samples (2) (2).zip
- SHA256 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800
Overview
overview
10Static
static
10samples (2) (2).zip
windows7-x64
1samples (2) (2).zip
windows10-2004-x64
1083e147374...08.exe
windows7-x64
8083e147374...08.exe
windows10-2004-x64
812437a49d2...3d.exe
windows7-x64
712437a49d2...3d.exe
windows10-2004-x64
71945c44901...7e.exe
windows7-x64
91945c44901...7e.exe
windows10-2004-x64
102040fa2a3c...d4.exe
windows7-x64
12040fa2a3c...d4.exe
windows10-2004-x64
12b5109e9a2...d9.exe
windows7-x64
102b5109e9a2...d9.exe
windows10-2004-x64
103538750cfe...5f.exe
windows7-x64
103538750cfe...5f.exe
windows10-2004-x64
105d96952d47...5f.exe
windows7-x64
105d96952d47...5f.exe
windows10-2004-x64
1063fb410fc5...22.exe
windows7-x64
763fb410fc5...22.exe
windows10-2004-x64
767beeb7a19...08.exe
windows7-x64
367beeb7a19...08.exe
windows10-2004-x64
16e5678ebd4...71.exe
windows7-x64
36e5678ebd4...71.exe
windows10-2004-x64
371506a3322...fb.exe
windows7-x64
1071506a3322...fb.exe
windows10-2004-x64
10734b9974ec...6d.exe
windows7-x64
10734b9974ec...6d.exe
windows10-2004-x64
1081a27b3dcf...40.exe
windows7-x64
981a27b3dcf...40.exe
windows10-2004-x64
10a1bd0fa8ad...46.exe
windows7-x64
10a1bd0fa8ad...46.exe
windows10-2004-x64
10a465bc0871...e3.exe
windows7-x64
6a465bc0871...e3.exe
windows10-2004-x64
6Behavioral task
behavioral1
Sample
samples (2) (2).zip
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
samples (2) (2).zip
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win7-20231215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral9
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral12
Sample
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win7-20231215-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral14
Sample
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral15
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral17
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win7-20231215-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral24
Sample
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral25
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral26
Sample
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral27
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win7-20231129-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral28
Sample
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral29
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral30
Sample
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral31
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target samples (2) (2).zip
- Size 11.5MB
- Sample240101-sladjafeg6
- SHA256 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800
- MD5 3103452bf9094d6f3ec5ddee144b821a
- SHA1 1995b4171447b7e11302682b29c34bba4c5939f9
- SHA512 3559e9e28f7ba881207ba01fd0c2eedf29f91d88b7c44c938fbec73e756a39ab0e072f88072bb82365e7476f6247658f8d59147e64eee6fb825003085b4edb6f
- SSDEEP 196608:1g0w+y495NuivJ1dlbNm5IemCPIurAW58NFfApXHUxcSeVIDF/je3ZSEMIVab0gx:1g0w+F5NuivJFbN4mCz5Uip0OFVuepWn
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- MedusaLocker payload 1 IoCs
resource yara_rule static1/unpack001/3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f family_medusalocker - Medusalocker family
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/a4dfaa8bbce586a593a86aa0e8e6c3e799d2a18b7e02d20284e83ff6f723c0d9 agile_net - Unsigned PE 24 IoCs
Checks for missing Authenticode signature.
resource unpack001/083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08 unpack001/12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d unpack001/1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e unpack001/2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4 unpack001/2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9 unpack001/3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f unpack001/5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f unpack001/63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222 unpack001/6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271 unpack001/71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb unpack001/734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d unpack001/81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740 unpack001/a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46 unpack001/a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3 unpack001/a4dfaa8bbce586a593a86aa0e8e6c3e799d2a18b7e02d20284e83ff6f723c0d9 unpack001/ae6f3869929b1d021a10bd51dc1aace28bec1a4b000085b477c1e470b73e77fe unpack001/bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2 unpack001/c475b20ef38d5ef011235eeaf75db5686a5fef724e3eb2fa3e8d4b056096fbb6 unpack001/d57ee4f41d4df716e6270a147e098aabb6cac69a1d5812b1f21f0bf17a9c7db5 unpack001/d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664 unpack001/dd6ac617529eed1916db34c8875f09f127ba3d2ff304352df29fdef4802143fd unpack001/e1bc3d93383ffb9540f20a1b58e4b3bb77ba24d247a1177030be6fe93d912136 unpack001/ea62bfae07927cc7fd706948ae7e474f4c0d7ed2afcb7c73c388e5f6936f5c29 unpack001/f2cafb550a0b7c248847d2548389379d0d8954335d81d60991a4d1e7333745b4 - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d nsis_installer_1 static1/unpack001/12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d nsis_installer_2
File Explorer
-
samples (2) (2).zip.zip 11.5MB
-
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08.exe 1.2MB
-
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d.exe 426KB
-
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e.exe 640KB
-
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4.exe 400KB
-
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe 701KB
-
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f.exe 332KB
-
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f.exe 732KB
-
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222.exe 924KB
-
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08.exe 416KB
-
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271.exe 578KB
-
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb.exe 597KB
-
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d.exe 804KB
-
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740.exe 1.1MB
-
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46.exe 740KB
-
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3.exe 408KB
-
a4dfaa8bbce586a593a86aa0e8e6c3e799d2a18b7e02d20284e83ff6f723c0d9.exe 446KB
-
ae6f3869929b1d021a10bd51dc1aace28bec1a4b000085b477c1e470b73e77fe.exe 309KB
-
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2.exe 1.1MB
-
c475b20ef38d5ef011235eeaf75db5686a5fef724e3eb2fa3e8d4b056096fbb6.exe 751KB
-
d57ee4f41d4df716e6270a147e098aabb6cac69a1d5812b1f21f0bf17a9c7db5.exe 836KB
-
d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664.exe 696KB
-
dd6ac617529eed1916db34c8875f09f127ba3d2ff304352df29fdef4802143fd.exe 531KB
-
e1bc3d93383ffb9540f20a1b58e4b3bb77ba24d247a1177030be6fe93d912136.exe 995KB
-
ea62bfae07927cc7fd706948ae7e474f4c0d7ed2afcb7c73c388e5f6936f5c29.exe 1.2MB
-
f2cafb550a0b7c248847d2548389379d0d8954335d81d60991a4d1e7333745b4.exe 396KB
083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08
- IMPHASH 4b932974a1b8b4dec33cf044302323ec
- SHA256 083e147374de04930caa882acaeda6df4821b75f869edb7386281f684e573c08
- MD5 26d35ecbbd980c6d2863a61914c4a1bb
- SHA1 ce2da4baff59602905fd75d10f3ac6ac2e235337
- SHA512 b192b0ee326dbb690c850832e76cd31257a47f819abaa0700647be022cb340297ad4a7496b352596715425a60aa60e7f001313ee08639d748c2c453ab79e8107
- SSDEEP 24576:h6FBigtov3pjeA+07ASgSl+YYxJuWMvV36/K+VLebSKLvBTyPj+dyqGgM0b1:2Bi53w3eqi+mfJujkyqGgHx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
669354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
recv
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
closesocket
normaliz
IdnToAscii
wldap32
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord200
ord22
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
kernel32
HeapFree
HeapAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameA
GetDateFormatW
SetFilePointerEx
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RaiseException
RtlUnwind
WaitForSingleObject
LoadLibraryW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetExitCodeProcess
CreateProcessA
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
HeapSize
FindFirstFileExA
IsValidCodePage
FindNextFileA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
SetEndOfFile
ExitProcess
CreateFileW
GetLogicalDrives
FindFirstFileW
Process32First
FindNextFileW
TerminateProcess
GetDriveTypeA
FindClose
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
FreeConsole
lstrcmpW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetModuleHandleW
CopyFileW
MoveFileExW
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
Name
.text
Size
954KB
Virtual Size
954KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=241, version=40116,
count=186, id=243, version=40116,
count=31, id=242, version=40116,
count=6, id=199, version=41118,
count=26, id=259, version=26706,
count=131, id=261, version=26706,
count=37, id=260, version=26706,
count=42, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=255, id=1, productName=Unmarked objects,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=260, productName=VS2019 v16.0.0 build 27508, version=27508,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d
- IMPHASH e160ef8e55bb9d162da4e266afd9eef3
- SHA256 12437a49d298941af8d087a1ff478a68ab4c312654153e17d598ff1c87be6b3d
- MD5 11db0fc2064d7c858067b99b413e357b
- SHA1 dbfe691315009c224e3b826dfb89ac7d910a7f08
- SHA512 120153a24b079eda7a55f97b31a7827f34ee8e6a69593180f0588ebc38efcee6c7a90131af366f9c0ce55288247bf4b6ab5fd9541ed365370f1f42c279ab93d8
- SSDEEP 12288:qntVoEco+qy0h6/id8Mq560WjLM7Ti/L6tdEyvIG9ij8e:mVdcvr0hCoV8OjvUdEyvItjd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12470
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary
user32
CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA
gdi32
SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
advapi32
RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA
comctl32
ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17
ole32
CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
105KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=158, id=1, productName=Unmarked objects,
count=17, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=10, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e
- IMPHASH a08952b00a788686a5ccda8fc072094a
- SHA256 1945c44901e7aa9dd5b6e7e6e07a777d57f7e76120a3ca5a46a0f983d30ce37e
- MD5 fb702537f0c25b34cc2b3dfb69025a85
- SHA1 eb8cae72ffd5361a977e186cb78fc64055748f00
- SHA512 94d2a4d9a5c689c13934bd9d2f236a421a63e90fcf6d3dd7362cbe7c64e1faacb68412b92ce743ee49e4e8adf4f91a495ccd8d0d3605e464bfccb26f31d1b843
- SSDEEP 12288:Z2X8+SnYa6TF42coyaLlGSDVmcUjErioq8iHiB6k:cM+SnAF4Uyycj24Hs6k
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
105763
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
opengl32
wglGetCurrentDC
wglGetCurrentContext
wglMakeCurrent
kernel32
OpenFile
GetSystemTime
WaitForSingleObject
WriteFile
GetStartupInfoA
SetHandleInformation
CreatePipe
GetStdHandle
CloseHandle
CreateThread
GlobalFree
GetFileInformationByHandle
TlsGetValue
ExitProcess
HeapCreate
HeapDestroy
GetCommandLineA
GetFileTime
GetSystemInfo
VirtualProtect
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
GetSystemTimeAsFileTime
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualQuery
FileTimeToSystemTime
SystemTimeToFileTime
RtlUnwind
TlsSetValue
TlsFree
HeapSize
GetCPInfo
VirtualAlloc
TlsAlloc
FormatMessageA
CreateEventA
GetOEMCP
IsValidCodePage
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetTimeZoneInformation
CreateIoCompletionPort
SetConsoleCtrlHandler
PostQueuedCompletionStatus
WaitForMultipleObjects
GetComputerNameA
GetSystemDirectoryA
GetWindowsDirectoryA
ExpandEnvironmentStringsA
EnumDateFormatsA
OutputDebugStringA
DebugBreak
LockResource
GetCurrentProcessId
LoadLibraryA
GetProcAddress
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameA
MulDiv
lstrcmpA
SetFilePointer
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
SetLastError
SetEndOfFile
IsDBCSLeadByte
lstrcmpiA
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetLastError
lstrlenW
WideCharToMultiByte
GetCurrentThreadId
GetModuleHandleA
GetCurrentProcess
ReadFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
FlushInstructionCache
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
MultiByteToWideChar
VirtualUnlock
user32
SetScrollInfo
GetScrollInfo
ScrollWindow
DrawFocusRect
EnableMenuItem
SetDlgItemTextA
IsDialogMessageA
GetSystemMenu
GetWindowTextLengthA
MessageBoxW
SetWindowTextA
CreateDialogParamA
DialogBoxParamA
EndDialog
IsDlgButtonChecked
CheckDlgButton
CheckMenuRadioItem
RemoveMenu
AppendMenuA
LoadBitmapA
GetWindowTextA
LoadStringW
GetWindowRect
TranslateAcceleratorA
SetMenuDefaultItem
SetMenu
GetMenu
GetSubMenu
PtInRect
IsMenu
SetWindowsHookExA
OffsetRect
CallNextHookEx
GetSysColorBrush
GetKeyState
CharLowerA
UnhookWindowsHookEx
InflateRect
SetRectEmpty
RegisterWindowMessageA
GetWindowDC
TrackPopupMenuEx
GetMessagePos
WindowFromPoint
MessageBeep
DrawEdge
FrameRect
ModifyMenuA
MonitorFromPoint
GetMonitorInfoA
DrawFrameControl
DrawTextA
SetMenuItemInfoA
GetMenuItemInfoA
GetMenuItemID
GetMenuItemCount
GetActiveWindow
GetWindowThreadProcessId
IsWindowEnabled
IsWindowVisible
UpdateWindow
MapWindowPoints
PostMessageA
LoadStringA
LoadMenuA
LoadAcceleratorsA
DestroyMenu
CreateAcceleratorTableA
GetDesktopWindow
GetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameA
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
SetWindowPos
GetSysColor
CreateWindowExA
SystemParametersInfoA
CallWindowProcA
SetFocus
EnableWindow
InvalidateRect
MoveWindow
GetClassInfoExA
LoadCursorA
GetSystemMetrics
LoadImageA
RegisterClassExA
DestroyWindow
CharNextA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
CreateMenu
CreatePopupMenu
GetClientRect
LoadIconA
SendMessageA
GetDlgItem
IsWindow
ShowWindow
GetWindowLongA
SetWindowLongA
PostQuitMessage
UnregisterClassA
gdi32
CreateDIBSection
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
GetObjectA
GetStockObject
SetBkMode
SetTextColor
SetBrushOrgEx
DeleteObject
CreateSolidBrush
CreateRectRgn
CombineRgn
StartPage
GetTextMetricsA
StartDocA
TextOutA
CreateFontIndirectA
CreatePatternBrush
GetCurrentObject
EndDoc
SelectObject
EndPage
SetBkColor
PatBlt
CreateBitmap
DeleteDC
comdlg32
ChooseColorA
PrintDlgA
ChooseFontA
advapi32
GetUserNameA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
ImpersonateLoggedOnUser
shell32
SHGetFolderPathW
ole32
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
OleInitialize
CoUninitialize
OleUninitialize
CoInitialize
oleaut32
SysAllocString
VarUI4FromStr
SysStringByteLen
VariantInit
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysStringLen
SysFreeString
VariantClear
crypt32
CertGetNameStringA
comctl32
InitCommonControlsEx
ord6
ImageList_Destroy
ImageList_GetImageCount
ImageList_Draw
ImageList_DrawIndirect
ImageList_LoadImageA
ord8
ImageList_Create
ImageList_AddMasked
ord413
wininet
FtpGetCurrentDirectoryA
FtpFindFirstFileA
ws2_32
htonl
htons
bind
closesocket
listen
accept
inet_ntoa
WSASocketA
shutdown
WSACleanup
WSAGetLastError
socket
WSAStartup
netapi32
NetUserDel
NetUserAdd
NetLocalGroupAddMembers
winmm
mmioSetInfo
mmioSeek
mmioDescend
mmioGetInfo
imm32
ImmGetConversionListA
ImmGetContext
ImmGetConversionStatus
Name
.text
Size
184KB
Virtual Size
180KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
392KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=39, id=125, productName=VS2005 build 50727, version=50727,
count=153, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=33, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=359, id=1, productName=Unmarked objects,
count=61, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4
- IMPHASH 284c9d70850d445a2194446d5ac9dded
- SHA256 2040fa2a3c5b16d74442d41d224a6ab16e0290a30f0535b18cb50de6a59686d4
- MD5 f9665d07df05a0a7c2c6f4019d1bba20
- SHA1 778f8bb7ba91ddf0ac9b12052d046d7f975e671a
- SHA512 cab4dae8b8534af781357df20e3f2d9522247d9b37c1afe72831b551cc218eb060fb1a7cceb158406d4d512879d06da5c9144a348a0bff077fe4f1ab20762cf8
- SSDEEP 6144:GCpNiYHtZHYdNsToSRBoptYASydR1wWhz:THiYwvUxRBn4dHz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4548
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
_adj_fdiv_m64
_adj_fprem1
__vbaHresultCheckObj
__vbaLenBstrB
_adj_fdiv_m32
__vbaExitProc
__vbaOnError
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaLateMemCall
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeObj
Name
.text
Size
388KB
Virtual Size
386KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=6, id=9, version=8041,
count=1, id=13, version=9782,
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9
- IMPHASH a90cc1b6f902761feb40477393138296
- SHA256 2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9
- MD5 6741d5aef031c6b1e51f386fefc1225e
- SHA1 95ea397aed18143bc18da02c21e693c44e373f90
- SHA512 90034da6a496dfcf2b7227b2aa585983cbe80f9a69586743eb219035c1bdab59eaa912139de0e576db2194383f1c70e16042736c1a593fd7e7a4ea93d515df5d
- SSDEEP 12288:ZohXTLkKkP0rRl6CRHCwWshS7JUc9ouDCwI/d9V5qyBmPjCkuYDaFB:ZYTLG2U/wWRVUYoUCwCVdmr7uma
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
15964
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ReadConsoleInputW
VerifyVersionInfoW
GetCPInfoExA
CreateEventW
GetSystemDirectoryW
GetProcAddress
GlobalAlloc
DeleteTimerQueueTimer
OpenWaitableTimerA
GetFileAttributesW
EnumResourceTypesW
GetLongPathNameW
GetModuleHandleW
CreateTimerQueue
InterlockedCompareExchange
FindNextFileA
LocalFlags
WaitCommEvent
SleepEx
GetConsoleAliasW
WritePrivateProfileSectionW
PulseEvent
SetLastError
GetConsoleMode
lstrcmpA
SetCalendarInfoA
GetSystemWindowsDirectoryA
GetComputerNameW
EnumTimeFormatsA
AddAtomA
SetSystemTime
_llseek
GetShortPathNameW
EnumCalendarInfoA
EnumCalendarInfoExW
FindNextFileW
CreateActCtxW
SetStdHandle
GetWindowsDirectoryW
FindFirstVolumeMountPointW
WriteProfileSectionW
LoadLibraryA
WriteConsoleW
CloseHandle
GetLastError
HeapReAlloc
HeapAlloc
MoveFileA
DeleteFileA
GetCommandLineW
HeapSetInformation
GetStartupInfoW
EncodePointer
DecodePointer
HeapCreate
HeapFree
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LoadLibraryW
Sleep
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
WideCharToMultiByte
HeapSize
GetConsoleCP
FlushFileBuffers
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
ReadFile
SetFilePointer
CreateFileW
user32
LoadMenuW
GetComboBoxInfo
DefDlgProcA
GetListBoxInfo
gdi32
GetCharWidth32A
advapi32
LookupAccountSidW
shell32
FindExecutableA
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
585KB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
63KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=14, id=158, productName=VS2010 build 30319, version=30319,
count=92, id=170, productName=VS2010 build 30319, version=30319,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=120, id=1, productName=Unmarked objects,
count=26, id=171, productName=VS2010 build 30319, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f
- IMPHASH f22bc6a616927c119c37738048bc1cc5
- SHA256 3538750cfe06d8fe364bc4f396229bfd08c9856f17477b0f8444d35a7f89775f
- MD5 7286267a7eeaf2c3122635c5edb71e84
- SHA1 d342d986442a20453d3c9a438766758301d88d4e
- SHA512 8567661bc656edbacd0ca59f1d1b38cad7c3101d8d06772ae1eba9828792327cbc6b4254e5e61d2b190f4f4350c6288ac2e5c811f7a4ed0c38bc4be8ccf636f0
- SSDEEP 6144:0LI9sGqBET+/evZ9zgDU/JSrJyhSdDXR0sVWorEriYtkD:d9JL+/eh90DU/JYUh01YtkD
- MD5 SHA1 SHA512 SSDEEP
-
MedusaLocker payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
129292
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
crypt32
CryptStringToBinaryW
CryptBinaryToStringW
shlwapi
StrStrIW
PathIsUNCW
PathFindExtensionW
rstrtmgr
RmShutdown
RmGetList
RmRegisterResources
RmEndSession
RmStartSession
mpr
WNetGetConnectionW
WNetAddConnection2W
kernel32
GetLogicalDrives
FindFirstVolumeW
SetVolumeMountPointW
FindVolumeClose
GetVolumePathNamesForVolumeNameW
DeleteVolumeMountPointW
FindNextVolumeW
GetDriveTypeW
ReadFile
FindFirstFileExW
FindNextFileW
WriteFile
FindClose
CreateFileW
SetFileAttributesW
SubmitThreadpoolWork
SetFilePointerEx
GetConsoleWindow
lstrcmpiW
GetWindowsDirectoryW
SetConsoleTitleW
MoveFileW
CreateThreadpoolWork
SizeofResource
GetCurrentProcess
AssignProcessToJobObject
InitializeProcThreadAttributeList
CreatePipe
PeekNamedPipe
WaitForSingleObject
OpenProcess
MultiByteToWideChar
UpdateProcThreadAttribute
LockResource
LoadResource
FindResourceW
CreateProcessW
GetModuleHandleW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetFileSizeEx
GetFileAttributesExW
GetExitCodeProcess
CloseHandle
GetLastError
CreateJobObjectW
SetInformationJobObject
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
DecodePointer
WriteConsoleW
QueryDosDeviceW
LocalFree
FormatMessageA
GetLocaleInfoEx
RaiseException
WaitForSingleObjectEx
Sleep
GetCurrentThreadId
GetExitCodeThread
IsProcessorFeaturePresent
FreeLibraryWhenCallbackReturns
CloseThreadpoolWork
GetModuleHandleExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
GetProcAddress
InitializeConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
ReleaseSRWLockShared
AcquireSRWLockShared
TryAcquireSRWLockExclusive
InitializeSRWLock
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
TerminateProcess
RtlUnwind
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
GetFileType
CompareStringW
LCMapStringW
user32
IsWindowVisible
ShowWindow
GetWindowThreadProcessId
RegisterWindowMessageW
GetShellWindow
GetAsyncKeyState
advapi32
CryptGenRandom
RegSetValueExW
OpenProcessToken
GetTokenInformation
CryptDestroyKey
CryptGetKeyParam
CryptAcquireContextW
CryptEncrypt
RegGetValueW
CryptExportKey
CryptImportKey
CryptGenKey
CryptReleaseContext
RegCloseKey
RegCreateKeyExW
shell32
SHEmptyRecycleBinW
ole32
CoGetObjectContext
CoGetApartmentType
Name
.text
Size
242KB
Virtual Size
241KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=30795,
count=163, id=261, version=30795,
count=20, id=260, version=30795,
count=18, id=260, version=32124,
count=66, id=261, version=32124,
count=26, id=259, version=32124,
count=19, id=257, version=30795,
count=224, id=1, productName=Unmarked objects,
count=8, id=265, version=32323,
count=1, id=255, version=32323,
count=1, id=151,
count=1, id=258, version=32323,
5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f
- IMPHASH 198fcdf1107e8858620b59878845e93f
- SHA256 5d96952d473d386285f01726073d8f1ec46c983fe4c9d657babe9272330d655f
- MD5 9346199aa06d8fa74051e98b06cd3d26
- SHA1 9020c5dbcb80340517916272f2479001b2bfdff3
- SHA512 a7e4b195c6eefa011b729deb32ffe533ef61bb2126e68272cba26ec8b2fc49b3e75327abb9f916530db911a1b7854020234300a02c87c65d6cd89b661ce18f58
- SSDEEP 12288:FEIJVxZIpeKXqWdXoeSPEWOSNXCdepyeEPbObcy9BwoWNffeKuIhQ+0F:F3VxZIprXqWdXoDPEWO8XCdebcONXwoy
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
7323
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetPriorityClass
GetLocaleInfoW
IsProcessInJob
SizeofResource
SetSystemTimeAdjustment
GetConsoleAliasExesLengthW
WriteConsoleOutputA
LeaveCriticalSection
GetFileAttributesA
GetFileAttributesW
GetTimeZoneInformation
lstrcatA
GetEnvironmentVariableA
GetVolumePathNameA
SetConsoleTitleA
WritePrivateProfileStringW
CreateJobObjectA
GetHandleInformation
GetLastError
GetCurrentDirectoryW
GetCompressedFileSizeW
HeapSize
BeginUpdateResourceW
EnumDateFormatsExA
CreateMemoryResourceNotification
GetAtomNameA
LoadLibraryA
LocalAlloc
SetCalendarInfoW
GetProfileStringA
SetCommMask
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
WaitForDebugEvent
GetCurrentProcessId
SetFileAttributesW
LCMapStringW
CompareStringW
CompareStringA
GetConsoleAliasesLengthA
GetModuleHandleW
FreeEnvironmentStringsA
InitializeSListHead
WriteConsoleOutputCharacterA
SetFilePointer
GetLongPathNameW
SetDefaultCommConfigA
Sleep
GetProcAddress
ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetStdHandle
EnterCriticalSection
GetFileType
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
HeapAlloc
RtlUnwind
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetStdHandle
DeleteCriticalSection
FatalAppExitA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetStartupInfoA
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
CloseHandle
CreateFileA
RaiseException
GetLocaleInfoA
LCMapStringA
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
FlushFileBuffers
SetEndOfFile
GetProcessHeap
ReadFile
SetEnvironmentVariableA
user32
GetProcessDefaultLayout
advapi32
OpenEventLogA
RegCreateKeyA
GetPrivateObjectSecurity
EqualPrefixSid
EqualSid
GetServiceKeyNameW
PrivilegedServiceAuditAlarmW
Name
.text
Size
691KB
Virtual Size
690KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.wutedij
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=31, id=132, productName=VS2008 build 21022, version=21022,
count=24, id=149, productName=VS2008 build 21022, version=21022,
count=126, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=130, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 63fb410fc5267c61c5099927af714a8f5f4ba6dcdeeb1f297b022879767c7222
- MD5 ec9c3efe831aaa203058927df7de6138
- SHA1 b77581e047551a70aaba0db7a57349136bd9e411
- SHA512 0d5aedcebaa660f345c549b9ae07b4d18fc01b563907b378c1cd905029bb0c6f6849e0f03c7c4a724c3448eb9c693138265a0b0129a298af3aada9bb0f447d6a
- SSDEEP 12288:tZqu3sRwqpxGCMF3dera2ybCPWy5SqZWj+6GJZy82VS1ToBgdoByOHGae0r2ivr:B3yEoro2PEpUA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
852430
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
824KB
Virtual Size
824KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
99KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 67beeb7a196a91ffdb77af4e53143e75a157ea6cf3432a2e14e1c55d11ef2f08
- MD5 bd4ea1c3cb843597d5b3a560f95840bb
- SHA1 f81c504435d27e6a502acee3d1834121517ea194
- SHA512 7ac8ef4f1f6f9aab30ea183e5377b6bdd617f7c18af86cdde4da8f2e8528835faf659b9fad8b8bffc22b98b4659967f013155c257feedddfaf9b332dd77c565a
- SSDEEP 3072:1VAz+HYRuV4ek4gX/am6/iQ0ET1fY/Tnib6qICONXvm0JZxkW5QGmwFp+1mSZoNJ:7c+HY0n/p0VTJq+9wm0sfi4J
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
5b:8f:d3:2e:b2:c6:47:40:7b:45:16:98:c2:75:b6:78:ad:c2:08:e6:a8:63:68:fc:22:b8:16:a2:68:2f:40:5e
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Amazon Services LLC,OU=Software Services,O=Amazon Services LLC,L=Seattle,ST=Washington,C=US
Chains
Mar 26, 2019
PE Signature issue
Digest
01:11:67:c6:a1:7e:a0:a0:54:0c:86:5a:32:19:de:58:2f:51:e2:9d
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Amazon Services LLC,OU=Software Services,O=Amazon Services LLC,L=Seattle,ST=Washington,C=US
Chains
Mar 26, 2019
Subject
CN=Amazon Services LLC,OU=Software Services,O=Amazon Services LLC,L=Seattle,ST=Washington,C=US
Serial Number
39:4f:2c:22:62:cc:2d:b9:2b:fe:ae:20:59:3b:f1:74
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 29, 2018 - Mar 29, 2020
Subject
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping
Timespan
Nov 10, 2006 - Nov 10, 2021
Subject
CN=DigiCert Timestamp Responder,O=DigiCert,C=US
Serial Number
03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Issuer
CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 22, 2014 - Oct 22, 2024
Subject
CN=Amazon Services LLC,OU=Software Services,O=Amazon Services LLC,L=Seattle,ST=Washington,C=US
Serial Number
39:4f:2c:22:62:cc:2d:b9:2b:fe:ae:20:59:3b:f1:74
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 29, 2018 - Mar 29, 2020
Subject
CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US
Serial Number
09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 4, 2017 - Jan 18, 2028
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
252206
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
238KB
Virtual Size
238KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
166KB
Virtual Size
166KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6e5678ebd457353b7c095af806f92b5f54341bbfa2c8d3f5ab03b84483013271
- MD5 e7818e26919dc4f84c6ac683f78eba88
- SHA1 47456d3f78c33e67b6d366bbff5c3896e5925527
- SHA512 95fff6c2e9428aa088f3c5565fbc52af14e53c2b58e402983947af0be3334618082775e78fd7901c8ec7b7556bda5bc9551a339ceaf2ecd651b160e3edc3b8f7
- SSDEEP 6144:ZVKpftK2A7ey6z20IJH4tsqtHJWj7pLoNam7nxDrMQW3dLG5wCNcKR4ce4NLfHxH:9R7eVI4tscJWC5Bq3d65wC8TO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
597874
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
576KB
Virtual Size
575KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 71506a3322b0e0bc6fc2c1a1f0ac844a82a8c3fbbfeb4e6452013b4ade7610fb
- MD5 ee754ea777505e2fd2870afb325f50e8
- SHA1 be8724e9bd48665ae0c6eedbaf8de23e5987dc45
- SHA512 a6b4acf8c94f1284458a950582ef18adfeac1496e26f537ea21c22f3574b3cffa48e547ea1b9804c45633e12b53c3f1ac1e2d536e150c84ddcbfc9223f525d85
- SSDEEP 12288:td5UKfiOLkxMAgyJ/4zBSqGuKCYminksnkyr2OMnVVs4OgcwdPsc:X5LAHPDuKC8n/dCD9Zsc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
617534
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
595KB
Virtual Size
595KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1024B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d
- IMPHASH ccdfcfe3b09ab1ac2d74e3c88d512281
- SHA256 734b9974ec7f673460deb7ae17af4eed0ad6fae862f0765068430050fc44d66d
- MD5 3bf9acee0ccca5d14b24d3d148e9e77d
- SHA1 e8f53145aad88480e9a055a4549aa5eaa631a51c
- SHA512 0a5bdab9e3c2aaf835d2263f4658a5c0e5021eed402e976d0e7e89dab41416ba3cd5767980396d769d0f6a993d5f0ff3294dcdfc7189c45480ef7a366961a63e
- SSDEEP 12288:miDzq+QQi5v6xH8HeYkqBeJEk3QgO92TWQunZxpFremjq8txlr:Hzq+Q3F6xHAJkEkAd9cuZfTO8Rr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
17060
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WaitForSingleObject
SetComputerNameW
AddConsoleAliasW
GetComputerNameW
GetModuleHandleW
EnumCalendarInfoExW
GetConsoleAliasesA
GetNumberFormatA
GetConsoleTitleA
GetWindowsDirectoryA
GetConsoleAliasExesW
EnumTimeFormatsA
EnumTimeFormatsW
CreateActCtxW
SetProcessPriorityBoost
FindResourceExA
GetCalendarInfoW
GetSystemWindowsDirectoryA
FindNextVolumeW
Beep
GetConsoleFontSize
lstrlenW
GlobalUnlock
GetShortPathNameA
GetCPInfoExW
SetLastError
GetProcAddress
GetLongPathNameA
VirtualAlloc
HeapSize
IsBadHugeWritePtr
QueryDosDeviceA
EnumSystemCodePagesW
SetThreadPriorityBoost
LoadLibraryA
WriteConsoleA
InterlockedExchangeAdd
LocalAlloc
RemoveDirectoryW
WriteProfileSectionW
AddAtomA
FindAtomA
EnumResourceTypesW
GetModuleFileNameA
GetOEMCP
GetDefaultCommConfigA
SetConsoleCursorInfo
GetConsoleTitleW
WriteConsoleOutputAttribute
GetDiskFreeSpaceExW
WriteFileEx
DeleteTimerQueueTimer
SuspendThread
RaiseException
GetModuleHandleA
GetLocaleInfoA
GetConsoleAliasA
ReadConsoleA
lstrlenA
SystemTimeToFileTime
BeginUpdateResourceW
FindResourceA
MultiByteToWideChar
GetCommandLineA
GetStartupInfoA
HeapAlloc
GetLastError
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
GetCPInfo
GetACP
IsValidCodePage
SetUnhandledExceptionFilter
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
ToAsciiEx
ChangeMenuA
CharLowerBuffW
CreateAcceleratorTableW
GetWindowLongW
GetSysColorBrush
SetCaretPos
ModifyMenuA
IsCharAlphaNumericA
GetKeyNameTextA
gdi32
GetCharWidthA
GetCharABCWidthsW
CreateHalftonePalette
advapi32
BackupEventLogA
Name
.text
Size
642KB
Virtual Size
642KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
154KB
Virtual Size
154KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=34, id=132, productName=VS2008 build 21022, version=21022,
count=25, id=149, productName=VS2008 build 21022, version=21022,
count=97, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740
- IMPHASH 1f9568b44e21b4f75fdcd8e1b27ff01b
- SHA256 81a27b3dcfbd52ceb68043465a9aaa3ff6a2e4d04e487197bb23db5c76eec740
- MD5 7d1c7ce6a2f202bb5df3f45c7f62bac3
- SHA1 50a9f5b3130b14d5a18b418e9c355586eaecf4fb
- SHA512 48b20444b0d72a37ecbed0969e2a9d9be3efc51d75e1283bc755cad10068fb40055430dc1fc4b295aae3d31d71de86d84b4f1c29da8636a3ef0baf014eaf82cd
- SSDEEP 24576:RsBH9jqVwCwh/RICu4upRwIzAKXRYVN2uaj7MM1By+hm:uH9jJ9RspRwIDRiJak2By+hm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
512977
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetModuleFileNameW
SetErrorMode
WaitForMultipleObjectsEx
FindClose
GetFileAttributesW
GetSystemDirectoryW
GetComputerNameExW
MultiByteToWideChar
FormatMessageW
GetLastError
SetEvent
GetDiskFreeSpaceExW
WaitForSingleObjectEx
CloseHandle
HeapAlloc
GetLogicalDriveStringsA
GetProcAddress
LocalFree
ReleaseSemaphore
GlobalMemoryStatusEx
GetModuleHandleW
CopyFileW
WideCharToMultiByte
GetConsoleWindow
FormatMessageA
CreateSemaphoreA
CreateEventA
lstrcmpW
SetConsoleTitleW
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
FindNextFileW
HeapFree
FindFirstFileW
GetProcessHeap
CreateDirectoryW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
HeapSize
HeapReAlloc
ReadConsoleW
ReadFile
CreatePipe
GetExitCodeProcess
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
CreateFileW
DeleteFileW
GetFileAttributesExW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
MoveFileExW
AreFileApisANSI
ResetEvent
OpenEventA
SetWaitableTimer
Sleep
GetCurrentProcessId
ResumeThread
GetLogicalProcessorInformation
GetModuleHandleA
CreateWaitableTimerA
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibrary
FreeLibraryAndExitThread
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
CreateTimerQueue
LoadLibraryW
WaitForSingleObject
RtlUnwind
RaiseException
ExitProcess
GetModuleHandleExW
CreateProcessA
ExitThread
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
user32
ShowWindow
GetWindowTextA
EnumWindows
GetWindowTextLengthA
advapi32
CryptReleaseContext
CryptAcquireContextA
GetUserNameW
CryptGenRandom
shell32
ShellExecuteW
ws2_32
socket
send
WSAStartup
connect
gethostbyname
closesocket
WSACleanup
recv
htons
shlwapi
PathIsNetworkPathA
netapi32
DsRoleGetPrimaryDomainInformation
NetUserEnum
NetApiBufferFree
Name
.text
Size
809KB
Virtual Size
809KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
239KB
Virtual Size
239KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
32KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=241, version=40116,
count=179, id=243, version=40116,
count=31, id=242, version=40116,
count=24, id=259, version=27316,
count=131, id=261, version=27316,
count=35, id=260, version=27316,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=194, id=1, productName=Unmarked objects,
count=49, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=2, id=265, version=27508,
count=1, id=255, productName=VS2019 v16.0.0 build 27508, version=27508,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.0.0 build 27508, version=27508,
a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46
- IMPHASH cda48ebb1fe57d9b31da3a94fc154bf3
- SHA256 a1bd0fa8ada1da0181b8d108ca72a41795b55060613e0182f2cbbc592f857f46
- MD5 b0475c2ee7b9c7f2ed5a8d6d8a8c4b5d
- SHA1 18845f37a2ffa83d62eed48f608019b1200f5ee2
- SHA512 6b860b7e7ed3f2e459e825df5e4c7d2e571c1b6dd922d8b57aeda1842463f66742e7365687ec45bc348efdde27441960f04e42b94e796fa80ef9383a7ad0cc47
- SSDEEP 12288:aSVJ90fbghORSIZgVf4wYDfpCwmx1jGHL+gQqGjcj366YEwrJUDHeW9:aSVGbghTVf5FXqIqGjcj36gYnW9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
21402
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateFileA
FindFirstChangeNotificationW
GetConsoleAliasesLengthW
PeekNamedPipe
SetEndOfFile
CancelWaitableTimer
CreateHardLinkA
FreeEnvironmentStringsA
GetTickCount
GetDateFormatA
ReadConsoleInputA
SizeofResource
GetFileAttributesW
FileTimeToSystemTime
GlobalUnlock
GetShortPathNameA
FindFirstFileA
GetLogicalDriveStringsA
GetLastError
SetLastError
GetTempFileNameW
AttachConsole
VirtualAlloc
BeginUpdateResourceW
LoadLibraryA
SetConsoleCtrlHandler
SetFileApisToANSI
OpenJobObjectW
FoldStringA
GetModuleHandleA
SetCalendarInfoA
FindFirstVolumeW
ReadConsoleOutputCharacterW
GetLocaleInfoA
GetProcAddress
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
LoadMenuA
DdeQueryStringW
GetClassInfoExW
GetKeyNameTextW
CharToOemBuffW
GetMessageExtraInfo
gdi32
CreateDCA
Name
.text
Size
652KB
Virtual Size
652KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
31.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=149, productName=VS2008 build 21022, version=21022,
count=109, id=131, productName=VS2008 build 21022, version=21022,
count=38, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=112, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a465bc08714bc760130a3f150a704df2f08af083b2aaf0c931e714019f3769e3
- MD5 39b1a5e9d1c343a1a2a29247f9ec5699
- SHA1 5e6f9e075d196de2613f8023a672f1e72fce331e
- SHA512 b4611ded931f492d28d6da42062d891483656e6b5983e349e54b3dfb200f43c29bef3f5b53b13c3e18d449f1b0ab0c2859235411b9287b37439b83be2aa91688
- SSDEEP 12288:jueNLldLN97ji4pSc9B/CfvgLMfedSaPLaz7hyViDK:juqldL/3da9fqhaz74V
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
420910
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
403KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
a4dfaa8bbce586a593a86aa0e8e6c3e799d2a18b7e02d20284e83ff6f723c0d9
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a4dfaa8bbce586a593a86aa0e8e6c3e799d2a18b7e02d20284e83ff6f723c0d9
- MD5 a7f8ba68a6b437f021bf0eb0d46f9611
- SHA1 0234841ffe0878d26939082890ee5f971560e388
- SHA512 1ad8706704f4648514573a8681f67247f43baee3e480fd84945bc84ca746d8a32be68298f2eb0f7d3d0106bc8d423fcda6b7ab4bfd5987f0e05b9dbc27b580b2
- SSDEEP 12288:9VrCTSKp/ZwxgoSRn0SrmXeiFWNS7Ro5hnyRIA:WSE/ZMglR0SVA7unU
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
395010
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
378KB
Virtual Size
377KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
67KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ae6f3869929b1d021a10bd51dc1aace28bec1a4b000085b477c1e470b73e77fe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ae6f3869929b1d021a10bd51dc1aace28bec1a4b000085b477c1e470b73e77fe
- MD5 b1db148752b4c3a8455aa205d6018df6
- SHA1 cfa6a7d8733ec733cbee44df9193d0ecd4ce8c74
- SHA512 58332ec7a4acdddfac178fa6741a8f3eb1d1444058aed60d9ed4a3a0944563700a5cb21f341dd4ac877fc00ead2adf09239ecc261ba9d3596a2e212b18c9929c
- SSDEEP 6144:9SFuGFKHoOcmWNMzsOoQrBruGFKHoOcmWNMzsOoQrBOg:9SFJKHCmiMACdrJKHCmiMACdO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
317422
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
302KB
Virtual Size
301KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2
- IMPHASH aa822b1bc62e9f028a1a5882deaba84c
- SHA256 bdd9dbc6d72ecc5ea0a063a1fc99e414a4cff177ec8726da0011134d8589c7d2
- MD5 837d96ee65e177210ad77e0b7a3e2ee1
- SHA1 9f96a1acbcf006bf9cc61119dc76ca47adf63066
- SHA512 3369cccd102ef223a3d3bcb8b7cd11bc409cdb63bbbce33c8bbd05e6b52bc32b2a9c3ff29202e8107da6eab04e61fab0a7645631821d37bc3120dfe86bc26a62
- SSDEEP 24576:O2LUPOg0SCp3G6xyYR+lsxJR5eZsQbqlxpBVjmbtgkT:rAV0SCEuaWlHjkZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
838228
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
oleaut32
SysFreeString
SysReAllocStringLen
SysAllocStringLen
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit
GetErrorInfo
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameA
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
user32
MessageBoxA
CharNextW
LoadStringW
PeekMessageW
MsgWaitForMultipleObjects
MessageBoxW
GetSystemMetrics
CharUpperBuffW
CharUpperW
CharLowerBuffW
kernel32
Sleep
VirtualFree
VirtualAlloc
lstrlenW
VirtualQuery
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsDBCSLeadByteEx
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
GetConsoleCP
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
SetFilePointer
SetEndOfFile
ReadFile
GetFileType
GetFileSize
CreateFileW
GetStdHandle
CloseHandle
LoadLibraryA
TlsSetValue
TlsGetValue
LocalFree
LocalAlloc
WaitForSingleObject
WaitForMultipleObjects
VirtualQueryEx
VirtualProtect
VerSetConditionMask
VerifyVersionInfoW
SuspendThread
SizeofResource
SetThreadPriority
SetLastError
SetEvent
SetErrorMode
ResumeThread
ResetEvent
ReleaseMutex
QueryPerformanceFrequency
QueryPerformanceCounter
OpenMutexW
MoveFileExW
LockResource
LoadResource
LoadLibraryW
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVolumeInformationW
GetVersionExW
GetThreadTimes
GetThreadPriority
GetThreadLocale
GetSystemTimes
GetProcessTimes
GetLocalTime
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetDriveTypeW
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetComputerNameA
GetCPInfoExW
GetCPInfo
FreeResource
InterlockedCompareExchange
FormatMessageW
FindResourceW
FindNextFileW
EnumSystemLocalesW
EnumCalendarInfoW
DeleteFileW
CreateProcessW
CreateMutexW
CreateEventW
ole32
CoUninitialize
CoInitialize
shell32
SHGetSpecialFolderPathW
wsock32
WSACleanup
WSAStartup
gethostname
gethostbyname
inet_ntoa
netapi32
NetShareEnum
NetApiBufferFree
TMethodImplementationIntercept
Name
.text
Size
811KB
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
24KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
250B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
270KB
Virtual Size
270KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
c475b20ef38d5ef011235eeaf75db5686a5fef724e3eb2fa3e8d4b056096fbb6
- IMPHASH a4559d1602669b68de352c9c26c5d967
- SHA256 c475b20ef38d5ef011235eeaf75db5686a5fef724e3eb2fa3e8d4b056096fbb6
- MD5 ccde533297eece153ce3814a12ab9806
- SHA1 f099640428da73a300479bc03aad0760409208a2
- SHA512 929d7f520749da20e050f14c12d3e1bd618ec7b9ede6f7be3e04771c94d4538386dbd2b9dfb6a4d5213f1a063a6cf6a9318dd81eeec3d4252fd818646264ccb6
- SSDEEP 12288:ovtehAAWqF0yc9hfnS99jpIiOKHa/vpwF9zOaCwXWqFv4fgD:oaEqFxwfno4+6/WKaC23FvUgD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
35673
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleAliasExesLengthA
GetCommState
WaitNamedPipeA
GetLogicalDriveStringsW
GlobalSize
CreateHardLinkA
WaitForSingleObjectEx
ReadConsoleW
EnumResourceTypesA
SetHandleCount
LoadLibraryW
GetConsoleMode
InterlockedPopEntrySList
GetWriteWatch
GetFileAttributesW
WriteConsoleW
GetModuleFileNameW
GetCompressedFileSizeA
CreateActCtxA
WritePrivateProfileStringW
GetConsoleAliasesW
GetStdHandle
SetLastError
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
EnumSystemCodePagesW
CreateMemoryResourceNotification
FindResourceExW
GetNumaHighestNodeNumber
LoadLibraryA
LocalAlloc
DnsHostnameToComputerNameA
WriteProfileSectionW
FoldStringA
GetModuleHandleA
GetCommTimeouts
FreeEnvironmentStringsW
GetConsoleTitleW
GetShortPathNameW
DeleteTimerQueueTimer
GlobalAddAtomW
DebugBreak
ReadConsoleOutputCharacterW
EnumCalendarInfoExA
DeleteFileA
FlushFileBuffers
CloseHandle
CreateFileA
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
GetConsoleCP
lstrcpynA
IsBadStringPtrW
FindVolumeClose
SearchPathA
SetDefaultCommConfigA
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
HeapFree
MultiByteToWideChar
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetCPInfo
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameA
HeapAlloc
HeapCreate
VirtualFree
HeapReAlloc
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
GetEnvironmentStringsW
GetCommandLineW
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetFilePointer
user32
RealChildWindowFromPoint
ScreenToClient
GetKeyNameTextA
LoadMenuA
MessageBoxIndirectA
GetDC
GetKBCodePage
GetScrollInfo
SetMenuDefaultItem
GetShellWindow
gdi32
GetCharABCWidthsA
CreateDiscardableBitmap
GetCharWidthI
advapi32
GetEventLogInformation
Name
.text
Size
692KB
Virtual Size
692KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=149, productName=VS2008 build 21022, version=21022,
count=54, id=132, productName=VS2008 build 21022, version=21022,
count=126, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=146, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
d57ee4f41d4df716e6270a147e098aabb6cac69a1d5812b1f21f0bf17a9c7db5
- IMPHASH 6847c4a23533c8db62ddf8eb8d214ba0
- SHA256 d57ee4f41d4df716e6270a147e098aabb6cac69a1d5812b1f21f0bf17a9c7db5
- MD5 2d662c96ca0138576097cd5ab7635742
- SHA1 22d4c4b8eb962f02c30a17773af49e307c7f0a07
- SHA512 4be88ee2c4fd20681649f2aef7e3e773fb5d5991ac97afa308f1947ff7721fd42b699417d813201564ded2bbb3a97334936a4210c9f161bbba794335c19daecb
- SSDEEP 24576:kSz3eDBSCHkYRCSvEhJh2tloNaq2eK0JJ6U:kSyDYMDRxEhuL0K0JJ6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
35851
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetVolumeNameForVolumeMountPointA
GlobalFix
CreateFileA
SetDefaultCommConfigA
GetDriveTypeW
AllocConsole
InterlockedIncrement
SystemTimeToFileTime
EnumCalendarInfoW
GetProfileSectionA
GetUserDefaultLCID
MoveFileWithProgressA
GetModuleHandleW
GetTickCount
ReadConsoleW
TzSpecificLocalTimeToSystemTime
SetHandleCount
AllocateUserPhysicalPages
GlobalAlloc
GetPrivateProfileIntA
AddRefActCtx
SetFileShortNameW
LoadLibraryW
IsProcessInJob
GetCalendarInfoW
SetVolumeMountPointA
GetConsoleAliasExesLengthW
GetFileAttributesA
GetFileAttributesW
GetOverlappedResult
GetVolumePathNameA
GetStringTypeExA
GetProfileIntA
ReleaseActCtx
SetLastError
GetProcAddress
SetComputerNameA
SearchPathA
GetTempFileNameA
LoadLibraryA
WriteConsoleA
MoveFileA
FindFirstVolumeMountPointW
RemoveDirectoryW
BeginUpdateResourceA
AddAtomA
GlobalWire
GetModuleFileNameA
FindNextFileA
SetLocaleInfoW
lstrcatW
FreeEnvironmentStringsW
GetConsoleTitleW
GetCurrentDirectoryA
EnumDateFormatsW
CompareStringA
SetCalendarInfoA
SetThreadAffinityMask
DeleteFileW
DebugBreak
EnumSystemLocalesW
AreFileApisANSI
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetLastError
HeapFree
DeleteFileA
ExitProcess
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
HeapAlloc
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
HeapCreate
HeapSize
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
WriteFile
GetStdHandle
GetModuleFileNameW
GetEnvironmentStringsW
GetFileType
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
CloseHandle
WriteConsoleW
SetStdHandle
CreateFileW
Name
.text
Size
107KB
Virtual Size
106KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
616KB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=25, id=158, productName=VS2010 build 30319, version=30319,
count=44, id=171, productName=VS2010 build 30319, version=30319,
count=118, id=170, productName=VS2010 build 30319, version=30319,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=130, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
- IMPHASH ef163fd1a1dfd01940ab083fe4660afa
- SHA256 d68e18e28f3ba8db95da24be50e918d9254214079f1394eb55ce53f772041664
- MD5 c2273e3679c0660d8b4cd294ec6f88a7
- SHA1 1b01c714e54dca1c562ccb77e746a9645eee7cfc
- SHA512 afd5b5181184449327e77cd116939d5c4c5bb83b4e4e70dc7d7e0579d4b4d66508b238d55a8f05bed9d0df9da6b286ccd2d805140e82db00d943b7fd11e56d4d
- SSDEEP 12288:eUA2qsjkyttrPtbOygEHNSMai7TIyBcWlsa9ccLgNEc2NHCS+1przL/AtSa:fUitB6hknXBbsaVLgNEceHCS+DzAtS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
15846
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
FindFirstFileW
SetThreadContext
FindFirstChangeNotificationW
PeekNamedPipe
SetEndOfFile
LoadResource
SetConsoleTextAttribute
GetLogicalDriveStringsW
FreeEnvironmentStringsA
GetModuleHandleW
GetTickCount
GetDateFormatA
LoadLibraryW
IsValidLocale
ReadConsoleInputA
GetFileAttributesA
FileTimeToSystemTime
GlobalUnlock
GetShortPathNameA
GetLastError
GetProcAddress
VirtualAlloc
CreateFileA
BackupWrite
GetTempFileNameA
CreateHardLinkW
OpenJobObjectW
FoldStringA
GetModuleHandleA
FindFirstVolumeA
ReadConsoleOutputCharacterW
CloseHandle
HeapSize
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
RaiseException
LoadLibraryA
BeginUpdateResourceW
HeapFree
MultiByteToWideChar
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
HeapCreate
VirtualFree
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
HeapReAlloc
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
SetFilePointer
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
user32
CharToOemBuffA
GetKeyNameTextA
GetClassInfoExA
GetMessageExtraInfo
ChangeMenuA
LoadBitmapA
GetParent
LoadMenuA
DdeQueryStringW
CopyIcon
FlashWindow
gdi32
GetCharWidthI
Name
.text
Size
642KB
Virtual Size
641KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
319KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=34, id=132, productName=VS2008 build 21022, version=21022,
count=24, id=149, productName=VS2008 build 21022, version=21022,
count=116, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=124, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
dd6ac617529eed1916db34c8875f09f127ba3d2ff304352df29fdef4802143fd
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dd6ac617529eed1916db34c8875f09f127ba3d2ff304352df29fdef4802143fd
- MD5 0a26cdf1f3070aa8e26290dc400d734f
- SHA1 f0b2fbc8bda0c524e4567ba2056d763bfcb15501
- SHA512 70fbe0067a8a59930632234e549797cee987dcc29acc733c4192e790032411a89863d39f61570c2f020d9b01c729153a2363c0000fe8dda0dd8f62df9bb52823
- SSDEEP 12288:CLKafDW3j5MF46IQ4M7ODpoaVNThxKVmx3LoalDW3j5MF4t:+KYStLBQ4MA6CnK+oYStzt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
407630
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
390KB
Virtual Size
390KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
138KB
Virtual Size
138KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
e1bc3d93383ffb9540f20a1b58e4b3bb77ba24d247a1177030be6fe93d912136
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e1bc3d93383ffb9540f20a1b58e4b3bb77ba24d247a1177030be6fe93d912136
- MD5 1b2fedadc6c80dc4b80e33de9a4aee88
- SHA1 eeb2faad3694dca7a8ed9baf6e606a0be6cda140
- SHA512 1bcfaaf1a538f0064e730005aa4f7405cff62effc0af7428669e79a5981b138964509ecefbe00fca3a45988b9a5dfda0f8dad1a54e3264f83d8d65ed3944a396
- SSDEEP 24576:7+hUeaHWqsD00k0vbw9/iiwy2L29f9/4vodCUDK2Qn8PF6OQnFLy:769a2qsD00k0vbw9/iiwy2L29fB4vlUH
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1012974
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
981KB
Virtual Size
981KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.sdata
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
ea62bfae07927cc7fd706948ae7e474f4c0d7ed2afcb7c73c388e5f6936f5c29
- IMPHASH 4b932974a1b8b4dec33cf044302323ec
- SHA256 ea62bfae07927cc7fd706948ae7e474f4c0d7ed2afcb7c73c388e5f6936f5c29
- MD5 ca4d63933be52108b1e25969f7f3210b
- SHA1 febc09c676026fbef3a3d1c91b801ee10cd71b41
- SHA512 343a956fbb67622891a7c7475008c5226c77af0e1d622cf972767af9e11ab85149e503e3ed0d5b51fa0c92356d6a04307b3d3281773c8804e7c4387e2fd4c9bd
- SSDEEP 24576:m6FBigPov3pjeA+07ASgSl+YYxJuWMvV36/K+VLebSKLvBTyPj+dyqG+G0b1:XBiz3w3eqi+mfJujkyqG+tx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
669354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ws2_32
recv
ntohl
gethostname
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
closesocket
normaliz
IdnToAscii
wldap32
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord301
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
ord200
ord22
crypt32
CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
advapi32
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
kernel32
HeapFree
HeapAlloc
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetACP
GetCommandLineW
GetCommandLineA
WriteFile
GetModuleFileNameA
GetDateFormatW
SetFilePointerEx
GetModuleHandleExW
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDriveTypeW
RaiseException
RtlUnwind
WaitForSingleObject
LoadLibraryW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetExitCodeProcess
CreateProcessA
SetStdHandle
GetTimeZoneInformation
HeapReAlloc
HeapSize
FindFirstFileExA
IsValidCodePage
FindNextFileA
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
WriteConsoleW
SetEndOfFile
ExitProcess
CreateFileW
GetLogicalDrives
FindFirstFileW
Process32First
FindNextFileW
TerminateProcess
GetDriveTypeA
FindClose
OpenProcess
CreateToolhelp32Snapshot
Process32Next
CloseHandle
FreeConsole
lstrcmpW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetLastError
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetTickCount
Sleep
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
WaitForMultipleObjects
SetLastError
FormatMessageA
VerSetConditionMask
VerifyVersionInfoA
CreateFileA
GetFileSizeEx
GetCurrentThread
GetThreadTimes
UnregisterWaitEx
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
AreFileApisANSI
GetModuleHandleW
CopyFileW
MoveFileExW
FormatMessageW
GetStringTypeW
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetExitCodeThread
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetModuleFileNameW
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
Name
.text
Size
954KB
Virtual Size
954KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
215KB
Virtual Size
214KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
54KB
Virtual Size
54KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=23, id=241, version=40116,
count=186, id=243, version=40116,
count=31, id=242, version=40116,
count=6, id=199, version=41118,
count=26, id=259, version=26706,
count=131, id=261, version=26706,
count=37, id=260, version=26706,
count=42, id=261, productName=VS2019 v16.0.0 build 27508, version=27508,
count=255, id=1, productName=Unmarked objects,
count=13, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=107, id=260, productName=VS2019 v16.0.0 build 27508, version=27508,
count=1, id=265, version=27027,
count=1, id=255, productName=VS2017 v15.9.7 build 27027, version=27027,
count=1, id=258, productName=VS2017 v15.9.7 build 27027, version=27027,
f2cafb550a0b7c248847d2548389379d0d8954335d81d60991a4d1e7333745b4
- IMPHASH ac131d702ee16feb46717282d66c3824
- SHA256 f2cafb550a0b7c248847d2548389379d0d8954335d81d60991a4d1e7333745b4
- MD5 564a7404616422977544ce1c40336e62
- SHA1 144e519cb062184244c2eddcacfaf43c9f8c049c
- SHA512 054efc72ad85ddb8fbe075f8c04954451f147e48cd8dfbfe9dc65e88438356ec707c0eef51a70e8d3285539eff943a40765511c0cda398f253a993c80627cb9e
- SSDEEP 3072:2XylCF/CdoxXJUcFKpv+P1u+0/t1W55JvlCykvxVORWDMtBYcqF0NqNKB9nvU44/:mZKdAKph+0/iJvoDMhqF1KX2B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4516
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
_CIcos
_adj_fptan
__vbaLenBstr
_adj_fdiv_m64
_adj_fprem1
__vbaHresultCheckObj
_adj_fdiv_m32
_adj_fdiv_m16i
__vbaObjSetAddref
_adj_fdivr_m16i
_CIsin
__vbaChkstk
EVENT_SINK_AddRef
__vbaStrCmp
DllFunctionCall
__vbaRedimPreserve
_adj_fpatan
__vbaRedim
EVENT_SINK_Release
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
__vbaFPException
_CIlog
__vbaNew2
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
_adj_fdivr_m32
_adj_fdiv_r
ord100
_CIatan
_allmul
_CItan
_CIexp
__vbaFreeObj
Name
.text
Size
384KB
Virtual Size
383KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=4, id=9, version=8041,
count=1, id=13, version=9782,