Downloads.zip
- SHA256 56ac86f444037f33eb84d1c4bf10ed74bbbba3a73da2d64f4608b27efef60866
Overview
overview
10Static
static
105geplik.ru.exe
windows7-x64
105geplik.ru.exe
windows10-2004-x64
1063geplik.ru.exe
windows7-x64
1063geplik.ru.exe
windows10-2004-x64
1064cb427208...2c.exe
windows7-x64
764cb427208...2c.exe
windows10-2004-x64
7CheatEngine75.exe
windows7-x64
6CheatEngine75.exe
windows10-2004-x64
6Screenshot...AM.png
windows7-x64
1Screenshot...AM.png
windows10-2004-x64
3aware2.0.exe
windows7-x64
7aware2.0.exe
windows10-2004-x64
10mape2.pyc
windows7-x64
3mape2.pyc
windows10-2004-x64
3creal.exe
windows7-x64
7creal.exe
windows10-2004-x64
7creal.pyc
windows7-x64
3creal.pyc
windows10-2004-x64
3geplik (2).ru666.exe
windows7-x64
10geplik (2).ru666.exe
windows10-2004-x64
10geplik ru.js
windows7-x64
8geplik ru.js
windows10-2004-x64
8geplik.ru.exe
windows7-x64
10geplik.ru.exe
windows10-2004-x64
10geplik.ru2.exe
windows7-x64
10geplik.ru2.exe
windows10-2004-x64
10geplik.ru3.exe
windows7-x64
10geplik.ru3.exe
windows10-2004-x64
10geplik.ru4.exe
windows7-x64
10geplik.ru4.exe
windows10-2004-x64
10geplik.ru666.exe
windows7-x64
10geplik.ru666.exe
windows10-2004-x64
10Behavioral task
behavioral1
Sample
5geplik.ru.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
5geplik.ru.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
63geplik.ru.exe
Resource
win7-20240221-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral4
Sample
63geplik.ru.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
32 signatures
150 seconds
Behavioral task
behavioral5
Sample
64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral6
Sample
64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral7
Sample
CheatEngine75.exe
Resource
win7-20240220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral8
Sample
CheatEngine75.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral9
Sample
Screenshot 2024-01-15 8.57.49 AM.png
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
Screenshot 2024-01-15 8.57.49 AM.png
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
aware2.0.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral12
Sample
aware2.0.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral13
Sample
mape2.pyc
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
mape2.pyc
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
creal.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
creal.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral17
Sample
creal.pyc
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
creal.pyc
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
geplik (2).ru666.exe
Resource
win7-20240220-en
windows7-x64
21 signatures
150 seconds
Behavioral task
behavioral20
Sample
geplik (2).ru666.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral21
Sample
geplik ru.js
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral22
Sample
geplik ru.js
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral23
Sample
geplik.ru.exe
Resource
win7-20240221-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral24
Sample
geplik.ru.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral25
Sample
geplik.ru2.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral26
Sample
geplik.ru2.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral27
Sample
geplik.ru3.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral28
Sample
geplik.ru3.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral29
Sample
geplik.ru4.exe
Resource
win7-20240221-en
windows7-x64
29 signatures
150 seconds
Behavioral task
behavioral30
Sample
geplik.ru4.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral31
Sample
geplik.ru666.exe
Resource
win7-20240220-en
windows7-x64
14 signatures
150 seconds
General
- Target Downloads.zip
- Size 75.1MB
- Sample240308-2cw1lsaa51
- SHA256 56ac86f444037f33eb84d1c4bf10ed74bbbba3a73da2d64f4608b27efef60866
- MD5 a0988d6fcd126c3c2a76190bb15b6c5a
- SHA1 3c6c5f3e97c9228455a3efc416605df9cc991bea
- SHA512 e6bc37a420ecb25cd0d17fff96381edf54b02c68f3573922a21a5a8a2f0b11e9440d7d8828386ffd81da515d573ab0a159a7bd28a71a3141aed0ac4ca9dd840c
- SSDEEP 1572864:BRkEP+24LwPTQqWHo5liKDVfgeRxFFOcYIHr+oKtC7V7XzG8:BPm246TvHiW+enFpQC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
redline
Botnet
-
cheat
C2
-
91.198.77.158:4483
Signatures
- Detect XtremeRAT payload 1 IoCs
resource yara_rule static1/unpack001/5geplik.ru.exe family_xtremerat - RedLine payload 1 IoCs
resource yara_rule static1/unpack001/geplik.ru666.exe family_redline - Redline family
- SectopRAT payload 1 IoCs
resource yara_rule static1/unpack001/geplik.ru666.exe family_sectoprat - Sectoprat family
- Xtremerat family
-
resource yara_rule static1/unpack001/5geplik.ru.exe upx - Detects Pyinstaller 2 IoCs
resource yara_rule static1/unpack001/aware2.0.exe pyinstaller static1/unpack001/creal.exe pyinstaller - Unsigned PE 13 IoCs
Checks for missing Authenticode signature.
resource unpack001/5geplik.ru.exe unpack001/63geplik.ru.exe unpack001/64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c unpack001/aware2.0.exe unpack001/creal.exe unpack001/geplik (2).ru666.exe unpack001/geplik.ru.exe unpack001/geplik.ru2.exe unpack001/geplik.ru3.exe unpack001/geplik.ru4.exe unpack001/geplik.ru666.exe unpack001/geplik.ru6667.exe unpack001/geplik.ruexe.exe
File Explorer
-
Downloads.zip.zip 75.1MB
-
5geplik.ru.exe.exe 301KB
-
63geplik.ru.exe.exe 261KB
-
64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c.exe 205KB
-
CheatEngine75.exe.exe 28.5MB
-
Screenshot 2024-01-15 8.57.49 AM.png.png 88KB
-
aware2.0.exe.exe 17.0MB
-
mape2.pyc60KB
-
creal.exe.exe 20.9MB
-
creal.pyc72KB
-
geplik (2).ru666.exe.exe 275KB
-
geplik ru.js2.5MB
-
geplik.ru.exe.exe 161KB
-
geplik.ru2.exe.exe 1.8MB
-
geplik.ru3.exe.exe 6.6MB
-
geplik.ru4.exe.exe 10KB
-
geplik.ru666.exe.exe 95KB
-
geplik.ru6667.exe.exe 1.0MB
-
geplik.ruexe.exe.exe 25KB
-
Пароли0Chrome.csv3KB
5geplik.ru.exe
- SHA256 59bf58575e5cb95edd0cba98c8cc536ca096615260c43273dad177c353609f54
- MD5 6528e3c44027d013e9b7d68d36120aa9
- SHA1 2f7b08ac26a38de24c288ae9594e2847f3e0f518
- SHA512 71103b6333802ded57993e969c002f8f507b17e35449e0a2501f1920cb4f8761c1220247876a11c752c0dae07e9102780edf95ab5517390ac99e1295803fa5ac
- SSDEEP 768:k8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiiw8YqagXx:msq+QV4rObAdXWpf/y+Ub9giox
- MD5 SHA1 SHA512 SSDEEP
-
Detect XtremeRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
53492
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
UPX0
Size
268KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
31KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
63geplik.ru.exe
- IMPHASH 0c3f2cf9e47c10e842f2d44e413c1a98
- SHA256 4a442ef8863e6589bc6fad1e20cb6ca3b96d3d5be3d720f9875e004039195d2d
- MD5 661b8bf0e1ab11c5544007cfed5234e2
- SHA1 4bd8a08bb4b1cc8930d681ccd2a139263d611739
- SHA512 3552092623d40a3baf40d53a039a7615ab7ed8dc5584e6c65fafda066b10809cb185a6f2eac41ec3273b40b0e2602f6be36c215bb205c02cd6a31cf82c672ce7
- SSDEEP 3072:R7a/ESqMbn1mNa9bPWn2TzZCaM+CR+sqItssVN0rsVcVB255HqNW3:09bwNubP/TlCSotlVC4VcO
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
9955
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\mufev.pdb
kernel32
GetConsoleAliasExesLengthA
InterlockedIncrement
ReadConsoleA
InterlockedDecrement
AddConsoleAliasW
GetFileAttributesExA
GetTickCount
FindNextVolumeMountPointA
GetNumberFormatA
GetWindowsDirectoryA
EnumTimeFormatsA
GlobalAlloc
GetLocaleInfoW
ReadConsoleInputA
GetThreadSelectorEntry
GetVersionExW
CreateDirectoryA
GetLastError
GetProcAddress
GetLocaleInfoA
RemoveDirectoryA
LoadLibraryA
WriteConsoleA
GlobalFindAtomW
SetEnvironmentVariableA
GetModuleFileNameA
GetConsoleTitleW
GetCurrentDirectoryA
DuplicateHandle
GetCurrentProcessId
GetVolumeInformationW
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
CreateFileA
FindResourceA
VirtualAlloc
GetComputerNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
HeapAlloc
HeapFree
RaiseException
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
Sleep
ExitProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
GetModuleHandleA
SetFilePointer
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
SetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
CloseHandle
user32
CharLowerBuffA
CharUpperBuffW
LoadKeyboardLayoutW
GetAltTabInfoA
UnregisterClassA
gdi32
StretchDIBits
advapi32
ReadEventLogA
shell32
FindExecutableW
winhttp
WinHttpCheckPlatform
Name
.text
Size
141KB
Virtual Size
141KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
76KB
Virtual Size
22.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c
- IMPHASH 46ad3d954e527f769e37017b3e128039
- SHA256 64cb42720817fd92283fc9dfac1e96dd1518d3ac0cd542701e14938f900b212c
- MD5 ea5bdba28c25ce240630a7a9de2d77e9
- SHA1 fdbc9bbb4b35094670b74800fe249831786c8f48
- SHA512 c5f8d4ba0956178acd3ae382a4dcedb68e9bc6482f8d874d0f2d9f90ef15eb8dabc97b910e9616d49f4b144af63ac68473a81a5a57f246a1993b538487b84e8f
- SSDEEP 3072:ZRpAyazIliazTh+r/0XzhtQtfElMyQD7i9WdBfBqQGAG7G0qNACPPd1cs5/yZh/8:xZ8azQru/QtfEC40LfBqsG9rCrt/Q58
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
23774
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
WriteFile
ReadFile
CreateFileW
FlushFileBuffers
GetLastError
FindClose
LocalAlloc
GetLogicalDriveStringsW
LocalFree
CreateThread
ExpandEnvironmentStringsW
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
CreateProcessW
SetFilePointer
GetDriveTypeW
FindFirstFileW
CreateMutexW
GetFileSize
GetEnvironmentVariableW
FindNextFileW
ExitProcess
GetConsoleCP
GetCommandLineW
IsProcessorFeaturePresent
SetLastError
GetCurrentThreadId
EncodePointer
DecodePointer
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetProcessHeap
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
LoadLibraryExW
RtlUnwind
OutputDebugStringW
HeapAlloc
HeapReAlloc
GetStringTypeW
HeapSize
LCMapStringW
CloseHandle
user32
wsprintfW
advapi32
RegCloseKey
CryptGenRandom
RegCreateKeyW
CryptAcquireContextW
RegSetValueExW
ntdll
RtlAdjustPrivilege
NtDelayExecution
NtClose
Name
.text
Size
59KB
Virtual Size
59KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=24, id=225, productName=VS2013 build 21005, version=21005,
count=15, id=223, productName=VS2013 build 21005, version=21005,
count=104, id=224, productName=VS2013 build 21005, version=21005,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=102, id=1, productName=Unmarked objects,
count=1, id=229, version=31101,
count=1, id=222, productName=VS2013 UPD4 build 31101, version=31101,
CheatEngine75.exe
- IMPHASH 5a594319a0d69dbc452e748bcf05892e
- SHA256 cb73a9806e39e7c694cd79bbdb0fd3c836ec82810f6ded1852aa1ac9c7b3012c
- MD5 8cef61e2080c38400698bc3265fd7f95
- SHA1 a174b7dd8bd1eacfa6a9accd878c16bdc8aa1936
- SHA512 81781fdb49a3b949725ff508a96eef01599ff90c2fd42f104dda311cfb37dfb90d4aa38d0d4694634c3a469fbdac4c7421a5aee99067536848bbc50bda4658cb
- SSDEEP 786432:0TCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFH:02EXFhV0KAcNjxAItj
- MD5 SHA1 SHA512 SSDEEP
Digest
e8:c3:db:02:be:18:b9:a4:83:e5:e4:ef:a2:b5:b7:3e:82:0a:22:6d:ea:a3:56:6d:ff:9d:13:e6:24:ef:c7:b9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=EngineGame,O=EngineGame,ST=Tel Aviv,C=IL
Chains
Jan 10, 2024
CN=EngineGame,O=EngineGame,ST=Tel Aviv,C=IL
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=EngineGame,O=EngineGame,ST=Tel Aviv,C=IL
Serial Number
fb:d0:1e:95:fd:dd:dc:33:e3:c2:18:c6:0d:a7:3e:12
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Dec 14, 2022 - Dec 13, 2024
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
1
Major OS version
6
Entry point
745196
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
kernel32
GetACP
GetExitCodeProcess
LocalFree
CloseHandle
SizeofResource
VirtualProtect
VirtualFree
GetFullPathNameW
ExitProcess
HeapAlloc
GetCPInfoExW
RtlUnwind
GetCPInfo
GetStdHandle
GetModuleHandleW
FreeLibrary
HeapDestroy
ReadFile
CreateProcessW
GetLastError
GetModuleFileNameW
SetLastError
FindResourceW
CreateThread
CompareStringW
LoadLibraryA
ResetEvent
GetVersion
RaiseException
FormatMessageW
SwitchToThread
GetExitCodeThread
GetCurrentThread
LoadLibraryExW
LockResource
GetCurrentThreadId
UnhandledExceptionFilter
VirtualQuery
VirtualQueryEx
Sleep
EnterCriticalSection
SetFilePointer
LoadResource
SuspendThread
GetTickCount
GetFileSize
GetStartupInfoW
GetFileAttributesW
InitializeCriticalSection
GetThreadPriority
SetThreadPriority
GetCurrentProcess
VirtualAlloc
GetSystemInfo
GetCommandLineW
LeaveCriticalSection
GetProcAddress
ResumeThread
GetVersionExW
VerifyVersionInfoW
HeapCreate
GetWindowsDirectoryW
VerSetConditionMask
GetDiskFreeSpaceW
FindFirstFileW
GetUserDefaultUILanguage
lstrlenW
QueryPerformanceCounter
SetEndOfFile
HeapFree
WideCharToMultiByte
FindClose
MultiByteToWideChar
LoadLibraryW
SetEvent
CreateFileW
GetLocaleInfoW
GetSystemDirectoryW
DeleteFileW
GetLocalTime
GetEnvironmentVariableW
WaitForSingleObject
WriteFile
ExitThread
DeleteCriticalSection
TlsGetValue
GetDateFormatW
SetErrorMode
IsValidLocale
TlsSetValue
CreateDirectoryW
GetSystemDefaultUILanguage
EnumCalendarInfoW
LocalAlloc
GetUserDefaultLangID
RemoveDirectoryW
CreateEventW
SetThreadLocale
GetThreadLocale
comctl32
InitCommonControls
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
user32
CreateWindowExW
TranslateMessage
CharLowerBuffW
CallWindowProcW
CharUpperW
PeekMessageW
GetSystemMetrics
SetWindowLongW
MessageBoxW
DestroyWindow
CharUpperBuffW
CharNextW
MsgWaitForMultipleObjects
LoadStringW
ExitWindowsEx
DispatchMessageW
oleaut32
SysAllocStringLen
SafeArrayPtrOfIndex
VariantCopy
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
VariantClear
SysFreeString
SysReAllocStringLen
VariantChangeType
SafeArrayCreate
netapi32
NetWkstaGetInfo
NetApiBufferFree
advapi32
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Name
.text
Size
718KB
Virtual Size
717KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.itext
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.bss
Size
Virtual Size
27KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didata
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
154B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
24B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
18KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Screenshot 2024-01-15 8.57.49 AM.png
- SHA256 7d8c6e8fda24e1a038f0741982d9e62fc53ba2502d8371f4ec38b74525a68684
- MD5 9a7656a88a1945967f4df3cf49348bca
- SHA1 a137dbab438ba26f66b0214f4ceeeb235ed554b8
- SHA512 b08d45b2739a838bb904a87f5daf2b1ff835d29f964fafca5a0f5957f7f3224aa23993e5cafef07d96b7d15a269100edc92eb398aab78c038a374a54b4e2ff84
- SSDEEP 1536:TY+l3aCrlVXnKXz/rIBi8FvI3vaPInmSNxgNlTlCNmlFfPmmfpGWLtWB:cgaUKj/EBDFv4aPdSOPCNYHbceMB
- MD5 SHA1 SHA512 SSDEEP
aware2.0.exe
- IMPHASH 9222d372923baed7aa9dfa28449a94ea
- SHA256 e8ea10c3d64051d884a5814f499af8d7fdcff0d28baecb8d032763e301fb0e86
- MD5 97cb8b3a2607a6ff9839e76ed7841ab7
- SHA1 4cbb14b7d67aa40588c552d0372ed413925937a5
- SHA512 ad083b6bab60ba7fa1f1eae42da932f36fc8b617c143c7794aae5fa2972b4928c53f40fc7d3faa6248c312ee703776dea3984c013cf22cb152c63a9fa1941609
- SSDEEP 393216:LdG13d6KculSiTNZnyByA2AkUWzhDhQ5CEDcZkyPs6:hgcuYiT+XXQtgCEDcZky/
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
12872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\Users\DarkCoderSc\Desktop\Celesty Binder\Stub\STATIC\Stub.pdb
kernel32
CreateFileA
FindResourceA
FreeLibrary
LoadResource
WriteFile
SizeofResource
GetProcAddress
LoadLibraryA
LockResource
EnumResourceNamesA
CloseHandle
FreeResource
GetWindowsDirectoryA
OutputDebugStringA
GetTempPathA
GetModuleHandleW
ExitProcess
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapAlloc
GetLastError
HeapFree
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetStdHandle
GetModuleFileNameW
Sleep
HeapSize
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LCMapStringW
MultiByteToWideChar
GetStringTypeW
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Name
.text
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16.9MB
Virtual Size
16.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=158, productName=VS2010 build 30319, version=30319,
count=68, id=170, productName=VS2010 build 30319, version=30319,
count=29, id=171, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=84, id=1, productName=Unmarked objects,
count=3, id=175, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
mape2.pyc
- SHA256 0fb712559f22faee51273103af60782f17e743e99d0717f78e106e3668d3b1bc
- MD5 d4d58c18cf079a1a2cf2b25d1fb6fff1
- SHA1 4a602163d3f07661920c8edf2d52fbdf3e7a6a73
- SHA512 49dbaf0be58afd08cd37e4ef78f0e8ca20bd53ef7a6b66e08d480f172a36cea9c1e948f81fe1b1a6779ff7e76cde2ad9e4d62f5a97325f9997428c957131dafa
- SSDEEP 768:Gg1j8WoR/Z74Tikbh26iQ9PcOv33gzNJ7di8BTlk9eu36++HMae2kSXMcyY9:Gg1j8lR/V4xh26z33sNldiczsv12M1Y9
- MD5 SHA1 SHA512 SSDEEP
creal.exe
- IMPHASH 1af6c885af093afc55142c2f1761dbe8
- SHA256 40c60131dcf9503afe01ed7f68162460debf1c11e3d8761515d002bbae7e0565
- MD5 bfc2354891d7e2c18811d62221ceb0d4
- SHA1 2dbaed797e3b2dcf2d0b2eed0738312fe6cc1773
- SHA512 5f1f0951fdc36f10c5cb56acb29ac61338a7b96f17265d0955e35c3a85f65ddd14dea67adfb7478c4c18839e67a79f9c6b13de7588d06290d2a237cfd88d941c
- SSDEEP 393216:OEkZQtsJiP8AxYD/QETSrvJQ7tsrxzGxdgN8v1:OhQts7XjQEWrhQJssINg
- MD5 SHA1 SHA512 SSDEEP
-
Detects Pyinstaller
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
49904
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
GetModuleFileNameW
CreateSymbolicLinkW
GetProcAddress
GetCommandLineW
GetEnvironmentVariableW
GetCPInfo
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
CloseHandle
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
SetEnvironmentVariableW
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
167KB
Virtual Size
167KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
100KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=4, id=253, version=32533,
count=40, id=261, version=32533,
count=17, id=260, version=32533,
count=9, id=259, version=32533,
count=11, id=257, version=30795,
count=139, id=1, productName=Unmarked objects,
count=21, id=260, version=32826,
count=1, id=258, version=32826,
creal.pyc
- SHA256 70f5dfb5761c398395edc2f5a8ff5222eeb004c8a57f2ee91ec9e5be1da055e4
- MD5 1ceec2fc9a5af3276ee2886fee27c5dd
- SHA1 9d11b07bc8f28f2176bd6d097258531b2fa38fb6
- SHA512 41f4e9eec0a0e0e16d0a469960dc1a1b8840437bfe3cc6db72eee2633bb9a9e1781793850b706cbf12b56ac8ff4974ce7763eae08ea3addd9b2f5cc56ecc5c09
- SSDEEP 1536:36TOrTSzYPQlWXV2IsBORbHBwG+ObIrSyKEgR2ez:31hv2IsBeWG+OuSyKEgR7
- MD5 SHA1 SHA512 SSDEEP
geplik (2).ru666.exe
- IMPHASH c0f591492a1d9bf6745cee299fe79f50
- SHA256 4add0f8906e6fad4f971845761aad49fa1d0c7fbff554b2a78dfc2d1b25284e7
- MD5 b81c443ac8c4ba37ec8460ae94a3341a
- SHA1 af4d873579cebc1486d2b89f1be9ec4721252a72
- SHA512 0225e3bd1eaf58f7b0f04ea054780dc7d69de9fbeb805aefac8583449141125462550d4adc4153324f16cae0000bb064f53d252976a4bf8b304578cf5a73810b
- SSDEEP 6144:q6Rk3IXDmAE71E8AxUT7X7DujDnwoZhnYtvoIECF5Htn:qN3UDXE719T7/uvnwoZ9IpF5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
15459
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
shlwapi
UrlGetPartW
PathCombineW
UrlCombineW
UrlCanonicalizeW
UrlApplySchemeW
PathAppendW
msimg32
TransparentBlt
kernel32
LCMapStringW
LCMapStringA
HeapFree
GetCurrentProcess
RtlUnwind
SetUnhandledExceptionFilter
GetOEMCP
GetStringTypeW
GetStringTypeA
InterlockedExchange
EnumResourceTypesW
WriteFile
LZCopy
GetCPInfo
LoadLibraryA
VirtualAlloc
IsDebuggerPresent
GetACP
GetLocaleInfoA
oleacc
GetOleaccVersionInfo
AccessibleObjectFromEvent
wtsapi32
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
Name
.text
Size
124KB
Virtual Size
124KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
geplik ru.js
- SHA256 3a5c4bcadbdfdae9975bd89b29a553cf249d1c9492f4f08e99a1468b27ac8306
- MD5 65449e1b1f857cb5168a2524d5d37681
- SHA1 2a22c03165abd965b816f17dfc30c9d4fe826ac5
- SHA512 d6ef3418386bb3026aa0c8b236cb08393b458bff7afb6561e16ec9bda091c4a4ec1baf8130919b165b7096fe4ab0b80dbe2b7f9b791f84c4d3edd455517b6d6a
- SSDEEP 384:oCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCd2ZCdV:3xxxxxxxxxxxxxxxxxx7
- MD5 SHA1 SHA512 SSDEEP
geplik.ru.exe
- IMPHASH efddc832809352fa5626b950f8ce5fce
- SHA256 29645afd1579bf501163d73ffb4cefe7043e85b47f030a2c633d721a9b10efee
- MD5 fb8ddd837ad8b94f1faf0b4920ce7b2b
- SHA1 c3bc51f18a1180be27c4ee0978aaa9e1295dbd4b
- SHA512 db218213ee139583f69b00ea7e33986857cbc73f0e549f996e0dc3b0b34282c838f874a65c13fa7e21adfb8d876ca6cef9421a19171c214b1ea98b1a99f1bc74
- SSDEEP 1536:IwYZ5gZyjech8y/nK/bobGPgeMWKQxljH3PBe/8YkfbM9Wzw1mE3SmJQENYmAzTa:YiZpyDz/WVPX/9CWz9xmJQMYmAzsX
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
4958
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetConsoleAliasExesLengthA
WriteConsoleOutputCharacterA
SystemTimeToTzSpecificLocalTime
GlobalAddAtomA
MoveFileExW
CreateJobObjectW
GetUserDefaultLCID
WideCharToMultiByte
LoadLibraryW
LocalShrink
GetLocaleInfoW
FatalAppExitW
GetFileAttributesA
HeapCreate
GetModuleFileNameW
ReleaseSemaphore
ReplaceFileA
DeactivateActCtx
InterlockedExchange
GetStdHandle
SetLastError
CreateNamedPipeA
BuildCommDCBW
LoadLibraryA
LocalAlloc
GetFileType
AddAtomW
lstrcatW
CancelTimerQueueTimer
FreeEnvironmentStringsW
VirtualProtect
GetCurrentDirectoryA
FileTimeToLocalFileTime
CreateFileW
SetStdHandle
HeapAlloc
GetCommandLineW
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
EnterCriticalSection
LeaveCriticalSection
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
GetLastError
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapFree
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
IsProcessorFeaturePresent
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
CloseHandle
WriteConsoleW
user32
LoadIconA
GetClassLongW
SetKeyboardState
Name
.text
Size
110KB
Virtual Size
109KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
26.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=22, id=171, productName=VS2010 build 30319, version=30319,
count=14, id=158, productName=VS2010 build 30319, version=30319,
count=88, id=170, productName=VS2010 build 30319, version=30319,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=98, id=1, productName=Unmarked objects,
count=1, id=175, version=30319,
count=1, id=154, productName=VS2010 build 30319, version=30319,
count=1, id=157, productName=VS2010 build 30319, version=30319,
geplik.ru2.exe
- IMPHASH 2eabe9054cad5152567f0699947a2c5b
- SHA256 262cc987d16421f31e2e29c8d532da5f6e14f116b43b49ac7162cedde815cb6a
- MD5 b19fe476f4fd4be81746e50107301004
- SHA1 e893c50bf22da4a4153bd492536261dba9e4a95d
- SHA512 19ed40890970d183b56dd45cf9f38ef75066c3680face9ed2bcb5366e066b9b12bcd21024f170a73c9bb2754c2d92d76dc63fd672970bf4fe318212954ddd59f
- SSDEEP 49152:LHJrcZmUZotIKfuytRrnVFQ9vAbDn2D/pgYn:LprcZeGKfuytO9vAn2TZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
5013504
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
lstrcpy
Name
Size
181KB
Virtual Size
404KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
512B
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
poidmwmx
Size
1.7MB
Virtual Size
1.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
xfqivvkm
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.taggant
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=14, id=259, version=26715,
count=158, id=261, version=26715,
count=18, id=260, version=28117,
count=20, id=259, version=28117,
count=117, id=261, version=28117,
count=20, id=260, version=26715,
count=19, id=257, version=26715,
count=212, id=1, productName=Unmarked objects,
count=1, id=265, version=28315,
count=1, id=255, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=258, productName=VS2019 v16.4.3 build 28315, version=28315,
geplik.ru3.exe
- SHA256 b3df220dc7edc143d630cd47300a4f5aa5c6d0ec4940209204084bf4880fa373
- MD5 72fcadf5196585dce72e2982da60fae6
- SHA1 d4c6406f3de0eb0a98ef7d33440f7a920b6e9fca
- SHA512 bf8dbd66a4750c1c27098128c932373f2945c9f9f745011bb3910729a40eb9b81297c0deb36a69396415288d65326c7502e54519f8bf8a01a181bbbdf67b272a
- SSDEEP 196608:YFAzFI0lsRlaQVM4vtsV5iyihCKqEkQt:oAI0mFVMG4EhTqEtt
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
6.6MB
Virtual Size
6.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
geplik.ru4.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
- MD5 2a94f3960c58c6e70826495f76d00b85
- SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
- SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
- SSDEEP 192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
13650
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
geplik.ru666.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 309d20f7a18a1ae1fed72e5c27b0ef2cc0d52dd1629efc250ca74b916730258f
- MD5 b116641699225bbcea28892995f65115
- SHA1 b43f932fa89ba3ca01bbd7739a7e01d0508cfd70
- SHA512 ac921b0d78f61070903096d31a0cf8d6a80375fbbbb5f1c211bcc8b8d88d982b40cc9088991ddd53b0fe553b0e1bf1f779a2ccae0779c756bea269cd857d79ff
- SSDEEP 1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2X3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdfY
- MD5 SHA1 SHA512 SSDEEP
-
RedLine payload
-
SectopRAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
103214
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
93KB
Virtual Size
92KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
geplik.ru6667.exe
- SHA256 980000d8405e25f8b732a33463bb2a9fd1c92f57667e4a56d8ff61cc5e7a1a6b
- MD5 b81d1f10bb2c31a9204057aeec1a2631
- SHA1 87e108c3611ebc8f0b69a705521e2722835d5269
- SHA512 094fe36da276fc57cddf45aedb7e33d2a600f3d46f0c84c46613eef1890eb1329ce48590f50cf814727c92b48dbb24cfc424adca53fe7dcf7b994fb284824dd5
- SSDEEP 24576:LsSXtCK7/VosEFgaE8eW0NsrK908QARTl7Dm4fTX:QitCItojFgz8eW0nLQARTNKY
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
793350
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
PDB paths
Name
CODE
Size
786KB
Virtual Size
785KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
DATA
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
BSS
Size
Virtual Size
15KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
44KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
201KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
geplik.ruexe.exe
- SHA256 519ca17094fb9a2c019ca09f37ffd31cc2175456597c7abb642b7b66db6d0419
- MD5 f72600d8c26ae084aee6d956fbadac00
- SHA1 7a7e3a1d59c7446a2443592cb1d3435415350f62
- SHA512 c0edf7b188cf812e855caeb8a67407c4f33914b1822bc9ddf761fdea711e9a380d0d6523c2f2aa2dae7ed5ac3614a711835926b68a690929a5a9048504917848
- SSDEEP 384:gIe083yUpvZ+QxZWgn3xNBz2WjMYwHUT0szzjw/LCDoRtv1MUOIZXW2F1vkcgxxX:S0wvsQvF9ZUZKUWodMUOIFV1vkxyT
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
.text
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
Пароли0Chrome.csv
- SHA256 a36115c83b75b83812eb19a8bde79887e2b30ce5cdbff58be85dd8882644b03b
- MD5 0fe628be5ee3ae5546df55ce52741040
- SHA1 3ea6c842599d977035bf76154a5e409ed3875935
- SHA512 78045d7c6ec8d66a4681ba187fd3622bd9221bb7929be1a8b8a6c11453febefa1865472e34d45999997dc8060b0d1cc485b9da745a31dde9b4fa78a44688d46f
- MD5 SHA1 SHA512