c13c3cdb3546357929ca0bba1ac54031

Sharing

Copy URL Twitter E-mail

General

Target

c13c3cdb3546357929ca0bba1ac54031
Size

1.8MB
MD5

c13c3cdb3546357929ca0bba1ac54031
SHA1

704d562695ed97b85186dc1db20c77034f1804fe
SHA256

38ec73fade842a8e71609bd72dc664dde3b894efddb5d520aa2292eb5cff705c
SHA512

92bdef6a1c57108d7aaa3dad391d9d2286284c8026ba907529fb9fe32167d2e721b919855dafc5f8ede226346ada4cc99480b4394725b355a4d690f285c3c6a0
SSDEEP

24576:2MI2xZhU/WFgn1QESpv4eEpOiG8Fnjona6U5YvAeyzGwDWjSmGWezuFQOYJr1U7b:2qxoQEQhVZ0smjYerq7b

Score

7^/10

upx aspackv2

Malware Config

Signatures

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
static1/unpack002/Активация WinXP SP-2/WinXP Reactivator.exe	aspack_v212_v242

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/Crack Win XP/crackXP.exe	upx

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Crack Win XP/crack/licdll.dll
unpack002/Crack Win XP/crack/winlogon.exe
unpack002/Crack Win XP/crackXP.exe
unpack003/out.upx
unpack002/Активация WinXP SP-2/WPA_Kill.exe
unpack002/Активация WinXP SP-2/WinXP Reactivator.exe
unpack002/Активация WinXP SP-2/XPKey.exe
unpack002/Активация WinXP SP-2/XPKeyOEMSE.exe
unpack004/wpa_kill_2.0.0.1/Crypt.dll
unpack004/wpa_kill_2.0.0.1/WPA_kill.exe

Files

c13c3cdb3546357929ca0bba1ac54031
.eml
crack.rar
.rar
Crack Win XP/crack/install.txt
Crack Win XP/crack/licdll.dll
.dll regsvr32 windows:5 windows x86 arch:x86

70f33a306b0f4707211a707d8708d49b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegSetValueExA
RegQueryValueExA
RegCreateKeyExA
CryptDecrypt
CryptDestroyKey
CryptDestroyHash
CryptReleaseContext
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LsaClose
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
GetCurrentHwProfileW
CryptImportKey
CryptExportKey
CryptGenKey
FreeSid
AllocateAndInitializeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
LsaStorePrivateData
LsaNtStatusToWinError
LsaOpenPolicy
RegQueryValueExW
CheckTokenMembership
LsaFreeMemory
LsaRetrievePrivateData
CryptVerifySignatureW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW

crypt32

CertGetIssuerCertificateFromStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertCreateCertificateContext
CertFindExtension
CertOpenStore
CertComparePublicKeyInfo
CertCloseStore
CryptEncodeObject
CryptExportPublicKeyInfo
CryptSignCertificate
CertEnumCertificatesInStore
CertVerifySubjectCertificateContext

kernel32

LocalFree
LocalAlloc
DeviceIoControl
GetShortPathNameW
LoadLibraryExW
GetLastError
FindResourceW
LoadResource
SizeofResource
lstrlenA
DisableThreadLibraryCalls
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleFileNameW
lstrcatW
HeapDestroy
EnterCriticalSection
LeaveCriticalSection
lstrcpynW
lstrcmpiW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
lstrcpyW
lstrlenW
MultiByteToWideChar
GetProcessHeap
HeapFree
GetSystemDefaultLCID
CreateEventW
SystemTimeToFileTime
SetEvent
CloseHandle
WaitForSingleObject
GetSystemTime
lstrcmpW
CreateThread
WriteFile
CreateFileA
LockResource
FindResourceExW
GetSystemDirectoryW
WideCharToMultiByte
HeapAlloc
GetSystemDirectoryA
Sleep
GetTickCount
lstrcpyA
GlobalMemoryStatus
lstrcmpA
LoadLibraryA
GetVolumeInformationW
GetDriveTypeA
GetLogicalDriveStringsA
GetSystemInfo
GetExitCodeThread
ResumeThread
SetThreadAffinityMask
GetProcessAffinityMask
GetCurrentProcess
ReadFile
SetFilePointer
ReleaseMutex
DebugBreak
GetFileSize
CreateMutexW
OpenMutexW
HeapCreate
HeapReAlloc
GetACP
GetVersionExW
GetModuleHandleW
FileTimeToSystemTime
CopyFileW
GetCurrentProcessId
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetDiskFreeSpaceA
QueryPerformanceCounter
GetLocalTime
GetCurrentThreadId
GetVersionExA
RtlUnwind
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
VirtualAlloc
CreateEventA
ExitProcess
VirtualFree
ReleaseSemaphore
VirtualProtect
FlushInstructionCache
GetSystemTimeAsFileTime
SetLastError

msvcrt

??3@YAXPAX@Z
_snwprintf
wcschr
_CIpow
_wcsupr
wcsncmp
wcsncat
_wtoi
_itow
_wcsicmp
wcscpy
wcstok
_wtol
__CxxFrameHandler
_ftol
ceil
wcslen
wcsncpy
atol
_adjust_fdiv
_initterm
_purecall
??2@YAPAXI@Z
realloc
free
malloc

ntdll

NtLockProductActivationKeys
NtQuerySystemInformation
RtlTimeToTimeFields

ole32

StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoCreateGuid

oleaut32

SysAllocString
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysStringLen
SysFreeString

rpcrt4

UuidCreate

setupapi

SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList

user32

GetSystemMetrics
wsprintfA
CharNextW
wsprintfW
SetTimer
KillTimer
GetDesktopWindow

wininet

InternetConnectA
InternetReadFile
InternetQueryOptionW
InternetSetOptionA
HttpSendRequestW
InternetOpenA
InternetErrorDlg
InternetCloseHandle
InternetAutodialHangup
InternetGetConnectedState
InternetAutodial
HttpOpenRequestA
HttpQueryInfoW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 262KB - Virtual size: 262KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Crack Win XP/crack/runme.cmd
Crack Win XP/crack/winlogon.exe
.exe windows:5 windows x86 arch:x86

26fd1634aefcefa3d30d56d2baeefc2f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

A_SHAInit
A_SHAUpdate
A_SHAFinal
MD5Final
MD5Update
MD5Init
I_ScSendTSMessage
RegSetKeySecurity
AddAccessAllowedAceEx
RegDeleteKeyW
RegOpenCurrentUser
CryptReleaseContext
CryptGetProvParam
CryptDestroyHash
CryptGetHashParam
CryptHashData
CryptSetHashParam
GetCurrentHwProfileW
CryptCreateHash
CryptAcquireContextW
CryptGenRandom
CryptDeriveKey
CryptSignHashW
CryptSetProvParam
CryptDestroyKey
CryptDecrypt
CryptEncrypt
CryptVerifySignatureW
CryptGetKeyParam
CryptGetUserKey
LsaNtStatusToWinError
CryptImportKey
LsaStorePrivateData
LsaRetrievePrivateData
RegCloseKey
RegQueryValueExW
RegOpenKeyW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegOpenKeyExW
CreateProcessAsUserW
DuplicateTokenEx
CloseServiceHandle
ControlService
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
EqualSid
GetTokenInformation
RegSetValueExW
RegCreateKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteValueW
CredFree
CredDeleteW
CredEnumerateW
CopySid
GetSidLengthRequired
GetSidSubAuthority
GetSidSubAuthorityCount
GetUserNameW
OpenThreadToken
ReportEventW
RegisterEventSourceW
EnumServicesStatusW
ImpersonateLoggedOnUser
RegQueryValueExA
CheckTokenMembership
DeregisterEventSource
LsaGetUserName
RevertToSelf
LookupAccountSidW
IsValidSid
SetTokenInformation
LogonUserW
LookupAccountNameW
OpenProcessToken
SynchronizeWindows31FilesAndWindowsNTRegistry
QueryWindows31FilesMigration
AdjustTokenPrivileges
SystemFunction036
RegQueryInfoKeyA
RegEnumKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetKernelObjectSecurity
QueryServiceConfigW
RegNotifyChangeKeyValue
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
AllocateLocallyUniqueId

authz

AuthzAccessCheck
AuthziFreeAuditEventType
AuthziInitializeAuditEvent
AuthziInitializeAuditParams
AuthziInitializeAuditEventType
AuthzFreeResourceManager
AuthzFreeAuditEvent
AuthziLogAuditEvent
AuthzInitializeResourceManager
AuthzFreeHandle

crypt32

CryptImportPublicKeyInfoEx
CertEnumCertificatesInStore
CertOpenStore
CertVerifySubjectCertificateContext
CertGetIssuerCertificateFromStore
CertAddCertificateContextToStore
CertFindExtension
CryptExportPublicKeyInfo
CertComparePublicKeyInfo
CertGetCertificateContextProperty
CryptDecryptMessage
CertCloseStore
CryptSignMessage
CryptImportPublicKeyInfo
CryptVerifyMessageSignature
CertCreateCertificateContext
CertDuplicateCertificateContext
CertSetCertificateContextProperty
CertFreeCertificateContext

gdi32

RemoveFontResourceW
AddFontResourceW

kernel32

LoadLibraryW
ReleaseSemaphore
CreateSemaphoreW
GetCurrentThread
WaitForSingleObjectEx
CreateThread
LoadResource
FindResourceW
SetThreadExecutionState
ResetEvent
GetComputerNameW
GetSystemDirectoryW
SetLastError
TransactNamedPipe
SetNamedPipeHandleState
GetTickCount
GetProfileStringW
GlobalGetAtomNameW
SetEnvironmentVariableW
VirtualLock
VirtualQuery
GetDriveTypeW
Beep
QueueUserWorkItem
LeaveCriticalSection
EnterCriticalSection
DisconnectNamedPipe
TerminateProcess
GetCurrentProcess
SearchPathW
lstrcatW
LocalReAlloc
ExpandEnvironmentStringsW
TerminateThread
ResumeThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
DeleteFileW
WriteProfileStringW
ReadFile
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
SetThreadPriority
SetPriorityClass
MoveFileExW
WaitForMultipleObjectsEx
GetExitCodeProcess
GetProcAddress
InterlockedExchange
SetTimerQueueTimer
GetComputerNameA
VerifyVersionInfoW
VerSetConditionMask
WriteFile
WaitNamedPipeW
WaitForMultipleObjects
ConnectNamedPipe
DuplicateHandle
OpenProcess
GetOverlappedResult
GetVersionExA
lstrcmpW
UnregisterWait
CreateNamedPipeW
CreateRemoteThread
CreateActCtxW
GetModuleFileNameW
SetErrorMode
SetUnhandledExceptionFilter
GetPrivateProfileStringW
LocalSize
VirtualAlloc
VirtualQueryEx
GetEnvironmentVariableW
DebugBreak
CreateFileA
InitializeCriticalSection
ProcessIdToSessionId
FindClose
FindFirstFileW
SetInformationJobObject
AssignProcessToJobObject
TerminateJobObject
PostQueuedCompletionStatus
PulseEvent
GetQueuedCompletionStatus
CreateIoCompletionPort
CreateJobObjectW
ActivateActCtx
DeactivateActCtx
InterlockedCompareExchange
LoadLibraryA
GetModuleHandleA
GetStartupInfoA
FreeLibrary
SleepEx
GetModuleHandleW
GetShortPathNameW
lstrcpynW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetUserDefaultLCID
GetTimeFormatW
WTSGetActiveConsoleSessionId
GetCurrentProcessId
GetCurrentThreadId
GetVersionExW
FormatMessageW
lstrcmpiW
GetProfileIntW
lstrcpyW
lstrlenW
Sleep
LocalAlloc
CreateEventW
CreateWaitableTimerW
CreateMutexW
OpenEventW
RegisterWaitForSingleObject
WaitForSingleObject
CreateProcessW
SetWaitableTimer
ReleaseMutex
SetEvent
UnregisterWaitEx
CloseHandle
GlobalAlloc
GlobalFree
GetLastError
LocalFree
GetVolumeInformationW
GetDriveTypeA
GetLogicalDriveStringsA
lstrlenA
lstrcpyA
MultiByteToWideChar
GetACP
WideCharToMultiByte
SystemTimeToFileTime
GetSystemTime
HeapAlloc
GetProcessHeap
LoadLibraryExW
HeapFree
GetSystemDefaultUILanguage
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
lstrcmpiA
GetFileSize
GetSystemInfo
GetExitCodeThread
SetThreadAffinityMask
GetProcessAffinityMask
SizeofResource
LockResource
FindResourceExW
GetSystemDirectoryA
SetFilePointer
OpenMutexW
CreateFileW
GlobalMemoryStatus
lstrcmpA
DelayLoadFailureHook
BaseInitAppcompatCacheSupport
OpenProfileUserMapping
CloseProfileUserMapping
BaseCleanupAppcompatCacheSupport
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
CreateSemaphoreA
CreateEventA
ExitProcess
VirtualFree
VirtualProtect
FlushInstructionCache
GetSystemTimeAsFileTime

msvcrt

wcsstr
wcsncpy
atoi
_wcsicmp
memmove
wcschr
wcsncat
swprintf
swscanf
_local_unwind2
wcscmp
free
malloc
_c_exit
wcslen
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_snwprintf
__p__fmode
__set_app_type
??3@YAXPAX@Z
??2@YAPAXI@Z
__CxxFrameHandler
_itow
_wtol
_strnicmp
sscanf
sprintf
_except_handler3
_controlfp
wcsncmp
_ftol
ceil
_wcsupr
wcscpy
__p__commode
wcscat
_exit
wcstok

nddeapi

ord613
ord612
ord611
ord603

ntdll

NtPowerInformation
NtSetSystemPowerState
NtRaiseHardError
RtlDeleteCriticalSection
NtOpenSymbolicLinkObject
NtReplyPort
NtCompleteConnectPort
NtReplyWaitReceivePort
NtAcceptConnectPort
NtCreatePort
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
NtLockProductActivationKeys
RtlTimeToTimeFields
NtUnmapViewOfSection
NtMapViewOfSection
NtOpenSection
NtQuerySymbolicLinkObject
NtQueryVolumeInformationFile
NtSetSecurityObject
RtlAdjustPrivilege
NtOpenFile
NtFsControlFile
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
RtlFreeHeap
NtQueryInformationToken
NtShutdownSystem
RtlEnterCriticalSection
RtlLeaveCriticalSection
RtlCompareUnicodeString
RtlInitializeCriticalSection
RtlCreateEnvironment
RtlQueryEnvironmentVariable_U
RtlSetEnvironmentVariable
RtlAllocateHeap
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlGetDaclSecurityDescriptor
RtlCopySid
RtlLengthSid
NtSetInformationThread
NtDuplicateToken
NtDuplicateObject
RtlEqualSid
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
NtOpenKey
NtQueryValueKey
NtClose
RtlOpenCurrentUser
RtlCreateSecurityDescriptor
RtlAddAce
RtlCreateAcl
RtlNtStatusToDosError
NtSetInformationProcess
NtCreateEvent
NtCreatePagingFile
RtlDosPathNameToNtPathName_U
NtQuerySystemInformation
NtOpenDirectoryObject
RtlRegisterWait
RtlTimeToSecondsSince1980
NtQuerySystemTime
NtPrivilegeObjectAuditAlarm
NtPrivilegeCheck
NtOpenThreadToken
NtOpenProcessToken
RtlUnhandledExceptionFilter
NtQueryInformationProcess
DbgBreakPoint
RtlCheckProcessParameters
RtlSetThreadIsCritical
RtlSetProcessIsCritical
RtlInitString
NtInitiatePowerAction
DbgPrint
NtFilterToken
NtQueryInformationJobObject
NtOpenEvent
RtlGetAce
RtlQueryInformationAcl
NtQuerySecurityObject
NtAllocateLocallyUniqueId

profmap

InitializeProfileMappingApi
RemapAndMoveUserW

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

regapi

RegDefaultUserConfigQueryW
RegUserConfigQuery

rpcrt4

RpcRevertToSelf
RpcFreeAuthorizationContext
RpcGetAuthorizationContextForClient
RpcServerListen
RpcImpersonateClient
RpcServerRegisterIfEx
UuidCreate
RpcServerRegisterIf
I_RpcMapWin32Status
NdrServerCall2
RpcServerUseProtseqEpW

secur32

LsaLookupAuthenticationPackage
LsaCallAuthenticationPackage
LsaRegisterLogonProcess
GetUserNameExW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiDestroyDeviceInfoList

sfc_os

SfcIsFileProtected

user32

CheckDlgButton
LoadCursorW
SetCursor
SetFocus
EnumWindows
UnhookWindowsHook
SetWindowsHookW
GetWindowTextW
CallNextHookEx
DialogBoxParamW
GetWindowPlacement
SetLastErrorEx
GetSystemMenu
DeleteMenu
SetWindowPlacement
SetUserObjectInformationW
GetAsyncKeyState
PostThreadMessageW
SetUserObjectSecurity
CreateDesktopW
KillTimer
GetMessageTime
SetTimer
wvsprintfW
UnregisterHotKey
DialogBoxIndirectParamW
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
RegisterDeviceNotificationW
SetThreadDesktop
CreateWindowExW
GetMessageW
TranslateMessage
RegisterWindowMessageW
RegisterClassW
IsDlgButtonChecked
FindWindowW
MessageBoxW
SendNotifyMessageW
PostQuitMessage
MsgWaitForMultipleObjects
GetWindowRect
GetSystemMetrics
PeekMessageW
DispatchMessageW
SetProcessWindowStation
UpdateWindow
ShowWindow
SetWindowPos
PostMessageW
ExitWindowsEx
EnumDisplayMonitors
SystemParametersInfoW
GetDlgItem
SendMessageW
CreateDialogParamW
DestroyWindow
GetWindowLongW
GetDlgItemTextW
EndDialog
SetWindowLongW
LoadStringW
SetWindowTextW
SetDlgItemTextW
wsprintfW
wsprintfA
CloseWindowStation
LoadImageW
GetKeyState
GetParent
RegisterLogonProcess
RecordShutdownReason
LoadLocalFonts
SetLogonNotifyWindow
UnlockWindowStation
LockWindowStation
GetDesktopWindow
CreateWindowStationW
OpenDesktopW
SwitchDesktop
DefWindowProcW
SetForegroundWindow
MBToWCSEx
SetWindowStationUser
UpdatePerUserSystemParameters
RegisterHotKey
ReplyMessage

userenv

ord131
ord117
GetAllUsersProfileDirectoryW
WaitForUserPolicyForegroundProcessing
ord140
WaitForMachinePolicyForegroundProcessing
ord118
ord150
ord152
UnregisterGPNotification
DestroyEnvironmentBlock
CreateEnvironmentBlock
RegisterGPNotification
GetUserProfileDirectoryW
ord130
LoadUserProfileW
UnloadUserProfile
ord151

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winsta

WinStationQueryLogonCredentialsW
_WinStationWaitForConnect
WinStationSetInformationW
_WinStationNotifyLogoff
_WinStationNotifyLogon
WinStationCheckLoopBack
WinStationShutdownSystem
_WinStationCallback
WinStationNameFromLogonIdW
WinStationDisconnect
_WinStationFUSCanRemoteUserDisconnect
WinStationConnectW
_WinStationNotifyDisconnectPipe
WinStationReset
WinStationQueryInformationW
WinStationGetMachinePolicy
WinStationEnumerate_IndexedW
WinStationIsHelpAssistantSession

ws2_32

WSACleanup
getaddrinfo
WSAStartup

Sections

.text
Size: 373KB - Virtual size: 372KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Crack Win XP/crackXP.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 9KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
GenuineCheck/GenuineCheck.exe
.exe windows:6 windows x86 arch:x86

400962508e4492c170b14a76204b3fde

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

23/05/2002, 08:00

Not After

25/09/2011, 08:00

Subject

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign

61:05:87:58:00:03:00:00:00:5a
Certificate

Issuer

CN=Microsoft Code Signing PCA,OU=Copyright (c) 2000 Microsoft Corp.,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

05/01/2005, 23:20

Not After

05/04/2006, 23:30

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

c4:1c:c4:db:41:88:1d:6c:88:4f:4f:63:9e:79:2c:d4:59:12:c1:4f
Signer

Actual PE Digest

c4:1c:c4:db:41:88:1d:6c:88:4f:4f:63:9e:79:2c:d4:59:12:c1:4f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\bt\6\src\client\obfuscate\obj\i386\oGenuineCheck.PDB

Imports

kernel32

SetEndOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetSystemDefaultLCID
GetModuleHandleA
GetProcAddress
FreeLibrary
GetExitCodeThread
GetLogicalDriveStringsA
lstrlenA
GetVolumeInformationA
GlobalMemoryStatus
GetProcessAffinityMask
CreateThread
GetStartupInfoA
GetCommandLineA
GetVersionExA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
HeapDestroy
HeapCreate
VirtualFree
HeapFree
HeapReAlloc
HeapAlloc
HeapSize
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
VirtualAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetFilePointer
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
FlushFileBuffers
CloseHandle
FindClose
FindFirstFileW
GetSystemDirectoryA
GetDriveTypeA
CreateDirectoryW
GetCurrentDirectoryW
CreateDirectoryA
LocalFree
TryEnterCriticalSection
CompareFileTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
GetComputerNameW
GetProcessHeap
SetFileAttributesW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileW
CreateFileA
GetSystemDefaultLangID
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetFileSize
ReadFile
lstrlenW
GetVolumeInformationW
GetDriveTypeW
GetLogicalDriveStringsW
DeviceIoControl
WaitForSingleObject
ResumeThread
SetThreadAffinityMask
InitializeCriticalSectionAndSpinCount
SetEvent
CreateEventA
Sleep
GetVersion

gdi32

GetStockObject
CreateSolidBrush
DeleteObject
SetBkColor

user32

EndPaint
FillRect
BroadcastSystemMessageA
wsprintfA
GetSystemMetrics
GetDesktopWindow
GetClientRect
BeginPaint
DialogBoxParamA
RedrawWindow
GetDlgItem
EndDialog
SetWindowTextA
LoadStringA
MessageBoxA

ole32

CoCreateInstance
CoSetProxyBlanket
CoCreateGuid
CLSIDFromProgID
StringFromGUID2
CoInitializeEx

crypt32

CertGetIssuerCertificateFromStore
CertOpenStore
CertComparePublicKeyInfo
CertEnumCertificatesInStore
CertFindExtension
CryptSignCertificate
CryptExportPublicKeyInfo
CryptEncodeObject
CertVerifySubjectCertificateContext
CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertCreateCertificateContext

wininet

InternetCloseHandle
HttpQueryInfoA
InternetReadFile
InternetConnectA
InternetOpenA
InternetSetOptionA
InternetGetConnectedState
InternetAutodial
InternetQueryOptionA
HttpOpenRequestA
InternetErrorDlg
HttpSendRequestA

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiCreateDeviceInfoList
SetupDiGetClassDevsW

advapi32

CryptHashData
RegOpenKeyExA
RegQueryValueExW
RegQueryValueExA
RegSetValueExA
RegCreateKeyExA
LookupAccountNameW
CryptReleaseContext
CryptDestroyKey
CryptGenKey
CryptGetUserKey
CryptGetProvParam
CryptAcquireContextA
CryptDestroyHash
CryptDeriveKey
RegCloseKey
CryptCreateHash
CryptDecrypt
RegEnumKeyExW
RegEnumKeyExA
RegOpenKeyExW
GetCurrentHwProfileA
GetCurrentHwProfileW
CryptExportKey
CryptImportKey
CryptGetHashParam

oleaut32

SysFreeString
SysAllocString
VariantInit
SysStringLen
VariantClear

Sections

.text
Size: 387KB - Virtual size: 386KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Активация WinXP SP-2/SetOOBEActivated.reg
Активация WinXP SP-2/Setup.bat
Активация WinXP SP-2/WPA_Kill.exe
.exe windows:4 windows x86 arch:x86

d149ce855ccb85a21966a23cb9a790e3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvbvm60

MethCallEngine
ord516
ord660
ord592
ord300
ord301
ord595
ord303
ord306
ord307
ord309
ord709
ord632
ord526
EVENT_SINK_AddRef
ord529
DllFunctionCall
EVENT_SINK_Release
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord710
ord711
ord712
ord607
ord530
ord608
ord317
ord318
ord533
ProcCallEngine
ord537
ord648
ord573
ord681
ord576
ord578
ord685
ord100
ord579
ord616
ord617
ord580

Sections

.text
Size: 64KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Активация WinXP SP-2/WinXP Reactivator.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 157KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

DATA
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.buran
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.adata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Активация WinXP SP-2/XPKey.exe
.exe windows:4 windows x86 arch:x86

ce44fb69099890add744753897c5813a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4424
ord3610
ord5265
ord4376
ord4853
ord3402
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord567
ord324
ord825
ord656
ord2302
ord4234
ord6199
ord2864
ord2379
ord4673
ord6055
ord5290
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord609
ord823
ord793
ord765
ord616
ord800
ord2621
ord1134
ord2575
ord4396
ord3574
ord3721
ord3719
ord3698
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord1146
ord1168
ord860
ord540
ord2289
ord2370
ord2642
ord755
ord470
ord5981
ord3874
ord3876
ord2818
ord6778
ord6779
ord2614
ord4224
ord3873
ord1105
ord1776
ord4274
ord6375
ord795
ord1576

msvcrt

srand
time
__CxxFrameHandler
atoi
difftime
_close
rand
_write
_open
strftime
localtime
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_ftol
__p__fmode
__set_app_type
_except_handler3
_controlfp
floor
__p__commode
_setmbcp

kernel32

GetModuleHandleA
GetStartupInfoA
Sleep

user32

SendMessageA
DrawIcon
GetClientRect
LoadIconA
GetSystemMetrics
EnableWindow
GetActiveWindow
MessageBoxA
IsIconic
GetParent

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Активация WinXP SP-2/XPKeyOEMSE.exe
.exe windows:4 windows x86 arch:x86

ce44fb69099890add744753897c5813a

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mfc42

ord4424
ord3610
ord5265
ord4376
ord4853
ord3402
ord4998
ord4710
ord2514
ord6052
ord4078
ord1775
ord4407
ord5241
ord2385
ord5163
ord6374
ord4353
ord5280
ord3798
ord4837
ord4441
ord2648
ord2055
ord6376
ord3749
ord5065
ord1727
ord5261
ord2446
ord2124
ord5277
ord2982
ord3147
ord3259
ord4465
ord3136
ord3262
ord2985
ord3081
ord2976
ord3830
ord3831
ord3825
ord3079
ord4080
ord4627
ord4425
ord3597
ord641
ord567
ord324
ord825
ord656
ord2302
ord4234
ord6199
ord2864
ord2379
ord4673
ord6055
ord5290
ord4486
ord2554
ord2512
ord5731
ord3922
ord1089
ord5199
ord2396
ord3346
ord5300
ord5302
ord2725
ord4079
ord4698
ord5307
ord5289
ord5714
ord4622
ord3738
ord561
ord815
ord609
ord823
ord793
ord765
ord616
ord800
ord2621
ord1134
ord2575
ord4396
ord3574
ord3721
ord3719
ord3698
ord2411
ord2023
ord4218
ord2578
ord4398
ord3582
ord1146
ord1168
ord860
ord540
ord2289
ord2370
ord2642
ord755
ord470
ord5981
ord3874
ord3876
ord2818
ord6778
ord6779
ord2614
ord4224
ord3873
ord1105
ord1776
ord4274
ord6375
ord795
ord1576

msvcrt

srand
time
__CxxFrameHandler
atoi
difftime
_close
rand
_write
_open
strftime
localtime
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_ftol
__p__fmode
__set_app_type
_except_handler3
_controlfp
floor
__p__commode
_setmbcp

kernel32

GetModuleHandleA
GetStartupInfoA
Sleep

user32

SendMessageA
DrawIcon
GetClientRect
LoadIconA
GetSystemMetrics
EnableWindow
GetActiveWindow
MessageBoxA
IsIconic
GetParent

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Активация WinXP SP-2/orgix.hiv
Активация WinXP SP-2/readme.txt
Активация WinXP SP-2/wa.reg
Активация WinXP SP-2/ПОМОЩЬ.txt
email-plain-1.txt
wpa_kill_2.0.0.1.zip
.zip
wpa_kill_2.0.0.1/Crypt.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

DeCrypt
EnCrypt

Sections

.text
Size: 1024B - Virtual size: 874B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
wpa_kill_2.0.0.1/WPA_kill.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

Size: - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 51KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wpa_kill_2.0.0.1/file.diz
wpa_kill_2.0.0.1/readme.txt

Sharing

General

Malware Config

Signatures

Files

70f33a306b0f4707211a707d8708d49b

Headers

File Characteristics

Imports

advapi32

crypt32

kernel32

msvcrt

ntdll

ole32

oleaut32

rpcrt4

setupapi

user32

wininet

Exports

Exports

Sections

.text Size: 262KB - Virtual size: 262KB

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 17KB - Virtual size: 17KB

.reloc Size: 12KB - Virtual size: 12KB

26fd1634aefcefa3d30d56d2baeefc2f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

authz

crypt32

gdi32

kernel32

msvcrt

nddeapi

ntdll

profmap

psapi

regapi

rpcrt4

secur32

setupapi

sfc_os

user32

userenv

version

winsta

ws2_32

Sections

.text Size: 373KB - Virtual size: 372KB

.data Size: 9KB - Virtual size: 19KB

.rsrc Size: 38KB - Virtual size: 37KB

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 56KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 4KB - Virtual size: 8KB

Headers

File Characteristics

Sections

.text Size: 24KB - Virtual size: 24KB

.data Size: 2KB - Virtual size: 28KB

.idata Size: 2KB - Virtual size: 4KB

.rsrc Size: 9KB - Virtual size: 12KB

400962508e4492c170b14a76204b3fde

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88Certificate

Extended Key Usages

Key Usages

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7eCertificate

Extended Key Usages

.text
Size: 262KB - Virtual size: 262KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 17KB - Virtual size: 17KB

.reloc
Size: 12KB - Virtual size: 12KB

.text
Size: 373KB - Virtual size: 372KB

.data
Size: 9KB - Virtual size: 19KB

.rsrc
Size: 38KB - Virtual size: 37KB

UPX0
Size: - Virtual size: 56KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 4KB - Virtual size: 8KB

.text
Size: 24KB - Virtual size: 24KB

.data
Size: 2KB - Virtual size: 28KB

.idata
Size: 2KB - Virtual size: 4KB

.rsrc
Size: 9KB - Virtual size: 12KB

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

6a:0b:99:4f:c0:00:0c:ab:11:d8:22:ef:7d:6c:79:7e
Certificate

61:05:87:58:00:03:00:00:00:5a
Certificate

c4:1c:c4:db:41:88:1d:6c:88:4f:4f:63:9e:79:2c:d4:59:12:c1:4f
Signer

.text
Size: 387KB - Virtual size: 386KB

.data
Size: 24KB - Virtual size: 40KB

.rsrc
Size: 80KB - Virtual size: 79KB

.text
Size: 64KB - Virtual size: 60KB

.data
Size: - Virtual size: 7KB

.rsrc
Size: 4KB - Virtual size: 1KB

CODE
Size: 157KB - Virtual size: 384KB

DATA
Size: 2KB - Virtual size: 8KB

BSS
Size: - Virtual size: 4KB

.idata
Size: 3KB - Virtual size: 12KB

.tls
Size: - Virtual size: 4KB

.rdata
Size: 512B - Virtual size: 4KB

.reloc
Size: - Virtual size: 28KB

.rsrc
Size: 32KB - Virtual size: 96KB

.buran
Size: 6KB - Virtual size: 8KB

.adata
Size: - Virtual size: 4KB

.text
Size: 24KB - Virtual size: 23KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 8KB - Virtual size: 4KB