MapleStory.exe

info
MZ
PE
resources
imports
exports
foremost
version info
signature
hexdump
disasm
log
discuss
donate

filename	MapleStory.exe
size	6983856 (0x6a90b0)
md5	fb5d9c17696e354edfb5250153c03106

type	PE32 executable (GUI) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x130

Rich Header

lib id	version	times used
96	4035	1
93	4035	2
95	4035	1
150	20413	3
149	30729	55
131	30729	173
10	9782	1
109	50727	5
132	21022	9
93	6030	4
11	9782	17
4	8447	6
123	50727	31
1	0	301
132	30729	487
146	30729	1
148	21022	1
145	30729	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	7
TimeDateStamp	0x502e261a
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	9.0
SizeOfCode	0xaca400
SizeOfInitializedData	0x27e800
SizeOfUninitializedData	0
AddressOfEntryPoint	0x10bf000
BaseOfCode	0x1000
BaseOfData	0xacc000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.0
ImageVersion	0.0
SubsystemVersion	5.0
Reserved1	0
SizeOfImage	0x10c1000
SizeOfHeaders	0x400
CheckSum	0x6ae36c
Subsystem	2
DllCharacteristics	0x8000
SizeOfStackReserve	0x200000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Sections

name	va	vsize	raw size	flags
	0x1000	0xd3a000	0x4dd200	RWX IDATA
.rsrc	0xd3b000	0x2d9d8	0xe600	RW- IDATA
.idata	0xd69000	0x1000	0x200	RW- IDATA
	0xd6a000	0x1dc000	0x200	RWX IDATA
vjloviex	0xf46000	0x179000	0x178e00	RWX IDATA
xzaohdyp	0x10bf000	0x1000	0x200	RWX IDATA
iuvwcszg	0x10c0000	0x1000	0x1000	RWX IDATA

Data Directory

type	va	size
EXPORT	0x10bd9b4	0x8f
IMPORT	0xd69041	0x55
RESOURCE	0xd3b000	0x2d9d8
EXCEPTION	0	0
SECURITY	0x6a7948	0x1768
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
BITMAP	#124	45252	1252
BITMAP	#125	45252	1252
BITMAP	#126	45252	1252
BITMAP	#127	45252	1252
ICON	#1	2216	1252
ICON	#2	1384	1252
DIALOG	#109	92	1252
DIALOG	#115	142	1252
DIALOG	#131	148	1252
GROUP_ICON	#101	34	1252
VERSION	#1	720	1252
MANIFEST	#1	356	1252

module_name	hint	ord	function_name
kernel32.dll			WriteConsoleA

ord	entry_va	function_name
1	0x8dfca0	ZtlTaskMemAllocImp
2	0x8dfcb0	ZtlTaskMemFreeImp
3	0x8dfcc0	ZtlTaskMemReallocImp

module_name	MapleStory.exe
flags	0
timestamp	2012-08-17 11:08:09
version	0.0
ordinal_base	1
nFunctions	3
nNames	3
Names(3)	0x10bd9e8
Functions(3)	0x10bd9dc
NameOrdinals(3)	0x10bd9f4

VS_FIXEDFILEINFO

dwSignature	0xfeef
FileVersion	104.1.0.0
ProductVersion	104.1.63.0
StrucVersion	1
FileFlagsMask	0
FileFlags	0x40000
FileOS	0x10004
FileType	0
FileSubtype	0

OpenSSL (terse)
ASN.1 (verbose)

Signers (1)

issuer: /C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=Terms of use at https://www.verisign.com/rpa (c)10/CN=VeriSign Class 3 Code Signing 2010 CA

serial: 6460F548469C3CAC5442912562585811

Certificates (4)

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Validity
            Not Before: May  1 00:00:00 2012 GMT
            Not After : Dec 31 23:59:59 2012 GMT
        Subject: C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer - G3
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (1024 bit)
                Modulus:
                    00:a9:59:66:74:da:3d:8a:7d:7a:d8:fc:f5:80:44:
                    7b:fe:47:6a:14:55:4e:50:47:0b:ec:d3:ed:ce:f6:
                    38:f7:4f:69:b9:b1:f0:b6:78:82:0a:8c:76:16:67:
                    e2:02:ad:b7:0d:a5:8a:f6:03:fc:66:d3:fc:08:2d:
                    cc:b5:73:59:7b:89:dc:33:6e:66:5a:5e:52:37:b4:
                    62:d1:92:59:35:14:8b:45:ac:59:b2:4d:24:a2:98:
                    94:68:42:72:9f:3a:68:e2:6b:8b:9e:22:2d:f4:98:
                    4e:9a:c6:af:b3:e4:a0:ab:3c:28:bf:23:e1:d7:72:
                    a4:f2:10:53:67:ae:77:af:51
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/tss-ca.crl

            X509v3 Extended Key Usage: critical
                Time Stamping
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA1-3
            X509v3 Subject Key Identifier: 
                B4:B7:F1:89:49:26:60:E7:65:EA:73:AE:DC:D3:38:CD:BF:57:92:6F
    Signature Algorithm: sha1WithRSAEncryption
         1e:98:aa:27:b7:78:b5:08:b5:c9:72:6d:b7:df:c0:0e:98:a6:
         35:c4:88:c9:d2:f6:6d:f1:4b:1a:fb:d5:f9:2d:99:00:9e:d1:
         e7:9b:8b:e1:3f:bd:39:80:0c:66:cd:07:bc:5c:98:54:a6:94:
         ba:10:d1:4e:8b:ab:f5:6f:65:cc:67:09:a2:80:7c:52:e8:0e:
         03:d6:6b:7a:c6:05:18:ec:c8:ac:42:7c:07:2c:a7:3d:08:66:
         dc:00:ed:fd:94:1d:73:f2:72:98:93:b1:11:d6:8f:ef:8e:ea:
         ac:f4:96:51:0c:d0:8d:df:31:52:4f:5e:af:7d:a7:4a:75:e6:
         4e:ce:2b:9f:29:2b:e7:cf:5d:9f:03:7e:6e:27:7b:23:ad:62:
         29:66:af:92:e8:2c:ce:bd:9c:7f:dc:cd:17:3c:43:c2:09:3f:
         75:45:c7:9e:e4:d7:60:7f:97:c6:e4:aa:c7:69:f5:fc:cd:74:
         ac:2c:b0:48:c1:50:4e:70:56:1e:b5:35:d3:8e:be:b1:ed:ac:
         bd:fe:0c:ec:85:7d:d5:bb:85:66:44:19:5d:9f:93:eb:82:ba:
         63:9e:d3:7c:61:ff:c8:1b:d9:23:58:7f:30:a3:66:a1:39:26:
         5e:92:c3:3c:cb:37:32:fa:f5:a3:8d:dc:d5:b0:a3:e9:25:36:
         55:d7:81:fa

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=ZA, ST=Western Cape, L=Durbanville, O=Thawte, OU=Thawte Certification, CN=Thawte Timestamping CA
        Validity
            Not Before: Dec  4 00:00:00 2003 GMT
            Not After : Dec  3 23:59:59 2013 GMT
        Subject: C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a9:ca:b2:a4:cc:cd:20:af:0a:7d:89:ac:87:75:
                    f0:b4:4e:f1:df:c1:0f:bf:67:61:bd:a3:64:1c:da:
                    bb:f9:ca:33:ab:84:30:89:58:7e:8c:db:6b:dd:36:
                    9e:0f:bf:d1:ec:78:f2:77:a6:7e:6f:3c:bf:93:af:
                    0d:ba:68:f4:6c:94:ca:bd:52:2d:ab:48:3d:f5:b6:
                    d5:5d:5f:1b:02:9f:fa:2f:6b:1e:a4:f7:a3:9a:a6:
                    1a:c8:02:e1:7f:4c:52:e3:0e:60:ec:40:1c:7e:b9:
                    0d:de:3f:c7:b4:df:87:bd:5f:7a:6a:31:2e:03:99:
                    81:13:a8:47:20:ce:31:73:0d:57:2d:cd:78:34:33:
                    95:12:99:12:b9:de:68:2f:aa:e6:e3:c2:8a:8c:2a:
                    c3:8b:21:87:66:bd:83:58:57:6f:75:bf:3c:aa:26:
                    87:5d:ca:10:15:3c:9f:84:ea:54:c1:0a:6e:c4:fe:
                    c5:4a:dd:b9:07:11:97:22:7c:db:3e:27:d1:1e:78:
                    ec:9f:31:c9:f1:e6:22:19:db:c4:b3:47:43:9a:1a:
                    5f:a0:1e:90:e4:5e:f5:ee:7c:f1:7d:ab:62:01:8f:
                    f5:4d:0b:de:d0:22:56:a8:95:cd:ae:88:76:ae:ee:
                    ba:0d:f3:e4:4d:d9:a0:fb:68:a0:ae:14:3b:b3:87:
                    c1:bb
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/ThawteTimestampingCA.crl

            X509v3 Extended Key Usage: 
                Time Stamping
            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            X509v3 Subject Alternative Name: 
                DirName:/CN=TSA2048-1-53
    Signature Algorithm: sha1WithRSAEncryption
         4a:6b:f9:ea:58:c2:44:1c:31:89:79:99:2b:96:bf:82:ac:01:
         d6:1c:4c:cd:b0:8a:58:6e:df:08:29:a3:5e:c8:ca:93:13:e7:
         04:52:0d:ef:47:27:2f:00:38:b0:e4:c9:93:4e:9a:d4:22:62:
         15:f7:3f:37:21:4f:70:31:80:f1:8b:38:87:b3:e8:e8:97:00:
         fe:cf:55:96:4e:24:d2:a9:27:4e:7a:ae:b7:61:41:f3:2a:ce:
         e7:c9:d9:5e:dd:bb:2b:85:3e:b5:9d:b5:d9:e1:57:ff:be:b4:
         c5:7e:f5:cf:0c:9e:f0:97:fe:2b:d3:3b:52:1b:1b:38:27:f7:
         3f:4a

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            64:60:f5:48:46:9c:3c:ac:54:42:91:25:62:58:58:11
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Validity
            Not Before: Aug 10 00:00:00 2011 GMT
            Not After : Mar 26 23:59:59 2013 GMT
        Subject: C=KR, ST=Seoul, L=Gangnam, O=NEXON Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, CN=NEXON Corporation
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:a7:a2:26:d5:8e:23:b6:86:ac:e3:03:df:b5:bd:
                    35:57:7d:de:23:54:ba:c6:4b:43:45:a4:07:6f:e6:
                    f7:7d:9c:16:62:86:88:ed:54:34:3d:62:2c:29:b0:
                    92:fa:ed:05:37:95:da:96:06:7b:31:0d:2a:b6:8b:
                    01:f7:78:d5:5c:50:be:51:ae:b3:79:42:58:46:e2:
                    49:80:4d:f6:4b:58:c9:1b:cc:cd:64:82:c3:b8:39:
                    76:e0:fe:fa:de:a9:f4:14:79:a7:02:7a:d2:04:30:
                    56:fd:6a:7f:b8:de:63:9d:78:70:6a:94:49:56:d5:
                    54:5c:8e:1f:58:73:9b:9c:3f:b1:4f:74:38:b9:7c:
                    67:ad:8a:d9:4b:52:36:c2:9a:e3:52:bc:3f:5a:55:
                    f2:4d:1c:61:2c:a9:70:da:8f:05:da:31:0e:e5:a6:
                    2f:d1:60:7a:cf:29:29:8b:b5:94:29:e4:59:6d:1f:
                    4d:a2:13:20:19:be:69:38:c3:65:6c:8f:3c:8c:d9:
                    70:3b:01:6c:98:01:e8:e9:d1:99:4c:7a:b4:eb:d6:
                    25:98:92:ec:ef:a5:ec:5e:db:33:93:6a:ac:e5:43:
                    c6:38:9d:13:96:42:f5:77:48:ed:cd:3b:04:b7:ca:
                    68:5c:9f:1e:45:7f:ea:43:0b:f8:e7:b9:46:a4:97:
                    88:97
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: 
                CA:FALSE
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://csc3-2010-crl.verisign.com/CSC3-2010.crl

            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage: 
                Code Signing
            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers - URI:http://csc3-2010-aia.verisign.com/CSC3-2010.cer

            X509v3 Authority Key Identifier: 
                keyid:CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D

            Netscape Cert Type: 
                Object Signing
            1.3.6.1.4.1.311.2.1.27: 
                0.......
    Signature Algorithm: sha1WithRSAEncryption
         48:7d:8a:c0:92:e5:68:37:bd:e9:a9:c9:30:4d:15:8a:1a:30:
         ee:6d:43:3c:ff:7c:53:5b:85:22:d2:f4:65:f4:b3:31:f7:ff:
         83:1d:71:b6:8f:ff:e4:ad:6a:91:3e:c6:50:00:e9:4b:6f:c9:
         2c:6a:63:cf:7a:e4:55:0b:14:9b:12:a3:0f:ee:29:dd:70:ce:
         0e:d4:88:29:93:13:be:6e:ff:0b:4b:c5:b8:b4:67:75:42:c0:
         f9:7b:be:1f:21:e6:e9:2a:28:98:e6:39:c6:f5:41:9f:8e:55:
         5d:53:1b:9c:18:fe:39:9b:f5:86:de:1b:c1:70:5b:a7:c6:3d:
         df:8b:97:47:ee:66:98:ac:24:a9:e6:0e:61:85:4d:e9:c0:dd:
         91:be:20:93:d4:60:a1:14:7a:4f:1f:aa:26:59:9a:0f:8a:b4:
         4c:14:d1:d7:ca:35:08:d3:c1:4c:0c:66:65:c1:0c:11:95:80:
         ee:75:f2:74:25:a0:a3:ce:c6:51:0f:31:ad:f9:88:ce:b3:22:
         be:6f:53:ef:66:8f:dc:45:55:3e:14:74:fc:6a:8c:f8:b6:43:
         3d:af:0f:ab:61:a6:46:6c:52:02:96:1b:8b:a3:9c:7d:f0:73:
         c6:6b:86:b1:fb:0b:61:9f:57:3b:f0:17:17:2d:db:39:0c:4e:
         ac:4d:c2:e8

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority - G5
        Validity
            Not Before: Feb  8 00:00:00 2010 GMT
            Not After : Feb  7 23:59:59 2020 GMT
        Subject: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)
                Modulus:
                    00:f5:23:4b:5e:a5:d7:8a:bb:32:e9:d4:57:f7:ef:
                    e4:c7:26:7e:ad:19:98:fe:a8:9d:7d:94:f6:36:6b:
                    10:d7:75:81:30:7f:04:68:7f:cb:2b:75:1e:cd:1d:
                    08:8c:df:69:94:a7:37:a3:9c:7b:80:e0:99:e1:ee:
                    37:4d:5f:ce:3b:14:ee:86:d4:d0:f5:27:35:bc:25:
                    0b:38:a7:8c:63:9d:17:a3:08:a5:ab:b0:fb:cd:6a:
                    62:82:4c:d5:21:da:1b:d9:f1:e3:84:3b:8a:2a:4f:
                    85:5b:90:01:4f:c9:a7:76:10:7f:27:03:7c:be:ae:
                    7e:7d:c1:dd:f9:05:bc:1b:48:9c:69:e7:c0:a4:3c:
                    3c:41:00:3e:df:96:e5:c5:e4:94:71:d6:55:01:c7:
                    00:26:4a:40:3c:b5:a1:26:a9:0c:a7:6d:80:8e:90:
                    25:7b:cf:bf:3f:1c:eb:2f:96:fa:e5:87:77:c6:b5:
                    56:b2:7a:3b:54:30:53:1b:df:62:34:ff:1e:d1:f4:
                    5a:93:28:85:e5:4c:17:4e:7e:5b:fd:a4:93:99:7f:
                    df:cd:ef:a4:75:ef:ef:15:f6:47:e7:f8:19:72:d8:
                    2e:34:1a:a6:b4:a7:4c:7e:bd:bb:4f:0c:3d:57:f1:
                    30:d6:a6:36:8e:d6:80:76:d7:19:2e:a5:cd:7e:34:
                    2d:89
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints: critical
                CA:TRUE, pathlen:0
            X509v3 Certificate Policies: 
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/cps
                  User Notice:
                    Explicit Text: https://www.verisign.com/rpa

            X509v3 Key Usage: critical
                Certificate Sign, CRL Sign
            1.3.6.1.5.5.7.1.12: 
                0_.].[0Y0W0U..image/gif0!0.0...+..............k...j.H.,{..0%.#http://logo.verisign.com/vslogo.gif
            X509v3 CRL Distribution Points: 

                Full Name:
                  URI:http://crl.verisign.com/pca3-g5.crl

            Authority Information Access: 
                OCSP - URI:http://ocsp.verisign.com

            X509v3 Extended Key Usage: 
                TLS Web Client Authentication, Code Signing
            X509v3 Subject Alternative Name: 
                DirName:/CN=VeriSignMPKI-2-8
            X509v3 Subject Key Identifier: 
                CF:99:A9:EA:7B:26:F4:4B:C9:8E:8F:D7:F0:05:26:EF:E3:D2:A7:9D
            X509v3 Authority Key Identifier: 
                keyid:7F:D3:65:A7:C2:DD:EC:BB:F0:30:09:F3:43:39:FA:02:AF:33:31:33

    Signature Algorithm: sha1WithRSAEncryption
         56:22:e6:34:a4:c4:61:cb:48:b9:01:ad:56:a8:64:0f:d9:8c:
         91:c4:bb:cc:0c:e5:ad:7a:a0:22:7f:df:47:38:4a:2d:6c:d1:
         7f:71:1a:7c:ec:70:a9:b1:f0:4f:e4:0f:0c:53:fa:15:5e:fe:
         74:98:49:24:85:81:26:1c:91:14:47:b0:4c:63:8c:bb:a1:34:
         d4:c6:45:e8:0d:85:26:73:03:d0:a9:8c:64:6d:dc:71:92:e6:
         45:05:60:15:59:51:39:fc:58:14:6b:fe:d4:a4:ed:79:6b:08:
         0c:41:72:e7:37:22:06:09:be:23:e9:3f:44:9a:1e:e9:61:9d:
         cc:b1:90:5c:fc:3d:d2:8d:ac:42:3d:65:36:d4:b4:3d:40:28:
         8f:9b:10:cf:23:26:cc:4b:20:cb:90:1f:5d:8c:4c:34:ca:3c:
         d8:e5:37:d6:6f:a5:20:bd:34:eb:26:d9:ae:0d:e7:c5:9a:f7:
         a1:b4:21:91:33:6f:86:e8:58:bb:25:7c:74:0e:58:fe:75:1b:
         63:3f:ce:31:7c:9b:8f:1b:96:9e:c5:53:76:84:5b:9c:ad:91:
         fa:ac:ed:93:ba:5d:c8:21:53:c2:82:53:63:af:12:0d:50:87:
         11:1b:3d:54:52:96:8a:2c:9c:3d:92:1a:08:9a:05:2e:c7:93:
         a5:48:91:d3

pkcs7-signedData

SHA1: nil

1.3.6.1.4.1.311.2.1.4

1.3.6.1.4.1.311.2.1.15

00 3c 00 3c 00 3c 00 4f  00 62 00 73 00 6f 00 6c  |.<.<.<.O.b.s.o.l|
00 65 00 74 00 65 00 3e  00 3e 00 3e              |.e.t.e.>.>.>    |

SHA1

a4 64 49 3d af 34 60 4a 79 6b 83 66 64 41 66 25 |.dI=.4`Jyk.fdAf%| 45 7a 0c e4 |Ez.. |

Certificates
- Certificate #0
  - 2
    - 79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - CN: VeriSign Time Stamping Services CA
    - 2012-05-01 00:00:00 UTC: 2012-12-31 23:59:59 UTC
    - Subject
      - C: US
      - O: Symantec Corporation
      - CN: Symantec Time Stamping Services Signer - G3
    - #5
      - rsaEncryption: nil
      - A9:59:66:74:DA:3D:8A:7D:7A:D8:FC:F5:80:44:7B:FE:
        47:6A:14:55:4E:50:47:0B:EC:D3:ED:CE:F6:38:F7:4F:
        69:B9:B1:F0:B6:78:82:0A:8C:76:16:67:E2:02:AD:B7:
        0D:A5:8A:F6:03:FC:66:D3:FC:08:2D:CC:B5:73:59:7B:
        89:DC:33:6E:66:5A:5E:52:37:B4:62:D1:92:59:35:14:
        8B:45:AC:59:B2:4D:24:A2:98:94:68:42:72:9F:3A:68:
        E2:6B:8B:9E:22:2D:F4:98:4E:9A:C6:AF:B3:E4:A0:AB:
        3C:28:BF:23:E1:D7:72:A4:F2:10:53:67:AE:77:AF:51: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        nil
      - crlDistributionPoints: http://crl.verisign.com/tss-ca.crl
      - extendedKeyUsage: true, timeStamping
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - keyUsage: true, 0x80
      - subjectAltName
        CN: TSA1-3
      - subjectKeyIdentifier:
        b4 b7 f1 89 49 26 60 e7 65 ea 73 ae dc d3 38 cd |....I&`.e.s...8.| bf 57 92 6f |.W.o |
  - RSA-SHA1:
```
1e 98 aa 27 b7 78 b5 08  b5 c9 72 6d b7 df c0 0e  |...'.x....rm....|
98 a6 35 c4 88 c9 d2 f6  6d f1 4b 1a fb d5 f9 2d  |..5.....m.K....-|
99 00 9e d1 e7 9b 8b e1  3f bd 39 80 0c 66 cd 07  |........?.9..f..|
bc 5c 98 54 a6 94 ba 10  d1 4e 8b ab f5 6f 65 cc  |.\.T.....N...oe.|
67 09 a2 80 7c 52 e8 0e  03 d6 6b 7a c6 05 18 ec  |g...|R....kz....|
c8 ac 42 7c 07 2c a7 3d  08 66 dc 00 ed fd 94 1d  |..B|.,.=.f......|
73 f2 72 98 93 b1 11 d6  8f ef 8e ea ac f4 96 51  |s.r............Q|
0c d0 8d df 31 52 4f 5e  af 7d a7 4a 75 e6 4e ce  |....1RO^.}.Ju.N.|
2b 9f 29 2b e7 cf 5d 9f  03 7e 6e 27 7b 23 ad 62  |+.)+..]..~n'{#.b|
29 66 af 92 e8 2c ce bd  9c 7f dc cd 17 3c 43 c2  |)f...,.......
```
- Certificate #1
  - 2
    - 47:BF:19:95:DF:8D:52:46:43:F7:DB:6D:48:0D:31:A4
    - RSA-SHA1: nil
    - Issuer
      - C: ZA
      - ST: Western Cape
      - L: Durbanville
      - O: Thawte
      - OU: Thawte Certification
      - CN: Thawte Timestamping CA
    - 2003-12-04 00:00:00 UTC: 2013-12-03 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - CN: VeriSign Time Stamping Services CA
    - #5
      - rsaEncryption: nil
      - A9:CA:B2:A4:CC:CD:20:AF:0A:7D:89:AC:87:75:F0:B4:
        4E:F1:DF:C1:0F:BF:67:61:BD:A3:64:1C:DA:BB:F9:CA:
        33:AB:84:30:89:58:7E:8C:DB:6B:DD:36:9E:0F:BF:D1:
        EC:78:F2:77:A6:7E:6F:3C:BF:93:AF:0D:BA:68:F4:6C:
        94:CA:BD:52:2D:AB:48:3D:F5:B6:D5:5D:5F:1B:02:9F:
        FA:2F:6B:1E:A4:F7:A3:9A:A6:1A:C8:02:E1:7F:4C:52:
        E3:0E:60:EC:40:1C:7E:B9:0D:DE:3F:C7:B4:DF:87:BD:
        5F:7A:6A:31:2E:03:99:81:13:A8:47:20:CE:31:73:0D:
        57:2D:CD:78:34:33:95:12:99:12:B9:DE:68:2F:AA:E6:
        E3:C2:8A:8C:2A:C3:8B:21:87:66:BD:83:58:57:6F:75:
        BF:3C:AA:26:87:5D:CA:10:15:3C:9F:84:EA:54:C1:0A:
        6E:C4:FE:C5:4A:DD:B9:07:11:97:22:7C:DB:3E:27:D1:
        1E:78:EC:9F:31:C9:F1:E6:22:19:DB:C4:B3:47:43:9A:
        1A:5F:A0:1E:90:E4:5E:F5:EE:7C:F1:7D:AB:62:01:8F:
        F5:4D:0B:DE:D0:22:56:A8:95:CD:AE:88:76:AE:EE:BA:
        0D:F3:E4:4D:D9:A0:FB:68:A0:AE:14:3B:B3:87:C1:BB: 0x010001
    - X509v3 extensions
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - basicConstraints
        true
        true: 0
      - crlDistributionPoints: http://crl.verisign.com/ThawteTimestampingCA.crl
      - extendedKeyUsage: timeStamping
      - keyUsage: true, 6
      - subjectAltName
        CN: TSA2048-1-53
  - RSA-SHA1:
```
4a 6b f9 ea 58 c2 44 1c  31 89 79 99 2b 96 bf 82  |Jk..X.D.1.y.+...|
ac 01 d6 1c 4c cd b0 8a  58 6e df 08 29 a3 5e c8  |....L...Xn..).^.|
ca 93 13 e7 04 52 0d ef  47 27 2f 00 38 b0 e4 c9  |.....R..G'/.8...|
93 4e 9a d4 22 62 15 f7  3f 37 21 4f 70 31 80 f1  |.N.."b..?7!Op1..|
8b 38 87 b3 e8 e8 97 00  fe cf 55 96 4e 24 d2 a9  |.8........U.N$..|
27 4e 7a ae b7 61 41 f3  2a ce e7 c9 d9 5e dd bb  |'Nz..aA.*....^..|
2b 85 3e b5 9d b5 d9 e1  57 ff be b4 c5 7e f5 cf  |+.>.....W....~..|
0c 9e f0 97 fe 2b d3 3b  52 1b 1b 38 27 f7 3f 4a  |.....+.;R..8'.?J|
```
- Certificate #2
  - 2
    - 64:60:F5:48:46:9C:3C:AC:54:42:91:25:62:58:58:11
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - 2011-08-10 00:00:00 UTC: 2013-03-26 23:59:59 UTC
    - Subject
      - C: KR
      - ST: Seoul
      - L: Gangnam
      - O: NEXON Corporation
      - OU: Digital ID Class 3 - Microsoft Software Validation v2
      - CN: NEXON Corporation
    - #5
      - rsaEncryption: nil
      - A7:A2:26:D5:8E:23:B6:86:AC:E3:03:DF:B5:BD:35:57:
        7D:DE:23:54:BA:C6:4B:43:45:A4:07:6F:E6:F7:7D:9C:
        16:62:86:88:ED:54:34:3D:62:2C:29:B0:92:FA:ED:05:
        37:95:DA:96:06:7B:31:0D:2A:B6:8B:01:F7:78:D5:5C:
        50:BE:51:AE:B3:79:42:58:46:E2:49:80:4D:F6:4B:58:
        C9:1B:CC:CD:64:82:C3:B8:39:76:E0:FE:FA:DE:A9:F4:
        14:79:A7:02:7A:D2:04:30:56:FD:6A:7F:B8:DE:63:9D:
        78:70:6A:94:49:56:D5:54:5C:8E:1F:58:73:9B:9C:3F:
        B1:4F:74:38:B9:7C:67:AD:8A:D9:4B:52:36:C2:9A:E3:
        52:BC:3F:5A:55:F2:4D:1C:61:2C:A9:70:DA:8F:05:DA:
        31:0E:E5:A6:2F:D1:60:7A:CF:29:29:8B:B5:94:29:E4:
        59:6D:1F:4D:A2:13:20:19:BE:69:38:C3:65:6C:8F:3C:
        8C:D9:70:3B:01:6C:98:01:E8:E9:D1:99:4C:7A:B4:EB:
        D6:25:98:92:EC:EF:A5:EC:5E:DB:33:93:6A:AC:E5:43:
        C6:38:9D:13:96:42:F5:77:48:ED:CD:3B:04:B7:CA:68:
        5C:9F:1E:45:7F:EA:43:0B:F8:E7:B9:46:A4:97:88:97: 0x010001
    - X509v3 extensions
      - basicConstraints
        nil
      - keyUsage: true, 0x80
      - crlDistributionPoints: http://csc3-2010-crl.verisign.com/CSC3-2010.crl
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        id-qt-cps: https://www.verisign.com/rpa
      - extendedKeyUsage: codeSigning
      - authorityInfoAccess
        #0
        OCSP: http://ocsp.verisign.com
        caIssuers: http://csc3-2010-aia.verisign.com/CSC3-2010.cer
      - authorityKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - nsCertType: 0x10
      - 1.3.6.1.4.1.311.2.1.27
        false: true
  - RSA-SHA1:
```
48 7d 8a c0 92 e5 68 37  bd e9 a9 c9 30 4d 15 8a  |H}....h7....0M..|
1a 30 ee 6d 43 3c ff 7c  53 5b 85 22 d2 f4 65 f4  |.0.mC<.|S[."..e.|
b3 31 f7 ff 83 1d 71 b6  8f ff e4 ad 6a 91 3e c6  |.1....q.....j.>.|
50 00 e9 4b 6f c9 2c 6a  63 cf 7a e4 55 0b 14 9b  |P..Ko.,jc.z.U...|
12 a3 0f ee 29 dd 70 ce  0e d4 88 29 93 13 be 6e  |....).p....)...n|
ff 0b 4b c5 b8 b4 67 75  42 c0 f9 7b be 1f 21 e6  |..K...guB..{..!.|
e9 2a 28 98 e6 39 c6 f5  41 9f 8e 55 5d 53 1b 9c  |.*(..9..A..U]S..|
18 fe 39 9b f5 86 de 1b  c1 70 5b a7 c6 3d df 8b  |..9......p[..=..|
97 47 ee 66 98 ac 24 a9  e6 0e 61 85 4d e9 c0 dd  |.G.f..$...a.M...|
91 be 20 93 d4 60 a1 14  7a 4f 1f aa 26 59 9a 0f  |.. ..`..zO..&Y..|
8a b4 4c 14 d1 d7 ca 35  08 d3 c1 4c 0c 66 65 c1  |..L....5...L.fe.|
0c 11 95 80 ee 75 f2 74  25 a0 a3 ce c6 51 0f 31  |.....u.t%....Q.1|
ad f9 88 ce b3 22 be 6f  53 ef 66 8f dc 45 55 3e  |.....".oS.f..EU>|
14 74 fc 6a 8c f8 b6 43  3d af 0f ab 61 a6 46 6c  |.t.j...C=...a.Fl|
52 02 96 1b 8b a3 9c 7d  f0 73 c6 6b 86 b1 fb 0b  |R......}.s.k....|
61 9f 57 3b f0 17 17 2d  db 39 0c 4e ac 4d c2 e8  |a.W;...-.9.N.M..|
```
- Certificate #3
  - 2
    - 52:00:E5:AA:25:56:FC:1A:86:ED:96:C9:D4:4B:33:C7
    - RSA-SHA1: nil
    - Issuer
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: (c) 2006 VeriSign, Inc. - For authorized use only
      - CN: VeriSign Class 3 Public Primary Certification Authority - G5
    - 2010-02-08 00:00:00 UTC: 2020-02-07 23:59:59 UTC
    - Subject
      - C: US
      - O: VeriSign, Inc.
      - OU: VeriSign Trust Network
      - OU: Terms of use at https://www.verisign.com/rpa (c)10
      - CN: VeriSign Class 3 Code Signing 2010 CA
    - #5
      - rsaEncryption: nil
      - F5:23:4B:5E:A5:D7:8A:BB:32:E9:D4:57:F7:EF:E4:C7:
        26:7E:AD:19:98:FE:A8:9D:7D:94:F6:36:6B:10:D7:75:
        81:30:7F:04:68:7F:CB:2B:75:1E:CD:1D:08:8C:DF:69:
        94:A7:37:A3:9C:7B:80:E0:99:E1:EE:37:4D:5F:CE:3B:
        14:EE:86:D4:D0:F5:27:35:BC:25:0B:38:A7:8C:63:9D:
        17:A3:08:A5:AB:B0:FB:CD:6A:62:82:4C:D5:21:DA:1B:
        D9:F1:E3:84:3B:8A:2A:4F:85:5B:90:01:4F:C9:A7:76:
        10:7F:27:03:7C:BE:AE:7E:7D:C1:DD:F9:05:BC:1B:48:
        9C:69:E7:C0:A4:3C:3C:41:00:3E:DF:96:E5:C5:E4:94:
        71:D6:55:01:C7:00:26:4A:40:3C:B5:A1:26:A9:0C:A7:
        6D:80:8E:90:25:7B:CF:BF:3F:1C:EB:2F:96:FA:E5:87:
        77:C6:B5:56:B2:7A:3B:54:30:53:1B:DF:62:34:FF:1E:
        D1:F4:5A:93:28:85:E5:4C:17:4E:7E:5B:FD:A4:93:99:
        7F:DF:CD:EF:A4:75:EF:EF:15:F6:47:E7:F8:19:72:D8:
        2E:34:1A:A6:B4:A7:4C:7E:BD:BB:4F:0C:3D:57:F1:30:
        D6:A6:36:8E:D6:80:76:D7:19:2E:A5:CD:7E:34:2D:89: 0x010001
    - X509v3 extensions
      - basicConstraints
        true
        true: 0
      - certificatePolicies
        2.16.840.1.113733.1.7.23.3
        #0
        id-qt-cps: https://www.verisign.com/cps
        id-qt-unotice: https://www.verisign.com/rpa
      - keyUsage: true, 6
      - 1.3.6.1.5.5.7.1.12
        image/gif
        SHA1:
        8f e5 d3 1a 86 ac 8d 8e 6b c3 cf 80 6a d4 48 18 |........k...j.H.| 2c 7b 19 2e |,{.. |
        http://logo.verisign.com/vslogo.gif
      - crlDistributionPoints: http://crl.verisign.com/pca3-g5.crl
      - authorityInfoAccess
        OCSP: http://ocsp.verisign.com
      - extendedKeyUsage
        clientAuth: codeSigning
      - subjectAltName
        CN: VeriSignMPKI-2-8
      - subjectKeyIdentifier:
        cf 99 a9 ea 7b 26 f4 4b c9 8e 8f d7 f0 05 26 ef |....{&.K......&.| e3 d2 a7 9d |.... |
      - authorityKeyIdentifier:
        7f d3 65 a7 c2 dd ec bb f0 30 09 f3 43 39 fa 02 |..e......0..C9..| af 33 31 33 |.313 |
  - RSA-SHA1:
```
56 22 e6 34 a4 c4 61 cb  48 b9 01 ad 56 a8 64 0f  |V".4..a.H...V.d.|
d9 8c 91 c4 bb cc 0c e5  ad 7a a0 22 7f df 47 38  |.........z."..G8|
4a 2d 6c d1 7f 71 1a 7c  ec 70 a9 b1 f0 4f e4 0f  |J-l..q.|.p...O..|
0c 53 fa 15 5e fe 74 98  49 24 85 81 26 1c 91 14  |.S..^.t.I$..&...|
47 b0 4c 63 8c bb a1 34  d4 c6 45 e8 0d 85 26 73  |G.Lc...4..E...&s|
03 d0 a9 8c 64 6d dc 71  92 e6 45 05 60 15 59 51  |....dm.q..E.`.YQ|
39 fc 58 14 6b fe d4 a4  ed 79 6b 08 0c 41 72 e7  |9.X.k....yk..Ar.|
37 22 06 09 be 23 e9 3f  44 9a 1e e9 61 9d cc b1  |7"...#.?D...a...|
90 5c fc 3d d2 8d ac 42  3d 65 36 d4 b4 3d 40 28  |.\.=...B=e6..=@(|
8f 9b 10 cf 23 26 cc 4b  20 cb 90 1f 5d 8c 4c 34  |....#&.K ...].L4|
ca 3c d8 e5 37 d6 6f a5  20 bd 34 eb 26 d9 ae 0d  |.<..7.o. .4.&...|
e7 c5 9a f7 a1 b4 21 91  33 6f 86 e8 58 bb 25 7c  |......!.3o..X.%||
74 0e 58 fe 75 1b 63 3f  ce 31 7c 9b 8f 1b 96 9e  |t.X.u.c?.1|.....|
c5 53 76 84 5b 9c ad 91  fa ac ed 93 ba 5d c8 21  |.Sv.[........].!|
53 c2 82 53 63 af 12 0d  50 87 11 1b 3d 54 52 96  |S..Sc...P...=TR.|
8a 2c 9c 3d 92 1a 08 9a  05 2e c7 93 a5 48 91 d3  |.,.=.........H..|
```

Signer

1
unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - OU: VeriSign Trust Network
  - OU: Terms of use at https://www.verisign.com/rpa (c)10
  - CN: VeriSign Class 3 Code Signing 2010 CA
- 64:60:F5:48:46:9C:3C:AC:54:42:91:25:62:58:58:11
SHA1: nil

1.3.6.1.4.1.311.2.1.12
- nil
contentType: 1.3.6.1.4.1.311.2.1.4
1.3.6.1.4.1.311.2.1.11: msCodeInd

messageDigest:

e7 f6 61 59 57 b0 4e 0f  57 af ae 99 b1 7d 24 78  |..aYW.N.W....}$x|
0d de a2 cc                                       |....            |

rsaEncryption:

a0 02 30 96 81 e9 30 8f  29 c3 cf c3 5f ac 72 ef  |..0...0.)..._.r.|
8d 85 85 38 32 32 2d fb  e0 6f 00 c9 68 38 97 1d  |...822-..o..h8..|
dd c6 89 78 0d f0 9e aa  6e 70 84 64 a0 78 35 bb  |...x....np.d.x5.|
c0 b4 30 af ad 62 e5 47  d4 88 fc 5b 47 c8 8c be  |..0..b.G...[G...|
84 3b d2 d0 ee 68 8e 7a  75 23 96 81 5d 1d c8 c7  |.;...h.zu#..]...|
c4 1d d9 56 9d 95 a1 ec  07 c6 83 88 6c 43 0f ef  |...V........lC..|
7e 45 3d 8d c9 89 93 a2  07 ae 72 87 46 a8 a0 59  |~E=.......r.F..Y|
e5 b8 fe 7d 05 a7 51 65  94 92 13 7f 06 0d 72 9f  |...}..Qe......r.|
60 c7 4a af 54 b0 8b 53  5f 15 c1 f5 d4 07 15 f1  |`.J.T..S_.......|
2d ea 83 04 05 9e dc 52  0c a7 ce 29 4c 19 fb 67  |-......R...)L..g|
65 54 1e 7d 00 01 8a c2  5d 37 ea 7d f0 d4 34 7e  |eT.}....]7.}..4~|
52 e5 a7 8d f5 d0 fa 3d  a9 03 f9 7d f9 7b 2e 71  |R......=...}.{.q|
4a fc 5b 3e 25 14 a7 c3  42 2f 3b 7b 95 95 4b 47  |J.[>%...B/;{..KG|
6d 13 62 25 15 6f 54 3b  28 a7 6d 5b 88 65 13 8e  |m.b%.oT;(.m[.e..|
aa 0b e2 ea db 10 64 d4  d7 c6 60 e0 4e 38 32 2b  |......d...`.N82+|
34 ee 0d d5 7e 98 4c c6  db e4 fe 07 0c 83 da af  |4...~.L.........|

countersignature

unnamed
- #0
  - C: US
  - O: VeriSign, Inc.
  - CN: VeriSign Time Stamping Services CA
- 79:A2:A5:85:F9:D1:15:42:13:D9:B8:3E:F6:B6:8D:ED
SHA1: nil

contentType: pkcs7-data
signingTime: 2012-08-17 11:10:55 UTC

messageDigest:

af c6 47 3a 34 6c d8 30  19 f5 16 05 b0 75 88 50  |..G:4l.0.....u.P|
07 83 b5 d8                                       |....            |

rsaEncryption:

37 fe a1 22 09 5b 4c 36  61 f6 27 7f 77 26 71 68  |7..".[L6a.'.w&qh|
e1 15 12 48 ec 13 87 06  b2 2e 25 00 c5 87 18 6d  |...H......%....m|
05 a7 96 47 e4 e4 95 d2  77 0f 77 ce 67 b8 ce f8  |...G....w.w.g...|
4e 36 31 69 7b 48 72 3d  5c 19 d5 8b ef 49 06 14  |N61i{Hr=\....I..|
87 dd 30 31 7a 52 8a 2c  f5 da 02 1a 25 54 35 d6  |..01zR.,....%T5.|
7c 5d 1d 4e dd e7 fd 37  dd fb 59 3f fc 5d 82 7b  ||].N...7..Y?.].{|
04 b4 08 cf 7f d6 19 36  2c 08 7e 46 40 7d c1 4d  |.......6,.~F@}.M|
78 39 b5 9b 57 8d 4e 07  43 7e 27 19 ec 43 49 9b  |x9..W.N.C~'..CI.|

show previews

offset	size	type	comment
15c1	15	HTM		#
15d0	6978272	BIN	overlay data past EOF	#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] can't find file_offset of VA 0xd51468

[?] can't find file_offset of VA 0xd5c52c

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[?] can't find file_offset of VA 0xd68400

[?] can't find file_offset of VA 0xd6845c

[?] can't find file_offset of VA 0xd684ec

[?] invalid VS_VERSIONINFO child type "t\x00r\x00i\x00"