Windows.zip
- SHA256 b59d4d38c6c98590709bcb7e4299a4e10306b29d46a56c5e8a6bb274bd4bef31
Overview
overview
10Static
static
7BUG32.exe
windows7-x64
BUG32.exe
windows10-2004-x64
Windows/Bonzify.exe
windows7-x64
8Windows/Bonzify.exe
windows10-2004-x64
8BossDaMajor.exe
windows7-x64
BossDaMajor.exe
windows10-2004-x64
Happy99.exe
windows7-x64
5Happy99.exe
windows10-2004-x64
5Magistr.exe
windows7-x64
1Magistr.exe
windows10-2004-x64
1Maldal.exe
windows7-x64
5Maldal.exe
windows10-2004-x64
5MeltingScreen.exe
windows7-x64
1MeltingScreen.exe
windows10-2004-x64
1Windows/Ra...ac.exe
windows7-x64
Windows/Ra...ac.exe
windows10-2004-x64
Windows/Ra...it.exe
windows7-x64
10Windows/Ra...it.exe
windows10-2004-x64
10Windows/Ra...or.exe
windows7-x64
Windows/Ra...or.exe
windows10-2004-x64
Windows/Ra...on.exe
windows7-x64
10Windows/Ra...on.exe
windows10-2004-x64
7Windows/Ra...ye.exe
windows7-x64
10Windows/Ra...ye.exe
windows10-2004-x64
10Windows/Ra...Eye.js
windows7-x64
10Windows/Ra...Eye.js
windows10-2004-x64
10Windows/Ra...ya.exe
windows7-x64
10Windows/Ra...ya.exe
windows10-2004-x64
10Windows/Ra...om.exe
windows7-x64
1Windows/Ra...om.exe
windows10-2004-x64
1Windows/Ra...om.exe
windows7-x64
3Windows/Ra...om.exe
windows10-2004-x64
3Behavioral task
behavioral1
Sample
BUG32.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
BUG32.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
Windows/Bonzify.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral4
Sample
Windows/Bonzify.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
BossDaMajor.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral6
Sample
BossDaMajor.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral7
Sample
Happy99.exe
Resource
win7-20240215-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
Happy99.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Magistr.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Magistr.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
Maldal.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral12
Sample
Maldal.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral13
Sample
MeltingScreen.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
MeltingScreen.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral16
Sample
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral17
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral18
Sample
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral19
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win7-20240221-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral22
Sample
Windows/Ransomware/Monster Ransomware/XMoon.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral23
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral24
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral26
Sample
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral27
Sample
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral28
Sample
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral29
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
General
- Target Windows.zip
- Size 53.8MB
- Sample240228-2gf5ysfe3t
- SHA256 b59d4d38c6c98590709bcb7e4299a4e10306b29d46a56c5e8a6bb274bd4bef31
- MD5 b0dc3a53687d1017d27c64f4a19801f0
- SHA1 6ae3c60cc70125e9ddea61869a44c5ac63e2002e
- SHA512 1e0e5f058f5f670f64886b1684d6592a88fe5408926a5ac76363543acf20bef00910e382dd3510110e466b1a0f3d3b4c42e8648ae840865d12896a646c45d264
- SSDEEP 1572864:2TTg/vmlX09CYwKyHiz6ZH27xTiBMymMEAHWZATpIbBPR:H/u0lOHs6H+xTAbHEEpYBPR
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Windows/Ransomware/Monster Ransomware/XMoon.exe upx - Unsigned PE 16 IoCs
Checks for missing Authenticode signature.
resource unpack004/BUG32.exe unpack001/Windows/Bonzify.exe unpack005/BossDaMajor.exe unpack006/Happy99.exe unpack007/Magistr.exe unpack008/Maldal.exe unpack009/MeltingScreen.exe unpack001/Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe unpack001/Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe unpack001/Windows/Ransomware/Monster Ransomware/XMoon.exe unpack001/Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe unpack001/Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe unpack001/Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap unpack001/Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Patched) unpack001/Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Wiper) unpack001/Windows/Ransomware/WannaCrypt0r/WannaCrypt0r.exe
File Explorer
-
Windows.zip.zip 53.8MB
-
Windows/000.zip.zip 119KB
-
Windows/42.zip.zip 41KB
-
Windows/BUG32.rar.rar 1.8MB
-
BUG32.exe.exe 3.0MB
-
ReadMe.txt223B
-
Windows/Bonzify.exe.exe 6.4MB
-
Windows/BossDaMajor.rar.rar 1.8MB
-
BossDaMajor.exe.exe 1.9MB
-
ReadMe4urSafety.txt719B
-
Windows/Email-Worm/Email-Worm.Win32.Happy99.zip.zip 5KB
-
Happy99.exe.exe 9KB
-
Windows/Email-Worm/Email-Worm.Win32.Magistr.zip.zip 62KB
-
Magistr.exe.exe 107KB
-
Windows/Email-Worm/Email-Worm.Win32.Maldal.zip.zip 19KB
-
Maldal.exe.exe 80KB
-
Windows/Email-Worm/Email-Worm.Win32.MeltingScreen.zip.zip 7KB
-
MeltingScreen.exe.exe 17KB
-
Windows/Email-Worm/Email-Worm.Win32.Pikachu.zip.zip 10KB
-
Windows/Fake GoldenEye.zip.zip 38KB
-
Windows/PCToaster.zip.zip 62KB
-
Windows/Ransomware/Annabelle Ransomware.zip.zip 15.6MB
-
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe.exe 15.9MB
-
Windows/Ransomware/BadRabbit Ransomware.zip.zip 395KB
-
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe.exe 431KB
-
Windows/Ransomware/Monster Ransomware (second new version).zip.zip 28KB
-
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe.exe 71KB
-
Windows/Ransomware/Monster Ransomware.zip.zip 511KB
-
Windows/Ransomware/Monster Ransomware/XMoon.exe.exe 669KB
-
Windows/Ransomware/Trojan.Ransom.GoldenEye.zip.zip 323KB
-
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe.exe 254KB
-
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js.js 365KB
-
Windows/Ransomware/Trojan.Ransom.NotPetya.zip.zip 321KB
-
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe.exe 390KB
-
Windows/Ransomware/Trojan.Ransom.PetrWrap.zip.zip 574KB
-
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap.exe 473KB
-
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Patched).exe 473KB
-
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Wiper).exe 40KB
-
Windows/Ransomware/WannaCrypt0r.zip.zip 3.3MB
-
Windows/Ransomware/WannaCrypt0r/WannaCrypt0r.exe.exe 3.4MB
-
Windows/Trojan.VBS.Bolbi.zip.zip 5KB
-
Windows/Win16/Virus.Win16.Apparition.zip.zip 67KB
-
Windows/Win16/Virus.Win16.Gollum.zip.zip 21KB
-
Windows/Win32/Joke.Win32.Badgame.zip.zip 34KB
-
Windows/Win32/Joke.Win32.FakePetya.zip.zip 27KB
-
Windows/Win32/Net-Worm.Win32.Opaserv.zip.zip 26KB
-
Windows/Win32/Trojan.Win32.Alerta.zip.zip 81KB
-
Windows/Win32/Trojan.Win32.IconDance.zip.zip 155KB
-
Windows/Win32/Trojan.Win32.Sevgi.zip.zip 197KB
-
Windows/Win32/Trojan.Win32.Whiter.zip.zip 21KB
-
Windows/Win32/Virus.VBS.Karma.zip.zip 1KB
-
Windows/Win32/Virus.Win32.Antares.zip.zip 50KB
-
Windows/Win32/Virus.Win32.Rigel.zip.zip 41KB
-
Windows/Win32/Virus.Win32.Winfig.zip.zip 12KB
-
Windows/Win9x/Trojan.Win9x.FlashKiller.zip.zip 660B
-
Windows/Win9x/Virus.Win9x.CIH (Infected AlZip program).zip.zip 1.1MB
-
Windows/Win9x/Virus.Win9x.CIH.zip.zip 9KB
-
Windows/Win9x/Virus.Win9x.Prizm.zip.zip 4KB
-
Windows/Win9x/Virus.Win9x.Shoerec.zip.zip 236KB
-
Windows/Win9x/Virus.Win9x.Smash.zip.zip 9KB
Windows/000.zip
- SHA256 d66c4c08833f9e8af486af44f879a0a5fb3113110874cc04bd53ee6351c92064
- MD5 f5d73448dbe1ec4f9a8ec187f216d9e5
- SHA1 6f76561bd09833c75ae8f0035dcb2bc87709e2e5
- SHA512 edbdc1d3df9094c4e7c962f479bb06cdc23555641eeb816b17a8a5d3f4d98f4d1d10299fd2f9152d30e3fa9e5b12c881fd524e75612e934b287109492ee1520b
- SSDEEP 3072:/msQvkoawLvldUo1OvAGczlPDloVCUfcU:C8oaiPOvA/zl7jUcU
- MD5 SHA1 SHA512 SSDEEP
Windows/42.zip
- SHA256 bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
- MD5 1df9a18b18332f153918030b7b516615
- SHA1 6c42c62696616b72bbfc88a4be4ead57aa7bc503
- SHA512 6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
- SSDEEP 768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK
- MD5 SHA1 SHA512 SSDEEP
Windows/BUG32.rar
- SHA256 5808f59ec4e3842b7bc0289c61c34f2d3aa875b12a26ab83aca52096e9261c43
- MD5 74e6fdd362371b9c903bf75552a210b9
- SHA1 26af4d075135dce7b7f58504d9b572dc7edcbe07
- SHA512 72bca8b1b15f58794f062397da395c4542fdfe3198f2cd0ba2eb58ebcc4ddc1a11f0425520771d9f78879cd958c62e8b89776443d6996d05bc023a07b36ba4ad
- SSDEEP 24576:pl6Pb4ply0yIbhp6FeB+RtR62BkMDEi8iOpnVWBf+APcLki+VOEeRft2Ace1XbAL:plabqlyoWFllNqiTFfgF2AceaOh/yx
- MD5 SHA1 SHA512 SSDEEP
BUG32.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 817a695e53a1d6e24f2c701751b4d18468f20698f30fada420dfba6e21a09797
- MD5 149cc2ec1900cb778afb50d8026eadf5
- SHA1 a7bc1bbc7bdc970757ec369ef0b51dc53989f131
- SHA512 d617654478beb6325d86c108cddaff8f8d658a235d26b8e0282ed85dca826bdb62b0b67e749c7cd421dbae1d98084220e2f4d5779badb8fd7ab07ff333a35553
- SSDEEP 49152:Or2U5IahDUGN97rkqOAackLjQ0rZEAh3oA6wHE+K60Kk0aCLkfAZKt0OJTcL:4H2ahFNNrg3QbQoA6wHEnFN4IJu
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.0MB
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ReadMe.txt
- SHA256 2bfd4d4376befcd10c62152b251849c05cd960a7681a72cb2a46a97c5257e329
- MD5 abe33191965832e29d7ef862c1df1f98
- SHA1 26adc19533b121b6a8dde1341141c27d35a67fce
- SHA512 55fda1654cd9f6ece0fc345d2ee503c7894f8ed89524f058d7fe53901582961366a7850c40371af80b7794d9a20e0f46090a332fa004178626d34235adb4fa26
- MD5 SHA1 SHA512
Windows/Bonzify.exe
- IMPHASH 0bee32f8779ce7af7a869e923f1dd6fb
- SHA256 d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e
- MD5 9c352d2ce0c0bdc40c72f52ce3480577
- SHA1 bd4c956186f33c92eb4469f7e5675510d0790e99
- SHA512 c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92
- SSDEEP 196608:/dAMaWetTeAkLIdx751qFTkub//73lc6u7b5VJ2Yx5xIdk3:naWedh+Idx75QYub//73lc6u7bLMYxD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5808
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\PC\Documents\Visual Studio 2015\Projects\Bonzify\Release\Bonzify.pdb
kernel32
FindClose
lstrcmpA
lstrcatA
CreateFileA
lstrcpyA
CloseHandle
LocalFree
GetProcessHeap
FlushFileBuffers
Sleep
DeleteFileA
CreateThread
HeapAlloc
SizeofResource
lstrlenA
SetLastError
TerminateProcess
ExpandEnvironmentStringsA
GetFullPathNameA
FindResourceA
WaitForSingleObject
OpenProcess
CreateToolhelp32Snapshot
LockResource
Process32Next
LoadResource
lstrcmpiA
CreateProcessA
FindNextFileA
WriteFile
HeapFree
FindFirstFileA
Process32First
LocalAlloc
user32
SendMessageA
advapi32
RegOpenKeyA
RegSetValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHChangeNotify
ole32
CoInitialize
CoCreateInstance
oleaut32
SysAllocString
SysFreeString
shlwapi
PathRemoveFileSpecA
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6.4MB
Virtual Size
6.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
452B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=48, id=1, productName=Unmarked objects,
count=4, id=265, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=151,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Windows/BossDaMajor.rar
- SHA256 fa5ee802f5e420147b9574967327fe26ebd704a0d1d426270761fdd7c32fcf08
- MD5 51bde10b508c0c1723555271deb05e48
- SHA1 6dfed950d75fb67f87e087e7d050de45a243b8fb
- SHA512 9584910f41fe6337fa5e32b58f7e99607258e091a3bacf920d564fa0c3c4a936501e3dc4c1d045c8af9f2ffdb11034a5660db6d1b176307fd614a88c08480046
- SSDEEP 49152:G7HHRp+X5Fxj67g0a0MjYxZu5FVgDgM+/QIa/Et72:G7H85/e007/xZu5XzM+/Qp8S
- MD5 SHA1 SHA512 SSDEEP
BossDaMajor.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 730a41a7656f606a22e9f0d68782612d6e00ab8cfe1260160b9e0b00bc2e442a
- MD5 38ff71c1dee2a9add67f1edb1a30ff8c
- SHA1 10f0defd98d4e5096fbeb321b28d6559e44d66db
- SHA512 8347782951f2647fe433482cb13186653afa32ee9f5be83a138c4ed47ff34d8de66a26e74b5a28ea21c1529b2078401922a9a26803772677b70489967c10f3e9
- SSDEEP 49152:veG3J7FtM9SbJakTiTBMGSARaspyyx979PSxgKFdGlYU:2GZxSoJrTiTBMGtRa8t7EFddU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
ReadMe4urSafety.txt
- SHA256 fa6b09bdb6a2a86c807cc220b0450257308b5288ffa9817d0ae1cf2032c928ce
- MD5 6c39396259a3208e24733deaec3e6bb7
- SHA1 e2e463ff45eb9e0a3d8b201de7342288bf95d3c3
- SHA512 c8ba7f5aa4a653706f14456fc1813b923a73222a34a6b8053b1156ed4a599d48cdee4ada752738a8bc18294b9225755512c57b7eb11b330cb21c09b289b4f30e
- MD5 SHA1 SHA512
Windows/Email-Worm/Email-Worm.Win32.Happy99.zip
- SHA256 cba3bdafa8093f4d589f86ab0528ad55b96e9f7547e8501ed2360ed6a35bcda0
- MD5 34f9b863314651e88f6da25771c272e5
- SHA1 88dc0d82b59717032f6b1a8830a4ab2c5cd7894a
- SHA512 ccc1d3ec870c7c0fb90e44ca395b5be7daea3af6be769c512a7f648021ad62f56b4352acf29ccd4b2da0883262574ea6e520dd56bf6854841f110e47fbbbfbfe
- SSDEEP 96:i0qAtHsnF08FkIUJPTr3MxtJ+WvepWQy4m2arwtraIwnW2Axx4/:xlFBIkPTjMxtr2MV4taC0nW2Ao/
- MD5 SHA1 SHA512 SSDEEP
Happy99.exe
- SHA256 4ebe3e1af5e147c580ecce052fe7d7d0219d5e5a2f5e6d8a7f7291735923db18
- MD5 02dd0eaa9649a11e55fa5467fa4b8ef8
- SHA1 a4a945192cb730634168f79b6e4cd298dbe3d168
- SHA512 3bf69de674737ca15d6ff7ce73396194f3631dc4b8d32cc570adeeacdc210acee50fd64c97172ce7cc77f166c681d2ccd55955b3aca9188813b7ff6f49280441
- SSDEEP 192:nR81cIkA5Dbaj/CaFx40Z9HnLH8bzTbjt5BNUFO:RycyhqN4u9HnLH8bnbjtpl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
1
Entry point
65536
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Windows/Email-Worm/Email-Worm.Win32.Magistr.zip
- SHA256 ea307d90f92724d1935ae6b114f3408d7ded48c9efc543daa2df13bd34db3151
- MD5 4c4e382dbe35585caa20b28aeeea7150
- SHA1 430c548a6863a23bbf9e274199d344a0d914922c
- SHA512 97ac838bdb5f151563592a015d2faa953fe0346164b730d9f547bbd7288f5070c7f04df6531a3db7f199a07e0806cc7a3965126177305488ac375bb0439d452a
- SSDEEP 1536:OzVCbdx1+V7YCDKPc3pptqdH0sOlHz8Ddxiv:aIJaV7YlPcxqdFbri
- MD5 SHA1 SHA512 SSDEEP
Magistr.exe
- SHA256 068f2ee28af7645dbf2a1684f0a5fc5ccb6aa1027f71da4468e0cba56c65e058
- MD5 9890349fe3c68f5923b29347bba021a4
- SHA1 fa080a50486b205b75833a6b5c9505abb1e3b4df
- SHA512 aedd86837987cbe8c0b1cf3b4ca0c3a875e4cc9bcc8097c160d0d6070427ad9e1d871d5339ea95cc03499c39a6536b5a6b6d43372a49eeaf2e87bf755a3d3367
- SSDEEP 3072:pRr1m0iQwTlFiIoXTLDCLLUsgULFsfMGdd64:Lk0LCwIi3DMUwFNGd04
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
23392
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=6, version=1668,
count=326, productName=Unmarked objects (old),
Windows/Email-Worm/Email-Worm.Win32.Maldal.zip
- SHA256 f0724b04f60c23ddeb626ae20894ac87838e7c5186377be380c9579a24f6a4b2
- MD5 b9b0403e13b3cef0ec4f8d0e3ec05434
- SHA1 8e9e2cffd9b3454cb177f64e3c13cdf3e1f59c1c
- SHA512 711d7c33f2da645aab719ca78f68e4ecf74f4cd1ec6dc7cab74871291e06cab96a65b27c90bc39734ac3a90c0e9826618e4aae9bec003c9825c005b65c69b750
- SSDEEP 384:YXkkqzEEeBJZ4+IFzxqNVfE+9ndYP1ZHtEhCu3BYdQpjSEtSgmzeOJTnVlfT2y0A:YX6zbeBk+qNoB1weDxYdIxSVRiA
- MD5 SHA1 SHA512 SSDEEP
Maldal.exe
- IMPHASH 894499b0c1732ab37b759498faae29f0
- SHA256 abac285f290f0cfcd308071c9dfa9b7b4b48d10b4a3b4d75048804e59a447787
- MD5 cbcd34a252a7cf61250b0f7f1cba3382
- SHA1 152f224d66555dd49711754bf4e29a17f4706332
- SHA512 09fdcb04707a3314e584f81db5210b2390f4c3f5efa173539f9d248db48ae26b3a8b240cf254561b0ecb764f6b04bb4c129832c6502d952d1960e443371ce2a9
- SSDEEP 1536:wh6S2wzALFx8hkMsiUmxi6QPitAKQjY8c4B5h:dS212xlQvKCYx4B
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6016
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm60
__vbaVarSub
_CIcos
_adj_fptan
__vbaVarMove
__vbaFreeVar
__vbaFreeVarList
__vbaEnd
_adj_fdiv_m64
__vbaNextEachVar
__vbaFreeObjList
_adj_fprem1
__vbaStrCat
__vbaSetSystemError
__vbaHresultCheckObj
_adj_fdiv_m32
__vbaVarForInit
__vbaOnError
ord595
__vbaObjSet
_adj_fdiv_m16i
_adj_fdivr_m16i
ord599
__vbaBoolVarNull
__vbaVargVar
_CIsin
__vbaVarZero
__vbaChkstk
EVENT_SINK_AddRef
__vbaVarTstEq
__vbaObjVar
DllFunctionCall
__vbaVarLateMemSt
__vbaVarOr
_adj_fpatan
EVENT_SINK_Release
ord600
_CIsqrt
EVENT_SINK_QueryInterface
__vbaExceptHandler
_adj_fprem
_adj_fdivr_m64
ord608
ord716
__vbaFPException
__vbaInStrVar
__vbaStrVarVal
__vbaVarCat
_CIlog
__vbaNew2
__vbaVarLateMemCallLdRf
_adj_fdiv_m32i
_adj_fdivr_m32i
__vbaFreeStrList
ord576
_adj_fdivr_m32
_adj_fdiv_r
ord100
__vbaVarTstNe
__vbaVarSetVar
__vbaVarCmpEq
__vbaLateMemCall
__vbaVarAdd
__vbaVarDup
__vbaVarLateMemCallLd
__vbaVarCopy
__vbaVarTstGe
_CIatan
__vbaStrMove
__vbaForEachVar
ord543
_allmul
_CItan
ord546
__vbaAryUnlock
__vbaVarForNext
_CIexp
__vbaFreeObj
Name
.text
Size
60KB
Virtual Size
56KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
12KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=14, version=7299,
count=2, id=9, version=8041,
count=1, id=13, version=8169,
Windows/Email-Worm/Email-Worm.Win32.MeltingScreen.zip
- SHA256 e7ce5f784ed38a7a7b06cd48396bfaef8e1fb9c68d480220648a5420d5755dd0
- MD5 5422bf6af2b8a337c5caaa48233a2922
- SHA1 8350618db47650fbd5ae792d0d46fb377680957b
- SHA512 0ebf67875b95c0261405a1cb207f0ba1ba5cee10871e3723e5321a4c0cf2a2f2996d6b270d9247fe6259cd8919383d002b8911e066311864753db998dde11b2b
- SSDEEP 192:SzLoIPshZMQsMvftLSj8yn8TCNBMXq4c8ueTt:SwHdvFLSwyn8+264fL
- MD5 SHA1 SHA512 SSDEEP
MeltingScreen.exe
- IMPHASH f90f100c81647f834881cf7cd9e90bd4
- SHA256 9d355e4f9a51536b05269f696b304859155985957ba95eb575f3f38c599d913c
- MD5 4784e42c3b15d1a141a5e0c8abc1205c
- SHA1 48c958deba25a4763ef244ac87e87983c6534179
- SHA512 d63d20a38602d4d228367b6596454a0f5b2884c831e3a95237d23b882abd624de59ea47835636b06a96e216f1decf8c468caacd45e5d3b16a5eb9e87bc69eb97
- SSDEEP 384:eHsipOITNe52uuCiuhwYW5t/QS5uoIjkg:PivNZuhi+wYW5toBoB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4212
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvbvm50
MethCallEngine
ord625
ord593
ord598
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
ord600
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord606
ord608
ord535
ord645
ord100
ord617
ord580
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
344B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
900B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Windows/Email-Worm/Email-Worm.Win32.Pikachu.zip
- SHA256 ecda6ce5dc46e2ff565e22f12f4cae92d55919879308df26aa33a0e282ecd740
- MD5 709a8c5aa653cda197c578010a370deb
- SHA1 478d14969570f06bc61dd3832ae7e0c4ecc92f80
- SHA512 c1bfd6c4ec85aff657646e67fc4b5cc5669ce5be62a09d28e22e37dcbbe1e11da6c2d47bdbae98e5b078d05f20cb687b82125da991ceb5daaa55d5dca05ede7a
- SSDEEP 192:D85Qk79fkb3xAw/9Irsy9reixuGtCEClWvIhaCUlpcPaxq58OxjkgZHOBq77RRfM:gZJSB/Wsy9KiIGqWFC8cCxq58qfZ0eX0
- MD5 SHA1 SHA512 SSDEEP
Windows/Fake GoldenEye.zip
- SHA256 874b6d641cd7bf6d0e069ecebed26ac33d22dee73780c471e54b6877ae9bfa11
- MD5 aa2e334155a24a215b5d7bb1c89257be
- SHA1 eee940069b326efcabd26d8f2c58e9d15ba7d542
- SHA512 0addc3ef59bfbf2482feacb1062457b180e6fe3c010b3463e8b33d090bc1eaae453175885ee8b7269f03e7ae77e24e1fb3ca4a160a16774eec6f503a56b96c4e
- SSDEEP 768:jGWJrteT/wBnp1K3F36Hj8xHcPpSoYi3n+RBSxrP2g:bI/4p1GF3CecxSJm+RQxv
- MD5 SHA1 SHA512 SSDEEP
Windows/PCToaster.zip
- SHA256 839e2e8904c5d91ab82e848a0f5ee93de32cf1d8539a9be8676d77c948e8ad14
- MD5 eb537eed40cf1eca96e2bf352df65089
- SHA1 ca71aa23b227b816b017e267203fa3319b59d8fc
- SHA512 95dca4c07c6cccbbaae47c6b1ed5083375f9b9037555efff8db8f3ac69388b4ffd9c9652e2f5db498532b4b3ceee160f190be31a85b242ba476d89580963f487
- SSDEEP 1536:6uhyUJLCbXUS3bS8FJA5KP/aCUnYzulKP5Ud7bAh:TZJLCbXUSrS8Q0PY+ulWn
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Annabelle Ransomware.zip
- SHA256 6854b5f66a016c933c2978086d85cd4f207e5c35ee554422a3cdd9a88a5ffecd
- MD5 12b368c03d5126e918127b27c7d16086
- SHA1 93ccceec02435a7ac6a6a2d242278b80e2c67f7f
- SHA512 68ea8889c93196ff4f82ca8dbd1d7e79b4bffc42b878b969da4e80e9eec874706016c361299a5f9f717edc70854ee269ee17b39edbbc042af86889900c164aa5
- SSDEEP 393216:SKkKEMzOrDjYhsZ7mIYi2DEWsUXSGmzZcE2j34ebsgTgH:SKm+hsZ7DYfzMRzZH27sgTk
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Annabelle Ransomware/716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac.exe
- SHA256 716335ba5cd1e7186c40295b199190e2b6655e48f1c1cbe12139ba67faa5e1ac
- MD5 0f743287c9911b4b1c726c7c7edcaf7d
- SHA1 9760579e73095455fcbaddfe1e7e98a2bb28bfe0
- SHA512 2a6dd6288303700ef9cb06ae1efeb1e121c89c97708e5ecd15ed9b2a35d0ecff03d8da58b30daeadad89bd38dc4649521ada149fb457408e5a2bdf1512f88677
- SSDEEP 393216:UMwm0qBknxdEX+LbMUgoSZmWSmh4aaRN22ChHCMNku1y:UMcKX+Lbjgd7W1RNVC9ku1
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
15.7MB
Virtual Size
15.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
268KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Windows/Ransomware/BadRabbit Ransomware.zip
- SHA256 7da4698bb24746aa5349e9e0b3645a7fab8a977308e06c90f5282dbb5ea7d00f
- MD5 b303526df291ef092a7650af3d4d63f8
- SHA1 97c6532d1df35b3e5c352c29006985468eb7abc5
- SHA512 603ff899d40df62203cb1d945bb625f10d6eeb439ae5588175fb04c9d850b07517f2b82d2a02f8b8f8a493660cc2a8b592875fcee2376bb6e7fd322398a0ce66
- SSDEEP 12288:DFiPL3qCRURZKf+VHZhuZkYEyGO3xzl9Vd:DFiD3qCRCZa+V/uD0O3xzf3
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/BadRabbit Ransomware/BadRabbit.exe
- IMPHASH e3bda9df66f1f9b2b9b7b068518f2af1
- SHA256 630325cac09ac3fab908f903e3b00d0dadd5fdaa0875ed8496fcbb97a558d0da
- MD5 fbbdc39af1139aebba4da004475e8839
- SHA1 de5c8d858e6e41da715dca1c019df0bfb92d32c0
- SHA512 74eca8c01de215b33d5ceea1fda3f3bef96b513f58a750dba04b0de36f7ef4f7846a6431d52879ca0d8641bfd504d4721a9a96fa2e18c6888fd67fa77686af87
- SSDEEP 12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
c9:13:30:16:a3:e5:cf:bf:b1:aa:8b:50:d1:16:0f:a5:35:73:41:3d:4f:81:f8:71:05:4e:c7:39:6d:5a:8b:17
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 8, 2017
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
PE Signature issue
Digest
bd:ae:90:d3:3b:42:bf:69:31:7c:f4:d9:c1:9d:fd:c2:69:86:ca:f0
Digest Algorithm
sha1
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Chains
Sep 8, 2017
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Serial Number
0e:bf:ea:68:d6:77:b3:e2:6c:ab:41:c3:3f:3e:69:de
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 16, 2016 - Dec 17, 2017
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Corporation,OU=STAR Security Engines,O=Symantec Corporation,L=Mountain View,ST=California,C=US
Serial Number
2e:6b:e6:bd:11:a8:67:6e:6c:57:90:9e:9b:0d:5f:57
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 15, 2017 - Apr 13, 2018
Subject
CN=Symantec Class 3 SHA256 Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7c:1b:35:35:4a:e7:db:74:e7:41:5f:11:69:ca:6b:a8
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jul 22, 2014 - Jul 21, 2024
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
1
Major OS version
5
Entry point
4800
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
ExitProcess
GetCommandLineW
GetFileSize
CreateProcessW
HeapAlloc
HeapFree
GetModuleHandleW
GetProcessHeap
WriteFile
GetSystemDirectoryW
ReadFile
GetModuleFileNameW
CreateFileW
lstrcatW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
user32
wsprintfW
shell32
CommandLineToArgvW
msvcrt
wcsstr
memcpy
free
malloc
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
828B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
28KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
590B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=224, productName=VS2013 UPD5 build 40629, version=40629,
count=1, id=223, productName=VS2013 UPD5 build 40629, version=40629,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=25, id=1, productName=Unmarked objects,
count=1, id=175, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Windows/Ransomware/Monster Ransomware (second new version).zip
- SHA256 a8cb8ff9d5b5110bc392f8356c9d81de2c2fb039b8ffdc12134204adac33c52b
- MD5 876e0542cce2b246e2a0794a92f766b7
- SHA1 5f30f676836b75503663f5de6683753b8237907f
- SHA512 24524b0fa3d7cad4ee04cbc50cf94f0b0f1773a84af07dd187d22432a370fdcf00a4ea8dd3bb7ff0f0712831f07ebcc438432249f07261e4a676f35edfde459c
- SSDEEP 768:PRIruUuQ08avVAvV9vuY8k9EPBw0Q49644leebtW/5:PmuBo9vbEPBhQ48nlpW/5
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Monster Ransomware (second new version)/tunamor.exe
- SHA256 78972cdde1a038f249b481ea2c4b172cc258aa294440333e9c46dcb3fbed5815
- MD5 e9fdc21bd273444925a4512166188e5b
- SHA1 e398138686eedcd8ef9de5342025f7118e120cdf
- SHA512 64989534f56fcd70f3ff08bb47a331d5624fc1e3b387420a885d6f32a537e05182de8c5890612cde03fdd312ad101955674d7455c84b900bf7eed97b402a2b08
- SSDEEP 768:Uv3mq1oJQpwvZlXhVkcDsaoi9P9TJKvaoStYARRQwfwiIySf4BtIl82+hE8x:YmqMQoXhVN4aooJhDCSeyxel82WNx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
32032
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
161KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
8B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Windows/Ransomware/Monster Ransomware.zip
- SHA256 1e5ed8905558e01db14106b51fdaad26398cbf04ab55fcfd108828f15ce383e3
- MD5 e0b99fa6358c719a278e4ca496e17f68
- SHA1 02a0f1d90c0d199760f5a463a9f1761fb918b540
- SHA512 6e0a056847ff49c2cd8205ad6b1790ab2c6af47edb4b2cfe7a4ccff2c02d39c8520d0e6562da0cdf53e8a28c3e463c90ef0fafa524d7ba050e5a8683af78f80a
- SSDEEP 12288:8/f4EvsPm/43szXwI/vVHUg7juTqDBsE1Y9ddNdrYafm5mIPcymC/l3Qze:24WXhnV0o6ws/xYaf/I443Qi
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Monster Ransomware/XMoon.exe
- SHA256 ea0a5854aa6e91ebe816d256f34f820697a92d86b4f81e8855c84daeed40b9d4
- MD5 a690cce59e21f5198ca304243b084f9e
- SHA1 8aeb0b106dd21e2afb50c3f7ae78ca4f8f4b29c5
- SHA512 9e0eebf53d0ea424ae9aeb0da2e27e5be75391a5be2945d29137da12baff32184df3a223692bbabb4b64350d902bd6847284d982e62313f3402035e842f4b758
- SSDEEP 12288:X6Wq4aaE6KwyF5L0Y2D1PqL6eqhBkEFY9ddNdzYaTW3aSDcyImRlL7zo:1thEVaPqL6JkF9YaTLSigL7c
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
896672
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
608KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
264KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
165KB
Virtual Size
168KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=152, version=20115,
count=175, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=53, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=33, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=528, id=1, productName=Unmarked objects,
count=72, id=180, version=40219,
count=28, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
Windows/Ransomware/Trojan.Ransom.GoldenEye.zip
- SHA256 24e74afd2f0d567fb433a84af7065770ba4f75825bf071dc5862eee78009bdd1
- MD5 fc9a825f9d890c48a1680ba6edb404b6
- SHA1 187ad9c4164e57674f770b05a22d62a12eb86c6f
- SHA512 2b7f1b102ebc42eb5524a1e689254ed31540c53f2e268e8506315aacf1ec103eecd36d7c3462011bd424ce664f348f2ae1c52345d071942c68bfa8cd62f7ab79
- SSDEEP 6144:w7Tu21ldM1vm+M64qM0gcjcTY3BmzRlHvVI82njmRgAZR6hFd:wfc4qDgdTJnvVIjmRgAEX
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.exe
- IMPHASH eadbe699c9f56194b9bbdf2dd7631233
- SHA256 389a7d395492c2da6f8abf5a8a7c49c3482f7844f77fe681808c71e961bcae97
- MD5 e3b7d39be5e821b59636d0fe7c2944cc
- SHA1 00479a97e415e9b6a5dfb5d04f5d9244bc8fbe88
- SHA512 8f977c60658063051968049245512b6aea68dd89005d0eefde26e4b2757210e9e95aabcef9aee173f57614b52cfbac924d36516b7bc7d3a5cc67daae4dee3ad5
- SSDEEP 3072:iTAjnioLO7WpLyLNZMcPSK7BaZ0NwAWMGc0HfmY4KsyyOiy12KJ3I4YgTl:i6nrD0ZMcPBAL7c0fTHs+2sYXg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
50212
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\src\ZoomIt\Release\ZoomIt.pdb
comctl32
ord17
winmm
PlaySoundA
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipSetPixelOffsetMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
GdipCreateBitmapFromHBITMAP
msimg32
AlphaBlend
kernel32
GetTickCount
FormatMessageA
lstrcpynA
CreateEventA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
ExpandEnvironmentStringsA
FindResourceA
GetFileAttributesA
DeleteFileA
MultiByteToWideChar
GetStringTypeW
FatalAppExitA
CreateSemaphoreW
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
MulDiv
GetFileType
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
RtlUnwind
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
HeapSize
GetModuleFileNameW
WriteFile
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
GetCurrentThreadId
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
HeapAlloc
HeapFree
Beep
CloseHandle
SizeofResource
LoadResource
Sleep
WaitForSingleObject
GetLastError
SetThreadPriority
GetCurrentThread
GetExitCodeProcess
GetCurrentProcess
GetVersion
LockResource
GetCommandLineW
GetModuleHandleA
LoadLibraryA
LocalFree
LocalAlloc
GetProcAddress
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
RaiseException
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
InterlockedExchange
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
OutputDebugStringW
LoadLibraryW
SetFilePointerEx
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
ReadFile
ReadConsoleW
SetEndOfFile
DeleteCriticalSection
user32
FindWindowW
FindWindowA
GetParent
GetDesktopWindow
GetWindowLongA
SetRect
FillRect
GetSysColor
ChildWindowFromPoint
MapWindowPoints
GetClipCursor
ClipCursor
GetCursorPos
LoadIconA
MessageBoxA
GetWindowRect
GetClientRect
RedrawWindow
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
SetActiveWindow
UpdateWindow
ChangeDisplaySettingsExA
SystemParametersInfoA
EnumDisplaySettingsA
SetCursorPos
DrawTextA
TrackPopupMenu
InsertMenuA
DestroyMenu
CreatePopupMenu
TranslateAcceleratorA
LoadAcceleratorsA
EnableWindow
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
SetFocus
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextA
SetDlgItemTextA
DialogBoxParamA
CreateDialogParamA
BringWindowToTop
IsWindowVisible
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
PostMessageA
GetMessageExtraInfo
UnregisterHotKey
RegisterHotKey
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
SetWindowLongA
gdi32
DeleteDC
DeleteObject
Ellipse
GetStockObject
LineTo
Rectangle
SelectObject
CreateSolidBrush
StretchBlt
SetROP2
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
Polygon
CreatePen
CreateFontIndirectA
GetDeviceCaps
StartDocA
SetMapMode
EndDoc
StartPage
EndPage
BitBlt
CreateBitmap
CreateCompatibleBitmap
CreateCompatibleDC
SetBkMode
CreateDCA
comdlg32
GetSaveFileNameA
GetOpenFileNameA
PrintDlgA
ChooseFontA
advapi32
RegCreateKeyA
RegOpenKeyExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegCloseKey
shell32
ShellExecuteA
Shell_NotifyIconA
ole32
CoInitialize
Name
.text
Size
190KB
Virtual Size
189KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
43KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
434B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=207, version=50929,
count=23, id=205, version=50929,
count=130, id=206, version=50929,
count=23, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=248, id=1, productName=Unmarked objects,
count=1, id=206, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=207, productName=VS2012 UPD2 build 60315, version=60315,
count=1, id=201, productName=VS2012 UPD1 build 51106, version=51106,
count=1, id=204, productName=VS2012 UPD1 build 51106, version=51106,
Windows/Ransomware/Trojan.Ransom.GoldenEye/GoldenEye.js
- SHA256 28fd3a1d9087d7b103b7f6cfca002798b6365fe6ebcc66fa02dbb4a9e6378e71
- MD5 c4e9fc349d5c8b24c0ddb1533de2c16b
- SHA1 147e938bd06709b3c20eea4ac461093d573be037
- SHA512 fd0cf6f434e665aabc91f6095394a08483990c12a0b6ad3a1bd820b740af0ddbc02bc0a2592be429c7488b3cd2889afad8f758b4258009dfe51e9faac76842be
- SSDEEP 6144:Jnm5mwYxm+DzkzFIDIWCy49ezGywT7PDSzT3enlJ1BJ0exGqkIb1Taha6e2T6Huv:FnaIEWeqWdnlhJ+eHHu+1Qk3C+MAQ
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Trojan.Ransom.NotPetya.zip
- SHA256 b2303893caaf9c6e048fc2aaf7ecbe6264a629a19169e5395595442d78ba17ad
- MD5 cd941cd911bd1ac5c37754d1d022aefb
- SHA1 168f20a901b52ca314618a7ebdf0889f8db72b3e
- SHA512 45b47529c473ea3b5539c279f6ba7214b320db7c3845eb1e29dc215da6aa85fc06fbfc620a7019a41c2ab6728a5ec78a6804a6912dcd64b9670de49683cc78bc
- SSDEEP 6144:B1DSczJ7BsNnX1EPljAetGjN3bFNq7pvndbaqPEwK30b3nilrdQY/CdUT:KiJ7+1iNGoFdbPMwK323odQYaUT
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Trojan.Ransom.NotPetya/NotPetya.exe
- IMPHASH ab8fd60b3da01515e6706e8d122c633f
- SHA256 e2ea7f9581a7e1386fc6601d1421e1194373c1c891f2d406de6d49810fcc7737
- MD5 b6cc1e4052f613e15a8b05439f5877b4
- SHA1 9bb3cb5080ae18985d93a28faeca6ae06d768b21
- SHA512 cd48f448cd355a1463ca090d8ad47100596e1ed1a1a771f26c672406669433e9d9d915268def0aad844511f65a3c69fbb3ab2e2dc610ecc0f66a8524a6a8ea73
- SSDEEP 12288:rF/X4NTS/x9jNG+w+9OqFoK323qdQYKU3:BXATS/x9jNg+95vdQa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4747
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\users\pc\documents\visual studio 2010\Projects\ME Doc Update\Release\ME Doc Update.pdb
kernel32
GetFullPathNameA
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
ExpandEnvironmentStringsA
WriteFile
CloseHandle
HeapReAlloc
GetStringTypeW
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
RtlUnwind
HeapSize
LCMapStringW
MultiByteToWideChar
IsProcessorFeaturePresent
shell32
ShellExecuteA
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
362KB
Virtual Size
362KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=171, productName=VS2010 build 30319, version=30319,
count=8, id=158, productName=VS2010 build 30319, version=30319,
count=56, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=68, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Windows/Ransomware/Trojan.Ransom.PetrWrap.zip
- SHA256 f55269492d84c579e90c25923d4ea6fc27d240d0d4166db0dc24453abdb0a592
- MD5 5bcfce4873962adbec7b3048dffb5ccb
- SHA1 b7d80a0bc35e50c073243f9d66c00625652f4f0c
- SHA512 5fdfea5b06c6885831e8ecc347cfb8547774b3e8c4d09e4fc2d686b1c62bcf6ce2d3db22faeaaae7cd1dbfcb8c564bd99d8312dc6e4bb39390a9a21a295a0413
- SSDEEP 12288:VfmoN7bRQQIpk39ZD0ugFKc/JvaH2rt7O/xV1J/tQL/2rMFJOYb03x:VekHRqc9ZDgZ/u2rhGZFG8Dx
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap
- IMPHASH 90cfb770dd8b0646a46fc541c93185a2
- SHA256 e079fa28ea51fa98644164caf585ae3231d25372fccca1245902fb57488d4660
- MD5 17c25c8a7c141195ee887de905f33d7b
- SHA1 7fa8079e8dca773574d01839efc623d3cd8e6a47
- SHA512 de95f18101b99d159fe459c5e5651e0db2b1c76e02c9c2741bfd920decc970abc6dc0b41651be0471b4c7c3deb8b5e9a6e956c6515f268f9dfee7b76087a1e2b
- SSDEEP 12288:ZPaAhutLwUVsvLPcFZXYl0oIZdm9n50DNq:ZPjutLRuvLPcX8mC5S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
149532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcessId
GetTickCount
GetVersionExA
FreeLibrary
GetProcAddress
GlobalMemoryStatus
LoadLibraryA
HeapAlloc
HeapFree
GetCommandLineA
HeapReAlloc
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ReadFile
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
AreFileApisANSI
MultiByteToWideChar
GetProcessHeap
SetLastError
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetEnvironmentStringsW
QueryPerformanceCounter
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
LoadLibraryExW
LoadLibraryW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
SetFilePointerEx
SetStdHandle
GetStringTypeW
LCMapStringW
HeapSize
CreateFileW
SetEndOfFile
GetVersion
GetCurrentThreadId
GetLastError
GetFileType
GetStdHandle
Sleep
VirtualAlloc
CreateFileA
CloseHandle
FreeEnvironmentStringsW
WriteFile
user32
GetUserObjectInformationW
GetProcessWindowStation
wsprintfA
MessageBoxA
GetDesktopWindow
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
139KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=207, version=50929,
count=22, id=205, version=50929,
count=143, id=206, version=50929,
count=94, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=4, id=207, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Patched)
- IMPHASH 90cfb770dd8b0646a46fc541c93185a2
- SHA256 bb990e2307c5f1143f3b8fabd77e62a2754c25b1de45636b93b6c87d1dc12784
- MD5 f9dc218f57d7ecf5a8664a6561a59a2e
- SHA1 f9e15d4799c382a00b17c322826c0fbee7a7014b
- SHA512 00c3e39687bcd9951d63adb521c096120d1c81521bb56615b32c42a0f5126f31fea023a173a95230a0d1e74056cd84baad29ffd7615409ff8b07640c550d955a
- SSDEEP 12288:9PaAhutLwUVsvLPcFZXYl0oIZdm9n50DNx:9PjutLRuvLPcX8mC5S
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
149532
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcessId
GetTickCount
GetVersionExA
FreeLibrary
GetProcAddress
GlobalMemoryStatus
LoadLibraryA
HeapAlloc
HeapFree
GetCommandLineA
HeapReAlloc
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
IsDebuggerPresent
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
ReadFile
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
AreFileApisANSI
MultiByteToWideChar
GetProcessHeap
SetLastError
InterlockedIncrement
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetEnvironmentStringsW
QueryPerformanceCounter
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
LoadLibraryExW
LoadLibraryW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwind
ReadConsoleW
SetFilePointer
SetFilePointerEx
SetStdHandle
GetStringTypeW
LCMapStringW
HeapSize
CreateFileW
SetEndOfFile
GetVersion
GetCurrentThreadId
GetLastError
GetFileType
GetStdHandle
Sleep
VirtualAlloc
CreateFileA
CloseHandle
FreeEnvironmentStringsW
WriteFile
user32
GetUserObjectInformationW
GetProcessWindowStation
wsprintfA
MessageBoxA
GetDesktopWindow
advapi32
ReportEventA
DeregisterEventSource
RegisterEventSourceA
Name
.text
Size
205KB
Virtual Size
205KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
139KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=207, version=50929,
count=22, id=205, version=50929,
count=143, id=206, version=50929,
count=94, id=206, productName=VS2012 UPD3 build 60610, version=60610,
count=9, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=108, id=1, productName=Unmarked objects,
count=4, id=207, version=61219,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Windows/Ransomware/Trojan.Ransom.PetrWrap/Trojan.Ransom.PetrWrap(Wiper)
- IMPHASH 09d0478591d4f788cb3e5ea416c25237
- SHA256 a22c230e85a9813eb863cc5e0b02116aa1ddd78550a73e423d2772edc515b396
- MD5 efc417703cf395ce7eb7d4b541aef38f
- SHA1 c139e545942f7d6a996ed543d2bd96806995df0f
- SHA512 ddbd28161ec93064cd2781080305c1be4c299cc20c9e94f38f0363f8af9d4a8383b3793124c2495eabec08a99f3d045a8cc057d5b5db25fd31d358fc3bb0771a
- SSDEEP 768:cZ3A5T5efj/t4zY5w67NUBnx3cSNxtoyP18hqyBrzESviowkdL:cpcTUfj/Lw6EbrtFP19Gr35
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
13120
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree
Name
.text
Size
35KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
512B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=45, id=171, productName=VS2010 build 30319, version=30319,
count=117, id=170, productName=VS2010 build 30319, version=30319,
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=95, id=1, productName=Unmarked objects,
count=2, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
Windows/Ransomware/WannaCrypt0r.zip
- SHA256 c0d0291ed579c974d771ecf6d255fc21122301868e40dce5c09fc67479a488d1
- MD5 05098733b42aa547546b3fd7d4eb95d7
- SHA1 e756989fb205516b665610ea25f9e897295ad792
- SHA512 3730d6c96050c6480ddebf3c92549c7135c67b2058ec8ee88c9d7f1fd6eb606918ed25f4db9fbb111930707aff7b96db906ef301a4e8674cb9a321cde129b97f
- SSDEEP 98304:hH+AqXjxj0Z76SUZA96QAgXhrvWS93X/77qOAR3ec3L:hH+Xjs76nA9ZAggStj7qOWOc7
- MD5 SHA1 SHA512 SSDEEP
Windows/Ransomware/WannaCrypt0r/WannaCrypt0r.exe
- IMPHASH 68f013d7437aa653a8a98a05807afeb1
- SHA256 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
- MD5 84c82835a5d21bbcf75a61706d8ab549
- SHA1 5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
- SHA512 90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
- SSDEEP 98304:QqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVp2g3x:QqPe1Cxcxk3ZAEUadzR8yc4gB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
30650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetFileAttributesW
GetFileSizeEx
CreateFileA
InitializeCriticalSection
DeleteCriticalSection
ReadFile
GetFileSize
WriteFile
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesW
SetCurrentDirectoryW
CreateDirectoryW
GetTempPathW
GetWindowsDirectoryW
GetFileAttributesA
SizeofResource
LockResource
LoadResource
MultiByteToWideChar
Sleep
OpenMutexA
GetFullPathNameA
CopyFileA
GetModuleFileNameA
VirtualAlloc
VirtualFree
FreeLibrary
HeapAlloc
GetProcessHeap
GetModuleHandleA
SetLastError
VirtualProtect
IsBadReadPtr
HeapFree
SystemTimeToFileTime
LocalFileTimeToFileTime
CreateDirectoryA
GetStartupInfoA
SetFilePointer
SetFileTime
GetComputerNameW
GetCurrentDirectoryA
SetCurrentDirectoryA
GlobalAlloc
LoadLibraryA
GetProcAddress
GlobalFree
CreateProcessA
CloseHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
FindResourceA
user32
wsprintfA
advapi32
CreateServiceA
OpenServiceA
StartServiceA
CloseServiceHandle
CryptReleaseContext
RegCreateKeyW
RegSetValueExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
msvcrt
realloc
fclose
fwrite
fread
fopen
sprintf
rand
srand
strcpy
memset
strlen
wcscat
wcslen
__CxxFrameHandler
??3@YAXPAX@Z
memcmp
_except_handler3
_local_unwind2
wcsrchr
swprintf
??2@YAPAXI@Z
memcpy
strcmp
strrchr
__p___argv
__p___argc
_stricmp
free
malloc
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_CxxThrowException
calloc
strcat
_mbsstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Name
.text
Size
28KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=12, version=7291,
count=1, id=11, version=8047,
count=4, id=14, version=7299,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=163, id=1, productName=Unmarked objects,
count=7, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
Windows/Trojan.VBS.Bolbi.zip
- SHA256 79dc113a4194e48e01b39d39156ce6b3bd50e02a5b07c1e1f40dd6c4b4cea967
- MD5 3d83b9debba178eca1ba8fce39e15f7c
- SHA1 9839eade0225a2f803cb539ca4f8237aed2e2040
- SHA512 071ed4215873624fb9d2796d82bda6270928ab38d27d963c7c00ee300f9cb0390480ab67495abce0c8dd408bf3ab697f8e77efbbe2ad6cf32d9913e03e6f1671
- SSDEEP 96:bSN6NqCxqrlc1ZUdfjqmLLwhpbuu29nDGw9w7at/8IrIGVFIjoEIazPuIIwI5NuK:bSCqsqrl7jLwr89nyw9oe/8IrIDjoEIz
- MD5 SHA1 SHA512 SSDEEP
Windows/Win16/Virus.Win16.Apparition.zip
- SHA256 b5202a2b9a13b8087479f15423759768537f41dbd25d6f701c56dd05cbc64937
- MD5 78bc80f340b9deb12ace499a6487260d
- SHA1 383aa778f61f745e8f1201c6e5997b22b4caa38b
- SHA512 16921b755198f843085c55375cdecc304fd853bee9840f2a6a6378170407d34735ca42c87ccc9edc638c8b4b0518e53656fbc4926cb1a48c82e8b7c6e2d0998f
- SSDEEP 1536:o4WvWL2ow3Z1rfb0+Hu1/NxfEJrwaGL0yNv7x5+J9p6FY0:oPrHU+aNpraGLHF9IQFY0
- MD5 SHA1 SHA512 SSDEEP
Windows/Win16/Virus.Win16.Gollum.zip
- SHA256 64a9eb8732f3e75b7cac730a1f5400e037750c2dc268c29635fe927996b5bb97
- MD5 834b2eaf1ba4289dd7cb394851184076
- SHA1 8cb216b8b4730a246aabc0d26862c4c6cef6aee0
- SHA512 ad8a19d357e601bcb40f92db7c07321dff9242b7a40dbe5a4154aa834457310459c4004034bf4bea0d4a1aa9af360d0a3c2a9128d3367027c28d736d6f12a7d5
- SSDEEP 384:RnLJGiG04piXv4zko+kx1YWfB6aHZwr+jmk0s8XBnACBqp3DzLO2o/:NI33pkv4zkojx1Yk5wfs8NAgw3DnOB
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Joke.Win32.Badgame.zip
- SHA256 5793faaba0dc98bbf0c068c4c404da4729a8d2ec03850fe1c941631a76cf8800
- MD5 d8b755ecc2352d82da833b3bdb1c2ff5
- SHA1 86941426a7e436cfa8f6172b386d9fdf90baeead
- SHA512 c2139a2e41a2a78cb4e65a7aef74c10c884c498a32139280deb6e7aa33396ccd27ff247f0ae84533e62d635fb8341b5784a9fb4a04b5d40fec91361d1a2aef91
- SSDEEP 768:3AqvAy27iryBbYlesCh7NZPjb2wgIc1uCvj1sZv4d4FBcxeP/:3nvL5eBeess7NZPjb2bIShsZtBcxeP/
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Joke.Win32.FakePetya.zip
- SHA256 3b2e941503de32acdf4a299b00275e2118c6ab15dc08efdc9bcbfc804725da4d
- MD5 4d4c3218f68965288e3b0fed6e611559
- SHA1 8f137935e06063a8a823c5f86f7dda123d713e8e
- SHA512 d8a3b0f0b2d25ce4413acb19c1c91f11465ea02fa7d44595ab396e75f62a3cd928b6d72b85f8dd814e886c76b93ab3391c792dde4cf68cd808506a9d73777ba7
- SSDEEP 768:E7ZFBEQ3CDCJg9Zk2B75n/MTaQdhuNqQNw6xo6J:E7Zv6t1EbuNtiQ
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Net-Worm.Win32.Opaserv.zip
- SHA256 ca4e5d7bc8b872f94e047625bab608ab7b4f3503326633c3baa0a7da8167f1fd
- MD5 8729f65cd343c27c05005315f58506b1
- SHA1 06b450d72e3f2bf1ccccc60f977143ed8e1c3483
- SHA512 ab36371c9685f4cb0d298dde0ca827ada9f68a31566795d292ad73377114fd71398ba69c7e2e9537db46aea28ba3e3e8bb01bc91276b5574f14b478d832c870c
- SSDEEP 768:zAJFQcFaWKBMpwrVOg88EA3Pky53dTcBhZuNtdlz/5IJ:8JFhaWKnpOL8PcgpcBONtdl0
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Trojan.Win32.Alerta.zip
- SHA256 9dfc4c8813ae25746fadc655fc2525223c2952c10c0b2432c0d43db61f341dc0
- MD5 f7a2ba6ca157f71b6d9cfc09a36c9f1f
- SHA1 67eec0d7c2332277471571369b4c0cc054221768
- SHA512 06b81c833191b99ebc7fc8ed8c355de2feda67a08fd5fafe2277ea6a3ecb6fa71caadeab54f5b5761af1adb2fd0b414543d8255460037dd435194c6d0784d2c8
- SSDEEP 1536:LhIwi1C9MTRamGtZpyxyC1bDXF8+CvunuARtkj1/BdLEclmh6:LhI9xFaDDpyxymd8+CvuRRtkj1/rRYY
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Trojan.Win32.IconDance.zip
- SHA256 6d6384205cc1f206724972337ad4e7659280c7be6377841c972808303a100ec9
- MD5 a7437146179d628edd1234e368524e74
- SHA1 8d3a2cd9dfdf4b6f1b16b5855d22d04ebe4b54e1
- SHA512 f8d31a2c3fea64d1d361489200a0fa7fd0a8154660bfc70f448f34123379f29a084c64d5f5fa775b31440871c39991b7f3cb79c0b115054139fda7c0821891da
- SSDEEP 3072:NRCk38NpR4S9t1m/JeWY2e1lPn2u1s4EI/7AVyPvoSoAglTq2f47gG6eGKoVm:NQk3SR4SBgJGl9i4EOLXpITq2w7V6goM
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Trojan.Win32.Sevgi.zip
- SHA256 dfed1b83179bcd77f9d5d60b930ea4cf75af5b5ad16d04ee741c97fa29e9a9a9
- MD5 a8d8f3b6b0a7ad03b900e97e497f4522
- SHA1 6f5c358d35d7ef9c3801e1f1490c62ef2910ad34
- SHA512 9f955873f3e3d3916814e9f2a333bb74bdc36beb833b7a0d0a3b802d747a8f8acc811015a9904a68bb6ecf380cbcc9ab5d72824da9bbb2dcba83a9d651d5a3b9
- SSDEEP 6144:7DYEPZ73KeFArWYiyI8ptSUNPaQ9zDAlJwp4nux0q3:7DTxjbFAr7zHNP7A7Q0q3
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Trojan.Win32.Whiter.zip
- SHA256 c72ae641512f1e72e58576d650eb9f35f97b0fc19e3a84dbb65578bae49ae8a4
- MD5 3d0815c3a722d667f490c7c55990e1b8
- SHA1 15962c038e36916ebb025c8ea6977272f3cabe33
- SHA512 717321f2b617d8edc2bb63b55744bcf43ebf4789dc6451ff50525edf431a289f78bcea69a1183dddd7c2670f371b5a4acc9ea0769d4c851214813d33119aca0b
- SSDEEP 384:wleVqPvJuI6jCnPE5+w0gF6qFcXLFScdbyu4Xu0NA7lP0pw6Opx:wDPEWnPEkg0qFcbFScku4+0I8pwVz
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Virus.VBS.Karma.zip
- SHA256 796435c3de5490760467e30bdd9a489ea5f09fa17b712ecfef69cd30fdae2fcb
- MD5 d5088cf5357d0114565e91ee602fdabc
- SHA1 8af8589f4cc28be4c54f90eb49c871518e854e76
- SHA512 3a279866fa77ce7824e0cd56b2091d3e3813f31efa2e30886883362ffc79c6b234b5702dfd760ea91dbe10971649b26eaca4c8c9daa9b030840441d2162737ad
- MD5 SHA1 SHA512
Windows/Win32/Virus.Win32.Antares.zip
- SHA256 945e999bcc4287d7d7df0b5f766345eea56ad0c3673b2a1dd63ef408c3211eab
- MD5 39f9da0534677e135e11faf2c33ecbd2
- SHA1 51c32938f42e5cd3e146b979492368e99750ba82
- SHA512 e3e25a892001fccc33bf50403ddc650000c29b1e17b44f46446d7fafb4bbf56d440ab0d91e0922d0bf931b8a9a611bab2313a46b0a06016d18b2e7379b5d5733
- SSDEEP 768:TlZqPsDWI/iZW+g8eDV+S8gM+5PYXCDsCUBqg0A3IHU2Q0mVPeRLP:KsDWI/MYDwaQPBqgVIH1UVPeRLP
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Virus.Win32.Rigel.zip
- SHA256 46c5fc0c6716f1ef34ebef91f7a6b5dc1da633b3b1c1498c9ce5bf7da4f8fe09
- MD5 6937f74fb2fe29419f720231e59135b5
- SHA1 85237b2e5a84bc1f0848f0bc7493369b9ef0e8c1
- SHA512 b24abd3a3e57ce9f303efa91c2049dbb3d26439c4f87a3acc78f689685c764a6ceae7148e5040c1c1c41b7cc3e080cda50b197d211064d58f8dfdcea1b8dc15a
- SSDEEP 768:SgNtGTDvh4Ee7xBsFQc9S2WmlxBbj4RvxfDCqoNRIYV53PfNroLHzI:5OWBGSq2p7o/IYDnNoM
- MD5 SHA1 SHA512 SSDEEP
Windows/Win32/Virus.Win32.Winfig.zip
- SHA256 14d982313af14bad97ccac92bccdf773ff8de3dc27797020ab3326981e1cb983
- MD5 5480dba50f642808dfa929d44d841174
- SHA1 e78916358b8a1d2640a9e3ef1ea9c29f509bf14b
- SHA512 295597681a169ee0e7297e0af7cdae118b0de25b48fef087e8c351763f25bf01faa997b4a6a265155d3e189f662388c6bd5cf1274ee7975a048d53351f440615
- SSDEEP 192:0zpe2uEJWuiak9cQaVFOiAx+dbROv7Xzv2HSCI6lA0ioEJcGGDlrvY/pgesQP:CphU9cz3FbROv7jv2/jioEXGdEn
- MD5 SHA1 SHA512 SSDEEP
Windows/Win9x/Trojan.Win9x.FlashKiller.zip
- SHA256 3a008a746ccf097352f0e10ec9ee0b8ca44985318b3ef1da4aa175bc1baafb33
- MD5 9ba30bf603fbab06572b52bb6ec2e90b
- SHA1 8fb2b38e39cbc2e16dbc56e4d9506fd70d005860
- SHA512 0c84c83604e6d0689d0e8ca4beb94c9653674d79ed619c0ee277bfe10904f5cfffbe2dd75ce88069abb7d4e1d1e59c36e82201a2ba58e0738f4416e60212c3df
- MD5 SHA1 SHA512
Windows/Win9x/Virus.Win9x.CIH (Infected AlZip program).zip
- SHA256 b951dddaa950fdeecbeae0c6915db4924da93be3413be783a78a42385065f70b
- MD5 c90a564ca42d8457767f9690b47f4742
- SHA1 34382b9aa21ce38d2bc4ccf9f78f99cc7fb8201e
- SHA512 13de1cc3983d8977dc22e452f3d7bfd28790e4913ef55234f71c3dc23a8593e131fbb2beaed186a1a2ea567d219b6bbd6a53e1073b3fe22d1e41216cc1cead5e
- SSDEEP 24576:8MY9hgbN9FlC2GDuH2ee7KuypvdQ6iUR7RS5NSFV:JYrgbbFlwSHUGlGgVS5gFV
- MD5 SHA1 SHA512 SSDEEP
Windows/Win9x/Virus.Win9x.CIH.zip
- SHA256 3d69ea82cb63eb9c39384b1ee5628b040a38bad97fc3dba78edb731dab899e7d
- MD5 8eeb278c35f182dee45f5d735901385b
- SHA1 f830498f3d5df0ade0d5a187ffaeeb98d0dd337c
- SHA512 b91120c33722a7154d9ae3b7d1b6a7681f8aabe744a7ae81f66bb09bbc6249c6b399884f1d95921033982aee4f62a82cd77a320503ac702f30668ec8fb5afa3a
- SSDEEP 192:9IvwWx88Fq/Cd9htuKTAmmQRhzPt06Zqdsup31nZLT+hJ:9IPx8nqd3AOTmQhzHqddTZLTOJ
- MD5 SHA1 SHA512 SSDEEP
Windows/Win9x/Virus.Win9x.Prizm.zip
- SHA256 7967236f6422012bc85a22a5b3028c98ffc857772d111674d75595a1d6f42cf9
- MD5 9e2c3840c03afc4eb9d5a754ca59958e
- SHA1 a2c41ede0b293c201385fd911d7187f48d356b17
- SHA512 90f0f1f8d7b6869e39b699b7eee2600349f157ef45fbbd0023b300186df234840762728903383645c38926d26e4740d2805a2297571e41681c6f8b35f51b63c7
- SSDEEP 96:foY2/hfHKtysfYERBu5g5ZfBI2muPywpoPuYd95lduc+ZkSDrCqmgbzlnwae5Jh6:f0/hfqtHfvRE5c9BTmuaTj/ddSDrCrib
- MD5 SHA1 SHA512 SSDEEP
Windows/Win9x/Virus.Win9x.Shoerec.zip
- SHA256 27761477969eac5965feee42fe86d5d6718f0f4a14d8bee08ec1f18c5dec8704
- MD5 447f6f5911e8517992d026ab7fb98bfe
- SHA1 9eedb57ed1d9c992bf7c975b3cbc623bb9bfb0fe
- SHA512 eddd8df0e7f4c1af7ccde6d4deef72000cd35cbbdc05e0b7792acb7d5f00da7473fddfca791c00f537bac96fbe5d2a21209e2fd9bf2c2f9159d9055faac744a9
- SSDEEP 3072:8USIacOFSQSX44hUE4AqeFOl9N6YKAP8ACXyYO+B87FxBFf25dPD+lCc2AfOZNCg:8JcDt5+E4AqEOhcAUA+TO+oF25Lc0ZoC
- MD5 SHA1 SHA512 SSDEEP
Windows/Win9x/Virus.Win9x.Smash.zip
- SHA256 4bbfaa8d551b40cdc69f1fa5775169456f716b374a0a9b1577baccbd56afb0db
- MD5 45c96d9e5d0d2291cc881cd62df05a2b
- SHA1 d4c4ad1ea14113cdedac5bbb2c7b4bee883adaf5
- SHA512 7fb957f788417a87e14842cf36d16e9c86bc43ad51c3613ade55b7be69737f98d523d6e4435ed2b47710fe058a78cc3b6952ea226798c59b0fe869d7947ad450
- SSDEEP 192:749JJk3B1kmGr76zN6uMuAkhFTwLbg/EasrEqa1A3JcBZ/FuB8INpCt+D1kn:74WBmJr76zk+AkLv/Hse1A3yBZ/FuBXk
- MD5 SHA1 SHA512 SSDEEP