3f66bd7050539f98a0373aec978cfc73
- SHA256 e0f492b56cdde36c64daa34406e43e16113e7b7e43952895529dea6b65eacd6b
Overview
overview
10Static
static
8BuhtaClient.vbs
windows7-x64
1BuhtaClient.vbs
windows10-2004-x64
1BuhtaClient.exe
windows7-x64
10BuhtaClient.exe
windows10-2004-x64
10BuhtaDev.chm
windows7-x64
1BuhtaDev.chm
windows10-2004-x64
1BuhtaPivot.xls
windows7-x64
1BuhtaPivot.xls
windows10-2004-x64
1BuhtaServer.exe
windows7-x64
1BuhtaServer.exe
windows10-2004-x64
1PivotInstall.exe
windows7-x64
1PivotInstall.exe
windows10-2004-x64
1dsd.exe
windows7-x64
1dsd.exe
windows10-2004-x64
1eapi.dll
windows7-x64
3eapi.dll
windows10-2004-x64
3quricol32.dll
windows7-x64
1quricol32.dll
windows10-2004-x64
3Behavioral task
behavioral1
Sample
BuhtaClient.vbs
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
BuhtaClient.vbs
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
BuhtaClient.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
BuhtaClient.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
BuhtaDev.chm
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
BuhtaDev.chm
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral7
Sample
BuhtaPivot.xls
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
BuhtaPivot.xls
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
BuhtaServer.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
BuhtaServer.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
PivotInstall.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
PivotInstall.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
dsd.exe
Resource
win7-20231215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
dsd.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
eapi.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
eapi.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
quricol32.dll
Resource
win7-20231215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral18
Sample
quricol32.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target 3f66bd7050539f98a0373aec978cfc73
- Size 15.7MB
- Sample240104-aj1tlafee3
- SHA256 e0f492b56cdde36c64daa34406e43e16113e7b7e43952895529dea6b65eacd6b
- MD5 3f66bd7050539f98a0373aec978cfc73
- SHA1 ecc1a246b42303a22e535ab829e1311500ebbc14
- SHA512 e5bc6ecad9feed52a13393c31e3953982d2bfe2eb68a3c51ff8b5b05aac0391e40ffb2fdb850fe7e225e01b357e42182d79ca0bc62a18495eac48b0ac5ef9ebb
- SSDEEP 393216:uktNbtNH3Gs5j887Hhv5epWgmgEtJ+HpaAekDaWHXT:ukDbtNH35jt750lmwHptZDaWHj
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Office macro that triggers on suspicious action 1 IoCs
Office document macro which triggers in special circumstances - often malicious.
resource yara_rule static1/unpack001/BuhtaPivot.xla office_macro_on_action -
resource static1/unpack001/BuhtaPivot.xla -
resource yara_rule static1/unpack001/BuhtaClient.exe aspack_v212_v242 - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/BuhtaClient.exe unpack001/BuhtaServer.exe unpack001/PivotInstall.exe unpack001/dsd.exe unpack001/eapi.dll unpack001/quricol32.dll
File Explorer
-
3f66bd7050539f98a0373aec978cfc73.rar 15.7MB
-
BuhtaClient.etl.vbs 5.7MB
-
BuhtaClient.exe.exe 12.9MB
-
BuhtaDev.chm.chm 396KB
-
BuhtaDev.lst39KB
-
BuhtaPivot.xla.xls .xla 59KB
-
BuhtaServer.exe.exe 1.4MB
-
Buhta_Show_FieldName_MSWordForm.frm891B
-
Buhta_Show_FieldName_MSWordForm.frx3KB
-
Buhta_Show_FieldNames_List_Form.frm1KB
-
Buhta_Show_FieldNames_List_Form.frx3KB
-
ExpressSpreadSheet.HLP938KB
-
ExpressSpreadSheet.cnt21KB
-
Fruser.cnt1KB
-
Fruser.hlp108KB
-
PivotInstall.exe.exe 524KB
-
dsd.exe.exe 1.3MB
-
eapi.dll.dll 148KB
-
quricol32.dll.dll 218KB
BuhtaClient.etl
- SHA256 5983718f774db2d1e7842dfe24e7c29dceda82569719c9e74b4227e7ff5904ab
- MD5 478fe388cc5749c07fc2f21dbabe25c0
- SHA1 e0acd04d2f7f88b47bd82abb7819d1b273eaa4e7
- SHA512 fb3ef8591b036f42e4346ff39287867e972bbe88005529f3ffa112d2b972c7f0c48ad5179078514e700823711041b2e7f9c57960d55961d6dd1ee4d39fc8710c
- SSDEEP 98304:noQSO6ZRVtW4tiyR/Mx2pkujlme8n1cOnJO:m
- MD5 SHA1 SHA512 SSDEEP
BuhtaClient.exe
- SHA256 612a2dcda3fcec5e2b4e0ca7c6f99952ef9274a482445c439261597884db5848
- MD5 c82005128e4de1cad09fbde5fdef3290
- SHA1 f4cfb7e40efb4a2a74ef734cb7dc0b70d2348ab4
- SHA512 622d8f81193d57c30ffa12b8f3d4ada6d52d6fe229d2b0a9b6fe79f52dd531ecc25334d2016204e943efe1060267aa323d446b88d783fd4e20b68fbc88af2d13
- SSDEEP 196608:tenHQWQw5KP+4OQF51fa51F5zttrD2VmfXooAl2qSzTfv6YbKaqKpIPuS/HCQ:t+D5Kmk1CPz7rqvl2qS3X7ld
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
43020289
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
6.7MB
Virtual Size
23.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
DATA
Size
154KB
Virtual Size
308KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
7KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6.0MB
Virtual Size
16.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.aspack
Size
11KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
BuhtaDev.chm
- SHA256 2ac5beadb46df69331c214b01e7994415a15698605d04e8e2f87bea40c2d420d
- MD5 2c1e5c9bd8e1a7f5a01d6840b715bcfd
- SHA1 6261eb9affd394dfc01c8c645ef5fbd3c1b1c981
- SHA512 622192042802bdc90be8d5a96c126252be49ae3d1f51f7e40cd44d95de09110edff79934d50445297d79667d4b20d8da5c68b295f68fe0c50a25169634def0bb
- SSDEEP 12288:nZVyrEJf+EwUEZ+voA3dCeOty3OuRHgLDpGpEGy6ULe:nurEd+X+v/tCtQ3OuRApGiGCC
- MD5 SHA1 SHA512 SSDEEP
BuhtaDev.lst
- SHA256 dfadfc20703605508b54cb6be86f4a1357a66aab2448dc8e81fd9ccf785cb7b7
- MD5 1e2f3960b181beed6278ad0783efb934
- SHA1 bffd5863f00ab7b74a27f639bcc484d975a1806a
- SHA512 0ff2e9c29923eaeab569557f45ab7203c72c1f3b529d0e18aa450cf1dbbbdfa8e51df7a5fc89a01614487d5e76b64dbe6cb5ddfa2a9e591d541c234f3c1893dc
- SSDEEP 384:BNb+d4ni506pexIMFs1B1GjEtH/C51PEroQEnHx9RvHldVw815WCOYMP05mnenX/:W6XnIMFwB1GXrK8zWCOYT4nKu/MSysW
- MD5 SHA1 SHA512 SSDEEP
BuhtaPivot.xla
- SHA256 5596e8b493c644d62c9f6ab6f6a5d621ee2b348ef63d3270965b45021f308fe5
- MD5 8336b5a5ddf41cf813a1274a9543a34c
- SHA1 533c18a7ce7db70dbc026b2f70031d44e6207c8d
- SHA512 e2f24c6c2d233b175053a41e382d3b1a29984c3bd28341bdaeadea977137717fb5df86ea27df57461cf6328155c00282ed569603c63940593fe4b33e196639f9
- SSDEEP 768:To9kwJv744eN0WVkiPSx2o7piwJtNWVnBJIcXX3CWe5rMuh8tpd:8Owt744eN0WVJPSx2o7pi2ejAMuhc
- MD5 SHA1 SHA512 SSDEEP
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
ЭтаКнига
Лист1
frmBasesList
Module1
BuhtaServer.exe
- SHA256 6975ceb7195e32eac63305e885373aec1af90430a25ccd5db43156b732a297b7
- MD5 de55c646c8e87db58b124f8d76eb6e6b
- SHA1 264365cce261e6fad450671c5ccb7955ebfc5ab4
- SHA512 a642df8144aa100dbef032ddf7a94f361a4875ad9a2223b993ad5c0b500cc72b3c7e20f1399bc751755e4f7191b5523c28da234a2ebe04f776fad72bbe45d7a1
- SSDEEP 24576:TYlSIAplA/e2enRok1ezqvSwm+KqZjX/sHtaaF5eWEDaS8N:TmSIuUMR2C1PsHtaakF8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1208028
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
70KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Buhta_Show_FieldName_MSWordForm.frm
- SHA256 eb9705f61a2a68ea9015783311c4225eaccf30eed34eb117fc8d5f963f645681
- MD5 5505d3ed9e731d0589705a8416f7eaee
- SHA1 62493e681210c81e591c7f50f37184417743ebaa
- SHA512 14eaba39e36d7b89ff8b7faff47cf21584d680df94884134c64f13e08bb606c25cc3585fb2e45ca56570857512c4d8387ae15606072603d28cde32f2c37247fb
- MD5 SHA1 SHA512
Buhta_Show_FieldName_MSWordForm.frx
- SHA256 8524267406d3bfd804db101d4fc209d5e8d10569133346bec3935d84f3a99ed0
- MD5 cbd2841a84f781689cf9aeb508414044
- SHA1 ce3f129c909823fe110cee57b57165ae4eccf507
- SHA512 6673c8965796e770b346cab5639aac5cfdaee0609cfc39e121a4314951f5811d4903c831cc1f34288ad57d16fd39e69424438e9cbe16804c72f063874c49e8a6
- MD5 SHA1 SHA512
Buhta_Show_FieldNames_List_Form.frm
- SHA256 764c608ab140d4aa276c942fdce4dc8f183a95fd17fae14c7427a58e294fdb24
- MD5 31e81cbe9c45957c734220547bbcd9d2
- SHA1 75960747f340beedcac938e8ef4f98ca4ef916ae
- SHA512 319675b8d143d099d8b5996752f68b9db35d5f99711bf1c73892d3aa8c9aeb25a3e1dd94e41c8de919cae8b3f988a4de1928135476bfa0656730acbcac504a32
- MD5 SHA1 SHA512
Buhta_Show_FieldNames_List_Form.frx
- SHA256 9d00103d73e2c887c2d319483d2d71006f5f71697d3a6591eb39bca2116b46f2
- MD5 c725415ddb4eb4b68acacc69e95654db
- SHA1 8205fa5f7511f977fefb3461fbf4c60d77f0b580
- SHA512 6e369bbcea8e3fee4cc833f228b160ba4926f53b5c35e80bd6418f713f8f3d303dbffb9057d8ac109ad1f67295449bada7282b3c8d5127577d044f5a55d4db8e
- MD5 SHA1 SHA512
ExpressSpreadSheet.HLP
- SHA256 2e3e37eb92e7b86f7d9c1d363a0a4e6efbdf2dbaf3530a4c511607533de31fa1
- MD5 2193b860613b48740d565cf79508f3ad
- SHA1 bd7a02f340faf1dd7bfe434337c00ea7b965dc7c
- SHA512 e9e441c51db97da38b17dc656fe7309d88a622798cebb5a9beeb5e25cf6bdea707fb4a79c689c6cc46b0523cf99078b337cad80663a105fc2fc5d6076f5c3e99
- SSDEEP 12288:WB6HQmgIYlQ3guwJbUPVOyOc/qs4klwllS8EuutFHBEvo59AzLJocUNs3IH0zk3W:Qn/GVOyOubAIH7RxoBG/rEbWoELtjo
- MD5 SHA1 SHA512 SSDEEP
ExpressSpreadSheet.cnt
- SHA256 3c254039d609fd81c04d7e39e78a3182dd746d345495f0b875384e272d9c8de1
- MD5 3e1003d0efb52ea7473c3e315894cd7e
- SHA1 00073c996dc8b2d964f2916299c89bee30f8d8af
- SHA512 f97b309dfd8095fde43ab3ede0e4f35ff94526848572d33ebd577ac6ee5672e2ec993c658848a1c51c0266831b3440b442bc01043c289dd6b5ab131279195186
- SSDEEP 192:u02g0I/xK5bXHHnX3EshweV0hClLd/A0+SVKunW9j2s:f2cg5bXHHnX02weV0hCla0LKuW9h
- MD5 SHA1 SHA512 SSDEEP
Fruser.cnt
- SHA256 f8ccc69181eb596848b5f2e44e06bc4db345e74928d744cac753676cae116b44
- MD5 a7ec2a0f641d72424cf04705f1206a24
- SHA1 5464afbe2329889926a837ab765ae4460eb23efe
- SHA512 ed2a503fc22e64e3f5ff68da008c1aab6b8e2e00b739f46f1ed2c9c31e908e149e55aacb5b7806895c53cdcce732b90744d8ba956e057339304f01350c598f04
- MD5 SHA1 SHA512
Fruser.hlp
- SHA256 c5ae0d5fa20d272abf76dd9dbab69397041d3dcfcf276e190df9767b6fef8685
- MD5 3fea18d27712d7e160d362b5dd816aca
- SHA1 7b2a99f69e93a23f6177ad5641e62240f31ab198
- SHA512 95ae2e1d9006d1247be32e5b56bc25bdaa7ca83f0c51768ac0f45949a4342923d7698d84f9ec3c6b4a7a9f4081f5884e9d22bf931dbfcdb8be6d8638fe5084d4
- SSDEEP 3072:5GWvR+UC5vdofiBGYmr7dQWzn6IUP7KrdX4:5TvzfGjrWr6IUP7Ku
- MD5 SHA1 SHA512 SSDEEP
PivotInstall.exe
- SHA256 0f3d184c3cc0eea67094be3c5a3106ed5562b174fccdda8c149fbea451649650
- MD5 4954c61666de06dd164bd88f9bd56d23
- SHA1 131a6fe6a8b30c4bc81845ec1423c4ba94775b7d
- SHA512 d3b0858183893c77b5baddfda98d03a49975235301d4745e147af228d7be74e98c166ff28f7afdd1ccc89ccd1a6f9bb11563912a65f810981dd6f69dec4e1198
- SSDEEP 12288:pB5UbRnGaVwlLiJuLtiHzb3r5fjep7Nv8I2/Fi:pByM+wNiJg8HXBm7NvZQY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
416268
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
403KB
Virtual Size
402KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
78KB
Virtual Size
78KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
dsd.exe
- SHA256 a17c20f67896a4f5dc8d3cecabee3a7683d5a733661c5e2dba709536b572984b
- MD5 fd191953fd1eae16f7965ea88590b6ac
- SHA1 2abc414d3e3e9033a8bedb53122236fc762d6809
- SHA512 c9b3dfd1f6a11e6bcb6e156d42105c3d01d3ab3bf9c51ebc6d044d8f60d83e0814d7ead8b0c690b8377114018c6ec894a4b8c40c84dc14bfc78b324c440627a6
- SSDEEP 12288:/s+kHIGrKqDR/i6L6VxNm51ilbfbgzEGA3DfccoGRfPtJSy5i72C/PYBMLvOronT:EHIq69plbfbgzEGATfcwXx5iZMMzOK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1171268
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
20B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
115KB
Virtual Size
115KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
eapi.dll
- IMPHASH 603880d61e6dd7c491f461f080fa4a37
- SHA256 7de13885441baa0cca8e81bbd5d2dd2a7ba411156b897dbe2820d94b7589da10
- MD5 d7c65f338b7063e4337f25d1a511f723
- SHA1 e1eb90f87e0a9bde3e70c0f87c2fc368dc8092e9
- SHA512 a726112ab90e707acffe75cecb537b138a202657eb9167327a26d5db53d3a25609ff772896b2691fdfea2765417eafb1116e02b762c98cca4a08333a085067b6
- SSDEEP 3072:NjYQztF8U/iSj2Z94vefRvEjWZh8UlIX:30E2Z94vewGh8F
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
90911
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GetLocaleInfoA
GetThreadLocale
MultiByteToWideChar
WideCharToMultiByte
VirtualProtect
GetSystemTimeAsFileTime
GetCurrentProcessId
RaiseException
RtlUnwind
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCurrentProcess
GetCommandLineA
GetVersionExA
HeapAlloc
HeapFree
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetLastError
SetFilePointer
CloseHandle
WriteFile
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
VirtualAlloc
IsBadWritePtr
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
GetStringTypeA
GetStringTypeW
GetACP
GetOEMCP
GetCPInfo
InterlockedExchange
VirtualQuery
LoadLibraryA
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetSystemInfo
ole32
StgOpenStorage
StgCreateDocfile
_JeeBookAddDecoration@116
_JeeBookAddFontW@44
_JeeBookAddFormatW@8
_JeeBookAddSheetW@8
_JeeBookCreate@0
_JeeBookFree@4
_JeeBookGetSheet@8
_JeeBookGetSheetCount@4
_JeeBookReserveSheets@8
_JeeBookSave@8
_JeeBookSetCodepage@8
_JeeBookSetCountry@12
_JeeOleStreamCreateW@4
_JeeOleStreamFree@4
_JeeSheetAddBoolean@20
_JeeSheetAddDouble@24
_JeeSheetAddEmpty@16
_JeeSheetAddStringW@20
_JeeSheetMergeCells@8
_JeeSheetSetColumn@20
_JeeSheetSetFooterMargin@12
_JeeSheetSetFooterW@8
_JeeSheetSetHeaderMargin@12
_JeeSheetSetHeaderW@8
_JeeSheetSetMargins@36
_JeeSheetSetNameW@8
_JeeSheetSetPageOrientation@8
_JeeSheetSetPaperSize@16
_JeeSheetSetRow@12
_OptAddObject@8
_OptCreateOptimizer@0
_OptFreeOptimizer@4
_OptGetColCount@4
_OptGetColWidth@8
_OptGetObject@12
_OptGetObjectCount@4
_OptGetRowCount@4
_OptGetRowHeight@8
_OptOptimize@8
_OptPageBreak@4
_OptResetOptimizer@4
_OptSetMaxPieces@12
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
20KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=105, version=2067,
count=17, id=15, productName=VS2003 (.NET) build 3077, version=3077,
count=94, id=95, productName=VS2003 (.NET) build 3077, version=3077,
count=5, id=93, version=2179,
count=64, id=1, productName=Unmarked objects,
count=38, id=96, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=92, productName=VS2003 (.NET) build 3077, version=3077,
count=1, id=90, productName=VS2003 (.NET) build 3077, version=3077,
quricol32.dll
- IMPHASH f44ea95867dfd4a725b69e9377af75fe
- SHA256 90864d6b81ab5b6251e3739366f2cd8ffb9bccc7c08f9c39eb4b73db17f0401b
- MD5 19306dd58bbd42f9c4fba0072a6e810a
- SHA1 e6c01ab512806319db1745e73fbd55f3ac9298b3
- SHA512 01f9b18438737baaa523048f518385aabdef8417ea92e38f65c3c052036b70c9329e8f07ba47af5a32edd7948a1b81cc1173b9e60db00ba1c87e2ac5c86c4340
- SSDEEP 3072:Syy0/QPixg1FYvqMH5XuCtM7ZRA0ke9S7egumTBfCUuAg0Fu/5b8+zd:W0/Qqxg1FYvqMHpuCtR0VpgDTBqUuAO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
93600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
LocalFree
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
lstrlenA
WriteFile
CreateFileW
GlobalAlloc
ExitProcess
LocalAlloc
HeapAlloc
GetLastError
HeapFree
GetModuleHandleW
Sleep
GetProcAddress
RtlUnwind
HeapReAlloc
GetCurrentThreadId
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
DeleteCriticalSection
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleHandleA
RaiseException
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
SetStdHandle
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetEndOfFile
GetProcessHeap
ReadFile
CreateFileA
user32
GetDC
ReleaseDC
gdi32
DeleteObject
GetDIBits
GetObjectW
CreateDIBSection
DestroyBuffer
GenerateBMPA
GenerateBMPW
GeneratePNGA
GeneratePNGW
GetHBitmapA
GetHBitmapW
GetPNGA
GetPNGW
Name
.text
Size
158KB
Virtual Size
158KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=100, id=1, productName=Unmarked objects,
count=153, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=12, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,