SlottedAimV2.rar
- SHA256 1cdd2cd88644b2d634ac27b95031bddcbb69479bf6bdd090a2257e40132a69c2
Behavioral task
behavioral1
Sample
Driver.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SlottedAimV2.exe
Resource
win11-20240412-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
mciavi32.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
spwizimg.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target SlottedAimV2.rar
- Size 7.1MB
- Sample240420-sdggwabb26
- SHA256 1cdd2cd88644b2d634ac27b95031bddcbb69479bf6bdd090a2257e40132a69c2
- MD5 04b4440a4dd4c687a388d993c0be18b7
- SHA1 3f363a3d4c04bde4609168336033bbdcd5555bd5
- SHA512 7f72cef7397380ba583c4034de5f10e42e1d40c268b82f63e3d17e85e2a8c1b498665be6f9235031ed3dc3f8efb2114982ef513bee79b49c743a61f98a384cc8
- SSDEEP 98304:LtIGDf639tvIF2/rvPzRrHY5rjoMQeYqolZIed277vRtf323r85zQ65gBB9UBr+U:LJII2rvbZHYibeYqolZIl7vRpn1RoU6S
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/�� ���.pyc blankgrabber - Blankgrabber family
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Driver.dll unpack001/mciavi32.dll
File Explorer
-
SlottedAimV2.rar.rar 7.1MB
-
Driver.dll.dll 242KB
-
How to use.txt156B
-
SlottedAimV2.exe.exe 7.0MB
-
�� ���.pyc1KB
-
mciavi32.dll.dll 101KB
-
spwizimg.dll.dll 5.6MB
Driver.dll
- IMPHASH e7be09a11268187c0db544b566d887c1
- SHA256 3cc04edaa12d7feed849f1b88e10d49b948b1ef2a62e197ac35d41e5b35dbfcc
- MD5 9a41f2a54a2fa0b81b2511e32e914f2c
- SHA1 3276c4d7be73019a6a7fe8e218a98228ac930ce4
- SHA512 8fd80dc238b3d8d75797720dc6117ff41b7064804ee243bc3e5d5c847c20856a22b30d9ed579aa1b565fc57c65bd138d913069a26cb71a93b0134b77df36dc27
- SSDEEP 3072:2QaHp8CKxa1Kd0B7itS5jWqJgvFmtPb9WxBvk4rFTbRL2LP/jWoF3tK8cDL6v51y:2QFPxm5BetSEqJgtibSs4HvD4YQ
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
181168
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
tapi32.pdb
msvcrt
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_initterm
_amsg_exit
_XcptFilter
free
_callnewh
wcscspn
_wtol
iswdigit
malloc
wcschr
_vsnprintf
_wtoi
_vsnwprintf
__CxxFrameHandler3
memcpy
iswctype
wcsrchr
_wcsicmp
__C_specific_handler
memset
gdi32
CreateFontIndirectW
GetCurrentObject
SelectObject
DeleteObject
GetObjectW
user32
GetActiveWindow
GetDlgItemInt
SetDlgItemInt
GetKeyState
CallWindowProcW
GetWindowRect
SetWindowPos
EnumChildWindows
CreateWindowExW
OpenClipboard
SetTimer
CloseClipboard
GetClipboardData
SetClipboardData
KillTimer
MessageBoxW
ShowWindow
IsWindowEnabled
EnumWindows
SetWindowLongW
SetForegroundWindow
MessageBeep
GetParent
GetFocus
CheckRadioButton
SetWindowLongPtrW
SetWindowTextW
GetWindowLongPtrW
SetFocus
GetClientRect
DialogBoxParamW
GetWindowTextW
SendMessageW
EndDialog
SendDlgItemMessageW
GetDlgItem
EnableWindow
DefWindowProcW
PostMessageW
DestroyWindow
GetSystemMetrics
GetThreadDesktop
LoadStringW
IsWindow
RegisterClassW
GetUserObjectInformationW
kernel32
RegEnumValueW
GetSystemInfo
HeapAlloc
InitializeCriticalSectionAndSpinCount
HeapFree
LoadLibraryExW
DeactivateActCtx
RegDeleteValueW
ReleaseActCtx
CreateActCtxW
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
DeleteFileW
GetWindowsDirectoryW
ResolveDelayLoadedAPI
DelayLoadFailureHook
ActivateActCtx
lstrlenW
RtlCaptureContext
lstrcmpW
GlobalSize
GetProfileIntW
MulDiv
FormatMessageW
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
GetCurrentThread
GetSystemDirectoryW
FindClose
FindNextFileW
SetLastError
FindFirstFileW
GlobalHandle
GetLocalTime
OutputDebugStringA
GetTickCount
lstrcmpiW
TlsFree
TlsGetValue
WideCharToMultiByte
FreeLibrary
GetModuleHandleW
GetProcessHeap
GetCurrentProcessId
GetComputerNameW
DeleteCriticalSection
LocalFree
GetProcAddress
ResetEvent
CreateThread
LoadLibraryW
CloseHandle
TlsAlloc
SetEvent
GetLastError
Sleep
MultiByteToWideChar
CreateEventW
GetACP
DuplicateHandle
ReleaseMutex
GetVersionExW
GetCurrentThreadId
FreeLibraryAndExitThread
LocalAlloc
WaitForSingleObject
lstrlenA
CreateMutexW
TlsSetValue
EnterCriticalSection
GetCurrentProcess
InitializeCriticalSection
GetModuleFileNameW
LeaveCriticalSection
GetTapi16CallbackMsg
LAddrParamsInited
LOpenDialAsst
LocWizardDlgProc
MMCAddProvider
MMCConfigProvider
MMCGetAvailableProviders
MMCGetDeviceFlags
MMCGetLineInfo
MMCGetLineStatus
MMCGetPhoneInfo
MMCGetPhoneStatus
MMCGetProviderList
MMCGetServerConfig
MMCInitialize
MMCRemoveProvider
MMCSetLineInfo
MMCSetPhoneInfo
MMCSetServerConfig
MMCShutdown
NonAsyncEventThread
TAPIWndProc
TUISPIDLLCallback
internalConfig
internalCreateDefLocation
internalNewLocationW
internalPerformance
internalRemoveLocation
internalRenameLocationW
lineAccept
lineAddProvider
lineAddProviderA
lineAddProviderW
lineAddToConference
lineAgentSpecific
lineAnswer
lineBlindTransfer
lineBlindTransferA
lineBlindTransferW
lineClose
lineCompleteCall
lineCompleteTransfer
lineConfigDialog
lineConfigDialogA
lineConfigDialogEdit
lineConfigDialogEditA
lineConfigDialogEditW
lineConfigDialogW
lineConfigProvider
lineCreateAgentA
lineCreateAgentSessionA
lineCreateAgentSessionW
lineCreateAgentW
lineDeallocateCall
lineDevSpecific
lineDevSpecificFeature
lineDial
lineDialA
lineDialW
lineDrop
lineForward
lineForwardA
lineForwardW
lineGatherDigits
lineGatherDigitsA
lineGatherDigitsW
lineGenerateDigits
lineGenerateDigitsA
lineGenerateDigitsW
lineGenerateTone
lineGetAddressCaps
lineGetAddressCapsA
lineGetAddressCapsW
lineGetAddressID
lineGetAddressIDA
lineGetAddressIDW
lineGetAddressStatus
lineGetAddressStatusA
lineGetAddressStatusW
lineGetAgentActivityListA
lineGetAgentActivityListW
lineGetAgentCapsA
lineGetAgentCapsW
lineGetAgentGroupListA
lineGetAgentGroupListW
lineGetAgentInfo
lineGetAgentSessionInfo
lineGetAgentSessionList
lineGetAgentStatusA
lineGetAgentStatusW
lineGetAppPriority
lineGetAppPriorityA
lineGetAppPriorityW
lineGetCallInfo
lineGetCallInfoA
lineGetCallInfoW
lineGetCallStatus
lineGetConfRelatedCalls
lineGetCountry
lineGetCountryA
lineGetCountryW
lineGetDevCaps
lineGetDevCapsA
lineGetDevCapsW
lineGetDevConfig
lineGetDevConfigA
lineGetDevConfigW
lineGetGroupListA
lineGetGroupListW
lineGetID
lineGetIDA
lineGetIDW
lineGetIcon
lineGetIconA
lineGetIconW
lineGetLineDevStatus
lineGetLineDevStatusA
lineGetLineDevStatusW
lineGetMessage
lineGetNewCalls
lineGetNumRings
lineGetProviderList
lineGetProviderListA
lineGetProviderListW
lineGetProxyStatus
lineGetQueueInfo
lineGetQueueListA
lineGetQueueListW
lineGetRequest
lineGetRequestA
lineGetRequestW
lineGetStatusMessages
lineGetTranslateCaps
lineGetTranslateCapsA
lineGetTranslateCapsW
lineHandoff
lineHandoffA
lineHandoffW
lineHold
lineInitialize
lineInitializeExA
lineInitializeExW
lineMakeCall
lineMakeCallA
lineMakeCallW
lineMonitorDigits
lineMonitorMedia
lineMonitorTones
lineNegotiateAPIVersion
lineNegotiateExtVersion
lineOpen
lineOpenA
lineOpenW
linePark
lineParkA
lineParkW
linePickup
linePickupA
linePickupW
linePrepareAddToConference
linePrepareAddToConferenceA
linePrepareAddToConferenceW
lineProxyMessage
lineProxyResponse
lineRedirect
lineRedirectA
lineRedirectW
lineRegisterRequestRecipient
lineReleaseUserUserInfo
lineRemoveFromConference
lineRemoveProvider
lineSecureCall
lineSendUserUserInfo
lineSetAgentActivity
lineSetAgentGroup
lineSetAgentMeasurementPeriod
lineSetAgentSessionState
lineSetAgentState
lineSetAgentStateEx
lineSetAppPriority
lineSetAppPriorityA
lineSetAppPriorityW
lineSetAppSpecific
lineSetCallData
lineSetCallParams
lineSetCallPrivilege
lineSetCallQualityOfService
lineSetCallTreatment
lineSetCurrentLocation
lineSetDevConfig
lineSetDevConfigA
lineSetDevConfigW
lineSetLineDevStatus
lineSetMediaControl
lineSetMediaMode
lineSetNumRings
lineSetQueueMeasurementPeriod
lineSetStatusMessages
lineSetTerminal
lineSetTollList
lineSetTollListA
lineSetTollListW
lineSetupConference
lineSetupConferenceA
lineSetupConferenceW
lineSetupTransfer
lineSetupTransferA
lineSetupTransferW
lineShutdown
lineSwapHold
lineTranslateAddress
lineTranslateAddressA
lineTranslateAddressW
lineTranslateDialog
lineTranslateDialogA
lineTranslateDialogW
lineUncompleteCall
lineUnhold
lineUnpark
lineUnparkA
lineUnparkW
phoneClose
phoneConfigDialog
phoneConfigDialogA
phoneConfigDialogW
phoneDevSpecific
phoneGetButtonInfo
phoneGetButtonInfoA
phoneGetButtonInfoW
phoneGetData
phoneGetDevCaps
phoneGetDevCapsA
phoneGetDevCapsW
phoneGetDisplay
phoneGetGain
phoneGetHookSwitch
phoneGetID
phoneGetIDA
phoneGetIDW
phoneGetIcon
phoneGetIconA
phoneGetIconW
phoneGetLamp
phoneGetMessage
phoneGetRing
phoneGetStatus
phoneGetStatusA
phoneGetStatusMessages
phoneGetStatusW
phoneGetVolume
phoneInitialize
phoneInitializeExA
phoneInitializeExW
phoneNegotiateAPIVersion
phoneNegotiateExtVersion
phoneOpen
phoneSetButtonInfo
phoneSetButtonInfoA
phoneSetButtonInfoW
phoneSetData
phoneSetDisplay
phoneSetGain
phoneSetHookSwitch
phoneSetLamp
phoneSetRing
phoneSetStatusMessages
phoneSetVolume
phoneShutdown
tapiGetLocationInfo
tapiGetLocationInfoA
tapiGetLocationInfoW
tapiRequestDrop
tapiRequestMakeCall
tapiRequestMakeCallA
tapiRequestMakeCallW
tapiRequestMediaCall
tapiRequestMediaCallA
tapiRequestMediaCallW
Name
.text
Size
179KB
Virtual Size
179KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
49KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
584B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
312B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=27412,
count=13, id=260, version=27412,
count=234, id=1, productName=Unmarked objects,
count=9, id=257, version=27412,
count=4, id=261, version=27412,
count=1, id=256, version=27412,
count=30, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
How to use.txt
- SHA256 286df79ca013e503cca00015ecbab1281f6f9da1d48e3a370d86b234b0dcbdbb
- MD5 aa9d85b0c13f0e820e746382583ff63f
- SHA1 fe75cb93dd1136c93b87f2fe00cadecfaf6856a3
- SHA512 ca4713ad0bcc22ce07166263c43df7340a643ba1dc5c0e4c6c744d5b6727bc5175d9a37d1acd24d5c2216d4e798fa2a4fe2f7ddc22ca2fdf6836c260237f096b
- MD5 SHA1 SHA512
SlottedAimV2.exe
- IMPHASH f4f2e2b03fe5666a721620fcea3aea9b
- SHA256 ebbdf48aafe6c046eca7512a4e764629559392147518fdf2917751a891bfcd5d
- MD5 decace854bd66eba96581505cbb1f785
- SHA1 dfd6824e2db3a2ebb89208f0e5f69e6cc1661da6
- SHA512 e55f8afc9a36913aaa24932a94b82100a53accd4f5d8865fc207c9b50c607efa259115d53d5926e0b45c99c0b9dece02996a6b8db5d365af122ccbcdd69823c8
- SSDEEP 196608:WrSUf0qyleOjmFQR4MVGFtwLPCnL2hVcL:PVXKtM5LPCGcL
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
ae:d1:22:9e:21:3f:95:02:6e:a9:d1:6c:5d:c0:3d:fe:86:76:4a:8d:d2:93:02:98:a0:43:dd:f1:70:7a:ba:54
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
2
Major OS version
5
Entry point
50496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetCPInfo
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetProcAddress
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=11, id=257, version=30795,
count=142, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
�� ���.pyc
- SHA256 53acc8d60175185518f758d4cdae146875bb59bea863427983048245522ef2ef
- MD5 e0bc88e433a6807c20d960d761749c29
- SHA1 8ead5d0ccec209398eeadff035af0bfb3798c803
- SHA512 f663f6aaa7abf4454770c3db5581186612eecd701637db30ab15048fe06ffeb05b08007820099220f823d4734a91fa46e87b8736b025c332c2677a85199cf905
- MD5 SHA1 SHA512
-
A stealer written in Python and packaged with Pyinstaller
mciavi32.dll
- IMPHASH 64ac7fcfa1bf5a3af1997b9aef6cbfc9
- SHA256 30317e32d7f5e36ad2674353a198f5b2760ff121c40cc0cf11be0cf9729fadb5
- MD5 e9944f49dfaa4d580ddfbd676d61d397
- SHA1 6f9e0bfec72657355ee400c71668779ee41b5ba6
- SHA512 fd494ad6aa5520e3e115cc5104882aa9922ecb181e61a03969aad73273ffa6cd8c0269994e0eec8676b41d2a7832db722d51b5e0bce9c7a7ed8d11b5330a289b
- SSDEEP 1536:4bfvWWJHxioRuscmoKKHeH8vQINmgZUg4nP8lNM3t3qs7SO2xjlyGp8w:4rWmsscmoKgDQInYXt3qsHSJyS8w
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
75344
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mciavi32.pdb
ntdll
__C_specific_handler
memmove
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
_vsnwprintf
memcpy
memset
msvfw32
DrawDibDraw
DrawDibChangePalette
DrawDibBegin
DrawDibClose
DrawDibRealize
DrawDibGetPalette
DrawDibOpen
DrawDibEnd
DrawDibSetPalette
DrawDibStop
DrawDibStart
ord2
ICDecompress
ICGetDisplayFormat
ICOpenFunction
ICDraw
ICDrawBegin
ICOpen
ICSendMessage
ICLocate
ICClose
api-ms-win-core-heap-obsolete-l1-1-0
GlobalReAlloc
GlobalUnlock
GlobalLock
GlobalHandle
api-ms-win-mm-time-l1-1-0
timeGetTime
timeEndPeriod
timeGetDevCaps
timeBeginPeriod
api-ms-win-core-synch-l1-1-0
InitializeCriticalSection
SetEvent
CreateEventW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ResetEvent
WaitForSingleObject
api-ms-win-core-string-obsolete-l1-1-0
lstrcmpiW
lstrlenW
api-ms-win-core-heap-l2-1-0
GlobalAlloc
LocalAlloc
GlobalFree
LocalFree
api-ms-win-core-libraryloader-l1-2-0
FreeLibrary
DisableThreadLibraryCalls
GetModuleHandleW
LoadStringW
GetModuleFileNameW
GetProcAddress
api-ms-win-core-largeinteger-l1-1-0
MulDiv
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
api-ms-win-core-processthreads-l1-1-0
CreateThread
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
api-ms-win-core-synch-l1-2-1
WaitForMultipleObjects
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
SetUnhandledExceptionFilter
SetErrorMode
UnhandledExceptionFilter
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-localization-l1-2-0
GetUserDefaultLangID
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
api-ms-win-core-file-l1-1-0
GetDriveTypeW
api-ms-win-core-registry-l2-1-0
RegCreateKeyW
RegOpenKeyW
api-ms-win-core-wow64-l1-1-0
IsWow64Process
api-ms-win-core-string-l2-1-0
CharPrevW
api-ms-win-core-atoms-l1-1-0
GlobalAddAtomW
GlobalDeleteAtom
GlobalFindAtomW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetSystemInfo
GetTickCount
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
gdi32
ExcludeClipRect
SetStretchBltMode
GetDCOrgEx
GetObjectType
GdiFlush
GetClipBox
IntersectClipRect
SaveDC
RealizePalette
CreateHatchBrush
GetStockObject
SetBkMode
SelectPalette
RestoreDC
DeleteObject
user32
FrameRect
IntersectRect
DrawTextW
InvalidateRect
FillRect
IsRectEmpty
PeekMessageW
GetAsyncKeyState
MsgWaitForMultipleObjects
GetDC
IsWindow
PostMessageW
GetClientRect
SetRectEmpty
SetCursor
LoadCursorW
GetForegroundWindow
WindowFromDC
IsChild
OffsetRect
GetActiveWindow
SendMessageW
SetActiveWindow
EqualRect
SetWindowPos
IsWindowVisible
GetWindowLongW
SetRect
GetFocus
CallNextHookEx
GetClassInfoW
UnhookWindowsHookEx
SetFocus
GetUpdateRect
SetCapture
SetWindowsHookExW
ReleaseCapture
ShowCursor
GetMessageW
DefWindowProcW
GetSystemMenu
DestroyWindow
CreateWindowExW
DeleteMenu
UnregisterClassW
GetWindowPlacement
DispatchMessageW
ClientToScreen
RegisterClassW
SetWindowPlacement
TranslateMessage
CheckMenuItem
AppendMenuW
PostQuitMessage
EnableMenuItem
SetForegroundWindow
BeginPaint
EndPaint
GetWindowRect
MessageBoxW
SetWindowLongPtrW
GetSystemMetrics
SetWindowTextW
SetClassLongPtrW
GetWindowLongPtrW
GetClassLongPtrW
ShowWindow
MoveWindow
AdjustWindowRect
IsZoomed
UpdateWindow
IsIconic
GetWindowTextW
UnionRect
ReleaseDC
winmm
waveOutPause
mmioRead
waveOutReset
waveOutRestart
mmioSeek
mmioAscend
mmioDescend
DriverCallback
waveOutPrepareHeader
waveOutOpen
mmioOpenW
waveOutClose
waveOutUnprepareHeader
waveOutGetPosition
sndPlaySoundW
waveOutGetVolume
waveOutMessage
mmioClose
mciDriverYield
DefDriverProc
GetDriverModuleHandle
mciLoadCommandResource
mciSetDriverData
mciFreeCommandResource
mciGetDriverData
mciDriverNotify
waveOutWrite
DriverProc
KeyboardHookProc
Name
.text
Size
71KB
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
12KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=46, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=257, version=27412,
count=214, id=1, productName=Unmarked objects,
count=8, id=260, version=27412,
count=2, id=259, version=27412,
count=1, id=256, version=27412,
count=16, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
spwizimg.dll
- SHA256 b206630e0c06b9bea1809d80b9f2601ee417857e7c8a22c1854e30c08ea744e1
- MD5 6259c2ebf8f1b15c4b075e413bf32598
- SHA1 80ef443ed0dc3c93476b7a0edfa0fd76f2baa50a
- SHA512 ecab9c71e95dcf2463490f34a2a66f5e9353b4be9af888f30b4e93520b4fa5a6a8fac5e69f84efeb88e195758d951cba8e36c9957eef261f4f9fb063bb04e395
- SSDEEP 3072:OtsxIS9L+rz5iG7aB+H+Yge19NT6lBc/0yY+wcE9rCbpxTNX5vNRZWyXzyKblUuB:O6xISpQiG7aBMjNxTNX5vZ
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
15:3c:b0:c6:3b:b7:bd:4a:74:25:df:b7:ef:37:b9:8e:57:d0:db:7c:40:9c:53:db:0c:b1:27:5e:96:8e:41:a4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:32:41:fb:59:99:6d:cc:4d:ff:00:00:00:00:02:32
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 2, 2019 - May 2, 2020
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
Name
.rdata
Size
512B
Virtual Size
176B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5.6MB
Virtual Size
5.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=255, version=27412,
count=1, id=258, version=27412,