filenameAgile1pLogin.exe
size942640 (0xe6230)
md5d87d6e44a5dbd984b4bdf0d919ff0202
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavWin.Trojan.Wpbrutebot-2 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x50
blocks_in_file2
num_relocs0
header_paragraphs4
min_extra_paragraphs0xf
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0x1a
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

DOS stub

00000000: ba 10 00 0e 1f b4 09 cd  21 b8 01 4c cd 21 90 90  |........!..L.!..|
00000010: 54 68 69 73 20 70 72 6f  67 72 61 6d 20 6d 75 73  |This program mus|
00000020: 74 20 62 65 20 72 75 6e  20 75 6e 64 65 72 20 57  |t be run under W|
00000030: 69 6e 33 32 0d 0a 24 37  00 00 00 00 00 00 00 00  |in32..$7........|
00000040: 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000000c0:

PE Header

SignaturePE
Machine0x14c
NumberOfSections9
TimeDateStamp0x53be5220
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x818e
Magic0x10b
LinkerVersion2.25
SizeOfCode0x9de00
SizeOfInitializedData0x47800
SizeOfUninitializedData0
AddressOfEntryPoint0x9eb9c
BaseOfCode0x1000
BaseOfData0x9f000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0xf0000
SizeOfHeaders0x400
CheckSum0xeeb7e
Subsystem2
DllCharacteristics0x140
SizeOfStackReserve0x100000
SizeOfStackCommit0x4000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

Borland Delphi v6.0 - v7.0

Sections

namevavsizeraw sizeflags
.text0x10000x9cf2c0x9d000R-X CODE
.itext0x9e0000xd180xe00R-X CODE
.data0x9f0000x5bb00x5c00RW- IDATA
.bss0xa50000x58fc0RW-
.idata0xab0000x30a40x3200RW- IDATA
.tls0xaf0000x540RW-
.rdata0xb00000x180x200R-- IDATA
.reloc0xb10000xa76c0xa800R-- IDATA DISCARDABLE
.rsrc0xbc0000x340000x34000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0xab0000x30a4
RESOURCE0xbc0000x34000
EXCEPTION00
SECURITY0xe5a000x830
BASERELOC0xb10000xa76c
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS0xb00000x18
LOAD_CONFIG00
Bound_IAT00
IAT0xab8e80x780
Delay_IAT00
CLR_Header00

TLS

raw
start		raw
end		indexcallbkszero
fill		flags
0x4af0000x4af0540x49f7900x4b001000
typenamesizecp
CURSOR#13080
CURSOR#23080
CURSOR#33080
CURSOR#43080
CURSOR#53080
CURSOR#63080
CURSOR#73080
BITMAPBBABORT4640
BITMAPBBALL4840
BITMAPBBCANCEL4640
BITMAPBBCLOSE4640
BITMAPBBHELP4640
BITMAPBBIGNORE4640
BITMAPBBNO4640
BITMAPBBOK4640
BITMAPBBRETRY4640
BITMAPBBYES4640
BITMAPPREVIEWGLYPH2320
ICON#1735720
ICON#2676240
ICON#3169360
ICON#496400
ICON#542640
ICON#624400
ICON#711280
DIALOGDLGTEMPLATE820
DIALOGTEXTFILEDLG820
STRING#4080800
STRING#408128720
STRING#408217240
STRING#40837720
STRING#40841600
STRING#40852280
STRING#40863280
STRING#408711720
STRING#40888560
STRING#40899040
STRING#409010160
STRING#40912800
STRING#40922040
STRING#40935200
STRING#40949720
STRING#40958520
STRING#40966760
RCDATACROPPEDSMALL85030
RCDATADVCLAL160
RCDATAPACKAGEINFO13280
RCDATATFRM1PLOGIN11000
GROUP_CURSOR#32761200
GROUP_CURSOR#32762200
GROUP_CURSOR#32763200
GROUP_CURSOR#32764200
GROUP_CURSOR#32765200
GROUP_CURSOR#32766200
GROUP_CURSOR#32767200
GROUP_ICONAAA_APP_ICON1040
VERSION#18680
MANIFEST#17330
idlangstring
652640Your %s Vault Is Locked
652800Could not decompress the image because it contains invalid compressed data. Description:
652810The "Portable Network Graphics" image contains an invalid palette.
652820The file being readed is not a valid "Portable Network Graphics" image because it contains an invalid header. This file may be corruped, try obtaining it again.
652830This "Portable Network Graphics" image is not supported or it might be invalid. (IHDR chunk is not the first)
652840This "Portable Network Graphics" image is not supported because either it's width or height exceeds the maximum size, which is 65535 pixels length.
652850There is no such palette entry.
652860This "Portable Network Graphics" image contains an unknown critical part which could not be decoded.
652870This "Portable Network Graphics" image is encoded with an unknown compression scheme which could not be decoded.
652880This "Portable Network Graphics" image uses an unknown interlace scheme which could not be decoded.
652890The chunks must be compatible to be assigned.
652900This "Portable Network Graphics" image is invalid because the decoder found an unexpected end of the file.
652910This "Portable Network Graphics" image contains no data.
652920The png image could not be loaded from the resource ID.
652930Some operation could not be performed because the system is out of resources. Close some windows and try again.
652940This operation is not valid because the current image contains no valid header.
652950The new size provided for image resizing is invalid.
652960Method '%s' not supported by automation object
652970Variant does not reference an automation object
652980Dispatch methods do not support more than 64 parameters
652990DCOM not installed
653000OLE control activation failed
653010Could not obtain OLE control window handle
653020License information for %s is invalid
653030License information for %s not found. You cannot use this control in design mode
653040Unable to retrieve a pointer to a running object registered with OLE for %s/%s
653050Buffer overflow
653060Invalid UTF7
653070Invalid owner
653080This control requires version 4.70 or greater of COMCTL32.DLL
653090This "Portable Network Graphics" image is not valid because it contains invalid pieces of data (crc error)
653100The "Portable Network Graphics" image could not be loaded because one of its main piece of data (ihdr) might be corrupted
653110This "Portable Network Graphics" image is invalid because it has missing image parts.
653120Alt+
653130Clipboard does not support Icons
653140Menu '%s' is already being used by another form
653150Docked control must have a name
653160Error removing control from dock tree
653170 - Dock zone not found
653180 - Dock zone has no control
653190Error loading dock zone from the stream. Expecting version %d, but found %d.
653200No OnGetItem event handler assigned
653210ANSI
653220ASCII
653230Unicode
653240Big Endian Unicode
653250UTF-8
653260UTF-7
653270OLE error %.8x
653280Tab
653290Esc
653300Enter
653310Space
653320PgUp
653330PgDn
653340End
653350Home
653360Left
653370Up
653380Right
653390Down
653400Ins
653410Del
653420Shift+
653430Ctrl+
653440Warning
653450Error
653460Information
653470Confirm
653480&Yes
653490&No
653500OK
653510Cancel
653520&Help
653530&Abort
653540&Retry
653550&Ignore
653560&All
653570N&o to All
653580Yes to &All
653590BkSp
653600A control cannot have itself as its parent
653610OK
653620Cancel
653630&Yes
653640&No
653650&Help
653660&Close
653670&Ignore
653680&Retry
653690Abort
653700&All
653710Cannot drag a form
653720Metafiles
653730Enhanced Metafiles
653740Icons
653750Bitmaps
653760Failed to read ImageList data from stream
653770Failed to write ImageList data to stream
653780Error creating window device context
653790Error creating window class
653800Cannot focus a disabled or invisible window
653810Control '%s' has no parent window
653820Parent given is not a parent of '%s'
653830Cannot hide an MDI Child Form
653840Cannot change Visible in OnShow or OnHide
653850Cannot make a visible window modal
653860Menu index out of range
653870Menu inserted twice
653880Sub-menu is not in menu
653890Not enough timers available
653900GroupIndex cannot be less than a previous menu item's GroupIndex
653910Cannot create form. No MDI forms are currently active
653920No context-sensitive help installed
653930No help found for context
653940No topic-based help system installed
653950Bitmap image is not valid
653960Icon image is not valid
653970Metafile is not valid
653980Invalid pixel format
653990Cannot change the size of an icon
654000Invalid operation on TOleGraphic
654010Unsupported clipboard format
654020Out of system resources
654030Canvas does not allow drawing
654040Invalid image size
654050Invalid ImageList
654060Unable to Replace Image
654070Invalid ImageList Index
654080List capacity out of bounds (%d)
654090List count out of bounds (%d)
654100List index out of bounds (%d)
654110Out of memory while expanding memory stream
654120Error reading %s%s%s: %s
654130Stream read error
654140Property is read-only
654150Failed to get data for '%s'
654160Resource %s not found
654170%s.Seek not implemented
654180Operation not allowed on sorted list
654190%s not in a class registration group
654200Property %s does not exist
654210Stream write error
654220Unable to find a Table of Contents
654230No help found for %s
654240Bits index out of range
654250Can't write to a read-only resource stream
654260CheckSynchronize called from thread $%x, which is NOT the main thread
654270Class %s not found
654280A class named %s already exists
654290List does not allow duplicates ($0%x)
654300A component named %s already exists
654310String list does not allow duplicates
654320Cannot create file "%s". %s
654330Cannot open file "%s". %s
654340Invalid stream format
654350''%s'' is not a valid component name
654360Invalid property value
654370Invalid property path
654380Invalid property value
654390Invalid data type for '%s'
654400Sun
654410Mon
654420Tue
654430Wed
654440Thu
654450Fri
654460Sat
654470Sunday
654480Monday
654490Tuesday
654500Wednesday
654510Thursday
654520Friday
654530Saturday
654540Ancestor for '%s' not found
654550Cannot assign a %s to a %s
654560Sep
654570Oct
654580Nov
654590Dec
654600January
654610February
654620March
654630April
654640May
654650June
654660July
654670August
654680September
654690October
654700November
654710December
654720Assertion failed
654730Interface not supported
654740Exception in safecall method
654750%s (%s, line %d)
654760Abstract Error
654770Access violation at address %p in module '%s'. %s of address %p
654780System Error. Code: %d. %s
654790A call to an OS function failed
654800Jan
654810Feb
654820Mar
654830Apr
654840May
654850Jun
654860Jul
654870Aug
654880Write
654890Error creating variant or safe array
654900Variant or safe array index out of bounds
654910Variant or safe array is locked
654920Invalid variant type conversion
654930Invalid variant operation
654940Invalid NULL variant operation
654950Invalid variant operation (%s%.8x) %s
654960Could not convert variant of type (%s) into type (%s)
654970Overflow while converting variant of type (%s) into type (%s)
654980Variant overflow
654990Invalid argument
655000Invalid variant type
655010Operation not supported
655020Unexpected variant error
655030External exception %x
655040Floating point division by zero
655050Floating point overflow
655060Floating point underflow
655070Invalid pointer operation
655080Invalid class typecast
655090Access violation at address %p. %s of address %p
655100Access violation
655110Stack overflow
655120Control-C hit
655130Privileged instruction
655140Exception %s in module %s at %p. %s%s
655150Application Error
655160Format '%s' invalid or incompatible with argument
655170No argument for format '%s'
655180Variant method calls not supported
655190Read
655200'%s' is not a valid integer value
655210Invalid argument to time encode
655220Invalid argument to date encode
655230Out of memory
655240I/O error %d
655250File not found
655260Invalid filename
655270Too many open files
655280File access denied
655290Read beyond end of file
655300Disk full
655310Invalid numeric input
655320Division by zero
655330Range check error
655340Integer overflow
655350Invalid floating point operation
module_namehintordfunction_name
oleaut32.dllSysFreeString
oleaut32.dllSysReAllocStringLen
oleaut32.dllSysAllocStringLen
advapi32.dllRegQueryValueExA
advapi32.dllRegOpenKeyExA
advapi32.dllRegCloseKey
user32.dllGetKeyboardType
user32.dllDestroyWindow
user32.dllLoadStringA
user32.dllMessageBoxA
user32.dllCharNextA
kernel32.dllGetACP
kernel32.dllSleep
kernel32.dllVirtualFree
kernel32.dllVirtualAlloc
kernel32.dllGetTickCount
kernel32.dllQueryPerformanceCounter
kernel32.dllGetCurrentThreadId
kernel32.dllInterlockedDecrement
kernel32.dllInterlockedIncrement
kernel32.dllVirtualQuery
kernel32.dllWideCharToMultiByte
kernel32.dllMultiByteToWideChar
kernel32.dlllstrlenA
kernel32.dlllstrcpynA
kernel32.dllLoadLibraryExA
kernel32.dllGetThreadLocale
kernel32.dllGetStartupInfoA
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetCommandLineA
kernel32.dllFreeLibrary
kernel32.dllFindFirstFileA
kernel32.dllFindClose
kernel32.dllExitProcess
kernel32.dllExitThread
kernel32.dllCompareStringA
kernel32.dllWriteFile
kernel32.dllUnhandledExceptionFilter
kernel32.dllRtlUnwind
kernel32.dllRaiseException
kernel32.dllGetStdHandle
kernel32.dllTlsSetValue
kernel32.dllTlsGetValue
kernel32.dllLocalAlloc
kernel32.dllGetModuleHandleA
user32.dllCreateWindowExW
user32.dllCreateWindowExA
user32.dllWindowFromPoint
user32.dllWaitMessage
user32.dllUpdateWindow
user32.dllUnregisterClassW
user32.dllUnregisterClassA
user32.dllUnhookWindowsHookEx
user32.dllTranslateMessage
user32.dllTranslateMDISysAccel
user32.dllTrackPopupMenu
user32.dllSystemParametersInfoA
user32.dllShowWindow
user32.dllShowScrollBar
user32.dllShowOwnedPopups
user32.dllSetWindowsHookExW
user32.dllSetWindowsHookExA
user32.dllSetWindowTextW
user32.dllSetWindowTextA
user32.dllSetWindowPos
user32.dllSetWindowPlacement
user32.dllSetWindowLongW
user32.dllSetWindowLongA
user32.dllSetTimer
user32.dllSetScrollRange
user32.dllSetScrollPos
user32.dllSetScrollInfo
user32.dllSetRect
user32.dllSetPropA
user32.dllSetParent
user32.dllSetMenuItemInfoW
user32.dllSetMenuItemInfoA
user32.dllSetMenu
user32.dllSetForegroundWindow
user32.dllSetFocus
user32.dllSetCursor
user32.dllSetClassLongA
user32.dllSetCapture
user32.dllSetActiveWindow
user32.dllSendMessageW
user32.dllSendMessageA
user32.dllScrollWindow
user32.dllScreenToClient
user32.dllRemovePropA
user32.dllRemoveMenu
user32.dllReleaseDC
user32.dllReleaseCapture
user32.dllRegisterWindowMessageA
user32.dllRegisterClipboardFormatA
user32.dllRegisterClassW
user32.dllRegisterClassA
user32.dllRedrawWindow
user32.dllPtInRect
user32.dllPostQuitMessage
user32.dllPostMessageW
user32.dllPostMessageA
user32.dllPeekMessageW
user32.dllPeekMessageA
user32.dllOpenDesktopA
user32.dllOffsetRect
user32.dllOemToCharA
user32.dllMessageBoxA
user32.dllMapWindowPoints
user32.dllMapVirtualKeyW
user32.dllMapVirtualKeyA
user32.dllLoadStringA
user32.dllLoadKeyboardLayoutA
user32.dllLoadIconA
user32.dllLoadCursorA
user32.dllLoadBitmapA
user32.dllKillTimer
user32.dllIsZoomed
user32.dllIsWindowVisible
user32.dllIsWindowUnicode
user32.dllIsWindowEnabled
user32.dllIsWindow
user32.dllIsRectEmpty
user32.dllIsIconic
user32.dllIsDialogMessageW
user32.dllIsDialogMessageA
user32.dllIsChild
user32.dllInvalidateRect
user32.dllIntersectRect
user32.dllInsertMenuItemA
user32.dllInsertMenuA
user32.dllInflateRect
user32.dllGetWindowThreadProcessId
user32.dllGetWindowTextLengthW
user32.dllGetWindowTextW
user32.dllGetWindowTextA
user32.dllGetWindowRect
user32.dllGetWindowPlacement
user32.dllGetWindowLongW
user32.dllGetWindowLongA
user32.dllGetWindowDC
user32.dllGetTopWindow
user32.dllGetSystemMetrics
user32.dllGetSystemMenu
user32.dllGetSysColorBrush
user32.dllGetSysColor
user32.dllGetSubMenu
user32.dllGetScrollRange
user32.dllGetScrollPos
user32.dllGetScrollInfo
user32.dllGetPropA
user32.dllGetParent
user32.dllGetWindow
user32.dllGetMessageTime
user32.dllGetMessagePos
user32.dllGetMenuStringW
user32.dllGetMenuStringA
user32.dllGetMenuState
user32.dllGetMenuItemInfoW
user32.dllGetMenuItemInfoA
user32.dllGetMenuItemID
user32.dllGetMenuItemCount
user32.dllGetMenu
user32.dllGetLastActivePopup
user32.dllGetKeyboardState
user32.dllGetKeyboardLayoutNameA
user32.dllGetKeyboardLayoutList
user32.dllGetKeyboardLayout
user32.dllGetKeyState
user32.dllGetKeyNameTextW
user32.dllGetKeyNameTextA
user32.dllGetIconInfo
user32.dllGetForegroundWindow
user32.dllGetFocus
user32.dllGetDesktopWindow
user32.dllGetDCEx
user32.dllGetDC
user32.dllGetCursorPos
user32.dllGetCursor
user32.dllGetClipboardData
user32.dllGetClientRect
user32.dllGetClassNameW
user32.dllGetClassNameA
user32.dllGetClassLongA
user32.dllGetClassInfoW
user32.dllGetClassInfoA
user32.dllGetCapture
user32.dllGetActiveWindow
user32.dllFrameRect
user32.dllFindWindowA
user32.dllFillRect
user32.dllEqualRect
user32.dllEnumWindows
user32.dllEnumThreadWindows
user32.dllEnumDesktopWindows
user32.dllEnumChildWindows
user32.dllEndPaint
user32.dllEnableWindow
user32.dllEnableScrollBar
user32.dllEnableMenuItem
user32.dllDrawTextW
user32.dllDrawTextA
user32.dllDrawMenuBar
user32.dllDrawIconEx
user32.dllDrawIcon
user32.dllDrawFrameControl
user32.dllDrawFocusRect
user32.dllDrawEdge
user32.dllDispatchMessageW
user32.dllDispatchMessageA
user32.dllDestroyWindow
user32.dllDestroyMenu
user32.dllDestroyIcon
user32.dllDestroyCursor
user32.dllDeleteMenu
user32.dllDefWindowProcW
user32.dllDefWindowProcA
user32.dllDefMDIChildProcA
user32.dllDefFrameProcA
user32.dllCreatePopupMenu
user32.dllCreateMenu
user32.dllCreateIcon
user32.dllCloseDesktop
user32.dllClientToScreen
user32.dllChildWindowFromPoint
user32.dllCheckMenuItem
user32.dllCharUpperBuffW
user32.dllCharNextW
user32.dllCharLowerBuffW
user32.dllCallWindowProcW
user32.dllCallWindowProcA
user32.dllCallNextHookEx
user32.dllBeginPaint
user32.dllCharNextA
user32.dllCharLowerBuffA
user32.dllCharLowerA
user32.dllCharUpperBuffA
user32.dllCharToOemA
user32.dllAdjustWindowRectEx
user32.dllActivateKeyboardLayout
msimg32.dllGradientFill
gdi32.dllUnrealizeObject
gdi32.dllStretchDIBits
gdi32.dllStretchBlt
gdi32.dllSetWindowOrgEx
gdi32.dllSetWinMetaFileBits
gdi32.dllSetViewportOrgEx
gdi32.dllSetTextColor
gdi32.dllSetStretchBltMode
gdi32.dllSetROP2
gdi32.dllSetPixel
gdi32.dllSetPaletteEntries
gdi32.dllSetMapMode
gdi32.dllSetEnhMetaFileBits
gdi32.dllSetDIBColorTable
gdi32.dllSetBrushOrgEx
gdi32.dllSetBkMode
gdi32.dllSetBkColor
gdi32.dllSelectPalette
gdi32.dllSelectObject
gdi32.dllSaveDC
gdi32.dllRestoreDC
gdi32.dllResizePalette
gdi32.dllRectangle
gdi32.dllRectVisible
gdi32.dllRealizePalette
gdi32.dllPlayEnhMetaFile
gdi32.dllPatBlt
gdi32.dllMoveToEx
gdi32.dllMaskBlt
gdi32.dllLineTo
gdi32.dllLPtoDP
gdi32.dllIntersectClipRect
gdi32.dllGetWindowOrgEx
gdi32.dllGetWinMetaFileBits
gdi32.dllGetTextMetricsA
gdi32.dllGetTextExtentPoint32W
gdi32.dllGetTextExtentPoint32A
gdi32.dllGetSystemPaletteEntries
gdi32.dllGetStockObject
gdi32.dllGetRgnBox
gdi32.dllGetPixel
gdi32.dllGetPaletteEntries
gdi32.dllGetObjectA
gdi32.dllGetNearestPaletteIndex
gdi32.dllGetEnhMetaFilePaletteEntries
gdi32.dllGetEnhMetaFileHeader
gdi32.dllGetEnhMetaFileDescriptionA
gdi32.dllGetEnhMetaFileBits
gdi32.dllGetDeviceCaps
gdi32.dllGetDIBits
gdi32.dllGetDIBColorTable
gdi32.dllGetDCOrgEx
gdi32.dllGetCurrentPositionEx
gdi32.dllGetClipBox
gdi32.dllGetBrushOrgEx
gdi32.dllGetBitmapBits
gdi32.dllExtTextOutA
gdi32.dllExcludeClipRect
gdi32.dllDeleteObject
gdi32.dllDeleteEnhMetaFile
gdi32.dllDeleteDC
gdi32.dllCreateSolidBrush
gdi32.dllCreatePenIndirect
gdi32.dllCreatePalette
gdi32.dllCreateHalftonePalette
gdi32.dllCreateFontIndirectA
gdi32.dllCreateEnhMetaFileA
gdi32.dllCreateDIBitmap
gdi32.dllCreateDIBSection
gdi32.dllCreateCompatibleDC
gdi32.dllCreateCompatibleBitmap
gdi32.dllCreateBrushIndirect
gdi32.dllCreateBitmap
gdi32.dllCopyEnhMetaFileA
gdi32.dllCloseEnhMetaFile
gdi32.dllBitBlt
version.dllVerQueryValueA
version.dllGetFileVersionInfoSizeA
version.dllGetFileVersionInfoA
kernel32.dlllstrcpyA
kernel32.dlllstrcmpA
kernel32.dllWriteFile
kernel32.dllWaitForSingleObject
kernel32.dllVirtualQuery
kernel32.dllVirtualProtect
kernel32.dllVirtualAlloc
kernel32.dllSizeofResource
kernel32.dllSetThreadLocale
kernel32.dllSetLastError
kernel32.dllSetFilePointer
kernel32.dllSetEvent
kernel32.dllSetErrorMode
kernel32.dllSetEndOfFile
kernel32.dllResetEvent
kernel32.dllReleaseMutex
kernel32.dllReadFile
kernel32.dllOpenProcess
kernel32.dllMultiByteToWideChar
kernel32.dllMulDiv
kernel32.dllLockResource
kernel32.dllLoadResource
kernel32.dllLoadLibraryA
kernel32.dllLeaveCriticalSection
kernel32.dllInitializeCriticalSection
kernel32.dllHeapFree
kernel32.dllHeapAlloc
kernel32.dllGlobalUnlock
kernel32.dllGlobalSize
kernel32.dllGlobalLock
kernel32.dllGlobalFree
kernel32.dllGlobalFindAtomA
kernel32.dllGlobalDeleteAtom
kernel32.dllGlobalAlloc
kernel32.dllGlobalAddAtomW
kernel32.dllGlobalAddAtomA
kernel32.dllGetVersionExA
kernel32.dllGetVersion
kernel32.dllGetUserDefaultLCID
kernel32.dllGetTickCount
kernel32.dllGetThreadLocale
kernel32.dllGetSystemDirectoryA
kernel32.dllGetStdHandle
kernel32.dllGetProcessHeap
kernel32.dllGetProcAddress
kernel32.dllGetModuleHandleA
kernel32.dllGetModuleFileNameA
kernel32.dllGetLocaleInfoA
kernel32.dllGetLocalTime
kernel32.dllGetLastError
kernel32.dllGetFullPathNameA
kernel32.dllGetFileAttributesA
kernel32.dllGetDiskFreeSpaceA
kernel32.dllGetDateFormatA
kernel32.dllGetCurrentThreadId
kernel32.dllGetCurrentThread
kernel32.dllGetCurrentProcessId
kernel32.dllGetCurrentProcess
kernel32.dllGetComputerNameA
kernel32.dllGetCPInfo
kernel32.dllGetACP
kernel32.dllFreeResource
kernel32.dllInterlockedExchange
kernel32.dllFreeLibrary
kernel32.dllFormatMessageA
kernel32.dllFindResourceA
kernel32.dllFindFirstFileA
kernel32.dllFindClose
kernel32.dllEnumCalendarInfoA
kernel32.dllEnterCriticalSection
kernel32.dllDeleteCriticalSection
kernel32.dllCreateThread
kernel32.dllCreateFileA
kernel32.dllCreateEventA
kernel32.dllCompareStringW
kernel32.dllCompareStringA
kernel32.dllCloseHandle
advapi32.dllRegQueryValueExA
advapi32.dllRegQueryInfoKeyA
advapi32.dllRegOpenKeyExA
advapi32.dllRegFlushKey
advapi32.dllRegEnumValueA
advapi32.dllRegCloseKey
advapi32.dllOpenThreadToken
advapi32.dllOpenProcessToken
advapi32.dllIsValidSid
advapi32.dllGetTokenInformation
advapi32.dllGetSidSubAuthorityCount
advapi32.dllGetSidSubAuthority
advapi32.dllGetSidIdentifierAuthority
oleaut32.dllGetErrorInfo
oleaut32.dllGetActiveObject
oleaut32.dllSysFreeString
ole32.dllCreateStreamOnHGlobal
ole32.dllIsAccelerator
ole32.dllOleDraw
ole32.dllOleSetMenuDescriptor
ole32.dllCoTaskMemFree
ole32.dllCoTaskMemAlloc
ole32.dllProgIDFromCLSID
ole32.dllStringFromCLSID
ole32.dllCoCreateInstance
ole32.dllCoGetClassObject
ole32.dllCoUninitialize
ole32.dllCoInitializeEx
ole32.dllCoInitialize
ole32.dllIsEqualGUID
kernel32.dllSleep
oleaut32.dllSafeArrayPtrOfIndex
oleaut32.dllSafeArrayGetUBound
oleaut32.dllSafeArrayGetLBound
oleaut32.dllSafeArrayCreate
oleaut32.dllVariantChangeType
oleaut32.dllVariantCopy
oleaut32.dllVariantClear
oleaut32.dllVariantInit
comctl32.dll_TrackMouseEvent
comctl32.dllImageList_SetIconSize
comctl32.dllImageList_GetIconSize
comctl32.dllImageList_Write
comctl32.dllImageList_Read
comctl32.dllImageList_GetDragImage
comctl32.dllImageList_DragShowNolock
comctl32.dllImageList_DragMove
comctl32.dllImageList_DragLeave
comctl32.dllImageList_DragEnter
comctl32.dllImageList_EndDrag
comctl32.dllImageList_BeginDrag
comctl32.dllImageList_Remove
comctl32.dllImageList_DrawEx
comctl32.dllImageList_Replace
comctl32.dllImageList_Draw
comctl32.dllImageList_GetBkColor
comctl32.dllImageList_SetBkColor
comctl32.dllImageList_Add
comctl32.dllImageList_SetImageCount
comctl32.dllImageList_GetImageCount
comctl32.dllImageList_Destroy
comctl32.dllImageList_Create
comctl32.dllInitCommonControls
shell32.dllShellExecuteA

StringTable 040904E4

CompanyNameAgileBits
InternalName1Password
ProductName1Password
ProductVersion4.0.1.503
FileDescription1Password
FileVersion4.0.1.503
LegalCopyrightCopyright © AgileBits
LegalTrademarksAll brand names and product names are trademarks or registered trademarks of their respective owners.

VS_FIXEDFILEINFO

FileVersion4.0.1.503
ProductVersion4.0.1.503
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0

Signers (1)

issuer: /C=GB/ST=Greater Manchester/L=Salford/O=COMODO CA Limited/CN=COMODO Code Signing CA 2
serial: 0BD569BE4F0D9C932E44FB2FC9CEDEA7

Certificates (1)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0b:d5:69:be:4f:0d:9c:93:2e:44:fb:2f:c9:ce:de:a7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Code Signing CA 2
        Validity
            Not Before: May 17 00:00:00 2013 GMT
            Not After : May 16 23:59:59 2016 GMT
        Subject: C=CA/postalCode=M5E1W7, ST=Ontario, L=Toronto/street=1 Yonge Street Suite 1801, O=AgileBits Inc., CN=AgileBits Inc.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:c2:3b:79:b9:cd:f7:82:ba:6d:44:ec:b0:20:12:
                    92:1e:38:c8:0e:30:97:c1:aa:9b:f1:ee:19:f7:a0:
                    8a:87:38:4f:01:a8:fb:8b:63:f5:41:7c:0f:50:36:
                    ef:ad:3b:14:ae:5d:5e:9b:17:54:7c:be:79:23:7c:
                    4b:a6:70:b0:a1:8b:51:70:4e:67:3a:1c:af:df:73:
                    b0:ea:2e:54:c6:80:46:c4:77:c6:5b:ea:91:c9:9b:
                    03:89:da:f8:b7:ca:cb:0a:6d:d7:c8:b2:9b:b9:c8:
                    35:b1:9d:cb:9c:f4:d7:3f:1a:3e:55:d1:3f:24:6e:
                    3f:d7:13:2d:19:bc:0d:fe:fa:ea:1c:bd:91:82:3a:
                    1f:9a:2c:f3:52:56:b6:e6:e9:ea:86:08:83:af:45:
                    52:bf:ab:30:e6:ff:53:d0:46:51:a2:65:e4:25:c5:
                    8a:9a:7b:12:6a:97:a3:c4:54:48:22:ab:3f:74:f7:
                    8c:8b:ec:0a:b5:67:a5:73:8c:f2:9f:34:59:b4:ed:
                    4a:b6:79:b5:53:c3:a1:11:38:10:d0:26:ae:9d:34:
                    3d:d0:16:cc:0e:9c:69:26:68:53:a1:ac:b6:c8:1e:
                    cc:4b:06:07:76:ea:c6:ab:c2:e6:4f:88:be:74:fb:
                    ad:9f:2a:81:d0:25:c1:2d:39:8a:34:bc:f6:af:a8:
                    79:7b
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier: 
                1E:C5:B1:2C:7D:87:DA:02:68:7C:25:BC:0C:07:84:3F:B6:CF:DE:F1
            X509v3 Subject Key Identifier: 
                28:1D:C5:4F:44:EB:F5:F9:50:5C:0D:F1:8A:00:1E:7D:B4:DB:D4:8B
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Extended Key Usage: 
                Code Signing
            Netscape Cert Type: 
                Object Signing
            X509v3 Certificate Policies: 
                Policy: 1.3.6.1.4.1.6449.1.2.1.3.2
                  CPS: https://secure.comodo.net/CPS
            X509v3 CRL Distribution Points: 
                Full Name:
                  URI:http://crl.comodoca.com/COMODOCodeSigningCA2.crl
            Authority Information Access: 
                CA Issuers - URI:http://crt.comodoca.com/COMODOCodeSigningCA2.crt
                OCSP - URI:http://ocsp.comodoca.com
            X509v3 Subject Alternative Name: 
                email:admin@agilebits.com
    Signature Algorithm: sha1WithRSAEncryption
    Signature Value:
        7c:fe:26:65:78:18:7e:d6:b3:b8:c5:59:5f:66:42:f7:a8:19:
        43:47:e9:d1:fa:fc:53:c6:61:d9:cb:22:66:db:f2:52:cd:33:
        6b:e1:d4:01:eb:2b:8a:b9:f1:b5:fc:6f:88:2d:fc:6e:b2:65:
        6e:d9:f5:18:fb:55:45:44:52:54:a6:89:8d:b9:fd:9a:94:76:
        a5:c4:35:67:2d:0d:ee:8d:e6:3e:b7:c7:0d:f0:be:3c:02:b6:
        7d:24:a6:1e:f3:75:0d:b7:e3:3c:21:cf:ba:3e:f9:9a:26:62:
        09:9b:bb:d8:77:c7:71:05:e2:7e:be:8a:f4:44:f4:b7:df:4b:
        a0:60:a5:aa:2d:ea:57:6f:76:56:a4:02:32:a3:df:2e:0b:d4:
        7c:25:88:af:03:cd:19:a0:30:8e:20:69:6a:4e:fb:cb:c6:a9:
        8d:91:a8:74:0b:8b:35:7e:99:ac:8c:c5:fc:a8:7d:37:99:28:
        0b:c6:7b:ff:bc:1e:3f:fb:ce:c9:09:c8:8e:b7:89:9b:24:0e:
        4c:51:49:55:56:8b:35:f5:85:c9:59:72:6f:34:df:5d:39:b4:
        d8:56:e6:86:c4:67:df:33:e5:69:a3:c6:d9:bd:32:31:79:fe:
        ed:8d:0b:20:83:9d:7d:29:10:8f:bd:df:d0:ee:a8:e9:74:f0:
        5b:4c:24:b8
pkcs7-signedData
  • 1
    • MD5: nil
    • 1.3.6.1.4.1.311.2.1.4
      • #0
        • 1.3.6.1.4.1.311.2.1.15
          • :
        • MD5
          • d8 26 65 b8 2c 2b 10 9f  bc 15 a9 d1 2a 90 7b 92  |.&e.,+......*.{.|
    • Certificate #2
      • 2
        • 0B:D5:69:BE:4F:0D:9C:93:2E:44:FB:2F:C9:CE:DE:A7
        • RSA-SHA1: nil
        • Issuer
          • C: GB
          • ST: Greater Manchester
          • L: Salford
          • O: COMODO CA Limited
          • CN: COMODO Code Signing CA 2
        • 2013-05-17 00:00:00 UTC: 2016-05-16 23:59:59 UTC
        • Subject
          • C: CA
          • postalCode: M5E1W7
          • ST: Ontario
          • L: Toronto
          • street: 1 Yonge Street Suite 1801
          • O: AgileBits Inc.
          • CN: AgileBits Inc.
        • #5
          • rsaEncryption: nil
          • C2:3B:79:B9:CD:F7:82:BA:6D:44:EC:B0:20:12:92:1E:
            38:C8:0E:30:97:C1:AA:9B:F1:EE:19:F7:A0:8A:87:38:
            4F:01:A8:FB:8B:63:F5:41:7C:0F:50:36:EF:AD:3B:14:
            AE:5D:5E:9B:17:54:7C:BE:79:23:7C:4B:A6:70:B0:A1:
            8B:51:70:4E:67:3A:1C:AF:DF:73:B0:EA:2E:54:C6:80:
            46:C4:77:C6:5B:EA:91:C9:9B:03:89:DA:F8:B7:CA:CB:
            0A:6D:D7:C8:B2:9B:B9:C8:35:B1:9D:CB:9C:F4:D7:3F:
            1A:3E:55:D1:3F:24:6E:3F:D7:13:2D:19:BC:0D:FE:FA:
            EA:1C:BD:91:82:3A:1F:9A:2C:F3:52:56:B6:E6:E9:EA:
            86:08:83:AF:45:52:BF:AB:30:E6:FF:53:D0:46:51:A2:
            65:E4:25:C5:8A:9A:7B:12:6A:97:A3:C4:54:48:22:AB:
            3F:74:F7:8C:8B:EC:0A:B5:67:A5:73:8C:F2:9F:34:59:
            B4:ED:4A:B6:79:B5:53:C3:A1:11:38:10:D0:26:AE:9D:
            34:3D:D0:16:CC:0E:9C:69:26:68:53:A1:AC:B6:C8:1E:
            CC:4B:06:07:76:EA:C6:AB:C2:E6:4F:88:BE:74:FB:AD:
            9F:2A:81:D0:25:C1:2D:39:8A:34:BC:F6:AF:A8:79:7B            : 0x010001
        • #6
          • authorityKeyIdentifier: 
            1e c5 b1 2c 7d 87 da 02  68 7c 25 bc 0c 07 84 3f  |...,}...h|%....?|
b6 cf de f1                                       |....            |
          • subjectKeyIdentifier: 
            28 1d c5 4f 44 eb f5 f9  50 5c 0d f1 8a 00 1e 7d  |(..OD...P\.....}|
b4 db d4 8b                                       |....            |
          • keyUsage: true, 0x80
          • basicConstraints
            • true
            • nil
          • extendedKeyUsage: codeSigning
          • nsCertType: 0x10
          • certificatePolicies
            • 1.3.6.1.4.1.6449.1.2.1.3.2
              • id-qt-cps: https://secure.comodo.net/CPS
          • crlDistributionPoints: http://crl.comodoca.com/COMODOCodeSigningCA2.crl
          • authorityInfoAccess
            • #0
              • caIssuers: http://crt.comodoca.com/COMODOCodeSigningCA2.crt
              • OCSP: http://ocsp.comodoca.com
          • subjectAltName: admin@agilebits.com
      • RSA-SHA1: 
        7c fe 26 65 78 18 7e d6  b3 b8 c5 59 5f 66 42 f7  ||.&ex.~....Y_fB.|
a8 19 43 47 e9 d1 fa fc  53 c6 61 d9 cb 22 66 db  |..CG....S.a.."f.|
f2 52 cd 33 6b e1 d4 01  eb 2b 8a b9 f1 b5 fc 6f  |.R.3k....+.....o|
88 2d fc 6e b2 65 6e d9  f5 18 fb 55 45 44 52 54  |.-.n.en....UEDRT|
a6 89 8d b9 fd 9a 94 76  a5 c4 35 67 2d 0d ee 8d  |.......v..5g-...|
e6 3e b7 c7 0d f0 be 3c  02 b6 7d 24 a6 1e f3 75  |.>.....<..}$...u|
0d b7 e3 3c 21 cf ba 3e  f9 9a 26 62 09 9b bb d8  |.....&b....|
77 c7 71 05 e2 7e be 8a  f4 44 f4 b7 df 4b a0 60  |w.q..~...D...K.`|
a5 aa 2d ea 57 6f 76 56  a4 02 32 a3 df 2e 0b d4  |..-.WovV..2.....|
7c 25 88 af 03 cd 19 a0  30 8e 20 69 6a 4e fb cb  ||%......0. ijN..|
c6 a9 8d 91 a8 74 0b 8b  35 7e 99 ac 8c c5 fc a8  |.....t..5~......|
7d 37 99 28 0b c6 7b ff  bc 1e 3f fb ce c9 09 c8  |}7.(..{...?.....|
8e b7 89 9b 24 0e 4c 51  49 55 56 8b 35 f5 85 c9  |....$.LQIUV.5...|
59 72 6f 34 df 5d 39 b4  d8 56 e6 86 c4 67 df 33  |Yro4.]9..V...g.3|
e5 69 a3 c6 d9 bd 32 31  79 fe ed 8d 0b 20 83 9d  |.i....21y.... ..|
7d 29 10 8f bd df d0 ee  a8 e9 74 f0 5b 4c 24 b8  |})........t.[L$.|
    • Signer
      • 1
      • unnamed
        • #0
          • C: GB
          • ST: Greater Manchester
          • L: Salford
          • O: COMODO CA Limited
          • CN: COMODO Code Signing CA 2
        • 0B:D5:69:BE:4F:0D:9C:93:2E:44:FB:2F:C9:CE:DE:A7
      • MD5: nil
      • #3
        • contentType: 1.3.6.1.4.1.311.2.1.4
        • 1.3.6.1.4.1.311.2.1.11: msCodeInd
        • messageDigest: 
          fe f8 2e fb a2 bd b9 d1  1c 9d 5d 88 1c e8 ca 5e  |..........]....^|
        • 1.3.6.1.4.1.311.2.1.12
          • 00 31 00 50 00 61 00 73  00 73 00 77 00 6f 00 72  |.1.P.a.s.s.w.o.r|
00 64                                             |.d              |
            : http://agilebits.com
      • rsaEncryption: 
        73 7c c8 f3 56 2a dd f6  fa 3f 18 dc 0c 3c 61 b2  |s|..V*...?...
offsetsizetypecomment
0940544EXE07/10/2014 08:43:12#
15c115HTM#
b42b473572PNG(256 x 256)#
e26808503PNG(87 x 91)#
e5a002096PKCS7Authenticode Signature#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











[?] ignoring invalid PEdump::BITMAPINFOHEADER