Individual Components.zip
- SHA256 f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897
Overview
overview
8Static
static
3MicrosoftW...ll.bat
windows7-x64
1MicrosoftW...ll.bat
windows10-2004-x64
1MicrosoftW...nc.vbs
windows7-x64
3MicrosoftW...nc.vbs
windows10-2004-x64
7MicrosoftW...un.vbs
windows7-x64
3MicrosoftW...un.vbs
windows10-2004-x64
7MicrosoftW...dy.exe
windows7-x64
8MicrosoftW...dy.exe
windows10-2004-x64
8MicrosoftW...or.exe
windows7-x64
3MicrosoftW...or.exe
windows10-2004-x64
7MicrosoftW...ch.exe
windows7-x64
1MicrosoftW...ch.exe
windows10-2004-x64
1MicrosoftW...er.exe
windows7-x64
3MicrosoftW...er.exe
windows10-2004-x64
7MicrosoftW...ew.exe
windows7-x64
8MicrosoftW...ew.exe
windows10-2004-x64
8MicrosoftW...le.exe
windows7-x64
3MicrosoftW...le.exe
windows10-2004-x64
7MicrosoftW...od.exe
windows7-x64
1MicrosoftW...od.exe
windows10-2004-x64
1MicrosoftW...er.bat
windows7-x64
MicrosoftW...er.bat
windows10-2004-x64
MicrosoftW...32.exe
windows7-x64
1MicrosoftW...32.exe
windows10-2004-x64
1MicrosoftW...2s.exe
windows7-x64
4MicrosoftW...2s.exe
windows10-2004-x64
7MicrosoftW...le.vbs
windows7-x64
3MicrosoftW...le.vbs
windows10-2004-x64
7MicrosoftW...ec.vbs
windows7-x64
1MicrosoftW...ec.vbs
windows10-2004-x64
1MicrosoftW...en.vbs
windows7-x64
3MicrosoftW...en.vbs
windows10-2004-x64
7Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MicrosoftWindowsServicesEtc/AppKill.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
MicrosoftWindowsServicesEtc/CallFunc.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
MicrosoftWindowsServicesEtc/DgzRun.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
MicrosoftWindowsServicesEtc/GetReady.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral9
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
MicrosoftWindowsServicesEtc/Major.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
MicrosoftWindowsServicesEtc/NotMuch.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral14
Sample
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
MicrosoftWindowsServicesEtc/WinScrew.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral17
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
MicrosoftWindowsServicesEtc/breakrule.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
MicrosoftWindowsServicesEtc/bsod.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
MicrosoftWindowsServicesEtc/checker.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
MicrosoftWindowsServicesEtc/data/eula32.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
MicrosoftWindowsServicesEtc/data/runner32s.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
MicrosoftWindowsServicesEtc/example.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
MicrosoftWindowsServicesEtc/fexec.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral31
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
MicrosoftWindowsServicesEtc/healgen.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target Individual Components.zip
- Size 23.9MB
- Sample240302-3d17dsag33
- SHA256 f30ea0f7276100d02319bee64445888af5d784eb12a962ea88f99d2ae4137897
- MD5 f949dd5dafce6af3c7b259a33fd6a63d
- SHA1 22d00d8c5d3c377c1dff4d5cea0a78f79e84c052
- SHA512 0a3d3ea21448cdedcf4fb139aea239edc8621d91a200bcb5c4ba54ab1e6eb95165b6fbf49457a796ff98f5903685b55304e44f976288d67b558ffae1357647b2
- SSDEEP 393216:dMvRIppwpu4lXNO208Odt0i9i6WZuwo4bPdbf9bdTyVyclN/bq4n3DVc1GKU:6vowpJlMXoxxg2blPYN/bq4n3DAU
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 15 IoCs
Checks for missing Authenticode signature.
resource unpack002/MicrosoftWindowsServicesEtc/GetReady.exe unpack002/MicrosoftWindowsServicesEtc/Major.exe unpack002/MicrosoftWindowsServicesEtc/NotMuch.exe unpack002/MicrosoftWindowsServicesEtc/RuntimeChecker.exe unpack002/MicrosoftWindowsServicesEtc/WinScrew.exe unpack002/MicrosoftWindowsServicesEtc/breakrule.exe unpack002/MicrosoftWindowsServicesEtc/bsod.exe unpack002/MicrosoftWindowsServicesEtc/data/eula32.exe unpack002/MicrosoftWindowsServicesEtc/data/runner32s.exe unpack002/MicrosoftWindowsServicesEtc/majordared.exe unpack002/MicrosoftWindowsServicesEtc/majorlist.exe unpack002/MicrosoftWindowsServicesEtc/majorsod.exe unpack002/MicrosoftWindowsServicesEtc/rsod.exe unpack001/Individual Components/SpamMessage.exe unpack001/Individual Components/runaway.exe
File Explorer
-
Individual Components.zip.zip 23.9MB
-
Individual Components/MrsMajor All Files.zip.zip 23.9MB
-
MicrosoftWindowsServicesEtc/AppKill.bat671B
-
MicrosoftWindowsServicesEtc/CallFunc.vbs.vbs 388B
-
MicrosoftWindowsServicesEtc/DgzRun.vbs.vbs 341B
-
MicrosoftWindowsServicesEtc/GetReady.exe.exe 52KB
-
MicrosoftWindowsServicesEtc/Major.exe.exe 60KB
-
MicrosoftWindowsServicesEtc/NotMuch.exe.exe 122KB
-
MicrosoftWindowsServicesEtc/RuntimeChecker.exe.exe 58KB
-
MicrosoftWindowsServicesEtc/WinScrew.exe.exe 52KB
-
MicrosoftWindowsServicesEtc/breakrule.exe.exe 58KB
-
MicrosoftWindowsServicesEtc/bsod.exe.exe 1.2MB
-
MicrosoftWindowsServicesEtc/checker.bat151B
-
MicrosoftWindowsServicesEtc/clingclang.wav13.1MB
-
MicrosoftWindowsServicesEtc/data/eula32.exe.exe 1.2MB
-
MicrosoftWindowsServicesEtc/data/excursor.ani17KB
-
MicrosoftWindowsServicesEtc/data/fileico.ico38KB
-
MicrosoftWindowsServicesEtc/data/runner32s.exe.exe 58KB
-
MicrosoftWindowsServicesEtc/data/thetruth.jpg.png 483KB
-
MicrosoftWindowsServicesEtc/example.txt.vbs 302B
-
MicrosoftWindowsServicesEtc/fexec.vbs.vbs 2KB
-
MicrosoftWindowsServicesEtc/healgen.vbs.vbs 302B
-
MicrosoftWindowsServicesEtc/majordared.exe.exe 8.8MB
-
MicrosoftWindowsServicesEtc/majorlist.exe.exe 51KB
-
MicrosoftWindowsServicesEtc/majorsod.exe.exe 58KB
-
MicrosoftWindowsServicesEtc/rsod.exe.exe 74KB
-
MicrosoftWindowsServicesEtc/weird/GetReady.bat345B
-
MicrosoftWindowsServicesEtc/weird/Major.vbs.vbs 2KB
-
MicrosoftWindowsServicesEtc/weird/RuntimeChecker.vbs.vbs 440B
-
MicrosoftWindowsServicesEtc/weird/WinScrew.bat336B
-
MicrosoftWindowsServicesEtc/weird/breakrule.vbs.vbs 108B
-
MicrosoftWindowsServicesEtc/weird/bsod.bat133B
-
MicrosoftWindowsServicesEtc/weird/cmd.vbs11B
-
MicrosoftWindowsServicesEtc/weird/majorlist.bat105B
-
MicrosoftWindowsServicesEtc/weird/majorsod.vbs.vbs 126B
-
MicrosoftWindowsServicesEtc/weird/runner32s.vbs.vbs 383B
-
MicrosoftWindowsServicesEtc/xRun.vbs.vbs 93B
-
MicrosoftWindowsServicesEtc/xRunReg.vbs.vbs 134B
-
Individual Components/SpamMessage.exe.exe 8KB
-
Individual Components/readme.md127B
-
Individual Components/runaway.exe.exe 8KB
Individual Components/MrsMajor All Files.zip
- SHA256 f4ded5c4fb0a84a29d1ce1daf78fa298a4d5639aee11fc5c510a7323421bc647
- MD5 cede7f0fd84f72e78cc4d545d6e4e0c5
- SHA1 ca3eaedef3e59db90979b55824d3807e2b94d615
- SHA512 17da93d606747d6a0d0db76754cd151c9866c7f9c991ee9ab023ac0cab9ea4da343fd8280725e2c49c83b000cb75496312604024e384f8c8a305d14e67eb7d1e
- SSDEEP 393216:pMvRIppwpu4lXNO208Odt0i9i6WZuwo4bPdbf9bdTyVyclN/bq4n3DVc1GKe:uvowpJlMXoxxg2blPYN/bq4n3DAe
- MD5 SHA1 SHA512 SSDEEP
MicrosoftWindowsServicesEtc/AppKill.bat
- SHA256 5549670ef8837c6e3c4e496c1ea2063670618249d4151dea4d07d48ab456690c
- MD5 d4e987817d2e5d6ed2c12633d6f11101
- SHA1 3f38430a028f9e3cb66c152e302b3586512dd9c4
- SHA512 b84fef88f0128b46f1e2f9c5dff2cb620ee885bed6c90dcf4a5dc51c77bea492c92b8084d8dc8b4277b47b2493a2d9d3f348c6e229bf3da9041ef90e0fd8b6c4
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/CallFunc.vbs
- SHA256 a767894a68ebc490cb5ab2b7b04dd12b7465553ce7ba7e41e1ea45f1eaef5275
- MD5 5f9737f03289963a6d7a71efab0813c4
- SHA1 ba22dfae8d365cbf8014a630f23f1d8574b5cf85
- SHA512 5f4fb691e6da90e8e0872378a7b78cbd1acbf2bd75d19d65f17bf5b1cea95047d66b79fd1173703fcfef42cfc116ca629b9b37e355e44155e8f3b98f2d916a2a
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/DgzRun.vbs
- SHA256 729f7540887cf32a5d4e1968a284c46cf904752821c734bd970ecd30a848477a
- MD5 a91417f7c55510155771f1f644dd6c7e
- SHA1 41bdb69c5baca73f49231d5b5f77975b79e55bdf
- SHA512 f786699c1ab9d7c74dd9eb9d76a76728980b29e84999a166a47b7ee102d8e545901ed0fcb30331712490a36de2d726115b661ad3900cdc2bfcfc601d00b76b07
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/GetReady.exe
- IMPHASH 7c4ab4fdaa64cb17a45b65aea063ccda
- SHA256 5319958efc38ea81f61854eb9f6c8aee32394d4389e52fe5c1f7f7ef6b261725
- MD5 57f3795953dafa8b5e2b24ba5bfad87f
- SHA1 47719bd600e7527c355dbdb053e3936379d1b405
- SHA512 172006e8deed2766e7fa71e34182b5539309ec8c2ac5f63285724ef8f59864e1159c618c0914eb05692df721794eb4726757b2ccf576f0c78a6567d807cbfb98
- SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqqjw0:Sn1KUhrIbsTIl4YTBfqQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strlen
strcpy
strcmp
memcpy
strcat
malloc
free
kernel32
GetModuleHandleA
HeapCreate
SetConsoleCtrlHandler
GetTempFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetExitCodeProcess
RemoveDirectoryA
HeapDestroy
ExitProcess
GetCommandLineA
GetNativeSystemInfo
GetVersionExA
Sleep
HeapAlloc
HeapFree
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentDirectoryA
GetTempPathA
LoadLibraryA
GetProcAddress
FreeLibrary
SetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
CreateDirectoryA
FindClose
FindFirstFileA
GetLastError
FindNextFileA
WriteFile
CreateFileA
SetFilePointer
GetFileSize
ReadFile
HeapReAlloc
user32
EnableWindow
DefWindowProcA
DestroyWindow
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
UnregisterClassA
LoadIconA
LoadCursorA
RegisterClassExA
IsWindowEnabled
GetSystemMetrics
CreateWindowExA
SetWindowLongA
SendMessageA
SetFocus
CreateAcceleratorTableA
SetForegroundWindow
BringWindowToTop
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DestroyAcceleratorTable
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExA
winmm
timeBeginPeriod
ole32
CoInitialize
shlwapi
PathRenameExtensionA
PathAddBackslashA
PathQuoteSpacesA
PathGetArgsA
Name
.code
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/Major.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 da0233f5e5e9a34e8dd4f6911444ca1f3e29bb9cbd958a9f4508ac7d72ccd55d
- MD5 d604c29940864c64b4752d31e2deb465
- SHA1 c1698ea4e5d1ba1c9b78973556f97e8f6dbbdef3
- SHA512 89a4a14574ba19fe319c766add0111feeb4320c08bf75f55a898d9acc783d5a862a6433758a413cc719b9179dcf873f1c850d1084851b8fc37aa1e3deabfcf54
- SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ/:4IxKWLvFn43bovQtu7qo43jjRDf4h/q
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/NotMuch.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 cf830a2d66d3ffe51341de9e62c939b2bb68583afbc926ddc7818c3a71e80ebb
- MD5 87a43b15969dc083a0d7e2ef73ee4dd1
- SHA1 657c7ff7e3f325bcbc88db9499b12c636d564a5f
- SHA512 8a02d24f5dab33cdaf768bca0d7a1e3ea75ad515747ccca8ee9f7ffc6f93e8f392ab377f7c2efa5d79cc0b599750fd591358a557f074f3ce9170283ab5b786a1
- SSDEEP 3072:V/mYyX16rSVvl/zCQXMdUQLK21J/mYyX16rSVvl/zCQXMdUQLK211:0j6mvLCQXM1L/wj6mvLCQXM1L/
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
130462
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Guest\documents\visual studio 2015\Projects\NotMuch\NotMuch\obj\Debug\NotMuch.pdb
mscoree
_CorExeMain
Name
.text
Size
119KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MicrosoftWindowsServicesEtc/RuntimeChecker.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 51f59e877a1c2a1c2760c677def7395ef2868c2ee3e56ffdc3ace570afa50428
- MD5 cd58990b1b7f6c68f56244c41ab91665
- SHA1 7ccca9958d6aebbe3883b55f115b041b827bd2e7
- SHA512 011bdd417ec3bf72daa2b32d3816b696be8b87423740dc2a0182e23515651deeb870a94f3415a73480145f9f5e36c1a3a492410b77ca95d7fab8b9826e9198cc
- SSDEEP 768:HfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQB:8IxKWLvFn43bovQtu7qo43jjRDf4e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/WinScrew.exe
- IMPHASH 7c4ab4fdaa64cb17a45b65aea063ccda
- SHA256 429e01b0e06b02a55bafb1527629f8d4c5f64d9b21ac9f81484a3928fdce6dc9
- MD5 1aaafedd9f259acca75708f4af10b5be
- SHA1 f6b4ea28d304e1f9205c1c0b970d60ee989402f2
- SHA512 a995ebf4d142452aabb419f0cacfa5412d03532840cb08c37dd7c00001dee521bf9d0da66ac4346b07dffd91fe01fa3115fa05811acbd43d380320dca1be4aa8
- SSDEEP 1536:Sn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqFwr:Sn1KUhrIbsTIl4YTBfqa
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strlen
strcpy
strcmp
memcpy
strcat
malloc
free
kernel32
GetModuleHandleA
HeapCreate
SetConsoleCtrlHandler
GetTempFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetExitCodeProcess
RemoveDirectoryA
HeapDestroy
ExitProcess
GetCommandLineA
GetNativeSystemInfo
GetVersionExA
Sleep
HeapAlloc
HeapFree
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentDirectoryA
GetTempPathA
LoadLibraryA
GetProcAddress
FreeLibrary
SetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
CreateDirectoryA
FindClose
FindFirstFileA
GetLastError
FindNextFileA
WriteFile
CreateFileA
SetFilePointer
GetFileSize
ReadFile
HeapReAlloc
user32
EnableWindow
DefWindowProcA
DestroyWindow
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
UnregisterClassA
LoadIconA
LoadCursorA
RegisterClassExA
IsWindowEnabled
GetSystemMetrics
CreateWindowExA
SetWindowLongA
SendMessageA
SetFocus
CreateAcceleratorTableA
SetForegroundWindow
BringWindowToTop
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DestroyAcceleratorTable
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExA
winmm
timeBeginPeriod
ole32
CoInitialize
shlwapi
PathRenameExtensionA
PathAddBackslashA
PathQuoteSpacesA
PathGetArgsA
Name
.code
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/breakrule.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 5eafebd52fbf6d0e8abd0cc9bf42d36e5b6e4d85b8ebe59f61c9f2d6dccc65e4
- MD5 bcb0ac4822de8aeb86ea8a83cd74d7ca
- SHA1 8e2b702450f91dde3c085d902c09dd265368112e
- SHA512 b73647a59eeb92f95c4d7519432ce40ce9014b292b9eb1ed6a809cca30864527c2c827fe49c285bb69984f33469704424edca526f9dff05a6244b33424df01d1
- SSDEEP 768:TfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQ5:oIxKWLvFn43bovQtu7qo43jjRDf45OP
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/bsod.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6581eeab9fd116662b4ca73f6ef00fb96e0505d01cfb446ee4b32bbdeefe1361
- MD5 8f6a3b2b1af3a4aacd8df1734d250cfe
- SHA1 505b3bd8e936cb5d8999c1b319951ffebab335c9
- SHA512 c1b5f845c005a1a586080e9da9744e30c7f3eda1e3aaba9c351768f7dea802e9f39d0227772413756ab63914ae4a2514e6ce52c494a91e92c3a1f08badb40264
- SSDEEP 24576:Zo4RxLUqi0cq0wQvNuPmLanpxJML1m2rVF9VoEzdWcKgl7xAYKTj6fi6QkGC3BQ:WopPL0bMmLYpxJTWxVoSoLglla6fiFc
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1293086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\guest\documents\visual studio 2015\Projects\THEREISNOESCAPE\THEREISNOESCAPE\obj\Debug\THEREISNOESCAPE.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MicrosoftWindowsServicesEtc/checker.bat
- SHA256 3382484b5a6a04d05500e7622da37c1ffaef3a1343395942bc7802bf2a19b53f
- MD5 f59801d5c49713770bdb2f14eff34e2f
- SHA1 91090652460c3a197cfad74d2d3c16947d023d63
- SHA512 c1c3a78f86e7938afbe391f0e03065b04375207704e419fe77bf0810d1e740c3ef8926c878884ad81b429ec41e126813a68844f600e124f5fa8d28ef17b4b7bc
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/clingclang.wav
- SHA256 6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29
- MD5 1c723b3b9420e04cb8845af8b62a37fa
- SHA1 3331a0f04c851194405eb9a9ff49c76bfa3d4db0
- SHA512 41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae
- SSDEEP 393216:mXi9si92zItrbEpi9Zstl69okZtHGv0PouGXOYcnv:mX8siQIZwastE9oGH5Ucn
- MD5 SHA1 SHA512 SSDEEP
MicrosoftWindowsServicesEtc/data/eula32.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c5704419b3eec34fb133cf2509d12492febdcb8831efa1ab014edeac83f538d9
- MD5 cbc127fb8db087485068044b966c76e8
- SHA1 d02451bd20b77664ce27d39313e218ab9a9fdbf9
- SHA512 200ee39287f056b504cc23beb1b301a88b183a3806b023d936a2d44a31bbfd08854f6776082d4f7e2232c3d2f606cd5d8229591ecdc86a2bbcfd970a1ee33d41
- SSDEEP 24576:ltxcvBKhCBmx66TPABwaktzXYjg6lks6TMHeAKHDZlwtH8eQ2d:2v0hC5ePtakt70gS1tBKHDZloH8eb
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1270738
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\guest\documents\visual studio 2015\Projects\eula32\eula32\obj\Debug\eula32.pdb
mscoree
_CorExeMain
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MicrosoftWindowsServicesEtc/data/excursor.ani
- SHA256 b93b0cb2bb965f5758cb0c699fbc827a64712d6f248aaf810cde5fa5ef3227eb
- MD5 289624a46bb7ec6d91d5b099343b7f24
- SHA1 2b0aab828ddb252baf4ed99994f716d136cd7948
- SHA512 8c77696fe1c897f56ea3afdecf67ad1128274815942cd4c73d30bf0a44dd1a690d8c2f4b0be08e604853084e5515020c2e913d6e044f9801b6223c1912eec8f8
- SSDEEP 96:TpjTq5589uVBc4VXdpQiMklaLHrmsqmggRdW/K26dpuMMK92Vqzjj/aJVO/A:djuK9uVBPjQcEaQPNuOzXaJVO/A
- MD5 SHA1 SHA512 SSDEEP
MicrosoftWindowsServicesEtc/data/fileico.ico
- SHA256 d13f7fd44f38136dae1cdf147ba9b673e698f77c0a644ccd3c12e3a71818a0cd
- MD5 a62eeca905717738a4355dc5009d0fc6
- SHA1 dd4cc0d3f203d395dfdc26834fc890e181d33382
- SHA512 47ffac6dc37dac4276579cd668fd2524ab1591b594032adbeb609d442f3a28235a2d185c66d8b78b6827ac51d62d97bdc3dffc3ffbaa70cf13d4d5f1dc5f16c2
- SSDEEP 768:NT3jpF8btdcP0pdsNhEGxz+e4HGiFULFkqr+vxYmCTTp5E3QbS8lC4pTqX:NT3j0tjsNmde4HGb2WHmQbvlxpa
- MD5 SHA1 SHA512 SSDEEP
MicrosoftWindowsServicesEtc/data/runner32s.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 a97ea879e2b51972aa0ba46a19ad4363d876ac035502a2ed2df27db522bc6ac4
- MD5 87815289b110cf33af8af1decf9ff2e9
- SHA1 09024f9ec9464f56b7e6c61bdd31d7044bdf4795
- SHA512 8d9024507fa83f578b375c86f38970177313ec3dd9fae794b6e7f739e84fa047a9ef56bf190f6f131d0c7c5e280e729208848b152b3ca492a54af2b18e70f5dc
- SSDEEP 768:nfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQR:cIxKWLvFn43bovQtu7qo43jjRDf4e
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/data/thetruth.jpg
- SHA256 4e3baea3d98c479951f9ea02e588a3b98b1975055c1dfdf67af4de6e7b41e476
- MD5 7907845316bdbd32200b82944d752d9c
- SHA1 1e5c37db25964c5dd05f4dce392533a838a722a9
- SHA512 72a64fab025928d60174d067990c35caa3bb6dadacf9c66e5629ee466016bc8495e71bed218e502f6bde61623e0819485459f25f3f82836e632a52727335c0a0
- SSDEEP 12288:hoHqZocqog5yrfBbCfgN2ZJ9c5E6Cfq+IJ6gSJ4zFSGj:/qovtynZfc5KrIcJ8rj
- MD5 SHA1 SHA512 SSDEEP
MicrosoftWindowsServicesEtc/example.txt
- SHA256 cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
- MD5 8837818893ce61b6730dd8a83d625890
- SHA1 a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
- SHA512 6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/fexec.vbs
- SHA256 f853dddb0f9f1b74b72bccdb5191c28e18d466b5dbc205f7741a24391375cd6f
- MD5 fd76266c8088a4dca45414c36c7e9523
- SHA1 6b19bf2904a0e3b479032e101476b49ed3ae144a
- SHA512 3cd49395368e279ac9a63315583d3804aa89ec8bb6112754973451a7ea7b68140598699b30eef1b0e94c3286d1e6254e2063188282f7e6a18f1349877adeb072
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/healgen.vbs
- SHA256 cc6d0f847fde710096b01abf905c037594ff4afae6e68a8b6af0cc59543e29bb
- MD5 8837818893ce61b6730dd8a83d625890
- SHA1 a9d71d6d6d0c262d41a60b6733fb23cd7b8c7614
- SHA512 6f17d46098e3c56070ced4171d4c3a0785463d92db5f703b56b250ab8615bcb6e504d4c5a74d05308a62ea36ae31bc29850187943b54add2b50422fb03125516
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/majordared.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 fa24bc7bc366f2ad579d57a691fb0d10d868e501221df0c32a98e705d2d61e43
- MD5 570d35aabee1887f7f6ab3f0a1e76984
- SHA1 ae989563c3be21ee9043690dcaac3a426859d083
- SHA512 9b68a8acacba451bbf028656c181fae29c5bcaed6a7ff4c1fc26ab708b62ca4be7bba9c777c598926d23331570617d20a0ce439f014461eccd8c3f595d21a54f
- SSDEEP 196608:xgHohVbAzr6oy+Hn2m4212TsuPmin+4Je5CcgY:OAVY6o3n2a16ein+4U5N
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
9245690
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Guest\documents\visual studio 2015\Projects\majordared\majordared\obj\Debug\majordared.pdb
mscoree
_CorExeMain
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MicrosoftWindowsServicesEtc/majorlist.exe
- IMPHASH 7c4ab4fdaa64cb17a45b65aea063ccda
- SHA256 3cdafc944b48d45a0d5dc068652486a970124ebe1379a7a04e5cf1dcf05c37c8
- MD5 230970ec5286b34a6b2cda9afdd28368
- SHA1 e3198d3d3b51d245a62a0dc955f2b1449608a295
- SHA512 52912b6b2ba55c540316fcfc6f45d68771d1c22ddf4eb09c2cc15fb8ddd214812c18fd75cd61b561c29f660e2bf20290a101b85da1e0bbf8dfbf90b791892b57
- SSDEEP 1536:bn1KqRJ9x3jnIbslu8JFNDfIDIO40nToIfqX:bn1KUhrIbsTIl4YTBfqX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strlen
strcpy
strcmp
memcpy
strcat
malloc
free
kernel32
GetModuleHandleA
HeapCreate
SetConsoleCtrlHandler
GetTempFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetExitCodeProcess
RemoveDirectoryA
HeapDestroy
ExitProcess
GetCommandLineA
GetNativeSystemInfo
GetVersionExA
Sleep
HeapAlloc
HeapFree
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentDirectoryA
GetTempPathA
LoadLibraryA
GetProcAddress
FreeLibrary
SetFileAttributesA
DeleteFileA
SetCurrentDirectoryA
CreateDirectoryA
FindClose
FindFirstFileA
GetLastError
FindNextFileA
WriteFile
CreateFileA
SetFilePointer
GetFileSize
ReadFile
HeapReAlloc
user32
EnableWindow
DefWindowProcA
DestroyWindow
GetWindowLongA
GetWindowTextLengthA
GetWindowTextA
UnregisterClassA
LoadIconA
LoadCursorA
RegisterClassExA
IsWindowEnabled
GetSystemMetrics
CreateWindowExA
SetWindowLongA
SendMessageA
SetFocus
CreateAcceleratorTableA
SetForegroundWindow
BringWindowToTop
GetMessageA
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
DestroyAcceleratorTable
MessageBoxA
GetWindowThreadProcessId
IsWindowVisible
GetForegroundWindow
EnumWindows
SetWindowPos
gdi32
GetStockObject
comctl32
InitCommonControlsEx
shell32
ShellExecuteExA
winmm
timeBeginPeriod
ole32
CoInitialize
shlwapi
PathRenameExtensionA
PathAddBackslashA
PathQuoteSpacesA
PathGetArgsA
Name
.code
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
MicrosoftWindowsServicesEtc/majorsod.exe
- IMPHASH d7ee0bec939bda9b20c9cb9dcb985e30
- SHA256 d1094e91960ded15444c6f50756adc451a7c0b495b2ea28319b7184ba96236f7
- MD5 b561c360c46744f55be79a25e1844e3c
- SHA1 ed0f7eb00b4f1ae6cf92ad75e5701014f3d03d56
- SHA512 0a3a75d08f1d7afcd7a476fc71157983e04b0c26b00ace4d505aa644e5da3e242dd0f6afdb3c93f29ba0b08d2702d0e96b49acba4ed260330068b13f93973e9f
- SSDEEP 768:jfiNar/0i5A9lquoNvU4n7oDBXhVa+3Y/v2pPLo6Gyfu7q3YKdX3jj60dhfp0nQY:4IxKWLvFn43bovQtu7qo43jjRDf4DOg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
msvcrt
memset
strncmp
memmove
strncpy
strstr
_strnicmp
_stricmp
strlen
strcmp
sprintf
fabs
ceil
malloc
floor
free
fclose
memcpy
strcpy
tolower
kernel32
GetModuleHandleA
HeapCreate
RemoveDirectoryA
GetTempFileNameA
GetShortPathNameA
GetWindowsDirectoryA
GetSystemDirectoryA
HeapDestroy
ExitProcess
GetExitCodeProcess
GetNativeSystemInfo
FindResourceA
LoadResource
SizeofResource
HeapAlloc
HeapFree
Sleep
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentThreadId
GetCurrentProcessId
CloseHandle
InitializeCriticalSection
GetCommandLineA
GetModuleFileNameA
GetEnvironmentVariableA
SetEnvironmentVariableA
GetCurrentProcess
TerminateProcess
SetUnhandledExceptionFilter
EnterCriticalSection
LeaveCriticalSection
GetVersionExA
HeapReAlloc
SetLastError
TlsAlloc
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
DeleteFileA
GetTempPathA
CreateDirectoryA
WriteFile
CreateFileA
SetFilePointer
ReadFile
DeleteCriticalSection
user32
CharLowerA
MessageBoxA
SendMessageA
PostMessageA
GetWindowThreadProcessId
IsWindowVisible
GetWindowLongA
GetForegroundWindow
IsWindowEnabled
EnableWindow
EnumWindows
SetWindowPos
DestroyWindow
GetDC
GetWindowTextLengthA
GetWindowTextA
SetRect
DrawTextA
GetSystemMetrics
ReleaseDC
GetSysColor
GetSysColorBrush
CreateWindowExA
CallWindowProcA
SetWindowLongA
SetFocus
RedrawWindow
RemovePropA
DefWindowProcA
SetPropA
GetParent
GetPropA
GetWindow
SetActiveWindow
UnregisterClassA
DestroyAcceleratorTable
LoadIconA
LoadCursorA
RegisterClassA
AdjustWindowRectEx
ShowWindow
CreateAcceleratorTableA
PeekMessageA
MsgWaitForMultipleObjects
GetMessageA
GetActiveWindow
TranslateAcceleratorA
TranslateMessage
DispatchMessageA
GetFocus
GetClientRect
FillRect
EnumChildWindows
DefFrameProcA
GetWindowRect
IsChild
GetClassNameA
GetKeyState
DestroyIcon
RegisterWindowMessageA
gdi32
GetStockObject
SelectObject
SetBkColor
SetTextColor
GetTextExtentPoint32A
CreateSolidBrush
DeleteObject
GetObjectA
CreateCompatibleDC
GetDIBits
DeleteDC
GetObjectType
CreateDIBSection
BitBlt
CreateBitmap
SetPixel
comctl32
InitCommonControlsEx
ole32
CoInitialize
CoTaskMemFree
RevokeDragDrop
shell32
ShellExecuteExA
winmm
timeBeginPeriod
shlwapi
PathQuoteSpacesA
PathRenameExtensionA
PathAddBackslashA
PathUnquoteSpacesA
Name
.code
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
39KB
Virtual Size
39KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
MicrosoftWindowsServicesEtc/rsod.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dcaabfd6955d3fec26a86217d1b1ab7e979c301d498473e4d885145ce031fc3b
- MD5 91a0740cfb043e1f4d8461f8cbe2ff19
- SHA1 92e1ad31c34c4102e5cb2cc69f3793b2a1d5304e
- SHA512 c60067655e5f191708af9b25382869e3ce65cd3ea2d6cac70f8cae4132942cfd6a8aa9dde1e2b7f3f12997d6d7411e21dc73ab4cd83ec555d74b82b86778a613
- SSDEEP 1536:UtmYDV2S8sigWZs1M4N2WNlA3V2bFUOSzm:UtmYDwPsigWO1M4gWNa3cuHm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
81230
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\users\guest\documents\visual studio 2015\Projects\redscreenofdeath32\redscreenofdeath32\obj\Debug\redscreenofdeath32.pdb
mscoree
_CorExeMain
Name
.text
Size
71KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MicrosoftWindowsServicesEtc/weird/GetReady.bat
- SHA256 33a0c62f3f66bce3fc1beb37aca8ad731bfa5590177d933d9d4eae016019242a
- MD5 3dbccaadafb7f0227c1839be5ca07015
- SHA1 bd636f73235d52d172ad8932a8e4a6a8b17389a0
- SHA512 d981670f9d492d97931ab260a7d7d27d4f97621a1ef3e20246d4be2a9b4cfc01e01174a1d46432b4a3d937ad135c97eec9ef7bbc7da46034388843887df4637e
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/Major.vbs
- SHA256 cbd3b0f294e8f11592a3ad80d1070d81746f806a48183b93c345251422ccbf0d
- MD5 9192fd494155eab424110765c751559e
- SHA1 b54fcc1e29617b3eee1c7bb215c048498881b641
- SHA512 b8c48916535f3721e7f47be6af671765c3befefcd407c6ea5fabcf9ada119747408d662f61fb436f98a7c33050b6674da54dddf25e683429204a96555ec6e801
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/RuntimeChecker.vbs
- SHA256 989d947c51c878bcefecb53d867a3c182c2d67129a87a5f6773eb6ef2bbf9b2e
- MD5 fe44b78a465853c0ac0744c6ab05ea40
- SHA1 f32dacd91b9547fce9a8a2846a4e17c33295aab3
- SHA512 6b945e16786833c2e2e9867315b8859c413687fc72d4c8576b9c0a1aed2dc65249468317dd49f2ecf777e27c9969b7a7abc72b4d9b7c182dc7999051377515db
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/WinScrew.bat
- SHA256 3aef33c03777abe62feef0a840ac6a087caafc05adfe801464fd1c52eac656a0
- MD5 04067ca733ee8b2ab2f068edc8b75a0f
- SHA1 973cb577f6ab2463040918c3661333553a3132c8
- SHA512 5423a1e668211f269a3d787548e11d18de7365d6c2525c2de61014854f1ab5a51b5de9eda70fb21d6ebe356cb52e93b3f406c71ed7fbcaedd2b023b6fa9c13f8
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/breakrule.vbs
- SHA256 17d014cb4abbaced3acce9b6d7a1b595cd6e2dd814e41f06ceddcdc08e93eebe
- MD5 2609fde7a9604c73be5083e4bcfa0e20
- SHA1 068c89f703fb11663143b9927f2a0c9f9f59c0e3
- SHA512 439fee7cc198cb3fef4ef14693141e52c305579a4ff2da0842323f57dcffade03f3b01ac288080fed423511937a4c1e2080f5a79f967a963fe34253f541824cb
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/bsod.bat
- SHA256 3900e3b60b4691311e050c4cf8fac82ff178a06e3d04d5d6b2d7ea12cf5d53d1
- MD5 c94bb8d71863b05b95891389bed6365e
- SHA1 07bb402d67f8b1fc601687f1df2622369413db3b
- SHA512 00e7ab3a91862faaf5ac5ca3de6dbf2cbb8aac4aba277e1e14b2ecf4650eea2e68134e0df549dca35ab715ed46e36fa9cfee1ba7bb3520511723bf567566682d
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/cmd.vbs
- SHA256 4d2639e890d6d5988eb9cb6f8cb50647048bbfeeb83fc604c52567e7381c876c
- MD5 b181d5a4055b4a620dd7c44c5065bbe7
- SHA1 36320f257026b923b923ad2c0e7fa93a257806e0
- SHA512 0bec0cf2e5b93065701c5458c1d7e047312971d7bbed3ce5444db710654fa0d84eabb7d7c243130e3cb2dae38eb05874929b5b08547174a6065f8accd4e0433d
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/majorlist.bat
- SHA256 839301ef07178c100e7f4d47874faf995ae5d11dfd527dda096a284c8114671b
- MD5 4cc606c63f423fda5324c962db709562
- SHA1 091250ffc64db9bea451885350abed2b7748014c
- SHA512 f29ef2bc694f497499545d1fa4e14ca93c06049fff582af3a6caf3885153491a1cd9e96ab5a6746051aa972421f876c008e5d5b671bd34c3922b61c84151097f
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/majorsod.vbs
- SHA256 8863b595563e92d73b29090ff83191b2fa1297507be588aa7e1cf910e77c7feb
- MD5 fecb9e50c1f01d9d6101f273cb860260
- SHA1 18c413f577c289004db6156bd133e5db70258044
- SHA512 2c30641b099d5b6c3af40cb41e70160c1f4294bb30dc3162b018e9552b48fc899d1a63d3e366bfb71fcf6803bcc518cf8d504ce60684ce221028a9bf2bc07f9d
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/weird/runner32s.vbs
- SHA256 9aae0707b1d5d3b7ed3bf5cc8fbb530aebd195e3e2f18312f3f7f1aa43e031b4
- MD5 5f427dc44f33906509423d24fa0590c0
- SHA1 b896f7667381a594d3751e05f258925b81c231c0
- SHA512 bd28c386772062ef945f24c8ad7a25f158856af36e31d2c9b14674cedfd34b4f48ed531cd40a7eb291384d83665ffe154f0786c1a7ee1616256cf30125120961
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/xRun.vbs
- SHA256 ed588fa361979f7f9c6dbb4e6a1ae6e075f2db8d79ea6ca2007ba8e3423671b0
- MD5 26ec8d73e3f6c1e196cc6e3713b9a89f
- SHA1 cb2266f3ecfef4d59bd12d7f117c2327eb9c55fa
- SHA512 2b3ad279f1cdc2a5b05073116c71d79e190bfa407da09d8268d56ac2a0c4cc0c31161a251686ac67468d0ba329c302a301c542c22744d9e3a3f5e7ffd2b51195
- MD5 SHA1 SHA512
MicrosoftWindowsServicesEtc/xRunReg.vbs
- SHA256 cdd4f356ca256c707960bc42b97649111a830e6f951ca6a3cf80853e3c342947
- MD5 8267192f547f8914ff36eff80ca3f402
- SHA1 23bdeb19fb37059e1293dd80d8be69480c957c73
- SHA512 cd684cb73496ca925fd8604fbbf286b842e2b02ce18b19d63618e8355dcec02bce700fb09b25da932545845b01a7f8d9986fa486db504b92a42d7c0ace21e9e2
- MD5 SHA1 SHA512
Individual Components/SpamMessage.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 ec0e09bd0b7ca794a3d11368d38ddd519543f2282f578536c49a5fe217db36ad
- MD5 80dacb3e5f3bcfce3a1bb14f8fd7c7e4
- SHA1 08db2aa946e62b4e05f9ce3e912070759f193f9d
- SHA512 1cf9e51bca9e50d14620e67611a002898b03bc922dc7902ab230d28bb6c823e4865080b12013313d074d7e90ab4a6f76430e7283f44af0e8db43e0fde37d3522
- SSDEEP 96:20pW/8FxbH9lY30DThysfLiHB9zI+doq9uAw9pAftoX5zNt:PpNbdl4+hTQB5IUoJAwYftg7
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13390
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\Visual Studio\プロジェクト\SpamMessage\obj\Debug\SpamMessage.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Individual Components/readme.md
- SHA256 e31c990dcc61d352be3b74e45cfe18ae633e4d5b404bd7afb670f7804425ca3b
- MD5 3d045ba9382e654c183b8cc52fac7826
- SHA1 0e0278cc1f315808b8d10c1b01f74118f6582630
- SHA512 20a54182108131c2f94a2b253aa994226a0ff6364e9c3474015477f59c74334fe833dde4d95d5a8284e55476b6a13f9a3e25acd93ea52ab9c5e0ccb2a4d389d2
- MD5 SHA1 SHA512
Individual Components/runaway.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 dc6ee4edbbbe1116a200b928f2b62dbc55594a9f79152bbb0076161a58546c11
- MD5 979b597855746aee2f30ee74f9d7c163
- SHA1 56dd0b4bbc5ddcc3fab99ea2e8f781d8b7c7c05f
- SHA512 6b7411b23fa0be275070bb08edb0293f7c5c00fffb7746afe0b4368e0a45e4c2743d3ef86417a610021577f70253bb0ca1c5d3398ac93d22d6672d2b16e0ec4e
- SSDEEP 96:iVVgYs1AwsKDUnjkmQWoDHLByKABzCcuTQDx+WpXOikN4PFmbIxzNt:iVrrjkmZoDHNyJl9uMDcWpXGN4PFRT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13498
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\FlyTech\Documents\Visual Studio 2015\Projects\Messager\Messager\obj\Debug\Messager.pdb
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ