ValoaimV8.rar
- SHA256 193d9acadf1f7cb18bd295f774c644f34da72dbc10c2eccd39c858f55f320a2f
Overview
overview
10Static
static
10ValoaimV8.exe
windows11-21h2-x64
10ValoaimV8.exe
ubuntu-18.04-amd64
ValoaimV8.exe
debian-9-armhf
ValoaimV8.exe
debian-9-mips
ValoaimV8.exe
debian-9-mipsel
XInput1_4.dll
windows11-21h2-x64
1mfcm140u.dll
windows11-21h2-x64
1mfcm140u.dll
ubuntu-18.04-amd64
mfcm140u.dll
debian-9-armhf
mfcm140u.dll
debian-9-mips
mfcm140u.dll
debian-9-mipsel
rasadhlp.dll
windows11-21h2-x64
1umpdc.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
ValoaimV8.exe
Resource
win11-20240412-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
ValoaimV8.exe
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ValoaimV8.exe
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
ValoaimV8.exe
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
ValoaimV8.exe
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
XInput1_4.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
mfcm140u.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
mfcm140u.dll
Resource
ubuntu1804-amd64-20240226-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
mfcm140u.dll
Resource
debian9-armhf-20240226-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
mfcm140u.dll
Resource
debian9-mipsbe-20240226-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
mfcm140u.dll
Resource
debian9-mipsel-20240226-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
rasadhlp.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
umpdc.dll
Resource
win11-20240412-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target ValoaimV8.rar
- Size 7.0MB
- Sample240420-se6s6abb57
- SHA256 193d9acadf1f7cb18bd295f774c644f34da72dbc10c2eccd39c858f55f320a2f
- MD5 8cad4d2de4a7be6bdb70a9554140f1a1
- SHA1 6e9ba7b352ff16515f39acb5479636ba84b67428
- SHA512 c90d28bff2011d6748619134747e9806eedf2a321059a0ee12f8b1ffe0305970879ffef8a64c5212048cc35266a2e541fcc0f18458701c4fc03ef0151b80ec05
- SSDEEP 196608:GCdDUMZIOaN3e8iYIRlOdwxPAsfZs77AE0d8EEF7Sx:nGiIO6FiJNRctypz
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- A stealer written in Python and packaged with Pyinstaller 1 IoCs
resource yara_rule static1/unpack002/L���Q:�.pyc blankgrabber - Blankgrabber family
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/ValoaimV8.exe unpack001/XInput1_4.dll unpack001/rasadhlp.dll
File Explorer
-
ValoaimV8.rar.rar 7.0MB
-
How to use.txt140B
-
ValoaimV8.exe.exe 20.0MB
-
L���Q:�.pyc1KB
-
XInput1_4.dll.dll 44KB
-
mfcm140u.dll.dll 94KB
-
rasadhlp.dll.dll 17KB
-
umpdc.dll.dll 64KB
How to use.txt
- SHA256 bf4de119ca94d5378aa8b3b2c12fb9df3f804dcf3a5e9abd99499d555cce2384
- MD5 62ea7e8f472ba9c9c8b5d3a791571a7c
- SHA1 149c9af5f10af81dfc5cfb255dc320c11de76593
- SHA512 554bb67c15638ff7117d0cb398136cf466ae483936b33a5d311b71d9c986a8123e4f336391a8036b4648467809dc9b69243b201c027a791485cd57ad2d1427ec
- MD5 SHA1 SHA512
ValoaimV8.exe
- IMPHASH f4f2e2b03fe5666a721620fcea3aea9b
- SHA256 443be4b5119ad344755137062321a4f5c249e8fb95482183c21378ba93fd96bf
- MD5 4ed9006d9970ee5f1ee6486cfc663ee6
- SHA1 258fbba6e43c23ad9680576cc51a7c0906387354
- SHA512 952750f7e1a1182ed69ef837b0ea053a66ef1f65d8a534a2a445a660677fc19f2eca6aa66e25e6bafedd94bbf9ccd99e3feea63b0bbd8a36d8683f67c2c63daa
- SSDEEP 98304:zrcxzdbM+Q2y+aq0mGRk2jOjFgFQlwq4Mjk+dBZtu9xTtwz/aer6/BbQEJ1nL2hS:zrcbf0mPEOjmFQR4MVGFtwLPCnL2hVcr
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
50496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
user32
CreateWindowExW
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW
comctl32
ord380
kernel32
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
GetCurrentDirectoryW
GetACP
GetOEMCP
GetModuleHandleW
MulDiv
GetLastError
SetDllDirectoryW
CreateFileW
GetFinalPathNameByHandleW
CloseHandle
GetModuleFileNameW
CreateSymbolicLinkW
GetCPInfo
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetTempPathW
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LoadLibraryExW
SetConsoleCtrlHandler
FindClose
FindFirstFileExW
GetCurrentProcess
LocalFree
FormatMessageW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
WriteConsoleW
SetEndOfFile
GetProcAddress
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetFullPathNameW
RemoveDirectoryW
FindNextFileW
SetStdHandle
DeleteFileW
ReadFile
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
advapi32
OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
gdi32
SelectObject
DeleteObject
CreateFontIndirectW
Name
.text
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
76KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=8, id=259, version=30795,
count=188, id=261, version=30795,
count=10, id=260, version=30795,
count=1, productName=Unmarked objects (old),
count=4, id=253, version=33030,
count=40, id=261, version=33030,
count=17, id=260, version=33030,
count=17, id=259, version=33030,
count=11, id=257, version=30795,
count=142, id=1, productName=Unmarked objects,
count=21, id=260, version=33135,
count=1, id=258, version=33135,
L���Q:�.pyc
- SHA256 4ddbe90d1c70ca832341c08af1258316bc9e921de2706f869a690348ac5859ea
- MD5 b07209281397dc8785a76ea268df67ef
- SHA1 fae81b37d021513b8f8194e2709889d9b21e5c6c
- SHA512 ffa215795fda8beec28fa737d222463e294de0b6d6171668396674b61c30dc50114ea251a835e1cec251bb737f96038ec91220e5d82333b7cd9692c58c9f7ac7
- MD5 SHA1 SHA512
-
A stealer written in Python and packaged with Pyinstaller
XInput1_4.dll
- IMPHASH d05a85d591f6e82ba032f8ecb86de7bf
- SHA256 cc119f987bf33731fcd22c3a9bbcc675f31d80593a4c26428b363d6eedef974b
- MD5 3b38601c450d38f14bd9ee43eb1e64f5
- SHA1 00fe510eecd4f31fcefa4c962c1db2146e23bfb8
- SHA512 ec915169daefa85383ca2a0cf842231bd5d4ab3453f354280065ff4e1766deea56d07ab56a0b7bfa3d02ce939600fcda70af64f73f8e3fbf778b9d4ba187a644
- SSDEEP 768:PxImrwYzySuuBTaPTBL55vjCF9nkKw5WGKwxhkdX7bI:JbcYT+F5J0+B5WGKwMdX7bI
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
30992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
XInput1_4.pdb
msvcrt
_initterm
memcpy
malloc
free
_amsg_exit
_XcptFilter
_wcsnicmp
__C_specific_handler
_vsnwprintf
memset
api-ms-win-eventing-classicprovider-l1-1-0
GetTraceLoggerHandle
UnregisterTraceGuids
RegisterTraceGuidsW
TraceMessage
GetTraceEnableFlags
GetTraceEnableLevel
api-ms-win-core-handle-l1-1-0
DuplicateHandle
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo
GetTickCount
api-ms-win-core-quirks-l1-1-0
QuirkIsEnabled
api-ms-win-security-base-l1-1-0
GetTokenInformation
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetProcAddress
FreeLibrary
LoadLibraryExW
LoadLibraryExA
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
Sleep
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
ResetEvent
LeaveCriticalSection
SetEvent
CreateEventW
AcquireSRWLockExclusive
InitializeCriticalSection
WaitForSingleObject
ReleaseSRWLockExclusive
EnterCriticalSection
api-ms-win-core-processthreads-l1-1-0
CreateThread
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-io-l1-1-0
DeviceIoControl
GetOverlappedResult
api-ms-win-core-com-l1-1-0
CoCreateInstance
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapFree
HeapAlloc
api-ms-win-eventing-provider-l1-1-0
EventUnregister
EventWriteTransfer
EventRegister
EventSetInformation
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
api-ms-win-devices-query-l1-1-0
DevCloseObjectQuery
DevCreateObjectQuery
api-ms-win-rtcore-ntuser-private-l1-1-4
ord2597
devobj
DevObjGetDeviceProperty
DevObjCreateDeviceInfoList
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjEnumDeviceInterfaces
DevObjGetDeviceInterfaceDetail
DevObjDestroyDeviceInfoList
api-ms-win-downlevel-kernel32-l1-1-0
QueueUserWorkItem
api-ms-win-core-memory-l1-1-0
VirtualQuery
VirtualProtect
DllMain
XInputEnable
XInputGetAudioDeviceIds
XInputGetBatteryInformation
XInputGetCapabilities
XInputGetKeystroke
XInputGetState
XInputSetState
Name
.text
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=42, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=85, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=15, id=264, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
mfcm140u.dll
- IMPHASH 3504912454b3d7dc5a9dc9973a496284
- SHA256 71dd9c15438bc082c56d320cbcb34a7cef366884a95fcbb18b9f6b6dd2b0291f
- MD5 ab035545e809e5e7c8cd9cd44b89f64b
- SHA1 b869df48596cd753fea7dc5a2bec0ea80d70b390
- SHA512 ddeb7713d500a921fdbc969cac0988abde7d9ba5ebc16a349a473ee3beb8110eba23620b766dd8ed94d87e6dad15be40a5c9433bf88d48faec24b42399683412
- SSDEEP 1536:OnKBn5WzzDxSVM5yj64+JGY0swu7fpbjMLuZOzlx+z2JBwaa+zNM:DBszDxSVM5664+JGY0st3MaZueCtBM
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:3a:8d:c1:14:39:2a:bb:93:e5:6e:11:1e:32:7c:c9:95:4d:f2:e0:ca:ed:0c:1e:38:d2:43:c0:07:4c:3e:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
PE Signature issue
Digest
11:3a:8d:c1:14:39:2a:bb:93:e5:6e:11:1e:32:7c:c9:95:4d:f2:e0:ca:ed:0c:1e:38:d2:43:c0:07:4c:3e:d9
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
Subject
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:e5:ce:9e:eb:de:4d:48:35:f4:00:00:00:00:00:e5
Issuer
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 2, 2023 - Jan 31, 2024
Subject
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 1, 2013 - May 1, 2028
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:3c:2b:0a:49:d9:d2:91:7e:ac:00:00:00:00:03:3c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 16, 2023 - Jan 31, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
6
Entry point
20449
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\MFCM140U.amd64.pdb
kernel32
DecodePointer
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
TerminateProcess
GetCurrentProcess
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-crt-heap-l1-1-0
free
_callnewh
malloc
vcruntime140
__FrameUnwindFilter
_CxxThrowException
_purecall
memset
__current_exception
__C_specific_handler
__std_exception_copy
memcpy
__current_exception_context
__std_type_info_destroy_list
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
user32
CopyRect
GetWindow
SetWindowPos
PostMessageW
SendMessageW
GetClientRect
mfc140u
ord5227
ord7922
ord9941
ord7461
ord6256
ord2344
ord13499
ord7460
ord5749
ord5062
ord5229
ord5083
ord5569
ord5339
ord9041
ord5552
ord5363
ord2336
ord2234
ord5080
ord473
ord2212
ord7389
ord3504
ord12025
ord2527
ord2519
ord4250
ord13198
ord13197
ord7450
ord4334
ord8042
ord13862
ord13760
ord8506
ord13131
ord5236
ord7549
ord13766
ord8470
ord8467
ord5346
ord12611
ord13496
ord7835
ord7838
ord3795
ord3201
ord3202
ord8900
ord2222
ord2221
ord269
ord1503
ord1031
ord1641
ord1033
ord3847
ord2314
ord4006
ord3208
ord6128
ord6722
ord2497
ord823
ord1343
ord7173
ord11902
ord7424
ord6074
ord11851
ord11805
ord3713
ord371
ord8917
ord3205
ord10199
ord3172
ord11435
ord8614
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_crt_atexit
_initterm
_initterm_e
terminate
abort
_register_onexit_function
_cexit
_initialize_narrow_environment
mscoree
_CorDllMain
AfxmReleaseManagedReferences
Name
.text
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.nep
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
660B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=260, version=29395,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=6, id=257, version=32420,
count=8, id=260, version=32420,
count=3, id=259, version=32420,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=257, version=29395,
count=177, id=1, productName=Unmarked objects,
count=38, id=261, version=32420,
count=1, id=256, version=32420,
count=1, id=255, version=32420,
count=1, id=258, version=32420,
rasadhlp.dll
- IMPHASH feaf8ef2a61d5237fd324d1624a3894b
- SHA256 81a4eecae1d6be831a6a720fdab12095cc5ce009798b551de802252a44dad425
- MD5 339501f87253fc863acede45ee251f75
- SHA1 c51a9ba91d05fc12f7cda33bdb160186d21d123c
- SHA512 246eb46bd457a8b91d9a84b607a4c197ade81cc9d79920785c801f1405b2d05d3769e74bae56046697806668e6e82991187f024c122cbf341715b98bcd1e3941
- SSDEEP 192:5/q7AhoBPt+AJHBefST3TPpTG67lQupK6ZmfDMZTmQBoyEtq6vaeqWpYW:M5Pt3JhYUnXolqIqWpYW
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
5280
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
rasadhlp.pdb
msvcrt
__C_specific_handler
free
_amsg_exit
_XcptFilter
memcpy
_initterm
_strlwr
malloc
memset
ntdll
RtlCaptureContext
NtCreateFile
NtDeviceIoControlFile
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlVirtualUnwind
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
FreeLibrary
GetProcAddress
DisableThreadLibraryCalls
api-ms-win-core-registry-l1-1-0
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
api-ms-win-core-heap-obsolete-l1-1-0
LocalFree
LocalAlloc
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-string-l1-1-0
WideCharToMultiByte
api-ms-win-core-synch-l1-1-0
WaitForSingleObject
CreateEventW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
AcsHlpNbConnection
WSAttemptAutodialAddr
WSAttemptAutodialName
WSNoteSuccessfulHostentLookup
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
528B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
44B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=259, version=27412,
count=11, id=260, version=27412,
count=47, id=1, productName=Unmarked objects,
count=5, id=257, version=27412,
count=1, id=256, version=27412,
count=5, id=269, version=27412,
count=1, id=255, version=27412,
count=1, id=258, version=27412,
umpdc.dll
- IMPHASH 171c26bd72218e670b2c74db98a744ab
- SHA256 52149a7fee76e2022a8b71467b512073c0ac3b10ac763f232adfb38f69ae057c
- MD5 c836a39340a6981ff4ee71e8903df93b
- SHA1 f17a1e567fdc6ccec0333f4cdc64c1a4ce4a0948
- SHA512 1e1498f8c8923ccd4c6e9b80947a18ba11aa8633d9be3a32ce91839346397e2074636424ad23f439d6b2fa55a567c8933ceb81b1b4047a2a7c22ac9cff24bb2e
- SSDEEP 1536:xMwE8iBRdHEZvGD1+q6J0tUobNbBPUQSGcNP19zl:qzRdkZvGD1+q6UUobNbBcQSGwt9B
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
6d:ff:ff:ac:d1:4a:f1:b5:59:9f:b9:b9:38:15:58:e2:1d:d4:b4:ca:69:1e:6c:4b:15:8d:00:60:39:1e:a9:ab
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 19, 2024
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 3, 2023 - Feb 1, 2024
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Oct 19, 2011 - Oct 19, 2026
Minor OS version
0
Major OS version
10
Entry point
15920
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
UMPDC.pdb
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
api-ms-win-crt-private-l1-1-0
_o__cexit
_o__configure_narrow_argv
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__seh_filter_dll
memcpy
__C_specific_handler
_o___std_type_info_destroy_list
api-ms-win-crt-string-l1-1-0
memset
ntdll
ZwClose
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
TpWaitForAlpcCompletion
ZwAlpcConnectPort
RtlWaitOnAddress
RtlInitUnicodeString
ZwAlpcQueryInformation
TpReleaseAlpcCompletion
EtwEventWriteTransfer
ZwAlpcDisconnectPort
TpAllocAlpcCompletion
RtlWakeAddressAll
ZwAlpcCancelMessage
RtlFreeHeap
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EtwEventSetInformation
NtPowerInformation
EtwEventRegister
EtwEventUnregister
vDbgPrintEx
ZwAlpcSendWaitReceivePort
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount64
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-libraryloader-l1-2-0
GetModuleHandleExW
GetModuleFileNameW
api-ms-win-core-synch-l1-1-0
CreateMutexW
WaitForSingleObjectEx
InitializeSRWLock
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseMutex
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-threadpool-l1-2-0
CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpool
CreateThreadpool
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
PdcAcquireRwLockExclusive
PdcActivationClientActivityRequest
PdcActivationClientRegister
PdcActivationClientUnregister
PdcAllocate
PdcFree
PdcNotificationClientAcknowledge
PdcNotificationClientRegister
PdcNotificationClientUnregister
PdcPortClose
PdcPortOpen
PdcPortSendMessage
PdcPortSendMessageSynchronously
PdcPpmProfileClientRegister
PdcPpmProfileClientUnregister
PdcPpmProfileDisable
PdcPpmProfileEnable
PdcReleaseRwLockExclusive
PdcResiliencyClientAcknowledge
PdcResiliencyClientRegister
PdcResiliencyClientUnregister
PdcRwLockInitialize
PdcSignalClientPulse
PdcSignalClientRegister
PdcSignalClientSetActive
PdcSignalClientUnregister
PdcSleep
PdcTaskClientRegister
PdcTaskClientRequest
PdcTaskClientUnregister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientRegister
Pdcv2ActivationClientRenewActivation
Pdcv2ActivationClientSetBrokeredProcessId
Pdcv2ActivationClientUnregister
SleepstudyHelperBlockerActiveDereference
SleepstudyHelperBlockerActiveReference
SleepstudyHelperBuildBlocker
SleepstudyHelperCreateBlockerFromGuid
SleepstudyHelperCreateLibrary
SleepstudyHelperDestroyBlocker
SleepstudyHelperDestroyBlockerBuilder
SleepstudyHelperDestroyLibrary
SleepstudyHelperGetBlockerGuid
SleepstudyHelperSetBlockerFriendlyName
SleepstudyHelperSetBlockerParentHandle
SleepstudyHelperSetBlockerVisible
Name
.text
Size
34KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
76B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=257, version=27412,
count=39, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1116, id=1, productName=Unmarked objects,
count=9, id=260, version=27412,
count=2, id=259, version=27412,
count=1, id=256, version=27412,
count=15, id=269, version=27412,
count=13, id=261, version=27412,
count=1, id=253, version=27412,
count=1, id=258, version=27412,