ecc952f6900284b23aeb2f2c02d08ba4_JaffaCakes118
- SHA256 8109b2fe6fe61eec679d059c1e553c20777dde2b6b8200ce3bdf57b2f2068bf5
Overview
overview
10Static
static
3HA_SendLin...re.exe
windows7-x64
7HA_SendLin...re.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/Assi...fy.exe
windows7-x64
8$TEMP/Assi...fy.exe
windows10-2004-x64
8$R0.dll
windows7-x64
8$R0.dll
windows10-2004-x64
8Assist/$R0.dll
windows7-x64
6Assist/$R0.dll
windows10-2004-x64
6$TEMP/DUDU_HH.exe
windows7-x64
10$TEMP/DUDU_HH.exe
windows10-2004-x64
10SendLink.exe
windows7-x64
3SendLink.exe
windows10-2004-x64
3SendLink.url
windows7-x64
6SendLink.url
windows10-2004-x64
3SendLog.html
windows7-x64
1SendLog.html
windows10-2004-x64
1SlideShow.html
windows7-x64
1SlideShow.html
windows10-2004-x64
1Support.url
windows7-x64
5Support.url
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
HA_SendLink191_Fire.exe
Resource
win7-20240319-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
HA_SendLink191_Fire.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Splash.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Splash.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240220-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
$TEMP/Assist_hanzify.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral12
Sample
$TEMP/Assist_hanzify.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
$R0.dll
Resource
win7-20240319-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral14
Sample
$R0.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral15
Sample
Assist/$R0.dll
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
Assist/$R0.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
$TEMP/DUDU_HH.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
$TEMP/DUDU_HH.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral19
Sample
SendLink.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
SendLink.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral21
Sample
SendLink.url
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
SendLink.url
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
SendLog.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
SendLog.html
Resource
win10v2004-20240226-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
SlideShow.html
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
SlideShow.html
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral27
Sample
Support.url
Resource
win7-20240319-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral28
Sample
Support.url
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
uninst.exe
Resource
win7-20240220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral30
Sample
uninst.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral31
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target ecc952f6900284b23aeb2f2c02d08ba4_JaffaCakes118
- Size 470KB
- Sample240411-gf4jmsdf42
- SHA256 8109b2fe6fe61eec679d059c1e553c20777dde2b6b8200ce3bdf57b2f2068bf5
- MD5 ecc952f6900284b23aeb2f2c02d08ba4
- SHA1 c109f7caa0aeae6e7ba464d6b12d2e6fc8ebea62
- SHA512 3fc457dde4694a0f4f83bcb641d965ae5c82cbc04d30f55f931a2c140486c3b18049b37fb7532c05897ff2285cc5cfd7329e286fc1709a704811c2e36abf6e92
- SSDEEP 6144:w8TCDgy82yhZHzSky3XE8V22dl192Bjpdvitf8LuBToP126xHe0K/rUHLM:hFJLHzSky3jV5dl192BABM1261eDKg
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 12 IoCs
Checks for missing Authenticode signature.
resource unpack001/HA_SendLink191_Fire.exe unpack002/$PLUGINSDIR/InstallOptions.dll unpack002/$PLUGINSDIR/Splash.dll unpack002/$PLUGINSDIR/StartMenu.dll unpack002/$PLUGINSDIR/System.dll unpack002/$TEMP/Assist_hanzify.exe unpack003/$R0 unpack003/Assist/$R0 unpack002/$TEMP/DUDU_HH.exe unpack002/SendLink.exe unpack002/uninst.exe unpack004/$PLUGINSDIR/LangDLL.dll - NSIS installer 3 IoCs
resource yara_rule static1/unpack001/HA_SendLink191_Fire.exe nsis_installer_1 static1/unpack002/$TEMP/Assist_hanzify.exe nsis_installer_1 static1/unpack002/uninst.exe nsis_installer_1
File Explorer
-
ecc952f6900284b23aeb2f2c02d08ba4_JaffaCakes118.zip 470KB
-
HA_SendLink191_Fire.exe.exe 481KB
-
$PLUGINSDIR/CustomPage.ini374B
-
$PLUGINSDIR/InstallOptions.dll.dll 12KB
-
$PLUGINSDIR/Splash.dll.dll 4KB
-
$PLUGINSDIR/Splash_logo-2.BMP49KB
-
$PLUGINSDIR/StartMenu.dll.dll 6KB
-
$PLUGINSDIR/System.dll.dll 10KB
-
$PLUGINSDIR/bgm_ʮ.mid6KB
-
$PLUGINSDIR/ioSpecial.ini211B
-
$PLUGINSDIR/modern-header.bmp25KB
-
$PLUGINSDIR/modern-wizard.bmp85KB
-
$TEMP/Assist_hanzify.exe.exe 193KB
-
$R0.dll 128KB
-
Assist/$R0.dll 156KB
-
$TEMP/DUDU_HH.exe.exe 220KB
-
SendLink.exe.exe 232KB
-
SendLink.url61B
-
SendLog.html.html 2KB
-
SlideShow.html.html .js 4KB
-
Support.url59B
-
uninst.exe.exe 56KB
-
$PLUGINSDIR/LangDLL.dll.dll 5KB
-
$PLUGINSDIR/modern-header.bmp25KB
-
˵.txt2KB
-
˵.txt2KB
-
.txt3KB
HA_SendLink191_Fire.exe
- IMPHASH 1bed3305885b0ca596d9cbba22baf78a
- SHA256 38a285fad90354c149689c2edcfbf2fa37441582fc97abfd4969739bc7df8c02
- MD5 c70f92533a5e197dcfdcc2c5edbdd98e
- SHA1 aab8d6bf5dec47e89bd34ad036b4edbc73444563
- SHA512 fd22a20825ebd1342003210306a3bbf4f1cf9c80d819558543c98f73911b458f71de5d8294e689f265ec2e1366e19522346863934f836fca1fcb2d7874217dc6
- SSDEEP 6144:FhF2fYDYYD+y82yhRHFSky3XEMV22Jl1F2BjplvitfMLuBTKP1265He0alrUHLY:fUTXJvHFSky3VV5Jl1F2BWBu126deHKU
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
14178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA
user32
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
CreateWindowExA
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetDlgItem
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
SetClipboardData
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
IsWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=159, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/CustomPage.ini
- SHA256 067dbd01b52ab2afd5771674b4081d096f4ab4bd0000852b219f4c41eec6cef4
- MD5 71ff189e29673708bbd707ec7dab56f7
- SHA1 23f754f692309abc5c4659fd420c371749f97fae
- SHA512 b9bc3d2228607257ce758fa51a1b47fed7488901e6cf672765f54332a5150f2162d89bc26bae4f442b392b97750f7eee33f960a39bc0bbc917fa4565b09ffc1c
- MD5 SHA1 SHA512
$PLUGINSDIR/InstallOptions.dll
- IMPHASH 9d433976e02d79532f0d635ee81d0b20
- SHA256 8203ae1589a50e6ff012e5d27bdd4f8ed7506077ca9b052827f5e90aaeb98519
- MD5 1e8f2fefe3ce893b117b26948b8978cb
- SHA1 59cfc6c3f5716e91609e54ca80ae8b06c93ef8ab
- SHA512 b3c36e1aa5d3ee5f482f4175a7d6fe10cf2bf3bd3423ab4266d11c4181cfbc7e3f66a30855034a8ec026a4d5987598f0116e98519b7445d9e5687bcbab2c0e5c
- SSDEEP 192:qzixixDOHhG9db9rd+oSVPECMlh3I8tqDyng7hwbbHF1QuCb:qOx0DOHqrdwTY6+ng72bbMum
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10288
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
MultiByteToWideChar
GetModuleHandleA
GetPrivateProfileIntA
GlobalAlloc
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
lstrcmpiA
user32
GetDlgCtrlID
GetClientRect
SetWindowRgn
LoadIconA
MapWindowPoints
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadImageA
gdi32
SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
ShellExecuteA
comdlg32
GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError
dialog
initDialog
show
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
152B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
930B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=63, id=1, productName=Unmarked objects,
count=11, id=93, version=2179,
count=1, id=49, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/Splash.dll
- IMPHASH dfca8f6698c93c9475bec373d99a1efd
- SHA256 2ada4d9531a62772ddd7eeb0737fe91925982c543990d9c0d4faaadde12b7ed0
- MD5 e07ad0d2f86ddf926911e3d2dbc2021e
- SHA1 370c93de8c9ba9549b0a646b329cb8d2fc7c91f8
- SHA512 c13747e3cb2d6712f3bf19bfe1bbbab47763239a4e21bbe685edbedae98bda9c7b8e4e06c22e8b7737752a3c3129e07c91c00b6e90ac741e891bc1bfa966fdae
- MD5 SHA1 SHA512
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GlobalFree
lstrcpyA
GlobalAlloc
lstrcatA
user32
RegisterClassA
LoadCursorA
DefWindowProcA
LoadImageA
EndPaint
GetClientRect
BeginPaint
SetTimer
ShowWindow
SetWindowPos
SetWindowLongA
SystemParametersInfoA
CreateWindowExA
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
DestroyWindow
gdi32
DeleteDC
BitBlt
SelectObject
CreateCompatibleDC
GetObjectA
DeleteObject
winmm
PlaySoundA
show
Name
.text
Size
1024B
Virtual Size
949B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
962B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
220B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/Splash_logo-2.BMP
- SHA256 1984cd30347613a06af1f9c8c4f92a9d152afec7a325257ebb334fe2c4852261
- MD5 383b536780fbc2f666925a81647479ec
- SHA1 9b4c5f1600b652984384b6f638dd6ed49a7a1125
- SHA512 66d4c93b009834d279f04e577c2f448141c60f5c537a57ea067626dd02e546ae5a6dd643d258c86ff574f1c280bd2b2bf06ffc225012aa8c2ceb8997271bb7e7
- SSDEEP 768:mqkmrZcrFtWH9+PmACLwhZLPT8guz3+BE5pdSwzNKQZS2dLjh7W0z/G5vx+HDu:YmrOrFtW+h1sfJ0QZSeK0S
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/StartMenu.dll
- IMPHASH 7d85f9c30f9e87a65fff848de2c96ac1
- SHA256 0fd71473abf9bdb824772875c915ba4864af50666cb41782ea26db11f4ded7ae
- MD5 5c6271fb9e292a5f970abc96e5b0182e
- SHA1 95f9b6d87c142cb42882cb3ca38d1fd424ee5bc3
- SHA512 32ff24ede0d0ae99411e4780af0d9f774190cac5e965eca98a0003e772324f1d90ed9b27d2d4f700634aec29b906822f8c37640c840e8ed07adb35dafaf25a00
- SSDEEP 96:HxLJdRZk8OkmE+WHw0FMXF6CWhFxKpKsVQhEfP0:HxLjPk8OT30FFAaCP0
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
6354
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrcpynA
GlobalAlloc
MulDiv
GetModuleHandleA
GlobalFree
FindClose
FindNextFileA
FindFirstFileA
lstrcmpiA
lstrcatA
lstrcpyA
user32
GetMessageA
IsDialogMessageA
PostMessageA
CallWindowProcA
TranslateMessage
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
ScreenToClient
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
GetWindowTextA
IsDlgButtonChecked
DispatchMessageA
DestroyWindow
GetDlgItem
CreateDialogParamA
SetWindowLongA
wsprintfA
GetWindowLongA
gdi32
GetTextMetricsA
SelectObject
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListA
Init
Select
Show
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
460B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=1, productName=Unmarked objects,
count=9, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/System.dll
- IMPHASH 4ec328f99bdd944fc98d8a5cf11f7a62
- SHA256 7a24883bdbf08ce90938094b6ab6f09a842af10b18b8ae4d70da2e6b806490b8
- MD5 10c44246d99a1c2e5f5e6b52b111a63d
- SHA1 0f41da79c3e789f4ae38738e3a5d73c538f8af4f
- SHA512 e5b0fa27cd02a67be5eb9c63646621d3e9ccfada98659c50dee8310a58ce12e1a6a059788b85f0f440067ed7e281a0e1a526b9403993b9000f91a51bfbb50da3
- SSDEEP 192:rOSsJI/rqmIDNLU0dq51EgAiNbubv6rLZ:lHQQ0d01Egbq76r
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10319
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
user32
wsprintfA
ole32
StringFromGUID2
CLSIDFromString
Alloc
Call
Copy
Free
Get
Int64Op
Store
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
784B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
92B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
494B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=14, version=7299,
count=19, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=3, id=48, version=9044,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/bgm_ʮ.mid
- SHA256 8d587b287ffd9376bad8e6ec62de803c8fca0500b7869c32ac2c2ceac042080a
- MD5 ddaf7a4effda5d0fbc39fb1c04dabeab
- SHA1 c3e7399e8a07005cb42b34adf1eab7dc680640ea
- SHA512 507bf70b471c494d126a8bd95433d1d0f10a2a11bcb0cc9003cbe07176ae0ba2c5d9cb22ff026cf371dc797893c95ac6009853a825d751a3362ab3c40e1869fb
- SSDEEP 192:BYfLDkO6VgI1T5XT1czek5ckfGaTNiVoCWpShAG8MHA:efvkOcgI1lXT1HkVNiVTqShAGnA
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/ioSpecial.ini
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- MD5 SHA1 SHA512
$PLUGINSDIR/modern-header.bmp
- SHA256 130a8ab35faf3e804a04e9a56a790ee388352b084f9079cf07b601b76b6caa64
- MD5 789d398691ff11f021a5f35e6d6f2856
- SHA1 6fc01136c7498cdd356bf1dcdd494b903a627168
- SHA512 4297b52f7663221121041b305d957517bf906d6c334bc35e19a7424d16e6e7d3c94b1c0ddccd03464be4356e6b2fb8c1e403907eb99cac7d7909d09975a5091a
- SSDEEP 768:nFjQ1XR8CAAP93VuG/a0Yw6uIr2TnRkvE:nW8C9P1VJ/8wnnRk8
- MD5 SHA1 SHA512 SSDEEP
$PLUGINSDIR/modern-wizard.bmp
- SHA256 7d5a2ff63ef7d209305b8faf074d1298fa504adc7051c10c61bcf6207be62041
- MD5 e7b9b38d7e2c28364123de24db2c67f1
- SHA1 6f11ed5d7eda3754eac4950ddb6cbf3d5b0cb81c
- SHA512 70f914a80bc5b6fda4a4464a3497c930e71769bd34761c419368dcefac49360733bb37bb3797fcd3c7f56e6c1704876096c9c8f5b40003b70506fd8b4b004875
- SSDEEP 1536:cXZM/bwDvuxN9iZNrHRv4Sgml150fTrJyQFS5AQppioGhAx80Fy/N8oFWdt:cXGMDvdHOSgu0rjF+KAxDyl8qWr
- MD5 SHA1 SHA512 SSDEEP
$TEMP/Assist_hanzify.exe
- IMPHASH b711f65a9aff6a22fb2f57f0ac8bda33
- SHA256 7a9be0f039c30ed7b521619244d5f1b34029f573162b39022948ab472bb65a04
- MD5 7e32fa5420daf2bef4833396f4390ab4
- SHA1 22238aa3e8ad066c525afc62e140937bfd597ca8
- SHA512 3b5307f03cd6f74c11440aa36f0222c21850af7f4723e73b261b727b5c03c94fe2fa02e897e8a07c13c4bc0b53819a3b3ca6be0c668328fe0de0de5a9ff56ea1
- SSDEEP 3072:ck5+bFdkJCaWvV9MDKsxt+Q2ua4m3r8HlimB4PKPRngJY/HkzanhV2HD:x05aoV92xt12N33r8BOU+J6kzanhsHD
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
13104
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
MulDiv
GetPrivateProfileStringA
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA
user32
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
CreateWindowExA
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
IsWindow
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
EmptyClipboard
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
GetDlgItem
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
108KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=156, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$R0
- IMPHASH 3e01e5e72f4a727eb05e25847cae4d97
- SHA256 68dbf3a7828473663ca275c6eef36d91ae0e620baa7c1583d0bbc4f780dbe5c3
- MD5 7ff63507a1ea33dc677c1f0a838fadf6
- SHA1 c35183495c7d90f22ad83970b4a86ca0c4b8b433
- SHA512 cdb8901c61e92894cf471fc305b0087f4849a71b8cb9f04eb6ddc6b53f90825532ceaaf57f6e5f98ff1f5a18ba20a0ecb6583a12e8777b5145704058582eb27d
- SSDEEP 1536:RGkDMJFeUvHjc5m9uY2nTP3f3ZOvzyaBnoifEhRfbBRJRZrPatTcu69OA7M6nFNR:gJ8p7JafiBRJRZrNMA7M6nFNend2
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
59937
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
DeviceIoControl
CreateFileA
ReadFile
SetFilePointer
GetSystemDirectoryA
GetWindowsDirectoryA
WideCharToMultiByte
WinExec
LockResource
SizeofResource
LoadResource
FindResourceA
GetACP
CreateDirectoryA
GetEnvironmentVariableA
RemoveDirectoryA
GetVersionExA
FindNextFileA
FindFirstFileA
ReleaseMutex
WriteFile
MoveFileExA
CopyFileA
GetCurrentProcess
InterlockedDecrement
SetEvent
WaitForMultipleObjects
ResetEvent
CreateEventA
lstrlenW
LoadLibraryExA
SetErrorMode
LocalFree
lstrcpyA
lstrcatA
Sleep
lstrlenA
MultiByteToWideChar
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileSectionA
DeleteFileA
GetTempPathA
GetTempFileNameA
WaitForSingleObject
GetTickCount
CreateMutexA
GetLastError
CloseHandle
LoadLibraryA
GetProcAddress
FreeLibrary
GetShortPathNameA
DisableThreadLibraryCalls
GetModuleFileNameA
FindClose
user32
GetSysColor
EnableWindow
LoadStringA
GetDesktopWindow
MessageBoxA
CallWindowProcW
SetWindowTextA
GetForegroundWindow
IsIconic
CallWindowProcA
SetWindowLongA
PostQuitMessage
PeekMessageA
LoadBitmapA
IsWindow
GetPropA
GetParent
GetClientRect
FlashWindowEx
PostMessageA
FindWindowExA
wsprintfA
DestroyWindow
DestroyIcon
DispatchMessageA
TranslateMessage
TranslateAcceleratorA
IsDialogMessageA
GetMessageA
ShowWindow
SetWindowPos
ScreenToClient
GetWindowRect
GetDlgItem
CreateDialogParamA
RemovePropA
KillTimer
SetTimer
SetPropA
SendMessageA
IsWindowUnicode
SetWindowLongW
GetSystemMetrics
SetForegroundWindow
GetAncestor
GetCapture
GetDC
GetMessagePos
IsWindowVisible
ReleaseDC
SetCapture
ReleaseCapture
LoadCursorA
SetCursor
BeginPaint
GetWindowTextA
DrawTextA
EndPaint
DialogBoxParamA
InvalidateRect
CheckDlgButton
IsDlgButtonChecked
EndDialog
ExitWindowsEx
SetDlgItemTextA
LoadImageA
LoadIconA
gdi32
GetObjectA
GetPixel
SelectObject
SetBkColor
CreateFontIndirectA
SetTextColor
DeleteObject
advapi32
RegOpenKeyA
AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegEnumValueA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
LookupPrivilegeValueA
shell32
ShellExecuteA
ole32
CoInitialize
CoCreateInstance
OleUninitialize
OleInitialize
CoUninitialize
CoGetMalloc
StringFromIID
CLSIDFromString
oleaut32
SysStringByteLen
SysAllocString
SysAllocStringByteLen
VariantInit
VariantClear
SysFreeString
LoadTypeLi
RegisterTypeLi
comctl32
ImageList_Create
ImageList_Destroy
ImageList_AddMasked
shlwapi
SHRegEnumUSKeyA
SHRegOpenUSKeyA
SHDeleteValueA
SHGetValueA
SHDeleteKeyA
SHSetValueA
SHDeleteEmptyKeyA
SHRegCloseUSKey
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
urlmon
URLDownloadToFileA
msvcrt
_itoa
__CxxFrameHandler
memset
??2@YAPAXI@Z
memcmp
strcat
strcpy
??1type_info@@UAE@XZ
_adjust_fdiv
_initterm
_onexit
__dllonexit
_CxxThrowException
toupper
tolower
wcscpy
strncat
wcslen
wcscmp
_mbsnbcmp
_mbscmp
atoi
atol
_stricmp
ftell
rewind
fgets
_strnicmp
fseek
fprintf
memmove
fwrite
_ftol
_mbsstr
sprintf
strchr
sscanf
time
srand
rand
_mbsnbcpy
free
fopen
fread
fclose
malloc
strstr
_beginthreadex
strncpy
strrchr
_except_handler3
memcpy
strcmp
_mbsicmp
_snprintf
strlen
setupapi
SetupIterateCabinetA
wininet
InternetConnectA
InternetOpenA
InternetSetStatusCallback
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetGetConnectedState
InternetCrackUrlA
HttpQueryInfoA
InternetCloseHandle
Action
ActionEx
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EventInvoke
Install
SCEventInvoke
SetSysInfo
Version
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.autoliv
Size
4KB
Virtual Size
8B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
40KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=12, version=7291,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8798,
count=2, id=11, version=8047,
count=9, id=95, version=2190,
count=27, id=93, version=2179,
count=252, id=1, productName=Unmarked objects,
count=26, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
Assist/$R0
- IMPHASH e9559ac95b98ff4786d6b8f305be59c0
- SHA256 a8cd1c0f58135ad104b0d2a3064d3d4b9792be5ff40a721aac7eb37e26708b36
- MD5 aaf5a6b61ca11868c31011a68d95a5ef
- SHA1 d58bb83332af9e56758ff5cb1fcd3173567e6c4c
- SHA512 e6461950958a38089197932f6ba34b578a6d6932e1cf7412a2c93f5841e853468037c0cd2081d3ef5f744ab04df7b8b967113aa255066a1f22ae980dc6ceca3b
- SSDEEP 3072:rLUxXZ6+a0acTJyxc+avp3U0S96yM33fJgqVfuO8LLx14:cxZ6/cNSKd7r33VfVA
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
85329
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
wininet
InternetCrackUrlA
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
shlwapi
SHDeleteEmptyKeyA
SHDeleteValueA
SHDeleteKeyA
SHGetValueA
SHSetValueA
kernel32
GetVersionExA
GetWindowsDirectoryA
GetEnvironmentVariableA
GetModuleHandleA
FindClose
FindFirstFileA
DeviceIoControl
CreateFileA
Sleep
CopyFileA
DeleteFileA
MoveFileExA
GetLastError
RemoveDirectoryA
FindNextFileA
CreateDirectoryA
WaitForSingleObject
LoadLibraryExA
SetErrorMode
WideCharToMultiByte
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
MapViewOfFile
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
DisableThreadLibraryCalls
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
CreateMutexA
GetSystemTime
TerminateThread
lstrlenA
LeaveCriticalSection
EnterCriticalSection
LocalFree
InterlockedIncrement
FindResourceA
InterlockedDecrement
lstrlenW
GetCurrentThreadId
FlushInstructionCache
GetCurrentProcess
GetShortPathNameA
GetProcAddress
FreeLibrary
LoadLibraryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetModuleFileNameA
lstrcpyW
lstrcatA
MultiByteToWideChar
lstrcpyA
CloseHandle
GetTickCount
GetTempFileNameA
GetTempPathA
LockResource
SizeofResource
LoadResource
user32
GetSysColorBrush
DestroyMenu
SetMenuItemInfoA
CheckMenuItem
TrackPopupMenu
MoveWindow
LoadBitmapA
GetAncestor
PostMessageA
FindWindowExA
GetPropA
SetPropA
wsprintfA
UpdateWindow
ShowWindow
DrawTextA
LoadStringA
LoadImageA
SetRect
CharNextA
CharUpperA
CharLowerA
DrawEdge
MessageBoxA
SetForegroundWindow
CreateWindowExA
GetDlgItem
DestroyWindow
InvalidateRect
GetParent
GetSubMenu
FillRect
GetFocus
GetWindowTextA
SetWindowTextA
GetWindow
GetClassInfoExA
RegisterClassExA
GetKeyState
TranslateMessage
DispatchMessageA
CallWindowProcA
GetWindowLongA
SetWindowLongA
GetClientRect
GetSysColor
CopyRect
InflateRect
BeginPaint
EndPaint
IsWindow
GetWindowRect
RedrawWindow
GetSystemMetrics
PtInRect
ReleaseCapture
GetDC
ReleaseDC
SetCapture
GetCursorPos
ScreenToClient
LoadCursorA
SetCursor
SendMessageA
DefWindowProcA
IsWindowVisible
LoadMenuA
InsertMenuA
CreatePopupMenu
GetDesktopWindow
RemovePropA
GetForegroundWindow
GetClassNameA
MapWindowPoints
gdi32
CreateBitmap
SetBkColor
SetBkMode
SetTextColor
GetTextExtentPoint32A
DeleteObject
GetStockObject
Rectangle
SelectObject
CreateSolidBrush
CreatePen
SelectClipRgn
CombineRgn
CreateRectRgn
DeleteDC
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
advapi32
RegEnumValueA
RegCreateKeyExA
RegCloseKey
RegOpenKeyExA
RegFlushKey
RegOpenKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegQueryValueA
RegQueryValueExA
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
shell32
ShellExecuteA
ShellExecuteExA
ole32
CoTaskMemFree
CoCreateInstance
CoInitialize
OleUninitialize
OleInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoUninitialize
CLSIDFromString
oleaut32
LoadTypeLi
VarUI4FromStr
SysStringByteLen
RegisterTypeLi
SysAllocStringByteLen
VariantInit
LoadRegTypeLi
SysStringLen
SysAllocStringLen
VariantClear
SysAllocString
SysFreeString
comctl32
ImageList_AddMasked
ImageList_Create
ImageList_Draw
ImageList_ReplaceIcon
ImageList_Remove
ImageList_Destroy
urlmon
URLDownloadToFileA
msvcrt
strlen
memset
_snprintf
strcmp
strncmp
??3@YAXPAX@Z
__CxxFrameHandler
ftell
_purecall
??2@YAPAXI@Z
memcpy
memcmp
strcpy
strcat
strrchr
atoi
_mbspbrk
_CxxThrowException
?terminate@@YAXXZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
??1type_info@@UAE@XZ
atol
free
malloc
realloc
_mbscmp
fclose
toupper
fprintf
fseek
fopen
_beginthreadex
strchr
_except_handler3
strncpy
fwrite
_mbsstr
sprintf
abs
_ftol
_strlwr
strncat
memmove
wcslen
sscanf
strstr
strftime
localtime
time
_strnicmp
fgets
rewind
_stricmp
_wcsicmp
isalnum
setupapi
SetupIterateCabinetA
netapi32
Netbios
CheckIntegrity
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
RunSettings
Name
.text
Size
84KB
Virtual Size
81KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
36KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
12KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=12, version=7291,
count=3, id=14, version=7299,
count=3, id=11, version=8047,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=3, id=11, version=8798,
count=13, id=95, version=2190,
count=314, id=1, productName=Unmarked objects,
count=31, id=93, version=2179,
count=2, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=40, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$TEMP/DUDU_HH.exe
- IMPHASH 86057e03f22e7f492f3fdd45c4a17706
- SHA256 81db7a9742cb8fb50f7a97a952388cb3f4a1a9d150bc84705f8c2abf2c71dafe
- MD5 0b2a860a558ca00e1b4f389b6d8be1e6
- SHA1 5e5a12756446751482d3db2798bd954f2f49ee68
- SHA512 2210d69d467358c3174bf0685bd6dc1236d56aa9a19246c58931ebf87fe955fb4ed5e9acbb328b1775930e20fa275781c0eb48dd6d943de46ff20dc8fe511147
- SSDEEP 1536:OmcjI6qnGJWh7jtCY4d/2uXAEaTKKNZuYfoIRSPVOklNmUSxxbZl99JF:OHGnGAl5id+kQfJoIOVOklNmUSxx
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
TerminateProcess
GetCurrentProcess
GetModuleHandleA
ExitProcess
GetCommandLineA
WinExec
GetTempPathA
LocalFree
_lclose
_lwrite
LocalAlloc
_lcreat
LockResource
SizeofResource
LoadResource
FindResourceA
user32
CharNextA
Name
.text
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
490B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
45B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
204KB
Virtual Size
201KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=14, version=7299,
count=17, id=1, productName=Unmarked objects,
count=5, id=19, version=8034,
count=1, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
SendLink.exe
- IMPHASH 6af06596619b89a4d66b28eed2995c84
- SHA256 2967c03995f30626ba1217437c962ebd96d038acb078ce98a0a0fdc6ecd97f79
- MD5 8764358d0a43bb3a3316bef556e13470
- SHA1 3de905521f15937eaa3726fb63d22509b1c7c5a4
- SHA512 b9d509ea1d786bf41d743d62fb1135ed091369d07f51ed9cac5016a9227fc6d5d41af9141faa830636deb1cf56c8d03068416b0cdbc5336ff120c13fd4c957cf
- SSDEEP 3072:iPsNDP86GKHz/BKhRfORZNRwOLZZt/Xav9vShnoE+qpaZccA/HZ:iP0GKHz2tqzmOLNXsShIAZ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
123377
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\Documents and Settings\KG\My Documents\Development\Projects\SendLink\Release\SendLink.pdb
ws2_32
send
recv
accept
listen
getpeername
bind
closesocket
socket
WSAStartup
gethostname
gethostbyname
WSAGetLastError
ntohs
htons
getsockopt
kernel32
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
CompareFileTime
GetLocalTime
GetSystemTime
GetLastError
DeleteFileA
CreateDirectoryA
GetFileAttributesA
FindFirstFileA
FindClose
FindNextFileA
GetCommandLineA
CreateThread
GetCurrentThread
GetCurrentThreadId
CloseHandle
GlobalAlloc
GlobalReAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
RtlUnwind
RaiseException
GetModuleHandleA
GetStartupInfoA
GetVersionExA
HeapFree
HeapAlloc
HeapReAlloc
HeapSize
GetFileType
CreateFileA
SetFilePointer
ReadFile
WriteFile
ExitProcess
GetProcAddress
TerminateProcess
GetCurrentProcess
TlsFree
SetLastError
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
HeapDestroy
HeapCreate
VirtualFree
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
SetEndOfFile
SetStdHandle
IsBadReadPtr
IsBadCodePtr
GetACP
GetOEMCP
GetCPInfo
LoadLibraryA
GetLocaleInfoA
VirtualProtect
GetSystemInfo
VirtualQuery
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
FlushFileBuffers
user32
SetWindowPos
RemovePropA
SetPropA
GetWindowTextA
SetWindowTextA
GetWindowTextLengthA
TrackPopupMenu
GetWindowRect
GetClientRect
ScreenToClient
GetActiveWindow
ShowWindow
AnimateWindow
IsIconic
IsZoomed
IsWindowVisible
ShowOwnedPopups
SetFocus
SetForegroundWindow
SetCapture
TrackMouseEvent
SetTimer
KillTimer
MessageBoxA
GetMessagePos
GetCursorPos
ReleaseCapture
IsDialogMessageA
IsChild
CreateDialogParamA
DialogBoxParamA
EndDialog
GetDlgItem
DestroyWindow
GetSystemMetrics
SetCursor
RegisterClipboardFormatA
DispatchMessageA
TranslateMessage
GetMessageA
GetSysColor
LoadMenuA
DestroyMenu
GetMenuItemCount
GetMenuItemInfoA
GetSubMenu
EnableMenuItem
CheckMenuItem
ReleaseDC
FillRect
DrawTextA
GetDC
BeginPaint
EndPaint
GetAsyncKeyState
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
CreateWindowExA
GetAncestor
GetDesktopWindow
SetWindowLongA
GetPropA
UnregisterClassA
CallWindowProcA
LoadCursorA
LoadIconA
RegisterClassExA
GetClassInfoExA
PostQuitMessage
PostMessageA
SendMessageA
GetWindowLongA
DestroyCursor
DefDlgProcA
DefWindowProcA
LoadStringA
DestroyIcon
shell32
Shell_NotifyIconA
DragFinish
ShellExecuteA
DragQueryFileA
comctl32
ImageList_ReplaceIcon
ImageList_Destroy
ImageList_Create
winmm
PlaySoundA
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
wininet
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenA
shfolder
SHGetFolderPathA
gdi32
DeleteDC
SetTextColor
DeleteObject
SetBkMode
ole32
CoRevokeClassObject
CoGetClassObject
CoCreateInstance
ReleaseStgMedium
DoDragDrop
RevokeDragDrop
OleGetClipboard
OleSetClipboard
OleUninitialize
OleInitialize
CoRegisterClassObject
oleaut32
VariantClear
VariantInit
Name
.text
Size
169KB
Virtual Size
169KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=39, version=9162,
count=11, id=29, productName=VS2002 (.NET) build 9466, version=9466,
count=28, id=64, productName=VS2002 (.NET) build 9466, version=9466,
count=125, id=28, productName=VS2002 (.NET) build 9466, version=9466,
count=2, id=37, version=8755,
count=6, id=28, version=9178,
count=333, id=1, productName=Unmarked objects,
count=23, id=25, version=9210,
count=59, id=58, version=9466,
count=1, id=69, productName=VS2002 (.NET) build 9466, version=9466,
count=1, id=61, productName=VS2002 (.NET) build 9466, version=9466,
SendLink.url
- SHA256 3110fcc032405e705e8710e263d43f38c2ffbef6054bf58ef38a90741fc838fd
- MD5 f50bb685c735a5fbb2796086f49edc2d
- SHA1 efca8e52c428bcc045e34422f8d1558d24d13ba8
- SHA512 fc4867586e6843710aacdbb6dd922f297570c474e811f74581e6fd3303e1b7e5e0ef4ba4c8248704f2dc08adef9ff4b2343d578494ec21464101f579c3ae5fef
- MD5 SHA1 SHA512
SendLog.html
- SHA256 d9ad94d068c4fcd94d145b58c7a22138d1aaae589071244de123d411e385ec29
- MD5 1234530e71e7c443ee3a9ec8b3e57975
- SHA1 7a8c1714bf7a76a5f08591fb9e103929491ab259
- SHA512 2c15328f0a13649bd9e214867bf767b246d8b6fcc2dc4e519d34e92308d48c07679c1b6ca778347bdcbe76f6097b3a88a5e07db71ef2caebc21125f47afba9c3
- MD5 SHA1 SHA512
SlideShow.html
- SHA256 5d7bb37fe6f93305e973b796ff07a5c32ae2388b86efd4466c49fad71468084b
- MD5 4a1e93b5c2c5edce62fbee0cae44a37d
- SHA1 aa1032b212501287c62bcbad0a4e0290a639e182
- SHA512 52e9cc1628666ba88983292218f1cdf22fa7224cdc8549bdfd05be4fb9649c6ee0bd437d6068c50fe8d80820a756def26b2143f19411d3319fc76e25d8a736ca
- SSDEEP 96:VvRI7pbCQ/QfwHTRp4IagpGocgrTnc48BP:VpEtcw4ITJzn56
- MD5 SHA1 SHA512 SSDEEP
Support.url
- SHA256 42ae69f14dfe217f82c20c40cce355c51ff77a06948bb303e9cbcdcb08cc17d6
- MD5 0e409c21b9005c0c38bc481c77728300
- SHA1 827ef47484383191a9236f2e754d854135b11107
- SHA512 443904890abb402d28b7b96e59076c222cfa63c9f2c5e44eeb1f8ea2add20d19a3c3aad9c554260b67ee7e2d8db4d822cb02f7e6dbde05542ed82b229bd06834
- MD5 SHA1 SHA512
uninst.exe
- IMPHASH 1bed3305885b0ca596d9cbba22baf78a
- SHA256 055140ecaa73d6bc79ef49173f6fbcfef3fe35619e9cce538eddca9b3b9023c4
- MD5 53731b89e1c5fd02c209ed4129db684e
- SHA1 78a34ff0f17a6fde269b31d86db99036e01cefca
- SHA512 f9dbabe261e526351025bfbb9e81cf76e83da041d9523d28e54cf4b1808559b6920e69865189822319c5a86ee0a8ffda227c1483e76d1601184938b0d501c6c2
- SSDEEP 1536:1PgXwpm4RmzZwCnUF2ICqdkJI6P+ZCsBTjt2bm:1PgXLdqF2fqdkJI1CiTjt2bm
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
-
NSIS installer
Minor OS version
0
Major OS version
4
Entry point
14178
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
lstrcatA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CopyFileA
ExitProcess
lstrcpynA
SetFileTime
GetWindowsDirectoryA
GetTempPathA
GetUserDefaultLangID
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
GlobalAlloc
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
lstrcpyA
lstrlenA
GetSystemDirectoryA
CloseHandle
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
MulDiv
WriteFile
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetCommandLineA
user32
SystemParametersInfoA
RegisterClassA
EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
LoadCursorA
SetCursor
CheckDlgButton
GetAsyncKeyState
IsDlgButtonChecked
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
CreateWindowExA
EmptyClipboard
OpenClipboard
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
wvsprintfA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
GetDlgItem
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
CreateDialogParamA
SetClipboardData
DestroyWindow
SetWindowLongA
LoadImageA
GetDC
EnableWindow
PeekMessageA
DispatchMessageA
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
IsWindow
gdi32
SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject
shell32
SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation
advapi32
RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA
comctl32
ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create
ole32
OleInitialize
OleUninitialize
CoCreateInstance
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Name
.text
Size
24KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
262KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ndata
Size
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, version=2190,
count=159, id=1, productName=Unmarked objects,
count=17, id=93, version=2179,
count=9, id=10, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
$PLUGINSDIR/LangDLL.dll
- IMPHASH 8fc31e88f4e2f35a7d6873d897a2680d
- SHA256 ede19cf9613ccbf2f4c731f6eb1460efe56484e97c8a0745a2a5460571e64f11
- MD5 dbab668ce84d6b38824ed1c9b9121adb
- SHA1 de8c80d7b0d01fafb750b2bded1f055d102aa3d0
- SHA512 5857680db3b642f14742ad55a3349cbe059c18c5dc58ae0def53886df5eb2c9abf5e444db1bc8449db779c33e940f8f2c4a7520ad8f374b9f2f01e57d6a2c953
- SSDEEP 48:SHbz1tBa/XC1TQO50vwovgxVLrh2TpXHW+iJ/L9Cp+0rf1uapskdfhhdJcN:m9UXC13C/ovLrh2cD/L9NolhjcN
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5244
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
GlobalFree
lstrcpynA
GetModuleHandleA
lstrlenA
lstrcmpA
MulDiv
lstrcpyA
GlobalAlloc
user32
LoadIconA
SetWindowTextA
SetDlgItemTextA
SendDlgItemMessageA
DialogBoxParamA
GetDC
ShowWindow
EndDialog
SendMessageA
gdi32
CreateFontIndirectA
GetDeviceCaps
DeleteObject
LangDialog
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
681B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
352B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
242B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=1, productName=Unmarked objects,
count=7, id=93, version=2179,
count=1, id=48, version=9044,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
$PLUGINSDIR/modern-header.bmp
- SHA256 130a8ab35faf3e804a04e9a56a790ee388352b084f9079cf07b601b76b6caa64
- MD5 789d398691ff11f021a5f35e6d6f2856
- SHA1 6fc01136c7498cdd356bf1dcdd494b903a627168
- SHA512 4297b52f7663221121041b305d957517bf906d6c334bc35e19a7424d16e6e7d3c94b1c0ddccd03464be4356e6b2fb8c1e403907eb99cac7d7909d09975a5091a
- SSDEEP 768:nFjQ1XR8CAAP93VuG/a0Yw6uIr2TnRkvE:nW8C9P1VJ/8wnnRk8
- MD5 SHA1 SHA512 SSDEEP
˵.txt
- SHA256 b485fb3b6cf192ece6630bedeed853e85534feb7f043c72216b038db1dd76fea
- MD5 1b4d684179e396c6af2c50e239c0528d
- SHA1 3d7213027ec292b193bf14a74f1e6354ae64d600
- SHA512 297945527f94ccb4e4ada044e211a975ad32d9f21e572848cc3a9f958ba1e373260c1651add789a3c5b6b3d1863b40c135d20c6254390d68a1ffce5e4a8f7a48
- MD5 SHA1 SHA512
˵.txt
- SHA256 b485fb3b6cf192ece6630bedeed853e85534feb7f043c72216b038db1dd76fea
- MD5 1b4d684179e396c6af2c50e239c0528d
- SHA1 3d7213027ec292b193bf14a74f1e6354ae64d600
- SHA512 297945527f94ccb4e4ada044e211a975ad32d9f21e572848cc3a9f958ba1e373260c1651add789a3c5b6b3d1863b40c135d20c6254390d68a1ffce5e4a8f7a48
- MD5 SHA1 SHA512
.txt
- SHA256 6060a0b70efa3e7fc44b379f8f354163747d433111b0ccc1f7a24583b7aef63b
- MD5 d34a4861abbcef62b9e66122eadb35d6
- SHA1 fe13355eea8bf4555353f6f0963ef768b212966b
- SHA512 02136d3ad6691fa9d09c171efa00783145510749f5033c793fe0fb9c1d51494587ce90edeb5591365f951af17f3e357c794f3f6118e2d97f669e33e00e24421a
- MD5 SHA1 SHA512