7d0586a51e7d29f77e75dc831a150bfa
- SHA256 49cf9b024465dcbe2b3c77374895d1c715f9ea53d46f8e4b2104ee245e01d706
Overview
overview
10Static
static
10is155016.exe
windows7-x64
3is155016.exe
windows10-2004-x64
3setup_akl.exe
windows7-x64
3setup_akl.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3AKV.exe
windows7-x64
1AKV.exe
windows10-2004-x64
1HTV.dll
windows7-x64
3HTV.dll
windows10-2004-x64
3HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6HTV.dll
windows7-x64
1HTV.dll
windows10-2004-x64
1HTV.dll
windows7-x64
1HTV.dll
windows10-2004-x64
1HTV.chm
windows7-x64
1HTV.chm
windows10-2004-x64
1HTV.exe
windows7-x64
6HTV.exe
windows10-2004-x64
6Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7qs.html
windows7-x64
1qs.html
windows10-2004-x64
1Behavioral task
behavioral1
Sample
is155016.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
is155016.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
setup_akl.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
setup_akl.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
AKV.exe
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
AKV.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
HTV.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
HTV.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
HTV.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
HTV.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral13
Sample
HTV.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
HTV.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral15
Sample
HTV.dll
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
HTV.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
HTV.chm
Resource
win7-20231215-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
HTV.chm
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral19
Sample
HTV.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral20
Sample
HTV.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
qs.html
Resource
win7-20231129-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
qs.html
Resource
win10v2004-20231222-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target 7d0586a51e7d29f77e75dc831a150bfa
- Size 487KB
- Sample240128-nss21ahgh4
- SHA256 49cf9b024465dcbe2b3c77374895d1c715f9ea53d46f8e4b2104ee245e01d706
- MD5 7d0586a51e7d29f77e75dc831a150bfa
- SHA1 db55333f109056e00fa60ca6e1094b6b11278c2f
- SHA512 42924c8a624de73909175b4cc6ee8e46a0ec3625f0a445f95da16e5a64810589b4c99c32bab6c45a6963072463e2e467e448eb260cd609a005105c90ac5c4091
- SSDEEP 12288:gTRz+RidaaKbBEoUVSvVDyz1SQdLzt03nxaMQ6:gTgcaaKbBMAZI1SgUnxaX6
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Ardamax family
- Ardamax main executable 1 IoCs
resource yara_rule static1/unpack002/HTV.exe family_ardamax - Unsigned PE 10 IoCs
Checks for missing Authenticode signature.
resource unpack001/is155016.exe unpack001/setup_akl.exe unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/AKV.exe unpack002/HTV.003 unpack002/HTV.004 unpack002/HTV.006 unpack002/HTV.007 unpack002/HTV.exe unpack002/Uninstall.exe - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/setup_akl.exe nsis_installer_1 static1/unpack002/Uninstall.exe nsis_installer_1
File Explorer
-
7d0586a51e7d29f77e75dc831a150bfa.cab 487KB
-
is155016.exe.exe 92KB
-
setup_akl.exe.exe 418KB
-
$PLUGINSDIR/InstallOptions.dll.dll 14KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
AKV.exe.exe 395KB
-
HTV.003.dll 4KB
-
HTV.004.exe 14KB
-
HTV.006.dll 8KB
-
HTV.007.dll 5KB
-
HTV.chm.chm 33KB
-
HTV.exe.exe 473KB
-
Uninstall.exe.exe 43KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
menu.gif.gif 22KB
-
qs.html.html 1KB
-
tray.gif.gif 7KB
is155016.exe
- IMPHASH 0b0dd23e909dfb9249804d10e836b037
- SHA256 7095d5866f8378beffedf836e451cd0416d8342e39138d91bc3391d49f472e45
- MD5 cd5ca8c901b504506c16915ead6131f0
- SHA1 a49b2c83c00752c297579f32f4089555986a3e94
- SHA512 5ced517f81db55f0b3af70489efdb7a31898642b06a115c77651869383056253c4b179da6988ce3317a3f62584b99e7c84cf379a561667d1150b8feaa6a9f3e1
- SSDEEP 1536:HUqkw/OYBCDVZC6iaYXcnk737NZiaQ8EpIGkbzdW8hT/W0/V2hX9GD0a2pl/Iyi9:0OOYBCD1NkuvkbzIQW0/UX9Ay7zM
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4197
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
user32
DispatchMessageA
DialogBoxParamA
CreateMenu
CreateMDIWindowA
CreateIcon
CharUpperBuffA
CharUpperA
CharToOemA
ChangeMenuA
kernel32
GetSystemTime
lstrlenA
lstrcpyA
lstrcmpiA
lstrcatA
VirtualAlloc
TlsFree
SleepEx
SetLastError
RtlUnwind
CloseHandle
EnumResourceLanguagesA
EnumResourceNamesA
EnumResourceTypesA
GetLastError
GetPrivateProfileStringA
GetStartupInfoA
GetTimeFormatA
GetVersion
LoadLibraryA
MapViewOfFile
OpenFile
OpenFileMappingA
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=27, id=125, productName=VS2005 build 50727, version=50727,
count=436, id=1, productName=Unmarked objects,
count=25, id=123, productName=VS2005 build 50727, version=50727,
count=139, id=109, productName=VS2005 build 50727, version=50727,
count=91, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
setup_akl.exe
- IMPHASH b2a0d9368ec1be7deb968a920e5c993e
- SHA256 e2dc1886ca386f8717079b28cd52c1843de737ee24f2e521972730b9a6503c1f
- MD5 f6699e0d27e915996f33ddf617c9bf6c
- SHA1 74d69a9449331b90e46ae01577b4714b1a35391a
- SHA512 104451a409acf12db353259e86b00e40b079e657f2c456a9f339977cd0a972dc23af16d2f85da12b6728294560b3cf13afe380dafe1a87ba62c81ff72b127c54
- SSDEEP 12288:XDKLYe6zUbRrda8Kb9zoNVSbVhyzCe1PXcZgE:TKLuGJa8Kb9q+XI51PMZgE
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12901
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=154, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH b1cd0d78f652ce5fc63f0879371af012
- SHA256 ee0ad77e681c4d0fdf1d67df5f4ca03e6bdd8e3b05dfb47a83ad5c733ed62960
- MD5 296a5f3179fa8d7a7a855eaf696ede44
- SHA1 57aa5b71553ed282dd22c768e039a187f5c13f63
- SHA512 bc527d1485f468e8d098057e0e38e8cb7aa6eb64d4ca30927b99b1552a3177b132b989015ff95bdf2ca046bf11a54b4b456f51e024fbc734fbb548c3499e53f6
- SSDEEP 192:r6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTyK72dwF7dBdcQOz:r6JaVh4I5rpPbTy+BdhO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10795
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc
user32
MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
ole32
CoTaskMemFree
dialog
initDialog
show
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
1012B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=72, id=1, productName=Unmarked objects,
count=13, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-header.bmp
- SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
- MD5 173391c2c5228607d99ca65f29c8fb3e
- SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
- SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
- SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
AKV.exe
- IMPHASH a2f82bef64ddff8e99050308fc76380e
- SHA256 14116fa79ccc105fabd312b4dff74933f8684c6b27db37e5e3a79d159092d29a
- MD5 b8fa30233794772b8b76b4b1d91c7321
- SHA1 0cf9561be2528944285e536f41d502be24c3aa87
- SHA512 10ce8b18e7afb8c7e30bb90b0a1f199ef0b77873fa7a9efc596606e151be6b516c0ec6222a9032bdcc527e80964f53d20a28fa1881a08b4df303b2e28204549d
- SSDEEP 6144:qXXNW/g8zSQbXumJZwsP2IUPNF/GVx8MFC:+XbySQjuG/P2bd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
125984
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
UrlUnescapeW
PathFindExtensionW
PathRemoveFileSpecW
comctl32
ImageList_LoadImageW
ImageList_Add
ImageList_Replace
ImageList_Draw
ImageList_AddMasked
CreateStatusWindowW
ImageList_Destroy
InitCommonControlsEx
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Create
shell32
SHGetMalloc
SHGetPathFromIDListW
SHBrowseForFolderW
ShellExecuteW
kernel32
DebugBreak
InitializeCriticalSection
OutputDebugStringW
WriteFile
lstrlenA
GetProcAddress
InterlockedIncrement
EnterCriticalSection
ReadFile
GetFileSize
FileTimeToLocalFileTime
CompareFileTime
WideCharToMultiByte
WaitForSingleObject
FindClose
GetFullPathNameW
FindFirstFileW
FindNextFileW
SetFilePointer
HeapAlloc
HeapReAlloc
HeapFree
GetVersionExA
GetProcessHeap
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetModuleHandleA
ExitProcess
GetStdHandle
LeaveCriticalSection
HeapSize
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
Sleep
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
RtlUnwind
InterlockedExchange
LoadLibraryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
InterlockedCompareExchange
IsProcessorFeaturePresent
SetEndOfFile
lstrcmpiW
DeleteCriticalSection
GetTimeFormatW
FreeLibrary
GetDateFormatW
GetModuleFileNameW
FileTimeToSystemTime
RaiseException
LoadLibraryExW
SetLastError
SystemTimeToFileTime
FindResourceW
LockResource
lstrcpyW
LoadResource
CreateThread
SizeofResource
GetLastError
GetCurrentProcessId
GetVersionExW
FlushInstructionCache
GetModuleHandleW
GetCurrentProcess
CloseHandle
lstrcmpW
CreateFileW
MultiByteToWideChar
lstrlenW
MulDiv
InterlockedDecrement
GetStringTypeExW
LoadLibraryW
GetThreadLocale
GetCurrentThreadId
GetModuleFileNameA
VirtualQuery
user32
DrawEdge
SetWindowsHookExW
PostMessageW
DrawFrameControl
SetWindowPos
CallWindowProcW
SetWindowTextW
IsMenu
GetSysColor
InvalidateRect
IsWindowEnabled
DestroyMenu
SetRectEmpty
SetMenuDefaultItem
EndDeferWindowPos
DialogBoxParamW
MessageBeep
SystemParametersInfoW
LoadCursorW
SetWindowPlacement
DeferWindowPos
BeginPaint
GetSysColorBrush
BeginDeferWindowPos
GetWindowDC
DestroyCaret
GetMenuItemCount
IsWindowVisible
GetKeyState
EndPaint
SetDlgItemTextW
GetWindowPlacement
EndDialog
GetClassNameW
DispatchMessageW
GetMenuItemInfoW
RegisterClassExW
TranslateMessage
GetDlgCtrlID
TrackPopupMenuEx
ReleaseDC
TrackPopupMenu
ShowWindow
SetMenuItemInfoW
LoadImageW
GetMessageW
GetMonitorInfoW
EnableMenuItem
GetParent
GetClassInfoExW
SetRect
wvsprintfW
MonitorFromPoint
InflateRect
GetWindowTextW
GetWindowLongW
GetMessagePos
wsprintfW
SetScrollInfo
GetSubMenu
WindowFromPoint
UpdateWindow
DrawFocusRect
ScreenToClient
PeekMessageW
MapWindowPoints
PtInRect
DestroyCursor
GetWindowThreadProcessId
SendMessageW
MapVirtualKeyW
GetKeyNameTextW
CharUpperW
UnregisterClassA
DestroyWindow
LoadStringW
ModifyMenuW
OffsetRect
DrawTextW
FillRect
GetDlgItem
CopyRect
CreateWindowExW
GetWindowRect
LoadBitmapW
FrameRect
CallNextHookEx
SetWindowLongW
SetScrollPos
GetSystemMetrics
GetFocus
GetScrollInfo
IsWindow
CreateDialogParamW
EnableWindow
RemoveMenu
GetWindow
MessageBoxW
GetActiveWindow
AppendMenuW
SetMenu
CreatePopupMenu
ScrollWindowEx
ReleaseCapture
PostQuitMessage
GetMenu
GetDlgItemTextW
MoveWindow
LoadAcceleratorsW
GetClientRect
SetCursor
CharLowerW
SetFocus
DefWindowProcW
RegisterWindowMessageW
CharNextW
LoadMenuW
LoadStringA
GetDC
GetCapture
SetCapture
UnhookWindowsHookEx
GetCursorPos
gdi32
SetBrushOrgEx
DeleteObject
CreateFontIndirectW
PatBlt
GetTextExtentPoint32W
SelectObject
MoveToEx
CreateCompatibleBitmap
LineTo
CreateDIBitmap
SetTextColor
SetBkMode
SetViewportOrgEx
CreateDIBSection
DeleteDC
CreateCompatibleDC
CreateBitmap
CreatePen
CreateFontW
BitBlt
GetStockObject
CreatePatternBrush
GetObjectW
SetBkColor
comdlg32
GetSaveFileNameW
GetOpenFileNameW
advapi32
RegDeleteKeyW
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
ole32
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoInitialize
oleaut32
VarUI4FromStr
Name
.text
Size
306KB
Virtual Size
305KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=21, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=325, id=1, productName=Unmarked objects,
count=69, id=110, productName=VS2005 build 50727, version=50727,
count=46, id=125, productName=VS2005 build 50727, version=50727,
count=206, id=109, productName=VS2005 build 50727, version=50727,
count=8, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
HTV.003
- IMPHASH 7538179af5f471b14303746be79de809
- SHA256 d4eba51c616b439a8819218bddf9a6fa257d55c9f04cf81441cc99cc945ad3eb
- MD5 c3679c3ff636d1a6b8c65323540da371
- SHA1 d184758721a426467b687bec2a4acc80fe44c6f8
- SHA512 494a0a32eef4392ecb54df6e1da7d93183473c4e45f4ac4bd6ec3b0ed8c85c58303a0d36edec41420d05ff624195f08791b6b7e018419a3251b7e71ec9b730e7
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4676
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
GetProcessHeap
HeapFree
CloseHandle
WriteFile
CreateFileW
lstrcatW
lstrlenW
lstrcpyW
ReadFile
CreateDirectoryW
GetSystemDirectoryW
GetWindowsDirectoryW
GetTempPathW
user32
FindWindowW
SendMessageW
shell32
ShellExecuteW
sfx_main
Name
.text
Size
1024B
Virtual Size
750B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
851B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=1, productName=Unmarked objects,
count=3, id=11, version=8799,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
HTV.004
- IMPHASH 86632da30434ccfc050190a47fb559c4
- SHA256 9ed69f6ee86a7fca1f3ef7801d08b38d9e82ab649e6169e894e48ce85b43dc30
- MD5 bda4860df26a5882b42b6b861376199d
- SHA1 8437ec07c9bc3001756ae0cb214b99e1e8a53fdb
- SHA512 484f45aaacdb4be03752df49c337c7596d539ee0442412083fcfeea78e1c485caf1fbb25cf8a749611358e3a895232f8d0c61c91545d98a3f2a3e1aa504859c6
- SSDEEP 384:qq/qih/MPPlOXAd4hIcWpXTxzE+w0TN99EuK:qq/qih/jG45O5FTNLER
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13034
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_acmdln
__p__fmode
__set_app_type
_except_handler3
_controlfp
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
calloc
exit
memcpy
memset
_itow
??2@YAPAXI@Z
_wcsdup
??3@YAXPAX@Z
free
__p__commode
kernel32
GetModuleHandleA
GetTempPathW
GetModuleHandleW
GetModuleFileNameW
CreateFileW
SetFilePointer
CloseHandle
GetTempFileNameW
FreeLibrary
DeleteFileW
WriteFile
ReadFile
LoadLibraryW
GetProcAddress
GetStartupInfoA
user32
MessageBoxW
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=4, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=41, id=1, productName=Unmarked objects,
count=3, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
count=1, id=14, version=7299,
count=1, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=11, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=5, id=110, productName=VS2005 build 50727, version=50727,
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
HTV.006
- IMPHASH 56a0310cc21e13f1fbc0b10b145ff8ee
- SHA256 3c9e56e51d5a7a1b9aefe853c12a98bf246039aa46db94227ea128f6331782ba
- MD5 43f02e9974b1477c1e6388882f233db0
- SHA1 f3e27b231193f8d5b2e1b09d05ae3a62795cf339
- SHA512 e22d14735606fe75ee5e55204807c3f5531d3e0c4f63aa4a3b2d4bb6abda6128c7e2816753f2e64400ac6dae8f8ef1e013a7a464dff2a79ad9937c48821a067f
- SSDEEP 96:6ynh3GtCJk7eZjXOoP/YYfR+cwXofW1oEIYoWkQrWyHe1e2mIXT6pDw9:H3Ggk0+oP/YY50tI1WkQRoeyD6pU9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5749
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Projects\AKL\kh\Release\kh.pdb
kernel32
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryA
GetLastError
InterlockedExchange
FreeLibrary
GetProcAddress
LocalFree
LocalAlloc
RaiseException
user32
GetFocus
CallNextHookEx
SendMessageW
SetWindowsHookExW
RegisterWindowMessageW
IsWindow
GetKeyboardState
ToUnicodeEx
PostMessageW
keybd_event
MapVirtualKeyW
UnhookWindowsHookEx
GetKeyboardLayout
AddMonitoredWnd
ClearKeyHook
ClearMsgHook
ClearWndCallHook
RemoveMonitoredWnd
SetKeyHook
SetMsgHook
SetWndCallHook
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
132B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.JOE
Size
512B
Virtual Size
408B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
448B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=30, id=1, productName=Unmarked objects,
count=3, id=11, version=8799,
count=5, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
HTV.007
- IMPHASH a2ed420e4430c2ef22cb11008c100339
- SHA256 a895ad4d23e8b2c2dc552092f645ca309e62c36d4721ebfe7afd2eee7765d4b2
- MD5 b5a87d630436f958c6e1d82d15f98f96
- SHA1 d3ff5e92198d4df0f98a918071aca53550bf1cff
- SHA512 fd7bae85a86bdaa12fec826d1d38728a90e2037cb3182ad7652d8a9f54c4b322734c587b62221e6f907fce24fcf2e0ae4cce1f5e3d8861661064b4da24bd87ce
- SSDEEP 48:6gklbZREoW0EE/KD4tJaKz5/aSbRsEJZAECi1cBaVM+kHbDouE:6gSoDidaeJGECiRQHbDoz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5285
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
LeaveCriticalSection
WriteProcessMemory
EnterCriticalSection
lstrcmpW
lstrcpynW
lstrcpyW
ReadProcessMemory
GetProcAddress
GetModuleHandleA
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
HeapAlloc
GetProcessHeap
user32
CallNextHookEx
SetWindowsHookExA
UnhookWindowsHookEx
Hook
Unhook
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
704B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
112B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
SHAREDAT
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
306B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=18, id=1, productName=Unmarked objects,
count=3, id=11, version=8799,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=122, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
HTV.chm
- SHA256 fc14326e0719e0a59ba8fbb6763f2cc41b47d59ef177c90dc3535cd3a38720b9
- MD5 0195038e7af8da97742eb0188204c3bf
- SHA1 b8c089c701ab283fa5aa921270b317c07cbee2c7
- SHA512 938c3a59895d861eb67a56f365fd387b122d42ff7bb52e5014faa738150d1eed2cd4a52b231ff70f1184fd7e3f0eb991096813b9933e574a7b4383f768384b04
- SSDEEP 768:4pfTcCfTSjb0O+TJPHjnKFZi4LHnX1OsFmncv6NpP2UT:4pfTcCfTcg1eXJjmncv6NpPV
- MD5 SHA1 SHA512 SSDEEP
HTV.exe
- IMPHASH f540a07307a950dc21e42040216c83fb
- SHA256 1a3d28ac6359e58aa656f4734f9f36b6c09badadcf9fb900b9b118d90c38a9dd
- MD5 17535dddecf8cb1efdba1f1952126547
- SHA1 a862a9a3eb6c201751be1038537522a5281ea6cb
- SHA512 b4f31b552ab3bb3dafa365aa7a31f58674ae7ee82ce1d23457f2e7047431430b00abb3b5498491725639daf583b526b278a737168cfdc4e9ec796dfbc14a53d8
- SSDEEP 6144:gP/HgQr8z0psVGBJbsvUIvpBSkULIMxEIvs/IV2JN4Xd8Ab:0gQNIGBJ/igkUYItFb
- MD5 SHA1 SHA512 SSDEEP
-
Ardamax main executable
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
163315
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
UrlUnescapeW
StrCmpIW
PathFindExtensionW
PathFindFileNameW
PathStripPathW
PathRemoveFileSpecW
StrFormatByteSizeW
PathRemoveExtensionW
StrDupW
PathFileExistsW
ws2_32
send
getservbyname
WSACleanup
WSAStartup
htons
inet_addr
gethostbyname
socket
connect
select
closesocket
recv
shutdown
comctl32
PropertySheetW
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Draw
ImageList_Destroy
ImageList_ReplaceIcon
ImageList_GetImageCount
ImageList_Create
_TrackMouseEvent
CreatePropertySheetPageW
DestroyPropertySheetPage
shell32
SHChangeNotify
ShellExecuteExW
Shell_NotifyIconW
ShellExecuteW
SHFileOperationW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ExtractIconW
DoEnvironmentSubstW
wininet
InternetGetLastResponseInfoW
InternetCloseHandle
FtpPutFileW
FtpCreateDirectoryW
FtpRemoveDirectoryW
FtpDeleteFileW
FtpSetCurrentDirectoryW
InternetConnectW
InternetOpenW
mpr
WNetCancelConnection2W
WNetAddConnection2W
kernel32
GetStringTypeA
GetThreadLocale
IsProcessorFeaturePresent
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringA
GetCurrentProcess
GetModuleHandleW
LockResource
LoadLibraryW
GetProcAddress
GetVersion
VirtualAlloc
MultiByteToWideChar
FindResourceExW
FlushInstructionCache
WideCharToMultiByte
VirtualFree
FreeLibrary
GetCurrentThreadId
CreateThread
SetThreadPriority
ResumeThread
GlobalLock
GetLocalTime
LeaveCriticalSection
lstrcpyW
GlobalUnlock
SystemTimeToFileTime
CompareFileTime
lstrcatW
GetSystemTimeAsFileTime
GetModuleFileNameW
EnterCriticalSection
CloseHandle
CreateFileW
lstrcpynW
RemoveDirectoryW
GetShortPathNameW
CreateDirectoryW
GetEnvironmentVariableW
WriteFile
OpenProcess
SetFileAttributesW
SetPriorityClass
CompareStringW
lstrlenW
GetCurrentThread
Sleep
SetProcessPriorityBoost
InitializeCriticalSection
DeleteFileW
InterlockedIncrement
MoveFileExW
SetLastError
ExitProcess
RaiseException
SizeofResource
lstrcmpiW
GetCurrentProcessId
InterlockedDecrement
LoadResource
lstrlenA
FindResourceW
lstrcmpW
lstrcpyA
LoadLibraryExW
GetDateFormatW
GetVersionExW
lstrcmpA
CreateMutexW
DeleteCriticalSection
GetLastError
SetProcessWorkingSetSize
LocalReAlloc
ReadFile
BeginUpdateResourceW
UpdateResourceW
EndUpdateResourceW
SetFilePointer
LocalFree
EnumResourceNamesW
LocalAlloc
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FormatMessageW
CreateToolhelp32Snapshot
Module32FirstW
Module32NextW
Process32FirstW
Process32NextW
GetWindowsDirectoryW
GetFileSize
CreateFileMappingW
GetTimeZoneInformation
GetComputerNameW
lstrcmpiA
GetTimeFormatW
GetTickCount
OutputDebugStringW
CopyFileW
GetTempFileNameW
GetTempPathW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesW
MoveFileW
HeapAlloc
HeapFree
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetVersionExA
GetProcessHeap
GetStartupInfoW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
GetStdHandle
GetModuleFileNameA
HeapDestroy
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
InterlockedExchange
LoadLibraryA
RtlUnwind
GetLocaleInfoA
GetConsoleCP
GetConsoleMode
LCMapStringA
LCMapStringW
VirtualQuery
GetStringTypeW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
FlushFileBuffers
user32
ReleaseCapture
CheckMenuItem
GetMenuItemCount
IsWindowEnabled
SetWindowTextW
GetMenu
InflateRect
GetCapture
IsClipboardFormatAvailable
GetSubMenu
EnableWindow
SendMessageW
OpenClipboard
GetMenuItemInfoW
MessageBoxW
GetActiveWindow
DdeInitializeW
AdjustWindowRectEx
DrawFrameControl
SetCapture
DdeCreateStringHandleW
SetMenuItemInfoW
DdeConnect
DestroyIcon
DdeClientTransaction
GetClipboardData
DispatchMessageW
MapWindowPoints
DdeAccessData
ShowWindow
TranslateMessage
UpdateWindow
CharLowerW
GetDC
FillRect
GetMessageW
SetTimer
CloseClipboard
DrawFocusRect
DialogBoxParamW
RegisterClassExW
DdeDisconnect
ScreenToClient
KillTimer
EndDialog
DdeFreeStringHandle
IsWindow
DdeUninitialize
LoadMenuW
GetDlgItem
PostQuitMessage
TrackPopupMenu
GetClassInfoExW
GetDlgItemTextW
BeginPaint
LoadIconW
InvalidateRect
SetDlgItemInt
RegisterWindowMessageW
GetWindowThreadProcessId
CallWindowProcW
GetParent
WindowFromPoint
FrameRect
PeekMessageW
PostMessageW
SetRectEmpty
EndPaint
GetMessagePos
PtInRect
GetWindowModuleFileNameW
GetDesktopWindow
GetWindowTextW
GetFocus
GetForegroundWindow
UnhookWindowsHookEx
SetFocus
DefWindowProcW
DrawEdge
GetDlgCtrlID
GetCursorPos
GetWindowDC
MessageBeep
LoadImageW
GetAncestor
IsWindowVisible
SetWindowLongW
ModifyMenuW
CopyRect
GetClassNameW
GetDlgItemInt
SetForegroundWindow
GetWindow
EnumWindows
TrackPopupMenuEx
ReleaseDC
DestroyWindow
LoadStringW
GetMonitorInfoW
SendMessageTimeoutW
FindWindowW
CharNextW
MonitorFromPoint
GetClientRect
SetCursor
RegisterHotKey
LoadCursorW
UnregisterHotKey
GetKeyState
CallNextHookEx
DrawTextW
GetSysColorBrush
MapVirtualKeyW
GetKeyNameTextW
wsprintfW
UnregisterClassA
ScrollWindow
SystemParametersInfoW
SetWindowsHookExW
GetSystemMetrics
IsMenu
DeleteMenu
ChangeClipboardChain
CreateWindowExW
GetWindowLongW
SetWindowPos
GetWindowRect
GetWindowTextLengthW
GetSysColor
DestroyMenu
SetClipboardViewer
SetDlgItemTextW
MoveWindow
GetClassLongW
OffsetRect
gdi32
GetTextMetricsW
SetTextColor
CreateCompatibleBitmap
CreatePen
GetStockObject
CreatePatternBrush
GetTextExtentPoint32W
SetBrushOrgEx
TextOutW
Polygon
PatBlt
SetPolyFillMode
GetDIBits
DeleteDC
RealizePalette
CreateSolidBrush
CreateDIBSection
SetBkMode
CreateCompatibleDC
CreateRectRgnIndirect
SelectObject
CreateBitmap
CombineRgn
SetBkColor
GetObjectW
BitBlt
CreateFontIndirectW
ExcludeClipRect
CreateFontW
DeleteObject
comdlg32
GetSaveFileNameW
GetOpenFileNameW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoUninitialize
oleaut32
SysFreeString
VarUI4FromStr
Name
.text
Size
354KB
Virtual Size
354KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=5, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=25, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=432, id=1, productName=Unmarked objects,
count=79, id=110, productName=VS2005 build 50727, version=50727,
count=49, id=125, productName=VS2005 build 50727, version=50727,
count=222, id=109, productName=VS2005 build 50727, version=50727,
count=17, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Uninstall.exe
- IMPHASH b2a0d9368ec1be7deb968a920e5c993e
- SHA256 3dc70f9fc553517666be9008ebcfab2b044ff711036d49e40144e0dd97910734
- MD5 916ced19a86ac3006f26ea60719dd648
- SHA1 68278a4c3d5202fff273844d8e4b488fc1daddcd
- SHA512 9c08cbca52a17f810f3892d66a72ff37c3af5a60ebe34f56e3937c933e265ae0e4207410f7778434cb203a76e36dc62df09a08f3b3f4338d35b44d5c5bc8bb28
- SSDEEP 768:dsXaaLGrI0+zMwduCWgNzkkRriqskbELjlF58e1mJDGlsCxKOeRTBAzXw3x7q:dxGGrf+wMRVrkxmJ9CxMAbcxe
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
12901
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
ExitProcess
user32
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
107KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=154, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/modern-header.bmp
- SHA256 6f178942b4130dd4c59215f1ce59cd47226f1ac4149f481486e9a652ea9cd1d8
- MD5 173391c2c5228607d99ca65f29c8fb3e
- SHA1 ba23989bda8532abb9e3d191472751c0e855d13e
- SHA512 9c777fabe2fe6133c876e6069d9bc73cdecbc5b71ce0bfc9484dbddfc2e61fc9ac364387792c181bfadc3dafe8461945295ae4583d17646204afdb3f5cc47c0b
- SSDEEP 384:xurmYyM7XYSv7aI2DV9ZHs+8UAdOuSApkjxxr8mD+NYbXcPUe3Xh41kAJXGtZDT3:xSmY9gpj+mJeq1kcU3Fn
- MD5 SHA1 SHA512 SSDEEP
menu.gif
- SHA256 979c4b395172a53794b18d996df95c75c68d70ec3573aba66cdfe28c8d1cf0eb
- MD5 20fe009bce33b78dd40b48bc5f8accc6
- SHA1 cd614d9b9e088eecb7e63722f61a39a0cf0ec196
- SHA512 f6be54be78bfdf770c7c131c5d108b0b33376886b9b4a66598e2c92543a2e83ffafdaea36b9d749784a978d4327cdf52ce0ac6feb9a28d683162b0b3f2f40a37
- SSDEEP 384:jcDMdRjSvmCSSlNWXDM46alwr1I7bsY+lm2a5mK11CFCFaAapNuJoX:rjYmC5lNaV0iMY+7a5/1eC6NCoX
- MD5 SHA1 SHA512 SSDEEP
qs.html
- SHA256 35b0f1bb808e1623ad534fbc1e72cea25ac28f71340e9c543f01d1bfdd094035
- MD5 40d00fa24b9cc44fbf2d724842808473
- SHA1 c0852aa2fb916c051652a8b2142ffb9d8c7ac87a
- SHA512 9eb750e08ca9750988290626ae8ed32a2ecfa7c8ca021b3e26b3da0a94de952b991a9a6a0ad5729d7d5ccf7b3b36fb36fd24047f705d0468ad04908ba8a7154c
- MD5 SHA1 SHA512
tray.gif
- SHA256 e675fecb791ed568aae7f1c24b159f7c0f7e23fe8a7ce76f72b3dd1a4ac00e9d
- MD5 0ac69330c3b9181b8a109fddb91fa128
- SHA1 ef9698ccce041ce8ba3f4af37d0c2b577f19b375
- SHA512 3a74c04baf3e1e842c0a2568a6480e4ece05baef31171397763de638c6e5b0d26255cf1d7802ea53c355563b8e4b600d24d04afb5168fbc54f66414445327749
- SSDEEP 192:+v4WtFpzyuVh4a3uoDB8wlKmXvaPOe6Kh3:+vtDhj4U5Km/q6Kh3
- MD5 SHA1 SHA512 SSDEEP