samples4.zip
- SHA256 7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858
Overview
overview
10Static
static
3samples4.zip
windows7-x64
1samples4.zip
windows10-2004-x64
10e60d49a96...01.exe
windows7-x64
0e60d49a96...01.exe
windows10-2004-x64
1ce5dd21fb...1e.exe
windows7-x64
101ce5dd21fb...1e.exe
windows10-2004-x64
103c73425d02...e6.exe
windows7-x64
63c73425d02...e6.exe
windows10-2004-x64
65df6314b5c...5b.exe
windows7-x64
105df6314b5c...5b.exe
windows10-2004-x64
105ee5166c02...93.exe
windows7-x64
105ee5166c02...93.exe
windows10-2004-x64
105f7cdd8c28...02.exe
windows7-x64
75f7cdd8c28...02.exe
windows10-2004-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
samples4.zip
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
samples4.zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral4
Sample
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db2501.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral5
Sample
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611e.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral6
Sample
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral7
Sample
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e6.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral8
Sample
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral9
Sample
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5b.exe
Resource
win7-20231215-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral10
Sample
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5b.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral11
Sample
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral13
Sample
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b02.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target samples4.zip
- Size 11.3MB
- Sample240101-s2944adcem
- SHA256 7ae4167445cef80f080de5b84c6490a61c1834aa1e05fce43e611c5d054da858
- MD5 78d1b2d2d33dbdee8a68614849da921e
- SHA1 c80d3a41878f8b776daeb5c706ecc4586f754a94
- SHA512 2bf4a6aa22954efdb5699299034a9a1bf5086634baaab14acc5e0904d3d38bab3a8e566f1f699340f99d71b128bd3d22df2b2a83d076ea0f031cd4c3b00b93c4
- SSDEEP 196608:iVPPnUoLLj3r94fPEC+uCSzmmGgQvFm69unI3xefV/EgOgm53FVvrYn/ushuMMof:cPPnUiD9QmJgKFKn9fV/EgOg61VMfYMj
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4 unpack001/1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d unpack001/3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc unpack001/5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3 unpack001/5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0 unpack001/5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e
File Explorer
-
samples4.zip.zip 11.3MB
-
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4.exe 255KB
-
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d.exe 919KB
-
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc.exe 213KB
-
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3.exe 4.5MB
-
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0.exe 2.2MB
-
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e.exe 5.8MB
0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4/0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
- IMPHASH f6a114275ec71b0f9e53c5ebb7d8d51d
- SHA256 0e60d49a967599fab179f8c885d91db25016be996d66a4e00cbb197e5085efa4
- MD5 1933fed76a030529b141d032c0620117
- SHA1 c55c60a23f5110e0b45fc02a09c4a64d3094809a
- SHA512 b153383ebd9919ff293896381d89a895c58985eef60f67803a4276026631184f4d85c19e9ea06351efb7230226b18ed9a17b533fb602e10ded518a7bd090dcfe
- SSDEEP 3072:iBWxT8JtvyAuX3CGun8r8206BretpJwIiymE9xTRVhGT4z106OKclYQO565tgPYs:iBxrKA4CGu8V0tl9zVhM49OxlYQ8fD3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
81202
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateSemaphoreA
MoveFileExW
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcess
GetCurrentThread
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetModuleHandleA
GetProcAddress
WinExec
GetCurrentProcessId
GlobalAlloc
OpenProcess
GetSystemInfo
GetTickCount
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
SetEndOfFile
HeapSize
WriteConsoleW
FlushFileBuffers
GetProcessHeap
GetStringTypeW
CreateThread
WaitForMultipleObjects
Sleep
CreateMutexA
WaitForSingleObject
ReleaseMutex
ReleaseSemaphore
GetLastError
CloseHandle
WriteFile
SetFilePointerEx
SetFilePointer
SetFileAttributesW
ReadFile
GetLogicalDriveStringsW
GetFileSize
GetDriveTypeW
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
TerminateProcess
CreateFileA
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
DecodePointer
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
HeapReAlloc
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetFileAttributesExW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetStdHandle
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
GetFileSizeEx
CompareStringW
LCMapStringW
user32
FindWindowA
ShowWindow
shell32
SHEmptyRecycleBinA
SHChangeNotify
advapi32
QueryServiceStatusEx
OpenServiceA
EnumDependentServicesA
ControlService
RegSetValueExA
RegCreateKeyExA
RegCloseKey
OpenEventLogA
CloseEventLog
ClearEventLogA
GetTokenInformation
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
OpenProcessToken
OpenSCManagerA
EnumServicesStatusExA
CloseServiceHandle
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
mpr
WNetAddConnection2W
WNetAddConnection2A
WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW
ws2_32
WSAStartup
rstrtmgr
RmGetList
RmStartSession
RmEndSession
RmRegisterResources
Name
.text
Size
172KB
Virtual Size
172KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
48KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=167, id=261, version=29395,
count=20, id=260, version=29395,
count=1, id=253, version=32420,
count=38, id=261, version=32420,
count=18, id=260, version=32420,
count=21, id=259, version=32420,
count=15, id=257, version=29395,
count=145, id=1, productName=Unmarked objects,
count=29, id=260, version=32532,
count=1, id=255, version=32532,
count=1, id=258, version=32532,
1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d/1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d
- IMPHASH 4a337ffacd1cf97d8fcf9a97fe4d8f98
- SHA256 1ce5dd21fbff44289d22647277a94f2611ee661cdcab323548caa0a7082ddc7d
- MD5 28e242e4680d33a2757aa2353cb84f8d
- SHA1 6b949c3f919d530410beb7082a41e1f30bc5ea3e
- SHA512 c00ce7ff6bc841533f3b18b3de8e864dc34e3370912b3bfc924b31e51e505b19422c61685d606861fdd7b25e6ba7a97aa42a7dd0d4bf18bc24863ec09b3d54e2
- SSDEEP 24576:PYl48Rnd+xEhyXOmBjuGh3HZDCixvP/Fg:+N5d+GhoOSVh3FCkvP/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
31056
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
PathFindExtensionW
wnsprintfW
mpr
WNetGetConnectionW
kernel32
GetFileSizeEx
HeapFree
FindNextFileW
FindClose
CreateFileW
PostQueuedCompletionStatus
LoadLibraryA
lstrcatW
CreateThread
HeapAlloc
GetProcAddress
GetProcessHeap
lstrcpyW
lstrcmpiW
CreateIoCompletionPort
lstrcmpW
FindFirstVolumeW
GetCurrentProcess
lstrcmpA
GetModuleHandleA
GlobalAlloc
GetSystemInfo
SetVolumeMountPointW
FindFirstFileW
GetVolumePathNamesForVolumeNameW
WriteFile
GetDriveTypeW
GetModuleFileNameA
GetLogicalDrives
Process32First
TerminateProcess
GetEnvironmentVariableA
lstrcatA
OpenProcess
CreateToolhelp32Snapshot
MultiByteToWideChar
GetTempPathA
CreateFileA
DeleteFileW
Process32Next
lstrcpyA
ExitProcess
lstrcmpiA
GetTempFileNameA
GetStringTypeW
SetStdHandle
AllocConsole
GetCurrentProcessId
WriteConsoleW
AttachConsole
GetStdHandle
lstrlenW
MoveFileW
CloseHandle
Sleep
FindVolumeClose
GetQueuedCompletionStatus
FreeEnvironmentStringsW
GetEnvironmentStringsW
VirtualQuery
ReadFile
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
HeapSize
HeapReAlloc
DecodePointer
FindNextVolumeW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
GetModuleFileNameW
GetModuleHandleExW
LCMapStringW
GetFileType
user32
wsprintfW
SystemParametersInfoA
gdi32
SelectObject
StartPage
EndDoc
CreateDCW
CreateFontW
DeleteDC
TextOutW
DeleteObject
StartDocW
EndPage
winspool.drv
EnumPrintersW
advapi32
OpenServiceA
CloseServiceHandle
ClearEventLogW
OpenSCManagerW
AllocateAndInitializeSid
ControlService
FreeSid
OpenEventLogW
CheckTokenMembership
QueryServiceStatusEx
shell32
SHEmptyRecycleBinW
ShellExecuteA
ole32
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantInit
VariantClear
Name
.text
Size
92KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.7aedee
Size
787KB
Virtual Size
788KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=143, id=261, version=27412,
count=18, id=260, version=27412,
count=37, id=261, version=30034,
count=19, id=260, version=30034,
count=19, id=259, version=30034,
count=21, id=257, version=27412,
count=156, id=1, productName=Unmarked objects,
count=1, id=262, version=27412,
count=10, id=265, version=30148,
count=1, id=258, version=30148,
3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc/3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 3c73425d026a172779c8ffc5e338afbf6e66f1ad3020a11c2bece4658fcb28fc
- MD5 045ffadc2fda21d2cd8e2fc37e9557c9
- SHA1 85fce2c0d66c852e9b7b326198da0cfb9f31fc54
- SHA512 7233efe7849edd61163d0656f1a732760f7b649f38b94cb7d8eef0e30450013d684a5b4241a1708d734c5a5ef6ce26d5cf1bdc3ccd6002d3edfc6a51e9698452
- SSDEEP 768:ZzCQUwJLKh1hn49V/KmhP1ypZr1hn49V/KmdP1ywZc:bA1hn4HmR1hn4HP+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
120586
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
102KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3/5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 5df6314b5c6f6bd151a5fda104d32655c5bd8153be922b80069b22f1c1de9db3
- MD5 407ba61bab1c10cabf0b5a7c40d43041
- SHA1 82d180dc50763c6a71f8449ef44e467afbc09e74
- SHA512 73bd51f5885587ec5c930d4ab0cd543b9b0479304c4a3c03d73abdd7b064a2ec4e8b01af45f7517072ce12daa2cfb679589603060438bfafa331a0b66b926f4a
- SSDEEP 98304:BD9WybBsIt6XW7JD9ENTPZsz3yilw5OLEvvybN/aBDPsfut6e:BxWaBhP719CCzC2EO4vvyb5a1mu0e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
7680000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
69KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.1MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
exlhlzdc
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
gyuvvvyg
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=1, productName=Unmarked objects,
count=11, id=174, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0/5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0
- IMPHASH e4817e5988730d84f473d0e35b261222
- SHA256 5ee5166c02636f294fb8f6da69d5c0ae893a1c4694ae1bcc3753b497598121a0
- MD5 71a4ba0fe0bc0cb450b8966cb585f757
- SHA1 eccb76a942b3359d8dbf4c12e6bc3be0c8627eca
- SHA512 5748e02e83ea32118013741680be6e2eea398b05cde8c359e0db9126175ce63a4890e7ca654e5a5930970889aa2598c650395972107d41522e55207dd5460c01
- SSDEEP 12288:QnQY+2XG1Inz4vM/nlBKSduzxx73zDJnaPxMrFHQJGTTqTdd1o/CMj:QbGOnbzuHT5naPxUHQATTqzi/Cu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
2209207
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
VirtualAlloc
VirtualProtect
LoadLibraryA
GetProcAddress
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
WriteConsoleW
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize
HeapReAlloc
CloseHandle
CreateFileW
DecodePointer
Name
.text
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e/5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e
- IMPHASH 04f4a4454da812f4d2024bd9e3fcfe70
- SHA256 5f7cdd8c28daba74fd96c1aa9de6d920b026dcea5b596e7e145ffe11c5a4cb8e
- MD5 bee46db93df737c15c59a6e1fd132954
- SHA1 680c46e55f600933fa0b5658f27f60bc336fcc96
- SHA512 69f253a708bbc9adbd4cd909ec1999e9bff0b2423e0b3c59eb760b73f19bdbdd77f0ead4d35afd70bc2925ef3928a76fbac7c5a504f5792e6a661081a1ef9871
- SSDEEP 98304:GMe3NP8k6r0Cx2MQkxvJrUTjOaBTbRlNIyJM+DP1zgFcqtZs:+O4FMQk2jVBXRHIL+psfs
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4491428
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
closesocket
crypt32
CryptUnprotectData
wininet
InternetReadFile
ntdll
NtQuerySystemInformation
rstrtmgr
RmStartSession
kernel32
LocalFree
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetDesktopWindow
gdi32
GetObjectW
advapi32
RegOpenKeyExA
shell32
SHGetKnownFolderPath
ole32
CreateStreamOnHGlobal
shlwapi
ord184
gdiplus
GdipGetImageEncoders
Name
.text
Size
Virtual Size
902KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
128KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.~Jw
Size
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.Tx?
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.7<a
Size
5.8MB
Virtual Size
5.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
469B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ