b15cf4f2515278f3f0766a16a6dadb49
- SHA256 860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd
Overview
overview
7Static
static
7Vw3Setup.exe
windows7-x64
7Vw3Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3SDK/vsidasp.vbs
windows7-x64
1SDK/vsidasp.vbs
windows10-2004-x64
VirtualWall.dll
windows7-x64
1VirtualWall.dll
windows10-2004-x64
1VwCfgNew.exe
windows7-x64
6VwCfgNew.exe
windows10-2004-x64
6VwClient/VwClient.dll
windows7-x64
7VwClient/VwClient.dll
windows10-2004-x64
7VwClient/V...fg.exe
windows7-x64
1VwClient/V...fg.exe
windows10-2004-x64
1VwHelpZhcn.chm
windows7-x64
1VwHelpZhcn.chm
windows10-2004-x64
1VwUpdate.exe
windows7-x64
1VwUpdate.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3新云软件.url
windows7-x64
1新云软件.url
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Vw3Setup.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Vw3Setup.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
SDK/vsidasp.vbs
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
SDK/vsidasp.vbs
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
VirtualWall.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
VirtualWall.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
VwCfgNew.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral12
Sample
VwCfgNew.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral13
Sample
VwClient/VwClient.dll
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
VwClient/VwClient.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
VwClient/VwClientCfg.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
VwClient/VwClientCfg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
VwHelpZhcn.chm
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
VwHelpZhcn.chm
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
VwUpdate.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral20
Sample
VwUpdate.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
新云软件.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
新云软件.url
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target b15cf4f2515278f3f0766a16a6dadb49
- Size 2.6MB
- Sample240304-ggf5qscc75
- SHA256 860ab461cf4a1228ed2bd4bbe7c23ac806bd0998581a5a3d2d5a096a2b71c3fd
- MD5 b15cf4f2515278f3f0766a16a6dadb49
- SHA1 df5dad2260ed788a3437365f0908423ed3d4dff3
- SHA512 37494e8f32bfd03f82b5a94d6d2eec2a15176857acb166f47864fada67712cd3d9fed3e0a6daea5c5dfa0246c5a46975249b25136663b09f6ae382adc1327048
- SSDEEP 49152:ykykjPKZshvx4Fy9qXGgQyECB6NI3WUePNgMTlKijg/GkfsoQw:7ys4NCCBrep3jgmoP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule static1/unpack002/VwClient/VwClient.dll acprotect -
resource yara_rule static1/unpack002/VirtualWall.dll aspack_v212_v242 -
resource yara_rule static1/unpack002/VwClient/VwClient.dll upx - Unsigned PE 11 IoCs
Checks for missing Authenticode signature.
resource unpack001/Vw3Setup.exe unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/$PLUGINSDIR/LangDLL.dll unpack002/VirtualWall.dll unpack002/VwCfgNew.exe unpack002/VwClient/VwClient.dll unpack003/out.upx unpack002/VwClient/VwClientCfg.exe unpack002/VwUpdate.exe unpack002/uninst.exe unpack004/$PLUGINSDIR/LangDLL.dll - NSIS installer 2 IoCs
resource yara_rule static1/unpack001/Vw3Setup.exe nsis_installer_1 static1/unpack002/uninst.exe nsis_installer_1
File Explorer
-
b15cf4f2515278f3f0766a16a6dadb49.rar 2.6MB
-
Vw3Setup.exe.exe 2.6MB
-
$PLUGINSDIR/InstallOptions.dll.dll 12KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-wizard.bmp25KB
-
AlertFiles/VirtualWall.bmp263KB
-
AlertFiles/VirtualWall.gif.gif 20KB
-
AlertFiles/VirtualWall.jpg.jpg 64KB
-
AlertFiles/VirtualWall.png.png 53KB
-
AlertFiles/VirtualWall.swf24KB
-
SDK/vsidasp.asp.vbs 16KB
-
SDK/vsidphp.php3KB
-
VirtualWall.dll.dll 310KB
-
VwCfgNew.exe.exe 488KB
-
VwClient/VwClient.dll.dll 10KB
-
out.upx.dll 13KB
-
VwClient/VwClientCfg.exe.exe 290KB
-
VwClient/cfg.ini173B
-
VwHelpZhcn.chm.chm 1.1MB
-
VwUpdate.exe.exe 281KB
-
cfg.mdb388KB
-
uninst.exe.exe 38KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
新云软件.url.url 133B
Vw3Setup.exe
- IMPHASH 1433f2e02f7db60c6c8547c52a3f8504
- SHA256 257901ed4baf9b723706c064c0d8c3c074989b712ca3f53aa17207febaf4e01a
- MD5 000f9cf40f83d513f311939a9f023ad4
- SHA1 2b9891f3edc08dbea9ccc140703c6b6c1986fef4
- SHA512 68fb4dfea7e54520c1fddc90055ac8746a5ba8ec47c85bf10b7d0ea1b20a2e6f351438d483eb867fe1972ea1d979edf8ff2a1d2c3a11221032e5d8b46656f626
- SSDEEP 49152:ud8y7aY6fOLhUoK28M6wazV+RQBJSiglyuRBV5PqDy9l3Zm0L+A7TkKdUO:w5aY6yvD1GpOyurPIynPxTkKdd
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
16359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
kernel32
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GlobalFree
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
ReadFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
GetCommandLineA
user32
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PeekMessageA
gdi32
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SetBkColor
SelectObject
advapi32
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumKeyA
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/InstallOptions.dll
- IMPHASH 922b855d216a21490e4bcbf6c29b7f7d
- SHA256 a505e6c537a5ce0166227dda9f7671605395592ac9f1a3764e8a01b713939db1
- MD5 07f3b3445f66e1089567796bf3c8be78
- SHA1 851eb574c1067b23a654f8aa47b17ef599b24d1c
- SHA512 8c56308fff3a947b26fd0d98dbdd96c406ddf967f5d7abee8cba082b6c46a4e575094bb0bb981551ac5160bb5089cf6fb125dd17a659c427e28c07402adab1c3
- SSDEEP 192:pzi5iBjGHp29db9Dd+w6VPESclh3I8dYvwqu7hwbbHF1QuCb:pO5kjGHSDdgjo6pvwqu72bbMum
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA
user32
GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
MapWindowPoints
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
SendMessageA
SetWindowTextA
GetWindowTextA
wsprintfA
CharNextA
CreateWindowExA
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
comdlg32
GetOpenFileNameA
CommDlgExtendedError
GetSaveFileNameA
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA
dialog
initDialog
show
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
930B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/LangDLL.dll
- IMPHASH ee01c5cc33cdb3294484fc93e41c14ad
- SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
- MD5 2c3c8976d729d28478a789217a882291
- SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
- SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
- SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
GlobalAlloc
GetModuleHandleA
lstrcpynA
lstrcmpA
MulDiv
lstrcpyA
GlobalFree
user32
LoadIconA
SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
DialogBoxParamA
GetDC
ShowWindow
EndDialog
SendMessageA
gdi32
CreateFontIndirectA
GetDeviceCaps
DeleteObject
LangDialog
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
242B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2067,
count=20, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-wizard.bmp
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- MD5 SHA1 SHA512 SSDEEP
AlertFiles/VirtualWall.bmp
- SHA256 a513958e28ed159caeaa70105b21f6b1dca790bcb44b6070434049674f71cd72
- MD5 9ecb30464b126e9184a0401468cfbf70
- SHA1 6f748c2ad8f50a6ec23812b067af8a3c5de9b244
- SHA512 cc919c8d3b3e9d60ae349ce71887ff6d5992ffd4b57e61801427427fa1ae9b8089e28c7f106a1927dcfe24a64d29bc3c3e4bf3719bf95af7a18db93b9a28eca7
- SSDEEP 1536:5oq9JTF++H0MFWWeG6pQ7wxZh1IbIJBZ6noGQrYB:rTF++H00xeb2yrEoGW6
- MD5 SHA1 SHA512 SSDEEP
AlertFiles/VirtualWall.gif
- SHA256 0baf2c3b95570c8e6a1c9a3bb7baf12704047b7907afb80f04361b663dad2d0e
- MD5 0d0dc89839e829732cb773f6b16fe53e
- SHA1 c936eaab2cbc7103bd2d3b6eeef042884283f21a
- SHA512 c03525dc6f2430fc42cd47be7b4fb4a92339ecb412316d5a57aee101529328c3efda5c02720462553ddcdda215145423a1fd6b938ed54125b1e30a683c277841
- SSDEEP 384:OHlg6oWt2TvgG2GICG5r82eU4pS8ZOHcJH568cZ37FzuPo:OHTc2O2X4pS8o85E8+LFSPo
- MD5 SHA1 SHA512 SSDEEP
AlertFiles/VirtualWall.jpg
- SHA256 6342ee35bf32e2ce56f26634e27819aa3c80fcc80c9701a546c5ee8eb5f3e0ea
- MD5 9b1070eeadb3659c8d2593fe323208a1
- SHA1 8c3046eb1e5621b0b33ba71940be0687390cf070
- SHA512 f1032a062c54730eb2d784f13d506a2b0d985b24d84ed6ea96e5e8896e5729c60975b060603d63dcec11923db29be09e0fe308434828e450b9d6056786464ee8
- SSDEEP 768:5Um54cfUm54cHw3wwwA0nW+GxhC2fVlTlqigdEck+kFosuHq0yqyoIMOzCV:15sZfCyVlBgdU+o0yqyoUzCV
- MD5 SHA1 SHA512 SSDEEP
AlertFiles/VirtualWall.png
- SHA256 c3b9a5f43619a49ec73fbf23a83b62734466d77612d3292adf0b314bdfd7c7a8
- MD5 e7904a980739083daf822859bcea17bd
- SHA1 ecdfc81d729ba9e12e2ba53a1875e0e73690c690
- SHA512 35fff12a332fecf0b38b81ead1420b7ea3d7b8b2633c6f7f0e7be50e204699bcbd95522165a1b47a88a66bfb299d79d879d456272517868a71898a9c6111280f
- SSDEEP 1536:+OiOpGzD365i6i3GiqxkqUfGWfynvQKcelQ0/J7h60UdC:+Qv5i6i3G/oyvCGQ0/ph1UdC
- MD5 SHA1 SHA512 SSDEEP
AlertFiles/VirtualWall.swf
- SHA256 13dced64d63543183f13753febb3266af5145f25e670122d777050b717dd2ceb
- MD5 91f086a8383885f268b790fc7b863446
- SHA1 370d7b21d3c81c45890ef8907c077315b5935fcd
- SHA512 eb3caf5c6ad4062b9aeb8f32d3bcc5494b83f3a4eeb62d5be7dc9f5701b80ecaaf585b624488806c4095414b0bc174b9cfe15f8ac6d7c2d3ecafd1abfd9cd626
- SSDEEP 768:DXJ2W61eOeOyGe7SCY6GydGYhVVy6L3Ccm:V61eOeOyv7PoCGYhVVZCcm
- MD5 SHA1 SHA512 SSDEEP
SDK/vsidasp.asp
- SHA256 9de64ac19108b723ecccdb48fd2ad87e0befe1a936ad3de551c788020da82d14
- MD5 a54b2c7e5a1e7b722f60a7e48acdcb8c
- SHA1 99caaa71fd6e49f9f84076cc0a2661de08807e56
- SHA512 4202a563e2b96cea3aa989b42b9ff9500d451c7167ccca222865046291e0ea503b831dff84e10dfda51778a663a6cbc23acff3c2bd7b96630dc37b30e8786eb8
- SSDEEP 384:Hkp8MG6g8aT+zqciWGaCZU29ydyuGRJ63XP+p63N:Ep8ML3iiCZU29yguGRJ63f+p63N
- MD5 SHA1 SHA512 SSDEEP
SDK/vsidphp.php
- SHA256 131023b8381114f77cf0a3c0575874024700971ce20618235edc47f2d5921eb5
- MD5 4f82689d558d7fe2a759d70ee1cee6cd
- SHA1 a8b27a755468c7b19765b4135d84545541c7be50
- SHA512 6cc6190ae3b597c92089f463e43664177293a1d4a63543f79ce188403c579c57e4f9b058c4fac6c8cf22456d7f1903c23ffd96342c71b648febc48691b055c21
- MD5 SHA1 SHA512
VirtualWall.dll
- SHA256 dad8f06df5c8417d1c43fe645d0425ce2369c61a50ed56b63c0fc472cdb8bbfd
- MD5 74b11daf83e0e41821e3907afe228737
- SHA1 38847d90b9117d9527fc65b878c49888b7b16eed
- SHA512 e4d1870e4b9a1bc1051379015fa53a3b5a8a7a0286d513b0d6b53dd16193f7f83aa55cea218ce0d1a65dbc66f8b28e3684d03aed6097792877db2dec230f12e8
- SSDEEP 6144:5z7pa09Ih48wScQMFUMK4wBgFb1TLdLb7IOerqmo+Vlw2Y:5np39IO1QFMvwmb1TLJbJeemXVm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
258049
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetFilterVersion
HttpFilterProc
RundllMakeCfgMap
TerminateFilter
Name
Size
5KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
66KB
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
6KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
222KB
Virtual Size
224KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=26, id=14, version=7299,
count=126, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=11, version=8047,
count=3, id=11, version=8798,
count=6, productName=Unmarked objects (old),
count=23, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=207, id=1, productName=Unmarked objects,
count=31, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VwCfgNew.exe
- SHA256 f7185e0e081b40c48fe14ca8aef34e0c9e23230e24c25657823b523f1fd1d8f2
- MD5 af00b56e5579b83f46551cd10017e993
- SHA1 b6e322098c2717b06dd3c85c20945478c0c06606
- SHA512 c6a0c59c3349c807a7d4a3eebe06fd1a308d061b94f8c9c8230924f9a970702cd55a5528a503e54e93d30aed581f0aed26c64a97000751ef7f0aa0002b69c504
- SSDEEP 12288:7Ub7qZg/fu1MMMt3FMvwmb1TLVZv1tl0S:nx1MMMt3FWwmb1/Pv1tT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
97KB
Virtual Size
276KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
22KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
5KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
384KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.vw
Size
313KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=3, id=11, version=8798,
count=4, productName=Unmarked objects (old),
count=2, id=19, version=8034,
count=28, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=3, id=11, version=8047,
count=11, id=10, version=8047,
count=4, id=4, version=8047,
count=3, id=4, version=9782,
count=886, id=1, productName=Unmarked objects,
count=76, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
VwClient/VwClient.dll
- SHA256 7604076faea99079091022b920ad2318839cc1883b08894f015245f851fece9b
- MD5 54bf8e984142b7f2e35d9bea7b6aec44
- SHA1 e905e201d8df2e9fe542c959fef7ada1167b5a4f
- SHA512 3147fbe999fb7a6a2acdc7ab38ea2d1a946a821a1122332d03b22171fb431c962b229a8208bcd8d6bd58812d7fda00e6a3518300e6abae138e7e5fea8aeeecfc
- SSDEEP 96:6sviUrNI4AijDGP54pkLqgqnuC4vuRsMh2P+BovBAeNCR7IWBAzMp1Cb3rUn0b3N:6C7SsuvXqnuz+7hRBA8RMfzYu7Z7N9J
- MD5 SHA1 SHA512 SSDEEP
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38592
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
GetFilterVersion
HttpFilterProc
Name
UPX0
Size
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=1, id=12, version=7291,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=71, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
out.upx
- SHA256 0bf1e35d18108fc87bce35385a1adfa0771d6b36a0f60f9e77010f1f0f3e4255
- MD5 d7598bbb1e9ef01bd38ae26bd1a1f5e7
- SHA1 2ec6f4e1e27816e2c23e1b1f4fea5ab369847e5f
- SHA512 24f33c214df13fe47e6a14deb3fac346ff6b4ea4497f25389622e39ae8b64a7385443de337dcaf6fbebfaee63543805ed00e84a9290b1787dc4fb7bd2341730f
- SSDEEP 192:6Su7VieqRXSVdOWbV2fLw+ofqtz24r6HqRIoht2u7Z7:BTeqZkOWbiw+5tz/r6loht2uN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15928
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
1024B
Virtual Size
1017B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
838B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=12, version=7291,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=71, id=1, productName=Unmarked objects,
count=13, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=8, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
VwClient/VwClientCfg.exe
- SHA256 170dbaa708bd8a6eba1f2e10d0abd009ee51fe724a4ee1b67cbb308f4a9a48f3
- MD5 36cd0791cee9ae02b250692b6f6c2a6b
- SHA1 6a8c2a42dc0022443d632c180b87624936e5598e
- SHA512 1c0899a78c43082ea54c7e0746d1a3485f4ff0eaf373fc5d54c3dd8600f66bf3f5daa0b367d80b30c779203dfe5a3d27969090a95afcf007da7aece01423fdd9
- SSDEEP 6144:1ytcx91UQN9sMFUMK4wBgFb1TLdq+UaTf69:3vWQPsFMvwmb1TL9Uf9
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
22KB
Virtual Size
52KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
2KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
10KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
242KB
Virtual Size
244KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=3, id=11, version=8798,
count=3, productName=Unmarked objects (old),
count=20, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=1, id=11, version=8047,
count=3, id=4, version=9782,
count=374, id=1, productName=Unmarked objects,
count=19, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
VwClient/cfg.ini
- SHA256 52171e4ab84f3162bfaa7a8711b4f24c306f15da801e7840f0d379e0ab736fbb
- MD5 2eaf9a5f1cbd628e1d66a975abd26969
- SHA1 3f11bb5d40bcef2e4a0845072b60dc5f59c4b8da
- SHA512 b93591e7ee79111f8fbbd24bf31f90eb9e40cc9c47d447817fe59355589ede73513a8656c5a9081746fdc5ba170ebaa24e0206d19d9e8578e3703b1b198f29f3
- MD5 SHA1 SHA512
VwHelpZhcn.chm
- SHA256 ffe8f2b9249d572e6f48da2361a4945a5fa1a1e07029fb5ead5832bec98f4096
- MD5 b6dd3309abec82c9d3afb6346821e7b7
- SHA1 3e0ff9d561e405752836aab2b5d0a9120e5140de
- SHA512 4107395ed9e0bf93b12e9081a7bb97e3314d8dd7ed47bec902abd579e84d136de7a0afcf1ca7eedcef79de3793c8ce1aca1fb2d4ce20183247eb86f35fb32440
- SSDEEP 24576:AxipDMeiP1i4hBezIVyiQp6YMugB8Ym6TqAQGxVZ7PY1+UJ:2i2eiP5rdQMpBauVZ7Q1+O
- MD5 SHA1 SHA512 SSDEEP
VwUpdate.exe
- SHA256 039ff8a955508a1f88ab2fd7338ad83ecf4637197bd56036a9e40ba1a811d10f
- MD5 047ee79579b597cff61358156451ac46
- SHA1 897e21dcc088d594f9cd86c5b2e36c3d6e8cd950
- SHA512 06a39802a32e2bd1958594f40e8916f6ca1f6f3e3457c406d3dd4d0e50069f0547fbbc8a0bc4aaee2583d7a015f54f894ab604aed9a8ab3ee7d5168991b96c70
- SSDEEP 6144:pDJxQI/74MFUMK4wBgFb1TLdHh8QDeOCYOSr:pluI8FMvwmb1TLAQqO/O6
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
Size
22KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
8KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
14KB
Virtual Size
64KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.data
Size
231KB
Virtual Size
232KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.adata
Size
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=12, version=7291,
count=2, productName=Unmarked objects (old),
count=2, id=19, version=8034,
count=22, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=14, version=7299,
count=11, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=4, version=9782,
count=344, id=1, productName=Unmarked objects,
count=19, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
cfg.mdb
- SHA256 3191fd6c3610aaa7ff37b58b5679f5698702716a20c60cf2a6453ab09e10a341
- MD5 a2b0f5974426485f2e881d402358a759
- SHA1 5329e2f9afdd2a17cae8f978ad52b08889900ec5
- SHA512 2919722e3b9f6ff0a45838fa751ebeeb5f77d33d8aaa89687051062bdd5ccaa1cf1c976e90dba9891f69aac46a3b490a2bb3917be9eaab3b7be0699abddd8552
- SSDEEP 1536:q8UOEM4DxbsXTZDcpNpS91BZ+0lvcNZHVNbiV51wcIa8qk6Cs:q8U4XTZDcRziV5KcIa8qk6Cs
- MD5 SHA1 SHA512 SSDEEP
uninst.exe
- IMPHASH 1433f2e02f7db60c6c8547c52a3f8504
- SHA256 e4443df1d3255cd1eb3fad89de5943341931f842498d327701dbefa7b00fa7c2
- MD5 77d5904fb7d1c5a687b585b199f33828
- SHA1 ae0ab177741d3900026b92ccf7abc211e9fd2e43
- SHA512 579aa711970be9cd4116fb15cac3e9863d2fbfdccc35ca4711a28576ad3ab793daeea2b7d96e352ae6d98407a0354daf59c714f5faba341c6c4c3800e959ea33
- SSDEEP 768:0w0D3T2XQW0dcyngqR8lWFYCPMfjABHD2tAJb5PAAIYHLLE8JyJRngCY9aLyMW:0w0DsT0zikYCPMUxDRbw8JBx0o
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
16359
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
comctl32
ord17
ImageList_AddMasked
ImageList_Destroy
ImageList_Create
kernel32
ExpandEnvironmentStringsA
GetEnvironmentVariableA
lstrcmpiA
CloseHandle
SetFileTime
GetFileAttributesA
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
GlobalFree
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
MulDiv
DeleteFileA
FindFirstFileA
FindNextFileA
FindClose
SetFilePointer
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
ReadFile
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
GetCommandLineA
user32
ExitWindowsEx
CharNextA
DialogBoxParamA
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
PeekMessageA
gdi32
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SetBkColor
SelectObject
advapi32
RegEnumValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegEnumKeyA
shell32
ShellExecuteA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderLocation
SHFileOperationA
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
23KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=155, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH ee01c5cc33cdb3294484fc93e41c14ad
- SHA256 799f91bdd59f2133bf195c5b4ca685ee91666d981a6bcd8a6c45b7c8ecc96eef
- MD5 2c3c8976d729d28478a789217a882291
- SHA1 10c18b23fac957419547ef0f8ec3bc1b10e91e79
- SHA512 749c650974f94cc5009124d3fa3d9bb1ee5824a3fa0a76b81733e08379678a2a1b7c54b77d1709fb6de24c81c68c03c0ec3e9ec5ccad0d30d9237300794f1213
- SSDEEP 48:aefTYzqi+/XC1aQbkMIwovgxbLuwOWd8s/d79C6O4MWNEYJvRZJ0dfh80:22XC1XkH/ohLZDSs/d799O4MQE0R4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5094
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
GlobalAlloc
GetModuleHandleA
lstrcpynA
lstrcmpA
MulDiv
lstrcpyA
GlobalFree
user32
LoadIconA
SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
DialogBoxParamA
GetDC
ShowWindow
EndDialog
SendMessageA
gdi32
CreateFontIndirectA
GetDeviceCaps
DeleteObject
LangDialog
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
242B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=93, version=2067,
count=20, id=1, productName=Unmarked objects,
count=5, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
新云软件.url
- SHA256 df65af1fc1e09f6effbde7e0ef1cb64d6caeef1f62b0e6467821efa032533678
- MD5 4f0017b3b346bd0626f0c3b915e6e734
- SHA1 823bf3ff9e16cd636c9dc0dc690d6a586fcbfe92
- SHA512 0f5eb5024cf6a0323f7998d419995a707c48de917a5899a185369e6acfeb17c09ffa03f7d110adc87b8de20b7d4bf30d50c72479bfb18614d2e21cbe169dc5a6
- MD5 SHA1 SHA512