformation
KERNEL32.DLLCreateFileA
KERNEL32.DLLGetLocaleInfoW
KERNEL32.DLLIsValidLocale
KERNEL32.DLLEnumSystemLocalesA
KERNEL32.DLLGetUserDefaultLCID
KERNEL32.DLLGetStringTypeW
KERNEL32.DLLGetStringTypeA
KERNEL32.DLLWriteConsoleW
KERNEL32.DLLGetConsoleOutputCP
KERNEL32.DLLWriteConsoleA
KERNEL32.DLLSetStdHandle
KERNEL32.DLLGetCurrentDirectoryA
KERNEL32.DLLGetFullPathNameW
KERNEL32.DLLSetFilePointer
KERNEL32.DLLGetCurrentProcessId
KERNEL32.DLLGetStartupInfoA
KERNEL32.DLLGetFileType
KERNEL32.DLLSetHandleCount
KERNEL32.DLLGetCommandLineW
KERNEL32.DLLGetCommandLineA
KERNEL32.DLLGetEnvironmentStringsW
KERNEL32.DLLFreeEnvironmentStringsW
KERNEL32.DLLGetEnvironmentStrings
KERNEL32.DLLFreeEnvironmentStringsA
KERNEL32.DLLLCMapStringW
KERNEL32.DLLLCMapStringA
KERNEL32.DLLGetStdHandle
KERNEL32.DLLExitProcess
KERNEL32.DLLHeapCreate
KERNEL32.DLLIsValidCodePage
KERNEL32.DLLCreateThread
KERNEL32.DLLlstrlenW
KERNEL32.DLLSleep
KERNEL32.DLLFindResourceW
KERNEL32.DLLSizeofResource
KERNEL32.DLLLoadResource
KERNEL32.DLLLockResource
KERNEL32.DLLGlobalAlloc
KERNEL32.DLLGlobalLock
KERNEL32.DLLGlobalUnlock
KERNEL32.DLLGlobalFree
KERNEL32.DLLWritePrivateProfileStringW
KERNEL32.DLLGetPrivateProfileIntW
KERNEL32.DLLGetLocaleInfoA
KERNEL32.DLLGetThreadLocale
KERNEL32.DLLGetVersionExA
KERNEL32.DLLGetOEMCP
KERNEL32.DLLGetCPInfo
KERNEL32.DLLGetConsoleMode
KERNEL32.DLLGetConsoleCP
KERNEL32.DLLTlsFree
KERNEL32.DLLTlsSetValue
KERNEL32.DLLTlsAlloc
KERNEL32.DLLInterlockedCompareExchange
KERNEL32.DLLGetProcAddress
KERNEL32.DLLLoadLibraryA
KERNEL32.DLLTlsGetValue
KERNEL32.DLLFindFirstFileW
KERNEL32.DLLFileTimeToLocalFileTime
KERNEL32.DLLFileTimeToSystemTime
KERNEL32.DLLFindClose
KERNEL32.DLLResumeThread
KERNEL32.DLLExitThread
KERNEL32.DLLDeleteFileA
KERNEL32.DLLGetSystemTimeAsFileTime
KERNEL32.DLLCreateDirectoryW
KERNEL32.DLLGetStartupInfoW
KERNEL32.DLLVirtualQuery
KERNEL32.DLLGetModuleHandleA
KERNEL32.DLLVirtualProtect
KERNEL32.DLLIsDebuggerPresent
KERNEL32.DLLSetUnhandledExceptionFilter
KERNEL32.DLLUnhandledExceptionFilter
KERNEL32.DLLTerminateProcess
KERNEL32.DLLRtlUnwind
KERNEL32.DLLGetDriveTypeA
KERNEL32.DLLWriteFile
KERNEL32.DLLFlushFileBuffers
KERNEL32.DLLSetFilePointerEx
KERNEL32.DLLSetEndOfFile
KERNEL32.DLLCreateFileMappingA
KERNEL32.DLLUnmapViewOfFile
KERNEL32.DLLMapViewOfFile
KERNEL32.DLLSetFileValidData
KERNEL32.DLLGetTempPathA
KERNEL32.DLLWaitForMultipleObjects
KERNEL32.DLLQueryPerformanceCounter
KERNEL32.DLLGetTickCount
KERNEL32.DLLCreateEventA
KERNEL32.DLLResetEvent
KERNEL32.DLLWritePrivateProfileStringA
KERNEL32.DLLGetPrivateProfileStringA
KERNEL32.DLLGetPrivateProfileIntA
KERNEL32.DLLLocalFree
KERNEL32.DLLIsProcessorFeaturePresent
KERNEL32.DLLLocalAlloc
KERNEL32.DLLGetModuleFileNameA
KERNEL32.DLLMoveFileW
KERNEL32.DLLSetFileAttributesW
KERNEL32.DLLCreateFileW
KERNEL32.DLLGetSystemDirectoryA
KERNEL32.DLLReadFile
KERNEL32.DLLGetDriveTypeW
KERNEL32.DLLGetFileSizeEx
KERNEL32.DLLGetSystemInfo
KERNEL32.DLLVirtualAlloc
KERNEL32.DLLVirtualFree
KERNEL32.DLLGetPrivateProfileStringW
ADVAPI32.dllRegQueryInfoKeyW
ADVAPI32.dllRegSetValueExW
ADVAPI32.dllRegEnumKeyExW
ADVAPI32.dllRegOpenKeyExW
ADVAPI32.dllRegCreateKeyExW
ADVAPI32.dllRegCloseKey
ADVAPI32.dllRegDeleteValueW
ADVAPI32.dllRegDeleteKeyW
ADVAPI32.dllOpenProcessToken
ADVAPI32.dllLookupPrivilegeValueA
ADVAPI32.dllAdjustTokenPrivileges
GDI32.dllDeleteObject
GDI32.dllDeleteDC
GDI32.dllSelectObject
GDI32.dllCreateCompatibleDC
gdiplus.dllGdipDrawImageRectRectI
gdiplus.dllGdiplusStartup
gdiplus.dllGdiplusShutdown
gdiplus.dllGdipCreateHBITMAPFromBitmap
gdiplus.dllGdipCreateBitmapFromStreamICM
gdiplus.dllGdipCreateBitmapFromStream
gdiplus.dllGdipCreateBitmapFromFileICM
gdiplus.dllGdipFree
gdiplus.dllGdipAlloc
gdiplus.dllGdipCreateSolidFill
gdiplus.dllGdipDeleteBrush
gdiplus.dllGdipCloneBrush
gdiplus.dllGdipCreateStringFormat
gdiplus.dllGdipDeleteStringFormat
gdiplus.dllGdipSetStringFormatAlign
gdiplus.dllGdipSetStringFormatTrimming
gdiplus.dllGdipDeleteGraphics
gdiplus.dllGdipDrawString
gdiplus.dllGdipDrawImageRectRect
gdiplus.dllGdipGetImageGraphicsContext
gdiplus.dllGdipCreateFont
gdiplus.dllGdipCreateFontFamilyFromName
gdiplus.dllGdipGetGenericFontFamilySansSerif
gdiplus.dllGdipDeleteFontFamily
gdiplus.dllGdipDeleteFont
gdiplus.dllGdipGetImageWidth
gdiplus.dllGdipGetImageHeight
gdiplus.dllGdipCreateBitmapFromScan0
gdiplus.dllGdipDisposeImage
gdiplus.dllGdipCloneImage
gdiplus.dllGdipCreateBitmapFromFile
IPHLPAPI.DLLGetAdaptersInfo
ole32.dllCoTaskMemRealloc
ole32.dllCoTaskMemAlloc
ole32.dllCoTaskMemFree
ole32.dllCoUninitialize
ole32.dllCoInitialize
ole32.dllCoCreateInstance
ole32.dllCreateStreamOnHGlobal
OLEAUT32.dll277
OLEAUT32.dll6
OLEAUT32.dll7
OLEAUT32.dll2
SHELL32.dllShell_NotifyIconW
SHELL32.dllSHFileOperationW
SHLWAPI.dllStrStrIA
USER32.dllLoadImageW
USER32.dllGetWindow
USER32.dllGetParent
USER32.dllBeginPaint
USER32.dllEndPaint
USER32.dllGetActiveWindow
USER32.dllDefWindowProcW
USER32.dllDialogBoxParamW
USER32.dllDestroyWindow
USER32.dllCharNextW
USER32.dllMapWindowPoints
USER32.dllSetWindowPos
USER32.dllSetCapture
USER32.dllKillTimer
USER32.dllSetTimer
USER32.dllInvalidateRect
USER32.dllScreenToClient
USER32.dllClientToScreen
USER32.dllGetClientRect
USER32.dllGetWindowRect
USER32.dllGetSystemMenu
USER32.dllSetWindowTextW
USER32.dllPostMessageW
USER32.dllSetWindowLongW
USER32.dllGetWindowLongW
USER32.dllDestroyMenu
USER32.dllGetSubMenu
USER32.dllLoadMenuW
USER32.dllEndDialog
USER32.dllUpdateLayeredWindow
USER32.dllSetForegroundWindow
USER32.dllShowWindow
USER32.dllIsIconic
USER32.dllSendMessageW
USER32.dllUpdateWindow
USER32.dllTrackPopupMenu
USER32.dllwsprintfW
USER32.dllPtInRect
USER32.dllGetCursorPos
USER32.dllUnregisterClassA
USER32.dllReleaseCapture
USER32.dllTrackMouseEvent
USER32.dllLoadCursorW
USER32.dllSetCursor
USER32.dllRemoveMenu
USER32.dllGetSystemMetrics
USER32.dllLoadIconW
USER32.dllLoadStringW
USER32.dllSystemParametersInfoW
VERSION.dllGetFileVersionInfoA
VERSION.dllGetFileVersionInfoSizeA
VERSION.dllVerQueryValueA
WS2_32.dllfreeaddrinfo
WS2_32.dll112
WS2_32.dllgetaddrinfo
WS2_32.dll111
WS2_32.dllWSAEnumNetworkEvents
WS2_32.dllWSAConnect
WS2_32.dllWSAGetOverlappedResult
WS2_32.dllWSASend
WS2_32.dllWSAResetEvent
WS2_32.dllWSARecv
WS2_32.dllWSAEventSelect
WS2_32.dllWSASetEvent
WS2_32.dllWSACreateEvent
WS2_32.dll23
WS2_32.dll4
WS2_32.dllWSASocketW
WS2_32.dllWSACloseEvent
WS2_32.dll21
WS2_32.dll9
WS2_32.dll19
WS2_32.dll52
WS2_32.dll8
WS2_32.dll11
WS2_32.dll57
WS2_32.dll15
WS2_32.dll151
WS2_32.dll14
WS2_32.dll18
WS2_32.dll17
WS2_32.dll20
WS2_32.dll3
WS2_32.dll116
WS2_32.dll16
WS2_32.dll115
WS2_32.dll13
WS2_32.dll1
WS2_32.dllWSAWaitForMultipleEvents
WS2_32.dll10
WS2_32.dll2

StringTable 040904b0

CompanyNameShenzhen QVOD Technology Co.,Ltd
FileDescriptionQvodInstall Module
FileVersion5,2,0,0
InternalNameQvodSetup5
LegalCopyrightCopyright (C) 2006 - 2013 Shenzhen QVOD Technology Co.,Ltd. All rights reserved.
OriginalFilenameQvodSetup5.exe
ProductNameQvodInstall Module
ProductVersion5, 2, 0, 0

VS_FIXEDFILEINFO

FileVersion5.2.0.0
ProductVersion5.2.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS4
FileType2
FileSubtype0
offsetsizetypecomment
0727552EXE11/15/2013 03:28:34#
15c115HTM#
7d9e899140PNG(589 x 450)#
95d2c2861PNG(343 x 5)#
9685c24353PNG(1404 x 34)#
9c7803713PNG(69 x 21)#
9d6043148PNG(72 x 14)#
9e250960PNG(78 x 33)#
9e6101069PNG(78 x 33)#
9ea401065PNG(78 x 33)#
9ee6c3548PNG(30 x 13)#
9fc482853PNG(342 x 5)#
a077028644PNG(501 x 169)#
a77545352PNG(129 x 22)#
b1a006576BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 734128 bytes (717 KiB)



Errors: 1
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK